layero 0.11.23 → 0.11.25

package/README.md

@@ -368,6 +368,12 @@ Full reference: <https://docs.layero.ru/cli/json-events>
 `node_modules`, `.git`, `dist`, `build`, `.next`, `.env*`, `.DS_Store`, and
 the rule files themselves. Maximum archive size is 500 MB.
 
+Env files (`.env`, `.env.*`) stay out even if `.gitignore` un-ignores them
+(`!.env.example`, `!.env`): those rules are written for git, not for a
+deploy. To upload an env file on purpose, name it in `.layeroignore`:
+`!.env.production`. Broad negations like `!*` do not bring env files back,
+and nothing brings back `.git`, `.layero` or the rule files.
+
 ## Config
 
 - Auth token: `~/.layero/config.json` (chmod 600). Claim tokens of temporary

package/dist/api.js

@@ -285,6 +285,19 @@ export class ApiClient {
         return this.request("POST", `/organizations/${org}/databases/${dbId}/api/storage/session`);
     }
     /** Настройки входа: незаданное не трогается (R2-08 — имя отправителя писем). */
+    /** Всё о входе базы: провайдеры (без ключей), способы, адреса возврата (R2-18). */
+    getDataAuthState(org, dbId) {
+        return this.request("GET", `/organizations/${org}/databases/${dbId}/api/auth/providers`);
+    }
+    setDataAuthProvider(org, dbId, input) {
+        return this.request("PUT", `/organizations/${org}/databases/${dbId}/api/auth/providers`, input);
+    }
+    setDataAuthProviderOptions(org, dbId, provider, input) {
+        return this.request("PUT", `/organizations/${org}/databases/${dbId}/api/auth/providers/${encodeURIComponent(provider)}/options`, input);
+    }
+    deleteDataAuthProvider(org, dbId, provider) {
+        return this.request("DELETE", `/organizations/${org}/databases/${dbId}/api/auth/providers/${encodeURIComponent(provider)}`);
+    }
     setDataAuthSettings(org, dbId, input) {
         return this.request("PUT", `/organizations/${org}/databases/${dbId}/api/auth/settings`, input);
     }

package/dist/commands/data-auth.js

@@ -0,0 +1,209 @@
+// `layero data auth …` — вход пользователей приложения из терминала (R2-18, 27.10.2026).
+//
+// Раньше провайдеры (Яндекс, VK ID, Сбер ID), их адреса возврата и способы
+// входа включались только в панели — единственный шаг эталонного приложения
+// без команды. Ручки сервера те же, что у панели.
+//
+// ⚠️ Секрет провайдера НЕ принимается аргументом: аргумент оседает в истории
+// shell и в списке процессов. Только stdin или переменная окружения.
+import chalk from "chalk";
+import { LayeroError, detectMode, emit } from "../agent.js";
+import { target } from "./data-api.js";
+const PROVIDERS = ["yandex", "vkid", "sber"];
+const TITLE = { yandex: "Яндекс", vkid: "VK ID", sber: "Сбер ID" };
+function asJson(opts) {
+    return detectMode().json || Boolean(opts.json);
+}
+function provider(name) {
+    const p = name.trim().toLowerCase();
+    if (!PROVIDERS.includes(p)) {
+        throw new LayeroError("invalid_choice", `провайдер «${name}» не поддержан`, `доступны: ${PROVIDERS.join(", ")}`);
+    }
+    return p;
+}
+function onOff(flag, value) {
+    if (value === undefined)
+        return undefined;
+    const v = value.trim().toLowerCase();
+    if (["on", "yes", "true", "1"].includes(v))
+        return true;
+    if (["off", "no", "false", "0"].includes(v))
+        return false;
+    throw new LayeroError("invalid_choice", `${flag}: ждали on или off, а пришло «${value}»`, `пример: ${flag} on`);
+}
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(chunk);
+    return Buffer.concat(chunks).toString("utf8").trim();
+}
+export async function dataAuthStatusCmd(opts) {
+    const { api, org, db, ref } = await target(opts);
+    const s = await api.getDataAuthState(org, db.id);
+    const providers = (s.providers ?? []).map((p) => ({
+        provider: p.provider, configured: Boolean(p.configured), enabled: Boolean(p.enabled),
+        checked_at: p.checked_at ?? null, return_urls: p.return_urls ?? [],
+    }));
+    const methods = {
+        password: s.password_enabled ?? null, link: s.magiclink_enabled ?? null,
+        signup_open: s.signup_open ?? null, confirm_email: s.confirm_email ?? null,
+    };
+    if (asJson(opts)) {
+        emit({ event: "data_auth_status", org, database: ref, callback_url: s.callback_url ?? null,
+            providers, methods, email_return_urls: s.email_return_urls ?? [] });
+        return;
+    }
+    const yn = (v) => (v === null ? "—" : v ? "да" : "нет");
+    console.log(chalk.bold("Способы входа"));
+    console.log(`  по паролю: ${yn(methods.password)}, по ссылке из письма: ${yn(methods.link)}, ` +
+        `регистрация открыта: ${yn(methods.signup_open)}, подтверждение почты: ${yn(methods.confirm_email)}`);
+    console.log(chalk.bold("\nПровайдеры"));
+    for (const p of providers) {
+        const state = p.enabled ? chalk.green("включён") : p.configured ? chalk.yellow("ключи есть, выключен") : chalk.dim("не подключён");
+        console.log(`  ${TITLE[p.provider] ?? p.provider}: ${state}`);
+    }
+    if (s.callback_url)
+        console.log(chalk.dim(`\nАдрес возврата для консоли провайдера: ${s.callback_url}`));
+}
+export async function dataAuthProviderSetCmd(name, opts) {
+    const p = provider(name);
+    if (!opts.clientId) {
+        throw new LayeroError("bad_format", "не задан Client ID", `layero data auth provider set ${p} --client-id <id>`);
+    }
+    let secret = "";
+    if (p !== "vkid") {
+        if (opts.secretFromEnv) {
+            secret = process.env[opts.secretFromEnv] ?? "";
+            if (!secret)
+                throw new LayeroError("bad_format", `переменная окружения ${opts.secretFromEnv} пуста или не задана`, "задайте её или передайте секрет через stdin");
+        }
+        else if (!process.stdin.isTTY) {
+            secret = await readStdin();
+        }
+        if (!secret) {
+            throw new LayeroError("bad_format", `у ${TITLE[p]} нужен секрет`, `передайте его через stdin или --secret-from-env: printf %s "$SECRET" | layero data auth provider set ${p} --client-id <id>`);
+        }
+    }
+    const { api, org, db, ref } = await target(opts);
+    await api.setDataAuthProvider(org, db.id, { provider: p, client_id: opts.clientId, client_secret: secret });
+    const s = await api.getDataAuthState(org, db.id);
+    if (asJson(opts)) {
+        emit({ event: "data_auth_provider_set", org, database: ref, provider: p, callback_url: s.callback_url ?? null });
+        return;
+    }
+    console.log(`${chalk.green("✓")} вход через ${TITLE[p]} подключён`);
+    if (s.callback_url)
+        console.log(chalk.dim(`  впишите в консоли провайдера адрес возврата: ${s.callback_url}`));
+    console.log(chalk.dim("  проверьте вход в панели: Авторизация → Способы входа → «Проверить вход»"));
+}
+export async function dataAuthProviderToggleCmd(name, enabled, opts) {
+    const p = provider(name);
+    const { api, org, db, ref } = await target(opts);
+    await api.setDataAuthProviderOptions(org, db.id, p, { enabled });
+    if (asJson(opts)) {
+        emit({ event: "data_auth_provider_toggled", org, database: ref, provider: p, enabled });
+        return;
+    }
+    console.log(`${chalk.green("✓")} вход через ${TITLE[p]} ${enabled ? "включён" : "выключен, ключи сохранены"}`);
+}
+export async function dataAuthProviderRemoveCmd(name, opts) {
+    const p = provider(name);
+    const { api, org, db, ref } = await target(opts);
+    if (!opts.yes) {
+        throw new LayeroError("confirmation_required", `удаление ключей ${TITLE[p]} не подтверждено`, `повторите с --yes: layero data auth provider remove ${p} --yes`);
+    }
+    await api.deleteDataAuthProvider(org, db.id, p);
+    if (asJson(opts)) {
+        emit({ event: "data_auth_provider_removed", org, database: ref, provider: p });
+        return;
+    }
+    console.log(`${chalk.green("✓")} ключи ${TITLE[p]} удалены, вход через него закрыт`);
+}
+/** `email` — адреса возврата писем входа, иначе — провайдера. */
+export async function dataAuthRedirectsCmd(action, method, url, opts) {
+    const m = method.trim().toLowerCase() === "email" ? "email" : provider(method);
+    if (action !== "list" && !url) {
+        throw new LayeroError("bad_format", "не задан адрес", `layero data auth redirects ${action} ${m} https://shop.example/auth`);
+    }
+    if (url && !/^https?:\/\//i.test(url)) {
+        throw new LayeroError("bad_format", `адрес «${url}» должен начинаться с http:// или https://`, "пример: https://shop.example/auth");
+    }
+    const { api, org, db, ref } = await target(opts);
+    const s = await api.getDataAuthState(org, db.id);
+    const current = m === "email"
+        ? (s.email_return_urls ?? [])
+        : ((s.providers ?? []).find((p) => p.provider === m)?.return_urls ?? []);
+    let next = current;
+    if (action === "add")
+        next = current.includes(url) ? current : [...current, url];
+    if (action === "remove")
+        next = current.filter((u) => u !== url);
+    if (action !== "list") {
+        if (m === "email")
+            await api.setDataAuthSettings(org, db.id, { email_return_urls: next });
+        else
+            await api.setDataAuthProviderOptions(org, db.id, m, { return_urls: next });
+    }
+    if (asJson(opts)) {
+        emit({ event: "data_auth_redirects", org, database: ref, method: m, urls: next });
+        return;
+    }
+    console.log(chalk.bold(`Адреса возврата: ${m === "email" ? "письма входа" : TITLE[m]}`));
+    for (const u of next)
+        console.log(`  ${u}`);
+    if (!next.length)
+        console.log(chalk.dim("  нет — после входа человек вернётся на адрес подключённого проекта"));
+}
+export async function dataAuthMethodsCmd(opts) {
+    const patch = {};
+    const set = (key, flag, value) => {
+        const v = onOff(flag, value);
+        if (v !== undefined)
+            patch[key] = v;
+    };
+    set("password_enabled", "--password", opts.password);
+    set("magiclink_enabled", "--link", opts.link);
+    set("signup_open", "--signup", opts.signup);
+    set("confirm_email", "--confirm-email", opts.confirmEmail);
+    if (!Object.keys(patch).length) {
+        throw new LayeroError("nothing_to_set", "не задан ни один способ", "пример: layero data auth methods --password on --link off --signup on");
+    }
+    const { api, org, db, ref } = await target(opts);
+    await api.setDataAuthSettings(org, db.id, patch);
+    if (asJson(opts)) {
+        emit({ event: "data_auth_methods_set", org, database: ref, changed: patch });
+        return;
+    }
+    console.log(`${chalk.green("✓")} способы входа обновлены: ${Object.entries(patch).map(([k, v]) => `${k}=${v ? "on" : "off"}`).join(", ")}`);
+}
+export function registerDataAuthCommands(auth, withDb, json) {
+    withDb(auth.command("status").description("Sign-in methods, providers and the callback URL for the provider console."))
+        .action(async (opts) => dataAuthStatusCmd(json(opts)));
+    const prov = auth.command("provider").description("External providers: yandex, vkid, sber.");
+    withDb(prov
+        .command("set <provider>")
+        .description("Save the provider's keys and enable it. The secret is read from stdin or --secret-from-env (VK ID has none).")
+        .requiredOption("--client-id <id>", "Client ID from the provider's console")
+        .option("--secret-from-env <var>", "take the secret from this environment variable")
+        .addHelpText("after", '\nExample:\n  $ printf %s "$YANDEX_SECRET" | layero data auth provider set yandex --client-id 1a2b3c')).action(async (name, opts) => dataAuthProviderSetCmd(name, json(opts)));
+    withDb(prov.command("on <provider>").description("Enable a provider whose keys are saved."))
+        .action(async (name, opts) => dataAuthProviderToggleCmd(name, true, json(opts)));
+    withDb(prov.command("off <provider>").description("Disable a provider, keeping its keys."))
+        .action(async (name, opts) => dataAuthProviderToggleCmd(name, false, json(opts)));
+    withDb(prov.command("remove <provider>").description("Delete the provider's keys.").option("-y, --yes", "do not ask for confirmation"))
+        .action(async (name, opts) => dataAuthProviderRemoveCmd(name, json(opts)));
+    const red = auth.command("redirects").description("Where the app may send people back after sign-in: per provider, or `email` for sign-in emails.");
+    withDb(red.command("list <method>").description("Return addresses of a provider or of `email`."))
+        .action(async (method, opts) => dataAuthRedirectsCmd("list", method, undefined, json(opts)));
+    withDb(red.command("add <method> <url>").description("Allow a return address."))
+        .action(async (method, url, opts) => dataAuthRedirectsCmd("add", method, url, json(opts)));
+    withDb(red.command("remove <method> <url>").description("Remove a return address."))
+        .action(async (method, url, opts) => dataAuthRedirectsCmd("remove", method, url, json(opts)));
+    withDb(auth
+        .command("methods")
+        .description("Turn sign-in methods on or off.")
+        .option("--password <on|off>", "email and password")
+        .option("--link <on|off>", "link or code from an email")
+        .option("--signup <on|off>", "new users may register")
+        .option("--confirm-email <on|off>", "require email confirmation")).action(async (opts) => dataAuthMethodsCmd(json(opts)));
+}

package/dist/commands/data-files.js

@@ -6,6 +6,7 @@
 import chalk from "chalk";
 import { LayeroError, detectMode, emit } from "../agent.js";
 import { target } from "./data-api.js";
+import { registerDataAuthCommands } from "./data-auth.js";
 function asJson(opts) {
     return detectMode().json || Boolean(opts.json);
 }
@@ -124,7 +125,8 @@ export function registerDataFilesCommands(data, withDb, json) {
         .option("--max <size>", "file size limit: 5MB, 512KB or bytes")
         .option("--types <list>", "allowed MIME types, comma-separated: image/jpeg,image/png")
         .addHelpText("after", "\nExample:\n  $ layero data buckets create screenshots --private --max 5MB --types image/jpeg,image/png")).action(async (name, opts) => dataBucketsCreateCmd(name, json(opts)));
-    const auth = data.command("auth").description("Sign-in settings that used to live only in the dashboard.");
+    const auth = data.command("auth").description("Sign-in of the app's users: status, providers (Yandex, VK ID, Sber ID), return addresses, methods, sender name.");
+    registerDataAuthCommands(auth, withDb, json);
     withDb(auth
         .command("sender <name>")
         .description("The sender name of sign-in emails (codes, links, password reset).")

package/dist/pack.js

@@ -60,11 +60,50 @@ const FORCE_INCLUDE_LOCKFILES = [
     "pnpm-lock.yaml",
     "npm-shrinkwrap.json",
 ];
-async function buildIgnore(cwd) {
+// Env files carry secrets. In the `ignore` package the last matching rule
+// wins, so a `.gitignore` written for git — `!.env.example`, or `!.env` in a
+// monorepo that commits a shared one — used to pull env files back into the
+// archive. A static site without a build serves the archive as-is, so that
+// `.env` ended up readable at the site's address.
+//
+// The exclusion is therefore re-applied after each user layer. The only way
+// back in is an explicit negation in `.layeroignore` that names an env file
+// (`!.env.production`): a deliberate, Layero-specific choice. `.gitignore`
+// never overrides it, and neither do broad `.layeroignore` negations such as
+// `!*`.
+//
+// The same broad negation would also have pulled back the other things that
+// must never reach a site: VCS metadata (remote credentials live in
+// `.git/config`), the CLI's own `.layero/` (claim tokens) and the rule files
+// themselves. They get the same treatment, with no way back in at all.
+const ENV_EXCLUDE = [".env", ".env.*"];
+const ALWAYS_EXCLUDE = [
+    ...ENV_EXCLUDE,
+    ".git",
+    ".svn",
+    ".hg",
+    ".layero",
+    ".gitignore",
+    ".layeroignore",
+];
+/** Negations from `.layeroignore` that explicitly name an env file. */
+function explicitEnvNegations(lines) {
+    return lines.filter((l) => l.startsWith("!") && l.includes(".env"));
+}
+async function userLayers(cwd) {
+    const gitignore = await readIgnoreFile(path.join(cwd, ".gitignore"));
+    const layeroignore = await readIgnoreFile(path.join(cwd, ".layeroignore"));
     const ig = ignore();
     ig.add(DEFAULT_IGNORE);
-    ig.add(await readIgnoreFile(path.join(cwd, ".gitignore")));
-    ig.add(await readIgnoreFile(path.join(cwd, ".layeroignore")));
+    ig.add(gitignore);
+    ig.add(ALWAYS_EXCLUDE);
+    ig.add(layeroignore);
+    ig.add(ALWAYS_EXCLUDE);
+    ig.add(explicitEnvNegations(layeroignore));
+    return ig;
+}
+async function buildIgnore(cwd) {
+    const ig = await userLayers(cwd);
     // Negations last so they win over any ignore rule above.
     ig.add(FORCE_INCLUDE_LOCKFILES.map((f) => `!/${f}`));
     return ig;
@@ -106,10 +145,7 @@ async function sha256OfFile(p) {
  * negations, so it reflects exactly what the user's .gitignore/.layeroignore
  * would have excluded. */
 async function detectForcedLockfiles(cwd) {
-    const probe = ignore();
-    probe.add(DEFAULT_IGNORE);
-    probe.add(await readIgnoreFile(path.join(cwd, ".gitignore")));
-    probe.add(await readIgnoreFile(path.join(cwd, ".layeroignore")));
+    const probe = await userLayers(cwd);
     const forced = [];
     for (const lf of FORCE_INCLUDE_LOCKFILES) {
         if (!probe.ignores(lf))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "layero",
-  "version": "0.11.23",
+  "version": "0.11.25",
   "description": "Layero CLI — deploy a directory or a repo to hosting with build servers in Russia. JSON events and exit codes for AI agents and CI.",
   "license": "MIT",
   "type": "module",