layero 0.8.11 → 0.8.13

package/dist/bin/layero.js

@@ -17,6 +17,7 @@ import { loginCmd } from "../commands/login.js";
 import { orgsListCmd } from "../commands/orgs.js";
 import { initCmd } from "../commands/init.js";
 import { LayeroError, detectMode, emit } from "../agent.js";
+import { notifyIfOutdated } from "../update-notifier.js";
 // Read version from the shipped package.json (two levels up from dist/bin/).
 const pkgPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "package.json");
 const VERSION = JSON.parse(readFileSync(pkgPath, "utf-8")).version;
@@ -143,7 +144,9 @@ async function main() {
     });
     program
         .command("rollback")
-        .description("Re-activate the previous successful deploy on the project's default branch.")
+        .description("Re-activate the previous successful deploy on a branch environment. " +
+        "DOES NOT move the production pointer — the apex keeps serving whatever " +
+        "it served before. To bring production back, use `layero promote <sha>`.")
         .option("--project <id_or_slug>", "target project (default: linked .layero/project.json)")
         .option("--branch <name>", "branch to roll back (default: project's default_branch)")
         .option("--deploy <id_or_sha>", "explicit deploy id or commit sha prefix to roll back to")
@@ -180,7 +183,10 @@ async function main() {
         .option("--root <dir>", "monorepo: subdirectory inside the repo that the builder treats as the app root (saved on the project; future GitHub-push and hook triggers use the same value)")
         .option("--prod", "deploy to production (replaces apex_hostname's active deploy). Without this flag, deploys go to the project's CLI preview pseudo-branch.")
         .option("--promote", "pin the project apex to this deploy after a successful build (V071). Works for any branch — e.g. `--promote` without --prod publishes a CLI preview straight to production.")
-        .option("--branch <name>", "deploy to a specific branch's environment. Wins over --prod.")
+        .option("--branch <name>", "ACCEPTED BUT IGNORED for direct uploads: the backend files every " +
+        "archive deploy under the reserved `cli` environment. Branch " +
+        "environments come from pushes to a connected repository, not from " +
+        "this flag. Kept for backwards compatibility.")
         .option("--org <slug>", "Layero organization slug for first-time project creation. Defaults to personal; required when you're a member of multiple orgs and want a non-personal home.")
         .addHelpText("after", "\nExamples:\n" +
         "  $ layero deploy                      # preview deploy (CLI pseudo-branch), auto-detect framework\n" +
@@ -194,6 +200,9 @@ async function main() {
         await deployCmd(opts);
     });
     await program.parseAsync(process.argv);
+    // AFTER the command, so the nag never delays real work — and on stderr, so
+    // `--json` stdout stays parseable. Bounded + never-throwing by construction.
+    await notifyIfOutdated(VERSION);
 }
 main().catch((err) => {
     const mode = detectMode();

package/dist/commands/init.js

@@ -85,7 +85,7 @@ or a \`dist/\`), ship the artifact directly and skip the server-side
 npx layero@latest deploy --prebuilt out
 \`\`\`
 
-Full reference: https://docs.layero.ru/cli/agents
+Full reference: https://docs.layero.ru/en/cli/agents
 ${AGENT_BLOCK_MARKER_END}
 `;
 }

package/dist/update-notifier.js

@@ -0,0 +1,125 @@
+/**
+ * Tell the user when their CLI is behind the published version.
+ *
+ * WHY this exists (2026-07-27): a stale CLI silently withholds every fix we
+ * ship. The `project_type` auto-flip for runtime apps landed 2026-05-26, yet
+ * prod still logged 20 failed deploys across 16 projects over the following
+ * month with "this repo looks like 'ssr_next' but the project is configured as
+ * 'spa'" — the exact crash that fix prevents. The machine that found this was
+ * itself running 0.5.3 against a published 0.8.11 and had never been told.
+ *
+ * A version nag is therefore not cosmetic: it is the delivery mechanism for
+ * every stability fix that already exists.
+ *
+ * Constraints this respects, in order of importance:
+ *   1. NEVER corrupt `--json`. Agents and CI parse stdout as JSON-lines, so the
+ *      notice goes to STDERR, always, in every mode.
+ *   2. NEVER slow a deploy down. One 1.5s-timeout request, at most once every
+ *      CHECK_INTERVAL_MS, and the result is cached on disk.
+ *   3. NEVER fail a command. Every path swallows its errors — an offline
+ *      machine, a proxy, a corrupt cache file must all be silent no-ops.
+ */
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import path from "node:path";
+import os from "node:os";
+const REGISTRY_URL = "https://registry.npmjs.org/layero/latest";
+const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // once a day is plenty
+const FETCH_TIMEOUT_MS = 1500;
+function cachePath() {
+    return path.join(os.homedir(), ".layero", "update-check.json");
+}
+/** -1 = a < b, 0 = equal, 1 = a > b. Plain numeric semver; a pre-release tag
+ *  (1.2.3-beta.1) compares by its numeric core, which is all we need here. */
+export function compareVersions(a, b) {
+    const core = (v) => (v.split("-")[0] ?? "").split(".").map((n) => parseInt(n, 10) || 0);
+    const [x, y] = [core(a), core(b)];
+    for (let i = 0; i < Math.max(x.length, y.length); i++) {
+        const d = (x[i] ?? 0) - (y[i] ?? 0);
+        if (d !== 0)
+            return d > 0 ? 1 : -1;
+    }
+    return 0;
+}
+async function readCache() {
+    try {
+        const raw = await readFile(cachePath(), "utf-8");
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.checked_at !== "number" || typeof parsed.latest !== "string")
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+async function writeCache(latest) {
+    try {
+        await mkdir(path.dirname(cachePath()), { recursive: true });
+        await writeFile(cachePath(), JSON.stringify({ checked_at: Date.now(), latest }), "utf-8");
+    }
+    catch {
+        /* a read-only HOME must not break the CLI */
+    }
+}
+async function fetchLatest() {
+    try {
+        const ctl = new AbortController();
+        const timer = setTimeout(() => ctl.abort(), FETCH_TIMEOUT_MS);
+        try {
+            const res = await fetch(REGISTRY_URL, {
+                signal: ctl.signal,
+                headers: { accept: "application/vnd.npm.install-v1+json" },
+            });
+            if (!res.ok)
+                return null;
+            const body = (await res.json());
+            return typeof body.version === "string" ? body.version : null;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve the newest published version, using the on-disk cache when fresh.
+ * Returns null when unknown (offline, throttled, first run with no network).
+ */
+export async function resolveLatest(now = Date.now()) {
+    const cached = await readCache();
+    if (cached && now - cached.checked_at < CHECK_INTERVAL_MS)
+        return cached.latest;
+    const latest = await fetchLatest();
+    if (latest)
+        await writeCache(latest);
+    return latest ?? cached?.latest ?? null;
+}
+/** The notice text, or null when the CLI is current. Pure — unit-testable. */
+export function updateNotice(current, latest) {
+    if (!latest)
+        return null;
+    if (compareVersions(current, latest) >= 0)
+        return null;
+    return (`\n  Доступна новая версия Layero CLI: ${current} → ${latest}\n` +
+        `  Обновиться:  npm i -g layero@latest\n` +
+        `  Старые версии не получают исправлений сборки и деплоя.\n`);
+}
+/**
+ * Best-effort check + print to stderr. Awaiting this is safe: it is bounded by
+ * FETCH_TIMEOUT_MS and never rejects. Opt out with LAYERO_NO_UPDATE_CHECK=1.
+ */
+export async function notifyIfOutdated(current) {
+    try {
+        if (process.env.LAYERO_NO_UPDATE_CHECK)
+            return;
+        const notice = updateNotice(current, await resolveLatest());
+        // stderr on purpose — stdout is the JSON-lines channel for agents.
+        if (notice)
+            process.stderr.write(notice);
+    }
+    catch {
+        /* a version nag must never be the reason a deploy fails */
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "layero",
-  "version": "0.8.11",
+  "version": "0.8.13",
   "description": "Layero CLI \u2014 publish a local site with one command. No git, no GitHub, agent-friendly (Cursor, Claude Code).",
   "license": "MIT",
   "type": "module",