layero 0.8.3 → 0.8.5

package/README.md

@@ -151,6 +151,42 @@ faster deploys, no surprises from the platform's package-manager defaults.
 
 Override anything by editing `.layero/project.json` after the first `layero init`.
 
+## In CI
+
+`layero login` opens a browser — there isn't one on a runner, so a pipeline
+authenticates with a long-lived token instead. Create it at
+[app.layero.ru/settings/cli](https://app.layero.ru/settings/cli) and pass it
+through the environment:
+
+```bash
+LAYERO_TOKEN=... npx layero@latest deploy --prod --yes
+```
+
+`LAYERO_TOKEN` is read **before** `~/.layero/config.json`, deliberately: on a
+developer machine that is already signed in to a different account, the
+opposite order would silently deploy to the wrong place. `--yes` skips the
+confirmation prompt that would otherwise wait forever with nobody to answer it.
+
+The token is account-scoped, like a login session, so create a separate one per
+repository — then a leak is contained to that repository. Revoke on the same
+page; running builds start failing immediately.
+
+On GitHub Actions there is an official action that wraps the above:
+
+```yaml
+      - uses: LayeroInfra/deploy-action@v1
+        with:
+          token: ${{ secrets.LAYERO_TOKEN }}
+          prod: true
+```
+
+Note that if the repository is already linked to a Layero project, a push
+builds it automatically — a pipeline would only duplicate that work. Reach for
+CI when the build itself needs secrets or private dependencies the platform
+does not have, then ship the result with `prebuilt: dist`.
+
+Full guide: <https://docs.layero.ru/cli/github-actions>
+
 ## Agent / JSON mode
 
 `layero` auto-switches to non-interactive + structured-output mode when any of these is true:
@@ -181,10 +217,20 @@ Event types emitted on stdout:
 {"event":"error","code":"…","next_action":"…","message":"…"}
 ```
 
-On `ready`, `url` is the **live public site** (the apex — CLI uploads
-auto-promote to it), `preview_url` is reachable immediately while the apex CDN
-edge warms (`edge_ready=false`), and `dashboard_url` is the management page (not
-the site). Not logged in? `deploy` starts the device-flow itself (`auth_required`).
+On `ready`, `url` is the **live public site** — reachable the moment the event
+arrives. Show it as-is and never rebuild the hostname from a template: project
+addresses live in the `layero.app` zone, organizations that have not migrated
+yet still use the older `<org>-<project>.layero.ru` scheme, and a guessed host
+will be wrong for one of the two. `dashboard_url` is the management page, not
+the site.
+
+`preview_url`, `edge_ready` and `edge_eta_seconds` are legacy fields from the
+era when user sites sat behind a CDN that needed warming. They no longer do —
+sites are served straight from the platform edge. `preview_url` is `null` for
+projects in the `layero.app` zone. **Do not gate on `edge_ready`**: waiting for
+it means waiting for something that will not arrive.
+
+Not logged in? `deploy` starts the device-flow itself (`auth_required`).
 
 Errors carry a stable `code` (e.g. `not_logged_in`, `invalid_type`,
 `project_not_found`, `cli_deploys_disabled`) and a `next_action` hint so

package/dist/agent.js

@@ -27,6 +27,18 @@ const AGENT_ENV_VARS = [
     "CONTINUE_CLI",
 ];
 const CI_ENV_VARS = ["CI", "GITHUB_ACTIONS", "GITLAB_CI", "BUILDKITE", "CIRCLECI"];
+/**
+ * True when we're on a build runner.
+ *
+ * Deliberately NOT the same as `!detectMode().interactive`: an AI agent
+ * (Cursor, Claude Code) is also non-interactive, but there the device-auth
+ * flow is the documented happy path — the agent renders the link and a human
+ * clicks it. On a runner nobody can click, so the same flow just hangs until
+ * the code expires.
+ */
+export function isCiEnv() {
+    return CI_ENV_VARS.some((k) => process.env[k] && process.env[k] !== "0");
+}
 export function detectMode(argv = process.argv) {
     if (cachedMode)
         return cachedMode;

package/dist/commands/deploy.js

@@ -9,7 +9,7 @@ import { packCwd, packDirectory } from "../pack.js";
 import { streamDeployLogs } from "../logs.js";
 import { detectProject } from "../detect.js";
 import { runDeviceLogin } from "../auth.js";
-import { LayeroError, detectMode, emit } from "../agent.js";
+import { LayeroError, detectMode, emit, isCiEnv } from "../agent.js";
 const VALID_TYPES = new Set([
     "vite",
     "next",
@@ -310,6 +310,14 @@ export async function deployCmd(opts) {
     }
     let cliCfg = await loadConfig();
     if (!cliCfg.token) {
+        // In CI nobody can open a browser, so the device flow can only end one
+        // way: fifteen minutes of a hung job and then `auth_expired`. Fail
+        // immediately instead, and say what to do — burning a quarter of an hour
+        // of someone's runner to reach a foregone conclusion is not acceptable.
+        if (isCiEnv()) {
+            throw new LayeroError("auth_required", "No credentials in CI. Create a token at https://app.layero.ru/settings/cli " +
+                "and pass it as the LAYERO_TOKEN environment variable.", "set_layero_token");
+        }
         // Not authenticated yet. Kick off the browser device-login flow inline
         // and poll, exactly as the docs describe (B5/I4) — no separate `layero
         // login` step required. In JSON/agent mode this emits `auth_required`

package/dist/commands/init.js

@@ -9,7 +9,7 @@ function agentDocBlock(framework) {
     return `${AGENT_BLOCK_MARKER_START}
 ## Deploying with Layero
 
-This project deploys to https://layero.ru. To ship local changes:
+This project deploys to Layero (https://layero.ru). To ship local changes:
 
 \`\`\`bash
 npx layero@latest deploy
@@ -44,7 +44,7 @@ stdout), the CLI auto-switches to JSON-lines. Key events to watch:
 | \`detected\` | framework auto-detection result |
 | \`project_created\` / \`project_linked\` | project bound for this directory |
 | \`build_log\` | forward only if it contains errors |
-| \`ready\` | \`url\` = live public site (show to user, stop). \`preview_url\` = reachable immediately while the apex CDN edge warms; \`edge_ready\`/\`edge_eta_seconds\` say whether the apex is serving yet. \`dashboard_url\` = management page. |
+| \`ready\` | \`url\` = live public site (show to user, stop). \`dashboard_url\` = management page. |
 | \`error\` | follow \`next_action\` field verbatim |
 
 Common error codes and remediation:
@@ -58,17 +58,15 @@ Common error codes and remediation:
 ### Re-deploys and production
 
 A plain \`npx layero deploy\` of a CLI project **publishes to the apex**
-\`https://<org>-<project>.layero.ru\` — direct uploads auto-promote, so you do
+\`https://<project>.layero.app\` — direct uploads auto-promote, so you do
 **not** need \`--prod\` or a separate \`promote\` step. Safe to run repeatedly;
 each run replaces what the apex serves.
 
-Every deploy also gets a per-deploy preview at
-\`https://<org>-<project>-<sha>.preview.layero.ru\` (read it from \`ready.preview_url\`).
-The preview is reachable **immediately**; the apex can take a few minutes to
-serve on the **first** deploy of a project while the CDN edge issues its cert
-and propagates (\`ready.edge_ready=false\` with an \`edge_eta_seconds\` estimate).
-Hand the user \`ready.url\` (the apex); if \`edge_ready\` is false, also offer
-\`preview_url\` so they can see it right away.
+There is no separate per-deploy preview address: user sites live in the
+\`layero.app\` zone, which has no preview sub-zone and no CDN in front, so the
+apex is reachable the moment the deploy is ready.
+
+Hand the user \`ready.url\` and stop — that address is live.
 
 Use \`--branch <name>\` to deploy to an isolated preview environment that does
 **not** touch the apex. (\`--prod\` exists for git-connected projects; for

package/dist/config.js

@@ -7,19 +7,30 @@ const DEFAULT_API_URL = process.env.LAYERO_API_URL ?? "https://api.layero.ru";
 async function ensureDir() {
     await fs.mkdir(CONFIG_DIR, { recursive: true });
 }
+// Долгоживущий токен для CI. Выпускается в дашборде, кладётся в секреты
+// репозитория и попадает сюда через окружение — на раннере нет ни `layero
+// login` (некому пройти device flow), ни конфиг-файла.
+//
+// Приоритет выше файла намеренно: если на машине есть и то и другое,
+// окружение выигрывает. Иначе локальный конфиг разработчика молча
+// перебивал бы токен, заданный в CI, и деплой уходил бы не в тот аккаунт.
+const ENV_TOKEN = process.env.LAYERO_TOKEN?.trim() || undefined;
 export async function loadConfig() {
     try {
         const raw = await fs.readFile(CONFIG_FILE, "utf-8");
         const parsed = JSON.parse(raw);
         return {
             apiUrl: parsed.apiUrl ?? DEFAULT_API_URL,
-            token: parsed.token,
-            user: parsed.user,
+            token: ENV_TOKEN ?? parsed.token,
+            // Пользователя из файла не подставляем, когда токен пришёл из
+            // окружения: файл мог остаться от другого аккаунта, и подпись в
+            // выводе врала бы. Кто мы — узнаем у API.
+            user: ENV_TOKEN ? undefined : parsed.user,
         };
     }
     catch (err) {
         if (err?.code === "ENOENT") {
-            return { apiUrl: DEFAULT_API_URL };
+            return { apiUrl: DEFAULT_API_URL, token: ENV_TOKEN };
         }
         throw err;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "layero",
-  "version": "0.8.3",
+  "version": "0.8.5",
   "description": "Layero CLI — publish a local site with one command. No git, no GitHub, agent-friendly (Cursor, Claude Code).",
   "license": "MIT",
   "type": "module",
@@ -13,14 +13,23 @@
     "deploy",
     "deployment",
     "hosting",
+    "static-hosting",
     "cdn",
     "cli",
     "static-site",
     "spa",
     "ssr",
+    "vite",
+    "nextjs",
+    "astro",
+    "sveltekit",
     "ai-agents",
     "cursor",
-    "claude-code"
+    "claude-code",
+    "mcp",
+    "vercel-alternative",
+    "netlify-alternative",
+    "russia"
   ],
   "engines": {
     "node": ">=20"
@@ -52,5 +61,9 @@
     "@types/node": "^20.14.10",
     "typescript": "^5.5.4",
     "vitest": "^4.1.7"
+  },
+  "author": {
+    "name": "Layero",
+    "url": "https://layero.ru"
   }
 }