layero 0.9.4 → 0.10.0

package/dist/commands/init.js

@@ -1,96 +1,73 @@
 import { promises as fs } from "node:fs";
 import path from "node:path";
-import chalk from "chalk";
 import { detectProject } from "../detect.js";
-import { emit, detectMode } from "../agent.js";
+import { emit } from "../agent.js";
 const AGENT_BLOCK_MARKER_START = "<!-- layero:start -->";
 const AGENT_BLOCK_MARKER_END = "<!-- layero:end -->";
 function agentDocBlock(framework) {
+    // Компактный индекс, а не ссылка на навык: по evals Vercel блок в
+    // AGENTS.md агент выполняет надёжнее (100 % против 79 % у навыка).
+    // Полная версия — навык `layero` в LayeroInfra/layero-agents; здесь —
+    // то, без чего первый деплой не случится. Коды ошибок сверяет
+    // `check-error-codes.py`: не перечислять здесь то, чего CLI не выдаёт.
     return `${AGENT_BLOCK_MARKER_START}
-## Deploying with Layero
+## Layero
 
-This project deploys to Layero (https://layero.ru). To ship local changes:
+This project deploys to Layero (https://layero.ru) — hosting with build servers
+in Russia. Full agent skill: https://github.com/LayeroInfra/layero-agents
+(\`npx skills add LayeroInfra/layero-agents\`, Claude Code:
+\`claude plugin marketplace add LayeroInfra/layero-agents && claude plugin install layero@layero\`).
+Docs for agents: https://docs.layero.ru/agents/
 
-\`\`\`bash
-npx layero@latest deploy
-\`\`\`
-
-Detected framework: **${framework}**. No git repository or GitHub connection
-is required — Layero packs and uploads the local directory directly.
-
-### First-time auth (one-click device flow)
-
-If you're not logged in yet, \`npx layero@latest deploy\` (or \`… login\`)
-starts the browser device-flow automatically and emits a JSON line:
-
-\`\`\`json
-{"event":"auth_required","url":"https://app.layero.ru/cli?code=ABCD-1234","user_code":"ABCD-1234"}
-\`\`\`
-
-Render the \`url\` as a clickable link in chat. The user opens it, signs in
-(by an emailed code or with Yandex ID — Layero creates the account on first sign-in),
-clicks "Разрешить доступ", and the CLI's poll loop picks up the token within
-2 seconds. No localhost server is involved — the browser can be on a
-different machine than the CLI.
-
-### JSON-lines events
-
-When run inside an agent (\`CURSOR_AGENT\`, \`CLAUDECODE\`, or any non-TTY
-stdout), the CLI auto-switches to JSON-lines. Key events to watch:
-
-| event | meaning |
-|---|---|
-| \`auth_required\` | render \`url\` as a link, keep waiting |
-| \`detected\` | framework auto-detection result |
-| \`project_created\` / \`project_linked\` | project bound for this directory |
-| \`build_log\` | forward only if it contains errors |
-| \`ready\` | \`url\` = live public site (show to user, stop). \`dashboard_url\` = management page. |
-| \`error\` | follow \`next_action\` field verbatim |
-
-Common error codes and remediation:
-
-- \`auth_required\` → run \`npx layero@latest login\`, or set \`LAYERO_TOKEN\`
-- \`auth_expired\` / \`auth_timeout\` → user did not approve in time, re-run login
-- \`project_unknown\` → run from the project directory, or pass \`--project\`
-- \`invalid_type\` → drop \`--type\`, rely on auto-detect
-- \`cli_deploys_disabled\` → user must enable CLI deploys in project settings
-- \`deploy_failed\` → check the dashboard URL in the message
-- \`internal\` → unexpected CLI error; re-run with \`--debug\`
+### Three paths — pick by situation
 
-There is no \`not_logged_in\`, \`deploy_error\` or \`deploy_timed_out\` — do not
-branch on codes that are not listed here.
+1. **Repository connected** (GitHub, GitVerse, GitLab, GitFlic, SourceCraft) —
+   push to a branch = preview, push to \`main\` = production. Connect one with
+   \`npx layero@latest projects create --repo <provider>:<owner/repo>\`.
+2. **A directory with code** (this project, framework: **${framework}**) —
+   \`npx layero@latest deploy --json\`. The CLI packs the directory, the
+   platform builds it. No git repository is needed for this path.
+3. **A site already on Layero** — \`npx layero@latest diagnose\`, \`logs\`,
+   \`rollback\`, \`domains\`, \`env\`, \`envs list\`, or the MCP server
+   \`https://mcp.layero.ru/mcp\`.
 
-### Re-deploys and production
-
-A plain \`npx layero deploy\` of a CLI project **publishes to the apex**
-\`https://<project>.layero.app\` — direct uploads auto-promote, so you do
-**not** need \`--prod\` or a separate \`promote\` step. Safe to run repeatedly;
-each run replaces what the apex serves.
-
-There is no separate per-deploy preview address: user sites live in the
-\`layero.app\` zone, which has no preview sub-zone and no CDN in front, so the
-apex is reachable the moment the deploy is ready.
-
-Hand the user \`ready.url\` and stop — that address is live.
-
-There is no way to publish without replacing the live site from the CLI:
-\`--branch\` is accepted and **silently ignored** — archive uploads are always
-filed under the reserved \`cli\` environment. If the user asks for a version
-"just to look at" that leaves the live address alone, tell them it needs a
-connected repository and a push to a branch. (\`--prod\` exists for
-git-connected projects; for direct CLI uploads it's redundant.)
-
-### Already built? Skip the server build
-
-If the site is already built locally (e.g. a Next.js static export in \`out/\`,
-or a \`dist/\`), ship the artifact directly and skip the server-side
-\`npm install\` + build:
+### Deploy from this directory
 
 \`\`\`bash
-npx layero@latest deploy --prebuilt out
+npx layero@latest deploy --json
 \`\`\`
 
-Full reference: https://docs.layero.ru/en/cli/agents
+Not logged in? The command starts the browser device flow itself and prints
+\`{"event":"auth_required","url":"…","user_code":"…"}\` — show \`url\` as a
+clickable link and keep waiting; the CLI polls every 2 s. No localhost
+callback: the browser may be on another machine. In CI use
+\`LAYERO_TOKEN=… npx layero@latest deploy --project <slug> --json --yes\`.
+No account at all? \`npx layero@latest deploy --claim\` publishes to a
+temporary project for 72 hours and prints a \`claim_url\` for a human to
+take it over.
+
+Key JSON events: \`detected\` (framework), \`project_created\` /
+\`project_linked\`, \`build_log\` (forward only lines with errors),
+\`claimable\` (\`claim_url\`, \`expires_at\`), \`ready\` — \`url\` is the live
+site: show it as-is and stop; \`dashboard_url\` is the panel, not the site.
+\`error\` — follow \`next_action\` verbatim.
+
+Exit codes: 0 ok · 2 auth (\`auth_required\`, \`auth_expired\`, \`auth_timeout\`) ·
+3 not found (\`project_unknown\`, \`project_not_found\`) · 4 invalid input
+(\`invalid_type\`, \`prebuilt_no_dir\`, \`branch_unsupported\`) · 5 remote
+(\`deploy_failed\`, \`internal\`). Codes \`not_logged_in\`, \`deploy_error\`,
+\`deploy_timed_out\` do not exist — do not branch on them.
+
+### Rules
+
+- Re-running \`deploy\` is safe and reuses the project; no commit needed.
+- A plain \`deploy\` of a CLI project **replaces the live site** at
+  \`ready.url\`: direct uploads auto-promote. \`--branch\` is refused
+  (\`branch_unsupported\`) — isolated previews come from pushing a branch of
+  a connected repository, nothing else.
+- Already built locally? \`npx layero@latest deploy --prebuilt <dir>\`.
+- Never \`git init\` just to deploy, never \`npm install -g layero\`, never
+  build the site address from a template — only \`ready.url\`.
 ${AGENT_BLOCK_MARKER_END}
 `;
 }
@@ -172,7 +149,6 @@ async function ensureGitignore(cwd) {
 }
 export async function initCmd(opts) {
     const cwd = process.cwd();
-    const mode = detectMode();
     const detected = await detectProject(cwd);
     emit({
         event: "detected",
@@ -182,6 +158,7 @@ export async function initCmd(opts) {
         confident: detected.confident,
     });
     const block = agentDocBlock(detected.framework_hint);
+    const agentDocs = [];
     if (!opts.skipAgentDocs) {
         // Touch every agent-doc convention we know about. If one already
         // exists we update it in-place; otherwise we create only the most
@@ -201,20 +178,15 @@ export async function initCmd(opts) {
         const targets = existing.length > 0 ? existing : ["AGENTS.md"];
         for (const f of targets) {
             const result = await upsertAgentDoc(cwd, f, block);
-            if (mode.interactive) {
-                console.log(chalk.green(`  ${result === "created" ? "✓ created" : result === "updated" ? "✓ updated" : "= unchanged"} ${f}`));
-            }
+            agentDocs.push({ file: f, result });
         }
     }
     const pjResult = await ensureProjectJson(cwd, detected.framework_hint, detected.build_cmd, detected.output_dir);
-    if (mode.interactive) {
-        console.log(chalk.green(`  ${pjResult === "created" ? "✓ created" : "= unchanged"} .layero/project.json`));
-    }
     await ensureGitignore(cwd);
-    if (mode.interactive) {
-        console.log("");
-        console.log(chalk.bold("Next:"));
-        console.log("  $ npx layero login    # one-time, in your browser");
-        console.log("  $ npx layero deploy   # ship the current directory");
-    }
+    emit({
+        event: "init_done",
+        framework: detected.framework_hint,
+        agent_docs: agentDocs,
+        project_json: pjResult,
+    });
 }

package/dist/commands/link.js

@@ -1,40 +1,27 @@
-import chalk from "chalk";
 import { ApiClient } from "../api.js";
 import { loadConfig } from "../config.js";
 import { persistProjectLinking } from "../project-config.js";
+import { LayeroError, emit } from "../agent.js";
 export async function linkCmd(idOrSlug) {
     const cfg = await loadConfig();
     if (!cfg.token) {
-        console.error(chalk.yellow("not logged in. run `layero login` first."));
-        process.exitCode = 1;
-        return;
+        throw new LayeroError("auth_required", "вход не выполнен", "выполните `layero login` или задайте LAYERO_TOKEN");
     }
     const api = new ApiClient(cfg);
-    // The backend accepts UUIDs only on /projects/{id}; for slug we fall back
-    // to listing — this is fine because users typically have <100 projects.
-    let proj;
-    try {
-        proj = await api.getProject(idOrSlug);
-    }
-    catch {
-        const all = await api.listProjects();
-        const match = all.find((p) => p.slug === idOrSlug);
-        if (!match) {
-            console.error(chalk.red(`no project with id/slug "${idOrSlug}"`));
-            process.exitCode = 1;
-            return;
-        }
-        proj = match;
-    }
+    // Слаг или id — различает клиент по форме значения (`resolveProject`):
+    // UUID, ушедший в поиск по слагу, не нашёлся бы.
+    const proj = await api.resolveProject(idOrSlug);
     await persistProjectLinking(process.cwd(), {
         project_id: proj.id,
         slug: proj.slug,
         organization_slug: proj.organization.slug,
         apex_hostname: proj.apex_hostname,
     }, proj.framework_hint ?? null);
-    console.log(chalk.green(`linked ${proj.slug} (${proj.id}) → ./.layero/project.json`));
-    if (proj.status === "pending_setup") {
-        console.log(chalk.yellow("  note: project is in pending_setup. finish the setup wizard in the dashboard, " +
-            "or run `layero deploy` to upload source and get the wizard URL."));
-    }
+    emit({
+        event: "project_linked",
+        project_id: proj.id,
+        slug: proj.slug,
+        url: `https://${proj.apex_hostname}`,
+        status: proj.status,
+    });
 }

package/dist/commands/logout.js

@@ -1,6 +1,6 @@
-import chalk from "chalk";
 import { clearConfig, configPath } from "../config.js";
+import { emit } from "../agent.js";
 export async function logoutCmd() {
     await clearConfig();
-    console.log(chalk.green(`logged out (removed ${configPath()})`));
+    emit({ event: "logged_out", config_path: configPath() });
 }

package/dist/commands/orgs.js

@@ -1,24 +1,20 @@
-import chalk from "chalk";
 import { ApiClient } from "../api.js";
 import { loadConfig } from "../config.js";
-/** `layero orgs list` — show every Layero organization the caller belongs to.
+import { LayeroError, emit } from "../agent.js";
+/** `layero orgs list` — организации аккаунта: личная и команды.
  *
- * Useful before `layero deploy --org=<slug>` so the user can see which
- * slugs to pass without leaving the terminal.
+ * Нужна перед `layero deploy --org=<slug>`, чтобы увидеть слаги, не выходя
+ * из терминала.
  */
 export async function orgsListCmd() {
     const cfg = await loadConfig();
-    if (!cfg.token)
-        throw new Error("not logged in. run `layero login` first.");
+    if (!cfg.token) {
+        throw new LayeroError("auth_required", "вход не выполнен", "выполните `layero login` или задайте LAYERO_TOKEN");
+    }
     const api = new ApiClient(cfg);
     const orgs = await api.listOrganizations();
-    if (orgs.length === 0) {
-        console.log(chalk.dim("no organizations on this account."));
-        return;
-    }
-    for (const o of orgs) {
-        const kindBadge = o.kind === "personal" ? chalk.dim("personal") : chalk.cyan("team");
-        const roleBadge = chalk.dim(`(${o.my_role})`);
-        console.log(`  ${chalk.bold(o.slug.padEnd(20))} ${kindBadge}  ${roleBadge}`);
-    }
+    emit({
+        event: "organizations",
+        organizations: orgs.map((o) => ({ id: o.id, slug: o.slug, kind: o.kind, role: o.my_role })),
+    });
 }

package/dist/commands/projects.js

@@ -1,21 +1,188 @@
-import chalk from "chalk";
-import { ApiClient } from "../api.js";
+import readline from "node:readline/promises";
+import { ApiClient, ApiError } from "../api.js";
 import { loadConfig } from "../config.js";
-export async function projectsListCmd() {
+import { LayeroError, detectMode, emit } from "../agent.js";
+import { orgOf } from "./db.js";
+async function makeClient() {
     const cfg = await loadConfig();
     if (!cfg.token) {
-        console.error(chalk.yellow("not logged in. run `layero login` first."));
-        process.exitCode = 1;
-        return;
+        throw new LayeroError("auth_required", "вход не выполнен", "выполните `layero login` или задайте LAYERO_TOKEN");
     }
-    const api = new ApiClient(cfg);
+    return new ApiClient(cfg);
+}
+export async function projectsListCmd() {
+    const api = await makeClient();
     const list = await api.listProjects();
-    if (list.length === 0) {
-        console.log("no projects yet — `layero deploy` to create one.");
+    emit({
+        event: "projects",
+        projects: list.map((p) => ({
+            id: p.id,
+            slug: p.slug,
+            name: p.name,
+            organization: p.organization.slug,
+            url: `https://${p.apex_hostname}`,
+            source_type: p.source_type,
+            repo: p.repo_full_name ?? null,
+            status: p.status,
+        })),
+    });
+}
+/**
+ * `<provider>:<owner/repo>` → провайдер и путь. Путь у GitLab бывает
+ * вложенным (`group/sub/project`) — режем только по ПЕРВОМУ двоеточию.
+ */
+export function parseRepoRef(raw) {
+    const idx = raw.indexOf(":");
+    const provider = idx > 0 ? raw.slice(0, idx).trim().toLowerCase() : "";
+    const path = (idx > 0 ? raw.slice(idx + 1) : raw).trim().replace(/^\/+|\/+$/g, "");
+    if (!provider || !path.includes("/")) {
+        throw new LayeroError("repo_format", `не разобрать «${raw}»`, "формат: --repo <provider>:<owner/repo>, например --repo github:acme/site или --repo gitverse:acme/site; провайдеры — `layero sources list`");
+    }
+    return { provider, path };
+}
+/**
+ * `layero projects create --repo <provider>:<owner/repo>` — проект из
+ * репозитория без панели (этап 6 AX-аудита). Раньше путь (a) «есть
+ * репозиторий» начинался с кнопки «Импорт из репозитория», и агент, у
+ * которого панели нет, был вынужден выбирать путь (b) — заливать папку.
+ *
+ * GitHub — через ключ аккаунта установки App: сервер заводит проект и
+ * вебхук одним вызовом, иного режима у App нет. Остальные провайдеры — в два
+ * шага: проект, затем `connect-source`, потому что только он возвращает
+ * судьбу вебхука, а без вебхука push не собирается, и молчать об этом нельзя.
+ */
+export async function projectsCreateCmd(opts) {
+    if (!opts.repo) {
+        throw new LayeroError("repo_format", "не указан репозиторий", "`layero projects create --repo <provider>:<owner/repo>`; папку без репозитория выкладывает `layero deploy`");
+    }
+    const { provider, path } = parseRepoRef(opts.repo);
+    const api = await makeClient();
+    const org = await orgOf(api, opts);
+    const accounts = await api.listImportAccounts(org);
+    const candidates = accounts.filter((a) => a.provider === provider);
+    if (candidates.length === 0) {
+        const known = [...new Set(accounts.map((a) => a.provider))];
+        throw new LayeroError("account_not_found", `в организации «${org}» нет подключения к ${provider}`, known.length
+            ? `подключены: ${known.join(", ")}; добавить — \`layero sources connect ${provider} --token-stdin\``
+            : `добавьте подключение: \`layero sources connect ${provider} --token-stdin\` (GitHub — установкой App в панели)`);
+    }
+    const account = candidates.find((a) => a.status === "active" && a.can_import !== false) ?? candidates[0];
+    if (account.status !== "active" || account.can_import === false) {
+        throw new LayeroError("account_not_found", `подключение ${provider} (${account.login}) в состоянии ${account.status}${account.status_note ? `: ${account.status_note}` : ""}`, account.configure_url ?? "переподключите провайдер: `layero sources connect …`");
+    }
+    // Репозиторий сверяем по списку аккаунта: опечатка в пути даёт понятный
+    // отказ здесь, а не 502 от провайдера после создания проекта.
+    const repos = await api.listImportRepos(org, account.key);
+    const repo = repos.find((r) => r.path.toLowerCase() === path.toLowerCase());
+    if (!repo) {
+        const sample = repos.slice(0, 8).map((r) => r.path).join(", ");
+        throw new LayeroError("repo_not_found", `репозиторий «${path}» не виден подключению ${provider} (${account.login})`, sample ? `доступны: ${sample}${repos.length > 8 ? ", …" : ""}` : "у подключения нет ни одного репозитория");
+    }
+    if (repo.imported_project_ids.length > 0) {
+        throw new LayeroError("repo_already_imported", `репозиторий «${repo.path}» уже привязан к проекту ${repo.imported_project_ids.join(", ")}`, "`layero link <id>` — привязать папку к нему; второй проект из того же репозитория заводится в панели");
+    }
+    const branch = opts.branch ?? repo.default_branch ?? "main";
+    const name = opts.name ?? repo.name;
+    let project;
+    if (account.key.startsWith("github:")) {
+        project = await api.createProjectFromAccount({
+            name,
+            organization_slug: org,
+            source_account_key: account.key,
+            repo_path: repo.path,
+            default_branch: branch,
+        });
+        emitCreated(project, repo.path, branch);
+        emit({ event: "source_connected", org, connection_id: account.key, provider, account: account.login });
+        // У GitHub App вебхук — часть установки: без него App не существует.
+        emit({ event: "webhook_installed", project: project.slug, url: "" });
         return;
     }
-    for (const p of list) {
-        const tag = p.source_type === "cli" ? chalk.magenta("[cli]") : chalk.blue("[gh] ");
-        console.log(`${tag} ${chalk.bold(p.slug)}  ${chalk.dim(p.id)}  https://${p.apex_hostname}`);
+    const connectionId = account.key.replace(/^connection:/, "");
+    project = await api.createCliProject({ name, organization_slug: org });
+    let connected;
+    try {
+        connected = await api.connectSource(project.id, {
+            connection_id: connectionId,
+            repo_path: repo.path,
+            branch,
+        });
+    }
+    catch (err) {
+        // Проект без источника бесполезен и занимает адрес — убираем. Удаление
+        // требует scope admin; без него проект останется, и мы это скажем.
+        let cleaned = false;
+        try {
+            await api.deleteProject(project.id);
+            cleaned = true;
+        }
+        catch {
+            /* нет прав или сеть — скажем словами ниже */
+        }
+        const reason = err instanceof ApiError ? err.body.slice(0, 300) : String(err);
+        throw new LayeroError("source_connect_failed", `репозиторий не привязался: ${reason}`, cleaned
+            ? "проект удалён; проверьте токен подключения (`layero sources list`) и повторите"
+            : `проект ${project.slug} создан без репозитория — привяжите в панели или удалите: \`layero projects delete ${project.slug} --yes\``);
+    }
+    emitCreated(connected.project, repo.path, branch);
+    emit({ event: "source_connected", org, connection_id: connectionId, provider, account: account.login });
+    if (connected.webhook_registered) {
+        emit({ event: "webhook_installed", project: connected.project.slug, url: connected.webhook_url });
+    }
+    else {
+        emit({
+            event: "webhook_unavailable",
+            project: connected.project.slug,
+            url: connected.webhook_url,
+            hint: connected.webhook_hint ??
+                "провайдер не дал создать вебхук этим токеном — заведите его в настройках репозитория вручную",
+        });
+    }
+}
+function emitCreated(project, repo, branch) {
+    emit({
+        event: "project_created",
+        project_id: project.id,
+        slug: project.slug,
+        organization: project.organization.slug,
+        url: `https://${project.apex_hostname}`,
+        repo,
+        branch,
+    });
+}
+/**
+ * `layero projects delete <slug> --yes` — необратимо. Маршрут требует у
+ * токена scope `admin`: токен по умолчанию (`read`+`deploy`) получит
+ * `forbidden`, и это правильно — агент с деплой-токеном не должен уметь
+ * снести проект.
+ */
+export async function projectsDeleteCmd(ref, opts) {
+    const api = await makeClient();
+    const project = await api.resolveProject(ref);
+    const mode = detectMode();
+    if (!opts.yes) {
+        if (!mode.interactive) {
+            throw new LayeroError("confirmation_required", `удаление проекта ${project.slug} (${project.apex_hostname}) необратимо, а подтвердить его здесь некому`, `покажите это человеку и повторите с --yes: \`layero projects delete ${project.slug} --yes\``);
+        }
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+        try {
+            const answer = (await rl.question(`Удалить проект ${project.slug} и сайт https://${project.apex_hostname}? Необратимо. Введите слаг для подтверждения: `)).trim();
+            if (answer !== project.slug) {
+                throw new LayeroError("confirmation_required", "удаление отменено", "введите слаг проекта точно, как показан");
+            }
+        }
+        finally {
+            rl.close();
+        }
+    }
+    try {
+        await api.deleteProject(project.id);
+    }
+    catch (err) {
+        if (err instanceof ApiError && err.status === 403) {
+            throw new LayeroError("forbidden", "удаление проекта требует токена со scope admin", "выпустите токен: `layero token create <имя> --scope admin` — или удалите проект в панели");
+        }
+        throw err;
     }
+    emit({ event: "project_deleted", project_id: project.id, slug: project.slug });
 }

package/dist/commands/sources.js

@@ -0,0 +1,127 @@
+import { ApiClient, ApiError } from "../api.js";
+import { loadConfig } from "../config.js";
+import { LayeroError, emit } from "../agent.js";
+import { orgOf } from "./db.js";
+async function makeClient() {
+    const cfg = await loadConfig();
+    if (!cfg.token) {
+        throw new LayeroError("auth_required", "вход не выполнен", "выполните `layero login` или задайте LAYERO_TOKEN");
+    }
+    return new ApiClient(cfg);
+}
+/** `layero sources list` — провайдеры, которые платформа умеет, и подключения организации. */
+export async function sourcesListCmd(opts) {
+    const api = await makeClient();
+    const org = await orgOf(api, opts);
+    const [providers, connections] = await Promise.all([
+        api.listSourceProviders(org),
+        api.listSourceConnections(org),
+    ]);
+    emit({
+        event: "sources",
+        org,
+        providers: providers.map((p) => ({
+            id: p.id,
+            title: p.title,
+            self_hosted: p.self_hosted,
+            webhook_supported: p.webhook_supported,
+            token_hint: p.token_hint ?? null,
+        })),
+        connections: connections.map((c) => ({
+            id: c.id,
+            provider: c.provider_id,
+            account: c.external_account,
+            status: c.status,
+            projects_count: c.projects_count,
+            token_expiry_state: c.token_expiry_state,
+            last_error: c.last_error,
+        })),
+    });
+}
+/** Читает stdin целиком — для `--token-stdin`. */
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks).toString("utf-8");
+}
+/**
+ * `layero sources connect <provider> --token-stdin` — подключить провайдера
+ * по PAT. Токен принимается флагом `--token` (для скриптов, где история не
+ * пишется) и через stdin (`--token-stdin`): в истории shell и в транскрипте
+ * агента `--token ghp_…` остаётся навсегда, а `echo $PAT | … --token-stdin`
+ * — нет. Сервер проверяет токен до записи и наружу его не возвращает.
+ *
+ * Список провайдеров — `/organizations/{slug}/source-providers`: сверяем до
+ * запроса, чтобы опечатка дала список, а не 400.
+ */
+export async function sourcesConnectCmd(provider, opts) {
+    const api = await makeClient();
+    const org = await orgOf(api, opts);
+    const providers = await api.listSourceProviders(org);
+    const spec = providers.find((p) => p.id === provider.trim().toLowerCase());
+    if (!spec) {
+        throw new LayeroError("provider_unknown", `провайдера «${provider}» нет`, `доступны: ${providers.map((p) => p.id).join(", ")}; GitHub подключается установкой App в панели`);
+    }
+    if (opts.baseUrl && !spec.self_hosted) {
+        throw new LayeroError("bad_format", `${spec.title} не поддерживает собственный инстанс`, "уберите --base-url");
+    }
+    let token = (opts.token ?? "").trim();
+    if (opts.tokenStdin) {
+        token = (await readStdin()).trim();
+    }
+    if (!token) {
+        throw new LayeroError("token_missing", "не передан токен провайдера", `${spec.token_hint ? spec.token_hint + ". " : ""}Передайте его через stdin: \`echo "$PAT" | layero sources connect ${spec.id} --token-stdin\``);
+    }
+    let created;
+    try {
+        created = await api.createSourceConnection(org, {
+            provider_id: spec.id,
+            token,
+            display_name: opts.name ?? null,
+            base_url: opts.baseUrl ?? null,
+        });
+    }
+    catch (err) {
+        if (err instanceof ApiError && err.status === 502) {
+            throw new LayeroError("source_rejected", `${spec.title} не принял токен: ${err.body.slice(0, 300)}`, spec.token_hint ?? "проверьте токен и его права");
+        }
+        throw err;
+    }
+    emit({
+        event: "source_connected",
+        org,
+        connection_id: created.id,
+        provider: created.provider_id,
+        account: created.external_account,
+    });
+}
+/** `layero sources repos <connection_id>` — репозитории, видимые токену подключения. */
+export async function sourcesReposCmd(connectionId, opts) {
+    const api = await makeClient();
+    const org = await orgOf(api, opts);
+    let repos;
+    try {
+        repos = await api.listSourceRepos(org, connectionId);
+    }
+    catch (err) {
+        if (err instanceof ApiError && err.status === 404) {
+            throw new LayeroError("connection_not_found", `в организации «${org}» нет подключения ${connectionId}`, "`layero sources list`");
+        }
+        throw err;
+    }
+    emit({
+        event: "source_repos",
+        org,
+        connection_id: connectionId,
+        repos: repos.map((r) => ({
+            path: r.path,
+            name: r.name,
+            default_branch: r.default_branch,
+            private: r.private,
+            can_admin: r.can_admin,
+            updated_at: r.updated_at,
+        })),
+    });
+}

package/dist/commands/whoami.js

@@ -1,19 +1,18 @@
-import chalk from "chalk";
 import { ApiClient } from "../api.js";
 import { loadConfig } from "../config.js";
+import { LayeroError, emit } from "../agent.js";
 export async function whoamiCmd() {
     const cfg = await loadConfig();
     if (!cfg.token) {
-        console.error(chalk.yellow("not logged in. run `layero login` first."));
-        process.exitCode = 1;
-        return;
+        throw new LayeroError("auth_required", "вход не выполнен", "выполните `layero login` или задайте LAYERO_TOKEN");
     }
     const api = new ApiClient(cfg);
     const me = await api.me();
-    console.log(`id:     ${me.id}`);
-    console.log(`username: ${me.username ?? chalk.yellow("(not set)")}`);
-    console.log(`email:  ${me.email ?? "(none)"}`);
-    if (me.github_login) {
-        console.log(`github: ${me.github_login}`);
-    }
+    emit({
+        event: "me",
+        id: me.id,
+        username: me.username ?? null,
+        email: me.email ?? null,
+        github_login: me.github_login ?? null,
+    });
 }