@cloudbase/cli 3.0.0-alpha.6 → 3.0.0-alpha.8

package/dist/standalone/cli.js

@@ -296103,6 +296103,1034 @@ function SchemaObject(obj) {
 module.exports = __webpack_require__(91010);
 
 
+/***/ }),
+
+/***/ 2604:
+/***/ (function(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.RoleDeleteCommand = exports.RoleUpdateCommand = exports.RoleCreateCommand = exports.RoleGetCommand = exports.RoleListCommand = void 0;
+const common_1 = __webpack_require__(48431);
+const chalk_1 = __importDefault(__webpack_require__(15896));
+const decorators_1 = __webpack_require__(93480);
+const error_1 = __webpack_require__(66759);
+const utils_1 = __webpack_require__(82079);
+const i18n_1 = __webpack_require__(69258);
+const PRESET_POLICY_EFFECT_MAP = {
+    AdministratorAccess: 'allow',
+    FunctionsAccess: 'allow',
+    StoragesAccess: 'allow',
+    CloudrunAccess: 'allow',
+    FunctionsDeny: 'deny',
+    StoragesDeny: 'deny',
+    CloudrunDeny: 'deny',
+};
+function getPermissionService(envId) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const app = yield (0, utils_1.getMangerService)(envId);
+        return app.permission;
+    });
+}
+function printRole(role, log, detail, roleType) {
+    const roleId = role.RoleId || '-';
+    const name = role.RoleName || '-';
+    const identity = role.RoleIdentity || '-';
+    log.info(`  ${(0, i18n_1.t)('• {{name}} ({{identity}})', {
+        name: chalk_1.default.bold.cyan(name),
+        identity: chalk_1.default.bold(identity)
+    })}`);
+    log.info(`    ${(0, i18n_1.t)('角色ID')}: ${roleId}`);
+    log.info(`    ${(0, i18n_1.t)('类型')}: ${roleType}`);
+    if (role.Description) {
+        log.info(`    ${(0, i18n_1.t)('描述')}: ${role.Description}`);
+    }
+    if (detail) {
+        const members = role.Members || [];
+        if (members.length === 0) {
+            log.info(`    ${(0, i18n_1.t)('成员')}: -`);
+        }
+        else {
+            log.info(`    ${(0, i18n_1.t)('成员')}: ${JSON.stringify(members, null, 2).split('\n').map((line, i) => i === 0 ? line : '      ' + line).join('\n')}`);
+        }
+        const policies = role.Policies || [];
+        if (policies.length === 0) {
+            log.info(`    ${(0, i18n_1.t)('策略')}: -`);
+        }
+        else {
+            log.info(`    ${(0, i18n_1.t)('策略')}: ${JSON.stringify(policies, null, 2).split('\n').map((line, i) => i === 0 ? line : '      ' + line).join('\n')}`);
+        }
+    }
+}
+function parseUsers(usersInput) {
+    if (!usersInput)
+        return [];
+    return usersInput
+        .split(',')
+        .map((item) => item.trim())
+        .filter(Boolean);
+}
+function normalizeGatewayPolicy(item) {
+    if (typeof item === 'string') {
+        const code = item.trim();
+        if (!code) {
+            throw new error_1.CloudBaseError({
+                message: (0, i18n_1.t)('策略 code 不能为空'),
+                code: 'INVALID_PARAM'
+            });
+        }
+        return {
+            ResourceType: 'gateway',
+            Resource: code,
+            GatewayPolicyCode: code,
+            Effect: PRESET_POLICY_EFFECT_MAP[code]
+        };
+    }
+    if (!item || typeof item !== 'object' || Array.isArray(item)) {
+        throw new error_1.CloudBaseError({
+            message: (0, i18n_1.t)('策略项必须是字符串或对象'),
+            code: 'INVALID_PARAM',
+            solution: [(0, i18n_1.t)('示例: "FunctionsAccess" 或 {"code":"custom_api","expression":{...}}')]
+        });
+    }
+    const code = (item.code || '').trim();
+    if (!code) {
+        throw new error_1.CloudBaseError({
+            message: (0, i18n_1.t)('自定义策略缺少 code（GatewayPolicyCode）'),
+            code: 'INVALID_PARAM',
+            solution: [(0, i18n_1.t)('示例: {"code":"custom_api","name":"API策略","expression":{...}}')]
+        });
+    }
+    let expression;
+    if (item.expression !== undefined) {
+        const isPlainObject = typeof item.expression === 'object' &&
+            item.expression !== null &&
+            !Array.isArray(item.expression);
+        if (!isPlainObject) {
+            throw new error_1.CloudBaseError({
+                message: (0, i18n_1.t)('策略 expression 必须是 JSON 对象'),
+                code: 'INVALID_PARAM',
+                solution: [(0, i18n_1.t)('示例: {"expression":{"version":"1.0","statement":[...]}}')]
+            });
+        }
+        expression = JSON.stringify(item.expression);
+    }
+    const rawEffect = String(item.effect || '').trim().toLowerCase();
+    if (!rawEffect || (rawEffect !== 'allow' && rawEffect !== 'deny')) {
+        throw new error_1.CloudBaseError({
+            message: (0, i18n_1.t)('自定义策略必须指定 effect（allow 或 deny）'),
+            code: 'INVALID_PARAM',
+            solution: [(0, i18n_1.t)('示例: {"code":"custom_api","effect":"allow",...}')]
+        });
+    }
+    const effect = rawEffect;
+    return {
+        ResourceType: 'gateway',
+        Resource: code,
+        Effect: effect,
+        GatewayPolicyCode: code,
+        GatewayPolicyName: item.name,
+        GatewayPolicyDescription: item.description,
+        GatewayPolicyExpression: expression
+    };
+}
+function parsePolicies(policiesInput) {
+    if (!policiesInput)
+        return [];
+    let raw;
+    try {
+        raw = JSON.parse(policiesInput);
+    }
+    catch (e) {
+        throw new error_1.CloudBaseError({
+            message: (0, i18n_1.t)('参数 --policies 不是合法 JSON'),
+            code: 'INVALID_PARAM',
+            solution: [(0, i18n_1.t)('示例: --policies \'["FunctionsAccess",{"code":"custom_api"}]\'')],
+            original: e
+        });
+    }
+    if (!Array.isArray(raw)) {
+        throw new error_1.CloudBaseError({
+            message: (0, i18n_1.t)('参数 --policies 必须是 JSON 数组'),
+            code: 'INVALID_PARAM'
+        });
+    }
+    return raw.map((item) => normalizeGatewayPolicy(item));
+}
+function validateRoleCreateInput(name, identity, users, policies) {
+    if (!name) {
+        throw new error_1.CloudBaseError({
+            message: (0, i18n_1.t)('参数 --name 必填'),
+            code: 'MISSING_PARAM'
+        });
+    }
+    if (!identity) {
+        throw new error_1.CloudBaseError({
+            message: (0, i18n_1.t)('参数 --identity 必填'),
+            code: 'MISSING_PARAM'
+        });
+    }
+    if (name.length < 2 || name.length > 32) {
+        throw new error_1.CloudBaseError({
+            message: (0, i18n_1.t)('角色名称长度需为 2-32 字符'),
+            code: 'INVALID_PARAM'
+        });
+    }
+    if (!/^[A-Za-z\u4e00-\u9fa5][A-Za-z0-9\u4e00-\u9fa5\\-_:@.]*$/.test(name)) {
+        throw new error_1.CloudBaseError({
+            message: (0, i18n_1.t)('角色名称格式不合法'),
+            code: 'INVALID_PARAM',
+            solution: [(0, i18n_1.t)('名称需中文/字母开头，仅支持中文、字母、数字和 -_:@.')]
+        });
+    }
+    if (!/^[A-Za-z0-9_:@.-]+$/.test(identity)) {
+        throw new error_1.CloudBaseError({
+            message: (0, i18n_1.t)('角色标识格式不合法'),
+            code: 'INVALID_PARAM',
+            solution: [(0, i18n_1.t)('标识仅支持字母、数字和 _-:@.')]
+        });
+    }
+    if (users.length > 100) {
+        throw new error_1.CloudBaseError({
+            message: (0, i18n_1.t)('用户列表最多支持 100 个'),
+            code: 'INVALID_PARAM'
+        });
+    }
+    if (policies.length > 50) {
+        throw new error_1.CloudBaseError({
+            message: (0, i18n_1.t)('策略列表最多支持 50 条'),
+            code: 'INVALID_PARAM'
+        });
+    }
+}
+function parseRemovePolicies(policiesInput) {
+    if (!policiesInput)
+        return [];
+    let raw;
+    try {
+        raw = JSON.parse(policiesInput);
+    }
+    catch (e) {
+        throw new error_1.CloudBaseError({
+            message: (0, i18n_1.t)('参数 --remove-policies 不是合法 JSON'),
+            code: 'INVALID_PARAM',
+            solution: [(0, i18n_1.t)('示例: --remove-policies \'["FunctionsAccess","StoragesDeny"]\'')],
+            original: e
+        });
+    }
+    if (!Array.isArray(raw)) {
+        throw new error_1.CloudBaseError({
+            message: (0, i18n_1.t)('参数 --remove-policies 必须是 JSON 数组'),
+            code: 'INVALID_PARAM'
+        });
+    }
+    return raw.map((item) => {
+        if (typeof item === 'string') {
+            const code = item.trim();
+            if (!code) {
+                throw new error_1.CloudBaseError({
+                    message: (0, i18n_1.t)('移除策略 code 不能为空'),
+                    code: 'INVALID_PARAM'
+                });
+            }
+            return {
+                ResourceType: 'gateway',
+                Resource: code,
+                GatewayPolicyCode: code
+            };
+        }
+        if (!item || typeof item !== 'object' || Array.isArray(item)) {
+            throw new error_1.CloudBaseError({
+                message: (0, i18n_1.t)('移除策略项必须是字符串或对象'),
+                code: 'INVALID_PARAM',
+                solution: [(0, i18n_1.t)('示例: "FunctionsAccess" 或 {"code":"custom_api"}')]
+            });
+        }
+        const code = String(item.code || '').trim();
+        if (!code) {
+            throw new error_1.CloudBaseError({
+                message: (0, i18n_1.t)('移除策略 code 不能为空'),
+                code: 'INVALID_PARAM'
+            });
+        }
+        return {
+            ResourceType: 'gateway',
+            Resource: code,
+            GatewayPolicyCode: code
+        };
+    });
+}
+let RoleListCommand = class RoleListCommand extends common_1.Command {
+    get options() {
+        return {
+            cmd: 'role',
+            childCmd: 'list',
+            options: [
+                {
+                    flags: '-e, --env-id <envId>',
+                    desc: (0, i18n_1.t)('环境 Id'),
+                    deprecatedName: 'envId'
+                },
+                {
+                    flags: '--type <type>',
+                    desc: (0, i18n_1.t)('过滤角色类型'),
+                    choices: ['system', 'custom']
+                },
+                {
+                    flags: '--limit <n>',
+                    desc: (0, i18n_1.t)('返回条数上限，默认 20'),
+                    default: 20
+                },
+                {
+                    flags: '--offset <n>',
+                    desc: (0, i18n_1.t)('跳过条数，默认 0'),
+                    default: 0
+                },
+                {
+                    flags: '--detail',
+                    desc: (0, i18n_1.t)('显示角色成员和权限策略')
+                }
+            ],
+            desc: (0, i18n_1.t)('查询环境下的角色列表（系统角色 + 自定义角色）'),
+            autoRunLogin: true,
+            examples: [
+                'tcb role list --env-id xxx',
+                'tcb role list --type custom --env-id xxx',
+                'tcb role list --detail --env-id xxx',
+                'tcb role list --limit 50 --offset 0 --env-id xxx',
+                'tcb role list --json'
+            ]
+        };
+    }
+    execute(envId, options, log) {
+        var _a, _b, _c, _d, _e, _f;
+        return __awaiter(this, void 0, void 0, function* () {
+            const limit = (_a = Number(options.limit)) !== null && _a !== void 0 ? _a : 20;
+            const offset = (_b = Number(options.offset)) !== null && _b !== void 0 ? _b : 0;
+            const type = options.type;
+            const detail = !!options.detail;
+            const pageSize = limit;
+            const pageNumber = Math.floor(offset / limit) + 1;
+            if (!(0, utils_1.isJsonOutput)()) {
+                log.info((0, i18n_1.t)('正在查询角色列表...'));
+            }
+            try {
+                const permissionService = yield getPermissionService(envId);
+                const result = yield permissionService.describeRoleList({
+                    pageNumber,
+                    pageSize,
+                    loadDetails: detail
+                });
+                const systemRoles = ((_c = result.Data) === null || _c === void 0 ? void 0 : _c.SystemRoles) || [];
+                const customRoles = ((_d = result.Data) === null || _d === void 0 ? void 0 : _d.CustomRoles) || [];
+                const totalCount = (_f = (_e = result.Data) === null || _e === void 0 ? void 0 : _e.TotalCount) !== null && _f !== void 0 ? _f : 0;
+                const filteredSystem = type === 'custom' ? [] : systemRoles;
+                const filteredCustom = type === 'system' ? [] : customRoles;
+                if ((0, utils_1.isJsonOutput)()) {
+                    if (type === 'system') {
+                        (0, utils_1.outputJson)(Object.assign(Object.assign({}, result), { Data: {
+                                SystemTotalCount: systemRoles.length,
+                                SystemRoles: systemRoles,
+                            } }));
+                    }
+                    else if (type === 'custom') {
+                        (0, utils_1.outputJson)(Object.assign(Object.assign({}, result), { Data: {
+                                CustomTotalCount: customRoles.length,
+                                CustomRoles: customRoles,
+                            } }));
+                    }
+                    else {
+                        (0, utils_1.outputJson)(result);
+                    }
+                    return;
+                }
+                const allRoles = [...filteredSystem, ...filteredCustom];
+                if (allRoles.length === 0) {
+                    log.info((0, i18n_1.t)('未查询到角色'));
+                    return;
+                }
+                if (filteredSystem.length > 0) {
+                    log.info(`\n${(0, i18n_1.t)('系统角色')} (${filteredSystem.length}):`);
+                    for (const role of filteredSystem) {
+                        printRole(role, log, detail, 'system');
+                    }
+                }
+                if (filteredCustom.length > 0) {
+                    log.info(`\n${(0, i18n_1.t)('自定义角色')} (${filteredCustom.length}):`);
+                    for (const role of filteredCustom) {
+                        printRole(role, log, detail, 'custom');
+                    }
+                }
+                const displayCount = filteredSystem.length + filteredCustom.length;
+                if (type) {
+                    const label = type === 'system' ? (0, i18n_1.t)('系统角色') : (0, i18n_1.t)('自定义角色');
+                    log.info(`\n${(0, i18n_1.t)('共 {{count}} 个{{label}}', { count: displayCount, label })}`);
+                }
+                else {
+                    log.info(`\n${(0, i18n_1.t)('共 {{count}} 个角色 (系统角色 {{system}}, 自定义角色 {{custom}})', { count: displayCount, system: filteredSystem.length, custom: filteredCustom.length })}`);
+                }
+                log.info((0, i18n_1.t)('\n下一步：'));
+                log.info(`  ${(0, i18n_1.t)('创建角色')}    ${(0, utils_1.highlightCommand)(`tcb role create --env-id ${envId}`)}`);
+            }
+            catch (e) {
+                throw new error_1.CloudBaseError({
+                    message: e.message || (0, i18n_1.t)('查询角色列表失败'),
+                    code: 'API_ERROR',
+                    solution: [
+                        (0, i18n_1.t)('请检查环境 ID 是否正确'),
+                        (0, i18n_1.t)('运行 {{cmd}} 重新登录', { cmd: (0, utils_1.highlightCommand)('tcb login') })
+                    ],
+                    original: e
+                });
+            }
+        });
+    }
+};
+__decorate([
+    (0, decorators_1.InjectParams)(),
+    __param(0, (0, decorators_1.EnvId)()),
+    __param(1, (0, decorators_1.ArgsOptions)()),
+    __param(2, (0, decorators_1.Log)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object, decorators_1.Logger]),
+    __metadata("design:returntype", Promise)
+], RoleListCommand.prototype, "execute", null);
+RoleListCommand = __decorate([
+    (0, common_1.ICommand)()
+], RoleListCommand);
+exports.RoleListCommand = RoleListCommand;
+let RoleGetCommand = class RoleGetCommand extends common_1.Command {
+    get options() {
+        return {
+            cmd: 'role',
+            childCmd: 'get',
+            options: [
+                {
+                    flags: '-e, --env-id <envId>',
+                    desc: (0, i18n_1.t)('环境 Id'),
+                    deprecatedName: 'envId'
+                },
+                {
+                    flags: '--id <roleId>',
+                    desc: (0, i18n_1.t)('按角色 ID 查询（精确）')
+                },
+                {
+                    flags: '--identity <identity>',
+                    desc: (0, i18n_1.t)('按角色标识查询（精确）')
+                },
+                {
+                    flags: '--name <name>',
+                    desc: (0, i18n_1.t)('按角色名称查询（模糊）')
+                },
+                {
+                    flags: '--detail',
+                    desc: (0, i18n_1.t)('显示角色成员和权限策略')
+                }
+            ],
+            desc: (0, i18n_1.t)('查询指定角色的详细信息'),
+            autoRunLogin: true,
+            examples: [
+                'tcb role get --id 2032299359962361858 --env-id xxx',
+                'tcb role get --identity administrator --env-id xxx',
+                'tcb role get --name 开发者 --env-id xxx',
+                'tcb role get --identity administrator --detail --env-id xxx',
+                'tcb role get --identity administrator --json'
+            ]
+        };
+    }
+    execute(envId, options, log) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const roleId = options.id;
+            const roleIdentity = options.identity;
+            const roleName = options.name;
+            const detail = !!options.detail;
+            const provided = [roleId, roleIdentity, roleName].filter(Boolean);
+            if (provided.length !== 1) {
+                throw new error_1.CloudBaseError({
+                    message: (0, i18n_1.t)('请且仅传入一个查询条件：--id / --identity / --name'),
+                    code: 'INVALID_PARAM',
+                    solution: [
+                        (0, i18n_1.t)('示例: tcb role get --id 2032299359962361858 --env-id xxx'),
+                        (0, i18n_1.t)('示例: tcb role get --identity administrator --env-id xxx'),
+                        (0, i18n_1.t)('示例: tcb role get --name 开发者 --env-id xxx')
+                    ]
+                });
+            }
+            if (!(0, utils_1.isJsonOutput)()) {
+                log.info((0, i18n_1.t)('正在查询角色详情...'));
+            }
+            try {
+                const permissionService = yield getPermissionService(envId);
+                const result = yield permissionService.describeRoleList(Object.assign(Object.assign(Object.assign(Object.assign({}, (roleId ? { roleId } : {})), (roleIdentity ? { roleIdentity } : {})), (roleName ? { roleName } : {})), { loadDetails: detail }));
+                if ((0, utils_1.isJsonOutput)()) {
+                    (0, utils_1.outputJson)(result);
+                    return;
+                }
+                const roles = this.extractRoles(result);
+                if (roles.length === 0) {
+                    if ((0, utils_1.isJsonOutput)()) {
+                        (0, utils_1.outputJson)([]);
+                    }
+                    else {
+                        log.info((0, i18n_1.t)('未查询到匹配角色'));
+                    }
+                    return;
+                }
+                if (roles.length > 1) {
+                    log.info(`\n${(0, i18n_1.t)('查询到 {{count}} 个角色', { count: roles.length })}:`);
+                    for (const item of roles) {
+                        printRole(item.role, log, detail, item.roleType);
+                    }
+                }
+                else {
+                    log.info(`\n${(0, i18n_1.t)('角色详情')}:`);
+                    const item = roles[0];
+                    printRole(item.role, log, detail, item.roleType);
+                }
+                log.info((0, i18n_1.t)('\n下一步：'));
+                log.info(`  ${(0, i18n_1.t)('查看角色列表')}    ${(0, utils_1.highlightCommand)(`tcb role list --env-id ${envId}`)}`);
+            }
+            catch (e) {
+                if (e instanceof error_1.CloudBaseError) {
+                    throw e;
+                }
+                throw new error_1.CloudBaseError({
+                    message: e.message || (0, i18n_1.t)('查询角色详情失败'),
+                    code: 'API_ERROR',
+                    solution: [
+                        (0, i18n_1.t)('请检查环境 ID 是否正确'),
+                        (0, i18n_1.t)('运行 {{cmd}} 重新登录', { cmd: (0, utils_1.highlightCommand)('tcb login') })
+                    ],
+                    original: e
+                });
+            }
+        });
+    }
+    extractRoles(result) {
+        var _a, _b;
+        const systemRoles = (((_a = result.Data) === null || _a === void 0 ? void 0 : _a.SystemRoles) || []).map((role) => ({
+            role,
+            roleType: 'system'
+        }));
+        const customRoles = (((_b = result.Data) === null || _b === void 0 ? void 0 : _b.CustomRoles) || []).map((role) => ({
+            role,
+            roleType: 'custom'
+        }));
+        return [...systemRoles, ...customRoles];
+    }
+};
+__decorate([
+    (0, decorators_1.InjectParams)(),
+    __param(0, (0, decorators_1.EnvId)()),
+    __param(1, (0, decorators_1.ArgsOptions)()),
+    __param(2, (0, decorators_1.Log)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object, decorators_1.Logger]),
+    __metadata("design:returntype", Promise)
+], RoleGetCommand.prototype, "execute", null);
+RoleGetCommand = __decorate([
+    (0, common_1.ICommand)()
+], RoleGetCommand);
+exports.RoleGetCommand = RoleGetCommand;
+let RoleCreateCommand = class RoleCreateCommand extends common_1.Command {
+    get options() {
+        return {
+            cmd: 'role',
+            childCmd: 'create',
+            options: [
+                {
+                    flags: '-e, --env-id <envId>',
+                    desc: (0, i18n_1.t)('环境 Id'),
+                    deprecatedName: 'envId'
+                },
+                {
+                    flags: '--name <name>',
+                    desc: (0, i18n_1.t)('角色名称（2-32 字符）')
+                },
+                {
+                    flags: '--identity <identity>',
+                    desc: (0, i18n_1.t)('角色标识（唯一）')
+                },
+                {
+                    flags: '--description <description>',
+                    desc: (0, i18n_1.t)('角色描述（最多 255 字符）')
+                },
+                {
+                    flags: '--users <uids>',
+                    desc: (0, i18n_1.t)('成员 UID 列表（逗号分隔）')
+                },
+                {
+                    flags: '--policies <json>',
+                    desc: [
+                        (0, i18n_1.t)('策略 JSON 数组，支持预设字符串和自定义对象混合'),
+                        (0, i18n_1.t)('预设: AdministratorAccess, FunctionsAccess, StoragesAccess, CloudrunAccess, FunctionsDeny, StoragesDeny, CloudrunDeny'),
+                        (0, i18n_1.t)('自定义对象字段: code, name, description, effect(allow|deny), expression'),
+                        (0, i18n_1.t)('expression 由 version 和 statement 构成，statement 是子语句数组，每条子语句包含 action, resource, effect, condition(非必填)'),
+                        (0, i18n_1.t)('action 格式: <功能类型>:<请求路径>，功能类型: storages/functions/cloudrun/model，路径为 * 表示全部'),
+                        (0, i18n_1.t)('resource 代表操作的资源，* 表示全部资源'),
+                        (0, i18n_1.t)('effect 取值 allow 或 deny，allow 和 deny 同时存在时 deny 优先'),
+                        (0, i18n_1.t)('示例: {"version":"1.0","statement":[{"action":"functions:*","resource":"*","effect":"allow"}]}')
+                    ].join('\n')
+                }
+            ],
+            desc: (0, i18n_1.t)('创建自定义角色'),
+            autoRunLogin: true,
+            examples: [
+                'tcb role create --name 开发者 --identity developer --env-id xxx',
+                'tcb role create --name 开发者 --identity developer --users 1003,1005 --env-id xxx',
+                'tcb role create --name 网关角色 --identity gateway_role --policies \'["FunctionsAccess","StoragesDeny"]\' --env-id xxx',
+                'tcb role create --name 全栈开发者 --identity fullstack_dev --policies \'["FunctionsAccess",{"code":"custom_api","name":"API路径策略","description":"仅允许访问/api路径","expression":{"version":"1.0","statement":[{"action":"functions:/api/*","resource":"*","effect":"allow"}]}}]\' --users 1003,1005,1007 --env-id xxx',
+                'tcb role create --name 开发者 --identity developer --env-id xxx --json'
+            ]
+        };
+    }
+    execute(envId, options, log) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const name = (options.name || '').trim();
+            const identity = (options.identity || '').trim();
+            const description = (options.description || '').trim();
+            const usersInput = options.users;
+            const policiesInput = options.policies;
+            const users = parseUsers(usersInput);
+            const policies = parsePolicies(policiesInput);
+            validateRoleCreateInput(name, identity, users, policies);
+            if (!(0, utils_1.isJsonOutput)()) {
+                log.info((0, i18n_1.t)('正在创建角色...'));
+            }
+            try {
+                const permissionService = yield getPermissionService(envId);
+                const createOptions = {
+                    roleName: name,
+                    roleIdentity: identity
+                };
+                if (description) {
+                    createOptions.description = description;
+                }
+                if (users.length > 0) {
+                    createOptions.memberUids = users;
+                }
+                if (policies.length > 0) {
+                    createOptions.policies = policies;
+                }
+                const result = yield permissionService.createRole(createOptions);
+                const data = result.Data || {};
+                if ((0, utils_1.isJsonOutput)()) {
+                    (0, utils_1.outputJson)(result);
+                    return;
+                }
+                log.success((0, i18n_1.t)('角色创建成功'));
+                log.info(`  ${(0, i18n_1.t)('角色名称')}: ${name}`);
+                log.info(`  ${(0, i18n_1.t)('角色标识')}: ${identity}`);
+                log.info(`  ${(0, i18n_1.t)('角色ID')}: ${data.RoleId || '-'}`);
+                if (users.length > 0) {
+                    const createdUsers = data.MemberUids || [];
+                    const usersText = createdUsers.length > 0 ? JSON.stringify(createdUsers) : '[]';
+                    log.info(`  ${(0, i18n_1.t)('已添加成员')}: ${usersText}`);
+                }
+                if (policies.length > 0) {
+                    const createdPolicies = data.Policies || [];
+                    const policiesText = JSON.stringify(createdPolicies, null, 2)
+                        .split('\n')
+                        .map((line, i) => (i === 0 ? line : `    ${line}`))
+                        .join('\n');
+                    log.info(`  ${(0, i18n_1.t)('已创建策略')}: ${policiesText}`);
+                }
+                log.info((0, i18n_1.t)('\n下一步：'));
+                log.info(`  ${(0, i18n_1.t)('查看角色列表')}    ${(0, utils_1.highlightCommand)(`tcb role list --env-id ${envId}`)}`);
+                if (data.RoleId) {
+                    log.info(`  ${(0, i18n_1.t)('查看角色详情')}    ${(0, utils_1.highlightCommand)(`tcb role get --id ${data.RoleId} --env-id ${envId}`)}`);
+                }
+            }
+            catch (e) {
+                if (e instanceof error_1.CloudBaseError) {
+                    throw e;
+                }
+                throw new error_1.CloudBaseError({
+                    message: e.message || (0, i18n_1.t)('创建角色失败'),
+                    code: 'API_ERROR',
+                    solution: [
+                        (0, i18n_1.t)('请检查参数是否正确'),
+                        (0, i18n_1.t)('请确认角色名称/角色标识未重复'),
+                        (0, i18n_1.t)('运行 {{cmd}} 重新登录', { cmd: (0, utils_1.highlightCommand)('tcb login') })
+                    ],
+                    original: e
+                });
+            }
+        });
+    }
+};
+__decorate([
+    (0, decorators_1.InjectParams)(),
+    __param(0, (0, decorators_1.EnvId)()),
+    __param(1, (0, decorators_1.ArgsOptions)()),
+    __param(2, (0, decorators_1.Log)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object, decorators_1.Logger]),
+    __metadata("design:returntype", Promise)
+], RoleCreateCommand.prototype, "execute", null);
+RoleCreateCommand = __decorate([
+    (0, common_1.ICommand)()
+], RoleCreateCommand);
+exports.RoleCreateCommand = RoleCreateCommand;
+let RoleUpdateCommand = class RoleUpdateCommand extends common_1.Command {
+    get options() {
+        return {
+            cmd: 'role',
+            childCmd: 'update',
+            options: [
+                {
+                    flags: '-e, --env-id <envId>',
+                    desc: (0, i18n_1.t)('环境 Id'),
+                    deprecatedName: 'envId'
+                },
+                {
+                    flags: '--id <roleId>',
+                    desc: (0, i18n_1.t)('角色 ID（必填）')
+                },
+                {
+                    flags: '--name <name>',
+                    desc: (0, i18n_1.t)('修改角色名称（2-32 字符）')
+                },
+                {
+                    flags: '--description <description>',
+                    desc: (0, i18n_1.t)('修改角色描述')
+                },
+                {
+                    flags: '--add-users <uids>',
+                    desc: (0, i18n_1.t)('添加成员（逗号分隔 UID）')
+                },
+                {
+                    flags: '--remove-users <uids>',
+                    desc: (0, i18n_1.t)('移除成员（逗号分隔 UID）')
+                },
+                {
+                    flags: '--add-policies <json>',
+                    desc: [
+                        (0, i18n_1.t)('策略 JSON 数组，支持预设字符串和自定义对象混合'),
+                        (0, i18n_1.t)('预设: AdministratorAccess, FunctionsAccess, StoragesAccess, CloudrunAccess, FunctionsDeny, StoragesDeny, CloudrunDeny'),
+                        (0, i18n_1.t)('自定义对象字段: code, name, description, effect(allow|deny), expression'),
+                        (0, i18n_1.t)('expression 由 version 和 statement 构成，statement 是子语句数组，每条子语句包含 action, resource, effect, condition(非必填)'),
+                        (0, i18n_1.t)('action 格式: <功能类型>:<请求路径>，功能类型: storages/functions/cloudrun/model，路径为 * 表示全部'),
+                        (0, i18n_1.t)('resource 代表操作的资源，* 表示全部资源'),
+                        (0, i18n_1.t)('effect 取值 allow 或 deny，allow 和 deny 同时存在时 deny 优先'),
+                        (0, i18n_1.t)('示例: {"version":"1.0","statement":[{"action":"functions:*","resource":"*","effect":"allow"}]}')
+                    ].join('\n')
+                },
+                {
+                    flags: '--remove-policies <json>',
+                    desc: [
+                        (0, i18n_1.t)('移除策略 JSON 数组，支持预设字符串和自定义对象混合'),
+                        (0, i18n_1.t)('预设: AdministratorAccess, FunctionsAccess, StoragesAccess, CloudrunAccess, FunctionsDeny, StoragesDeny, CloudrunDeny'),
+                        (0, i18n_1.t)('自定义对象需提供 code 字段'),
+                        (0, i18n_1.t)('示例: \'["FunctionsAccess", {"code": "custom_api"}]\'')
+                    ].join('\n')
+                }
+            ],
+            desc: [
+                (0, i18n_1.t)('更新角色信息（名称、描述、成员、策略）'),
+                '',
+                `${(0, i18n_1.t)('注意：')}\n`,
+                `  · ${(0, i18n_1.t)('管理员角色：仅可修改成员，不可修改策略')}`,
+                `  · ${(0, i18n_1.t)('注册用户/组织成员/匿名用户/所有用户：仅可修改策略，不可修改成员')}`,
+                `  · ${(0, i18n_1.t)('所有系统角色：不可修改角色名称')}`,
+                `  · ${(0, i18n_1.t)('自定义角色：以上均可修改')}`
+            ].join('\n'),
+            autoRunLogin: true,
+            examples: [
+                'tcb role update --id 2032299359962361858 --name "高级开发者" --env-id xxx',
+                'tcb role update --id 2032299359962361858 --add-users "1001,1002" --remove-users "1003" --env-id xxx',
+                'tcb role update --id 2032299359962361858 --add-policies \'["FunctionsAccess"]\' --remove-policies \'["StoragesDeny"]\' --env-id xxx',
+                'tcb role update --id 2032299359962361858 --name "新名称" --add-users "1001" --env-id xxx --json'
+            ]
+        };
+    }
+    execute(envId, options, log) {
+        var _a, _b, _c, _d;
+        return __awaiter(this, void 0, void 0, function* () {
+            const roleId = (options.id || '').trim();
+            const name = options.name;
+            const description = options.description;
+            const addUsersInput = options.addUsers;
+            const removeUsersInput = options.removeUsers;
+            const addPoliciesInput = options.addPolicies;
+            const removePoliciesInput = options.removePolicies;
+            if (!roleId) {
+                throw new error_1.CloudBaseError({
+                    message: (0, i18n_1.t)('参数 --id 必填'),
+                    code: 'MISSING_PARAM',
+                    solution: [(0, i18n_1.t)('示例: tcb role update --id <roleId> --name "新名称" --env-id xxx')]
+                });
+            }
+            const updateFields = [name, description, addUsersInput, removeUsersInput, addPoliciesInput, removePoliciesInput];
+            const hasUpdate = updateFields.some((f) => f !== undefined && f !== '');
+            if (!hasUpdate) {
+                throw new error_1.CloudBaseError({
+                    message: (0, i18n_1.t)('请至少指定一个更新字段'),
+                    code: 'MISSING_PARAM',
+                    solution: [
+                        (0, i18n_1.t)('可用选项: --name, --description, --add-users, --remove-users, --add-policies, --remove-policies'),
+                        (0, i18n_1.t)('示例: tcb role update --id {{id}} --name "新名称" --env-id xxx', { id: roleId })
+                    ]
+                });
+            }
+            if (name) {
+                const trimmedName = name.trim();
+                if (trimmedName.length < 2 || trimmedName.length > 32) {
+                    throw new error_1.CloudBaseError({
+                        message: (0, i18n_1.t)('角色名称长度需为 2-32 字符'),
+                        code: 'INVALID_PARAM'
+                    });
+                }
+                if (!/^[A-Za-z\u4e00-\u9fa5][A-Za-z0-9\u4e00-\u9fa5\\-_:@.]*$/.test(trimmedName)) {
+                    throw new error_1.CloudBaseError({
+                        message: (0, i18n_1.t)('角色名称格式不合法'),
+                        code: 'INVALID_PARAM',
+                        solution: [(0, i18n_1.t)('名称需中文/字母开头，仅支持中文、字母、数字和 -_:@.')]
+                    });
+                }
+            }
+            const addUsers = parseUsers(addUsersInput);
+            const removeUsers = parseUsers(removeUsersInput);
+            const addPolicies = parsePolicies(addPoliciesInput);
+            const removePolicies = parseRemovePolicies(removePoliciesInput);
+            const confirmed = yield (0, utils_1.autoConfirm)((0, i18n_1.t)('确定要更新角色 {{id}} 吗？', { id: roleId }));
+            if (!confirmed)
+                return;
+            if (!(0, utils_1.isJsonOutput)()) {
+                log.info((0, i18n_1.t)('正在更新角色...'));
+            }
+            try {
+                const permissionService = yield getPermissionService(envId);
+                const modifyOptions = {
+                    roleId
+                };
+                if (name) {
+                    modifyOptions.roleName = name.trim();
+                }
+                if (description) {
+                    modifyOptions.description = description.trim();
+                }
+                if (addUsers.length > 0) {
+                    modifyOptions.addMemberUids = addUsers;
+                }
+                if (removeUsers.length > 0) {
+                    modifyOptions.removeMemberUids = removeUsers;
+                }
+                if (addPolicies.length > 0) {
+                    modifyOptions.addPolicies = addPolicies;
+                }
+                if (removePolicies.length > 0) {
+                    modifyOptions.removePolicies = removePolicies;
+                }
+                const result = yield permissionService.modifyRole(modifyOptions);
+                const data = result.Data || {};
+                if ((0, utils_1.isJsonOutput)()) {
+                    (0, utils_1.outputJson)(result);
+                    return;
+                }
+                log.success((0, i18n_1.t)('角色更新成功'));
+                const hasBasicChange = !!name || !!description;
+                const hasMemberChange = (((_a = data.AddedMemberUids) === null || _a === void 0 ? void 0 : _a.length) || 0) > 0 || (((_b = data.RemovedMemberUids) === null || _b === void 0 ? void 0 : _b.length) || 0) > 0;
+                const hasPolicyChange = (((_c = data.AddedPolicies) === null || _c === void 0 ? void 0 : _c.length) || 0) > 0 || (((_d = data.RemovedPolicies) === null || _d === void 0 ? void 0 : _d.length) || 0) > 0;
+                if (hasBasicChange) {
+                    log.info(`\n  ${(0, i18n_1.t)('基本信息变更')}:`);
+                    if (name) {
+                        log.info(`    ${(0, i18n_1.t)('角色名称')}: ${name.trim()}`);
+                    }
+                    if (description) {
+                        log.info(`    ${(0, i18n_1.t)('描述')}: ${description.trim()}`);
+                    }
+                }
+                if (hasMemberChange) {
+                    log.info(`\n  ${(0, i18n_1.t)('成员变更')}:`);
+                    const added = data.AddedMemberUids || [];
+                    const removed = data.RemovedMemberUids || [];
+                    if (added.length > 0) {
+                        log.info(`    + ${(0, i18n_1.t)('已添加')}: ${JSON.stringify(added)}`);
+                    }
+                    if (removed.length > 0) {
+                        log.info(`    - ${(0, i18n_1.t)('已移除')}: ${JSON.stringify(removed)}`);
+                    }
+                }
+                if (hasPolicyChange) {
+                    log.info(`\n  ${(0, i18n_1.t)('策略变更')}:`);
+                    const addedPolicies = data.AddedPolicies || [];
+                    const removedPolicies = data.RemovedPolicies || [];
+                    if (addedPolicies.length > 0) {
+                        log.info(`    + ${(0, i18n_1.t)('已添加策略')}: ${JSON.stringify(addedPolicies)}`);
+                    }
+                    if (removedPolicies.length > 0) {
+                        log.info(`    - ${(0, i18n_1.t)('已移除策略')}: ${JSON.stringify(removedPolicies)}`);
+                    }
+                }
+                log.info((0, i18n_1.t)('\n下一步：'));
+                log.info(`  ${(0, i18n_1.t)('查看角色详情')}    ${(0, utils_1.highlightCommand)(`tcb role get --id ${roleId} --env-id ${envId}`)}`);
+                log.info(`  ${(0, i18n_1.t)('查看角色列表')}    ${(0, utils_1.highlightCommand)(`tcb role list --env-id ${envId}`)}`);
+            }
+            catch (e) {
+                if (e instanceof error_1.CloudBaseError) {
+                    throw e;
+                }
+                throw new error_1.CloudBaseError({
+                    message: e.message || (0, i18n_1.t)('更新角色失败'),
+                    code: 'API_ERROR',
+                    solution: [
+                        (0, i18n_1.t)('请检查参数是否正确'),
+                        (0, i18n_1.t)('系统角色可能有修改限制，请参考帮助信息'),
+                        (0, i18n_1.t)('运行 {{cmd}} 重新登录', { cmd: (0, utils_1.highlightCommand)('tcb login') })
+                    ],
+                    original: e
+                });
+            }
+        });
+    }
+};
+__decorate([
+    (0, decorators_1.InjectParams)(),
+    __param(0, (0, decorators_1.EnvId)()),
+    __param(1, (0, decorators_1.ArgsOptions)()),
+    __param(2, (0, decorators_1.Log)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object, decorators_1.Logger]),
+    __metadata("design:returntype", Promise)
+], RoleUpdateCommand.prototype, "execute", null);
+RoleUpdateCommand = __decorate([
+    (0, common_1.ICommand)()
+], RoleUpdateCommand);
+exports.RoleUpdateCommand = RoleUpdateCommand;
+let RoleDeleteCommand = class RoleDeleteCommand extends common_1.Command {
+    get options() {
+        return {
+            cmd: 'role',
+            childCmd: 'delete <roleIds...>',
+            options: [
+                {
+                    flags: '-e, --env-id <envId>',
+                    desc: (0, i18n_1.t)('环境 Id'),
+                    deprecatedName: 'envId'
+                }
+            ],
+            desc: (0, i18n_1.t)('删除自定义角色（不可撤销）'),
+            autoRunLogin: true,
+            examples: [
+                'tcb role delete 2037415874111574018 --env-id xxx',
+                'tcb role delete 2037415874111574018 2037420918731018242 --env-id xxx',
+                'tcb role delete 2037415874111574018 --env-id xxx --json'
+            ]
+        };
+    }
+    execute(envId, params, log) {
+        var _a, _b;
+        return __awaiter(this, void 0, void 0, function* () {
+            const roleIds = [].concat((params === null || params === void 0 ? void 0 : params[0]) || [])
+                .map((id) => String(id).trim())
+                .filter(Boolean);
+            if (roleIds.length === 0) {
+                throw new error_1.CloudBaseError({
+                    message: (0, i18n_1.t)('请指定要删除的角色 ID，例如：tcb role delete <roleId>'),
+                    code: 'MISSING_PARAM',
+                    solution: [(0, i18n_1.t)('运行 {{cmd}} 查看角色列表', { cmd: (0, utils_1.highlightCommand)(`tcb role list --env-id ${envId}`) })]
+                });
+            }
+            if (roleIds.length > 100) {
+                throw new error_1.CloudBaseError({
+                    message: (0, i18n_1.t)('单次最多删除 100 个角色'),
+                    code: 'INVALID_PARAM',
+                    solution: [(0, i18n_1.t)('请分批删除，每次不超过 100 个')]
+                });
+            }
+            const uniqueIds = [...new Set(roleIds)];
+            if (!(0, utils_1.isJsonOutput)()) {
+                log.warn(chalk_1.default.yellow((0, i18n_1.t)('确认删除以下角色？')));
+                for (const id of uniqueIds) {
+                    log.info(`  • ${id}`);
+                }
+                log.warn(chalk_1.default.red((0, i18n_1.t)('\n此操作不可撤销，是否继续？')));
+                const confirmed = yield (0, utils_1.autoConfirm)((0, i18n_1.t)('确定要删除 {{count}} 个角色吗？', { count: uniqueIds.length }), false);
+                if (!confirmed)
+                    return;
+            }
+            if (!(0, utils_1.isJsonOutput)()) {
+                log.info((0, i18n_1.t)('正在删除角色...'));
+            }
+            try {
+                const permissionService = yield getPermissionService(envId);
+                const result = yield permissionService.deleteRoles({ roleIds: uniqueIds });
+                const data = result.Data || {};
+                const successCount = (_a = data.SuccessCount) !== null && _a !== void 0 ? _a : 0;
+                const failedCount = (_b = data.FailedCount) !== null && _b !== void 0 ? _b : 0;
+                if ((0, utils_1.isJsonOutput)()) {
+                    (0, utils_1.outputJson)(result);
+                    return;
+                }
+                if (failedCount > 0) {
+                    log.warn((0, i18n_1.t)('已删除 {{success}} 个，失败 {{failed}} 个', { success: successCount, failed: failedCount }));
+                }
+                else {
+                    log.success((0, i18n_1.t)('已删除 {{count}} 个角色', { count: successCount }));
+                }
+                log.info((0, i18n_1.t)('\n已删除:'));
+                for (const id of uniqueIds) {
+                    log.info(`  • ${id}`);
+                }
+            }
+            catch (e) {
+                if (e instanceof error_1.CloudBaseError) {
+                    throw e;
+                }
+                throw new error_1.CloudBaseError({
+                    message: e.message || (0, i18n_1.t)('删除角色失败'),
+                    code: 'API_ERROR',
+                    solution: [
+                        (0, i18n_1.t)('系统角色不可删除，只能删除自定义角色'),
+                        (0, i18n_1.t)('运行 {{cmd}} 重新登录', { cmd: (0, utils_1.highlightCommand)('tcb login') })
+                    ],
+                    original: e
+                });
+            }
+        });
+    }
+};
+__decorate([
+    (0, decorators_1.InjectParams)(),
+    __param(0, (0, decorators_1.EnvId)()),
+    __param(1, (0, decorators_1.ArgsParams)()),
+    __param(2, (0, decorators_1.Log)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Array, decorators_1.Logger]),
+    __metadata("design:returntype", Promise)
+], RoleDeleteCommand.prototype, "execute", null);
+RoleDeleteCommand = __decorate([
+    (0, common_1.ICommand)()
+], RoleDeleteCommand);
+exports.RoleDeleteCommand = RoleDeleteCommand;
+
+
 /***/ }),
 
 /***/ 2608:
@@ -330981,7 +332009,7 @@ module.exports = function generate_pattern(it, $keyword, $ruleType) {
 /***/ ((module) => {
 
 "use strict";
-module.exports = /*#__PURE__*/JSON.parse('{"name":"@cloudbase/cli","version":"3.0.0-alpha.6","description":"cli tool for cloudbase","main":"lib/index.js","scripts":{"build":"rimraf lib types && tsc --resolveJsonModule && cpx \\"src/**/*.html\\" lib","watch":"rimraf lib types && tsc -w","dev":"rimraf lib types && cpx \\"src/**/*.html\\" lib && tsc -w","eslint":"eslint \\"./**/*.ts\\"","test":"node --experimental-vm-modules node_modules/jest/bin/jest.js --runInBand --forceExit --detectOpenHandles --verbose --testTimeout=120000","test:e2e":"node --experimental-vm-modules node_modules/jest/bin/jest.js --testPathPattern=\'test/e2e/\' --runInBand --forceExit --detectOpenHandles --verbose --testTimeout=120000","tsc":"tsc","pkg":"pkg ./bin/cloudbase.js --out-path ./pkg","postinstall":"node ./post-install.js || exit 0 && patch-package","prepublishOnly":"node ./scripts/check-publish-source.js","debug":"bin/tcb.js lowcode watch","build:bundle":"webpack --config build/webpack/cli.cjs && webpack --config build/webpack/ccr.cjs && node build/scripts/copy-figlet-fonts.js","package:darwin-arm64":"OS=darwin ARCH=arm64 VERSION= node -e \\"require(\'child_process\').execSync(\'bash build/scripts/package.sh\',{stdio:\'inherit\'})\\"","package:darwin-x64":"OS=darwin ARCH=x64 VERSION= node -e \\"require(\'child_process\').execSync(\'bash build/scripts/package.sh\',{stdio:\'inherit\'})\\"","package:linux-arm64":"OS=linux ARCH=arm64 VERSION= node -e \\"require(\'child_process\').execSync(\'bash build/scripts/package.sh\',{stdio:\'inherit\'})\\"","package:linux-x64":"OS=linux ARCH=x64 VERSION= node -e \\"require(\'child_process\').execSync(\'bash build/scripts/package.sh\',{stdio:\'inherit\'})\\"","package:all":"bash build/scripts/build-all.sh","node:fetch:one":"node -e \\"require(\'child_process\').execSync(\'bash build/scripts/fetch-node.sh\',{stdio:\'inherit\'})\\"","node:fetch:all":"NODE_VERSION=22.18.0 bash build/scripts/fetch-node.sh --all","node:fetch:win-x64":"OS=windows ARCH=x64 NODE_VERSION=22.18.0 bash build/scripts/fetch-node.sh","node:fetch:win-arm64":"OS=windows ARCH=arm64 NODE_VERSION=22.18.0 bash build/scripts/fetch-node.sh","package:windows-x64":"OS=windows ARCH=x64 VERSION= node -e \\"require(\'child_process\').execSync(\'bash build/scripts/package.sh\',{stdio:\'inherit\'})\\"","package:windows-arm64":"OS=windows ARCH=arm64 VERSION= node -e \\"require(\'child_process\').execSync(\'bash build/scripts/package.sh\',{stdio:\'inherit\'})\\"","package:windows-all":"npm run -s node:fetch:win-x64 && npm run -s node:fetch:win-arm64 && npm run -s package:windows-x64 && npm run -s package:windows-arm64","package:npm":"npm run build && npm run build:bundle && bash build/scripts/prepare-publish.sh","out:prune":"bash build/scripts/prune-out.sh","i18n:scan":"i18next-scanner --config locales/i18next-scanner.config.js && node locales/scripts/generate.js","i18n:sync":"node locales/scripts/sync.js sync","publish":"node ./scripts/publish.js"},"repository":{"type":"git","url":"https://github.com/TencentCloudBase/cloud-base-cli.git"},"bin":{"cloudbase":"bin/cloudbase.js","cloudbase-mcp":"bin/cloudbase-mcp.cjs","tcb":"bin/tcb.js"},"husky":{"hooks":{"pre-commit":"npm run build"}},"author":"cwuyiqing@gmail.com","license":"ISC","dependencies":{"@cloudbase/cloud-api":"^0.5.5","@cloudbase/cloudbase-mcp":"^2.7.3","@cloudbase/framework-core":"^1.9.7","@cloudbase/functions-framework":"1.16.0","@cloudbase/iac-core":"0.0.3-alpha.14","@cloudbase/lowcode-cli":"^0.23.0","@cloudbase/manager-node":"4.11.0-alpha.9","@cloudbase/toolbox":"0.7.17","@dotenvx/dotenvx":"^1.48.3","@musistudio/claude-code-router":"1.0.36","address":"^1.1.2","camelcase-keys":"^7.0.2","chalk":"^2.4.2","cli-table3":"^0.5.1","commander":"7","del":"^5.1.0","didyoumean":"^1.2.2","enquirer":"^2.3.6","execa":"^4.0.3","figlet":"^1.7.0","fs-extra":"^8.1.0","gradient-string":"^2.0.2","https-proxy-agent":"^5.0.1","i":"^0.3.7","inquirer":"^6.5.0","json-schema-to-typescript":"^14.0.5","lodash":"^4.17.21","log-symbols":"^3.0.0","lowdb":"^1.0.0","make-dir":"^3.0.0","node-fetch":"^2.6.0","nodemon":"^3.1.4","npm":"^11.5.2","open":"^7.0.0","ora":"^4.0.2","os-locale":"5.0.0","patch-package":"^8.0.0","portfinder":"^1.0.28","progress":"^2.0.3","query-string":"^6.8.1","reflect-metadata":"^0.1.13","semver":"^7.3.7","simple-git":"^3.28.0","tar-fs":"^2.0.1","terminal-link":"^2.1.1","toml":"^3.0.0","unzipper":"^0.10.10","update-notifier":"^4.0.0","xdg-basedir":"^4.0.0","yargs":"^16.2.0","yargs-parser":"^21.0.1","zod":"^4.0.13"},"devDependencies":{"@babel/parser":"^7.28.4","@babel/traverse":"^7.28.4","@babel/types":"^7.28.4","@types/fs-extra":"^11.0.4","@types/jest":"^27","@types/koa__router":"^8.0.11","@types/lodash":"^4.14.182","@types/node":"^12.12.38","@types/node-fetch":"^2.5.4","@types/react":"^17.0.37","@types/semver":"^7.3.9","@types/unzipper":"^0.10.11","@types/webpack-dev-server":"^3.11.1","@typescript-eslint/eslint-plugin":"^4.8.1","@typescript-eslint/parser":"^4.8.1","cpx":"^1.5.0","eslint":"^7.14.0","eslint-config-alloy":"^3.8.2","husky":"^3.0.9","i18next-scanner":"^4.6.0","jest":"^27","rimraf":"^3.0.2","ts-jest":"^27","typescript":"^4.7.2","webpack":"^5.92.0","webpack-cli":"^5.1.4"},"packageManager":"yarn@3.6.2+sha512.2c2f8b9615e6659773f65cdec7cf92ef773a98a99e611579601f61c7a91ec94c89c929aac86f1cee819421a9b0db7acfd53ec3ebb95af44f77f77634b08b9557","ai":{"skills":"./skills","skillsIndex":"./skills/index.json","compatible":["codebuddy","cursor","copilot","claude","windsurf"],"description":"CloudBase CLI - 腾讯云云开发命令行工具，支持云函数、云数据库、静态托管等全栈云开发能力"}}');
+module.exports = /*#__PURE__*/JSON.parse('{"name":"@cloudbase/cli","version":"3.0.0-alpha.8","description":"cli tool for cloudbase","main":"lib/index.js","scripts":{"build":"rimraf lib types && tsc --resolveJsonModule && cpx \\"src/**/*.html\\" lib","watch":"rimraf lib types && tsc -w","dev":"rimraf lib types && cpx \\"src/**/*.html\\" lib && tsc -w","eslint":"eslint \\"./**/*.ts\\"","test":"node --experimental-vm-modules node_modules/jest/bin/jest.js --runInBand --forceExit --detectOpenHandles --verbose --testTimeout=120000","test:e2e":"node --experimental-vm-modules node_modules/jest/bin/jest.js --testPathPattern=\'test/e2e/\' --runInBand --forceExit --detectOpenHandles --verbose --testTimeout=120000","tsc":"tsc","pkg":"pkg ./bin/cloudbase.js --out-path ./pkg","postinstall":"node ./post-install.js || exit 0 && patch-package","prepublishOnly":"node ./scripts/check-publish-source.js","debug":"bin/tcb.js lowcode watch","build:bundle":"webpack --config build/webpack/cli.cjs && webpack --config build/webpack/ccr.cjs && node build/scripts/copy-figlet-fonts.js","package:darwin-arm64":"OS=darwin ARCH=arm64 VERSION= node -e \\"require(\'child_process\').execSync(\'bash build/scripts/package.sh\',{stdio:\'inherit\'})\\"","package:darwin-x64":"OS=darwin ARCH=x64 VERSION= node -e \\"require(\'child_process\').execSync(\'bash build/scripts/package.sh\',{stdio:\'inherit\'})\\"","package:linux-arm64":"OS=linux ARCH=arm64 VERSION= node -e \\"require(\'child_process\').execSync(\'bash build/scripts/package.sh\',{stdio:\'inherit\'})\\"","package:linux-x64":"OS=linux ARCH=x64 VERSION= node -e \\"require(\'child_process\').execSync(\'bash build/scripts/package.sh\',{stdio:\'inherit\'})\\"","package:all":"bash build/scripts/build-all.sh","node:fetch:one":"node -e \\"require(\'child_process\').execSync(\'bash build/scripts/fetch-node.sh\',{stdio:\'inherit\'})\\"","node:fetch:all":"NODE_VERSION=22.18.0 bash build/scripts/fetch-node.sh --all","node:fetch:win-x64":"OS=windows ARCH=x64 NODE_VERSION=22.18.0 bash build/scripts/fetch-node.sh","node:fetch:win-arm64":"OS=windows ARCH=arm64 NODE_VERSION=22.18.0 bash build/scripts/fetch-node.sh","package:windows-x64":"OS=windows ARCH=x64 VERSION= node -e \\"require(\'child_process\').execSync(\'bash build/scripts/package.sh\',{stdio:\'inherit\'})\\"","package:windows-arm64":"OS=windows ARCH=arm64 VERSION= node -e \\"require(\'child_process\').execSync(\'bash build/scripts/package.sh\',{stdio:\'inherit\'})\\"","package:windows-all":"npm run -s node:fetch:win-x64 && npm run -s node:fetch:win-arm64 && npm run -s package:windows-x64 && npm run -s package:windows-arm64","package:npm":"npm run build && npm run build:bundle && bash build/scripts/prepare-publish.sh","out:prune":"bash build/scripts/prune-out.sh","i18n:scan":"i18next-scanner --config locales/i18next-scanner.config.js && node locales/scripts/generate.js","i18n:sync":"node locales/scripts/sync.js sync","publish":"node ./scripts/publish.js"},"repository":{"type":"git","url":"https://github.com/TencentCloudBase/cloud-base-cli.git"},"bin":{"cloudbase":"bin/cloudbase.js","cloudbase-mcp":"bin/cloudbase-mcp.cjs","tcb":"bin/tcb.js"},"husky":{"hooks":{"pre-commit":"npm run build"}},"author":"cwuyiqing@gmail.com","license":"ISC","dependencies":{"@cloudbase/cloud-api":"^0.5.5","@cloudbase/cloudbase-mcp":"^2.7.3","@cloudbase/framework-core":"^1.9.7","@cloudbase/functions-framework":"1.16.0","@cloudbase/iac-core":"0.0.3-alpha.14","@cloudbase/lowcode-cli":"^0.23.0","@cloudbase/manager-node":"4.11.0-alpha.9","@cloudbase/toolbox":"0.7.17","@dotenvx/dotenvx":"^1.48.3","@musistudio/claude-code-router":"1.0.36","address":"^1.1.2","camelcase-keys":"^7.0.2","chalk":"^2.4.2","cli-table3":"^0.5.1","commander":"7","del":"^5.1.0","didyoumean":"^1.2.2","enquirer":"^2.3.6","execa":"^4.0.3","figlet":"^1.7.0","fs-extra":"^8.1.0","gradient-string":"^2.0.2","https-proxy-agent":"^5.0.1","i":"^0.3.7","inquirer":"^6.5.0","json-schema-to-typescript":"^14.0.5","lodash":"^4.17.21","log-symbols":"^3.0.0","lowdb":"^1.0.0","make-dir":"^3.0.0","node-fetch":"^2.6.0","nodemon":"^3.1.4","npm":"^11.5.2","open":"^7.0.0","ora":"^4.0.2","os-locale":"5.0.0","patch-package":"^8.0.0","portfinder":"^1.0.28","progress":"^2.0.3","query-string":"^6.8.1","reflect-metadata":"^0.1.13","semver":"^7.3.7","simple-git":"^3.28.0","tar-fs":"^2.0.1","terminal-link":"^2.1.1","toml":"^3.0.0","unzipper":"^0.10.10","update-notifier":"^4.0.0","xdg-basedir":"^4.0.0","yargs":"^16.2.0","yargs-parser":"^21.0.1","zod":"^4.0.13"},"devDependencies":{"@babel/parser":"^7.28.4","@babel/traverse":"^7.28.4","@babel/types":"^7.28.4","@types/fs-extra":"^11.0.4","@types/jest":"^27","@types/koa__router":"^8.0.11","@types/lodash":"^4.14.182","@types/node":"^12.12.38","@types/node-fetch":"^2.5.4","@types/react":"^17.0.37","@types/semver":"^7.3.9","@types/unzipper":"^0.10.11","@types/webpack-dev-server":"^3.11.1","@typescript-eslint/eslint-plugin":"^4.8.1","@typescript-eslint/parser":"^4.8.1","cpx":"^1.5.0","eslint":"^7.14.0","eslint-config-alloy":"^3.8.2","husky":"^3.0.9","i18next-scanner":"^4.6.0","jest":"^27","rimraf":"^3.0.2","ts-jest":"^27","typescript":"^4.7.2","webpack":"^5.92.0","webpack-cli":"^5.1.4"},"packageManager":"yarn@3.6.2+sha512.2c2f8b9615e6659773f65cdec7cf92ef773a98a99e611579601f61c7a91ec94c89c929aac86f1cee819421a9b0db7acfd53ec3ebb95af44f77f77634b08b9557","ai":{"skills":"./skills","skillsIndex":"./skills/index.json","compatible":["codebuddy","cursor","copilot","claude","windsurf"],"description":"CloudBase CLI - 腾讯云云开发命令行工具，支持云函数、云数据库、静态托管等全栈云开发能力"}}');
 
 /***/ }),
 
@@ -386631,6 +387659,547 @@ return PromiseArray;
 };
 
 
+/***/ }),
+
+/***/ 15771:
+/***/ (function(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.PermissionGetCommand = exports.PermissionSetCommand = void 0;
+const common_1 = __webpack_require__(48431);
+const decorators_1 = __webpack_require__(93480);
+const error_1 = __webpack_require__(66759);
+const utils_1 = __webpack_require__(82079);
+const i18n_1 = __webpack_require__(69258);
+function getPermissionService(envId) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const app = yield (0, utils_1.getMangerService)(envId);
+        return app.permission;
+    });
+}
+const VALID_RESOURCE_TYPES = ['function', 'storage', 'table', 'collection'];
+const VALID_LEVELS = {
+    table: ['readonly', 'private', 'adminwrite', 'adminonly'],
+    collection: ['readonly', 'private', 'adminwrite', 'adminonly', 'custom'],
+    function: ['custom'],
+    storage: ['readonly', 'private', 'adminwrite', 'adminonly', 'custom']
+};
+const LEVEL_MAP = {
+    readonly: 'READONLY',
+    private: 'PRIVATE',
+    adminwrite: 'ADMINWRITE',
+    adminonly: 'ADMINONLY',
+    custom: 'CUSTOM'
+};
+const REVERSE_LEVEL_MAP = {
+    READONLY: 'readonly',
+    PRIVATE: 'private',
+    ADMINWRITE: 'adminwrite',
+    ADMINONLY: 'adminonly',
+    CUSTOM: 'custom'
+};
+const LEVEL_DESCRIPTIONS = {
+    table: {
+        readonly: '读取全部数据，修改本人数据',
+        private: '读取和修改本人数据',
+        adminwrite: '读取全部数据，不可修改数据',
+        adminonly: '无权限'
+    },
+    collection: {
+        readonly: '读取全部数据，修改本人数据',
+        private: '读取和修改本人数据',
+        adminwrite: '读取全部数据，不可修改数据',
+        adminonly: '无权限',
+        custom: '自定义安全规则'
+    },
+    function: {
+        custom: '自定义安全规则'
+    },
+    storage: {
+        readonly: '所有用户可读，仅创建者和管理员可写',
+        private: '仅创建者及管理员可读写',
+        adminwrite: '所有用户可读，仅管理员可写',
+        adminonly: '仅管理员可读写',
+        custom: '自定义安全规则'
+    }
+};
+function parseResourceArg(resourceArg) {
+    if (!resourceArg) {
+        throw new error_1.CloudBaseError({
+            message: (0, i18n_1.t)('参数格式错误：请指定资源类型'),
+            code: 'INVALID_PARAM',
+            solution: [
+                (0, i18n_1.t)('用法：tcb permission set <type>:<resource> --level <level>'),
+                (0, i18n_1.t)('示例：tcb permission set table:users --level readonly'),
+                (0, i18n_1.t)('云函数可省略资源名称：tcb permission set function --level custom --rule \'{"read": true}\''),
+                (0, i18n_1.t)('支持的资源类型：{{types}}', { types: VALID_RESOURCE_TYPES.join(', ') })
+            ]
+        });
+    }
+    let resourceType;
+    let resource;
+    if (resourceArg.includes(':')) {
+        const colonIndex = resourceArg.indexOf(':');
+        resourceType = resourceArg.substring(0, colonIndex);
+        resource = resourceArg.substring(colonIndex + 1);
+    }
+    else {
+        resourceType = resourceArg;
+        resource = '';
+    }
+    if (!VALID_RESOURCE_TYPES.includes(resourceType)) {
+        throw new error_1.CloudBaseError({
+            message: (0, i18n_1.t)('不支持的资源类型：{{type}}', { type: resourceType }),
+            code: 'INVALID_ENUM',
+            solution: [
+                (0, i18n_1.t)('支持的资源类型：{{types}}', { types: VALID_RESOURCE_TYPES.join(', ') }),
+                (0, i18n_1.t)('示例：tcb permission set table:users --level readonly')
+            ]
+        });
+    }
+    const typedResourceType = resourceType;
+    if (!resource && typedResourceType !== 'function') {
+        throw new error_1.CloudBaseError({
+            message: (0, i18n_1.t)('资源名称不能为空'),
+            code: 'INVALID_PARAM',
+            solution: [
+                (0, i18n_1.t)('用法：tcb permission set <type>:<resource> --level <level>'),
+            ]
+        });
+    }
+    return { resourceType: typedResourceType, resource };
+}
+function parseGetResourceArg(resourceArg) {
+    const [rawType, rawResources = ''] = resourceArg.split(':');
+    const resources = rawResources
+        ? rawResources.split(',').map(r => r.trim()).filter(Boolean)
+        : [];
+    if (!VALID_RESOURCE_TYPES.includes(rawType)) {
+        throw new error_1.CloudBaseError({
+            message: (0, i18n_1.t)('不支持的资源类型：{{type}}', { type: rawType }),
+            code: 'INVALID_ENUM',
+            solution: [
+                (0, i18n_1.t)('支持的资源类型：{{types}}', { types: VALID_RESOURCE_TYPES.join(', ') }),
+                (0, i18n_1.t)('示例：tcb permission get table:users')
+            ]
+        });
+    }
+    if (resources.length > 100) {
+        throw new error_1.CloudBaseError({
+            message: (0, i18n_1.t)('资源列表不能超过 100 条，当前 {{count}} 条', { count: resources.length }),
+            code: 'INVALID_PARAM'
+        });
+    }
+    return { resourceType: rawType, resources };
+}
+function fetchResourceIdentifiers(resourceType, envId) {
+    var _a, _b;
+    return __awaiter(this, void 0, void 0, function* () {
+        const app = yield (0, utils_1.getMangerService)(envId);
+        switch (resourceType) {
+            case 'function':
+                return [];
+            case 'storage': {
+                const result = yield app.env.describeEnvs({ EnvId: envId });
+                const storages = ((_b = (_a = result.EnvList) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.Storages) || [];
+                return storages.map(s => s.Bucket).filter(Boolean);
+            }
+            case 'collection': {
+                const result = yield app.database.listCollections({});
+                const collections = result.Collections || [];
+                return collections.map(c => c.CollectionName);
+            }
+            case 'table': {
+                const result = yield app.mysql.runSql({
+                    Sql: `SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA='${envId}' AND TABLE_TYPE='BASE TABLE' AND TABLE_NAME LIKE '%'`,
+                    ReadOnly: true
+                });
+                return (result.Items || []).map((item) => {
+                    try {
+                        const parsed = JSON.parse(item);
+                        return Array.isArray(parsed) ? parsed[0] : parsed.TABLE_NAME;
+                    }
+                    catch (_a) {
+                        return item;
+                    }
+                });
+            }
+            default:
+                return [];
+        }
+    });
+}
+let PermissionSetCommand = class PermissionSetCommand extends common_1.Command {
+    get options() {
+        return {
+            cmd: 'permission',
+            childCmd: 'set <resourceArg>',
+            options: [
+                {
+                    flags: '-e, --env-id <envId>',
+                    desc: (0, i18n_1.t)('环境 Id'),
+                    deprecatedName: 'envId'
+                },
+                {
+                    flags: '--level <level>',
+                    desc: (0, i18n_1.t)('权限级别'),
+                    choices: ['readonly', 'private', 'adminwrite', 'adminonly', 'custom']
+                },
+                {
+                    flags: '--rule <rule>',
+                    desc: (0, i18n_1.t)('自定义规则（JSON 字符串）')
+                },
+            ],
+            desc: (0, i18n_1.t)('设置资源权限'),
+            examples: [
+                'tcb permission set table:users --level readonly --env-id xxx',
+                'tcb permission set function --level custom --rule \'{"read": true}\' --env-id xxx',
+                'tcb permission set table:users --level readonly --env-id xxx --json'
+            ]
+        };
+    }
+    execute(envId, params, options, log) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const resourceArg = params === null || params === void 0 ? void 0 : params[0];
+            const { resourceType, resource } = parseResourceArg(resourceArg);
+            const level = options.level;
+            const rule = options.rule;
+            if (!level && !rule) {
+                throw new error_1.CloudBaseError({
+                    message: (0, i18n_1.t)('请指定权限级别或自定义规则'),
+                    code: 'MISSING_PARAM',
+                    solution: [
+                        (0, i18n_1.t)('使用 --level 指定权限级别：tcb permission set {{type}}:{{resource}} --level <level>', { type: resourceType, resource }),
+                        (0, i18n_1.t)('或使用 --rule 指定自定义规则：tcb permission set {{type}}:{{resource}} --rule \'<json>\'', { type: resourceType, resource }),
+                        (0, i18n_1.t)('{{type}} 支持的权限级别：{{levels}}', { type: resourceType, levels: VALID_LEVELS[resourceType].join(', ') })
+                    ]
+                });
+            }
+            let finalLevel;
+            if (level) {
+                finalLevel = level;
+            }
+            else {
+                finalLevel = 'custom';
+            }
+            const validLevels = VALID_LEVELS[resourceType];
+            if (!validLevels.includes(finalLevel)) {
+                throw new error_1.CloudBaseError({
+                    message: (0, i18n_1.t)('资源类型 {{type}} 不支持权限级别 {{level}}', { type: resourceType, level: finalLevel }),
+                    code: 'INVALID_PARAM',
+                    solution: [
+                        (0, i18n_1.t)('{{type}} 支持的权限级别：{{levels}}', { type: resourceType, levels: validLevels.join(', ') })
+                    ]
+                });
+            }
+            if (finalLevel === 'custom' && !rule) {
+                throw new error_1.CloudBaseError({
+                    message: (0, i18n_1.t)('权限级别为 custom 时，需要提供 --rule '),
+                    code: 'MISSING_PARAM',
+                    solution: [
+                        (0, i18n_1.t)('使用 --rule 指定规则：--rule \'{"read": true}\''),
+                        (0, i18n_1.t)('示例：tcb permission set {{type}}:{{resource}} --level custom --rule \'{"read": true}\'', { type: resourceType, resource })
+                    ]
+                });
+            }
+            const apiOptions = {
+                resourceType,
+                resource,
+                permission: LEVEL_MAP[finalLevel]
+            };
+            if (rule) {
+                apiOptions.securityRule = rule;
+            }
+            const confirmed = yield (0, utils_1.autoConfirm)((0, i18n_1.t)('即将设置 {{type}}/{{resource}} 的权限为 {{level}}，确认执行？', {
+                type: resourceType, resource, level: finalLevel
+            }));
+            if (!confirmed)
+                return;
+            if (!(0, utils_1.isJsonOutput)()) {
+                log.info((0, i18n_1.t)('正在设置 {{type}}/{{resource}} 的权限...', { type: resourceType, resource }));
+            }
+            try {
+                const permissionService = yield getPermissionService(envId);
+                const resp = yield permissionService.modifyResourcePermission(apiOptions);
+                if ((0, utils_1.isJsonOutput)()) {
+                    (0, utils_1.outputJson)(resp);
+                    return;
+                }
+                log.success((0, i18n_1.t)('资源权限设置成功'));
+                log.info('');
+                log.info((0, i18n_1.t)('权限详情:'));
+                log.info(`  Resource:    ${resourceType}/${resource}`);
+                log.info(`  Level:       ${finalLevel}`);
+                const description = (_a = LEVEL_DESCRIPTIONS[resourceType]) === null || _a === void 0 ? void 0 : _a[finalLevel];
+                if (description) {
+                    log.info(`  Description: ${description}`);
+                }
+                if (rule) {
+                    log.info(`  Rule:        ${rule}`);
+                }
+                log.info('');
+                log.info((0, i18n_1.t)('下一步：'));
+                log.info(`  ${(0, i18n_1.t)('查看资源权限')}    ${(0, utils_1.highlightCommand)(`tcb permission get ${resourceType}:${resource} --env-id ${envId}`)}`);
+            }
+            catch (e) {
+                throw new error_1.CloudBaseError({
+                    message: e.message || (0, i18n_1.t)('设置资源权限失败'),
+                    code: 'API_ERROR',
+                    solution: [
+                        (0, i18n_1.t)('请检查资源名称是否正确'),
+                        (0, i18n_1.t)('运行 {{cmd}} 重新登录', { cmd: (0, utils_1.highlightCommand)('tcb login') })
+                    ],
+                    original: e
+                });
+            }
+        });
+    }
+};
+__decorate([
+    (0, decorators_1.InjectParams)(),
+    __param(0, (0, decorators_1.EnvId)()),
+    __param(1, (0, decorators_1.ArgsParams)()),
+    __param(2, (0, decorators_1.ArgsOptions)()),
+    __param(3, (0, decorators_1.Log)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Array, Object, decorators_1.Logger]),
+    __metadata("design:returntype", Promise)
+], PermissionSetCommand.prototype, "execute", null);
+PermissionSetCommand = __decorate([
+    (0, common_1.ICommand)()
+], PermissionSetCommand);
+exports.PermissionSetCommand = PermissionSetCommand;
+let PermissionGetCommand = class PermissionGetCommand extends common_1.Command {
+    get options() {
+        return {
+            cmd: 'permission',
+            childCmd: 'get [resourceArg]',
+            options: [
+                {
+                    flags: '-e, --env-id <envId>',
+                    desc: (0, i18n_1.t)('环境 Id'),
+                    deprecatedName: 'envId'
+                }
+            ],
+            desc: (0, i18n_1.t)('查询资源权限'),
+            autoRunLogin: true,
+            examples: [
+                'tcb permission get --env-id xxx',
+                'tcb permission get table --env-id xxx',
+                'tcb permission get table:users --env-id xxx',
+                'tcb permission get table:users,orders --env-id xxx',
+                'tcb permission get function --env-id xxx',
+                'tcb permission get storage:my-bucket --env-id xxx',
+                'tcb permission get table --env-id xxx --json'
+            ]
+        };
+    }
+    execute(envId, params, options, log) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const resourceArg = params === null || params === void 0 ? void 0 : params[0];
+            let queryTypes;
+            if (!resourceArg) {
+                queryTypes = [...VALID_RESOURCE_TYPES];
+            }
+            else if (!resourceArg.includes(':')) {
+                if (!VALID_RESOURCE_TYPES.includes(resourceArg)) {
+                    throw new error_1.CloudBaseError({
+                        message: (0, i18n_1.t)('不支持的资源类型：{{type}}', { type: resourceArg }),
+                        code: 'INVALID_ENUM',
+                        solution: [
+                            (0, i18n_1.t)('支持的资源类型：{{types}}', { types: VALID_RESOURCE_TYPES.join(', ') })
+                        ]
+                    });
+                }
+                queryTypes = [resourceArg];
+            }
+            else {
+                const { resourceType, resources } = parseGetResourceArg(resourceArg);
+                queryTypes = [resourceType];
+                return this.executeWithResources(resourceType, resources, envId, log);
+            }
+            return this.executeForTypes(queryTypes, envId, log);
+        });
+    }
+    executeWithResources(resourceType, resources, envId, log) {
+        var _a, _b, _c;
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!(0, utils_1.isJsonOutput)()) {
+                const displayResources = resources.join(', ');
+                log.info((0, i18n_1.t)('正在查询 {{type}} 的权限（{{resources}}）...', {
+                    type: resourceType,
+                    resources: displayResources
+                }));
+            }
+            try {
+                const permissionService = yield getPermissionService(envId);
+                let finalResources = resources;
+                if (finalResources.length === 0 && resourceType !== 'function') {
+                    finalResources = yield fetchResourceIdentifiers(resourceType, envId);
+                }
+                if (finalResources.length === 0) {
+                    if (!(0, utils_1.isJsonOutput)()) {
+                        log.info((0, i18n_1.t)('{{type}} 类型的资源列表为空，跳过查询', { type: resourceType }));
+                    }
+                    this.outputResult([], 0, log);
+                    return;
+                }
+                const resp = yield permissionService.describeResourcePermission({
+                    resourceType,
+                    resources: finalResources
+                });
+                this.outputResult(((_a = resp.Data) === null || _a === void 0 ? void 0 : _a.PermissionList) || [], (_c = (_b = resp.Data) === null || _b === void 0 ? void 0 : _b.TotalCount) !== null && _c !== void 0 ? _c : 0, log);
+            }
+            catch (e) {
+                throw new error_1.CloudBaseError({
+                    message: e.message || (0, i18n_1.t)('查询资源权限失败'),
+                    code: 'API_ERROR',
+                    solution: [
+                        (0, i18n_1.t)('请检查资源名称是否正确'),
+                        (0, i18n_1.t)('运行 {{cmd}} 重新登录', { cmd: (0, utils_1.highlightCommand)('tcb login') })
+                    ],
+                    original: e
+                });
+            }
+        });
+    }
+    executeForTypes(types, envId, log) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const typeDisplay = types.length === VALID_RESOURCE_TYPES.length
+                ? (0, i18n_1.t)('全部类型')
+                : types.join(', ');
+            if (!(0, utils_1.isJsonOutput)()) {
+                log.info((0, i18n_1.t)('正在查询 {{types}} 的资源权限...', { types: typeDisplay }));
+            }
+            const permissionService = yield getPermissionService(envId);
+            const results = yield Promise.all(types.map((type) => __awaiter(this, void 0, void 0, function* () {
+                var _a, _b, _c, _d;
+                try {
+                    const resources = yield fetchResourceIdentifiers(type, envId);
+                    if (type !== 'function' && resources.length === 0) {
+                        log.verbose(`[${type}] 无资源，跳过查询`);
+                        return { permissionList: [], totalCount: 0 };
+                    }
+                    const apiResources = type === 'function' ? undefined : resources;
+                    if (!(0, utils_1.isJsonOutput)()) {
+                        log.verbose(`[${type}] 获取到 ${(_a = apiResources === null || apiResources === void 0 ? void 0 : apiResources.length) !== null && _a !== void 0 ? _a : 0} 个资源标识`);
+                    }
+                    const resp = yield permissionService.describeResourcePermission({
+                        resourceType: type,
+                        resources: apiResources
+                    });
+                    return {
+                        permissionList: ((_b = resp.Data) === null || _b === void 0 ? void 0 : _b.PermissionList) || [],
+                        totalCount: (_d = (_c = resp.Data) === null || _c === void 0 ? void 0 : _c.TotalCount) !== null && _d !== void 0 ? _d : 0
+                    };
+                }
+                catch (e) {
+                    if (!(0, utils_1.isJsonOutput)()) {
+                        log.warn((0, i18n_1.t)('查询 {{type}} 权限失败: {{error}}', {
+                            type,
+                            error: e.message
+                        }));
+                    }
+                    return { permissionList: [], totalCount: 0 };
+                }
+            })));
+            const allPermissions = results.reduce((list, r) => list.concat(r.permissionList), []);
+            const totalCount = results.reduce((sum, r) => sum + r.totalCount, 0);
+            this.outputResult(allPermissions, totalCount, log);
+        });
+    }
+    outputResult(permissionList, totalCount, log) {
+        if ((0, utils_1.isJsonOutput)()) {
+            (0, utils_1.outputJson)({
+                TotalCount: totalCount,
+                PermissionList: permissionList
+            });
+            return;
+        }
+        if (permissionList.length === 0) {
+            log.info((0, i18n_1.t)('未查询到权限记录'));
+            return;
+        }
+        const head = [
+            (0, i18n_1.t)('资源类型'),
+            (0, i18n_1.t)('资源名称'),
+            (0, i18n_1.t)('权限级别'),
+            (0, i18n_1.t)('描述')
+        ];
+        const tableData = permissionList.map(item => {
+            var _a;
+            const type = item.ResourceType || '-';
+            const resource = item.Resource || '-';
+            const permission = item.Permission || '-';
+            const lowerLevel = REVERSE_LEVEL_MAP[permission] || permission;
+            const description = ((_a = LEVEL_DESCRIPTIONS[type]) === null || _a === void 0 ? void 0 : _a[lowerLevel]) || '-';
+            return [type, resource, lowerLevel, description];
+        });
+        (0, utils_1.printHorizontalTable)(head, tableData);
+        log.info((0, i18n_1.t)('共 {{count}} 条记录', { count: totalCount }));
+    }
+};
+__decorate([
+    (0, decorators_1.InjectParams)(),
+    __param(0, (0, decorators_1.EnvId)()),
+    __param(1, (0, decorators_1.ArgsParams)()),
+    __param(2, (0, decorators_1.ArgsOptions)()),
+    __param(3, (0, decorators_1.Log)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Array, Object, decorators_1.Logger]),
+    __metadata("design:returntype", Promise)
+], PermissionGetCommand.prototype, "execute", null);
+__decorate([
+    (0, decorators_1.InjectParams)(),
+    __param(3, (0, decorators_1.Log)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Array, String, decorators_1.Logger]),
+    __metadata("design:returntype", Promise)
+], PermissionGetCommand.prototype, "executeWithResources", null);
+__decorate([
+    (0, decorators_1.InjectParams)(),
+    __param(2, (0, decorators_1.Log)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Array, String, decorators_1.Logger]),
+    __metadata("design:returntype", Promise)
+], PermissionGetCommand.prototype, "executeForTypes", null);
+__decorate([
+    (0, decorators_1.InjectParams)(),
+    __param(2, (0, decorators_1.Log)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Array, Number, decorators_1.Logger]),
+    __metadata("design:returntype", void 0)
+], PermissionGetCommand.prototype, "outputResult", null);
+PermissionGetCommand = __decorate([
+    (0, common_1.ICommand)()
+], PermissionGetCommand);
+exports.PermissionGetCommand = PermissionGetCommand;
+
+
 /***/ }),
 
 /***/ 15782:
@@ -547274,6 +548843,32 @@ function sleep(time) {
 exports.sleep = sleep;
 
 
+/***/ }),
+
+/***/ 41650:
+/***/ (function(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+__exportStar(__webpack_require__(15771), exports);
+__exportStar(__webpack_require__(2604), exports);
+
+
 /***/ }),
 
 /***/ 41665:
@@ -597880,6 +599475,7 @@ __exportStar(__webpack_require__(38001), exports);
 __exportStar(__webpack_require__(11502), exports);
 __exportStar(__webpack_require__(81106), exports);
 __exportStar(__webpack_require__(60928), exports);
+__exportStar(__webpack_require__(41650), exports);
 
 
 /***/ }),
@@ -939243,6 +940839,9 @@ const outputHelpInfo = () => {
     docs              [cmd]                      ${(0, i18n_1.t)('云开发文档检索操作')}
     api               [cmd]                      ${(0, i18n_1.t)('通用腾讯云 API 调用操作')}
     secrets           [cmd]                      ${(0, i18n_1.t)('临时密钥管理操作')}
+    user              [cmd]                      ${(0, i18n_1.t)('用户管理操作')}
+    permission        [cmd]                      ${(0, i18n_1.t)('资源权限管理操作')}
+    role              [cmd]                      ${(0, i18n_1.t)('角色管理操作')}
 `;
     const options = `
   ${(0, i18n_1.t)('选项')}