@lark-apaas/miaoda-cli 0.1.3-alpha.2d526ac → 0.1.3-alpha.3198e3b

package/dist/api/db/api.js

@@ -48,8 +48,13 @@ async function mapDbHttpError(err, url, ctx, opts) {
                     (0, client_1.extractData)(body); // 业务 code 命中 → 抛 AppError；不命中走兜底
                 }
                 catch (appErr) {
-                    if (appErr instanceof error_1.AppError && opts?.onErrorBody) {
-                        opts.onErrorBody(body, appErr);
+                    if (appErr instanceof error_1.AppError) {
+                        // env 上下文存在时把"env not exist"系列错误统一重写成 UNKNOWN_ENV_VALUE
+                        // —— 用户视角 vocab 错和 state 错都是「这个 env 不能用」，文案统一更好理解。
+                        const decorated = (0, client_1.decorateEnvError)(appErr, opts?.env);
+                        if (opts?.onErrorBody)
+                            opts.onErrorBody(body, decorated);
+                        throw decorated;
                     }
                     throw appErr;
                 }
@@ -104,6 +109,7 @@ async function execSql(opts) {
     catch (err) {
         (0, client_1.traceHttp)('POST', url, start, err instanceof http_client_1.HttpError ? err.response : undefined, err);
         await mapDbHttpError(err, url, 'Failed to execute SQL', {
+            env: opts.dbBranch,
             onErrorBody: attachSqlPartialResults,
             // SQL 路径单独的超时文案：PG 的 statement_timeout 会回滚整条事务，所以这里
             // 明示「事务已回滚、没有改动落地」，并把 hint 引导到「简化 SQL / 加 LIMIT / 拆条」。
@@ -191,7 +197,7 @@ async function getSchema(opts) {
     }
     catch (err) {
         (0, client_1.traceHttp)('GET', url, start, err instanceof http_client_1.HttpError ? err.response : undefined, err);
-        await mapDbHttpError(err, url, 'Failed to get schema');
+        await mapDbHttpError(err, url, 'Failed to get schema', { env: opts.dbBranch });
         throw err; // 不可达
     }
     const body = (await response.json());
@@ -229,7 +235,7 @@ async function importData(opts) {
     }
     catch (err) {
         (0, client_1.traceHttp)('POST', url, start, err instanceof http_client_1.HttpError ? err.response : undefined, err);
-        await mapDbHttpError(err, url, 'Failed to import data');
+        await mapDbHttpError(err, url, 'Failed to import data', { env: opts.dbBranch });
         throw err; // 不可达
     }
     // 后端 InnerAdminImportData 响应里 data 直接返 {tableName, recordCount, durationMs}
@@ -268,7 +274,7 @@ async function exportData(opts) {
     }
     catch (err) {
         (0, client_1.traceHttp)('POST', url, start, err instanceof http_client_1.HttpError ? err.response : undefined, err);
-        await mapDbHttpError(err, url, 'Failed to export data');
+        await mapDbHttpError(err, url, 'Failed to export data', { env: opts.dbBranch });
         throw err; // 不可达
     }
     // 成功路径：响应 body 通常是原始 CSV/SQL/JSON 字节，但部分错误场景下网关会返
@@ -340,7 +346,7 @@ async function listDDLChangelog(opts) {
     }
     catch (err) {
         (0, client_1.traceHttp)('GET', url, start, err instanceof http_client_1.HttpError ? err.response : undefined, err);
-        await mapDbHttpError(err, url, 'Failed to list DDL changelog');
+        await mapDbHttpError(err, url, 'Failed to list DDL changelog', { env: opts.dbBranch });
         throw err; // 不可达
     }
     const body = (await response.json());
@@ -370,7 +376,7 @@ async function getAuditStatus(opts) {
     }
     catch (err) {
         (0, client_1.traceHttp)('GET', url, start, err instanceof http_client_1.HttpError ? err.response : undefined, err);
-        await mapDbHttpError(err, url, 'Failed to get audit status');
+        await mapDbHttpError(err, url, 'Failed to get audit status', { env: opts.dbBranch });
         throw err; // 不可达
     }
     const respBody = (await response.json());
@@ -402,7 +408,7 @@ async function setAuditConfig(opts) {
     }
     catch (err) {
         (0, client_1.traceHttp)('POST', url, start, err instanceof http_client_1.HttpError ? err.response : undefined, err);
-        await mapDbHttpError(err, url, 'Failed to set audit config');
+        await mapDbHttpError(err, url, 'Failed to set audit config', { env: opts.dbBranch });
         throw err; // 不可达
     }
     const respBody = (await response.json());
@@ -430,7 +436,9 @@ async function listAuditLog(opts) {
     }
     const client = (0, http_1.getHttpClient)();
     const url = (0, client_1.buildInnerUrl)(opts.appId, '/db/audit/log', {
-        tables: opts.tables.join(','),
+        // IDL `Tables list<string>` 走重复 query key（?tables=A&tables=B）—— join(',')
+        // 会让 Hertz/Kitex 网关绑成 ["A,B"] 单元素切片，命中单表错误分支报错文案错乱。
+        tables: opts.tables,
         since: opts.since,
         until: opts.until,
         limit: opts.limit !== undefined ? String(opts.limit) : undefined,
@@ -445,7 +453,7 @@ async function listAuditLog(opts) {
     }
     catch (err) {
         (0, client_1.traceHttp)('GET', url, start, err instanceof http_client_1.HttpError ? err.response : undefined, err);
-        await mapDbHttpError(err, url, 'Failed to list audit log');
+        await mapDbHttpError(err, url, 'Failed to list audit log', { env: opts.dbBranch });
         throw err; // 不可达
     }
     const body = (await response.json());
@@ -522,7 +530,7 @@ async function getMigrationStatus(opts) {
     }
     catch (err) {
         (0, client_1.traceHttp)('GET', url, start, err instanceof http_client_1.HttpError ? err.response : undefined, err);
-        await mapDbHttpError(err, url, 'Failed to get migration status');
+        await mapDbHttpError(err, url, 'Failed to get migration status', { env: opts.dbBranch });
         throw err; // 不可达
     }
     const body = (await response.json());
@@ -571,7 +579,7 @@ async function getRecoveryPreview(opts) {
     }
     catch (err) {
         (0, client_1.traceHttp)('GET', url, start, err instanceof http_client_1.HttpError ? err.response : undefined, err);
-        await mapDbHttpError(err, url, 'Failed to get recovery preview');
+        await mapDbHttpError(err, url, 'Failed to get recovery preview', { env: opts.dbBranch });
         throw err; // 不可达
     }
     const body = (await response.json());
@@ -594,7 +602,7 @@ async function getRecoveryStatus(opts) {
     }
     catch (err) {
         (0, client_1.traceHttp)('GET', url, start, err instanceof http_client_1.HttpError ? err.response : undefined, err);
-        await mapDbHttpError(err, url, 'Failed to get recovery status');
+        await mapDbHttpError(err, url, 'Failed to get recovery status', { env: opts.dbBranch });
         throw err; // 不可达
     }
     const body = (await response.json());
@@ -615,7 +623,7 @@ async function getDbQuota(opts) {
     }
     catch (err) {
         (0, client_1.traceHttp)('GET', url, start, err instanceof http_client_1.HttpError ? err.response : undefined, err);
-        await mapDbHttpError(err, url, 'Failed to get db quota');
+        await mapDbHttpError(err, url, 'Failed to get db quota', { env: opts.dbBranch });
         throw err; // 不可达
     }
     const respBody = (await response.json());

package/dist/api/db/client.js

@@ -1,9 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SQLSTATE_MAP = void 0;
+exports.SQLSTATE_MAP = exports.ENV_CTX_TYPO = void 0;
 exports.traceHttp = traceHttp;
 exports.ensureInnerSuccess = ensureInnerSuccess;
 exports.mapDataloomBizError = mapDataloomBizError;
+exports.buildUnknownEnvError = buildUnknownEnvError;
+exports.decorateEnvError = decorateEnvError;
 exports.extractData = extractData;
 exports.buildInnerUrl = buildInnerUrl;
 const error_1 = require("../../utils/error");
@@ -69,7 +71,8 @@ function ensureInnerSuccess(body) {
  *
  * 优先级：
  *   1. k_dl_1300002 + SQLSTATE 透传     → SQLSTATE_MAP
- *   2. k_dl_1600000 + "Invalid DB Branch" → MULTI_ENV_NOT_INITIALIZED
+ *   2. k_dl_1600000 + "Invalid DB Branch" → UNKNOWN_ENV_VALUE 占位（mapDbHttpError
+ *      会用用户实际 --env 值通过 decorateEnvError 重写）
  *   3. BIZ_ERR_MAP 命中 → 语义 code（可能带 hint）
  *   4. 兜底 DB_API_<code>
  *
@@ -84,7 +87,13 @@ function mapDataloomBizError(code, rawMessage) {
         }
     }
     if (code === 'k_dl_1600000' && message.startsWith('Invalid DB Branch')) {
-        return new error_1.AppError('MULTI_ENV_NOT_INITIALIZED', '--env is not available (multi-env not initialized)', { next_actions: ['Verify the --env value matches an existing dbBranch.'] });
+        // 这里没有 user-facing --env 值（client 层不知道 CLI 入参），先用 server 侧返回的
+        // 分支名占位；mapDbHttpError 在拿到 env 上下文后会通过 decorateEnvError 重写成
+        // 用户传入的实际值。dataloom 错误文案历史上同时存在英文冒号和中文冒号「：」格式，
+        // 这里两种都接。
+        const m = /Invalid DB Branch[:：\s]+([^\s]+)/i.exec(message);
+        const branch = m?.[1] ?? '<branch>';
+        return buildUnknownEnvError(branch);
     }
     const mapped = BIZ_ERR_MAP.get(code);
     if (mapped) {
@@ -94,6 +103,71 @@ function mapDataloomBizError(code, rawMessage) {
     }
     return new error_1.AppError(`DB_API_${code}`, message);
 }
+/**
+ * typo / CLI vocab violation 路径用：state 未知，列双 env 让用户在 dev/online 之间选，
+ * 不引导 init（init 不会创建 typo 出来的分支）。
+ */
+exports.ENV_CTX_TYPO = {
+    available: ['dev', 'online'],
+    suggestInit: false,
+};
+/**
+ * 统一构造"--env 值不可用"错误。两类入口共用：
+ *   - CLI vocab 校验（_env.ts validateEnv）：用户传 dev/main/online 以外值
+ *   - backend state 错（decorateEnvError）：vocab 合法但 db 实际状态对不上
+ *
+ * `available` 跟 `suggestInit` 由调用方按错误码归类传入；user-facing 不展示 `main`
+ * 内部别名，统一用 `online`。
+ */
+function buildUnknownEnvError(env, ctx = exports.ENV_CTX_TYPO) {
+    const hints = [
+        `--env must match an existing database branch. Available: ${ctx.available.join(', ')}.`,
+    ];
+    if (ctx.suggestInit) {
+        hints.push(`Run \`miaoda db migration init\` before using '${env}'.`);
+    }
+    return new error_1.AppError('UNKNOWN_ENV_VALUE', `Unknown --env value '${env}'`, {
+        next_actions: hints,
+    });
+}
+/**
+ * 把 backend env 相关错误统一重写成 UNKNOWN_ENV_VALUE 文案，按错误码做 state 推断：
+ *
+ *   - DB_API_k_dl_1300033（非专家应用）→ 单 env (online)，不建议 init
+ *   - DB_API_k_dl_1300039（专家未 init）→ 单 env (online)，建议 init
+ *   - DB_API_k_dl_000007 + "db branch not found"（pg connection 兜底）→ 单 env，建议 init
+ *   - UNKNOWN_ENV_VALUE（mapDataloomBizError 对 k_dl_1600000 的占位）→ typo path
+ *
+ * env 未传时不改写：避免把 backend 兜底文案（如 "Multi-env is not initialized"）
+ * 改成 `Unknown --env value ''` 这种空字符串错误。
+ */
+function decorateEnvError(err, env) {
+    if (env === undefined || env === '')
+        return err;
+    const ctx = classifyEnvError(err);
+    if (!ctx)
+        return err;
+    return buildUnknownEnvError(env, ctx);
+}
+function classifyEnvError(err) {
+    if (err.code === 'DB_API_k_dl_1300033') {
+        // 非专家应用：init 也会被同一 guard 拒掉，建议 init 是误导
+        return { available: ['online'], suggestInit: false };
+    }
+    if (err.code === 'DB_API_k_dl_1300039') {
+        // 专家未 init：init 会创建 dev 分支
+        return { available: ['online'], suggestInit: true };
+    }
+    if (err.code === 'DB_API_k_dl_000007' && /db branch not found/i.test(err.message)) {
+        // pg connection 层 ErrParamsInvalid：大概率 pre-init；建议 init（非专家会被 init 路径拦）
+        return { available: ['online'], suggestInit: true };
+    }
+    if (err.code === 'UNKNOWN_ENV_VALUE') {
+        // mapDataloomBizError 对 k_dl_1600000 的占位：typo path，state 未知，列双 env
+        return exports.ENV_CTX_TYPO;
+    }
+    return null;
+}
 /**
  * 剥掉 PG 透传错误的 "ERROR:" 前缀：CLI 输出本身就会前缀 "Error:"，
  * 不去掉就会变成 `Error: ERROR: relation ...` 双重前缀，PRD 不要这种冗余。
@@ -201,12 +275,25 @@ function buildInnerUrl(appId, path, query) {
     let url = `/v1/dataloom/app/${encodeURIComponent(appId)}${normalized}`;
     if (query) {
         const usp = new URLSearchParams();
-        for (const [k, v] of Object.entries(query)) {
-            if (v === undefined || v === '')
+        for (const [k, rawV] of Object.entries(query)) {
+            if (rawV === undefined)
+                continue;
+            // 数组值 → 重复 key 编码（?k=v1&k=v2）。IDL 里 list<string> 类型经
+            // Hertz/Kitex HTTP→Thrift 网关绑定 slice 字段需要重复 key；如果改成
+            // join(',') 单串，后端会拿到 ["v1,v2"] 单元素切片而非 ["v1","v2"]。
+            if (typeof rawV !== 'string') {
+                for (const item of rawV) {
+                    if (item === '')
+                        continue;
+                    usp.append(k, item);
+                }
+                continue;
+            }
+            if (rawV === '')
                 continue;
             // dbBranch 兼容用户视角的 `online` 别名 → 后端实际 dbBranch 名为 `main`，
             // 这里集中归一，避免每个 API 函数各自处理。其他值（dev / 自定义分支）原样透传。
-            const norm = k === 'dbBranch' && v === 'online' ? 'main' : v;
+            const norm = k === 'dbBranch' && rawV === 'online' ? 'main' : rawV;
             usp.append(k, norm);
         }
         const qs = usp.toString();

package/dist/cli/commands/db/index.js

@@ -4,6 +4,7 @@ exports.registerDbCommands = registerDbCommands;
 const error_1 = require("../../../utils/error");
 const index_1 = require("../../../cli/handlers/db/index");
 const shared_1 = require("../../../cli/commands/shared");
+const _env_1 = require("../../../cli/handlers/db/_env");
 function parsePositiveInt(raw) {
     const n = Number(raw);
     if (!Number.isInteger(n) || n < 1) {
@@ -19,6 +20,13 @@ function registerDbCommands(program) {
         // --env 注册在 db 父级，spec 把它列入 db --help 的 Global Flags；
         // leaf 命令仍各自接收 --env 值（commander 解析时父级 option 自动适用于子命令）
         .option('--env <name>', '指定目标环境（dev / online，仅专家模式应用支持）');
+    // 任意 leaf action 执行前先做 --env vocab 校验：用户拼错（'onlin'/'prod' 等）立即报
+    // UNKNOWN_ENV_VALUE 避免后端无意义被打到。preAction hook 拿父级 dbCmd 的 --env 值
+    // —— commander 把父级 option 自动 propagate 给子命令的 optsWithGlobals。
+    dbCmd.hook('preAction', () => {
+        const env = dbCmd.opts().env;
+        (0, _env_1.validateEnv)(typeof env === 'string' ? env : undefined);
+    });
     dbCmd.action(() => {
         dbCmd.outputHelp();
     });

package/dist/cli/handlers/db/_destructive.js

@@ -0,0 +1,67 @@
+"use strict";
+// db 域内不可逆 / destructive 操作的统一确认门。
+//
+// 设计要点：
+//   1. --yes：放行（CI / 脚本显式确认场景）
+//   2. 非 TTY 且无 --yes：抛 DESTRUCTIVE_REQUIRES_CONFIRM，不要默认放行。
+//      非 TTY 通常是 CI / agent / 管道场景，无人能交互回答 y/N，必须靠 --yes 显式确认。
+//   3. TTY 且无 --yes：交互式 y/N（prompt 写 stderr，避免污染 --json 模式 stdout）
+//
+// 反例（已修复，见这次 commit）：把 !isJsonMode() 拿来做确认门 —— --json 只改输出
+// 格式，跟"用户已确认"不是同一语义。CI / agent 几乎总会带 --json 解析输出，等价于
+// 把不可逆操作的确认变成了空门，跟 file rm 的模型也不一致。
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.confirmDestructive = confirmDestructive;
+exports.assertDestructiveAllowedInTty = assertDestructiveAllowedInTty;
+exports.askYesNo = askYesNo;
+const node_readline_1 = __importDefault(require("node:readline"));
+const render_1 = require("../../../utils/render");
+const error_1 = require("../../../utils/error");
+const DESTRUCTIVE_REQUIRES_CONFIRM_MSG = 'This operation is destructive. Rerun with --yes to confirm.';
+/**
+ * 完整的"yes/tty/交互"决策门。直接用于无需 fetch 预览的简单确认场景（如 migration init）。
+ *
+ * 返回值：
+ *   - true  → 已确认，可执行
+ *   - false → TTY 下用户输了 n，调用方应渲染 Aborted 并退出
+ *
+ * 异常：
+ *   - DESTRUCTIVE_REQUIRES_CONFIRM：非 TTY 且无 --yes
+ */
+async function confirmDestructive(prompt, yes) {
+    if (yes === true)
+        return true;
+    if (!(0, render_1.isStdoutTty)()) {
+        throw new error_1.AppError('DESTRUCTIVE_REQUIRES_CONFIRM', DESTRUCTIVE_REQUIRES_CONFIRM_MSG);
+    }
+    return askYesNo(prompt);
+}
+/**
+ * 给"需要在 confirm 之前先 fetch 预览"的场景（migration apply / recovery apply 可选优化）用：
+ * 在非 TTY 无 --yes 时提前抛错，避免无意义触发后端 dry-run RPC。
+ *
+ * 调用后 TTY 路径仍需自行调 askYesNo / confirmDestructive 完成交互。
+ */
+function assertDestructiveAllowedInTty(yes) {
+    if (yes === true)
+        return;
+    if (!(0, render_1.isStdoutTty)()) {
+        throw new error_1.AppError('DESTRUCTIVE_REQUIRES_CONFIRM', DESTRUCTIVE_REQUIRES_CONFIRM_MSG);
+    }
+}
+/**
+ * 交互式 y/N。输入读 stdin，prompt 写 stderr —— stderr 避免污染 --json 模式 stdout 的 envelope。
+ * 仅 'y'（忽略大小写）算确认；其余一律视为否决。
+ */
+async function askYesNo(prompt) {
+    const rl = node_readline_1.default.createInterface({ input: process.stdin, output: process.stderr });
+    return new Promise((resolve) => {
+        rl.question(prompt, (answer) => {
+            rl.close();
+            resolve(answer.trim().toLowerCase() === 'y');
+        });
+    });
+}

package/dist/cli/handlers/db/_env.js

@@ -0,0 +1,26 @@
+"use strict";
+// db 域内 --env 参数的 CLI vocab 校验。
+//
+// 用户视角的 vocab：
+//   - dev    → 多环境沙箱分支
+//   - online → 生产分支（向后端发请求时映射成 main，client.ts/api.ts 已处理）
+//   - main   → online 的别名，兼容历史脚本
+//
+// 配合 client.ts::buildUnknownEnvError，把 vocab 错（这里）跟 backend state 错
+// （client.ts 处理）统一成同一类 UNKNOWN_ENV_VALUE，避免用户在两种失败之间困惑。
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateEnv = validateEnv;
+const client_1 = require("../../../api/db/client");
+const VOCAB = ['dev', 'main', 'online'];
+const VOCAB_SET = new Set(VOCAB);
+/**
+ * CLI vocab 校验。空值（未传 --env）放行，由后端按 workspace 默认 branch 处理。
+ * 不在 vocab 内 → 抛 UNKNOWN_ENV_VALUE，preAction hook 兜底，避免无意义触发 RPC。
+ */
+function validateEnv(env) {
+    if (env === undefined || env === '')
+        return;
+    if (VOCAB_SET.has(env))
+        return;
+    throw (0, client_1.buildUnknownEnvError)(env);
+}

package/dist/cli/handlers/db/audit.js

@@ -45,6 +45,7 @@ const output_1 = require("../../../utils/output");
 const render_1 = require("../../../utils/render");
 const time_1 = require("../../../utils/time");
 const _operator_1 = require("../../../cli/handlers/db/_operator");
+const index_1 = require("../../../api/db/index");
 const VALID_RETENTION = new Set(['7d', '30d', '180d', '360d', 'forever']);
 async function handleDbAuditStatus(table, opts) {
     const appId = (0, shared_1.resolveAppId)(opts);
@@ -200,43 +201,43 @@ async function handleDbAuditList(tables, opts) {
     const since = normalizeTime(opts.since, '--since');
     const until = normalizeTime(opts.until, '--until');
     // 多表场景：dataloom 对"任一表不存在"是 fail-fast（typo 应立即可见，符合 PRD 单表语义），
-    // 但 PRD 多表语义是"其他表继续返回，底部汇总跳过情况"。CLI 在这里做闭环：把不存在的表
-    // 从入参里剥掉重试，最终跟服务端 skipped（audit 未启用）合并展示。单表场景仍 fail-fast。
+    // 但 PRD 多表语义是"其他表继续返回，底部汇总跳过情况"。CLI 在这里前置校验：用 getSchema
+    // 的 tableNames 过滤模式（dataloom 端内存过滤，不存在的表静默忽略，不报错）拿到存在的
+    // 表集合，本地 diff 出缺失表，再用过滤后的表去查 listAuditLog。单表场景跳过预校验。
     const isMulti = tables.length > 1;
-    let result;
+    let queryTables = tables;
     const localMissing = [];
-    let curTables = [...tables];
-    for (;;) {
-        try {
-            result = await api.db.listAuditLog({
-                appId,
-                tables: curTables,
-                since,
-                until,
-                limit,
-                cursor: opts.cursor,
-                dbBranch: opts.env,
-            });
-            break;
+    if (isMulti) {
+        const schemaResp = await api.db.getSchema({
+            appId,
+            tableNames: tables.join(','),
+            dbBranch: opts.env,
+        });
+        const existing = new Set((0, index_1.flattenSchemaList)(schemaResp.schema).map((t) => t.name));
+        for (const t of tables) {
+            if (!existing.has(t))
+                localMissing.push(t);
         }
-        catch (err) {
-            if (isMulti && err instanceof error_1.AppError && err.code === 'DB_API_k_dl_000005') {
-                const missing = extractMissingTable(err.message);
-                if (missing !== null && curTables.includes(missing)) {
-                    localMissing.push(missing);
-                    curTables = curTables.filter((t) => t !== missing);
-                    if (curTables.length === 0) {
-                        // 全部表都不存在 → 抛 TABLE_NOT_FOUND，列出所有缺失表
-                        throw new error_1.AppError('TABLE_NOT_FOUND', `None of the requested tables exist: ${localMissing.join(', ')}`, {
-                            next_actions: ['Run `miaoda db schema list` to see all tables.'],
-                        });
-                    }
-                    continue;
-                }
-            }
-            throw decorateAuditListError(err, tables);
+        queryTables = tables.filter((t) => existing.has(t));
+        if (queryTables.length === 0) {
+            throw new error_1.AppError('TABLE_NOT_FOUND', `None of the requested tables exist: ${localMissing.join(', ')}`, { next_actions: ['Run `miaoda db schema list` to see all tables.'] });
         }
     }
+    let result;
+    try {
+        result = await api.db.listAuditLog({
+            appId,
+            tables: queryTables,
+            since,
+            until,
+            limit,
+            cursor: opts.cursor,
+            dbBranch: opts.env,
+        });
+    }
+    catch (err) {
+        throw decorateAuditListError(err, tables);
+    }
     const visible = result.items;
     // 服务端 skipped（audit 未启用，bare 名）+ CLI 本地探测 missing 合并；
     // localMissing 自带 `(table not found)` 后缀，formatSkippedHint 透传渲染
@@ -264,7 +265,7 @@ async function handleDbAuditList(tables, opts) {
         return;
     }
     if (visible.length === 0) {
-        (0, output_1.emit)('No audit log entries found.');
+        (0, output_1.emit)('No audit events found.');
         if (skipped.length > 0) {
             process.stderr.write(formatSkippedHint(skipped, tables.length) + '\n');
         }

package/dist/cli/handlers/db/migration.js

@@ -32,14 +32,10 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleDbMigrationInit = handleDbMigrationInit;
 exports.handleDbMigrationDiff = handleDbMigrationDiff;
 exports.handleDbMigrationApply = handleDbMigrationApply;
-const node_readline_1 = __importDefault(require("node:readline"));
 const api = __importStar(require("../../../api/index"));
 const shared_1 = require("../../../cli/commands/shared");
 const colors_1 = require("../../../utils/colors");
@@ -48,17 +44,16 @@ const output_1 = require("../../../utils/output");
 const poll_1 = require("../../../utils/poll");
 const render_1 = require("../../../utils/render");
 const spinner_1 = require("../../../utils/spinner");
+const _destructive_1 = require("../../../cli/handlers/db/_destructive");
 async function handleDbMigrationInit(opts) {
     const appId = (0, shared_1.resolveAppId)(opts);
-    // 不可逆操作，TTY 默认要求 y/N；--yes 跳过
-    if (!opts.yes && !(0, output_1.isJsonMode)()) {
-        // 文案对齐 PRD：先讲不可逆，再问是否初始化；syncData 时追加一句而不是塞进同一句话
-        const suffix = opts.syncData ? ' (existing data will be copied to dev)' : '';
-        const ok = await confirm(`? This action is irreversible. Initialize multi-env (dev / online)${suffix}? (y/N) `);
-        if (!ok) {
-            (0, output_1.emit)('Aborted.');
-            return;
-        }
+    // 不可逆操作：--yes 直接放行；非 TTY 抛 DESTRUCTIVE_REQUIRES_CONFIRM；TTY 交互确认。
+    // 不再用 isJsonMode() 做门 —— 见 _destructive.ts 注释。
+    const suffix = opts.syncData ? ' (existing data will be copied to dev)' : '';
+    const ok = await (0, _destructive_1.confirmDestructive)(`? This action is irreversible. Initialize multi-env (dev / online)${suffix}? (y/N) `, opts.yes);
+    if (!ok) {
+        (0, output_1.emit)('Aborted.');
+        return;
     }
     let result;
     try {
@@ -89,7 +84,7 @@ async function handleDbMigrationInit(opts) {
 async function handleDbMigrationDiff(opts) {
     const appId = (0, shared_1.resolveAppId)(opts);
     let result;
-    const stopSpinner = (0, spinner_1.startSpinner)('Computing migration diff');
+    const stopSpinner = (0, spinner_1.startSpinner)('Previewing migration diff (dev → online)');
     try {
         result = await api.db.migrate({ appId, dryRun: true });
     }
@@ -111,10 +106,11 @@ async function handleDbMigrationDiff(opts) {
 }
 async function handleDbMigrationApply(opts) {
     const appId = (0, shared_1.resolveAppId)(opts);
-    // TTY 下先 diff 给用户审；--yes 直接打到 online
-    if (!opts.yes && !(0, output_1.isJsonMode)()) {
+    // --yes 跳过预览 + 确认；否则 TTY 拉 diff 给用户审，非 TTY 直接拒（避免无意义 dry-run RPC）
+    if (opts.yes !== true) {
+        (0, _destructive_1.assertDestructiveAllowedInTty)(opts.yes);
         let preview;
-        const stopSpinner = (0, spinner_1.startSpinner)('Computing migration diff');
+        const stopSpinner = (0, spinner_1.startSpinner)('Previewing migration diff (dev → online)');
         try {
             preview = await api.db.migrate({ appId, dryRun: true });
         }
@@ -132,8 +128,10 @@ async function handleDbMigrationApply(opts) {
                 ],
             });
         }
-        renderDiff(preview);
-        const ok = await confirm(`? Apply ${String(preview.changes.length)} change(s) to ${preview.to}? (y/N) `);
+        // --json 模式跳过 pretty diff 渲染（污染 stdout envelope），但仍要求 confirm
+        if (!(0, output_1.isJsonMode)())
+            renderDiff(preview);
+        const ok = await (0, _destructive_1.askYesNo)(`? Apply ${String(preview.changes.length)} change(s) to ${preview.to}? (y/N) `);
         if (!ok) {
             (0, output_1.emit)('Aborted.');
             return;
@@ -154,7 +152,7 @@ async function handleDbMigrationApply(opts) {
     const taskId = result.taskId;
     const final = await (0, poll_1.pollUntilDone)({
         label: 'migration apply',
-        spinnerLabel: 'Applying migration to online',
+        spinnerLabel: 'Applying migration (dev → online)',
         intervalMs: 1000,
         fetch: () => api.db.getMigrationStatus({ appId, taskId }),
         isDone: (cur) => {
@@ -234,12 +232,3 @@ function decorateMigrationError(err) {
             return err;
     }
 }
-async function confirm(prompt) {
-    const rl = node_readline_1.default.createInterface({ input: process.stdin, output: process.stderr });
-    return new Promise((resolve) => {
-        rl.question(prompt, (answer) => {
-            rl.close();
-            resolve(answer.trim().toLowerCase() === 'y');
-        });
-    });
-}

package/dist/cli/handlers/db/recovery.js

@@ -32,13 +32,10 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleDbRecoveryDiff = handleDbRecoveryDiff;
 exports.handleDbRecoveryApply = handleDbRecoveryApply;
-const node_readline_1 = __importDefault(require("node:readline"));
+exports.formatRecoveryTargetForDisplay = formatRecoveryTargetForDisplay;
 const api = __importStar(require("../../../api/index"));
 const shared_1 = require("../../../cli/commands/shared");
 const colors_1 = require("../../../utils/colors");
@@ -47,6 +44,7 @@ const output_1 = require("../../../utils/output");
 const poll_1 = require("../../../utils/poll");
 const render_1 = require("../../../utils/render");
 const time_1 = require("../../../utils/time");
+const _destructive_1 = require("../../../cli/handlers/db/_destructive");
 // ── recovery diff ──
 //
 // PITR preview 是异步任务：dataloom 立即返 previewRequestId，CLI 自己 poll 直到 success/failed。
@@ -55,7 +53,7 @@ const time_1 = require("../../../utils/time");
 async function handleDbRecoveryDiff(target, opts) {
     const appId = (0, shared_1.resolveAppId)(opts);
     const ts = normalizeTimestamp(target);
-    const preview = await runRecoveryPreview(appId, ts);
+    const preview = await runRecoveryPreview(appId, ts, target);
     renderDiff(ts, preview);
 }
 async function handleDbRecoveryApply(target, opts) {
@@ -64,7 +62,7 @@ async function handleDbRecoveryApply(target, opts) {
     // PRD 要求 apply 输出包含 N tables affected / Ms elapsed。
     // tables_affected 从 preview 拿；elapsed 用 CLI 端墙钟（dataloom apply 是异步
     // 触发，server-side elapsed=0；下面 poll 真终态后用本地计时器算 elapsed）。
-    const preview = await runRecoveryPreview(appId, ts);
+    const preview = await runRecoveryPreview(appId, ts, target);
     const tablesAffected = preview.tablesAffected ?? preview.changes?.length ?? 0;
     // 0 changes 短路：目标时间点与当前一致，apply 没意义。pretty 模式渲染 preview
     // 的 "No changes — database is already at this state." 后直接退；--json 模式
@@ -83,9 +81,14 @@ async function handleDbRecoveryApply(target, opts) {
         }
         return;
     }
-    if (!opts.yes && !(0, output_1.isJsonMode)()) {
-        renderDiff(ts, preview);
-        const ok = await confirm(`? Restore database to ${ts}? This will overwrite current data. (y/N) `);
+    // --yes 跳过；非 TTY 抛 DESTRUCTIVE_REQUIRES_CONFIRM；TTY 渲染 diff（pretty）+ 交互确认。
+    // 不再用 isJsonMode() 做门 —— 见 _destructive.ts 注释。
+    if (opts.yes !== true) {
+        (0, _destructive_1.assertDestructiveAllowedInTty)(opts.yes);
+        // --json 模式跳过 pretty diff 渲染避免污染 stdout envelope；TTY pretty 模式渲染
+        if (!(0, output_1.isJsonMode)())
+            renderDiff(ts, preview);
+        const ok = await (0, _destructive_1.askYesNo)(`? Restore database to ${ts}? This will overwrite current data. (y/N) `);
         if (!ok) {
             (0, output_1.emit)('Aborted.');
             return;
@@ -102,7 +105,7 @@ async function handleDbRecoveryApply(target, opts) {
     // 立即返 status="restore_triggered"，CLI 必须 poll GET /db/recovery/status 拿
     // Redis 缓存的 Resetting/Ready/Failed，否则用户会被误导以为已恢复完。
     const startedAt = Date.now();
-    await waitRecoveryDone(appId, ts);
+    await waitRecoveryDone(appId, ts, target);
     const elapsed = Math.max(1, Math.round((Date.now() - startedAt) / 1000));
     if ((0, output_1.isJsonMode)()) {
         // PRD：{"status": "restored", "target": "...", "tables_affected": N, "elapsed_seconds": M}
@@ -129,11 +132,11 @@ async function handleDbRecoveryApply(target, opts) {
  * 不设固定超时：BranchRestore 实际时长依库大小变化（前端文案示例 1 分钟，大库可能
  * 几分钟），由 pollUntilDone 内置 60 分钟上限兜底，远超正常场景。
  */
-async function waitRecoveryDone(appId, target) {
+async function waitRecoveryDone(appId, target, rawTarget) {
     try {
         return await (0, poll_1.pollUntilDone)({
             label: 'recovery apply',
-            spinnerLabel: 'Restoring database to target time',
+            spinnerLabel: `Restoring database (target: ${formatRecoveryTargetForDisplay(rawTarget)})`,
             intervalMs: 2000,
             fetch: () => api.db.getRecoveryStatus({ appId }),
             isDone: (cur) => {
@@ -160,7 +163,7 @@ async function waitRecoveryDone(appId, target) {
  * 补 hint。failed 状态下 dataloom 已把 errorMessage 翻好，CLI 包成 k_dl_1300036
  * 让 decorateRecoveryError 命中窗口超限 hint。
  */
-async function runRecoveryPreview(appId, ts) {
+async function runRecoveryPreview(appId, ts, rawTarget) {
     let triggered;
     try {
         triggered = await api.db.recover({ appId, target: ts, dryRun: true });
@@ -175,7 +178,7 @@ async function runRecoveryPreview(appId, ts) {
     try {
         return await (0, poll_1.pollUntilDone)({
             label: 'recovery preview',
-            spinnerLabel: 'Computing recovery preview',
+            spinnerLabel: `Previewing recovery impact (target: ${formatRecoveryTargetForDisplay(rawTarget)})`,
             intervalMs: 1000,
             fetch: () => api.db.getRecoveryPreview({ appId, previewRequestId }),
             isDone: (cur) => {
@@ -199,6 +202,38 @@ async function runRecoveryPreview(appId, ts) {
     }
 }
 // ── helpers ──
+/**
+ * 把用户传入的 recovery target 解析成本地时区的 ISO 8601 字符串，
+ * 如 "2026-05-20T22:32:00+08:00"。无论用户传相对值（30m / 2h / 3d）还是绝对值，
+ * 都统一展示成"具体几点"，让用户一眼看清楚"目标恢复点是我本地几点"——
+ * "30m ago"这种相对描述虽然原样直观，但跟 backend dataloom 收到的实际时间点没有
+ * 显式对照，遇到长 poll 时间过去后会让人怀疑"算的到底是哪个点"。
+ *
+ * 不用 UTC 'Z' 后缀：用户读时间不直观；带 +/-HH:MM offset 一眼即懂时差。
+ * 解析失败 → 原样返回兜底，避免 spinner 渲染崩。
+ */
+function formatRecoveryTargetForDisplay(rawInput) {
+    const trimmed = rawInput.trim();
+    let ms;
+    try {
+        ms = (0, time_1.parseTimeToMs)(trimmed);
+    }
+    catch {
+        return trimmed;
+    }
+    return formatIsoWithLocalOffset(ms);
+}
+function formatIsoWithLocalOffset(ms) {
+    const d = new Date(ms);
+    const pad = (n) => String(n).padStart(2, '0');
+    // getTimezoneOffset 返回本地相对 UTC 的差值（分钟）— UTC 在东八区是 -480
+    const offsetMinutes = -d.getTimezoneOffset();
+    const sign = offsetMinutes >= 0 ? '+' : '-';
+    const absOffset = Math.abs(offsetMinutes);
+    const tz = `${sign}${pad(Math.floor(absOffset / 60))}:${pad(absOffset % 60)}`;
+    return (`${String(d.getFullYear())}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}` +
+        `T${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}${tz}`);
+}
 /**
  * 把用户传入的时间统一成 ISO 8601 UTC 字符串发给 dataloom。
  *
@@ -376,12 +411,3 @@ function decorateRecoveryError(err) {
             return err;
     }
 }
-async function confirm(prompt) {
-    const rl = node_readline_1.default.createInterface({ input: process.stdin, output: process.stderr });
-    return new Promise((resolve) => {
-        rl.question(prompt, (answer) => {
-            rl.close();
-            resolve(answer.trim().toLowerCase() === 'y');
-        });
-    });
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lark-apaas/miaoda-cli",
-  "version": "0.1.3-alpha.2d526ac",
+  "version": "0.1.3-alpha.3198e3b",
   "description": "Miaoda 平台命令行工具，面向 Agent 调用",
   "type": "commonjs",
   "bin": {