@limecloud/cli 0.10.0 → 0.11.0

package/README.md

@@ -106,7 +106,9 @@ limecloud-cli diagnose login --space-id space_example --app-id app_example --env
 
 使用已登记CLI客户端、精确Issuer/API Origin及`lime:open:read`委托。任务先比较当前公开合同，再通过原Management API读取应用及一页OAuth客户端，复用当前认证/范围与授权，不新增业务端点。需要明确空间、应用和环境；每页默认20、上限50，按返回游标用`--cursor`显式继续，不自动翻页、登录、刷新、开页或修改。目标未部署公开合同发现时报告阻塞，不猜在线兼容。
 
-`ok:true`仅表示生成报告，另判`status:observed/attention/partial/blocked`及`coverage`。`observed`仅表示完整返回列表中存在活跃、含openid和回调地址的客户端配置候选，`login_verified`始终为false；各来源不共享快照，后续页保持部分报告。注册中心不可用与空列表区分，无权及来源失败不泄漏响应正文。JSON/CSV/NDJSON保留范围、完整性、来源和时间，table显示检查项摘要；详情及结构化下一步见JSON。此能力不等于真实登录、API/Webhook或完整宿主任务验收。
+`ok:true`仅表示生成报告，另判`status:observed/attention/partial/blocked`及`coverage`。`observed`仅表示完整返回列表中存在活跃、含openid和回调地址的客户端配置候选，`login_verified`始终为false；各来源不共享快照，后续页保持部分报告。注册中心不可用与空列表区分，无权及来源失败不泄漏响应正文。
+
+Table按覆盖范围、检查码/说明、应用、本页客户端候选、逐来源原始UTC时间、动作合同比对、独立HTTP观察及下一步分段展示，字段和长说明不裁剪。未读取、来源不可用和可读空页分开说明。下一页以包含准确目标/范围/语言的参数数组给出，不自动执行；后台URL是可选接续入口。窄终端可自然换行；需要按字段处理或交给Agent组织时优先JSON。Table的`--fields`只选择检查列，范围、候选与来源仍保留。CSV/NDJSON每条检查记录也附原应用/客户端、来源、完整性、合同和HTTP观察，可用`--fields`显式投影。此能力不等于真实登录、API/Webhook或完整宿主任务验收。
 
 ## 输出语言
 
@@ -351,6 +353,10 @@ limecloud-cli task group resolve --space-id "YOUR_SPACE_ID" --preparation-id "OR
 
 恢复引用显式同步文件及目录后才发送，不支持目录同步的文件系统失败关闭；未宣称所有OS/文件系统断电语义已验收。执行前回读原准备；本动作发现与凭据检查通过后，先持久一次尝试标记再发送。标记后重跑execute停止，改查原回执或显式resolve。即使标记后请求尚未发出，也按原ID恢复；本地标记不证明服务端已提交，404亦不能证明未提交。引用缺失时可用get从原Owner回读；切换配置、语言或更新不重置原键/确认，也不自动登录、重试或开页。正式API仍独立重验当前权限、原修订、完整影响及期限；命令可用不等于全部宿主完整适配已验收。
 
+更新CLI时保留所选凭据文件及旁侧原恢复目录。软件号变化本身不要求换准备或重做确认：尚无执行尝试时，通过get核对原值，仍须匹配原动作合同、精确确认和原期限；回读不会续期或产生人的批准。已有尝试或结果未知时，升级后仍只查询receipt或显式resolve。CLI包更新不代表宿主方法已更新或当前会话已加载，不能通过重装、切语言或新准备消除原unknown。
+
+原准备读取遇到断网、403、响应不兼容或原绑定变化时，错误仍附带已核对本地引用的`error.recovery`，保留原操作ID、Issuer/API/Client/企业及原执行合同，只提供get/receipt/resolve参数数组；不自动执行、改写引用或清除尝试标记。提示不是成功、当前授权或安全重试的证明；读取/终结仍可能失败。没有有效原引用时不从无效响应或未知引用格式生成提示，保持原文件并报告待核对，不自动迁移或重新准备。
+
 
 ## 可选公开方法候选
 

package/dist/identity.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Lime Identity API",
-    "version": "0.10.0",
+    "version": "0.11.0",
     "description": "Implemented public OAuth 2.0 and OpenID Connect endpoints. Plain protocol responses; separate from authenticated management BFF APIs."
   },
   "servers": [
@@ -961,15 +961,15 @@
       "post": {
         "operationId": "identity_resource_introspect",
         "summary": "Check resource access",
-        "description": "Check a business machine access token for one exact API and action using a separately provisioned resource-server credential. Current token, customer approval, API/runtime generations and verifier binding are checked in one MySQL transaction. Provisioning currently requires trusted internal orchestration; self-service management is pending. Enforce the returned customer, data and field limits in the real resource owner. Do not cache allowed responses; a remote decision does not lock the provider database or guarantee atomic revocation of in-flight work.",
+        "description": "Check a business machine access token for one exact API and action using a dedicated resource-server credential. Current token, customer approval, API/runtime generations and verifier binding are checked in one MySQL transaction. Manage internal and partner credentials in Open API details, and official credentials in Portal technical contract details. Enforce the returned customer, data and field limits in the real resource owner. Do not cache allowed responses; a remote decision does not lock the provider database or guarantee atomic revocation of in-flight work.",
         "x-lime-localizations": {
           "en": {
             "summary": "Check resource access",
-            "description": "Check a business machine access token for one exact API and action using a separately provisioned resource-server credential. Current token, customer approval, API/runtime generations and verifier binding are checked in one MySQL transaction. Provisioning currently requires trusted internal orchestration; self-service management is pending. Enforce the returned customer, data and field limits in the real resource owner. Do not cache allowed responses; a remote decision does not lock the provider database or guarantee atomic revocation of in-flight work."
+            "description": "Check a business machine access token for one exact API and action using a dedicated resource-server credential. Current token, customer approval, API/runtime generations and verifier binding are checked in one MySQL transaction. Manage internal and partner credentials in Open API details, and official credentials in Portal technical contract details. Enforce the returned customer, data and field limits in the real resource owner. Do not cache allowed responses; a remote decision does not lock the provider database or guarantee atomic revocation of in-flight work."
           },
           "zh-CN": {
             "summary": "检查资源访问权限",
-            "description": "使用单独登记的资源服务器专用凭据，为一个精确 API 和动作检查业务机器 Access Token。在同一 MySQL 事务中重验当前令牌、客户批准、API/运行代次及校验方绑定。当前登记需可信内部编排，自助管理尚待接通。实际资源所属领域必须执行返回的客户、数据及字段限制。不得缓存允许结果；远程决策不会锁定提供方数据库，也不能保证在途工作的原子撤权。"
+            "description": "使用资源服务器专用凭据，为一个精确 API 和动作检查业务机器 Access Token。在同一 MySQL 事务中重验当前令牌、客户批准、API/运行代次及校验方绑定。内部及合作凭据在 Open 的 API 详情管理，官方凭据在 Portal 的技术合同详情管理。实际资源所属领域必须执行返回的客户、数据及字段限制。不得缓存允许结果；远程决策不会锁定提供方数据库，也不能保证在途工作的原子撤权。"
           }
         },
         "tags": [