@numa-tech/numa 1.14.29 → 1.14.30

package/dist/integration-bootstrap/commands.js

@@ -1,615 +0,0 @@
-import process from "node:process";
-import { lstat } from "node:fs/promises";
-import { resolve } from "node:path";
-import { setTimeout as delay } from "node:timers/promises";
-import open from "open";
-import { loadAppConfig } from "../app-config.js";
-import { loadConfig } from "../config.js";
-import { PipelineError, sanitizePipelineOutput } from "../pipeline/errors.js";
-import { writePrivateJson } from "../private-file.js";
-import { AuthorizationClient } from "../authorization/client.js";
-import { waitForKeycloakBootstrap } from "../authorization/commands.js";
-import { IntegrationBootstrapClient, integrationBootstrapClientRequestId, integrationBootstrapIdempotencyKey } from "./client.js";
-const PLAN_TERMINAL = new Set(["SUCCEEDED", "FAILED", "EXPIRED"]);
-const ACTION_TERMINAL = new Set(["UNKNOWN", "SUCCEEDED", "FAILED", "EXPIRED"]);
-function normalizedBrowserOptions(options) {
-    return {
-        ...options,
-        noOpen: options.noOpen === true || options.open === false
-    };
-}
-function outputPath(value) {
-    if (value !== value.trim() || value.length === 0 || /[\u0000-\u001f\u007f]/u.test(value)) {
-        throw new PipelineError("output must be a non-empty local path without control characters.", "INTEGRATION_BOOTSTRAP_INPUT_INVALID");
-    }
-    return resolve(value);
-}
-async function pathExists(path) {
-    try {
-        await lstat(path);
-        return true;
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return false;
-        throw error;
-    }
-}
-export async function executeIntegrationBootstrapTrustAnchorExport(api, options) {
-    const destination = outputPath(options.output);
-    if (!options.force && await pathExists(destination)) {
-        throw new PipelineError("Trust-anchor output already exists; choose another path or pass --force to replace it.", "INTEGRATION_BOOTSTRAP_TRUST_ANCHOR_OUTPUT_EXISTS");
-    }
-    const document = await api.getTrustAnchorConfiguration();
-    await writePrivateJson(destination, document.configuration);
-    return { ...document, outputPath: destination };
-}
-function snake(key) {
-    return key.replace(/([a-z0-9])([A-Z])/gu, "$1_$2").toLowerCase();
-}
-export function stableIntegrationBootstrapOutput(value) {
-    const safe = sanitizePipelineOutput(value);
-    if (Array.isArray(safe))
-        return safe.map(stableIntegrationBootstrapOutput);
-    if (safe && typeof safe === "object") {
-        return Object.fromEntries(Object.entries(safe).map(([key, item]) => [snake(key), stableIntegrationBootstrapOutput(item)]));
-    }
-    return safe;
-}
-async function jsonEnabled(command) {
-    return Boolean(command.optsWithGlobals().json
-        || (await loadAppConfig()).output === "json");
-}
-async function output(command, payload, text) {
-    process.stdout.write(await jsonEnabled(command)
-        ? `${JSON.stringify(stableIntegrationBootstrapOutput(payload), null, 2)}\n`
-        : `${String(sanitizePipelineOutput(text))}\n`);
-}
-function planLine(plan) {
-    const changes = plan.changes.map((change) => `  ${change.component}\t${change.action}\t${change.target}\t${change.reasonCode}`);
-    const blockers = plan.blockers.map((blocker) => `  ${blocker.component}\t${blocker.target}\t${blocker.reasonCode}`);
-    return [
-        `${plan.state}\t${plan.schemaVersion}\t${plan.profileCode}`,
-        `plan digest: ${plan.planDigest}`,
-        `review expires: ${plan.reviewExpiresAt}`,
-        "changes:",
-        ...(changes.length ? changes : ["  -"]),
-        "blockers:",
-        ...(blockers.length ? blockers : ["  -"])
-    ].join("\n");
-}
-function sessionLine(session) {
-    if (session.plan != null)
-        return planLine(session.plan);
-    const error = session.errorCode == null ? "" : `\n${session.errorCode}: ${session.errorSummary ?? "-"}`;
-    return `${session.sessionNo}\t${session.status}${error}`;
-}
-function runLine(run) {
-    return `${run.runNo}\t${run.state}\tv${run.version}\t${run.step}\t${run.disposition ?? "-"}`;
-}
-function actionLine(action) {
-    return `${action.actionNo}\t${action.kind}\t${action.state}\t${action.disposition ?? "-"}`;
-}
-const PRIVILEGED_STEP_LABELS = {
-    SUCCESS: "成功",
-    FAILED: "失败",
-    UNCHANGED: "无变更",
-    SKIPPED: "跳过",
-    WAITING: "等待"
-};
-function privilegedRunLine(run) {
-    const lines = run.steps.map((step) => `${PRIVILEGED_STEP_LABELS[step.status]}\t${step.step}\t${step.detail}`);
-    const error = run.errorCode == null ? [] : [`${run.errorCode}: ${run.errorSummary ?? "-"}`];
-    return [
-        `${run.runId}\t${run.mode}\t${run.status}`,
-        ...lines,
-        ...error
-    ].join("\n");
-}
-function startMayHaveCommitted(error) {
-    return error instanceof PipelineError
-        && (error.code === "INTEGRATION_BOOTSTRAP_START_RESULT_UNKNOWN"
-            || error.code === "INTEGRATION_BOOTSTRAP_CONFLICT");
-}
-function unknown(message, error) {
-    return new PipelineError(message, "INTEGRATION_BOOTSTRAP_RESULT_UNKNOWN", error instanceof PipelineError ? error.status : undefined, error instanceof PipelineError ? error.requestId : undefined);
-}
-function identityMismatch(message) {
-    return new PipelineError(message, "INTEGRATION_BOOTSTRAP_IDENTITY_MISMATCH", 409);
-}
-function expectedVersion(value) {
-    if (!/^(?:0|[1-9][0-9]*)$/u.test(value)) {
-        throw new PipelineError("expected-run-version must be a canonical non-negative 32-bit integer.", "INTEGRATION_BOOTSTRAP_INPUT_INVALID");
-    }
-    const parsed = Number(value);
-    if (!Number.isSafeInteger(parsed) || parsed < 0 || parsed > 2_147_483_647) {
-        throw new PipelineError("expected-run-version must be a non-negative 32-bit integer.", "INTEGRATION_BOOTSTRAP_INPUT_INVALID");
-    }
-    return parsed;
-}
-function requireConfirmation(value, action) {
-    if (!value) {
-        throw new PipelineError(`${action} requires --yes.`, "INTEGRATION_BOOTSTRAP_CONFIRMATION_REQUIRED");
-    }
-}
-const SHA256 = /^[a-f0-9]{64}$/u;
-const INIT_OPERATION_KEY = /^[A-Za-z0-9][A-Za-z0-9._:-]{7,159}$/u;
-export function integrationBootstrapInitKeys(operationKey) {
-    if (!INIT_OPERATION_KEY.test(operationKey)) {
-        throw new PipelineError("operation-key must be 8-160 characters, start with a letter or number, and use only letters, numbers, . _ : or -.", "INTEGRATION_BOOTSTRAP_OPERATION_KEY_INVALID");
-    }
-    const prefix = `integration-init:${operationKey}`;
-    try {
-        return {
-            planClientRequestId: integrationBootstrapClientRequestId(`${prefix}:plan`),
-            planIdempotencyKey: integrationBootstrapIdempotencyKey(`${prefix}:plan-write`),
-            applyClientRequestId: integrationBootstrapClientRequestId(`${prefix}:apply`),
-            applyIdempotencyKey: integrationBootstrapIdempotencyKey(`${prefix}:apply-write`)
-        };
-    }
-    catch (error) {
-        if (error instanceof PipelineError) {
-            throw new PipelineError("operation-key must be 8-160 characters, start with a letter or number, and use only letters, numbers, . _ : or -.", "INTEGRATION_BOOTSTRAP_OPERATION_KEY_INVALID");
-        }
-        throw error;
-    }
-}
-function exactExpectedPlanDigest(value) {
-    if (value == null)
-        return undefined;
-    if (!SHA256.test(value)) {
-        throw new PipelineError("expected-plan-digest must be exactly 64 lowercase hexadecimal characters.", "INTEGRATION_BOOTSTRAP_INPUT_INVALID");
-    }
-    return value;
-}
-async function openAuthorization(url, label, openBrowser, notify) {
-    notify(`正在打开一次性 Keycloak 管理员授权（${label}）…\n`);
-    try {
-        await openBrowser(url);
-    }
-    catch {
-        notify(`无法自动打开浏览器，请手动打开:\n${url}\n`);
-    }
-}
-function deadline(expiresAt) {
-    return Date.parse(expiresAt) + 15_000;
-}
-async function pollPlan(api, sessionNo, expiresAt, sleep) {
-    let expires = deadline(expiresAt);
-    for (;;) {
-        const session = await api.getPlanSession(sessionNo);
-        if (PLAN_TERMINAL.has(session.status))
-            return session;
-        expires = Math.max(expires, deadline(session.expiresAt));
-        if (!Number.isFinite(expires) || Date.now() >= expires) {
-            throw unknown("Integration bootstrap plan authorization expired before a durable terminal result was observed.");
-        }
-        await sleep(1_000);
-    }
-}
-async function pollAction(api, actionNo, expiresAt, sleep) {
-    const expires = deadline(expiresAt);
-    for (;;) {
-        const action = await api.getAction(actionNo);
-        if (ACTION_TERMINAL.has(action.state))
-            return action;
-        if (!Number.isFinite(expires) || Date.now() >= expires) {
-            throw unknown("Integration bootstrap authorization expired before a durable action result was observed.");
-        }
-        await sleep(1_000);
-    }
-}
-function exactPlanSession(session, clientRequestId) {
-    if (session.clientRequestId !== clientRequestId) {
-        throw identityMismatch("Resolved integration bootstrap plan session does not match the original client-request-id.");
-    }
-}
-function exactRun(run, input) {
-    if (run.clientRequestId !== input.clientRequestId || run.planSessionNo !== input.planSessionNo
-        || run.planDigest !== input.planDigest) {
-        throw identityMismatch("Resolved integration bootstrap run does not match the original immutable apply request.");
-    }
-}
-function exactAction(action, runNo, kind, input) {
-    if (action.clientRequestId !== input.clientRequestId || action.runNo !== runNo
-        || action.kind !== kind || action.expectedRunVersion !== input.expectedRunVersion) {
-        throw identityMismatch("Resolved integration bootstrap action does not match the original immutable request.");
-    }
-}
-function isExactAction(action, runNo, kind, input) {
-    return action != null && action.clientRequestId === input.clientRequestId
-        && action.runNo === runNo && action.kind === kind
-        && action.expectedRunVersion === input.expectedRunVersion;
-}
-async function resolvePlanAfterStart(api, options, error) {
-    let session;
-    try {
-        session = await api.resolvePlanSession(options.clientRequestId);
-    }
-    catch (resolveError) {
-        throw unknown("Integration bootstrap plan result is unknown. Retry the same plan command with the original client-request-id and idempotency-key; do not choose new values.", resolveError instanceof PipelineError ? resolveError : error);
-    }
-    exactPlanSession(session, options.clientRequestId);
-    if (session.status !== "AWAITING_AUTHORIZATION")
-        return { session };
-    try {
-        return { start: await api.startPlanSession(options.clientRequestId, options.idempotencyKey) };
-    }
-    catch (replayError) {
-        throw unknown("The actor-scoped plan session is awaiting authorization, but its one-time URL could not be recovered. Retry the exact same plan command and keys.", replayError);
-    }
-}
-export async function executeIntegrationBootstrapPlan(api, options, openBrowser, sleep, notify = (message) => process.stderr.write(message)) {
-    const normalized = {
-        ...options,
-        clientRequestId: integrationBootstrapClientRequestId(options.clientRequestId),
-        idempotencyKey: integrationBootstrapIdempotencyKey(options.idempotencyKey)
-    };
-    let result;
-    try {
-        result = { start: await api.startPlanSession(normalized.clientRequestId, normalized.idempotencyKey) };
-    }
-    catch (error) {
-        if (!startMayHaveCommitted(error))
-            throw error;
-        result = await resolvePlanAfterStart(api, normalized, error);
-    }
-    if (result.session != null) {
-        if (options.noOpen || PLAN_TERMINAL.has(result.session.status))
-            return { session: result.session };
-        return { session: await pollPlan(api, result.session.sessionNo, result.session.expiresAt, sleep) };
-    }
-    const started = result.start;
-    if (started.clientRequestId !== normalized.clientRequestId) {
-        throw identityMismatch("Integration bootstrap plan start does not match client-request-id.");
-    }
-    if (options.noOpen)
-        return { started };
-    await openAuthorization(started.authorizationUrl, `session ${started.sessionNo}`, openBrowser, notify);
-    return {
-        started,
-        session: await pollPlan(api, started.sessionNo, started.authorizationExpiresAt, sleep)
-    };
-}
-function initContinuationKeys(operationKey, kind, version) {
-    const prefix = `integration-init:${operationKey}:${kind.toLowerCase()}:v${version}`;
-    return {
-        clientRequestId: integrationBootstrapClientRequestId(prefix),
-        idempotencyKey: integrationBootstrapIdempotencyKey(`${prefix}:write`)
-    };
-}
-async function continueIntegrationBootstrapInit(api, operationKey, initial, noOpen, openBrowser, sleep, notify) {
-    const results = [];
-    let run = initial;
-    // One init invocation may need a read-only reconciliation followed by one write recovery.
-    // A second unknown write is left durable and the same init command can be run again.
-    for (let stage = 0; stage < 2 && run.state === "UNKNOWN"; stage += 1) {
-        const active = run.currentAction;
-        const resumableKind = active != null
-            && active.kind !== "APPLY"
-            && ["AWAITING_AUTHORIZATION", "AUTHORIZING", "RUNNING"].includes(active.state)
-            ? active.kind : null;
-        const resumable = resumableKind == null ? null : active;
-        const kind = resumableKind
-            ?? (run.recoverAllowed ? "RECOVER"
-                : run.reapplyAllowed ? "REAPPLY"
-                    : run.reconcileAllowed ? "RECONCILE" : null);
-        if (kind == null)
-            break;
-        const expectedRunVersion = resumable?.expectedRunVersion ?? run.version;
-        const keys = initContinuationKeys(operationKey, kind, expectedRunVersion);
-        if (resumable != null && resumable.clientRequestId !== keys.clientRequestId)
-            break;
-        const result = await executeIntegrationBootstrapAction(api, run.runNo, kind, {
-            expectedRunVersion: String(expectedRunVersion),
-            clientRequestId: keys.clientRequestId,
-            idempotencyKey: keys.idempotencyKey,
-            noOpen,
-            yes: true
-        }, openBrowser, sleep, notify);
-        results.push({ kind, ...result });
-        run = result.run;
-        if (result.action == null
-            || !["SUCCEEDED", "UNKNOWN"].includes(result.action.state))
-            break;
-    }
-    return results;
-}
-export async function executeIntegrationBootstrapInit(api, options, openBrowser, sleep, confirmApply, notify = (message) => process.stderr.write(message)) {
-    const keys = integrationBootstrapInitKeys(options.operationKey);
-    const expectedDigest = exactExpectedPlanDigest(options.expectedPlanDigest);
-    if (options.yes && expectedDigest == null) {
-        throw new PipelineError("Non-interactive init requires --expected-plan-digest together with --yes.", "INTEGRATION_BOOTSTRAP_CONFIRMATION_REQUIRED");
-    }
-    const plan = await executeIntegrationBootstrapPlan(api, {
-        clientRequestId: keys.planClientRequestId,
-        idempotencyKey: keys.planIdempotencyKey,
-        noOpen: options.noOpen
-    }, openBrowser, sleep, notify);
-    const session = plan.session;
-    const reviewed = session?.status === "SUCCEEDED" ? session.plan : null;
-    if (session == null || reviewed == null || reviewed.state !== "READY") {
-        return { keys, plan, confirmed: false, continuations: [] };
-    }
-    if (expectedDigest != null && expectedDigest !== reviewed.planDigest) {
-        throw new PipelineError("The READY plan digest does not match --expected-plan-digest; no apply was started.", "INTEGRATION_BOOTSTRAP_PLAN_DIGEST_MISMATCH", 409);
-    }
-    notify(`${planLine(reviewed)}\n`);
-    const confirmed = options.yes || (confirmApply != null && await confirmApply(reviewed));
-    if (!confirmed)
-        return { keys, plan, confirmed: false, continuations: [] };
-    const apply = await executeIntegrationBootstrapApply(api, {
-        sessionNo: session.sessionNo,
-        planDigest: reviewed.planDigest,
-        clientRequestId: keys.applyClientRequestId,
-        idempotencyKey: keys.applyIdempotencyKey,
-        noOpen: options.noOpen,
-        yes: true
-    }, openBrowser, sleep, notify);
-    const applyRun = apply.run;
-    const continuations = applyRun?.state === "UNKNOWN"
-        ? await continueIntegrationBootstrapInit(api, options.operationKey, applyRun, options.noOpen, openBrowser, sleep, notify)
-        : [];
-    return { keys, plan, confirmed: true, apply, continuations };
-}
-async function resolveApplyAfterStart(api, input, idempotencyKey, error) {
-    let run;
-    try {
-        run = await api.resolveRun(input.clientRequestId);
-    }
-    catch (resolveError) {
-        throw unknown("Integration bootstrap apply result is unknown. Use run resolve with the original client-request-id; never create another apply request.", resolveError instanceof PipelineError ? resolveError : error);
-    }
-    exactRun(run, input);
-    if (run.currentAction?.state !== "AWAITING_AUTHORIZATION")
-        return { run };
-    try {
-        return { start: await api.startApply(input, idempotencyKey) };
-    }
-    catch (replayError) {
-        throw unknown("Apply authorization URL recovery failed. Retry the exact same apply command and keys.", replayError);
-    }
-}
-export async function executeIntegrationBootstrapApply(api, options, openBrowser, sleep, notify = (message) => process.stderr.write(message)) {
-    requireConfirmation(options.yes, "Integration bootstrap apply");
-    const input = {
-        planSessionNo: options.sessionNo,
-        planDigest: options.planDigest,
-        clientRequestId: integrationBootstrapClientRequestId(options.clientRequestId)
-    };
-    const key = integrationBootstrapIdempotencyKey(options.idempotencyKey);
-    const plan = await api.getPlanSession(input.planSessionNo);
-    let result;
-    const planReady = plan.status === "SUCCEEDED" && plan.plan?.state === "READY"
-        && plan.plan.planDigest === input.planDigest
-        && Date.parse(plan.plan.reviewExpiresAt) > Date.now();
-    if (!planReady) {
-        let existing;
-        try {
-            existing = await api.resolveRun(input.clientRequestId);
-        }
-        catch (error) {
-            if (error instanceof PipelineError && error.code === "INTEGRATION_BOOTSTRAP_NOT_FOUND") {
-                throw new PipelineError("Apply requires the exact unexpired READY v2 plan session and digest.", "INTEGRATION_BOOTSTRAP_PLAN_NOT_READY", 409);
-            }
-            throw unknown("The plan is no longer startable and an existing run could not be resolved safely. Use run resolve with the original client-request-id; do not POST another apply.", error);
-        }
-        exactRun(existing, input);
-        if (existing.currentAction?.kind === "APPLY"
-            && existing.currentAction.state === "AWAITING_AUTHORIZATION") {
-            try {
-                result = { start: await api.startApply(input, key) };
-            }
-            catch (error) {
-                if (!startMayHaveCommitted(error))
-                    throw error;
-                result = await resolveApplyAfterStart(api, input, key, error);
-            }
-        }
-        else {
-            result = { run: existing };
-        }
-    }
-    else {
-        try {
-            result = { start: await api.startApply(input, key) };
-        }
-        catch (error) {
-            if (!startMayHaveCommitted(error))
-                throw error;
-            result = await resolveApplyAfterStart(api, input, key, error);
-        }
-    }
-    if (result.run != null) {
-        const current = result.run.currentAction;
-        if (options.noOpen || current == null || ACTION_TERMINAL.has(current.state))
-            return { run: result.run };
-        const action = await pollAction(api, current.actionNo, current.authorizationExpiresAt, sleep);
-        return { action, run: await api.getRun(result.run.runNo) };
-    }
-    const started = result.start;
-    if (started.clientRequestId !== input.clientRequestId || started.planSessionNo !== input.planSessionNo
-        || started.planDigest !== input.planDigest)
-        throw identityMismatch("Apply start identity is inconsistent.");
-    if (options.noOpen)
-        return { started };
-    await openAuthorization(started.authorizationUrl, `action ${started.actionNo}`, openBrowser, notify);
-    const action = await pollAction(api, started.actionNo, started.authorizationExpiresAt, sleep);
-    return { started, action, run: await api.getRun(started.runNo) };
-}
-async function resolveActionAfterStart(api, runNo, kind, input, idempotencyKey, error) {
-    let action;
-    try {
-        action = await api.resolveAction(input.clientRequestId);
-    }
-    catch (resolveError) {
-        throw unknown(`Integration bootstrap ${kind.toLowerCase()} result is unknown. Run "numa integration bootstrap action resolve ${runNo} --client-request-id ${input.clientRequestId}"; do not replay automatically.`, resolveError instanceof PipelineError ? resolveError : error);
-    }
-    exactAction(action, runNo, kind, input);
-    if (action.state !== "AWAITING_AUTHORIZATION")
-        return { action };
-    try {
-        return { start: await api.startAction(runNo, kind, input, idempotencyKey) };
-    }
-    catch (replayError) {
-        throw unknown(`${kind} authorization URL recovery failed. Retry the exact same action command and keys.`, replayError);
-    }
-}
-export async function executeIntegrationBootstrapAction(api, runNo, kind, options, openBrowser, sleep, notify = (message) => process.stderr.write(message)) {
-    if (kind !== "RECONCILE")
-        requireConfirmation(options.yes, `Integration bootstrap ${kind.toLowerCase()}`);
-    const input = {
-        expectedRunVersion: expectedVersion(options.expectedRunVersion),
-        clientRequestId: integrationBootstrapClientRequestId(options.clientRequestId)
-    };
-    const key = integrationBootstrapIdempotencyKey(options.idempotencyKey);
-    const before = await api.getRun(runNo);
-    const existing = isExactAction(before.currentAction, before.runNo, kind, input)
-        && ["AWAITING_AUTHORIZATION", "AUTHORIZING", "RUNNING"].includes(before.currentAction.state)
-        ? before.currentAction : null;
-    if (existing == null && before.version !== input.expectedRunVersion) {
-        throw new PipelineError("Run version changed before action start.", "INTEGRATION_BOOTSTRAP_RUN_VERSION_CONFLICT", 409);
-    }
-    const allowed = kind === "RECONCILE" ? before.reconcileAllowed
-        : kind === "RECOVER" ? before.recoverAllowed : before.reapplyAllowed;
-    if (existing == null && !allowed) {
-        throw new PipelineError(`${kind} is not allowed by the current durable run evidence.`, "INTEGRATION_BOOTSTRAP_ACTION_NOT_ALLOWED", 409);
-    }
-    let result;
-    if (existing != null && existing.state !== "AWAITING_AUTHORIZATION") {
-        result = { action: existing };
-    }
-    else {
-        try {
-            result = { start: await api.startAction(before.runNo, kind, input, key) };
-        }
-        catch (error) {
-            if (!startMayHaveCommitted(error))
-                throw error;
-            result = await resolveActionAfterStart(api, before.runNo, kind, input, key, error);
-        }
-    }
-    if (result.action != null) {
-        if (options.noOpen || ACTION_TERMINAL.has(result.action.state)) {
-            return { action: result.action, run: await api.getRun(before.runNo) };
-        }
-        const action = await pollAction(api, result.action.actionNo, result.action.authorizationExpiresAt, sleep);
-        return { action, run: await api.getRun(before.runNo) };
-    }
-    const started = result.start;
-    if (started.runNo !== before.runNo || started.kind !== kind || started.clientRequestId !== input.clientRequestId) {
-        throw identityMismatch("Integration bootstrap action start identity is inconsistent.");
-    }
-    if (options.noOpen)
-        return { started, run: await api.getRun(before.runNo) };
-    await openAuthorization(started.authorizationUrl, `action ${started.actionNo}`, openBrowser, notify);
-    const action = await pollAction(api, started.actionNo, started.authorizationExpiresAt, sleep);
-    return { started, action, run: await api.getRun(before.runNo) };
-}
-function addExamples(command, values, notes) {
-    return command.addHelpText("after", `\n说明:\n${notes.map((value) => `  - ${value}`).join("\n")}\n\nExamples:\n${values.map((value) => `  ${value}`).join("\n")}\n`);
-}
-export function registerIntegrationBootstrapCommands(program, dependencies = {}) {
-    const client = () => dependencies.clientFactory?.()
-        ?? new IntegrationBootstrapClient(loadConfig("platform"));
-    const privilegedClient = () => dependencies.privilegedClientFactory?.()
-        ?? new AuthorizationClient(loadConfig("platform"));
-    const openBrowser = dependencies.openBrowser ?? (async (url) => { await open(url); });
-    const sleep = dependencies.sleep ?? ((milliseconds) => delay(milliseconds));
-    const integration = program.command("integration").description("审阅并执行平台固定的外部系统集成 bootstrap");
-    const bootstrap = integration.command("bootstrap")
-        .description("通过一次临时管理员登录幂等初始化固定外部集成")
-        .addHelpText("after", `
-安全边界:
-  所有 realm、client、role、Jenkins instance、folder 与 credential metadata 均由服务端固定。
-  CLI 不接收、读取或输出管理员 token、client secret、Jenkins password 或 Secret 响应。
-  每次命令都创建一次新鲜 PKCE 管理员授权并从实时状态重新检查。
-  已匹配步骤输出“无变更”；失败直接报告步骤和原因，不创建恢复点。
-  bootstrap 不轮换 secret；轮换必须使用独立的 integration secret rotate 命令。
-`);
-    const trustAnchor = bootstrap.command("trust-anchor")
-        .description("导出一次性导入 master realm 的最小无密钥 PKCE 信任锚");
-    addExamples(trustAnchor.command("export")
-        .description("从当前 DevOps 公开端点下载、校验并原子写入 Keycloak client JSON")
-        .requiredOption("-o, --output <file>", "本地 JSON 输出路径")
-        .option("--force", "替换已存在的输出文件")
-        .action(async (options, command) => {
-        const result = await executeIntegrationBootstrapTrustAnchorExport(client(), options);
-        await output(command, {
-            ok: true,
-            trustAnchor: {
-                realm: result.realm,
-                clientId: result.clientId,
-                configurationDigest: result.configurationDigest,
-                sourceUrl: result.sourceUrl,
-                outputPath: result.outputPath
-            }
-        }, [
-            `已导出 master realm 信任锚: ${result.outputPath}`,
-            `client: ${result.clientId}`,
-            `sha256: ${result.configurationDigest}`,
-            "请将该 JSON 导入配置的 Keycloak master realm；导入后再运行 integration bootstrap init。"
-        ].join("\n"));
-    }), [
-        "numa integration bootstrap trust-anchor export --output ./mci-devops-platform-bootstrap-master.json",
-        "numa integration bootstrap trust-anchor export --output ./mci-devops-platform-bootstrap-master.json --force --json"
-    ], [
-        "该 GET 是公开、无会话操作；文件仅包含 public PKCE client，不包含 client secret、用户密码或 token。",
-        "CLI 强制 master realm header、当前 DevOps callback、S256 PKCE 和禁用 Direct Access Grants。",
-        "每个 DevOps/Keycloak 信任域只需导入一次；后续新 bootstrap profile 复用同一信任锚。"
-    ]);
-    const executePrivileged = async (command, request, options) => {
-        const browser = normalizedBrowserOptions(options);
-        const api = privilegedClient();
-        const started = await api.startPrivilegedOperation(request);
-        if (browser.noOpen || !started.loginUrl) {
-            await output(command, { ok: true, privileged_session: started }, started.loginUrl
-                ? `${started.runId}\t${started.mode}\t${started.status}\n请在浏览器打开: ${started.loginUrl}`
-                : `${started.runId}\t${started.mode}\t${started.status}`);
-            return;
-        }
-        process.stderr.write(`正在打开一次性 Keycloak 管理员授权（run ${started.runId}）…\n`);
-        try {
-            await openBrowser(started.loginUrl);
-        }
-        catch {
-            process.stderr.write(`无法自动打开浏览器，请手动打开:\n${started.loginUrl}\n`);
-        }
-        const run = await waitForKeycloakBootstrap({
-            getKeycloakBootstrapRun: (runId) => api.getPrivilegedOperationRun(runId)
-        }, started, sleep);
-        const ok = run.status === "SUCCEEDED";
-        await output(command, { ok, privileged_operation: run }, privilegedRunLine(run));
-        if (!ok)
-            process.exitCode = 1;
-    };
-    addExamples(bootstrap.command("init")
-        .description("幂等创建或校正固定 Keycloak/Jenkins writer 配置；不轮换 secret")
-        .option("--no-open", "不打开浏览器；返回一次性 login URL 和 run ID")
-        .action(async (options, command) => {
-        await executePrivileged(command, { mode: "INTEGRATION_INIT" }, options);
-    }), [
-        "numa integration bootstrap init",
-        "numa integration bootstrap init --no-open --json"
-    ], [
-        "每次运行都重新检查实时状态；已完成步骤显示“无变更”。",
-        "失败后直接重新运行本命令；不需要 operation-key、plan、recover 或 reapply。",
-        "只读取当前 Keycloak secret 并同步到 Jenkins，不会轮换 secret。"
-    ]);
-    const secret = integration.command("secret")
-        .description("显式管理固定集成 secret；不会由 bootstrap 隐式触发");
-    addExamples(secret.command("rotate")
-        .description("显式轮换 Keycloak writer secret，并同步覆盖 Jenkins credential")
-        .option("--no-open", "不打开浏览器；返回一次性 login URL 和 run ID")
-        .action(async (options, command) => {
-        await executePrivileged(command, { mode: "SECRET_ROTATE" }, options);
-    }), [
-        "numa integration secret rotate",
-        "numa integration secret rotate --no-open --json"
-    ], [
-        "必须完成一次新鲜管理员登录；secret 只在服务端一次性内存和 Jenkins 内部流转。",
-        "轮换后始终重新读取 Keycloak 当前值、覆盖 Jenkins credential 并验证 token claims。",
-        "若轮换结果不可确认，不要再次轮换；运行 integration bootstrap init 同步当前 secret。"
-    ]);
-}
-//# sourceMappingURL=commands.js.map