@polardbx/pxbaas 0.0.0-stage → 0.1.0-beta.1

package/dist/credentials/jwt-introspect.d.ts

@@ -0,0 +1,32 @@
+/**
+ * JWT 解析工具 - 无需密钥验证，仅解码 payload
+ * 用于从 JWT 中提取角色、租户ID、过期时间等信息
+ */
+export interface JwtPayload {
+    role: 'anon' | 'service_role';
+    tenant_id?: string;
+    iss: string;
+    iat: number;
+    exp: number;
+    [key: string]: unknown;
+}
+export interface IntrospectedJwt {
+    payload: JwtPayload;
+    isExpired: boolean;
+    expiresIn: number;
+    fingerprint: string;
+}
+/**
+ * 解码 JWT payload（不验证签名）
+ * @throws Error 如果 JWT 格式无效
+ */
+export declare function decodeJwt(token: string): JwtPayload;
+/**
+ * 解析 JWT 并计算指纹
+ */
+export declare function introspectJwt(token: string): Promise<IntrospectedJwt>;
+/**
+ * 格式化过期时间为人类可读字符串
+ */
+export declare function formatExpiry(expiresIn: number): string;
+//# sourceMappingURL=jwt-introspect.d.ts.map

package/dist/credentials/jwt-introspect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-introspect.d.ts","sourceRoot":"","sources":["../../src/credentials/jwt-introspect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,GAAG,cAAc,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAanD;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAkB3E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAatD"}

package/dist/credentials/jwt-introspect.js

@@ -0,0 +1,64 @@
+/**
+ * JWT 解析工具 - 无需密钥验证，仅解码 payload
+ * 用于从 JWT 中提取角色、租户ID、过期时间等信息
+ */
+/**
+ * 解码 JWT payload（不验证签名）
+ * @throws Error 如果 JWT 格式无效
+ */
+export function decodeJwt(token) {
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+        throw new Error('Invalid JWT format: expected 3 parts');
+    }
+    const payloadBase64 = parts[1];
+    try {
+        const payloadJson = Buffer.from(payloadBase64, 'base64url').toString('utf-8');
+        return JSON.parse(payloadJson);
+    }
+    catch (err) {
+        throw new Error(`Failed to decode JWT payload: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/**
+ * 解析 JWT 并计算指纹
+ */
+export async function introspectJwt(token) {
+    const { createHash } = await import('node:crypto');
+    const payload = decodeJwt(token);
+    const now = Math.floor(Date.now() / 1000);
+    const expiresIn = payload.exp - now;
+    const isExpired = expiresIn <= 0;
+    // 计算指纹：sha256 前8字符 + 后4字符
+    const hash = createHash('sha256').update(token).digest('hex');
+    const fingerprint = `${hash.slice(0, 8)}...${hash.slice(-4)}`;
+    return {
+        payload,
+        isExpired,
+        expiresIn,
+        fingerprint,
+    };
+}
+/**
+ * 格式化过期时间为人类可读字符串
+ */
+export function formatExpiry(expiresIn) {
+    if (expiresIn <= 0) {
+        const ago = Math.abs(expiresIn);
+        if (ago < 60)
+            return `expired ${ago}s ago`;
+        if (ago < 3600)
+            return `expired ${Math.floor(ago / 60)}m ago`;
+        if (ago < 86400)
+            return `expired ${Math.floor(ago / 3600)}h ago`;
+        return `expired ${Math.floor(ago / 86400)}d ago`;
+    }
+    if (expiresIn < 60)
+        return `expires in ${expiresIn}s`;
+    if (expiresIn < 3600)
+        return `expires in ${Math.floor(expiresIn / 60)}m`;
+    if (expiresIn < 86400)
+        return `expires in ${Math.floor(expiresIn / 3600)}h`;
+    return `expires in ${Math.floor(expiresIn / 86400)}d`;
+}
+//# sourceMappingURL=jwt-introspect.js.map

package/dist/credentials/jwt-introspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-introspect.js","sourceRoot":"","sources":["../../src/credentials/jwt-introspect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAkBH;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAe,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa;IAC/C,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAEnD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IACpC,MAAM,SAAS,GAAG,SAAS,IAAI,CAAC,CAAC;IAEjC,0BAA0B;IAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE9D,OAAO;QACL,OAAO;QACP,SAAS;QACT,SAAS;QACT,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,GAAG,GAAG,EAAE;YAAE,OAAO,WAAW,GAAG,OAAO,CAAC;QAC3C,IAAI,GAAG,GAAG,IAAI;YAAE,OAAO,WAAW,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;QAC9D,IAAI,GAAG,GAAG,KAAK;YAAE,OAAO,WAAW,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC;QACjE,OAAO,WAAW,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC;IACnD,CAAC;IAED,IAAI,SAAS,GAAG,EAAE;QAAE,OAAO,cAAc,SAAS,GAAG,CAAC;IACtD,IAAI,SAAS,GAAG,IAAI;QAAE,OAAO,cAAc,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC,GAAG,CAAC;IACzE,IAAI,SAAS,GAAG,KAAK;QAAE,OAAO,cAAc,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC;IAC5E,OAAO,cAAc,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;AACxD,CAAC"}

package/dist/credentials/masker.d.ts

@@ -0,0 +1,20 @@
+/**
+ * 密钥脱敏工具 - 只显示指纹，不暴露完整密钥
+ */
+/**
+ * 计算密钥指纹：sha256 前8字符 + 后4字符
+ * 格式：sha256:abcd1234...ef56
+ */
+export declare function computeFingerprint(key: string): string;
+/**
+ * 脱敏 Authorization header
+ * 输入: "Bearer eyJhbGc..."
+ * 输出: "Bearer sha256:abcd1234...ef56"
+ */
+export declare function maskAuthorizationHeader(header: string): string;
+/**
+ * 脱敏任意字符串（如果看起来像 JWT）
+ * JWT 特征：包含两个点，三段 base64
+ */
+export declare function maskIfJwt(value: string): string;
+//# sourceMappingURL=masker.d.ts.map

package/dist/credentials/masker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"masker.d.ts","sourceRoot":"","sources":["../../src/credentials/masker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGtD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQ9D;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM/C"}

package/dist/credentials/masker.js

@@ -0,0 +1,37 @@
+/**
+ * 密钥脱敏工具 - 只显示指纹，不暴露完整密钥
+ */
+import { createHash } from 'node:crypto';
+/**
+ * 计算密钥指纹：sha256 前8字符 + 后4字符
+ * 格式：sha256:abcd1234...ef56
+ */
+export function computeFingerprint(key) {
+    const hash = createHash('sha256').update(key).digest('hex');
+    return `sha256:${hash.slice(0, 8)}...${hash.slice(-4)}`;
+}
+/**
+ * 脱敏 Authorization header
+ * 输入: "Bearer eyJhbGc..."
+ * 输出: "Bearer sha256:abcd1234...ef56"
+ */
+export function maskAuthorizationHeader(header) {
+    if (!header.startsWith('Bearer ')) {
+        return header;
+    }
+    const token = header.slice(7);
+    const fingerprint = computeFingerprint(token);
+    return `Bearer ${fingerprint}`;
+}
+/**
+ * 脱敏任意字符串（如果看起来像 JWT）
+ * JWT 特征：包含两个点，三段 base64
+ */
+export function maskIfJwt(value) {
+    const parts = value.split('.');
+    if (parts.length === 3 && parts.every(p => p.length > 0)) {
+        return computeFingerprint(value);
+    }
+    return value;
+}
+//# sourceMappingURL=masker.js.map

package/dist/credentials/masker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"masker.js","sourceRoot":"","sources":["../../src/credentials/masker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,UAAU,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,UAAU,WAAW,EAAE,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/credentials/profile.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Profile 管理器 - 多环境配置管理
+ */
+export type ProfileMode = 'single-tenant' | 'multi-tenant';
+/** Where a profile's instance came from: a customer's own instance (login) or a Zero-provisioned one. */
+export type ProfileSource = 'login' | 'zero';
+export interface BaasProfile {
+    name: string;
+    endpoint: string;
+    /** Canonical App origin supplied by the platform; never derived by the CLI. */
+    appEndpoint?: string;
+    tenantId?: string;
+    mode: ProfileMode;
+    /** Instance origin. Absent on legacy profiles (treated as 'login'). */
+    source?: ProfileSource;
+    /** Zero instance id (sbx_*), only when source === 'zero'. */
+    zeroInstanceId?: string;
+    /** Zero instance expiry (ISO 8601), only when source === 'zero'. */
+    expiresAt?: string;
+    createdAt: string;
+    updatedAt: string;
+}
+interface ProfilesStore {
+    version: 1;
+    current: string;
+    profiles: Record<string, BaasProfile>;
+}
+/** 设置进程级 profile 覆盖（由 main.ts 的 preAction hook 调用）。 */
+export declare function setCliProfileOverrideGlobal(profileName: string | undefined): void;
+/** 读取进程级 profile 覆盖（供测试/诊断）。 */
+export declare function getCliProfileOverrideGlobal(): string | undefined;
+export declare class ProfileManager {
+    private homeDir;
+    private cliProfileOverride?;
+    private store;
+    constructor(homeDir?: string);
+    /**
+     * 设置 CLI profile 覆盖（来自 --profile flag）。
+     * 同时写入进程级变量，使其它命令实例（各自 new ProfileManager）也能看到。
+     */
+    setCliProfileOverride(profileName: string | undefined): void;
+    /** 生效的 --profile 覆盖：实例级优先，其次进程级。 */
+    private get effectiveCliProfileOverride();
+    /**
+     * 获取 profiles.json 路径
+     */
+    private getProfilesFilePath;
+    /**
+     * 加载 profiles store
+     */
+    load(): Promise<ProfilesStore>;
+    /**
+     * 保存 profiles store
+     */
+    private save;
+    /**
+     * 获取当前激活的 profile
+     * 优先级：--profile flag > BAAS_PROFILE env > store.current
+     */
+    getCurrentProfile(): Promise<BaasProfile | null>;
+    /**
+     * 列出所有 profiles
+     */
+    listProfiles(): Promise<BaasProfile[]>;
+    /**
+     * 获取指定 profile
+     */
+    getProfile(name: string): Promise<BaasProfile | null>;
+    /**
+     * 创建或更新 profile
+     */
+    setProfile(profile: BaasProfile): Promise<void>;
+    /**
+     * 切换当前 profile
+     */
+    useProfile(name: string): Promise<void>;
+    /**
+     * 删除 profile
+     */
+    removeProfile(name: string): Promise<boolean>;
+}
+export {};
+//# sourceMappingURL=profile.d.ts.map

package/dist/credentials/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../src/credentials/profile.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,cAAc,CAAC;AAE3D,yGAAyG;AACzG,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,WAAW,CAAC;IAClB,uEAAuE;IACvE,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,aAAa;IACrB,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACvC;AAYD,uDAAuD;AACvD,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAEjF;AAED,gCAAgC;AAChC,wBAAgB,2BAA2B,IAAI,MAAM,GAAG,SAAS,CAEhE;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,kBAAkB,CAAC,CAAS;IACpC,OAAO,CAAC,KAAK,CAA8B;gBAE/B,OAAO,CAAC,EAAE,MAAM;IAI5B;;;OAGG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAK5D,oCAAoC;IACpC,OAAO,KAAK,2BAA2B,GAEtC;IAED;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAI3B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC;IA2BpC;;OAEG;YACW,IAAI;IAYlB;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAsCtD;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAK5C;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAK3D;;OAEG;IACG,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBrD;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW7C;;OAEG;IACG,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAiBpD"}

package/dist/credentials/profile.js

@@ -0,0 +1,184 @@
+/**
+ * Profile 管理器 - 多环境配置管理
+ */
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/**
+ * Profile 管理器
+ *
+ * 存储路径：~/.baas/profiles.json
+ * 优先级：--profile flag > BAAS_PROFILE env > store.current
+ */
+// 进程级 --profile 覆盖：各命令实现自己 new ProfileManager()，实例字段无法跨实例共享，
+// 因此用模块级变量承载（仅本进程生效，绝不写回 profiles.json）。
+let processCliProfileOverride;
+/** 设置进程级 profile 覆盖（由 main.ts 的 preAction hook 调用）。 */
+export function setCliProfileOverrideGlobal(profileName) {
+    processCliProfileOverride = profileName;
+}
+/** 读取进程级 profile 覆盖（供测试/诊断）。 */
+export function getCliProfileOverrideGlobal() {
+    return processCliProfileOverride;
+}
+export class ProfileManager {
+    homeDir;
+    cliProfileOverride; // --profile flag
+    store = null;
+    constructor(homeDir) {
+        this.homeDir = homeDir ?? join(homedir(), '.baas');
+    }
+    /**
+     * 设置 CLI profile 覆盖（来自 --profile flag）。
+     * 同时写入进程级变量，使其它命令实例（各自 new ProfileManager）也能看到。
+     */
+    setCliProfileOverride(profileName) {
+        this.cliProfileOverride = profileName;
+        processCliProfileOverride = profileName;
+    }
+    /** 生效的 --profile 覆盖：实例级优先，其次进程级。 */
+    get effectiveCliProfileOverride() {
+        return this.cliProfileOverride ?? processCliProfileOverride;
+    }
+    /**
+     * 获取 profiles.json 路径
+     */
+    getProfilesFilePath() {
+        return join(this.homeDir, 'profiles.json');
+    }
+    /**
+     * 加载 profiles store
+     */
+    async load() {
+        if (this.store) {
+            return this.store;
+        }
+        const filePath = this.getProfilesFilePath();
+        if (!existsSync(filePath)) {
+            this.store = { version: 1, current: '', profiles: {} };
+            return this.store;
+        }
+        try {
+            const content = await readFile(filePath, 'utf-8');
+            const data = JSON.parse(content);
+            if (data.version !== 1) {
+                throw new Error(`Unsupported profiles file version: ${data.version}`);
+            }
+            this.store = data;
+            return this.store;
+        }
+        catch (err) {
+            throw new Error(`Failed to read profiles file: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    /**
+     * 保存 profiles store
+     */
+    async save(store) {
+        if (!existsSync(this.homeDir)) {
+            await mkdir(this.homeDir, { mode: 0o700, recursive: true });
+        }
+        const filePath = this.getProfilesFilePath();
+        const content = JSON.stringify(store, null, 2);
+        await writeFile(filePath, content, { mode: 0o644 });
+        this.store = store;
+    }
+    /**
+     * 获取当前激活的 profile
+     * 优先级：--profile flag > BAAS_PROFILE env > store.current
+     */
+    async getCurrentProfile() {
+        const store = await this.load();
+        // 1. CLI --profile flag
+        const cliOverride = this.effectiveCliProfileOverride;
+        if (cliOverride) {
+            const profile = store.profiles[cliOverride];
+            if (!profile) {
+                throw new Error(`Profile '${cliOverride}' not found (from --profile flag)`);
+            }
+            return profile;
+        }
+        // 2. BAAS_PROFILE 环境变量
+        const envProfile = process.env.BAAS_PROFILE;
+        if (envProfile) {
+            const profile = store.profiles[envProfile];
+            if (!profile) {
+                throw new Error(`Profile '${envProfile}' not found (from BAAS_PROFILE env)`);
+            }
+            return profile;
+        }
+        // 3. store.current
+        if (store.current) {
+            const profile = store.profiles[store.current];
+            if (!profile) {
+                // current 指向不存在的 profile，清除它
+                store.current = '';
+                await this.save(store);
+                return null;
+            }
+            return profile;
+        }
+        return null;
+    }
+    /**
+     * 列出所有 profiles
+     */
+    async listProfiles() {
+        const store = await this.load();
+        return Object.values(store.profiles);
+    }
+    /**
+     * 获取指定 profile
+     */
+    async getProfile(name) {
+        const store = await this.load();
+        return store.profiles[name] ?? null;
+    }
+    /**
+     * 创建或更新 profile
+     */
+    async setProfile(profile) {
+        const store = await this.load();
+        const now = new Date().toISOString();
+        if (store.profiles[profile.name]) {
+            // 更新
+            profile.updatedAt = now;
+        }
+        else {
+            // 创建
+            profile.createdAt = now;
+            profile.updatedAt = now;
+        }
+        store.profiles[profile.name] = profile;
+        await this.save(store);
+    }
+    /**
+     * 切换当前 profile
+     */
+    async useProfile(name) {
+        const store = await this.load();
+        if (!store.profiles[name]) {
+            throw new Error(`Profile '${name}' not found`);
+        }
+        store.current = name;
+        await this.save(store);
+    }
+    /**
+     * 删除 profile
+     */
+    async removeProfile(name) {
+        const store = await this.load();
+        if (!store.profiles[name]) {
+            return false;
+        }
+        delete store.profiles[name];
+        // 如果删除的是当前 profile，清除 current
+        if (store.current === name) {
+            store.current = '';
+        }
+        await this.save(store);
+        return true;
+    }
+}
+//# sourceMappingURL=profile.js.map

package/dist/credentials/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/credentials/profile.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA8BjC;;;;;GAKG;AACH,6DAA6D;AAC7D,yCAAyC;AACzC,IAAI,yBAA6C,CAAC;AAElD,uDAAuD;AACvD,MAAM,UAAU,2BAA2B,CAAC,WAA+B;IACzE,yBAAyB,GAAG,WAAW,CAAC;AAC1C,CAAC;AAED,gCAAgC;AAChC,MAAM,UAAU,2BAA2B;IACzC,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,MAAM,OAAO,cAAc;IACjB,OAAO,CAAS;IAChB,kBAAkB,CAAU,CAAC,iBAAiB;IAC9C,KAAK,GAAyB,IAAI,CAAC;IAE3C,YAAY,OAAgB;QAC1B,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH,qBAAqB,CAAC,WAA+B;QACnD,IAAI,CAAC,kBAAkB,GAAG,WAAW,CAAC;QACtC,yBAAyB,GAAG,WAAW,CAAC;IAC1C,CAAC;IAED,oCAAoC;IACpC,IAAY,2BAA2B;QACrC,OAAO,IAAI,CAAC,kBAAkB,IAAI,yBAAyB,CAAC;IAC9D,CAAC;IAED;;OAEG;IACK,mBAAmB;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAE5C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAkB,CAAC;YAElD,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,IAAI,CAAC,KAAoB;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAE/C,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB;QACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,wBAAwB;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,CAAC;QACrD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,YAAY,WAAW,mCAAmC,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,uBAAuB;QACvB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC5C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,qCAAqC,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,mBAAmB;QACnB,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,6BAA6B;gBAC7B,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,OAAoB;QACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,KAAK;YACL,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,KAAK;YACL,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;YACxB,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,aAAa,CAAC,CAAC;QACjD,CAAC;QAED,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;QACrB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE5B,8BAA8B;QAC9B,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3B,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC;QACrB,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/credentials/tenant-guard.d.ts

@@ -0,0 +1,16 @@
+/**
+ * 租户一致性守卫 - 验证 profile 和 JWT 的 tenant_id 一致
+ */
+import type { BaasProfile } from './profile.js';
+import type { IntrospectedJwt } from './jwt-introspect.js';
+/**
+ * 验证 profile 和 JWT 的 tenant_id 一致性
+ *
+ * 规则：
+ * - 多租户模式：profile.tenantId == anonJwt.tenantId == serviceJwt.tenantId
+ * - 单租户模式：profile.tenantId 为空，JWT 的 tenant_id 也应为空（或不存在）
+ *
+ * @throws Error 如果不一致
+ */
+export declare function validateTenantConsistency(profile: BaasProfile, anonJwt: IntrospectedJwt, serviceJwt: IntrospectedJwt): void;
+//# sourceMappingURL=tenant-guard.d.ts.map

package/dist/credentials/tenant-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-guard.d.ts","sourceRoot":"","sources":["../../src/credentials/tenant-guard.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,eAAe,GAC1B,IAAI,CAwDN"}

package/dist/credentials/tenant-guard.js

@@ -0,0 +1,53 @@
+/**
+ * 租户一致性守卫 - 验证 profile 和 JWT 的 tenant_id 一致
+ */
+/**
+ * 验证 profile 和 JWT 的 tenant_id 一致性
+ *
+ * 规则：
+ * - 多租户模式：profile.tenantId == anonJwt.tenantId == serviceJwt.tenantId
+ * - 单租户模式：profile.tenantId 为空，JWT 的 tenant_id 也应为空（或不存在）
+ *
+ * @throws Error 如果不一致
+ */
+export function validateTenantConsistency(profile, anonJwt, serviceJwt) {
+    const profileTenant = profile.tenantId;
+    const anonTenant = anonJwt.payload.tenant_id;
+    const serviceTenant = serviceJwt.payload.tenant_id;
+    // 多租户模式
+    if (profile.mode === 'multi-tenant') {
+        if (!profileTenant) {
+            throw new Error('Error: multi-tenant profile must have tenantId');
+        }
+        if (anonTenant !== profileTenant) {
+            throw new Error(`Error: tenant_id mismatch. Profile: ${profileTenant}, Anon JWT: ${anonTenant ?? 'none'}. ` +
+                `Ensure you pasted the correct keys for this tenant.`);
+        }
+        if (serviceTenant !== profileTenant) {
+            throw new Error(`Error: tenant_id mismatch. Profile: ${profileTenant}, Service JWT: ${serviceTenant ?? 'none'}. ` +
+                `Ensure you pasted the correct keys for this tenant.`);
+        }
+    }
+    // 单租户模式
+    if (profile.mode === 'single-tenant') {
+        if (profileTenant) {
+            throw new Error('Error: single-tenant profile must not have tenantId');
+        }
+        // 单租户模式下，JWT 不应该包含 tenant_id（或者 tenant_id 为空字符串）
+        if (anonTenant && anonTenant !== '') {
+            throw new Error(`Error: single-tenant profile but anon JWT has tenant_id: ${anonTenant}. ` +
+                `This key is for multi-tenant mode.`);
+        }
+        if (serviceTenant && serviceTenant !== '') {
+            throw new Error(`Error: single-tenant profile but service JWT has tenant_id: ${serviceTenant}. ` +
+                `This key is for multi-tenant mode.`);
+        }
+    }
+    // 两把 key 的 tenant_id 必须一致（无论单租户还是多租户）
+    if (anonTenant !== serviceTenant) {
+        throw new Error(`Error: anon and service JWT have different tenant_id. ` +
+            `Anon: ${anonTenant ?? 'none'}, Service: ${serviceTenant ?? 'none'}. ` +
+            `Ensure both keys are for the same tenant.`);
+    }
+}
+//# sourceMappingURL=tenant-guard.js.map

package/dist/credentials/tenant-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-guard.js","sourceRoot":"","sources":["../../src/credentials/tenant-guard.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAoB,EACpB,OAAwB,EACxB,UAA2B;IAE3B,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;IACvC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;IAC7C,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC;IAEnD,QAAQ;IACR,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,uCAAuC,aAAa,eAAe,UAAU,IAAI,MAAM,IAAI;gBAC3F,qDAAqD,CACtD,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,KAAK,aAAa,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,uCAAuC,aAAa,kBAAkB,aAAa,IAAI,MAAM,IAAI;gBACjG,qDAAqD,CACtD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,QAAQ;IACR,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACrC,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,iDAAiD;QACjD,IAAI,UAAU,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,4DAA4D,UAAU,IAAI;gBAC1E,oCAAoC,CACrC,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,IAAI,aAAa,KAAK,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,+DAA+D,aAAa,IAAI;gBAChF,oCAAoC,CACrC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,wDAAwD;YACxD,SAAS,UAAU,IAAI,MAAM,cAAc,aAAa,IAAI,MAAM,IAAI;YACtE,2CAA2C,CAC5C,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/credentials/tty-guard.d.ts

@@ -0,0 +1,19 @@
+/**
+ * TTY 守卫 - 防止 agent 执行敏感命令
+ */
+/**
+ * 断言当前运行在交互式 TTY 中
+ * @param isTTY - 可选参数，用于测试。如果不提供，则从 process.stdin.isTTY 读取
+ * @param ciEnv - 可选参数，用于测试。如果不提供，则从 process.env.CI 读取
+ * @throws Error 如果非 TTY 环境
+ */
+export declare function assertTty(isTTY?: boolean, ciEnv?: string): void;
+/**
+ * 断言命令行参数中不包含密钥参数
+ * 防止通过 argv 传递密钥（会出现在 shell history 中）
+ *
+ * @param argv - 命令行参数数组
+ * @throws Error 如果发现密钥参数
+ */
+export declare function assertNoKeyArgs(argv: string[]): void;
+//# sourceMappingURL=tty-guard.d.ts.map

package/dist/credentials/tty-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tty-guard.d.ts","sourceRoot":"","sources":["../../src/credentials/tty-guard.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAkB/D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAkBpD"}

package/dist/credentials/tty-guard.js

@@ -0,0 +1,47 @@
+/**
+ * TTY 守卫 - 防止 agent 执行敏感命令
+ */
+/**
+ * 断言当前运行在交互式 TTY 中
+ * @param isTTY - 可选参数，用于测试。如果不提供，则从 process.stdin.isTTY 读取
+ * @param ciEnv - 可选参数，用于测试。如果不提供，则从 process.env.CI 读取
+ * @throws Error 如果非 TTY 环境
+ */
+export function assertTty(isTTY, ciEnv) {
+    // 检查 stdin 是否是 TTY
+    const actualIsTTY = isTTY !== undefined ? isTTY : process.stdin.isTTY;
+    if (!actualIsTTY) {
+        throw new Error('Error: pxbaas login requires an interactive TTY. ' +
+            'Use --anon-key-stdin and --service-key-stdin for piped input.');
+    }
+    // 额外防护：CI 环境
+    const actualCI = ciEnv !== undefined ? ciEnv : process.env.CI;
+    if (actualCI === 'true' || actualCI === '1') {
+        throw new Error('Error: pxbaas login is disabled in CI environments. ' +
+            'Use --anon-key-stdin and --service-key-stdin for non-interactive input.');
+    }
+}
+/**
+ * 断言命令行参数中不包含密钥参数
+ * 防止通过 argv 传递密钥（会出现在 shell history 中）
+ *
+ * @param argv - 命令行参数数组
+ * @throws Error 如果发现密钥参数
+ */
+export function assertNoKeyArgs(argv) {
+    const forbiddenArgs = [
+        '--anon-key',
+        '--service-key',
+        '--token',
+    ];
+    for (const arg of argv) {
+        // 检查 --anon-key=value 或 --anon-key value 形式
+        for (const forbidden of forbiddenArgs) {
+            if (arg === forbidden || arg.startsWith(`${forbidden}=`)) {
+                throw new Error(`Error: passing keys via argv is forbidden (${arg}). ` +
+                    `Use ${forbidden}-stdin or environment variables.`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=tty-guard.js.map

package/dist/credentials/tty-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tty-guard.js","sourceRoot":"","sources":["../../src/credentials/tty-guard.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAAe,EAAE,KAAc;IACvD,mBAAmB;IACnB,MAAM,WAAW,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;IACtE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,mDAAmD;YACnD,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,aAAa;IACb,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9D,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,sDAAsD;YACtD,yEAAyE,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,MAAM,aAAa,GAAG;QACpB,YAAY;QACZ,eAAe;QACf,SAAS;KACV,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,4CAA4C;QAC5C,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;YACtC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CACb,8CAA8C,GAAG,KAAK;oBACtD,OAAO,SAAS,kCAAkC,CACnD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}