@polardbx/pxbaas 0.0.0-stage → 0.1.0-beta.1

package/dist/commands/instance/index.js

@@ -0,0 +1,361 @@
+import { ZeroDriver, ZeroError } from '@polardbx/pxbaas-client';
+import { ProfileManager } from '../../credentials/profile.js';
+import { CredentialStore } from '../../credentials/credential-store.js';
+import { computeFingerprint, formatError, formatSuccess, formatWarning } from '../../credentials/index.js';
+import { ZeroStore } from '../../instance/zero-store.js';
+import { provisionInstance, releaseInstance, } from '../../instance/provision.js';
+/**
+ * `pxbaas provision` / `pxbaas instance` — claim and manage disposable BaaS instances
+ * from PolarDB-X Zero. Fully automatic and offline-credential-free: keys come from
+ * Zero over TLS, are stored in the keyring, and only fingerprints are shown.
+ */
+export function registerInstanceCommands(program) {
+    // Top-level: pxbaas provision
+    program
+        .command('provision')
+        .description('Claim a disposable BaaS instance from PolarDB-X Zero and bind it to a profile')
+        .option('--name <profile>', 'Profile name to create (default: zero-<id suffix>)')
+        .option('--whitelist-ip <ip,cidr>', 'Extra IP whitelist for the instance (default: your egress IP)')
+        .option('--no-switch', 'Create the profile but do not switch the current profile to it')
+        .option('--reuse', 'Reuse an existing active Zero instance instead of claiming a new one')
+        .option('--force', 'Overwrite an existing profile of the same name')
+        .option('--json', 'Output in JSON format')
+        .action(async (options) => {
+        try {
+            await handleProvision(options, program);
+        }
+        catch (error) {
+            reportError(error, options.json);
+        }
+    });
+    const instanceCmd = program
+        .command('instance')
+        .description('Manage Zero-provisioned BaaS instances (list/release/credentials/current)');
+    // pxbaas instance claim — alias of provision
+    instanceCmd
+        .command('claim')
+        .description('Alias of `pxbaas provision`')
+        .option('--name <profile>', 'Profile name to create')
+        .option('--whitelist-ip <ip,cidr>', 'Extra IP whitelist')
+        .option('--no-switch', 'Do not switch current profile')
+        .option('--reuse', 'Reuse an existing active instance')
+        .option('--force', 'Overwrite an existing profile of the same name')
+        .option('--json', 'Output in JSON format')
+        .action(async (options) => {
+        try {
+            await handleProvision(options, program);
+        }
+        catch (error) {
+            reportError(error, options.json);
+        }
+    });
+    instanceCmd
+        .command('list')
+        .description('List Zero instances bound on this machine (and reconcile with Zero when a token exists)')
+        .option('--json', 'Output in JSON format')
+        .action(async (options) => {
+        try {
+            await handleList(options, program);
+        }
+        catch (error) {
+            reportError(error, options.json);
+        }
+    });
+    instanceCmd
+        .command('release <id>')
+        .description('Release a Zero instance (destructive; two-phase, needs --confirm)')
+        .option('--keep-profile', 'Release remotely but keep the local profile/credentials')
+        .option('--confirm', 'Actually perform the release (required)')
+        .option('--json', 'Output in JSON format')
+        .action(async (id, options) => {
+        try {
+            await handleRelease(id, options, program);
+        }
+        catch (error) {
+            reportError(error, options.json);
+        }
+    });
+    instanceCmd
+        .command('credentials <id>')
+        .description('Show a Zero instance endpoint/dashboard/fingerprints (--reveal for dashboard password)')
+        .option('--reveal', 'Also print the Dashboard password (handle with care)')
+        .option('--json', 'Output in JSON format')
+        .action(async (id, options) => {
+        try {
+            await handleCredentials(id, options, program);
+        }
+        catch (error) {
+            reportError(error, options.json);
+        }
+    });
+    instanceCmd
+        .command('current')
+        .description('Show the Zero instance bound to the current profile (if any)')
+        .option('--json', 'Output in JSON format')
+        .action(async (options) => {
+        try {
+            await handleCurrent(options, program);
+        }
+        catch (error) {
+            reportError(error, options.json);
+        }
+    });
+}
+function makeDeps() {
+    return {
+        zero: new ZeroDriver(),
+        profiles: new ProfileManager(),
+        creds: new CredentialStore(),
+        store: new ZeroStore(),
+    };
+}
+function isJson(options, program) {
+    return Boolean(options.json || program.opts().json);
+}
+function reportError(error, json) {
+    if (error instanceof ZeroError) {
+        const hint = zeroErrorHint(error.code);
+        if (json) {
+            console.log(JSON.stringify({ status: 'error', code: error.code, error: error.message, hint }, null, 2));
+        }
+        else {
+            console.error(formatError(`[${error.code}] ${error.message}`));
+            if (hint)
+                console.error(formatWarning(hint));
+        }
+        process.exit(1);
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    if (json)
+        console.log(JSON.stringify({ status: 'error', error: message }, null, 2));
+    else
+        console.error(formatError(message));
+    process.exit(1);
+}
+/** Stop-and-inform guidance for Zero capacity/rate errors (never loop-retry). */
+function zeroErrorHint(code) {
+    switch (code) {
+        case 'SUPABASE_LIMIT_REACHED':
+            return 'You already hold the max concurrent instances. Run `pxbaas instance list`, then `pxbaas instance release <id> --confirm` to free a slot.';
+        case 'RATE_LIMIT_EXCEEDED':
+            return 'Rate limited by IP. Wait a bit before retrying; do not loop.';
+        case 'SUPABASE_POOL_EXHAUSTED':
+            return 'No instance in the pool right now. It refills automatically — retry once after 1-2 minutes.';
+        case 'SUPABASE_DISABLED':
+            return 'The Zero Supabase service is currently disabled. Report to the user; do not retry.';
+        case 'INVALID_WHITELIST_IP':
+            return 'whitelistIp must be a comma-separated list of IPv4/CIDR.';
+        case 'INSTANCE_NOT_FOUND':
+            return 'Instance not found, not owned by this token, or already released.';
+        default:
+            return undefined;
+    }
+}
+async function handleProvision(options, program) {
+    const json = isJson(options, program);
+    const deps = makeDeps();
+    const result = await provisionInstance(deps, {
+        name: options.name,
+        whitelistIp: options.whitelistIp,
+        switchProfile: options.switch, // commander sets switch=false with --no-switch
+        reuse: options.reuse,
+        force: options.force,
+    });
+    if (json) {
+        console.log(JSON.stringify(toProvisionJson(result), null, 2));
+        return;
+    }
+    console.log(formatSuccess(`${result.reused ? 'Reused' : 'Provisioned'} Zero instance ${result.instance.id}`));
+    console.log(`  Profile:    ${result.profileName}`);
+    if (result.switchedFrom && result.switchedFrom !== result.profileName) {
+        console.log(`  Switched:   ${result.switchedFrom} -> ${result.profileName}  (switch back: pxbaas profile use ${result.switchedFrom})`);
+    }
+    console.log(`  Endpoint:   ${result.instance.endpoint}`);
+    if (result.instance.dashboardUrl)
+        console.log(`  Dashboard:  ${result.instance.dashboardUrl}  (user: supabase)`);
+    console.log(`  Keys:       anon ${result.keys.anon.fingerprint} · service_role ${result.keys.serviceRole.fingerprint}`);
+    if (result.instance.expiresAt)
+        console.log(`  Expires:    ${result.instance.expiresAt} (15-day, no renewal)`);
+    if (result.instance.whitelistIp)
+        console.log(`  Whitelist:  ${result.instance.whitelistIp} (other IPs are rejected)`);
+    console.log('');
+    console.log('  Next: pxbaas status --json · pxbaas db tables --json · pxbaas skill install --host <host>');
+    console.log('        Dashboard password: pxbaas instance credentials ' + result.instance.id + ' --reveal');
+}
+function toProvisionJson(result) {
+    return {
+        status: result.reused ? 'reused' : 'provisioned',
+        profile: result.profileName,
+        switchedFrom: result.switchedFrom,
+        instance: result.instance,
+        keys: result.keys,
+        dashboard: result.dashboard,
+        nextSteps: [
+            'pxbaas status --json',
+            'pxbaas db tables --json',
+            'pxbaas skill install --host <qoder|claude|...>',
+            `pxbaas instance credentials ${result.instance.id} --reveal`,
+        ],
+    };
+}
+async function handleList(options, program) {
+    const json = isJson(options, program);
+    const store = new ZeroStore();
+    const local = await store.listInstances();
+    const token = await store.getToken();
+    // Reconcile with Zero when we have a token (best-effort; never fail the command).
+    let remoteIds = null;
+    let remoteError;
+    if (token) {
+        try {
+            const remote = await new ZeroDriver().list(token);
+            remoteIds = remote.map((i) => i.id);
+        }
+        catch (e) {
+            remoteError = e instanceof Error ? e.message : String(e);
+        }
+    }
+    const rows = local.map((rec) => ({
+        id: rec.id,
+        profile: rec.profileName,
+        endpoint: rec.endpoint,
+        expiresAt: rec.expiresAt ?? null,
+        expired: rec.expiresAt ? new Date(rec.expiresAt).getTime() <= Date.now() : false,
+        remotePresent: remoteIds ? remoteIds.includes(rec.id) : null,
+    }));
+    if (json) {
+        console.log(JSON.stringify({ instances: rows, reconciled: Boolean(remoteIds), remoteError }, null, 2));
+        return;
+    }
+    if (rows.length === 0) {
+        console.log(formatWarning('No Zero instances bound on this machine. Run `pxbaas provision` to claim one.'));
+        return;
+    }
+    for (const r of rows) {
+        const flags = [r.expired ? 'EXPIRED' : '', r.remotePresent === false ? 'released-remotely' : '']
+            .filter(Boolean)
+            .join(',');
+        console.log(`${r.id}  profile=${r.profile}  expires=${r.expiresAt ?? '?'}${flags ? `  [${flags}]` : ''}`);
+    }
+    if (remoteError)
+        console.log(formatWarning(`(could not reconcile with Zero: ${remoteError})`));
+}
+async function handleRelease(id, options, program) {
+    const json = isJson(options, program);
+    const deps = makeDeps();
+    const rec = await deps.store.getInstance(id);
+    if (!options.confirm) {
+        const preview = {
+            status: 'dry-run',
+            id,
+            profile: rec?.profileName ?? null,
+            willRemoveProfile: !options.keepProfile && Boolean(rec),
+            note: 'pass --confirm to release (destroys cloud resources; irreversible)',
+        };
+        if (json)
+            console.log(JSON.stringify(preview, null, 2));
+        else {
+            console.log(formatWarning(`Preview: release instance ${id}${rec ? ` and remove profile '${rec.profileName}'` : ''}.`));
+            console.log('  Re-run with --confirm to proceed (irreversible).');
+        }
+        return;
+    }
+    const result = await releaseInstance(deps, id, { removeProfile: !options.keepProfile });
+    if (json) {
+        console.log(JSON.stringify({ status: 'released', ...result }, null, 2));
+        return;
+    }
+    console.log(formatSuccess(`Released Zero instance ${id}`));
+    if (result.profileRemoved)
+        console.log(`  Removed profile: ${result.profileRemoved}`);
+    if (result.wasCurrent)
+        console.log(formatWarning('  This was the current profile; no profile is active now. Use `pxbaas profile use <name>` or `pxbaas provision`.'));
+}
+async function handleCredentials(id, options, program) {
+    const json = isJson(options, program);
+    const store = new ZeroStore();
+    const rec = await store.getInstance(id);
+    if (!rec)
+        throw new Error(`No Zero instance '${id}' bound on this machine.`);
+    const creds = await new CredentialStore().getCredentials(rec.profileName);
+    const out = {
+        id: rec.id,
+        profile: rec.profileName,
+        endpoint: rec.endpoint,
+        dashboardUrl: rec.dashboardUrl ?? null,
+        dashboardUser: 'supabase',
+        expiresAt: rec.expiresAt ?? null,
+        whitelistIp: rec.whitelistIp ?? null,
+        keys: creds
+            ? {
+                anon: { fingerprint: computeFingerprint(creds.anonKey), role: 'anon' },
+                serviceRole: { fingerprint: computeFingerprint(creds.serviceRoleKey), role: 'service_role' },
+            }
+            : null,
+    };
+    if (options.reveal) {
+        out.dashboardPassword = rec.dashboardPassword ?? null;
+    }
+    if (json) {
+        console.log(JSON.stringify(out, null, 2));
+        return;
+    }
+    console.log(`Instance:   ${rec.id}`);
+    console.log(`Profile:    ${rec.profileName}`);
+    console.log(`Endpoint:   ${rec.endpoint}`);
+    console.log(`Dashboard:  ${rec.dashboardUrl ?? '-'}  (user: supabase)`);
+    if (creds)
+        console.log(`Keys:       anon ${computeFingerprint(creds.anonKey)} · service_role ${computeFingerprint(creds.serviceRoleKey)}`);
+    console.log(`Expires:    ${rec.expiresAt ?? '-'}`);
+    if (options.reveal) {
+        console.log(formatWarning(`Dashboard password: ${rec.dashboardPassword ?? '-'}  (do not paste into shared logs)`));
+    }
+    else {
+        console.log('  (dashboard password hidden; re-run with --reveal)');
+    }
+}
+async function handleCurrent(options, program) {
+    const json = isJson(options, program);
+    const profiles = new ProfileManager();
+    const current = await profiles.getCurrentProfile();
+    if (!current) {
+        if (json)
+            console.log(JSON.stringify({ status: 'no-profile' }, null, 2));
+        else
+            console.log(formatWarning('No active profile. Run `pxbaas provision` (Zero) or `pxbaas login` (your own instance).'));
+        return;
+    }
+    if (current.source !== 'zero') {
+        if (json)
+            console.log(JSON.stringify({ profile: current.name, source: current.source ?? 'login', zeroInstance: null }, null, 2));
+        else
+            console.log(`Current profile '${current.name}' is your own instance (not a Zero instance).`);
+        return;
+    }
+    const rec = await new ZeroStore().getInstance(current.zeroInstanceId ?? '');
+    if (json) {
+        // Never emit secrets (token / dashboardPassword / dbPassword) — redacted view only.
+        console.log(JSON.stringify({ profile: current.name, source: 'zero', zeroInstance: publicInstanceView(rec) }, null, 2));
+        return;
+    }
+    console.log(`Current profile '${current.name}' -> Zero instance ${current.zeroInstanceId}`);
+    if (rec)
+        console.log(`  Endpoint: ${rec.endpoint}  Expires: ${rec.expiresAt ?? '-'}`);
+}
+/** Redact a stored Zero instance record for safe output (drops token & passwords). */
+function publicInstanceView(rec) {
+    if (!rec)
+        return null;
+    return {
+        id: rec.id,
+        endpoint: rec.endpoint,
+        dashboardUrl: rec.dashboardUrl ?? null,
+        profileName: rec.profileName,
+        expiresAt: rec.expiresAt ?? null,
+        whitelistIp: rec.whitelistIp ?? null,
+        claimedAt: rec.claimedAt,
+        dashboardUser: 'supabase',
+        secretsRedacted: true,
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/commands/instance/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/instance/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3G,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAEzD,OAAO,EACL,iBAAiB,EACjB,eAAe,GAGhB,MAAM,6BAA6B,CAAC;AAErC;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,8BAA8B;IAC9B,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,+EAA+E,CAAC;SAC5F,MAAM,CAAC,kBAAkB,EAAE,oDAAoD,CAAC;SAChF,MAAM,CAAC,0BAA0B,EAAE,+DAA+D,CAAC;SACnG,MAAM,CAAC,aAAa,EAAE,gEAAgE,CAAC;SACvF,MAAM,CAAC,SAAS,EAAE,sEAAsE,CAAC;SACzF,MAAM,CAAC,SAAS,EAAE,gDAAgD,CAAC;SACnE,MAAM,CAAC,QAAQ,EAAE,uBAAuB,CAAC;SACzC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,MAAM,WAAW,GAAG,OAAO;SACxB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,2EAA2E,CAAC,CAAC;IAE5F,6CAA6C;IAC7C,WAAW;SACR,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,6BAA6B,CAAC;SAC1C,MAAM,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;SACpD,MAAM,CAAC,0BAA0B,EAAE,oBAAoB,CAAC;SACxD,MAAM,CAAC,aAAa,EAAE,+BAA+B,CAAC;SACtD,MAAM,CAAC,SAAS,EAAE,mCAAmC,CAAC;SACtD,MAAM,CAAC,SAAS,EAAE,gDAAgD,CAAC;SACnE,MAAM,CAAC,QAAQ,EAAE,uBAAuB,CAAC;SACzC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,WAAW;SACR,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,yFAAyF,CAAC;SACtG,MAAM,CAAC,QAAQ,EAAE,uBAAuB,CAAC;SACzC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,WAAW;SACR,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,mEAAmE,CAAC;SAChF,MAAM,CAAC,gBAAgB,EAAE,yDAAyD,CAAC;SACnF,MAAM,CAAC,WAAW,EAAE,yCAAyC,CAAC;SAC9D,MAAM,CAAC,QAAQ,EAAE,uBAAuB,CAAC;SACzC,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;QAC5B,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,WAAW;SACR,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,wFAAwF,CAAC;SACrG,MAAM,CAAC,UAAU,EAAE,sDAAsD,CAAC;SAC1E,MAAM,CAAC,QAAQ,EAAE,uBAAuB,CAAC;SACzC,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;QAC5B,IAAI,CAAC;YACH,MAAM,iBAAiB,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,WAAW;SACR,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,8DAA8D,CAAC;SAC3E,MAAM,CAAC,QAAQ,EAAE,uBAAuB,CAAC;SACzC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,QAAQ;IACf,OAAO;QACL,IAAI,EAAE,IAAI,UAAU,EAAE;QACtB,QAAQ,EAAE,IAAI,cAAc,EAAE;QAC9B,KAAK,EAAE,IAAI,eAAe,EAAE;QAC5B,KAAK,EAAE,IAAI,SAAS,EAAE;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,OAA2B,EAAE,OAAgB;IAC3D,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,IAAc;IACjD,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1G,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC/D,IAAI,IAAI;gBAAE,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;QAC/E,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,IAAY;IACjC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,wBAAwB;YAC3B,OAAO,0IAA0I,CAAC;QACpJ,KAAK,qBAAqB;YACxB,OAAO,8DAA8D,CAAC;QACxE,KAAK,yBAAyB;YAC5B,OAAO,6FAA6F,CAAC;QACvG,KAAK,mBAAmB;YACtB,OAAO,oFAAoF,CAAC;QAC9F,KAAK,sBAAsB;YACzB,OAAO,0DAA0D,CAAC;QACpE,KAAK,oBAAoB;YACvB,OAAO,mEAAmE,CAAC;QAC7E;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAoH,EACpH,OAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE;QAC3C,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,+CAA+C;QAC9E,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IAEH,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,kBAAkB,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9G,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,YAAY,OAAO,MAAM,CAAC,WAAW,sCAAsC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;IACzI,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY;QAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,QAAQ,CAAC,YAAY,oBAAoB,CAAC,CAAC;IACjH,OAAO,CAAC,GAAG,CAAC,sBAAsB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,mBAAmB,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;IACxH,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,QAAQ,CAAC,SAAS,uBAAuB,CAAC,CAAC;IAC9G,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW;QAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,QAAQ,CAAC,WAAW,2BAA2B,CAAC,CAAC;IACtH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,6FAA6F,CAAC,CAAC;IAC3G,OAAO,CAAC,GAAG,CAAC,0DAA0D,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC;AAC7G,CAAC;AAED,SAAS,eAAe,CAAC,MAAuB;IAC9C,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa;QAChD,OAAO,EAAE,MAAM,CAAC,WAAW;QAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE;YACT,sBAAsB;YACtB,yBAAyB;YACzB,gDAAgD;YAChD,+BAA+B,MAAM,CAAC,QAAQ,CAAC,EAAE,WAAW;SAC7D;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,OAA2B,EAAE,OAAgB;IACrE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,SAAS,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;IAErC,kFAAkF;IAClF,IAAI,SAAS,GAAoB,IAAI,CAAC;IACtC,IAAI,WAA+B,CAAC;IACpC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,UAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClD,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,WAAW,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/B,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,WAAW;QACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAChC,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK;QAChF,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;KAC7D,CAAC,CAAC,CAAC;IAEJ,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvG,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,+EAA+E,CAAC,CAAC,CAAC;QAC5G,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7F,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,OAAO,aAAa,CAAC,CAAC,SAAS,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,WAAW;QAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,mCAAmC,WAAW,GAAG,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,EAAU,EACV,OAAqE,EACrE,OAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAE7C,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG;YACd,MAAM,EAAE,SAAS;YACjB,EAAE;YACF,OAAO,EAAE,GAAG,EAAE,WAAW,IAAI,IAAI;YACjC,iBAAiB,EAAE,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;YACvD,IAAI,EAAE,oEAAoE;SAC3E,CAAC;QACF,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;aACnD,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,6BAA6B,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,wBAAwB,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACvH,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QACpE,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACxF,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,cAAc;QAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,UAAU;QAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,kHAAkH,CAAC,CAAC,CAAC;AACxK,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,EAAU,EACV,OAA6C,EAC7C,OAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,SAAS,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,EAAE,0BAA0B,CAAC,CAAC;IAE7E,MAAM,KAAK,GAAG,MAAM,IAAI,eAAe,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1E,MAAM,GAAG,GAA4B;QACnC,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,WAAW;QACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;QACtC,aAAa,EAAE,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAChC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,IAAI,EAAE,KAAK;YACT,CAAC,CAAC;gBACE,IAAI,EAAE,EAAE,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;gBACtE,WAAW,EAAE,EAAE,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE;aAC7F;YACH,CAAC,CAAC,IAAI;KACT,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,GAAG,CAAC,iBAAiB,GAAG,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC;IACxD,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,CAAC,YAAY,IAAI,GAAG,oBAAoB,CAAC,CAAC;IACxE,IAAI,KAAK;QAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IAC3I,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,uBAAuB,GAAG,CAAC,iBAAiB,IAAI,GAAG,mCAAmC,CAAC,CAAC,CAAC;IACrH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAA2B,EAAE,OAAgB;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAAC;IACnD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;YACpE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,yFAAyF,CAAC,CAAC,CAAC;QAC3H,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;YAC5H,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,CAAC,IAAI,+CAA+C,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,IAAI,SAAS,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAC5E,IAAI,IAAI,EAAE,CAAC;QACT,oFAAoF;QACpF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvH,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,CAAC,IAAI,sBAAsB,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC5F,IAAI,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,CAAC,QAAQ,cAAc,GAAG,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,sFAAsF;AACtF,SAAS,kBAAkB,CAAC,GAA8B;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;QACtC,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAChC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,aAAa,EAAE,UAAU;QACzB,eAAe,EAAE,IAAI;KACtB,CAAC;AACJ,CAAC"}

package/dist/commands/login/index.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function registerLoginCommand(program: Command): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/login/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/login/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA2CpC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAiB3D"}

package/dist/commands/login/index.js

@@ -0,0 +1,185 @@
+import inquirer from 'inquirer';
+import { CredentialStore, ProfileManager, introspectJwt, validateTenantConsistency, assertTty, assertNoKeyArgs, formatSuccess, formatError, computeFingerprint, } from '../../credentials/index.js';
+/**
+ * 从 stdin 读取一行（用于 --anon-key-stdin / --service-key-stdin）
+ */
+async function readFromStdin() {
+    return new Promise((resolve, reject) => {
+        let data = '';
+        process.stdin.setEncoding('utf8');
+        process.stdin.on('readable', () => {
+            let chunk;
+            while ((chunk = process.stdin.read()) !== null) {
+                data += chunk;
+            }
+        });
+        process.stdin.on('end', () => {
+            resolve(data.trim());
+        });
+        process.stdin.on('error', reject);
+    });
+}
+export function registerLoginCommand(program) {
+    program
+        .command('login')
+        .description('Authenticate with PolarDB-X BaaS (interactive TTY only)')
+        .option('--endpoint <url>', 'BaaS endpoint URL')
+        .option('--tenant-id <id>', 'Tenant ID (for multi-tenant mode)')
+        .option('--anon-key-stdin', 'Read anon key from stdin')
+        .option('--service-key-stdin', 'Read service role key from stdin')
+        .action(async (options) => {
+        try {
+            await handleLogin(options, program);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            console.error(formatError(message));
+            process.exit(1);
+        }
+    });
+}
+async function handleLogin(options, program) {
+    // 检查 argv 中是否有密钥参数（安全守卫）
+    assertNoKeyArgs(process.argv);
+    const isStdinMode = options.anonKeyStdin || options.serviceKeyStdin;
+    // 如果不是 stdin 模式，必须是 TTY
+    if (!isStdinMode) {
+        assertTty();
+    }
+    let endpoint;
+    let tenantId;
+    let anonKey;
+    let serviceRoleKey;
+    if (isStdinMode) {
+        // stdin 模式：从命令行参数或 stdin 获取
+        endpoint = options.endpoint || '';
+        tenantId = options.tenantId;
+        if (!endpoint) {
+            throw new Error('--endpoint is required when using --anon-key-stdin or --service-key-stdin');
+        }
+        if (options.anonKeyStdin && options.serviceKeyStdin) {
+            // 两个都从 stdin 读取（每行一个）
+            const lines = (await readFromStdin()).split('\n');
+            if (lines.length < 2) {
+                throw new Error('Expected two lines from stdin: anon key on first line, service role key on second line');
+            }
+            anonKey = lines[0].trim();
+            serviceRoleKey = lines[1].trim();
+        }
+        else {
+            // 只指定了一个 --*-key-stdin：用法错误。直接报错，绝不先阻塞读 stdin
+            // （否则在 TTY 下会卡住等输入，而不是立刻提示用法）。
+            throw new Error('Both --anon-key-stdin and --service-key-stdin must be specified together');
+        }
+    }
+    else {
+        // TTY 交互模式：使用 inquirer 提示
+        const answers = await inquirer.prompt([
+            {
+                type: 'input',
+                name: 'endpoint',
+                message: 'BaaS endpoint URL:',
+                default: options.endpoint || 'http://localhost:8000',
+                validate: (input) => {
+                    if (!input.trim())
+                        return 'Endpoint is required';
+                    if (!input.startsWith('http://') && !input.startsWith('https://')) {
+                        return 'Endpoint must start with http:// or https://';
+                    }
+                    return true;
+                },
+            },
+            {
+                type: 'input',
+                name: 'tenantId',
+                message: 'Tenant ID (leave empty for single-tenant mode):',
+                default: options.tenantId || '',
+            },
+            {
+                type: 'password',
+                name: 'anonKey',
+                message: 'Anon Key:',
+                mask: '*',
+                validate: (input) => {
+                    if (!input.trim())
+                        return 'Anon key is required';
+                    return true;
+                },
+            },
+            {
+                type: 'password',
+                name: 'serviceRoleKey',
+                message: 'Service Role Key:',
+                mask: '*',
+                validate: (input) => {
+                    if (!input.trim())
+                        return 'Service role key is required';
+                    return true;
+                },
+            },
+        ]);
+        endpoint = answers.endpoint;
+        tenantId = answers.tenantId || undefined;
+        anonKey = answers.anonKey;
+        serviceRoleKey = answers.serviceRoleKey;
+    }
+    // 解析 JWT
+    const anonJwt = await introspectJwt(anonKey);
+    const serviceJwt = await introspectJwt(serviceRoleKey);
+    // 检查 JWT 是否过期：过期凭据不可用，拒绝登录而非保存坏凭据
+    // （否则 login “成功”但后续每条命令都 401，报错还很难排查）。
+    if (anonJwt.isExpired) {
+        throw new Error('Anon key is expired. Please provide a valid (non-expired) key.');
+    }
+    if (serviceJwt.isExpired) {
+        throw new Error('Service role key is expired. Please provide a valid (non-expired) key.');
+    }
+    // 创建 profile
+    const mode = tenantId ? 'multi-tenant' : 'single-tenant';
+    // 使用全局 --profile 选项，如果未提供则使用 'default'
+    const profileName = program.opts().profile || 'default';
+    const profile = {
+        name: profileName,
+        endpoint,
+        tenantId,
+        mode,
+        createdAt: new Date().toISOString(),
+        updatedAt: new Date().toISOString(),
+    };
+    // 验证租户一致性
+    validateTenantConsistency(profile, anonJwt, serviceJwt);
+    // 保存 profile
+    const profileManager = new ProfileManager();
+    await profileManager.setProfile(profile);
+    await profileManager.useProfile(profileName);
+    // 保存凭据
+    const credentialStore = new CredentialStore();
+    await credentialStore.setCredentials(profileName, {
+        anonKey,
+        serviceRoleKey,
+        storedAt: new Date().toISOString(),
+    });
+    // 输出成功消息
+    if (options.json || program.opts().json) {
+        const output = {
+            status: 'success',
+            message: `Login successful for profile: ${profileName}`,
+            profile: profileName,
+            endpoint,
+            tenantId: tenantId || '(single-tenant)',
+            mode,
+            anonKeyFingerprint: computeFingerprint(anonKey),
+            serviceKeyFingerprint: computeFingerprint(serviceRoleKey),
+        };
+        console.log(JSON.stringify(output, null, 2));
+    }
+    else {
+        console.log(formatSuccess(`Login successful for profile: ${profileName}`));
+        console.log(`  Endpoint:    ${endpoint}`);
+        console.log(`  Tenant ID:   ${tenantId || '(single-tenant)'}`);
+        console.log(`  Mode:        ${mode}`);
+        console.log(`  Anon Key:    ${computeFingerprint(anonKey)}`);
+        console.log(`  Service Key: ${computeFingerprint(serviceRoleKey)}`);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/commands/login/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/login/index.ts"],"names":[],"mappings":"AACA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EACL,eAAe,EACf,cAAc,EACd,aAAa,EACb,yBAAyB,EACzB,SAAS,EACT,eAAe,EACf,aAAa,EACb,WAAW,EACX,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AAUpC;;GAEG;AACH,KAAK,UAAU,aAAa;IAC1B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE;YAChC,IAAI,KAAa,CAAC;YAClB,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC/C,IAAI,IAAI,KAAK,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YAC3B,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,kBAAkB,EAAE,mBAAmB,CAAC;SAC/C,MAAM,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;SAC/D,MAAM,CAAC,kBAAkB,EAAE,0BAA0B,CAAC;SACtD,MAAM,CAAC,qBAAqB,EAAE,kCAAkC,CAAC;SACjE,MAAM,CAAC,KAAK,EAAE,OAAqB,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAqB,EAAE,OAAgB;IAChE,yBAAyB;IACzB,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9B,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC;IAEpE,wBAAwB;IACxB,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,SAAS,EAAE,CAAC;IACd,CAAC;IAED,IAAI,QAAgB,CAAC;IACrB,IAAI,QAA4B,CAAC;IACjC,IAAI,OAAe,CAAC;IACpB,IAAI,cAAsB,CAAC;IAE3B,IAAI,WAAW,EAAE,CAAC;QAChB,4BAA4B;QAC5B,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;QAClC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAE5B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC/F,CAAC;QAED,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YACpD,sBAAsB;YACtB,MAAM,KAAK,GAAG,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;YAC5G,CAAC;YACD,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1B,cAAc,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,8CAA8C;YAC9C,+BAA+B;YAC/B,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;SAAM,CAAC;QACN,0BAA0B;QAC1B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;YACpC;gBACE,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,oBAAoB;gBAC7B,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,uBAAuB;gBACpD,QAAQ,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;wBAAE,OAAO,sBAAsB,CAAC;oBACjD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;wBAClE,OAAO,8CAA8C,CAAC;oBACxD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;aACF;YACD;gBACE,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,iDAAiD;gBAC1D,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;aAChC;YACD;gBACE,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,GAAG;gBACT,QAAQ,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;wBAAE,OAAO,sBAAsB,CAAC;oBACjD,OAAO,IAAI,CAAC;gBACd,CAAC;aACF;YACD;gBACE,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,mBAAmB;gBAC5B,IAAI,EAAE,GAAG;gBACT,QAAQ,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;wBAAE,OAAO,8BAA8B,CAAC;oBACzD,OAAO,IAAI,CAAC;gBACd,CAAC;aACF;SACF,CAAC,CAAC;QAEH,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC5B,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;QACzC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC1B,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAC1C,CAAC;IAED,SAAS;IACT,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,cAAc,CAAC,CAAC;IAEvD,kCAAkC;IAClC,uCAAuC;IACvC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IAED,aAAa;IACb,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC;IACzD,uCAAuC;IACvC,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,IAAI,SAAS,CAAC;IAExD,MAAM,OAAO,GAAgB;QAC3B,IAAI,EAAE,WAAW;QACjB,QAAQ;QACR,QAAQ;QACR,IAAI;QACJ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,UAAU;IACV,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAExD,aAAa;IACb,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAE7C,OAAO;IACP,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;IAC9C,MAAM,eAAe,CAAC,cAAc,CAAC,WAAW,EAAE;QAChD,OAAO;QACP,cAAc;QACd,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC,CAAC;IAEH,SAAS;IACT,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG;YACb,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,iCAAiC,WAAW,EAAE;YACvD,OAAO,EAAE,WAAW;YACpB,QAAQ;YACR,QAAQ,EAAE,QAAQ,IAAI,iBAAiB;YACvC,IAAI;YACJ,kBAAkB,EAAE,kBAAkB,CAAC,OAAO,CAAC;YAC/C,qBAAqB,EAAE,kBAAkB,CAAC,cAAc,CAAC;SAC1D,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,iCAAiC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,kBAAkB,QAAQ,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,kBAAkB,QAAQ,IAAI,iBAAiB,EAAE,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,kBAAkB,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,kBAAkB,kBAAkB,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;AACH,CAAC"}

package/dist/commands/login/login.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function registerLoginCommand(program: Command): void;
+//# sourceMappingURL=login.d.ts.map

package/dist/commands/login/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/commands/login/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA4CpC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAkB3D"}