@polardbx/pxbaas 0.0.0-stage → 0.1.0-beta.10

package/dist/credentials/masker.js

@@ -0,0 +1,40 @@
+/**
+ * 密钥脱敏工具 - 只显示指纹，不暴露完整密钥
+ */
+import { createHash } from 'node:crypto';
+/**
+ * 计算密钥指纹：sha256 前8字符 + 后4字符
+ * 格式：sha256:abcd1234...ef56
+ *
+ * 这是**展示层**的唯一加前缀处（whoami / instance / provision 直接输出它）。
+ * `introspectJwt().fingerprint` 返回的是同一指纹的裸值，前缀只在这里加一次。
+ */
+export function computeFingerprint(key) {
+    const hash = createHash('sha256').update(key).digest('hex');
+    return `sha256:${hash.slice(0, 8)}...${hash.slice(-4)}`;
+}
+/**
+ * 脱敏 Authorization header
+ * 输入: "Bearer eyJhbGc..."
+ * 输出: "Bearer sha256:abcd1234...ef56"
+ */
+export function maskAuthorizationHeader(header) {
+    if (!header.startsWith('Bearer ')) {
+        return header;
+    }
+    const token = header.slice(7);
+    const fingerprint = computeFingerprint(token);
+    return `Bearer ${fingerprint}`;
+}
+/**
+ * 脱敏任意字符串（如果看起来像 JWT）
+ * JWT 特征：包含两个点，三段 base64
+ */
+export function maskIfJwt(value) {
+    const parts = value.split('.');
+    if (parts.length === 3 && parts.every(p => p.length > 0)) {
+        return computeFingerprint(value);
+    }
+    return value;
+}
+//# sourceMappingURL=masker.js.map

package/dist/credentials/masker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"masker.js","sourceRoot":"","sources":["../../src/credentials/masker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,UAAU,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,UAAU,WAAW,EAAE,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/credentials/profile.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Profile 管理器 - 多环境配置管理
+ */
+export type ProfileMode = 'single-tenant' | 'multi-tenant';
+/** Where a profile's instance came from: a customer's own instance (login) or a Zero-provisioned one. */
+export type ProfileSource = 'login' | 'zero';
+export interface BaasProfile {
+    name: string;
+    endpoint: string;
+    /** Canonical App origin supplied by the platform; never derived by the CLI. */
+    appEndpoint?: string;
+    tenantId?: string;
+    mode: ProfileMode;
+    /** Instance origin. Absent on legacy profiles (treated as 'login'). */
+    source?: ProfileSource;
+    /** Zero instance id (sbx_*), only when source === 'zero'. */
+    zeroInstanceId?: string;
+    /** Zero instance expiry (ISO 8601), only when source === 'zero'. */
+    expiresAt?: string;
+    /**
+     * 该 profile 是否绑定了平台管理凭据（dashboard Basic Auth）。仅是标记：口令本身
+     * 存在凭据存储的独立账目里，数据面命令读不到它。
+     */
+    adminCapable?: boolean;
+    createdAt: string;
+    updatedAt: string;
+}
+interface ProfilesStore {
+    version: 1;
+    current: string;
+    profiles: Record<string, BaasProfile>;
+}
+/** 设置进程级 profile 覆盖（由 main.ts 的 preAction hook 调用）。 */
+export declare function setCliProfileOverrideGlobal(profileName: string | undefined): void;
+/** 读取进程级 profile 覆盖（供测试/诊断）。 */
+export declare function getCliProfileOverrideGlobal(): string | undefined;
+/**
+ * 判断被调用的命令是否会创建/覆盖 `--profile` 指定的 profile。
+ *
+ * @param commandPath 完整命令路径（如 `['profile','import']`），不含程序名。
+ *                    只比叶子名会让将来任何同名子命令误获放行，故必须传完整路径。
+ */
+export declare function isProfileCreatingCommand(commandPath: readonly string[]): boolean;
+export declare class ProfileManager {
+    private homeDir;
+    private cliProfileOverride?;
+    private store;
+    constructor(homeDir?: string);
+    /**
+     * 设置 CLI profile 覆盖（来自 --profile flag）。
+     * 同时写入进程级变量，使其它命令实例（各自 new ProfileManager）也能看到。
+     */
+    setCliProfileOverride(profileName: string | undefined): void;
+    /** 生效的 --profile 覆盖：实例级优先，其次进程级。 */
+    private get effectiveCliProfileOverride();
+    /**
+     * 获取 profiles.json 路径
+     */
+    private getProfilesFilePath;
+    /**
+     * 加载 profiles store
+     */
+    load(): Promise<ProfilesStore>;
+    /**
+     * 保存 profiles store
+     */
+    private save;
+    /**
+     * 获取当前激活的 profile
+     * 优先级：--profile flag > BAAS_PROFILE env > store.current
+     */
+    getCurrentProfile(): Promise<BaasProfile | null>;
+    /**
+     * 列出所有 profiles
+     */
+    listProfiles(): Promise<BaasProfile[]>;
+    /**
+     * 获取指定 profile
+     */
+    getProfile(name: string): Promise<BaasProfile | null>;
+    /**
+     * 创建或更新 profile
+     */
+    setProfile(profile: BaasProfile): Promise<void>;
+    /**
+     * 切换当前 profile
+     */
+    useProfile(name: string): Promise<void>;
+    /**
+     * 删除 profile
+     */
+    removeProfile(name: string): Promise<boolean>;
+}
+export {};
+//# sourceMappingURL=profile.d.ts.map

package/dist/credentials/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../src/credentials/profile.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,cAAc,CAAC;AAE3D,yGAAyG;AACzG,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,WAAW,CAAC;IAClB,uEAAuE;IACvE,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,aAAa;IACrB,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACvC;AAYD,uDAAuD;AACvD,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAEjF;AAED,gCAAgC;AAChC,wBAAgB,2BAA2B,IAAI,MAAM,GAAG,SAAS,CAEhE;AAgBD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAMhF;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,kBAAkB,CAAC,CAAS;IACpC,OAAO,CAAC,KAAK,CAA8B;gBAE/B,OAAO,CAAC,EAAE,MAAM;IAI5B;;;OAGG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAK5D,oCAAoC;IACpC,OAAO,KAAK,2BAA2B,GAEtC;IAED;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAI3B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC;IA2BpC;;OAEG;YACW,IAAI;IAYlB;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAsCtD;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAK5C;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAK3D;;OAEG;IACG,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBrD;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW7C;;OAEG;IACG,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAiBpD"}

package/dist/credentials/profile.js

@@ -0,0 +1,207 @@
+/**
+ * Profile 管理器 - 多环境配置管理
+ */
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/**
+ * Profile 管理器
+ *
+ * 存储路径：~/.baas/profiles.json
+ * 优先级：--profile flag > BAAS_PROFILE env > store.current
+ */
+// 进程级 --profile 覆盖：各命令实现自己 new ProfileManager()，实例字段无法跨实例共享，
+// 因此用模块级变量承载（仅本进程生效，绝不写回 profiles.json）。
+let processCliProfileOverride;
+/** 设置进程级 profile 覆盖（由 main.ts 的 preAction hook 调用）。 */
+export function setCliProfileOverrideGlobal(profileName) {
+    processCliProfileOverride = profileName;
+}
+/** 读取进程级 profile 覆盖（供测试/诊断）。 */
+export function getCliProfileOverrideGlobal() {
+    return processCliProfileOverride;
+}
+/**
+ * 会「写入 --profile 所指 profile」的命令，按完整命令路径匹配。
+ *
+ * 对这些命令来说，profile 名不存在恰恰是前提（它们正要创建它），所以 main.ts 的
+ * preAction 钩子不能对其做存在性硬校验；其余命令一律保持响亮失败，否则就退回了
+ * `--profile` 曾被静默忽略、写操作跨实例误落的旧缺陷。
+ */
+const PROFILE_CREATING_COMMANDS = [
+    ['login'],
+    ['profile', 'import'],
+    // `tenant login` 可以把管理凭据绑定到一个尚不存在的 profile（管理员常在新机器上先做这一步）
+    ['tenant', 'login'],
+];
+/**
+ * 判断被调用的命令是否会创建/覆盖 `--profile` 指定的 profile。
+ *
+ * @param commandPath 完整命令路径（如 `['profile','import']`），不含程序名。
+ *                    只比叶子名会让将来任何同名子命令误获放行，故必须传完整路径。
+ */
+export function isProfileCreatingCommand(commandPath) {
+    return PROFILE_CREATING_COMMANDS.some((candidate) => candidate.length === commandPath.length &&
+        candidate.every((segment, index) => segment === commandPath[index]));
+}
+export class ProfileManager {
+    homeDir;
+    cliProfileOverride; // --profile flag
+    store = null;
+    constructor(homeDir) {
+        this.homeDir = homeDir ?? join(homedir(), '.baas');
+    }
+    /**
+     * 设置 CLI profile 覆盖（来自 --profile flag）。
+     * 同时写入进程级变量，使其它命令实例（各自 new ProfileManager）也能看到。
+     */
+    setCliProfileOverride(profileName) {
+        this.cliProfileOverride = profileName;
+        processCliProfileOverride = profileName;
+    }
+    /** 生效的 --profile 覆盖：实例级优先，其次进程级。 */
+    get effectiveCliProfileOverride() {
+        return this.cliProfileOverride ?? processCliProfileOverride;
+    }
+    /**
+     * 获取 profiles.json 路径
+     */
+    getProfilesFilePath() {
+        return join(this.homeDir, 'profiles.json');
+    }
+    /**
+     * 加载 profiles store
+     */
+    async load() {
+        if (this.store) {
+            return this.store;
+        }
+        const filePath = this.getProfilesFilePath();
+        if (!existsSync(filePath)) {
+            this.store = { version: 1, current: '', profiles: {} };
+            return this.store;
+        }
+        try {
+            const content = await readFile(filePath, 'utf-8');
+            const data = JSON.parse(content);
+            if (data.version !== 1) {
+                throw new Error(`Unsupported profiles file version: ${data.version}`);
+            }
+            this.store = data;
+            return this.store;
+        }
+        catch (err) {
+            throw new Error(`Failed to read profiles file: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    /**
+     * 保存 profiles store
+     */
+    async save(store) {
+        if (!existsSync(this.homeDir)) {
+            await mkdir(this.homeDir, { mode: 0o700, recursive: true });
+        }
+        const filePath = this.getProfilesFilePath();
+        const content = JSON.stringify(store, null, 2);
+        await writeFile(filePath, content, { mode: 0o644 });
+        this.store = store;
+    }
+    /**
+     * 获取当前激活的 profile
+     * 优先级：--profile flag > BAAS_PROFILE env > store.current
+     */
+    async getCurrentProfile() {
+        const store = await this.load();
+        // 1. CLI --profile flag
+        const cliOverride = this.effectiveCliProfileOverride;
+        if (cliOverride) {
+            const profile = store.profiles[cliOverride];
+            if (!profile) {
+                throw new Error(`Profile '${cliOverride}' not found (from --profile flag)`);
+            }
+            return profile;
+        }
+        // 2. BAAS_PROFILE 环境变量
+        const envProfile = process.env.BAAS_PROFILE;
+        if (envProfile) {
+            const profile = store.profiles[envProfile];
+            if (!profile) {
+                throw new Error(`Profile '${envProfile}' not found (from BAAS_PROFILE env)`);
+            }
+            return profile;
+        }
+        // 3. store.current
+        if (store.current) {
+            const profile = store.profiles[store.current];
+            if (!profile) {
+                // current 指向不存在的 profile，清除它
+                store.current = '';
+                await this.save(store);
+                return null;
+            }
+            return profile;
+        }
+        return null;
+    }
+    /**
+     * 列出所有 profiles
+     */
+    async listProfiles() {
+        const store = await this.load();
+        return Object.values(store.profiles);
+    }
+    /**
+     * 获取指定 profile
+     */
+    async getProfile(name) {
+        const store = await this.load();
+        return store.profiles[name] ?? null;
+    }
+    /**
+     * 创建或更新 profile
+     */
+    async setProfile(profile) {
+        const store = await this.load();
+        const now = new Date().toISOString();
+        if (store.profiles[profile.name]) {
+            // 更新
+            profile.updatedAt = now;
+        }
+        else {
+            // 创建
+            profile.createdAt = now;
+            profile.updatedAt = now;
+        }
+        store.profiles[profile.name] = profile;
+        await this.save(store);
+    }
+    /**
+     * 切换当前 profile
+     */
+    async useProfile(name) {
+        const store = await this.load();
+        if (!store.profiles[name]) {
+            throw new Error(`Profile '${name}' not found`);
+        }
+        store.current = name;
+        await this.save(store);
+    }
+    /**
+     * 删除 profile
+     */
+    async removeProfile(name) {
+        const store = await this.load();
+        if (!store.profiles[name]) {
+            return false;
+        }
+        delete store.profiles[name];
+        // 如果删除的是当前 profile，清除 current
+        if (store.current === name) {
+            store.current = '';
+        }
+        await this.save(store);
+        return true;
+    }
+}
+//# sourceMappingURL=profile.js.map

package/dist/credentials/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/credentials/profile.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAmCjC;;;;;GAKG;AACH,6DAA6D;AAC7D,yCAAyC;AACzC,IAAI,yBAA6C,CAAC;AAElD,uDAAuD;AACvD,MAAM,UAAU,2BAA2B,CAAC,WAA+B;IACzE,yBAAyB,GAAG,WAAW,CAAC;AAC1C,CAAC;AAED,gCAAgC;AAChC,MAAM,UAAU,2BAA2B;IACzC,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,yBAAyB,GAAmC;IAChE,CAAC,OAAO,CAAC;IACT,CAAC,SAAS,EAAE,QAAQ,CAAC;IACrB,2DAA2D;IAC3D,CAAC,QAAQ,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,WAA8B;IACrE,OAAO,yBAAyB,CAAC,IAAI,CACnC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACvC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,cAAc;IACjB,OAAO,CAAS;IAChB,kBAAkB,CAAU,CAAC,iBAAiB;IAC9C,KAAK,GAAyB,IAAI,CAAC;IAE3C,YAAY,OAAgB;QAC1B,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH,qBAAqB,CAAC,WAA+B;QACnD,IAAI,CAAC,kBAAkB,GAAG,WAAW,CAAC;QACtC,yBAAyB,GAAG,WAAW,CAAC;IAC1C,CAAC;IAED,oCAAoC;IACpC,IAAY,2BAA2B;QACrC,OAAO,IAAI,CAAC,kBAAkB,IAAI,yBAAyB,CAAC;IAC9D,CAAC;IAED;;OAEG;IACK,mBAAmB;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAE5C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAkB,CAAC;YAElD,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,IAAI,CAAC,KAAoB;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAE/C,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB;QACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,wBAAwB;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,CAAC;QACrD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,YAAY,WAAW,mCAAmC,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,uBAAuB;QACvB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC5C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,qCAAqC,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,mBAAmB;QACnB,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,6BAA6B;gBAC7B,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,OAAoB;QACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,KAAK;YACL,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,KAAK;YACL,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;YACxB,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,aAAa,CAAC,CAAC;QACjD,CAAC;QAED,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;QACrB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE5B,8BAA8B;QAC9B,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3B,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC;QACrB,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/credentials/tenant-guard.d.ts

@@ -0,0 +1,16 @@
+/**
+ * 租户一致性守卫 - 验证 profile 和 JWT 的 tenant_id 一致
+ */
+import type { BaasProfile } from './profile.js';
+import type { IntrospectedJwt } from './jwt-introspect.js';
+/**
+ * 验证 profile 和 JWT 的 tenant_id 一致性
+ *
+ * 规则：
+ * - 多租户模式：profile.tenantId == anonJwt.tenantId == serviceJwt.tenantId
+ * - 单租户模式：profile.tenantId 为空，JWT 的 tenant_id 也应为空（或不存在）
+ *
+ * @throws Error 如果不一致
+ */
+export declare function validateTenantConsistency(profile: BaasProfile, anonJwt: IntrospectedJwt, serviceJwt: IntrospectedJwt): void;
+//# sourceMappingURL=tenant-guard.d.ts.map

package/dist/credentials/tenant-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-guard.d.ts","sourceRoot":"","sources":["../../src/credentials/tenant-guard.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,eAAe,GAC1B,IAAI,CAwDN"}

package/dist/credentials/tenant-guard.js

@@ -0,0 +1,53 @@
+/**
+ * 租户一致性守卫 - 验证 profile 和 JWT 的 tenant_id 一致
+ */
+/**
+ * 验证 profile 和 JWT 的 tenant_id 一致性
+ *
+ * 规则：
+ * - 多租户模式：profile.tenantId == anonJwt.tenantId == serviceJwt.tenantId
+ * - 单租户模式：profile.tenantId 为空，JWT 的 tenant_id 也应为空（或不存在）
+ *
+ * @throws Error 如果不一致
+ */
+export function validateTenantConsistency(profile, anonJwt, serviceJwt) {
+    const profileTenant = profile.tenantId;
+    const anonTenant = anonJwt.payload.tenant_id;
+    const serviceTenant = serviceJwt.payload.tenant_id;
+    // 多租户模式
+    if (profile.mode === 'multi-tenant') {
+        if (!profileTenant) {
+            throw new Error('Error: multi-tenant profile must have tenantId');
+        }
+        if (anonTenant !== profileTenant) {
+            throw new Error(`Error: tenant_id mismatch. Profile: ${profileTenant}, Anon JWT: ${anonTenant ?? 'none'}. ` +
+                `Ensure you pasted the correct keys for this tenant.`);
+        }
+        if (serviceTenant !== profileTenant) {
+            throw new Error(`Error: tenant_id mismatch. Profile: ${profileTenant}, Service JWT: ${serviceTenant ?? 'none'}. ` +
+                `Ensure you pasted the correct keys for this tenant.`);
+        }
+    }
+    // 单租户模式
+    if (profile.mode === 'single-tenant') {
+        if (profileTenant) {
+            throw new Error('Error: single-tenant profile must not have tenantId');
+        }
+        // 单租户模式下，JWT 不应该包含 tenant_id（或者 tenant_id 为空字符串）
+        if (anonTenant && anonTenant !== '') {
+            throw new Error(`Error: single-tenant profile but anon JWT has tenant_id: ${anonTenant}. ` +
+                `This key is for multi-tenant mode.`);
+        }
+        if (serviceTenant && serviceTenant !== '') {
+            throw new Error(`Error: single-tenant profile but service JWT has tenant_id: ${serviceTenant}. ` +
+                `This key is for multi-tenant mode.`);
+        }
+    }
+    // 两把 key 的 tenant_id 必须一致（无论单租户还是多租户）
+    if (anonTenant !== serviceTenant) {
+        throw new Error(`Error: anon and service JWT have different tenant_id. ` +
+            `Anon: ${anonTenant ?? 'none'}, Service: ${serviceTenant ?? 'none'}. ` +
+            `Ensure both keys are for the same tenant.`);
+    }
+}
+//# sourceMappingURL=tenant-guard.js.map

package/dist/credentials/tenant-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-guard.js","sourceRoot":"","sources":["../../src/credentials/tenant-guard.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAoB,EACpB,OAAwB,EACxB,UAA2B;IAE3B,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;IACvC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;IAC7C,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC;IAEnD,QAAQ;IACR,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,uCAAuC,aAAa,eAAe,UAAU,IAAI,MAAM,IAAI;gBAC3F,qDAAqD,CACtD,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,KAAK,aAAa,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,uCAAuC,aAAa,kBAAkB,aAAa,IAAI,MAAM,IAAI;gBACjG,qDAAqD,CACtD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,QAAQ;IACR,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACrC,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,iDAAiD;QACjD,IAAI,UAAU,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,4DAA4D,UAAU,IAAI;gBAC1E,oCAAoC,CACrC,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,IAAI,aAAa,KAAK,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,+DAA+D,aAAa,IAAI;gBAChF,oCAAoC,CACrC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,wDAAwD;YACxD,SAAS,UAAU,IAAI,MAAM,cAAc,aAAa,IAAI,MAAM,IAAI;YACtE,2CAA2C,CAC5C,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/credentials/tty-guard.d.ts

@@ -0,0 +1,29 @@
+/**
+ * TTY 守卫 - 防止 agent 执行敏感命令
+ */
+/**
+ * 断言当前运行在交互式 TTY 中
+ * @param isTTY - 可选参数，用于测试。如果不提供，则从 process.stdin.isTTY 读取
+ * @param ciEnv - 可选参数，用于测试。如果不提供，则从 process.env.CI 读取
+ * @throws Error 如果非 TTY 环境
+ */
+export declare function assertTty(isTTY?: boolean, ciEnv?: string): void;
+/**
+ * 从 stdin 按行读取密钥/口令类输入。
+ *
+ * 存在的理由：敏感值绝不能走 argv（会进 shell history 与进程列表）。login 与
+ * tenant login 都需要"两行管道输入"，此前各自实现了一份，统一到这里。
+ *
+ * @param expected 期望的行数
+ * @param label 报错里对各行内容的说明（保持调用方的既有文案可辨识）
+ */
+export declare function readStdinLines(expected: number, label: string): Promise<string[]>;
+/**
+ * 断言命令行参数中不包含密钥参数
+ * 防止通过 argv 传递密钥（会出现在 shell history 中）
+ *
+ * @param argv - 命令行参数数组
+ * @throws Error 如果发现密钥参数
+ */
+export declare function assertNoKeyArgs(argv: string[]): void;
+//# sourceMappingURL=tty-guard.d.ts.map

package/dist/credentials/tty-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tty-guard.d.ts","sourceRoot":"","sources":["../../src/credentials/tty-guard.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAkB/D;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAmBvF;AACD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAsBpD"}

package/dist/credentials/tty-guard.js

@@ -0,0 +1,79 @@
+/**
+ * TTY 守卫 - 防止 agent 执行敏感命令
+ */
+/**
+ * 断言当前运行在交互式 TTY 中
+ * @param isTTY - 可选参数，用于测试。如果不提供，则从 process.stdin.isTTY 读取
+ * @param ciEnv - 可选参数，用于测试。如果不提供，则从 process.env.CI 读取
+ * @throws Error 如果非 TTY 环境
+ */
+export function assertTty(isTTY, ciEnv) {
+    // 检查 stdin 是否是 TTY
+    const actualIsTTY = isTTY !== undefined ? isTTY : process.stdin.isTTY;
+    if (!actualIsTTY) {
+        throw new Error('Error: pxbaas login requires an interactive TTY. ' +
+            'Use --anon-key-stdin and --service-key-stdin for piped input.');
+    }
+    // 额外防护：CI 环境
+    const actualCI = ciEnv !== undefined ? ciEnv : process.env.CI;
+    if (actualCI === 'true' || actualCI === '1') {
+        throw new Error('Error: pxbaas login is disabled in CI environments. ' +
+            'Use --anon-key-stdin and --service-key-stdin for non-interactive input.');
+    }
+}
+/**
+ * 从 stdin 按行读取密钥/口令类输入。
+ *
+ * 存在的理由：敏感值绝不能走 argv（会进 shell history 与进程列表）。login 与
+ * tenant login 都需要"两行管道输入"，此前各自实现了一份，统一到这里。
+ *
+ * @param expected 期望的行数
+ * @param label 报错里对各行内容的说明（保持调用方的既有文案可辨识）
+ */
+export async function readStdinLines(expected, label) {
+    const data = await new Promise((resolvePromise, rejectPromise) => {
+        let buffer = '';
+        process.stdin.setEncoding('utf8');
+        process.stdin.on('readable', () => {
+            let chunk;
+            while ((chunk = process.stdin.read()) !== null) {
+                buffer += chunk;
+            }
+        });
+        process.stdin.on('end', () => resolvePromise(buffer));
+        process.stdin.on('error', rejectPromise);
+    });
+    const lines = data.split('\n').map((line) => line.trim());
+    if (lines.length < expected) {
+        throw new Error(`Expected ${expected} lines from stdin: ${label}`);
+    }
+    return lines;
+}
+/**
+ * 断言命令行参数中不包含密钥参数
+ * 防止通过 argv 传递密钥（会出现在 shell history 中）
+ *
+ * @param argv - 命令行参数数组
+ * @throws Error 如果发现密钥参数
+ */
+export function assertNoKeyArgs(argv) {
+    const forbiddenArgs = [
+        '--anon-key',
+        '--service-key',
+        '--token',
+        // 平台管理凭据同样不得进 argv（会留在 shell history 与进程列表里）
+        '--dashboard-user',
+        '--dashboard-password',
+        '--admin-password',
+    ];
+    for (const arg of argv) {
+        // 检查 --anon-key=value 或 --anon-key value 形式
+        for (const forbidden of forbiddenArgs) {
+            if (arg === forbidden || arg.startsWith(`${forbidden}=`)) {
+                throw new Error(`Error: passing keys via argv is forbidden (${arg}). ` +
+                    `Use ${forbidden}-stdin or environment variables.`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=tty-guard.js.map

package/dist/credentials/tty-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tty-guard.js","sourceRoot":"","sources":["../../src/credentials/tty-guard.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAAe,EAAE,KAAc;IACvD,mBAAmB;IACnB,MAAM,WAAW,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;IACtE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,mDAAmD;YACnD,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,aAAa;IACb,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9D,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,sDAAsD;YACtD,yEAAyE,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,KAAa;IAClE,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QACvE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE;YAChC,IAAI,KAAoB,CAAC;YACzB,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC;YAClB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,YAAY,QAAQ,sBAAsB,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,MAAM,aAAa,GAAG;QACpB,YAAY;QACZ,eAAe;QACf,SAAS;QACT,6CAA6C;QAC7C,kBAAkB;QAClB,sBAAsB;QACtB,kBAAkB;KACnB,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,4CAA4C;QAC5C,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;YACtC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CACb,8CAA8C,GAAG,KAAK;oBACtD,OAAO,SAAS,kCAAkC,CACnD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}