@polardbx/pxbaas 0.1.0-beta.1 → 0.1.0-beta.10

package/dist/credentials/env-file.js

@@ -1,12 +1,28 @@
 /**
  * Env-file 解析 - 从 Supabase/BaaS 惯例的 .env 文件里提取登录所需字段
  *
- * 仅覆盖单租户实例（MULTI_TENANT_MODE=false / 缺省）。多租户实例的 env 文件
- * 只带 global keys，无法直接作为租户业务凭证，需走平台 API 铸造 per-tenant key，
- * 该路径暂不支持（见 resolveLoginFromEnv 的显式报错）。
+ * 单租户实例取 SUPABASE_ANON_KEY / SUPABASE_SERVICE_ROLE_KEY；多租户实例
+ * （MULTI_TENANT_MODE=true）取 DEFAULT_TENANT_ID + TENANT_ANON_KEY /
+ * TENANT_SERVICE_ROLE_KEY —— 离线包 gen-client-env.sh 产出的多租户 client.env
+ * 同时带全局键与租户级键，而全局键访问租户资源会被 Kong 的全局凭证护栏挡掉，
+ * 所以落库的一律是租户级凭据；文件里的 GLOBAL_* 只报告存在、不导入。
  *
  * 不引入 dotenv 依赖：项目内的 env 文件均为简单 KEY=VALUE 格式。
  */
+/**
+ * 多租户 env 文件缺少租户级凭据时抛出。
+ *
+ * 单独成类是为了让调用方（profile import 的失败分支）能**判别**这种情况并给出
+ * 分流指引，而不是只对着一段自然语言做字符串匹配。
+ */
+export class TenantCredentialGapError extends Error {
+    missing;
+    constructor(message, missing) {
+        super(message);
+        this.name = 'TenantCredentialGapError';
+        this.missing = missing;
+    }
+}
 /**
  * 解析 env 文件文本为键值对。
  *
@@ -60,6 +76,13 @@ const SERVICE_VARS = [
     'SERVICE_ROLE_KEY',
     'GLOBAL_SERVICE_ROLE_KEY',
 ];
+const TENANT_ID_VARS = ['DEFAULT_TENANT_ID'];
+const TENANT_ANON_VARS = ['TENANT_ANON_KEY'];
+const TENANT_SERVICE_VARS = ['TENANT_SERVICE_ROLE_KEY'];
+const GLOBAL_KEY_VARS = ['GLOBAL_ANON_KEY', 'GLOBAL_SERVICE_ROLE_KEY'];
+/** 实例管理面凭据：默认不导入，见 EnvLoginFields.skippedAdminKeys。 */
+const ADMIN_USERNAME_VARS = ['DASHBOARD_USERNAME'];
+const ADMIN_PASSWORD_VARS = ['DASHBOARD_PASSWORD'];
 function pickWithSource(env, keys) {
     for (const k of keys) {
         const v = env[k];
@@ -70,31 +93,60 @@ function pickWithSource(env, keys) {
     return undefined;
 }
 /**
- * 从解析后的 env 中提取单租户登录字段。
+ * 从解析后的 env 中提取登录字段（单租户或多租户）。
  *
  * @param env       parseEnvText 的结果
  * @param options.intranet  为 true 时优先使用内网入口 SUPABASE_INTRANET_URL
- * @throws Error    多租户实例、或缺少必需字段时抛出可直接展示的错误
+ * @throws Error    缺少必需字段（多租户即缺租户级凭据）时抛出可直接展示的错误
  */
 export function resolveLoginFromEnv(env, options = {}) {
-    // 多租户：暂不支持（global keys 不能直接访问租户资源）
     const mtRaw = (env.MULTI_TENANT_MODE ?? '').trim().toLowerCase();
-    if (mtRaw === 'true' || mtRaw === '1' || mtRaw === 'yes') {
-        throw new Error('Multi-tenant instances are not supported by `profile import` yet ' +
-            '(MULTI_TENANT_MODE=true). The env file only carries global keys, which cannot ' +
-            'access tenant resources. Use `pxbaas login` with per-tenant anon/service keys instead.');
+    const isMultiTenant = mtRaw === 'true' || mtRaw === '1' || mtRaw === 'yes';
+    // 多租户：只有租户级凭据能访问租户资源（全局键会命中 Kong 的全局凭证护栏 403），
+    // 因此改写取值来源；全局键仅记录「存在但未导入」。
+    let anonVars = ANON_VARS;
+    let serviceVars = SERVICE_VARS;
+    let tenantId;
+    let tenantIdSource;
+    let skippedGlobalKeys;
+    if (isMultiTenant) {
+        const tenantIdHit = pickWithSource(env, TENANT_ID_VARS);
+        const tenantAnonHit = pickWithSource(env, TENANT_ANON_VARS);
+        const tenantServiceHit = pickWithSource(env, TENANT_SERVICE_VARS);
+        const missingTenant = [];
+        if (!tenantIdHit)
+            missingTenant.push(`tenant id (${TENANT_ID_VARS.join(' | ')})`);
+        if (!tenantAnonHit)
+            missingTenant.push(`tenant anon key (${TENANT_ANON_VARS.join(' | ')})`);
+        if (!tenantServiceHit) {
+            missingTenant.push(`tenant service role key (${TENANT_SERVICE_VARS.join(' | ')})`);
+        }
+        if (missingTenant.length > 0) {
+            throw new TenantCredentialGapError('Multi-tenant instances are not supported by `profile import` unless the env file ' +
+                `carries tenant-level credentials. This file is missing: ${missingTenant.join('; ')}. ` +
+                'Regenerate client.env with tenant keys, or use `pxbaas login --tenant-id <id> ' +
+                '--anon-key-stdin --service-key-stdin` with per-tenant keys instead.', missingTenant);
+        }
+        tenantId = tenantIdHit.value;
+        tenantIdSource = tenantIdHit.source;
+        anonVars = TENANT_ANON_VARS;
+        serviceVars = TENANT_SERVICE_VARS;
+        const presentGlobal = GLOBAL_KEY_VARS.filter((k) => (env[k] ?? '').trim() !== '');
+        if (presentGlobal.length > 0) {
+            skippedGlobalKeys = presentGlobal;
+        }
     }
     const endpointVars = options.intranet ? ENDPOINT_VARS_INTRANET : ENDPOINT_VARS;
     const endpointHit = pickWithSource(env, endpointVars);
-    const anonHit = pickWithSource(env, ANON_VARS);
-    const serviceHit = pickWithSource(env, SERVICE_VARS);
+    const anonHit = pickWithSource(env, anonVars);
+    const serviceHit = pickWithSource(env, serviceVars);
     const missing = [];
     if (!endpointHit)
         missing.push(`endpoint (${endpointVars.join(' | ')})`);
     if (!anonHit)
-        missing.push(`anon key (${ANON_VARS.join(' | ')})`);
+        missing.push(`anon key (${anonVars.join(' | ')})`);
     if (!serviceHit)
-        missing.push(`service role key (${SERVICE_VARS.join(' | ')})`);
+        missing.push(`service role key (${serviceVars.join(' | ')})`);
     if (missing.length > 0) {
         throw new Error(`Env file is missing required variable(s): ${missing.join('; ')}`);
     }
@@ -102,17 +154,40 @@ export function resolveLoginFromEnv(env, options = {}) {
     if (!/^https?:\/\//.test(endpoint)) {
         throw new Error(`Endpoint from ${endpointHit.source} must start with http:// or https:// (got: ${endpoint})`);
     }
+    // 管理凭据默认不外吸：只报告"存在"，由调用方决定是否显式导入（--with-admin）。
+    const presentAdmin = [...ADMIN_USERNAME_VARS, ...ADMIN_PASSWORD_VARS].filter((k) => (env[k] ?? '').trim() !== '');
     return {
         endpoint,
         anonKey: anonHit.value,
         serviceRoleKey: serviceHit.value,
-        tenantId: undefined,
-        mode: 'single-tenant',
+        tenantId,
+        mode: isMultiTenant ? 'multi-tenant' : 'single-tenant',
         sources: {
             endpoint: endpointHit.source,
             anonKey: anonHit.source,
             serviceRoleKey: serviceHit.source,
+            tenantId: tenantIdSource,
         },
+        skippedGlobalKeys,
+        skippedAdminKeys: presentAdmin.length > 0 ? presentAdmin : undefined,
+    };
+}
+/**
+ * 从 env 中提取实例管理凭据（dashboard Basic Auth）。
+ *
+ * 返回 undefined 表示文件里没有成对的管理凭据 —— 调用方**不应**因此报错：
+ * 它们只在管理员显式 `--with-admin` 或临时能力探测时才被读取。
+ * 只出现一半（有 user 无 password）视为不可用，避免半套凭据落库。
+ */
+export function resolveAdminFromEnv(env) {
+    const username = pickWithSource(env, ADMIN_USERNAME_VARS);
+    const password = pickWithSource(env, ADMIN_PASSWORD_VARS);
+    if (!username || !password)
+        return undefined;
+    return {
+        username: username.value,
+        password: password.value,
+        sources: { username: username.source, password: password.source },
     };
 }
 //# sourceMappingURL=env-file.js.map

package/dist/credentials/env-file.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-file.js","sourceRoot":"","sources":["../../src/credentials/env-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAc,EAAE,CAAC;IAE1B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,SAAS;QACX,CAAC;QAED,qBAAqB;QACrB,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACd,SAAS,CAAC,oBAAoB;QAChC,CAAC;QAED,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,SAAS;QACX,CAAC;QAED,IAAI,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE/C,gCAAgC;QAChC,MAAM,MAAM,GACV,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;YACnE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACtE,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,gCAAgC;YAChC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;gBACtB,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yCAAyC;AACzC,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAiBD,MAAM,aAAa,GAAG,CAAC,cAAc,EAAE,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;AACvF,MAAM,sBAAsB,GAAG,CAAC,uBAAuB,EAAE,cAAc,EAAE,qBAAqB,CAAC,CAAC;AAChG,MAAM,SAAS,GAAG,CAAC,mBAAmB,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;AACvE,MAAM,YAAY,GAAG;IACnB,2BAA2B;IAC3B,kBAAkB;IAClB,yBAAyB;CAC1B,CAAC;AAEF,SAAS,cAAc,CACrB,GAAc,EACd,IAAc;IAEd,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAc,EACd,UAAkC,EAAE;IAEpC,mCAAmC;IACnC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjE,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,gFAAgF;YAChF,wFAAwF,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,aAAa,CAAC;IAC/E,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAErD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,qBAAqB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,6CAA6C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,WAAY,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,iBAAiB,WAAY,CAAC,MAAM,8CAA8C,QAAQ,GAAG,CAC9F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ;QACR,OAAO,EAAE,OAAQ,CAAC,KAAK;QACvB,cAAc,EAAE,UAAW,CAAC,KAAK;QACjC,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE;YACP,QAAQ,EAAE,WAAY,CAAC,MAAM;YAC7B,OAAO,EAAE,OAAQ,CAAC,MAAM;YACxB,cAAc,EAAE,UAAW,CAAC,MAAM;SACnC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"env-file.js","sourceRoot":"","sources":["../../src/credentials/env-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH;;;;;GAKG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,OAAO,CAAW;IAE3B,YAAY,OAAe,EAAE,OAAiB;QAC5C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAc,EAAE,CAAC;IAE1B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,SAAS;QACX,CAAC;QAED,qBAAqB;QACrB,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACd,SAAS,CAAC,oBAAoB;QAChC,CAAC;QAED,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,SAAS;QACX,CAAC;QAED,IAAI,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE/C,gCAAgC;QAChC,MAAM,MAAM,GACV,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;YACnE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACtE,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,gCAAgC;YAChC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;gBACtB,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yCAAyC;AACzC,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AA6BD,MAAM,aAAa,GAAG,CAAC,cAAc,EAAE,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;AACvF,MAAM,sBAAsB,GAAG,CAAC,uBAAuB,EAAE,cAAc,EAAE,qBAAqB,CAAC,CAAC;AAChG,MAAM,SAAS,GAAG,CAAC,mBAAmB,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;AACvE,MAAM,YAAY,GAAG;IACnB,2BAA2B;IAC3B,kBAAkB;IAClB,yBAAyB;CAC1B,CAAC;AACF,MAAM,cAAc,GAAG,CAAC,mBAAmB,CAAC,CAAC;AAC7C,MAAM,gBAAgB,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAC7C,MAAM,mBAAmB,GAAG,CAAC,yBAAyB,CAAC,CAAC;AACxD,MAAM,eAAe,GAAG,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;AACvE,uDAAuD;AACvD,MAAM,mBAAmB,GAAG,CAAC,oBAAoB,CAAC,CAAC;AACnD,MAAM,mBAAmB,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAEnD,SAAS,cAAc,CACrB,GAAc,EACd,IAAc;IAEd,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAc,EACd,UAAkC,EAAE;IAEpC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjE,MAAM,aAAa,GAAG,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,KAAK,CAAC;IAE3E,+CAA+C;IAC/C,2BAA2B;IAC3B,IAAI,QAAQ,GAAG,SAAS,CAAC;IACzB,IAAI,WAAW,GAAG,YAAY,CAAC;IAC/B,IAAI,QAA4B,CAAC;IACjC,IAAI,cAAkC,CAAC;IACvC,IAAI,iBAAuC,CAAC;IAE5C,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACxD,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAC5D,MAAM,gBAAgB,GAAG,cAAc,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAElE,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,IAAI,CAAC,WAAW;YAAE,aAAa,CAAC,IAAI,CAAC,cAAc,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClF,IAAI,CAAC,aAAa;YAAE,aAAa,CAAC,IAAI,CAAC,oBAAoB,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5F,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,4BAA4B,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,wBAAwB,CAChC,mFAAmF;gBACjF,2DAA2D,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBACvF,gFAAgF;gBAChF,qEAAqE,EACvE,aAAa,CACd,CAAC;QACJ,CAAC;QAED,QAAQ,GAAG,WAAY,CAAC,KAAK,CAAC;QAC9B,cAAc,GAAG,WAAY,CAAC,MAAM,CAAC;QACrC,QAAQ,GAAG,gBAAgB,CAAC;QAC5B,WAAW,GAAG,mBAAmB,CAAC;QAClC,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,iBAAiB,GAAG,aAAa,CAAC;QACpC,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,aAAa,CAAC;IAC/E,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAEpD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,qBAAqB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,6CAA6C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,WAAY,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,iBAAiB,WAAY,CAAC,MAAM,8CAA8C,QAAQ,GAAG,CAC9F,CAAC;IACJ,CAAC;IAED,gDAAgD;IAChD,MAAM,YAAY,GAAG,CAAC,GAAG,mBAAmB,EAAE,GAAG,mBAAmB,CAAC,CAAC,MAAM,CAC1E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CACpC,CAAC;IAEF,OAAO;QACL,QAAQ;QACR,OAAO,EAAE,OAAQ,CAAC,KAAK;QACvB,cAAc,EAAE,UAAW,CAAC,KAAK;QACjC,QAAQ;QACR,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe;QACtD,OAAO,EAAE;YACP,QAAQ,EAAE,WAAY,CAAC,MAAM;YAC7B,OAAO,EAAE,OAAQ,CAAC,MAAM;YACxB,cAAc,EAAE,UAAW,CAAC,MAAM;YAClC,QAAQ,EAAE,cAAc;SACzB;QACD,iBAAiB;QACjB,gBAAgB,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;KACrE,CAAC;AACJ,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAc;IAChD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,KAAK;QACxB,QAAQ,EAAE,QAAQ,CAAC,KAAK;QACxB,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE;KAClE,CAAC;AACJ,CAAC"}

package/dist/credentials/index.d.ts

@@ -7,5 +7,7 @@ export * from './jwt-introspect.js';
 export * from './masker.js';
 export * from './tty-guard.js';
 export * from './tenant-guard.js';
+export * from './env-file.js';
+export * from './commit.js';
 export * from './formatter.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/credentials/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}

package/dist/credentials/index.js

@@ -7,5 +7,7 @@ export * from './jwt-introspect.js';
 export * from './masker.js';
 export * from './tty-guard.js';
 export * from './tenant-guard.js';
+export * from './env-file.js';
+export * from './commit.js';
 export * from './formatter.js';
 //# sourceMappingURL=index.js.map

package/dist/credentials/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}

package/dist/credentials/jwt-introspect.d.ts

@@ -14,6 +14,13 @@ export interface IntrospectedJwt {
     payload: JwtPayload;
     isExpired: boolean;
     expiresIn: number;
+    /**
+     * 裸指纹：sha256 前8 + 后4，形如 `6ee48f23...a477`，**不带** `sha256:` 前缀。
+     *
+     * 契约（分层，勿在其中一层"顺手"补前缀，否则展示层会变成 `sha256:sha256:`）：
+     * 内层解析只产出裸值；展示层 `computeFingerprint()`（./masker.ts，whoami /
+     * instance / provision 用它）统一加 `sha256:` 前缀。
+     */
     fingerprint: string;
 }
 /**

package/dist/credentials/jwt-introspect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-introspect.d.ts","sourceRoot":"","sources":["../../src/credentials/jwt-introspect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,GAAG,cAAc,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAanD;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAkB3E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAatD"}
+{"version":3,"file":"jwt-introspect.d.ts","sourceRoot":"","sources":["../../src/credentials/jwt-introspect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,GAAG,cAAc,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAanD;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAkB3E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAatD"}

package/dist/credentials/jwt-introspect.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-introspect.js","sourceRoot":"","sources":["../../src/credentials/jwt-introspect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAkBH;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAe,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa;IAC/C,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAEnD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IACpC,MAAM,SAAS,GAAG,SAAS,IAAI,CAAC,CAAC;IAEjC,0BAA0B;IAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE9D,OAAO;QACL,OAAO;QACP,SAAS;QACT,SAAS;QACT,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,GAAG,GAAG,EAAE;YAAE,OAAO,WAAW,GAAG,OAAO,CAAC;QAC3C,IAAI,GAAG,GAAG,IAAI;YAAE,OAAO,WAAW,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;QAC9D,IAAI,GAAG,GAAG,KAAK;YAAE,OAAO,WAAW,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC;QACjE,OAAO,WAAW,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC;IACnD,CAAC;IAED,IAAI,SAAS,GAAG,EAAE;QAAE,OAAO,cAAc,SAAS,GAAG,CAAC;IACtD,IAAI,SAAS,GAAG,IAAI;QAAE,OAAO,cAAc,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC,GAAG,CAAC;IACzE,IAAI,SAAS,GAAG,KAAK;QAAE,OAAO,cAAc,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC;IAC5E,OAAO,cAAc,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;AACxD,CAAC"}
+{"version":3,"file":"jwt-introspect.js","sourceRoot":"","sources":["../../src/credentials/jwt-introspect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAyBH;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAe,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa;IAC/C,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAEnD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IACpC,MAAM,SAAS,GAAG,SAAS,IAAI,CAAC,CAAC;IAEjC,0BAA0B;IAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE9D,OAAO;QACL,OAAO;QACP,SAAS;QACT,SAAS;QACT,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,GAAG,GAAG,EAAE;YAAE,OAAO,WAAW,GAAG,OAAO,CAAC;QAC3C,IAAI,GAAG,GAAG,IAAI;YAAE,OAAO,WAAW,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;QAC9D,IAAI,GAAG,GAAG,KAAK;YAAE,OAAO,WAAW,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC;QACjE,OAAO,WAAW,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC;IACnD,CAAC;IAED,IAAI,SAAS,GAAG,EAAE;QAAE,OAAO,cAAc,SAAS,GAAG,CAAC;IACtD,IAAI,SAAS,GAAG,IAAI;QAAE,OAAO,cAAc,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC,GAAG,CAAC;IACzE,IAAI,SAAS,GAAG,KAAK;QAAE,OAAO,cAAc,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC;IAC5E,OAAO,cAAc,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;AACxD,CAAC"}

package/dist/credentials/masker.d.ts

@@ -4,6 +4,9 @@
 /**
  * 计算密钥指纹：sha256 前8字符 + 后4字符
  * 格式：sha256:abcd1234...ef56
+ *
+ * 这是**展示层**的唯一加前缀处（whoami / instance / provision 直接输出它）。
+ * `introspectJwt().fingerprint` 返回的是同一指纹的裸值，前缀只在这里加一次。
  */
 export declare function computeFingerprint(key: string): string;
 /**

package/dist/credentials/masker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"masker.d.ts","sourceRoot":"","sources":["../../src/credentials/masker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGtD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQ9D;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM/C"}
+{"version":3,"file":"masker.d.ts","sourceRoot":"","sources":["../../src/credentials/masker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGtD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQ9D;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM/C"}

package/dist/credentials/masker.js

@@ -5,6 +5,9 @@ import { createHash } from 'node:crypto';
 /**
  * 计算密钥指纹：sha256 前8字符 + 后4字符
  * 格式：sha256:abcd1234...ef56
+ *
+ * 这是**展示层**的唯一加前缀处（whoami / instance / provision 直接输出它）。
+ * `introspectJwt().fingerprint` 返回的是同一指纹的裸值，前缀只在这里加一次。
  */
 export function computeFingerprint(key) {
     const hash = createHash('sha256').update(key).digest('hex');

package/dist/credentials/masker.js.map

@@ -1 +1 @@
-{"version":3,"file":"masker.js","sourceRoot":"","sources":["../../src/credentials/masker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,UAAU,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,UAAU,WAAW,EAAE,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"masker.js","sourceRoot":"","sources":["../../src/credentials/masker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,UAAU,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,UAAU,WAAW,EAAE,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/credentials/profile.d.ts

@@ -17,6 +17,11 @@ export interface BaasProfile {
     zeroInstanceId?: string;
     /** Zero instance expiry (ISO 8601), only when source === 'zero'. */
     expiresAt?: string;
+    /**
+     * 该 profile 是否绑定了平台管理凭据（dashboard Basic Auth）。仅是标记：口令本身
+     * 存在凭据存储的独立账目里，数据面命令读不到它。
+     */
+    adminCapable?: boolean;
     createdAt: string;
     updatedAt: string;
 }
@@ -29,6 +34,13 @@ interface ProfilesStore {
 export declare function setCliProfileOverrideGlobal(profileName: string | undefined): void;
 /** 读取进程级 profile 覆盖（供测试/诊断）。 */
 export declare function getCliProfileOverrideGlobal(): string | undefined;
+/**
+ * 判断被调用的命令是否会创建/覆盖 `--profile` 指定的 profile。
+ *
+ * @param commandPath 完整命令路径（如 `['profile','import']`），不含程序名。
+ *                    只比叶子名会让将来任何同名子命令误获放行，故必须传完整路径。
+ */
+export declare function isProfileCreatingCommand(commandPath: readonly string[]): boolean;
 export declare class ProfileManager {
     private homeDir;
     private cliProfileOverride?;

package/dist/credentials/profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../src/credentials/profile.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,cAAc,CAAC;AAE3D,yGAAyG;AACzG,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,WAAW,CAAC;IAClB,uEAAuE;IACvE,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,aAAa;IACrB,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACvC;AAYD,uDAAuD;AACvD,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAEjF;AAED,gCAAgC;AAChC,wBAAgB,2BAA2B,IAAI,MAAM,GAAG,SAAS,CAEhE;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,kBAAkB,CAAC,CAAS;IACpC,OAAO,CAAC,KAAK,CAA8B;gBAE/B,OAAO,CAAC,EAAE,MAAM;IAI5B;;;OAGG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAK5D,oCAAoC;IACpC,OAAO,KAAK,2BAA2B,GAEtC;IAED;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAI3B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC;IA2BpC;;OAEG;YACW,IAAI;IAYlB;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAsCtD;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAK5C;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAK3D;;OAEG;IACG,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBrD;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW7C;;OAEG;IACG,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAiBpD"}
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../src/credentials/profile.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,cAAc,CAAC;AAE3D,yGAAyG;AACzG,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,WAAW,CAAC;IAClB,uEAAuE;IACvE,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,aAAa;IACrB,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACvC;AAYD,uDAAuD;AACvD,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAEjF;AAED,gCAAgC;AAChC,wBAAgB,2BAA2B,IAAI,MAAM,GAAG,SAAS,CAEhE;AAgBD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAMhF;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,kBAAkB,CAAC,CAAS;IACpC,OAAO,CAAC,KAAK,CAA8B;gBAE/B,OAAO,CAAC,EAAE,MAAM;IAI5B;;;OAGG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAK5D,oCAAoC;IACpC,OAAO,KAAK,2BAA2B,GAEtC;IAED;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAI3B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC;IA2BpC;;OAEG;YACW,IAAI;IAYlB;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAsCtD;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAK5C;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAK3D;;OAEG;IACG,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBrD;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW7C;;OAEG;IACG,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAiBpD"}

package/dist/credentials/profile.js

@@ -22,6 +22,29 @@ export function setCliProfileOverrideGlobal(profileName) {
 export function getCliProfileOverrideGlobal() {
     return processCliProfileOverride;
 }
+/**
+ * 会「写入 --profile 所指 profile」的命令，按完整命令路径匹配。
+ *
+ * 对这些命令来说，profile 名不存在恰恰是前提（它们正要创建它），所以 main.ts 的
+ * preAction 钩子不能对其做存在性硬校验；其余命令一律保持响亮失败，否则就退回了
+ * `--profile` 曾被静默忽略、写操作跨实例误落的旧缺陷。
+ */
+const PROFILE_CREATING_COMMANDS = [
+    ['login'],
+    ['profile', 'import'],
+    // `tenant login` 可以把管理凭据绑定到一个尚不存在的 profile（管理员常在新机器上先做这一步）
+    ['tenant', 'login'],
+];
+/**
+ * 判断被调用的命令是否会创建/覆盖 `--profile` 指定的 profile。
+ *
+ * @param commandPath 完整命令路径（如 `['profile','import']`），不含程序名。
+ *                    只比叶子名会让将来任何同名子命令误获放行，故必须传完整路径。
+ */
+export function isProfileCreatingCommand(commandPath) {
+    return PROFILE_CREATING_COMMANDS.some((candidate) => candidate.length === commandPath.length &&
+        candidate.every((segment, index) => segment === commandPath[index]));
+}
 export class ProfileManager {
     homeDir;
     cliProfileOverride; // --profile flag

package/dist/credentials/profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/credentials/profile.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA8BjC;;;;;GAKG;AACH,6DAA6D;AAC7D,yCAAyC;AACzC,IAAI,yBAA6C,CAAC;AAElD,uDAAuD;AACvD,MAAM,UAAU,2BAA2B,CAAC,WAA+B;IACzE,yBAAyB,GAAG,WAAW,CAAC;AAC1C,CAAC;AAED,gCAAgC;AAChC,MAAM,UAAU,2BAA2B;IACzC,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,MAAM,OAAO,cAAc;IACjB,OAAO,CAAS;IAChB,kBAAkB,CAAU,CAAC,iBAAiB;IAC9C,KAAK,GAAyB,IAAI,CAAC;IAE3C,YAAY,OAAgB;QAC1B,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH,qBAAqB,CAAC,WAA+B;QACnD,IAAI,CAAC,kBAAkB,GAAG,WAAW,CAAC;QACtC,yBAAyB,GAAG,WAAW,CAAC;IAC1C,CAAC;IAED,oCAAoC;IACpC,IAAY,2BAA2B;QACrC,OAAO,IAAI,CAAC,kBAAkB,IAAI,yBAAyB,CAAC;IAC9D,CAAC;IAED;;OAEG;IACK,mBAAmB;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAE5C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAkB,CAAC;YAElD,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,IAAI,CAAC,KAAoB;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAE/C,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB;QACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,wBAAwB;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,CAAC;QACrD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,YAAY,WAAW,mCAAmC,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,uBAAuB;QACvB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC5C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,qCAAqC,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,mBAAmB;QACnB,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,6BAA6B;gBAC7B,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,OAAoB;QACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,KAAK;YACL,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,KAAK;YACL,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;YACxB,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,aAAa,CAAC,CAAC;QACjD,CAAC;QAED,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;QACrB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE5B,8BAA8B;QAC9B,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3B,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC;QACrB,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/credentials/profile.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAmCjC;;;;;GAKG;AACH,6DAA6D;AAC7D,yCAAyC;AACzC,IAAI,yBAA6C,CAAC;AAElD,uDAAuD;AACvD,MAAM,UAAU,2BAA2B,CAAC,WAA+B;IACzE,yBAAyB,GAAG,WAAW,CAAC;AAC1C,CAAC;AAED,gCAAgC;AAChC,MAAM,UAAU,2BAA2B;IACzC,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,yBAAyB,GAAmC;IAChE,CAAC,OAAO,CAAC;IACT,CAAC,SAAS,EAAE,QAAQ,CAAC;IACrB,2DAA2D;IAC3D,CAAC,QAAQ,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,WAA8B;IACrE,OAAO,yBAAyB,CAAC,IAAI,CACnC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACvC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,cAAc;IACjB,OAAO,CAAS;IAChB,kBAAkB,CAAU,CAAC,iBAAiB;IAC9C,KAAK,GAAyB,IAAI,CAAC;IAE3C,YAAY,OAAgB;QAC1B,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH,qBAAqB,CAAC,WAA+B;QACnD,IAAI,CAAC,kBAAkB,GAAG,WAAW,CAAC;QACtC,yBAAyB,GAAG,WAAW,CAAC;IAC1C,CAAC;IAED,oCAAoC;IACpC,IAAY,2BAA2B;QACrC,OAAO,IAAI,CAAC,kBAAkB,IAAI,yBAAyB,CAAC;IAC9D,CAAC;IAED;;OAEG;IACK,mBAAmB;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAE5C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAkB,CAAC;YAElD,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,IAAI,CAAC,KAAoB;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAE/C,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB;QACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,wBAAwB;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,CAAC;QACrD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,YAAY,WAAW,mCAAmC,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,uBAAuB;QACvB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC5C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,qCAAqC,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,mBAAmB;QACnB,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,6BAA6B;gBAC7B,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,OAAoB;QACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,KAAK;YACL,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,KAAK;YACL,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;YACxB,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,aAAa,CAAC,CAAC;QACjD,CAAC;QAED,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;QACrB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE5B,8BAA8B;QAC9B,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3B,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC;QACrB,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/credentials/tty-guard.d.ts

@@ -8,6 +8,16 @@
  * @throws Error 如果非 TTY 环境
  */
 export declare function assertTty(isTTY?: boolean, ciEnv?: string): void;
+/**
+ * 从 stdin 按行读取密钥/口令类输入。
+ *
+ * 存在的理由：敏感值绝不能走 argv（会进 shell history 与进程列表）。login 与
+ * tenant login 都需要"两行管道输入"，此前各自实现了一份，统一到这里。
+ *
+ * @param expected 期望的行数
+ * @param label 报错里对各行内容的说明（保持调用方的既有文案可辨识）
+ */
+export declare function readStdinLines(expected: number, label: string): Promise<string[]>;
 /**
  * 断言命令行参数中不包含密钥参数
  * 防止通过 argv 传递密钥（会出现在 shell history 中）

package/dist/credentials/tty-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tty-guard.d.ts","sourceRoot":"","sources":["../../src/credentials/tty-guard.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAkB/D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAkBpD"}
+{"version":3,"file":"tty-guard.d.ts","sourceRoot":"","sources":["../../src/credentials/tty-guard.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAkB/D;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAmBvF;AACD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAsBpD"}

package/dist/credentials/tty-guard.js

@@ -21,6 +21,34 @@ export function assertTty(isTTY, ciEnv) {
             'Use --anon-key-stdin and --service-key-stdin for non-interactive input.');
     }
 }
+/**
+ * 从 stdin 按行读取密钥/口令类输入。
+ *
+ * 存在的理由：敏感值绝不能走 argv（会进 shell history 与进程列表）。login 与
+ * tenant login 都需要"两行管道输入"，此前各自实现了一份，统一到这里。
+ *
+ * @param expected 期望的行数
+ * @param label 报错里对各行内容的说明（保持调用方的既有文案可辨识）
+ */
+export async function readStdinLines(expected, label) {
+    const data = await new Promise((resolvePromise, rejectPromise) => {
+        let buffer = '';
+        process.stdin.setEncoding('utf8');
+        process.stdin.on('readable', () => {
+            let chunk;
+            while ((chunk = process.stdin.read()) !== null) {
+                buffer += chunk;
+            }
+        });
+        process.stdin.on('end', () => resolvePromise(buffer));
+        process.stdin.on('error', rejectPromise);
+    });
+    const lines = data.split('\n').map((line) => line.trim());
+    if (lines.length < expected) {
+        throw new Error(`Expected ${expected} lines from stdin: ${label}`);
+    }
+    return lines;
+}
 /**
  * 断言命令行参数中不包含密钥参数
  * 防止通过 argv 传递密钥（会出现在 shell history 中）
@@ -33,6 +61,10 @@ export function assertNoKeyArgs(argv) {
         '--anon-key',
         '--service-key',
         '--token',
+        // 平台管理凭据同样不得进 argv（会留在 shell history 与进程列表里）
+        '--dashboard-user',
+        '--dashboard-password',
+        '--admin-password',
     ];
     for (const arg of argv) {
         // 检查 --anon-key=value 或 --anon-key value 形式

package/dist/credentials/tty-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"tty-guard.js","sourceRoot":"","sources":["../../src/credentials/tty-guard.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAAe,EAAE,KAAc;IACvD,mBAAmB;IACnB,MAAM,WAAW,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;IACtE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,mDAAmD;YACnD,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,aAAa;IACb,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9D,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,sDAAsD;YACtD,yEAAyE,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,MAAM,aAAa,GAAG;QACpB,YAAY;QACZ,eAAe;QACf,SAAS;KACV,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,4CAA4C;QAC5C,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;YACtC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CACb,8CAA8C,GAAG,KAAK;oBACtD,OAAO,SAAS,kCAAkC,CACnD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"tty-guard.js","sourceRoot":"","sources":["../../src/credentials/tty-guard.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAAe,EAAE,KAAc;IACvD,mBAAmB;IACnB,MAAM,WAAW,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;IACtE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,mDAAmD;YACnD,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,aAAa;IACb,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9D,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,sDAAsD;YACtD,yEAAyE,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,KAAa;IAClE,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QACvE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE;YAChC,IAAI,KAAoB,CAAC;YACzB,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC;YAClB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,YAAY,QAAQ,sBAAsB,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,MAAM,aAAa,GAAG;QACpB,YAAY;QACZ,eAAe;QACf,SAAS;QACT,6CAA6C;QAC7C,kBAAkB;QAClB,sBAAsB;QACtB,kBAAkB;KACnB,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,4CAA4C;QAC5C,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;YACtC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CACb,8CAA8C,GAAG,KAAK;oBACtD,OAAO,SAAS,kCAAkC,CACnD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/db/apply-schema.d.ts

@@ -1,17 +1,31 @@
 /**
- * Single-tenant schema apply engine shared by `pxbaas db push <file>` and
- * `pxbaas app db-init <name>`.
+ * Schema apply engine shared by `pxbaas db push <file>` and `pxbaas app db-init <name>`.
  *
- * Safety contract (agreed design):
- *   - The plan (every statement) is shown BEFORE anything runs.
+ * Two execution identities (chosen by profile.mode via {@link getSchemaSink}):
+ *   - single-tenant → MetaDriver `/pg/query` with the global service_role key
+ *     (that key IS the platform admin, so it can also write the central RLS
+ *     registry `supabase._mysqlrest_rls_*` directly).
+ *   - multi-tenant  → TenantDdlDriver `/api/tenant-ddl/*` with the per-tenant
+ *     service_role key. DDL/DML runs on the tenant's OWN database; RLS goes
+ *     through the structured endpoints (the tenant account has NO grant on the
+ *     shared `supabase` database, so a raw central INSERT would be denied).
+ *
+ * Safety contract (agreed design, unchanged):
+ *   - The plan (every step) is shown BEFORE anything runs.
  *   - Execution requires explicit authorization: an interactive confirm, or
  *     `--yes` for non-interactive use. `--dry-run` only previews.
- *   - Statements run sequentially and STOP ON THE FIRST ERROR.
- *   - No automatic rollback — already-applied statements stay applied.
- *   - Multi-tenant profiles are rejected: tenant DDL is out of scope (it needs
- *     the global service_role key via POST /pg/query with tenant_<id>.<table>).
+ *   - Steps run sequentially and STOP ON THE FIRST ERROR.
+ *   - No automatic rollback — already-applied steps stay applied.
+ *
+ * RLS source (see plan §5, decision R-C "hybrid"):
+ *   - a declarative `db/rls.json` is preferred when present;
+ *   - otherwise the `INSERT ... supabase._mysqlrest_rls_*` statements embedded in
+ *     schema.sql are parsed (multi-tenant) or run verbatim (single-tenant).
  */
-import { MetaDriver } from "@polardbx/pxbaas-client";
+import { MetaDriver, type RlsTableInput, type RlsPolicyInput } from "@polardbx/pxbaas-client";
+import type { ProfileMode } from "../credentials/profile.js";
+import { type RlsJson } from "./sql-file.js";
+export type { RlsJson };
 export interface ApplyOptions {
     /** Target schema the `__SCHEMA__` placeholder resolves to (single-tenant: public). */
     schema: string;
@@ -22,9 +36,12 @@ export interface ApplyOptions {
     /** Emit a structured result instead of human text (caller prints JSON). */
     json: boolean;
 }
+export type StepKind = "sql" | "rls-table" | "rls-policy";
 export interface StatementResult {
     index: number;
+    /** For sql steps this is the SQL; for RLS steps a human-readable description. */
     sql: string;
+    kind?: StepKind;
     status: "pending" | "ok" | "failed" | "skipped";
     error?: string;
 }
@@ -37,12 +54,56 @@ export interface ApplyResult {
     dryRun: boolean;
     authorized: boolean;
     statements: StatementResult[];
+    /** Present when produced by {@link applySchema}. */
+    mode?: ProfileMode;
+    rls?: {
+        tables: number;
+        policies: number;
+        source: "rls.json" | "schema.sql" | "none";
+    };
 }
 /** A minimal SQL executor so this module stays unit-testable without MetaDriver. */
 export type SqlExecutor = (sql: string) => Promise<unknown>;
+/** Per-call context the sink needs to render/apply structured RLS. */
+export interface RlsApplyContext {
+    /** Single-tenant target schema; ignored by the multi-tenant sink (server-bound). */
+    schema: string;
+}
+/**
+ * Execution strategy for a resolved profile. Encapsulates the single- vs
+ * multi-tenant channel difference so {@link applySchema} stays mode-agnostic.
+ */
+export interface SchemaSink {
+    mode: ProfileMode;
+    profileName: string;
+    /** Run one DDL/DML statement on the appropriate channel. */
+    runStatement(sql: string): Promise<unknown>;
+    /** Apply one RLS table toggle. */
+    applyRlsTable(input: RlsTableInput, ctx: RlsApplyContext): Promise<unknown>;
+    /** Apply one RLS policy. */
+    applyRlsPolicy(input: RlsPolicyInput, ctx: RlsApplyContext): Promise<unknown>;
+    /** Human-readable label for the plan preview. */
+    renderRlsTable(input: RlsTableInput, ctx: RlsApplyContext): string;
+    renderRlsPolicy(input: RlsPolicyInput, ctx: RlsApplyContext): string;
+    /** Drop one of the app's tables (used by `app destroy --purge-db`). */
+    dropTable(table: string, ctx: RlsApplyContext): Promise<unknown>;
+    /**
+     * Remove the RLS registry rows for one table. `toggleRemoved` reports whether
+     * the central `_mysqlrest_rls_tables` enable/force row was deleted. In
+     * multi-tenant this uses `DELETE /api/tenant-ddl/rls/tables`; on instances that
+     * predate that endpoint the call fails and we degrade gracefully (the benign
+     * toggle row is left and self-heals on the next db-init upsert).
+     */
+    purgeRlsForTable(table: string, ctx: RlsApplyContext): Promise<{
+        policiesDeleted: number;
+        toggleRemoved: boolean;
+    }>;
+}
 /**
  * Resolve the active profile into a single-tenant MetaDriver.
  * @throws when there is no profile, no credentials, or the profile is multi-tenant.
+ * @deprecated prefer {@link getSchemaSink}, which supports both modes. Kept for
+ * single-tenant callers and existing tests.
  */
 export declare function getSingleTenantMetaDriver(role?: "anon" | "service_role"): Promise<{
     driver: MetaDriver;
@@ -50,8 +111,34 @@ export declare function getSingleTenantMetaDriver(role?: "anon" | "service_role"
     profileName: string;
 }>;
 /**
- * Show the plan, obtain authorization, then apply statements sequentially with
- * stop-on-first-error semantics. Never rolls back.
+ * Resolve the active profile into a mode-appropriate {@link SchemaSink}.
+ * Unlike {@link getSingleTenantMetaDriver}, a multi-tenant profile is fully
+ * supported: DDL/RLS route through the tenant self-service endpoints using the
+ * per-tenant service_role key (Kong injects the trusted X-Tenant-Id).
+ */
+export declare function getSchemaSink(role?: "anon" | "service_role"): Promise<SchemaSink>;
+/**
+ * Apply a raw SQL script through an injected executor (single-tenant legacy
+ * path). Schema substitution uses the single-tenant rule; RLS statements are
+ * NOT diverted (they run verbatim through the executor). For mode-aware apply
+ * with RLS diversion use {@link applySchema}.
  */
 export declare function applySqlStatements(rawSql: string, source: string, opts: ApplyOptions, executor: SqlExecutor): Promise<ApplyResult>;
+export interface ApplySchemaParams extends ApplyOptions {
+    rawSql: string;
+    source: string;
+    /** Parsed `db/rls.json` (preferred RLS source); null/absent → fall back to schema.sql. */
+    rls?: RlsJson | null;
+}
+/**
+ * Mode-aware apply used by `db push` and `app db-init`.
+ *
+ * - Splits the script, then (multi-tenant OR when rls.json is present) diverts
+ *   the embedded central-registry RLS INSERTs out of the raw-SQL stream.
+ * - RLS source: `db/rls.json` when present; else parsed from schema.sql
+ *   (multi-tenant) or left embedded (single-tenant legacy).
+ * - `__SCHEMA__`: single-tenant → --schema; multi-tenant → de-qualified.
+ * - Order: DDL/seed first (tables must exist), then RLS tables, then policies.
+ */
+export declare function applySchema(params: ApplySchemaParams, sink: SchemaSink): Promise<ApplyResult>;
 //# sourceMappingURL=apply-schema.d.ts.map

package/dist/db/apply-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apply-schema.d.ts","sourceRoot":"","sources":["../../src/db/apply-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAUrD,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,+DAA+D;IAC/D,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,CAAC;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAED,oFAAoF;AACpF,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE5D;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,GAAE,MAAM,GAAG,cAA+B,GAC7C,OAAO,CAAC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B/E;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,WAAW,CAAC,CAyItB"}
+{"version":3,"file":"apply-schema.d.ts","sourceRoot":"","sources":["../../src/db/apply-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EACL,UAAU,EAEV,KAAK,aAAa,EAClB,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AAQjC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAWL,KAAK,OAAO,EACb,MAAM,eAAe,CAAC;AAEvB,YAAY,EAAE,OAAO,EAAE,CAAC;AAExB,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,+DAA+D;IAC/D,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,WAAW,GAAG,YAAY,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,CAAC;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,oDAAoD;IACpD,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,MAAM,CAAA;KAAE,CAAC;CACxF;AAED,oFAAoF;AACpF,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE5D,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,kCAAkC;IAClC,aAAa,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,4BAA4B;IAC5B,cAAc,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9E,iDAAiD;IACjD,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,eAAe,GAAG,MAAM,CAAC;IACnE,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,eAAe,GAAG,MAAM,CAAC;IACrE,uEAAuE;IACvE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE;;;;;;OAMG;IACH,gBAAgB,CACd,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACjE;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,GAAE,MAAM,GAAG,cAA+B,GAC7C,OAAO,CAAC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B/E;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,IAAI,GAAE,MAAM,GAAG,cAA+B,GAC7C,OAAO,CAAC,UAAU,CAAC,CAoGrB;AA8ID;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,WAAW,CAAC,CAWtB;AAED,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,0FAA0F;IAC1F,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CA0DnG"}