@polardbx/pxbaas 0.1.0-beta.1 → 0.1.0-beta.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (180) hide show
  1. package/README.md +224 -0
  2. package/dist/app/local-index.d.ts +70 -0
  3. package/dist/app/local-index.d.ts.map +1 -0
  4. package/dist/app/local-index.js +140 -0
  5. package/dist/app/local-index.js.map +1 -0
  6. package/dist/app/preflight.d.ts +24 -1
  7. package/dist/app/preflight.d.ts.map +1 -1
  8. package/dist/app/preflight.js +47 -11
  9. package/dist/app/preflight.js.map +1 -1
  10. package/dist/app/spec-lint.d.ts.map +1 -1
  11. package/dist/app/spec-lint.js +16 -0
  12. package/dist/app/spec-lint.js.map +1 -1
  13. package/dist/app/templates.d.ts +24 -0
  14. package/dist/app/templates.d.ts.map +1 -1
  15. package/dist/app/templates.js.map +1 -1
  16. package/dist/cli/help-guides.d.ts +17 -0
  17. package/dist/cli/help-guides.d.ts.map +1 -0
  18. package/dist/cli/help-guides.js +132 -0
  19. package/dist/cli/help-guides.js.map +1 -0
  20. package/dist/cli/root.d.ts.map +1 -1
  21. package/dist/cli/root.js +6 -0
  22. package/dist/cli/root.js.map +1 -1
  23. package/dist/commands/app/index.d.ts.map +1 -1
  24. package/dist/commands/app/index.js +687 -47
  25. package/dist/commands/app/index.js.map +1 -1
  26. package/dist/commands/completion/index.d.ts.map +1 -1
  27. package/dist/commands/completion/index.js +5 -1
  28. package/dist/commands/completion/index.js.map +1 -1
  29. package/dist/commands/data/index.d.ts +52 -0
  30. package/dist/commands/data/index.d.ts.map +1 -1
  31. package/dist/commands/data/index.js +201 -39
  32. package/dist/commands/data/index.js.map +1 -1
  33. package/dist/commands/db/index.d.ts +15 -0
  34. package/dist/commands/db/index.d.ts.map +1 -1
  35. package/dist/commands/db/index.js +200 -55
  36. package/dist/commands/db/index.js.map +1 -1
  37. package/dist/commands/functions/new.d.ts +4 -0
  38. package/dist/commands/functions/new.d.ts.map +1 -1
  39. package/dist/commands/functions/new.js +24 -9
  40. package/dist/commands/functions/new.js.map +1 -1
  41. package/dist/commands/gen/index.d.ts.map +1 -1
  42. package/dist/commands/gen/index.js +13 -10
  43. package/dist/commands/gen/index.js.map +1 -1
  44. package/dist/commands/guide/index.d.ts +8 -0
  45. package/dist/commands/guide/index.d.ts.map +1 -0
  46. package/dist/commands/guide/index.js +20 -0
  47. package/dist/commands/guide/index.js.map +1 -0
  48. package/dist/commands/instance/index.d.ts.map +1 -1
  49. package/dist/commands/instance/index.js +120 -0
  50. package/dist/commands/instance/index.js.map +1 -1
  51. package/dist/commands/login/index.d.ts.map +1 -1
  52. package/dist/commands/login/index.js +23 -63
  53. package/dist/commands/login/index.js.map +1 -1
  54. package/dist/commands/profile/import-env.d.ts +7 -2
  55. package/dist/commands/profile/import-env.d.ts.map +1 -1
  56. package/dist/commands/profile/import-env.js +141 -16
  57. package/dist/commands/profile/import-env.js.map +1 -1
  58. package/dist/commands/profile/index.d.ts.map +1 -1
  59. package/dist/commands/profile/index.js +16 -1
  60. package/dist/commands/profile/index.js.map +1 -1
  61. package/dist/commands/skill/index.d.ts.map +1 -1
  62. package/dist/commands/skill/index.js +89 -14
  63. package/dist/commands/skill/index.js.map +1 -1
  64. package/dist/commands/storage/index.d.ts.map +1 -1
  65. package/dist/commands/storage/index.js +209 -7
  66. package/dist/commands/storage/index.js.map +1 -1
  67. package/dist/commands/tenant/index.d.ts +19 -0
  68. package/dist/commands/tenant/index.d.ts.map +1 -0
  69. package/dist/commands/tenant/index.js +667 -0
  70. package/dist/commands/tenant/index.js.map +1 -0
  71. package/dist/commands/whoami/index.js +19 -0
  72. package/dist/commands/whoami/index.js.map +1 -1
  73. package/dist/credentials/credential-store.d.ts +30 -1
  74. package/dist/credentials/credential-store.d.ts.map +1 -1
  75. package/dist/credentials/credential-store.js +114 -12
  76. package/dist/credentials/credential-store.js.map +1 -1
  77. package/dist/credentials/env-file.d.ts +48 -7
  78. package/dist/credentials/env-file.d.ts.map +1 -1
  79. package/dist/credentials/env-file.js +91 -16
  80. package/dist/credentials/env-file.js.map +1 -1
  81. package/dist/credentials/index.d.ts +2 -0
  82. package/dist/credentials/index.d.ts.map +1 -1
  83. package/dist/credentials/index.js +2 -0
  84. package/dist/credentials/index.js.map +1 -1
  85. package/dist/credentials/jwt-introspect.d.ts +7 -0
  86. package/dist/credentials/jwt-introspect.d.ts.map +1 -1
  87. package/dist/credentials/jwt-introspect.js.map +1 -1
  88. package/dist/credentials/masker.d.ts +3 -0
  89. package/dist/credentials/masker.d.ts.map +1 -1
  90. package/dist/credentials/masker.js +3 -0
  91. package/dist/credentials/masker.js.map +1 -1
  92. package/dist/credentials/profile.d.ts +12 -0
  93. package/dist/credentials/profile.d.ts.map +1 -1
  94. package/dist/credentials/profile.js +23 -0
  95. package/dist/credentials/profile.js.map +1 -1
  96. package/dist/credentials/tty-guard.d.ts +10 -0
  97. package/dist/credentials/tty-guard.d.ts.map +1 -1
  98. package/dist/credentials/tty-guard.js +32 -0
  99. package/dist/credentials/tty-guard.js.map +1 -1
  100. package/dist/db/apply-schema.d.ts +98 -11
  101. package/dist/db/apply-schema.d.ts.map +1 -1
  102. package/dist/db/apply-schema.js +247 -80
  103. package/dist/db/apply-schema.js.map +1 -1
  104. package/dist/db/introspect.d.ts +54 -0
  105. package/dist/db/introspect.d.ts.map +1 -0
  106. package/dist/db/introspect.js +140 -0
  107. package/dist/db/introspect.js.map +1 -0
  108. package/dist/db/sql-file.d.ts +55 -0
  109. package/dist/db/sql-file.d.ts.map +1 -1
  110. package/dist/db/sql-file.js +417 -0
  111. package/dist/db/sql-file.js.map +1 -1
  112. package/dist/instance/zero-whitelist.d.ts +39 -0
  113. package/dist/instance/zero-whitelist.d.ts.map +1 -0
  114. package/dist/instance/zero-whitelist.js +67 -0
  115. package/dist/instance/zero-whitelist.js.map +1 -0
  116. package/dist/main.js +26 -3
  117. package/dist/main.js.map +1 -1
  118. package/dist/skill/agents-md.d.ts +25 -0
  119. package/dist/skill/agents-md.d.ts.map +1 -0
  120. package/dist/skill/agents-md.js +62 -0
  121. package/dist/skill/agents-md.js.map +1 -0
  122. package/dist/skill/hosts.d.ts +31 -7
  123. package/dist/skill/hosts.d.ts.map +1 -1
  124. package/dist/skill/hosts.js +65 -7
  125. package/dist/skill/hosts.js.map +1 -1
  126. package/dist/skill/installer.d.ts +15 -3
  127. package/dist/skill/installer.d.ts.map +1 -1
  128. package/dist/skill/installer.js +62 -24
  129. package/dist/skill/installer.js.map +1 -1
  130. package/dist/tenant/bundle.d.ts +66 -0
  131. package/dist/tenant/bundle.d.ts.map +1 -0
  132. package/dist/tenant/bundle.js +132 -0
  133. package/dist/tenant/bundle.js.map +1 -0
  134. package/dist/tenant/guide.d.ts +50 -0
  135. package/dist/tenant/guide.d.ts.map +1 -0
  136. package/dist/tenant/guide.js +152 -0
  137. package/dist/tenant/guide.js.map +1 -0
  138. package/dist/tenant/probe.d.ts +65 -0
  139. package/dist/tenant/probe.d.ts.map +1 -0
  140. package/dist/tenant/probe.js +159 -0
  141. package/dist/tenant/probe.js.map +1 -0
  142. package/dist/tenant/verify.d.ts +37 -0
  143. package/dist/tenant/verify.d.ts.map +1 -0
  144. package/dist/tenant/verify.js +132 -0
  145. package/dist/tenant/verify.js.map +1 -0
  146. package/dist/version.d.ts +29 -0
  147. package/dist/version.d.ts.map +1 -0
  148. package/dist/version.js +65 -0
  149. package/dist/version.js.map +1 -0
  150. package/package.json +3 -3
  151. package/skills/pxbaas-app-spec/SKILL.md +4 -2
  152. package/skills/pxbaas-app-spec/references/deploy-options.md +3 -2
  153. package/skills/pxbaas-app-spec/references/runtime-contract.md +2 -2
  154. package/skills/pxbaas-app-spec/references/templates-examples.md +7 -4
  155. package/skills/pxbaas-cli/SKILL.md +26 -8
  156. package/skills/pxbaas-cli/references/app-deploy.md +46 -3
  157. package/skills/pxbaas-cli/references/auth-and-credentials.md +30 -2
  158. package/skills/pxbaas-cli/references/data-postgrest.md +19 -3
  159. package/skills/pxbaas-cli/references/db-and-meta.md +17 -0
  160. package/skills/pxbaas-cli/references/multi-tenant-apps.md +35 -4
  161. package/skills/pxbaas-cli/references/provision.md +16 -1
  162. package/skills/pxbaas-cli/references/safety-and-two-phase.md +42 -13
  163. package/skills/pxbaas-cli/references/tenant-admin.md +122 -0
  164. package/skills/pxbaas-cli/references/troubleshooting.md +4 -1
  165. package/templates/webapp/csr-bff/db/rls.json +13 -0
  166. package/templates/webapp/csr-bff/db/schema.sql +8 -28
  167. package/templates/webapp/manifest.json +131 -8
  168. package/templates/webapp/react-vite-hono/backend/index.ts +21 -4
  169. package/templates/webapp/ssr-blog/db/rls.json +13 -0
  170. package/templates/webapp/ssr-blog/db/schema.sql +8 -28
  171. package/templates/webapp/ssr-hono/backend/index.ts +50 -31
  172. package/templates/webapp/ssr-shop/db/rls.json +16 -0
  173. package/templates/webapp/ssr-shop/db/schema.sql +12 -42
  174. package/dist/commands/login/login.d.ts +0 -3
  175. package/dist/commands/login/login.d.ts.map +0 -1
  176. package/dist/commands/login/login.js +0 -185
  177. package/dist/commands/login/login.js.map +0 -1
  178. /package/templates/webapp/vanilla-static/frontend/{app.js → dist/app.js} +0 -0
  179. /package/templates/webapp/vanilla-static/frontend/{index.html → dist/index.html} +0 -0
  180. /package/templates/webapp/vanilla-static/frontend/{style.css → dist/style.css} +0 -0
@@ -14,17 +14,19 @@ import { existsSync } from 'node:fs';
14
14
  import { homedir } from 'node:os';
15
15
  import { dirname, join } from 'node:path';
16
16
  import { listBundledSkillsIn, listSkillFiles, readCliVersion, resolveSkillsRoot } from './assets.js';
17
- import { detectInstalledHosts, hostSkillsRoot } from './hosts.js';
17
+ import { ALL_EXCLUDED_HOSTS, detectInstalledHosts, hostSkillsRoot, projectSkillsRoot, PROJECT_HOSTS, } from './hosts.js';
18
18
  import { classifyTarget, readMarker, sha256File, writeMarker } from './ownership.js';
19
19
  export class SkillManager {
20
20
  homeDir;
21
21
  skillsRoot;
22
22
  cliVersion;
23
+ projectRoot;
23
24
  skillsCache = null;
24
25
  constructor(options = {}) {
25
26
  this.homeDir = options.homeDir ?? homedir();
26
27
  this.skillsRoot = options.skillsRoot ?? resolveSkillsRoot();
27
28
  this.cliVersion = options.cliVersion ?? 'unknown';
29
+ this.projectRoot = options.projectRoot ?? process.cwd();
28
30
  }
29
31
  /** Async factory that resolves the CLI version from package.json. */
30
32
  static async create(options = {}) {
@@ -51,27 +53,43 @@ export class SkillManager {
51
53
  /**
52
54
  * Resolve which host skills-roots to act on.
53
55
  * - `--dir` wins (single custom skills-root, host label "custom")
54
- * - `--all` → every detected host (those with an existing ~/.<host>)
56
+ * - `--scope project` requires `--host` (a ProjectHost) or `--dir`; `--all` is
57
+ * user-scope only because writing every vendor repo directory is spammy
58
+ * - `--all` (user scope) → every detected host except ALL_EXCLUDED_HOSTS
55
59
  * - `--host <h>` → that host
56
60
  * - none → auto-detect: exactly one detected host is used; 0 or >1 is an error
57
61
  */
58
62
  resolveTargets(opts) {
63
+ const scope = opts.scope ?? 'user';
64
+ if (scope === 'project') {
65
+ if (opts.all) {
66
+ throw new Error(`--all is user-scope only. For --scope project pass --host <${PROJECT_HOSTS.join('|')}> or --dir <path>.`);
67
+ }
68
+ if (opts.dir) {
69
+ return [{ host: 'custom', destRoot: opts.dir, scope }];
70
+ }
71
+ if (!opts.host || !PROJECT_HOSTS.includes(opts.host)) {
72
+ throw new Error(`--scope project requires --host <${PROJECT_HOSTS.join('|')}> (or --dir <path>).`);
73
+ }
74
+ const host = opts.host;
75
+ return [{ host, destRoot: projectSkillsRoot(host, this.projectRoot), scope }];
76
+ }
59
77
  if (opts.dir) {
60
- return [{ host: 'custom', destRoot: opts.dir }];
78
+ return [{ host: 'custom', destRoot: opts.dir, scope }];
61
79
  }
62
80
  if (opts.all) {
63
- const detected = detectInstalledHosts(this.homeDir);
81
+ const detected = detectInstalledHosts(this.homeDir).filter((h) => !ALL_EXCLUDED_HOSTS.includes(h));
64
82
  if (detected.length === 0) {
65
83
  throw new Error(`No supported host directory found under ${this.homeDir}. Pass --host <name> or --dir <path>.`);
66
84
  }
67
- return detected.map((host) => ({ host, destRoot: hostSkillsRoot(host, this.homeDir) }));
85
+ return detected.map((host) => ({ host, destRoot: hostSkillsRoot(host, this.homeDir), scope }));
68
86
  }
69
87
  if (opts.host) {
70
- return [{ host: opts.host, destRoot: hostSkillsRoot(opts.host, this.homeDir) }];
88
+ return [{ host: opts.host, destRoot: hostSkillsRoot(opts.host, this.homeDir), scope }];
71
89
  }
72
90
  const detected = detectInstalledHosts(this.homeDir);
73
91
  if (detected.length === 1) {
74
- return [{ host: detected[0], destRoot: hostSkillsRoot(detected[0], this.homeDir) }];
92
+ return [{ host: detected[0], destRoot: hostSkillsRoot(detected[0], this.homeDir), scope }];
75
93
  }
76
94
  if (detected.length === 0) {
77
95
  throw new Error(`No supported host directory found under ${this.homeDir}. Pass --host <name> or --dir <path>.`);
@@ -89,12 +107,12 @@ export class SkillManager {
89
107
  for (const target of targets) {
90
108
  for (const skill of skills) {
91
109
  const destDir = join(target.destRoot, skill);
92
- results.push(await this.installOne(target.host, skill, destDir, filesBySkill.get(skill) ?? [], options));
110
+ results.push(await this.installOne(target.host, skill, destDir, filesBySkill.get(skill) ?? [], options, target.scope));
93
111
  }
94
112
  }
95
113
  return results;
96
114
  }
97
- async installOne(host, skill, targetDir, files, options) {
115
+ async installOne(host, skill, targetDir, files, options, scope = 'user') {
98
116
  const assetDir = join(this.skillsRoot, skill);
99
117
  const state = await classifyTarget(targetDir);
100
118
  if (state === 'foreign' && !options.force) {
@@ -103,13 +121,14 @@ export class SkillManager {
103
121
  skill,
104
122
  targetDir,
105
123
  status: 'skipped-foreign',
124
+ scope,
106
125
  reason: 'Directory exists but is not managed by pxbaas-cli. Re-run with --force to back it up and overwrite.',
107
126
  };
108
127
  }
109
128
  const plannedStatus = state === 'owned' ? 'updated' : 'installed';
110
129
  if (options.dryRun) {
111
130
  const verb = state === 'owned' ? 'update' : 'install';
112
- return { host, skill, targetDir, status: 'dry-run', filesWritten: files, reason: `would ${verb}` };
131
+ return { host, skill, targetDir, status: 'dry-run', scope, filesWritten: files, reason: `would ${verb}` };
113
132
  }
114
133
  try {
115
134
  if (state === 'foreign' && options.force) {
@@ -139,10 +158,10 @@ export class SkillManager {
139
158
  throw new Error(`Verification failed: missing ${rel} after copy`);
140
159
  }
141
160
  }
142
- return { host, skill, targetDir, status: plannedStatus, filesWritten: files, skillVersion: this.cliVersion };
161
+ return { host, skill, targetDir, status: plannedStatus, scope, filesWritten: files, skillVersion: this.cliVersion };
143
162
  }
144
163
  catch (err) {
145
- return { host, skill, targetDir, status: 'error', reason: err instanceof Error ? err.message : String(err) };
164
+ return { host, skill, targetDir, status: 'error', scope, reason: err instanceof Error ? err.message : String(err) };
146
165
  }
147
166
  }
148
167
  /** Report install state of every bundled skill across all detected hosts. */
@@ -152,20 +171,39 @@ export class SkillManager {
152
171
  for (const host of detectInstalledHosts(this.homeDir)) {
153
172
  const destRoot = hostSkillsRoot(host, this.homeDir);
154
173
  for (const skill of skills) {
155
- results.push(await this.listOne(host, skill, join(destRoot, skill)));
174
+ results.push(await this.listOne(host, skill, join(destRoot, skill), 'user'));
175
+ }
176
+ }
177
+ return results;
178
+ }
179
+ /** Report install state of bundled skills in repository-level directories. */
180
+ async listProject(options = {}) {
181
+ const skills = await this.selectedSkills(options.skills);
182
+ const results = [];
183
+ const seenRoots = new Set();
184
+ for (const host of PROJECT_HOSTS) {
185
+ const destRoot = projectSkillsRoot(host, this.projectRoot);
186
+ // codex and the neutral `agents` key share .agents/skills: report once.
187
+ if (seenRoots.has(destRoot))
188
+ continue;
189
+ seenRoots.add(destRoot);
190
+ if (!existsSync(destRoot))
191
+ continue;
192
+ for (const skill of skills) {
193
+ results.push(await this.listOne(host, skill, join(destRoot, skill), 'project'));
156
194
  }
157
195
  }
158
196
  return results;
159
197
  }
160
- async listOne(host, skill, targetDir) {
198
+ async listOne(host, skill, targetDir, scope = 'user') {
161
199
  const state = await classifyTarget(targetDir);
162
200
  if (state === 'absent')
163
- return { host, skill, targetDir, status: 'not-installed' };
201
+ return { host, skill, targetDir, status: 'not-installed', scope };
164
202
  if (state === 'foreign') {
165
- return { host, skill, targetDir, status: 'foreign', reason: 'directory exists but is not managed by pxbaas-cli' };
203
+ return { host, skill, targetDir, status: 'foreign', scope, reason: 'directory exists but is not managed by pxbaas-cli' };
166
204
  }
167
205
  const marker = await readMarker(targetDir);
168
- return { host, skill, targetDir, status: 'installed', skillVersion: marker?.skillVersion, installedAt: marker?.installedAt };
206
+ return { host, skill, targetDir, status: 'installed', scope, skillVersion: marker?.skillVersion, installedAt: marker?.installedAt };
169
207
  }
170
208
  /**
171
209
  * Remove bundled skills from each target. Only removes directories owned by
@@ -176,27 +214,27 @@ export class SkillManager {
176
214
  const results = [];
177
215
  for (const target of targets) {
178
216
  for (const skill of skills) {
179
- results.push(await this.removeOne(target.host, skill, join(target.destRoot, skill), options));
217
+ results.push(await this.removeOne(target.host, skill, join(target.destRoot, skill), options, target.scope));
180
218
  }
181
219
  }
182
220
  return results;
183
221
  }
184
- async removeOne(host, skill, targetDir, options) {
222
+ async removeOne(host, skill, targetDir, options, scope = 'user') {
185
223
  const state = await classifyTarget(targetDir);
186
224
  if (state === 'absent')
187
- return { host, skill, targetDir, status: 'not-installed' };
225
+ return { host, skill, targetDir, status: 'not-installed', scope };
188
226
  if (state === 'foreign') {
189
- return { host, skill, targetDir, status: 'skipped-foreign', reason: 'Directory is not managed by pxbaas-cli; refusing to delete.' };
227
+ return { host, skill, targetDir, status: 'skipped-foreign', scope, reason: 'Directory is not managed by pxbaas-cli; refusing to delete.' };
190
228
  }
191
229
  if (options.dryRun || !options.confirm) {
192
- return { host, skill, targetDir, status: 'dry-run', reason: options.dryRun ? 'would remove' : 'pass --confirm to remove' };
230
+ return { host, skill, targetDir, status: 'dry-run', scope, reason: options.dryRun ? 'would remove' : 'pass --confirm to remove' };
193
231
  }
194
232
  try {
195
233
  await rm(targetDir, { recursive: true, force: true });
196
- return { host, skill, targetDir, status: 'removed' };
234
+ return { host, skill, targetDir, status: 'removed', scope };
197
235
  }
198
236
  catch (err) {
199
- return { host, skill, targetDir, status: 'error', reason: err instanceof Error ? err.message : String(err) };
237
+ return { host, skill, targetDir, status: 'error', scope, reason: err instanceof Error ? err.message : String(err) };
200
238
  }
201
239
  }
202
240
  }
@@ -1 +1 @@
1
- {"version":3,"file":"installer.js","sourceRoot":"","sources":["../../src/skill/installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrG,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAiB,MAAM,YAAY,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAoB,MAAM,gBAAgB,CAAC;AA6CvG,MAAM,OAAO,YAAY;IACN,OAAO,CAAS;IAChB,UAAU,CAAS;IACnB,UAAU,CAAS;IAC5B,WAAW,GAAoB,IAAI,CAAC;IAE5C,YAAY,UAA+B,EAAE;QAC3C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;QAC5D,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC;IACpD,CAAC;IAED,qEAAqE;IACrE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAA+B,EAAE;QACnD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC;QAClE,OAAO,IAAI,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,sCAAsC;IACtC,KAAK,CAAC,aAAa;QACjB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,MAAiB;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,IAAsD;QACnE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,CAAC,OAAO,uCAAuC,CAAC,CAAC;YAClH,CAAC;YACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,CAAC,OAAO,uCAAuC,CAAC,CAAC;QAClH,CAAC;QACD,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,sEAAsE,CACtH,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,OAAO,CAAC,OAAyB,EAAE,UAA0B,EAAE;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC7C,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAC3F,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,IAAY,EACZ,KAAa,EACb,SAAiB,EACjB,KAAe,EACf,OAAuB;QAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QAE9C,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC1C,OAAO;gBACL,IAAI;gBACJ,KAAK;gBACL,SAAS;gBACT,MAAM,EAAE,iBAAiB;gBACzB,MAAM,EAAE,qGAAqG;aAC9G,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAkB,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;QACjF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;QACrG,CAAC;QAED,IAAI,CAAC;YACH,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACzC,MAAM,MAAM,CAAC,SAAS,EAAE,GAAG,SAAS,QAAQ,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAE5C,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBAChC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBACjC,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/C,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACzB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;YACtC,CAAC;YAED,MAAM,MAAM,GAAgB;gBAC1B,KAAK,EAAE,YAAY;gBACnB,SAAS,EAAE,KAAK;gBAChB,YAAY,EAAE,IAAI,CAAC,UAAU;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,IAAI;gBACJ,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACrC,KAAK,EAAE,MAAM;aACd,CAAC;YACF,MAAM,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAErC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACxB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;oBACtC,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,aAAa,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/G,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/G,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,IAAI,CAAC,UAAiC,EAAE;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACpD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,KAAa,EAAE,SAAiB;QAClE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACnF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mDAAmD,EAAE,CAAC;QACpH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC/H,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,OAAyB,EAAE,UAAyB,EAAE;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAChG,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,KAAa,EAAE,SAAiB,EAAE,OAAsB;QAC5F,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACnF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,6DAA6D,EAAE,CAAC;QACtI,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACvC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC;QAC7H,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/G,CAAC;IACH,CAAC;CACF"}
1
+ {"version":3,"file":"installer.js","sourceRoot":"","sources":["../../src/skill/installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrG,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,aAAa,GAGd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAoB,MAAM,gBAAgB,CAAC;AAkDvG,MAAM,OAAO,YAAY;IACN,OAAO,CAAS;IAChB,UAAU,CAAS;IACnB,UAAU,CAAS;IACnB,WAAW,CAAS;IAC7B,WAAW,GAAoB,IAAI,CAAC;IAE5C,YAAY,UAA+B,EAAE;QAC3C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;QAC5D,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC;QAClD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1D,CAAC;IAED,qEAAqE;IACrE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAA+B,EAAE;QACnD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC;QAClE,OAAO,IAAI,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,sCAAsC;IACtC,KAAK,CAAC,aAAa;QACjB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,MAAiB;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;OAQG;IACH,cAAc,CAAC,IAKd;QACC,MAAM,KAAK,GAAiB,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CACb,8DAA8D,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAC1G,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAmB,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CACb,oCAAoC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAClF,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAmB,CAAC;YACtC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CACxD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CACvC,CAAC;YACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,CAAC,OAAO,uCAAuC,CAAC,CAAC;YAClH,CAAC;YACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,IAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,CAAC,OAAO,uCAAuC,CAAC,CAAC;QAClH,CAAC;QACD,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,sEAAsE,CACtH,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,OAAO,CAAC,OAAyB,EAAE,UAA0B,EAAE;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC7C,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CACzG,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,IAAY,EACZ,KAAa,EACb,SAAiB,EACjB,KAAe,EACf,OAAuB,EACvB,QAAsB,MAAM;QAE5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QAE9C,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC1C,OAAO;gBACL,IAAI;gBACJ,KAAK;gBACL,SAAS;gBACT,MAAM,EAAE,iBAAiB;gBACzB,KAAK;gBACL,MAAM,EAAE,qGAAqG;aAC9G,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAkB,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;QACjF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;QAC5G,CAAC;QAED,IAAI,CAAC;YACH,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACzC,MAAM,MAAM,CAAC,SAAS,EAAE,GAAG,SAAS,QAAQ,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAE5C,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBAChC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBACjC,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/C,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACzB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;YACtC,CAAC;YAED,MAAM,MAAM,GAAgB;gBAC1B,KAAK,EAAE,YAAY;gBACnB,SAAS,EAAE,KAAK;gBAChB,YAAY,EAAE,IAAI,CAAC,UAAU;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,IAAI;gBACJ,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACrC,KAAK,EAAE,MAAM;aACd,CAAC;YACF,MAAM,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAErC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACxB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;oBACtC,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,aAAa,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;QACtH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACtH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,IAAI,CAAC,UAAiC,EAAE;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACpD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,WAAW,CAAC,UAAiC,EAAE;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YAC3D,wEAAwE;YACxE,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACtC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,IAAY,EACZ,KAAa,EACb,SAAiB,EACjB,QAAsB,MAAM;QAE5B,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAC1F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mDAAmD,EAAE,CAAC;QAC3H,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACtI,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,OAAyB,EAAE,UAAyB,EAAE;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAC9F,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,IAAY,EACZ,KAAa,EACb,SAAiB,EACjB,OAAsB,EACtB,QAAsB,MAAM;QAE5B,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAC1F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,6DAA6D,EAAE,CAAC;QAC7I,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACvC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC;QACpI,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACtH,CAAC;IACH,CAAC;CACF"}
@@ -0,0 +1,66 @@
1
+ /**
2
+ * 租户交付包(tenant access bundle)。
3
+ *
4
+ * 解决的问题:管理员在 CLI 里拿到了新租户的密钥之后,怎么把它交给"另一个真人"。
5
+ * 交付物是一份**规范 env 文件**,格式与 `pxbaas profile import` 的多租户输入契约逐字
6
+ * 对齐(credentials/env-file.ts 的 TENANT_* 分支),所以收件人不需要手改任何字段名。
7
+ *
8
+ * 三条硬纪律:
9
+ * 1. **字段白名单**。bundle 内容由本模块**逐字段显式拼装**,因此结构上不可能包含
10
+ * `jwt_secret`(租户签名母密钥)、`DASHBOARD_*`(实例管理口令)或 `GLOBAL_*`
11
+ * (平台全局密钥)。这不是"记得过滤",而是根本没有把它们写进去的入口。
12
+ * 2. **明文只落 0600 文件,绝不进 stdout / `--json` / 日志**。终端上只出现指纹。
13
+ * 3. **不留存于内存之外**:调用方拿到 keys 后要么写钥匙串,要么交给本模块写文件。
14
+ */
15
+ export declare const BUNDLE_VERSION = 1;
16
+ export interface BundleInput {
17
+ tenantId: string;
18
+ /** Kong 网关地址;必须已是网关,不能是 Studio 端口。 */
19
+ endpoint: string;
20
+ anonKey: string;
21
+ serviceRoleKey: string;
22
+ /** 同 VPC 使用者可加内网入口,导入时用 --intranet 优先。 */
23
+ intranetEndpoint?: string;
24
+ issuedBy?: string;
25
+ /** 供注释头标注有效期语义(当前平台签发约 10 年且不可撤销)。 */
26
+ generatedAt?: string;
27
+ }
28
+ export interface HandoffRecord {
29
+ tenantId: string;
30
+ endpoint: string;
31
+ generatedAt: string;
32
+ anonFingerprint: string;
33
+ serviceFingerprint: string;
34
+ bundlePath: string;
35
+ /** 交付包整文件 sha256,用于收件人比对"拿到的是不是同一份"。 */
36
+ bundleSha256: string;
37
+ issuedBy?: string;
38
+ }
39
+ export interface WriteBundleResult {
40
+ path: string;
41
+ bytes: number;
42
+ record: HandoffRecord;
43
+ instructions: string;
44
+ }
45
+ /**
46
+ * 渲染交付包文本。只输出这 5(+1)个变量:
47
+ * MULTI_TENANT_MODE / SUPABASE_URL / DEFAULT_TENANT_ID / TENANT_ANON_KEY /
48
+ * TENANT_SERVICE_ROLE_KEY(可选 SUPABASE_INTRANET_URL)。
49
+ */
50
+ export declare function renderBundle(input: BundleInput): string;
51
+ /**
52
+ * 写交付包。目标已存在时**必须**显式 `overwrite`,否则拒绝 —— 不静默覆盖别人的接入包。
53
+ */
54
+ export declare function writeBundle(file: string, input: BundleInput, options?: {
55
+ overwrite?: boolean;
56
+ homeDir?: string;
57
+ }): Promise<WriteBundleResult>;
58
+ /** 可直接复制转发给使用者的交接说明(不含任何密钥值)。 */
59
+ export declare function renderInstructions(record: HandoffRecord): string;
60
+ export declare function listHandoffs(homeDir?: string): Promise<HandoffRecord[]>;
61
+ /**
62
+ * 签发台账:只记指纹与文件哈希,**不含任何明文密钥**。0600。
63
+ * 泄露事件回溯时这是唯一能回答"我发过哪些包、对应哪个租户"的记录。
64
+ */
65
+ export declare function appendHandoffRecord(record: HandoffRecord, homeDir?: string): Promise<void>;
66
+ //# sourceMappingURL=bundle.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/tenant/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,aAAa,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CA0BvD;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,WAAW,EAClB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GACtD,OAAO,CAAC,iBAAiB,CAAC,CA+B5B;AAED,iCAAiC;AACjC,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAgBhE;AAID,wBAAsB,YAAY,CAChC,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,EAAE,CAAC,CAY1B;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,EACrB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAcf"}
@@ -0,0 +1,132 @@
1
+ /**
2
+ * 租户交付包(tenant access bundle)。
3
+ *
4
+ * 解决的问题:管理员在 CLI 里拿到了新租户的密钥之后,怎么把它交给"另一个真人"。
5
+ * 交付物是一份**规范 env 文件**,格式与 `pxbaas profile import` 的多租户输入契约逐字
6
+ * 对齐(credentials/env-file.ts 的 TENANT_* 分支),所以收件人不需要手改任何字段名。
7
+ *
8
+ * 三条硬纪律:
9
+ * 1. **字段白名单**。bundle 内容由本模块**逐字段显式拼装**,因此结构上不可能包含
10
+ * `jwt_secret`(租户签名母密钥)、`DASHBOARD_*`(实例管理口令)或 `GLOBAL_*`
11
+ * (平台全局密钥)。这不是"记得过滤",而是根本没有把它们写进去的入口。
12
+ * 2. **明文只落 0600 文件,绝不进 stdout / `--json` / 日志**。终端上只出现指纹。
13
+ * 3. **不留存于内存之外**:调用方拿到 keys 后要么写钥匙串,要么交给本模块写文件。
14
+ */
15
+ import { createHash } from 'node:crypto';
16
+ import { existsSync } from 'node:fs';
17
+ import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
18
+ import { dirname, join, resolve } from 'node:path';
19
+ import { homedir } from 'node:os';
20
+ import { computeFingerprint } from '../credentials/index.js';
21
+ export const BUNDLE_VERSION = 1;
22
+ /**
23
+ * 渲染交付包文本。只输出这 5(+1)个变量:
24
+ * MULTI_TENANT_MODE / SUPABASE_URL / DEFAULT_TENANT_ID / TENANT_ANON_KEY /
25
+ * TENANT_SERVICE_ROLE_KEY(可选 SUPABASE_INTRANET_URL)。
26
+ */
27
+ export function renderBundle(input) {
28
+ const endpoint = stripSlash(input.endpoint);
29
+ const generatedAt = input.generatedAt ?? new Date().toISOString();
30
+ // 注释头:parseEnvText 会安全忽略 '#' 行,因此头部不需要解析器改动。
31
+ const header = [
32
+ '# PolarDB-X BaaS 租户接入包 (tenant access bundle)',
33
+ `# tenant_id : ${input.tenantId}`,
34
+ `# instance : ${endpoint} (Kong 网关,勿改成 Studio/内网调试端口)`,
35
+ `# created_at : ${generatedAt}`,
36
+ input.issuedBy ? `# issued_by : ${input.issuedBy}` : undefined,
37
+ '#',
38
+ '# ⚠ 本文件含明文租户密钥,且:有效期约 10 年、当前平台不支持撤销。',
39
+ '# - 只通过安全通道传输(受控网盘 / 密邮正文 / 当面拷贝);不要贴进 IM 群、工单附件、截图或聊天记录',
40
+ '# - 收件人导入成功后请删除本文件(凭据会进入其操作系统钥匙串)',
41
+ '# - 怀疑泄露:当前只能由平台侧重建该租户',
42
+ '# ============================================================',
43
+ 'MULTI_TENANT_MODE=true',
44
+ `SUPABASE_URL=${endpoint}`,
45
+ `DEFAULT_TENANT_ID=${input.tenantId}`,
46
+ `TENANT_ANON_KEY=${input.anonKey}`,
47
+ `TENANT_SERVICE_ROLE_KEY=${input.serviceRoleKey}`,
48
+ ];
49
+ if (input.intranetEndpoint) {
50
+ header.push(`SUPABASE_INTRANET_URL=${stripSlash(input.intranetEndpoint)}`);
51
+ }
52
+ return header.join('\n') + '\n';
53
+ }
54
+ /**
55
+ * 写交付包。目标已存在时**必须**显式 `overwrite`,否则拒绝 —— 不静默覆盖别人的接入包。
56
+ */
57
+ export async function writeBundle(file, input, options = {}) {
58
+ const path = resolve(file);
59
+ if (existsSync(path) && !options.overwrite) {
60
+ throw new Error(`Bundle file already exists: ${path}. Pass --overwrite to replace it (the old bundle's keys stay valid — overwriting the file does NOT revoke them).`);
61
+ }
62
+ const text = renderBundle(input);
63
+ const dir = dirname(path);
64
+ if (!existsSync(dir)) {
65
+ await mkdir(dir, { mode: 0o700, recursive: true });
66
+ }
67
+ await writeFile(path, text, { mode: 0o600 });
68
+ await chmod(path, 0o600);
69
+ const generatedAt = input.generatedAt ?? new Date().toISOString();
70
+ const record = {
71
+ tenantId: input.tenantId,
72
+ endpoint: stripSlash(input.endpoint),
73
+ generatedAt,
74
+ anonFingerprint: computeFingerprint(input.anonKey),
75
+ serviceFingerprint: computeFingerprint(input.serviceRoleKey),
76
+ bundlePath: path,
77
+ bundleSha256: createHash('sha256').update(text).digest('hex'),
78
+ issuedBy: input.issuedBy,
79
+ };
80
+ await appendHandoffRecord(record, options.homeDir);
81
+ return { path, bytes: Buffer.byteLength(text), record, instructions: renderInstructions(record) };
82
+ }
83
+ /** 可直接复制转发给使用者的交接说明(不含任何密钥值)。 */
84
+ export function renderInstructions(record) {
85
+ return [
86
+ `下一步:把 ${record.bundlePath} 通过安全通道发给该租户的使用者,并附上以下说明。`,
87
+ '',
88
+ ` 1) 安装 CLI(需 Node.js >= 20): npm install -g @polardbx/pxbaas@beta`,
89
+ ` 2) 导入接入包: pxbaas profile import ${record.bundlePath.split('/').pop()} --name ${record.tenantId} --json`,
90
+ ' 3) 自检: pxbaas whoami --json → 期望 mode=multi-tenant、tenantId=' + record.tenantId,
91
+ ' 4) 健康检查: pxbaas doctor --json → 5 项全 pass,Tenant Consistency 必须 pass',
92
+ ' 5) 打通数据面: pxbaas db tables --json',
93
+ ' 6) 全部通过后删除该 env 文件',
94
+ '',
95
+ ' 指纹核对(证明收件人拿到的就是这份包,防传输途中被替换):',
96
+ ` anon: ${record.anonFingerprint}`,
97
+ ` service_role: ${record.serviceFingerprint}`,
98
+ ' 收件人在 `pxbaas whoami --json` 里比对 anonKey.fingerprint / serviceKey.fingerprint 是否一致。',
99
+ ].join('\n');
100
+ }
101
+ const HANDOFF_FILE_NAME = 'handoffs.json';
102
+ export async function listHandoffs(homeDir) {
103
+ const path = join(homeDir ?? join(homedir(), '.baas'), HANDOFF_FILE_NAME);
104
+ if (!existsSync(path))
105
+ return [];
106
+ try {
107
+ const parsed = JSON.parse(await readFile(path, 'utf-8'));
108
+ return parsed.records ?? [];
109
+ }
110
+ catch {
111
+ return [];
112
+ }
113
+ }
114
+ /**
115
+ * 签发台账:只记指纹与文件哈希,**不含任何明文密钥**。0600。
116
+ * 泄露事件回溯时这是唯一能回答"我发过哪些包、对应哪个租户"的记录。
117
+ */
118
+ export async function appendHandoffRecord(record, homeDir) {
119
+ const dir = homeDir ?? join(homedir(), '.baas');
120
+ const path = join(dir, HANDOFF_FILE_NAME);
121
+ const records = await listHandoffs(dir);
122
+ records.push(record);
123
+ if (!existsSync(dir)) {
124
+ await mkdir(dir, { mode: 0o700, recursive: true });
125
+ }
126
+ await writeFile(path, JSON.stringify({ version: BUNDLE_VERSION, records }, null, 2) + '\n', { mode: 0o600 });
127
+ await chmod(path, 0o600);
128
+ }
129
+ function stripSlash(value) {
130
+ return value.replace(/\/+$/, '');
131
+ }
132
+ //# sourceMappingURL=bundle.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../src/tenant/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAkChC;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAkB;IAC7C,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClE,6CAA6C;IAC7C,MAAM,MAAM,GAAG;QACb,+CAA+C;QAC/C,kBAAkB,KAAK,CAAC,QAAQ,EAAE;QAClC,kBAAkB,QAAQ,gCAAgC;QAC1D,kBAAkB,WAAW,EAAE;QAC/B,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;QAC/D,GAAG;QACH,uCAAuC;QACvC,4DAA4D;QAC5D,qCAAqC;QACrC,0BAA0B;QAC1B,gEAAgE;QAChE,wBAAwB;QACxB,gBAAgB,QAAQ,EAAE;QAC1B,qBAAqB,KAAK,CAAC,QAAQ,EAAE;QACrC,mBAAmB,KAAK,CAAC,OAAO,EAAE;QAClC,2BAA2B,KAAK,CAAC,cAAc,EAAE;KAClD,CAAC;IACF,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,yBAAyB,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAY,EACZ,KAAkB,EAClB,UAAqD,EAAE;IAEvD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,+BAA+B,IAAI,kHAAkH,CACtJ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAEzB,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClE,MAAM,MAAM,GAAkB;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;QACpC,WAAW;QACX,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC;QAClD,kBAAkB,EAAE,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC;QAC5D,UAAU,EAAE,IAAI;QAChB,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC7D,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;IAEF,MAAM,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAEnD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;AACpG,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IACtD,OAAO;QACL,SAAS,MAAM,CAAC,UAAU,2BAA2B;QACrD,EAAE;QACF,oEAAoE;QACpE,qDAAqD,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,WAAW,MAAM,CAAC,QAAQ,SAAS;QAC1H,wFAAwF,GAAG,MAAM,CAAC,QAAQ;QAC1G,4FAA4F;QAC5F,qDAAqD;QACrD,sBAAsB;QACtB,EAAE;QACF,iCAAiC;QACjC,qBAAqB,MAAM,CAAC,eAAe,EAAE;QAC7C,qBAAqB,MAAM,CAAC,kBAAkB,EAAE;QAChD,wFAAwF;KACzF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB;IAEhB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC1E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAGtD,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAqB,EACrB,OAAgB;IAEhB,MAAM,GAAG,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,SAAS,CACb,IAAI,EACJ,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACpE,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACF,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC"}
@@ -0,0 +1,50 @@
1
+ /**
2
+ * 多租户接入缺口的诊断与引导(方案文档 §5.4)。
3
+ *
4
+ * 原来 `profile import` 撞到"多租户 env 却没有租户级凭据"时只抛一句拒绝,而它给出的
5
+ * 两个建议("重新生成 client.env"、"用 per-tenant key 登录")**都是使用者自己做不到**
6
+ * 的动作——租户级密钥由平台签发。结果是 CLI 把用户堵在门口,还让他以为是自己的错。
7
+ *
8
+ * 本模块把这一处变成两条明确出口:
9
+ * - 非管理员 → 一份可以直接转给实例管理员的**申请清单**(要哪个租户、哪两把值、
10
+ * 以及怎么判断拿到的到底是不是租户级密钥);
11
+ * - 具备管理面能力 → 指出可以用 `pxbaas tenant ...` 自助开通/取键,并给出命令。
12
+ *
13
+ * 边界:这里**只读、只打印**,绝不在失败分支里创建租户(读路径不携带建库/建账号/
14
+ * 占配额这类写副作用,见方案 N2)。管理凭据也只做**临时**探测,绝不落库(N3)。
15
+ */
16
+ import { type ParsedEnv } from '../credentials/index.js';
17
+ import { type TenantProbeResult } from './probe.js';
18
+ export interface KeyFinding {
19
+ variable: string;
20
+ role?: string;
21
+ /** JWT 里的 tenant_id claim;无 = 平台全局密钥,无法访问租户资源。 */
22
+ tenantId?: string;
23
+ expired: boolean;
24
+ fingerprint: string;
25
+ note: string;
26
+ }
27
+ export interface TenantGapDiagnostics {
28
+ envFile?: string;
29
+ endpoint?: string;
30
+ multiTenantMode?: string;
31
+ defaultTenantId?: string;
32
+ tenantLevelKeysPresent: string[];
33
+ keyFindings: KeyFinding[];
34
+ /** env 文件里是否有成对的 dashboard 凭据(仅报告存在,不导入)。 */
35
+ adminCredentialsPresent: boolean;
36
+ }
37
+ /** 纯本地解析:不联网、不写任何状态。 */
38
+ export declare function diagnoseTenantCredentialGap(env: ParsedEnv, options?: {
39
+ envFile?: string;
40
+ }): TenantGapDiagnostics;
41
+ /** 非管理员出口:一份可原样转给实例管理员的申请清单。 */
42
+ export declare function renderRequestChecklist(diag: TenantGapDiagnostics): string;
43
+ /** 管理员出口:指出可以自助的动作与命令。 */
44
+ export declare function renderAdminPath(diag: TenantGapDiagnostics, probe: TenantProbeResult): string;
45
+ /**
46
+ * 用 env 里的 dashboard 凭据做一次**临时**探测:只在内存里使用,不落库、不写文件。
47
+ * 没有成对凭据时返回 undefined(调用方走非管理员出口)。
48
+ */
49
+ export declare function tryProbeFromEnv(env: ParsedEnv, endpoint: string | undefined): Promise<TenantProbeResult | undefined>;
50
+ //# sourceMappingURL=guide.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"guide.d.ts","sourceRoot":"","sources":["../../src/tenant/guide.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAiC,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAExF,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AActE,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,6CAA6C;IAC7C,uBAAuB,EAAE,OAAO,CAAC;CAClC;AAED,wBAAwB;AACxB,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,SAAS,EACd,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GACjC,oBAAoB,CAiDtB;AAED,gCAAgC;AAChC,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,CAiCzE;AAED,0BAA0B;AAC1B,wBAAgB,eAAe,CAAC,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAwB5F;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,SAAS,EACd,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAUxC"}