@polardbx/pxbaas 0.1.0-beta.2 → 0.1.0-beta.4

package/dist/credentials/env-file.js

@@ -1,12 +1,28 @@
 /**
  * Env-file 解析 - 从 Supabase/BaaS 惯例的 .env 文件里提取登录所需字段
  *
- * 仅覆盖单租户实例（MULTI_TENANT_MODE=false / 缺省）。多租户实例的 env 文件
- * 只带 global keys，无法直接作为租户业务凭证，需走平台 API 铸造 per-tenant key，
- * 该路径暂不支持（见 resolveLoginFromEnv 的显式报错）。
+ * 单租户实例取 SUPABASE_ANON_KEY / SUPABASE_SERVICE_ROLE_KEY；多租户实例
+ * （MULTI_TENANT_MODE=true）取 DEFAULT_TENANT_ID + TENANT_ANON_KEY /
+ * TENANT_SERVICE_ROLE_KEY —— 离线包 gen-client-env.sh 产出的多租户 client.env
+ * 同时带全局键与租户级键，而全局键访问租户资源会被 Kong 的全局凭证护栏挡掉，
+ * 所以落库的一律是租户级凭据；文件里的 GLOBAL_* 只报告存在、不导入。
  *
  * 不引入 dotenv 依赖：项目内的 env 文件均为简单 KEY=VALUE 格式。
  */
+/**
+ * 多租户 env 文件缺少租户级凭据时抛出。
+ *
+ * 单独成类是为了让调用方（profile import 的失败分支）能**判别**这种情况并给出
+ * 分流指引，而不是只对着一段自然语言做字符串匹配。
+ */
+export class TenantCredentialGapError extends Error {
+    missing;
+    constructor(message, missing) {
+        super(message);
+        this.name = 'TenantCredentialGapError';
+        this.missing = missing;
+    }
+}
 /**
  * 解析 env 文件文本为键值对。
  *
@@ -60,6 +76,13 @@ const SERVICE_VARS = [
     'SERVICE_ROLE_KEY',
     'GLOBAL_SERVICE_ROLE_KEY',
 ];
+const TENANT_ID_VARS = ['DEFAULT_TENANT_ID'];
+const TENANT_ANON_VARS = ['TENANT_ANON_KEY'];
+const TENANT_SERVICE_VARS = ['TENANT_SERVICE_ROLE_KEY'];
+const GLOBAL_KEY_VARS = ['GLOBAL_ANON_KEY', 'GLOBAL_SERVICE_ROLE_KEY'];
+/** 实例管理面凭据：默认不导入，见 EnvLoginFields.skippedAdminKeys。 */
+const ADMIN_USERNAME_VARS = ['DASHBOARD_USERNAME'];
+const ADMIN_PASSWORD_VARS = ['DASHBOARD_PASSWORD'];
 function pickWithSource(env, keys) {
     for (const k of keys) {
         const v = env[k];
@@ -70,31 +93,60 @@ function pickWithSource(env, keys) {
     return undefined;
 }
 /**
- * 从解析后的 env 中提取单租户登录字段。
+ * 从解析后的 env 中提取登录字段（单租户或多租户）。
  *
  * @param env       parseEnvText 的结果
  * @param options.intranet  为 true 时优先使用内网入口 SUPABASE_INTRANET_URL
- * @throws Error    多租户实例、或缺少必需字段时抛出可直接展示的错误
+ * @throws Error    缺少必需字段（多租户即缺租户级凭据）时抛出可直接展示的错误
  */
 export function resolveLoginFromEnv(env, options = {}) {
-    // 多租户：暂不支持（global keys 不能直接访问租户资源）
     const mtRaw = (env.MULTI_TENANT_MODE ?? '').trim().toLowerCase();
-    if (mtRaw === 'true' || mtRaw === '1' || mtRaw === 'yes') {
-        throw new Error('Multi-tenant instances are not supported by `profile import` yet ' +
-            '(MULTI_TENANT_MODE=true). The env file only carries global keys, which cannot ' +
-            'access tenant resources. Use `pxbaas login` with per-tenant anon/service keys instead.');
+    const isMultiTenant = mtRaw === 'true' || mtRaw === '1' || mtRaw === 'yes';
+    // 多租户：只有租户级凭据能访问租户资源（全局键会命中 Kong 的全局凭证护栏 403），
+    // 因此改写取值来源；全局键仅记录「存在但未导入」。
+    let anonVars = ANON_VARS;
+    let serviceVars = SERVICE_VARS;
+    let tenantId;
+    let tenantIdSource;
+    let skippedGlobalKeys;
+    if (isMultiTenant) {
+        const tenantIdHit = pickWithSource(env, TENANT_ID_VARS);
+        const tenantAnonHit = pickWithSource(env, TENANT_ANON_VARS);
+        const tenantServiceHit = pickWithSource(env, TENANT_SERVICE_VARS);
+        const missingTenant = [];
+        if (!tenantIdHit)
+            missingTenant.push(`tenant id (${TENANT_ID_VARS.join(' | ')})`);
+        if (!tenantAnonHit)
+            missingTenant.push(`tenant anon key (${TENANT_ANON_VARS.join(' | ')})`);
+        if (!tenantServiceHit) {
+            missingTenant.push(`tenant service role key (${TENANT_SERVICE_VARS.join(' | ')})`);
+        }
+        if (missingTenant.length > 0) {
+            throw new TenantCredentialGapError('Multi-tenant instances are not supported by `profile import` unless the env file ' +
+                `carries tenant-level credentials. This file is missing: ${missingTenant.join('; ')}. ` +
+                'Regenerate client.env with tenant keys, or use `pxbaas login --tenant-id <id> ' +
+                '--anon-key-stdin --service-key-stdin` with per-tenant keys instead.', missingTenant);
+        }
+        tenantId = tenantIdHit.value;
+        tenantIdSource = tenantIdHit.source;
+        anonVars = TENANT_ANON_VARS;
+        serviceVars = TENANT_SERVICE_VARS;
+        const presentGlobal = GLOBAL_KEY_VARS.filter((k) => (env[k] ?? '').trim() !== '');
+        if (presentGlobal.length > 0) {
+            skippedGlobalKeys = presentGlobal;
+        }
     }
     const endpointVars = options.intranet ? ENDPOINT_VARS_INTRANET : ENDPOINT_VARS;
     const endpointHit = pickWithSource(env, endpointVars);
-    const anonHit = pickWithSource(env, ANON_VARS);
-    const serviceHit = pickWithSource(env, SERVICE_VARS);
+    const anonHit = pickWithSource(env, anonVars);
+    const serviceHit = pickWithSource(env, serviceVars);
     const missing = [];
     if (!endpointHit)
         missing.push(`endpoint (${endpointVars.join(' | ')})`);
     if (!anonHit)
-        missing.push(`anon key (${ANON_VARS.join(' | ')})`);
+        missing.push(`anon key (${anonVars.join(' | ')})`);
     if (!serviceHit)
-        missing.push(`service role key (${SERVICE_VARS.join(' | ')})`);
+        missing.push(`service role key (${serviceVars.join(' | ')})`);
     if (missing.length > 0) {
         throw new Error(`Env file is missing required variable(s): ${missing.join('; ')}`);
     }
@@ -102,17 +154,40 @@ export function resolveLoginFromEnv(env, options = {}) {
     if (!/^https?:\/\//.test(endpoint)) {
         throw new Error(`Endpoint from ${endpointHit.source} must start with http:// or https:// (got: ${endpoint})`);
     }
+    // 管理凭据默认不外吸：只报告"存在"，由调用方决定是否显式导入（--with-admin）。
+    const presentAdmin = [...ADMIN_USERNAME_VARS, ...ADMIN_PASSWORD_VARS].filter((k) => (env[k] ?? '').trim() !== '');
     return {
         endpoint,
         anonKey: anonHit.value,
         serviceRoleKey: serviceHit.value,
-        tenantId: undefined,
-        mode: 'single-tenant',
+        tenantId,
+        mode: isMultiTenant ? 'multi-tenant' : 'single-tenant',
         sources: {
             endpoint: endpointHit.source,
             anonKey: anonHit.source,
             serviceRoleKey: serviceHit.source,
+            tenantId: tenantIdSource,
         },
+        skippedGlobalKeys,
+        skippedAdminKeys: presentAdmin.length > 0 ? presentAdmin : undefined,
+    };
+}
+/**
+ * 从 env 中提取实例管理凭据（dashboard Basic Auth）。
+ *
+ * 返回 undefined 表示文件里没有成对的管理凭据 —— 调用方**不应**因此报错：
+ * 它们只在管理员显式 `--with-admin` 或临时能力探测时才被读取。
+ * 只出现一半（有 user 无 password）视为不可用，避免半套凭据落库。
+ */
+export function resolveAdminFromEnv(env) {
+    const username = pickWithSource(env, ADMIN_USERNAME_VARS);
+    const password = pickWithSource(env, ADMIN_PASSWORD_VARS);
+    if (!username || !password)
+        return undefined;
+    return {
+        username: username.value,
+        password: password.value,
+        sources: { username: username.source, password: password.source },
     };
 }
 //# sourceMappingURL=env-file.js.map

package/dist/credentials/env-file.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-file.js","sourceRoot":"","sources":["../../src/credentials/env-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAc,EAAE,CAAC;IAE1B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,SAAS;QACX,CAAC;QAED,qBAAqB;QACrB,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACd,SAAS,CAAC,oBAAoB;QAChC,CAAC;QAED,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,SAAS;QACX,CAAC;QAED,IAAI,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE/C,gCAAgC;QAChC,MAAM,MAAM,GACV,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;YACnE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACtE,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,gCAAgC;YAChC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;gBACtB,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yCAAyC;AACzC,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAiBD,MAAM,aAAa,GAAG,CAAC,cAAc,EAAE,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;AACvF,MAAM,sBAAsB,GAAG,CAAC,uBAAuB,EAAE,cAAc,EAAE,qBAAqB,CAAC,CAAC;AAChG,MAAM,SAAS,GAAG,CAAC,mBAAmB,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;AACvE,MAAM,YAAY,GAAG;IACnB,2BAA2B;IAC3B,kBAAkB;IAClB,yBAAyB;CAC1B,CAAC;AAEF,SAAS,cAAc,CACrB,GAAc,EACd,IAAc;IAEd,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAc,EACd,UAAkC,EAAE;IAEpC,mCAAmC;IACnC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjE,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,gFAAgF;YAChF,wFAAwF,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,aAAa,CAAC;IAC/E,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAErD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,qBAAqB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,6CAA6C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,WAAY,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,iBAAiB,WAAY,CAAC,MAAM,8CAA8C,QAAQ,GAAG,CAC9F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ;QACR,OAAO,EAAE,OAAQ,CAAC,KAAK;QACvB,cAAc,EAAE,UAAW,CAAC,KAAK;QACjC,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE;YACP,QAAQ,EAAE,WAAY,CAAC,MAAM;YAC7B,OAAO,EAAE,OAAQ,CAAC,MAAM;YACxB,cAAc,EAAE,UAAW,CAAC,MAAM;SACnC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"env-file.js","sourceRoot":"","sources":["../../src/credentials/env-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH;;;;;GAKG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,OAAO,CAAW;IAE3B,YAAY,OAAe,EAAE,OAAiB;QAC5C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAc,EAAE,CAAC;IAE1B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,SAAS;QACX,CAAC;QAED,qBAAqB;QACrB,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACd,SAAS,CAAC,oBAAoB;QAChC,CAAC;QAED,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,SAAS;QACX,CAAC;QAED,IAAI,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE/C,gCAAgC;QAChC,MAAM,MAAM,GACV,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;YACnE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACtE,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,gCAAgC;YAChC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;gBACtB,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yCAAyC;AACzC,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AA6BD,MAAM,aAAa,GAAG,CAAC,cAAc,EAAE,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;AACvF,MAAM,sBAAsB,GAAG,CAAC,uBAAuB,EAAE,cAAc,EAAE,qBAAqB,CAAC,CAAC;AAChG,MAAM,SAAS,GAAG,CAAC,mBAAmB,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;AACvE,MAAM,YAAY,GAAG;IACnB,2BAA2B;IAC3B,kBAAkB;IAClB,yBAAyB;CAC1B,CAAC;AACF,MAAM,cAAc,GAAG,CAAC,mBAAmB,CAAC,CAAC;AAC7C,MAAM,gBAAgB,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAC7C,MAAM,mBAAmB,GAAG,CAAC,yBAAyB,CAAC,CAAC;AACxD,MAAM,eAAe,GAAG,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;AACvE,uDAAuD;AACvD,MAAM,mBAAmB,GAAG,CAAC,oBAAoB,CAAC,CAAC;AACnD,MAAM,mBAAmB,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAEnD,SAAS,cAAc,CACrB,GAAc,EACd,IAAc;IAEd,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAc,EACd,UAAkC,EAAE;IAEpC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjE,MAAM,aAAa,GAAG,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,KAAK,CAAC;IAE3E,+CAA+C;IAC/C,2BAA2B;IAC3B,IAAI,QAAQ,GAAG,SAAS,CAAC;IACzB,IAAI,WAAW,GAAG,YAAY,CAAC;IAC/B,IAAI,QAA4B,CAAC;IACjC,IAAI,cAAkC,CAAC;IACvC,IAAI,iBAAuC,CAAC;IAE5C,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACxD,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAC5D,MAAM,gBAAgB,GAAG,cAAc,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAElE,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,IAAI,CAAC,WAAW;YAAE,aAAa,CAAC,IAAI,CAAC,cAAc,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClF,IAAI,CAAC,aAAa;YAAE,aAAa,CAAC,IAAI,CAAC,oBAAoB,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5F,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,4BAA4B,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,wBAAwB,CAChC,mFAAmF;gBACjF,2DAA2D,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBACvF,gFAAgF;gBAChF,qEAAqE,EACvE,aAAa,CACd,CAAC;QACJ,CAAC;QAED,QAAQ,GAAG,WAAY,CAAC,KAAK,CAAC;QAC9B,cAAc,GAAG,WAAY,CAAC,MAAM,CAAC;QACrC,QAAQ,GAAG,gBAAgB,CAAC;QAC5B,WAAW,GAAG,mBAAmB,CAAC;QAClC,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,iBAAiB,GAAG,aAAa,CAAC;QACpC,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,aAAa,CAAC;IAC/E,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAEpD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,qBAAqB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,6CAA6C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,WAAY,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,iBAAiB,WAAY,CAAC,MAAM,8CAA8C,QAAQ,GAAG,CAC9F,CAAC;IACJ,CAAC;IAED,gDAAgD;IAChD,MAAM,YAAY,GAAG,CAAC,GAAG,mBAAmB,EAAE,GAAG,mBAAmB,CAAC,CAAC,MAAM,CAC1E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CACpC,CAAC;IAEF,OAAO;QACL,QAAQ;QACR,OAAO,EAAE,OAAQ,CAAC,KAAK;QACvB,cAAc,EAAE,UAAW,CAAC,KAAK;QACjC,QAAQ;QACR,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe;QACtD,OAAO,EAAE;YACP,QAAQ,EAAE,WAAY,CAAC,MAAM;YAC7B,OAAO,EAAE,OAAQ,CAAC,MAAM;YACxB,cAAc,EAAE,UAAW,CAAC,MAAM;YAClC,QAAQ,EAAE,cAAc;SACzB;QACD,iBAAiB;QACjB,gBAAgB,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;KACrE,CAAC;AACJ,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAc;IAChD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,KAAK;QACxB,QAAQ,EAAE,QAAQ,CAAC,KAAK;QACxB,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE;KAClE,CAAC;AACJ,CAAC"}

package/dist/credentials/jwt-introspect.d.ts

@@ -14,6 +14,13 @@ export interface IntrospectedJwt {
     payload: JwtPayload;
     isExpired: boolean;
     expiresIn: number;
+    /**
+     * 裸指纹：sha256 前8 + 后4，形如 `6ee48f23...a477`，**不带** `sha256:` 前缀。
+     *
+     * 契约（分层，勿在其中一层"顺手"补前缀，否则展示层会变成 `sha256:sha256:`）：
+     * 内层解析只产出裸值；展示层 `computeFingerprint()`（./masker.ts，whoami /
+     * instance / provision 用它）统一加 `sha256:` 前缀。
+     */
     fingerprint: string;
 }
 /**

package/dist/credentials/jwt-introspect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-introspect.d.ts","sourceRoot":"","sources":["../../src/credentials/jwt-introspect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,GAAG,cAAc,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAanD;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAkB3E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAatD"}
+{"version":3,"file":"jwt-introspect.d.ts","sourceRoot":"","sources":["../../src/credentials/jwt-introspect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,GAAG,cAAc,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAanD;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAkB3E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAatD"}

package/dist/credentials/jwt-introspect.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-introspect.js","sourceRoot":"","sources":["../../src/credentials/jwt-introspect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAkBH;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAe,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa;IAC/C,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAEnD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IACpC,MAAM,SAAS,GAAG,SAAS,IAAI,CAAC,CAAC;IAEjC,0BAA0B;IAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE9D,OAAO;QACL,OAAO;QACP,SAAS;QACT,SAAS;QACT,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,GAAG,GAAG,EAAE;YAAE,OAAO,WAAW,GAAG,OAAO,CAAC;QAC3C,IAAI,GAAG,GAAG,IAAI;YAAE,OAAO,WAAW,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;QAC9D,IAAI,GAAG,GAAG,KAAK;YAAE,OAAO,WAAW,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC;QACjE,OAAO,WAAW,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC;IACnD,CAAC;IAED,IAAI,SAAS,GAAG,EAAE;QAAE,OAAO,cAAc,SAAS,GAAG,CAAC;IACtD,IAAI,SAAS,GAAG,IAAI;QAAE,OAAO,cAAc,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC,GAAG,CAAC;IACzE,IAAI,SAAS,GAAG,KAAK;QAAE,OAAO,cAAc,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC;IAC5E,OAAO,cAAc,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;AACxD,CAAC"}
+{"version":3,"file":"jwt-introspect.js","sourceRoot":"","sources":["../../src/credentials/jwt-introspect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAyBH;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAe,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa;IAC/C,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAEnD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IACpC,MAAM,SAAS,GAAG,SAAS,IAAI,CAAC,CAAC;IAEjC,0BAA0B;IAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE9D,OAAO;QACL,OAAO;QACP,SAAS;QACT,SAAS;QACT,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,GAAG,GAAG,EAAE;YAAE,OAAO,WAAW,GAAG,OAAO,CAAC;QAC3C,IAAI,GAAG,GAAG,IAAI;YAAE,OAAO,WAAW,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;QAC9D,IAAI,GAAG,GAAG,KAAK;YAAE,OAAO,WAAW,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC;QACjE,OAAO,WAAW,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC;IACnD,CAAC;IAED,IAAI,SAAS,GAAG,EAAE;QAAE,OAAO,cAAc,SAAS,GAAG,CAAC;IACtD,IAAI,SAAS,GAAG,IAAI;QAAE,OAAO,cAAc,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC,GAAG,CAAC;IACzE,IAAI,SAAS,GAAG,KAAK;QAAE,OAAO,cAAc,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC;IAC5E,OAAO,cAAc,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;AACxD,CAAC"}

package/dist/credentials/masker.d.ts

@@ -4,6 +4,9 @@
 /**
  * 计算密钥指纹：sha256 前8字符 + 后4字符
  * 格式：sha256:abcd1234...ef56
+ *
+ * 这是**展示层**的唯一加前缀处（whoami / instance / provision 直接输出它）。
+ * `introspectJwt().fingerprint` 返回的是同一指纹的裸值，前缀只在这里加一次。
  */
 export declare function computeFingerprint(key: string): string;
 /**

package/dist/credentials/masker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"masker.d.ts","sourceRoot":"","sources":["../../src/credentials/masker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGtD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQ9D;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM/C"}
+{"version":3,"file":"masker.d.ts","sourceRoot":"","sources":["../../src/credentials/masker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGtD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQ9D;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM/C"}

package/dist/credentials/masker.js

@@ -5,6 +5,9 @@ import { createHash } from 'node:crypto';
 /**
  * 计算密钥指纹：sha256 前8字符 + 后4字符
  * 格式：sha256:abcd1234...ef56
+ *
+ * 这是**展示层**的唯一加前缀处（whoami / instance / provision 直接输出它）。
+ * `introspectJwt().fingerprint` 返回的是同一指纹的裸值，前缀只在这里加一次。
  */
 export function computeFingerprint(key) {
     const hash = createHash('sha256').update(key).digest('hex');

package/dist/credentials/masker.js.map

@@ -1 +1 @@
-{"version":3,"file":"masker.js","sourceRoot":"","sources":["../../src/credentials/masker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,UAAU,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,UAAU,WAAW,EAAE,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"masker.js","sourceRoot":"","sources":["../../src/credentials/masker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,UAAU,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,UAAU,WAAW,EAAE,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/credentials/profile.d.ts

@@ -17,6 +17,11 @@ export interface BaasProfile {
     zeroInstanceId?: string;
     /** Zero instance expiry (ISO 8601), only when source === 'zero'. */
     expiresAt?: string;
+    /**
+     * 该 profile 是否绑定了平台管理凭据（dashboard Basic Auth）。仅是标记：口令本身
+     * 存在凭据存储的独立账目里，数据面命令读不到它。
+     */
+    adminCapable?: boolean;
     createdAt: string;
     updatedAt: string;
 }
@@ -29,6 +34,13 @@ interface ProfilesStore {
 export declare function setCliProfileOverrideGlobal(profileName: string | undefined): void;
 /** 读取进程级 profile 覆盖（供测试/诊断）。 */
 export declare function getCliProfileOverrideGlobal(): string | undefined;
+/**
+ * 判断被调用的命令是否会创建/覆盖 `--profile` 指定的 profile。
+ *
+ * @param commandPath 完整命令路径（如 `['profile','import']`），不含程序名。
+ *                    只比叶子名会让将来任何同名子命令误获放行，故必须传完整路径。
+ */
+export declare function isProfileCreatingCommand(commandPath: readonly string[]): boolean;
 export declare class ProfileManager {
     private homeDir;
     private cliProfileOverride?;

package/dist/credentials/profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../src/credentials/profile.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,cAAc,CAAC;AAE3D,yGAAyG;AACzG,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,WAAW,CAAC;IAClB,uEAAuE;IACvE,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,aAAa;IACrB,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACvC;AAYD,uDAAuD;AACvD,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAEjF;AAED,gCAAgC;AAChC,wBAAgB,2BAA2B,IAAI,MAAM,GAAG,SAAS,CAEhE;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,kBAAkB,CAAC,CAAS;IACpC,OAAO,CAAC,KAAK,CAA8B;gBAE/B,OAAO,CAAC,EAAE,MAAM;IAI5B;;;OAGG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAK5D,oCAAoC;IACpC,OAAO,KAAK,2BAA2B,GAEtC;IAED;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAI3B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC;IA2BpC;;OAEG;YACW,IAAI;IAYlB;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAsCtD;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAK5C;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAK3D;;OAEG;IACG,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBrD;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW7C;;OAEG;IACG,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAiBpD"}
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../src/credentials/profile.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,cAAc,CAAC;AAE3D,yGAAyG;AACzG,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,WAAW,CAAC;IAClB,uEAAuE;IACvE,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,aAAa;IACrB,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACvC;AAYD,uDAAuD;AACvD,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAEjF;AAED,gCAAgC;AAChC,wBAAgB,2BAA2B,IAAI,MAAM,GAAG,SAAS,CAEhE;AAgBD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAMhF;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,kBAAkB,CAAC,CAAS;IACpC,OAAO,CAAC,KAAK,CAA8B;gBAE/B,OAAO,CAAC,EAAE,MAAM;IAI5B;;;OAGG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAK5D,oCAAoC;IACpC,OAAO,KAAK,2BAA2B,GAEtC;IAED;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAI3B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC;IA2BpC;;OAEG;YACW,IAAI;IAYlB;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAsCtD;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAK5C;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAK3D;;OAEG;IACG,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBrD;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW7C;;OAEG;IACG,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAiBpD"}

package/dist/credentials/profile.js

@@ -22,6 +22,29 @@ export function setCliProfileOverrideGlobal(profileName) {
 export function getCliProfileOverrideGlobal() {
     return processCliProfileOverride;
 }
+/**
+ * 会「写入 --profile 所指 profile」的命令，按完整命令路径匹配。
+ *
+ * 对这些命令来说，profile 名不存在恰恰是前提（它们正要创建它），所以 main.ts 的
+ * preAction 钩子不能对其做存在性硬校验；其余命令一律保持响亮失败，否则就退回了
+ * `--profile` 曾被静默忽略、写操作跨实例误落的旧缺陷。
+ */
+const PROFILE_CREATING_COMMANDS = [
+    ['login'],
+    ['profile', 'import'],
+    // `tenant login` 可以把管理凭据绑定到一个尚不存在的 profile（管理员常在新机器上先做这一步）
+    ['tenant', 'login'],
+];
+/**
+ * 判断被调用的命令是否会创建/覆盖 `--profile` 指定的 profile。
+ *
+ * @param commandPath 完整命令路径（如 `['profile','import']`），不含程序名。
+ *                    只比叶子名会让将来任何同名子命令误获放行，故必须传完整路径。
+ */
+export function isProfileCreatingCommand(commandPath) {
+    return PROFILE_CREATING_COMMANDS.some((candidate) => candidate.length === commandPath.length &&
+        candidate.every((segment, index) => segment === commandPath[index]));
+}
 export class ProfileManager {
     homeDir;
     cliProfileOverride; // --profile flag

package/dist/credentials/profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/credentials/profile.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA8BjC;;;;;GAKG;AACH,6DAA6D;AAC7D,yCAAyC;AACzC,IAAI,yBAA6C,CAAC;AAElD,uDAAuD;AACvD,MAAM,UAAU,2BAA2B,CAAC,WAA+B;IACzE,yBAAyB,GAAG,WAAW,CAAC;AAC1C,CAAC;AAED,gCAAgC;AAChC,MAAM,UAAU,2BAA2B;IACzC,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,MAAM,OAAO,cAAc;IACjB,OAAO,CAAS;IAChB,kBAAkB,CAAU,CAAC,iBAAiB;IAC9C,KAAK,GAAyB,IAAI,CAAC;IAE3C,YAAY,OAAgB;QAC1B,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH,qBAAqB,CAAC,WAA+B;QACnD,IAAI,CAAC,kBAAkB,GAAG,WAAW,CAAC;QACtC,yBAAyB,GAAG,WAAW,CAAC;IAC1C,CAAC;IAED,oCAAoC;IACpC,IAAY,2BAA2B;QACrC,OAAO,IAAI,CAAC,kBAAkB,IAAI,yBAAyB,CAAC;IAC9D,CAAC;IAED;;OAEG;IACK,mBAAmB;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAE5C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAkB,CAAC;YAElD,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,IAAI,CAAC,KAAoB;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAE/C,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB;QACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,wBAAwB;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,CAAC;QACrD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,YAAY,WAAW,mCAAmC,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,uBAAuB;QACvB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC5C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,qCAAqC,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,mBAAmB;QACnB,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,6BAA6B;gBAC7B,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,OAAoB;QACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,KAAK;YACL,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,KAAK;YACL,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;YACxB,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,aAAa,CAAC,CAAC;QACjD,CAAC;QAED,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;QACrB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE5B,8BAA8B;QAC9B,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3B,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC;QACrB,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/credentials/profile.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAmCjC;;;;;GAKG;AACH,6DAA6D;AAC7D,yCAAyC;AACzC,IAAI,yBAA6C,CAAC;AAElD,uDAAuD;AACvD,MAAM,UAAU,2BAA2B,CAAC,WAA+B;IACzE,yBAAyB,GAAG,WAAW,CAAC;AAC1C,CAAC;AAED,gCAAgC;AAChC,MAAM,UAAU,2BAA2B;IACzC,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,yBAAyB,GAAmC;IAChE,CAAC,OAAO,CAAC;IACT,CAAC,SAAS,EAAE,QAAQ,CAAC;IACrB,2DAA2D;IAC3D,CAAC,QAAQ,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,WAA8B;IACrE,OAAO,yBAAyB,CAAC,IAAI,CACnC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACvC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,cAAc;IACjB,OAAO,CAAS;IAChB,kBAAkB,CAAU,CAAC,iBAAiB;IAC9C,KAAK,GAAyB,IAAI,CAAC;IAE3C,YAAY,OAAgB;QAC1B,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH,qBAAqB,CAAC,WAA+B;QACnD,IAAI,CAAC,kBAAkB,GAAG,WAAW,CAAC;QACtC,yBAAyB,GAAG,WAAW,CAAC;IAC1C,CAAC;IAED,oCAAoC;IACpC,IAAY,2BAA2B;QACrC,OAAO,IAAI,CAAC,kBAAkB,IAAI,yBAAyB,CAAC;IAC9D,CAAC;IAED;;OAEG;IACK,mBAAmB;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAE5C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAkB,CAAC;YAElD,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,IAAI,CAAC,KAAoB;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAE/C,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB;QACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,wBAAwB;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,CAAC;QACrD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,YAAY,WAAW,mCAAmC,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,uBAAuB;QACvB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC5C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,qCAAqC,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,mBAAmB;QACnB,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,6BAA6B;gBAC7B,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,OAAoB;QACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,KAAK;YACL,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,KAAK;YACL,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;YACxB,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,aAAa,CAAC,CAAC;QACjD,CAAC;QAED,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;QACrB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE5B,8BAA8B;QAC9B,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3B,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC;QACrB,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/credentials/tty-guard.d.ts

@@ -8,6 +8,16 @@
  * @throws Error 如果非 TTY 环境
  */
 export declare function assertTty(isTTY?: boolean, ciEnv?: string): void;
+/**
+ * 从 stdin 按行读取密钥/口令类输入。
+ *
+ * 存在的理由：敏感值绝不能走 argv（会进 shell history 与进程列表）。login 与
+ * tenant login 都需要"两行管道输入"，此前各自实现了一份，统一到这里。
+ *
+ * @param expected 期望的行数
+ * @param label 报错里对各行内容的说明（保持调用方的既有文案可辨识）
+ */
+export declare function readStdinLines(expected: number, label: string): Promise<string[]>;
 /**
  * 断言命令行参数中不包含密钥参数
  * 防止通过 argv 传递密钥（会出现在 shell history 中）

package/dist/credentials/tty-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tty-guard.d.ts","sourceRoot":"","sources":["../../src/credentials/tty-guard.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAkB/D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAkBpD"}
+{"version":3,"file":"tty-guard.d.ts","sourceRoot":"","sources":["../../src/credentials/tty-guard.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAkB/D;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAmBvF;AACD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAsBpD"}

package/dist/credentials/tty-guard.js

@@ -21,6 +21,34 @@ export function assertTty(isTTY, ciEnv) {
             'Use --anon-key-stdin and --service-key-stdin for non-interactive input.');
     }
 }
+/**
+ * 从 stdin 按行读取密钥/口令类输入。
+ *
+ * 存在的理由：敏感值绝不能走 argv（会进 shell history 与进程列表）。login 与
+ * tenant login 都需要"两行管道输入"，此前各自实现了一份，统一到这里。
+ *
+ * @param expected 期望的行数
+ * @param label 报错里对各行内容的说明（保持调用方的既有文案可辨识）
+ */
+export async function readStdinLines(expected, label) {
+    const data = await new Promise((resolvePromise, rejectPromise) => {
+        let buffer = '';
+        process.stdin.setEncoding('utf8');
+        process.stdin.on('readable', () => {
+            let chunk;
+            while ((chunk = process.stdin.read()) !== null) {
+                buffer += chunk;
+            }
+        });
+        process.stdin.on('end', () => resolvePromise(buffer));
+        process.stdin.on('error', rejectPromise);
+    });
+    const lines = data.split('\n').map((line) => line.trim());
+    if (lines.length < expected) {
+        throw new Error(`Expected ${expected} lines from stdin: ${label}`);
+    }
+    return lines;
+}
 /**
  * 断言命令行参数中不包含密钥参数
  * 防止通过 argv 传递密钥（会出现在 shell history 中）
@@ -33,6 +61,10 @@ export function assertNoKeyArgs(argv) {
         '--anon-key',
         '--service-key',
         '--token',
+        // 平台管理凭据同样不得进 argv（会留在 shell history 与进程列表里）
+        '--dashboard-user',
+        '--dashboard-password',
+        '--admin-password',
     ];
     for (const arg of argv) {
         // 检查 --anon-key=value 或 --anon-key value 形式

package/dist/credentials/tty-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"tty-guard.js","sourceRoot":"","sources":["../../src/credentials/tty-guard.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAAe,EAAE,KAAc;IACvD,mBAAmB;IACnB,MAAM,WAAW,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;IACtE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,mDAAmD;YACnD,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,aAAa;IACb,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9D,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,sDAAsD;YACtD,yEAAyE,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,MAAM,aAAa,GAAG;QACpB,YAAY;QACZ,eAAe;QACf,SAAS;KACV,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,4CAA4C;QAC5C,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;YACtC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CACb,8CAA8C,GAAG,KAAK;oBACtD,OAAO,SAAS,kCAAkC,CACnD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"tty-guard.js","sourceRoot":"","sources":["../../src/credentials/tty-guard.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAAe,EAAE,KAAc;IACvD,mBAAmB;IACnB,MAAM,WAAW,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;IACtE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,mDAAmD;YACnD,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,aAAa;IACb,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9D,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,sDAAsD;YACtD,yEAAyE,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,KAAa;IAClE,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QACvE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE;YAChC,IAAI,KAAoB,CAAC;YACzB,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC;YAClB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,YAAY,QAAQ,sBAAsB,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,MAAM,aAAa,GAAG;QACpB,YAAY;QACZ,eAAe;QACf,SAAS;QACT,6CAA6C;QAC7C,kBAAkB;QAClB,sBAAsB;QACtB,kBAAkB;KACnB,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,4CAA4C;QAC5C,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;YACtC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CACb,8CAA8C,GAAG,KAAK;oBACtD,OAAO,SAAS,kCAAkC,CACnD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/db/introspect.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Schema introspection shared by `db tables`, `db schema`, and `gen types`.
+ *
+ * Why this exists (fixes defect C1): those three commands used the Meta API
+ * (`MetaDriver` -> `/pg/*`) unconditionally. In multi-tenant mode `/pg/*` only
+ * accepts the platform/global service_role key, so a per-tenant key is rejected
+ * with 401 (`Authentication failed`) — even though the same credentials work for
+ * `db query` (which already routes through tenant-ddl), `data *` (REST), and
+ * `storage`. See `db/apply-schema.ts` ("per-tenant keys are rejected 401 on
+ * /pg/query").
+ *
+ * The fix keeps single-tenant behavior EXACTLY as before (Meta API) and adds a
+ * multi-tenant path that runs the same portable `information_schema` queries
+ * through `TenantDdlDriver` (which the tenant key CAN call). The introspection
+ * SQL is backend-agnostic, so it is factored into pure functions that take an
+ * injectable `SqlRunner` — trivial to unit-test without a network.
+ */
+import { type TableInfo, type TableColumn, type TableIndex } from '@polardbx/pxbaas-client';
+/** Runs a SELECT and returns bare rows. Backed by MetaDriver (single-tenant
+ *  `/pg/query`) or TenantDdlDriver (multi-tenant `/api/tenant-ddl/query`). */
+export type SqlRunner = (sql: string) => Promise<Record<string, unknown>[]>;
+/** List tables/views via information_schema (portable across both drivers). */
+export declare function listTablesViaSql(run: SqlRunner, schema?: string): Promise<TableInfo[]>;
+/** List a table's columns via information_schema (mirrors MetaDriver SQL). */
+export declare function getTableColumnsViaSql(run: SqlRunner, table: string, schema?: string): Promise<TableColumn[]>;
+/** List a table's indexes via information_schema (mirrors MetaDriver SQL). */
+export declare function getTableIndexesViaSql(run: SqlRunner, table: string, schema?: string): Promise<TableIndex[]>;
+/** A schema introspector bound to the correct backend for the profile's mode. */
+export interface SchemaIntrospector {
+    /** Human label for the schema being introspected (tenant db in multi-tenant). */
+    currentSchema(): Promise<string>;
+    listTables(): Promise<TableInfo[]>;
+    getColumns(table: string): Promise<TableColumn[]>;
+    getIndexes(table: string): Promise<TableIndex[]>;
+}
+export interface MakeIntrospectorOptions {
+    /** Profile mode; 'multi-tenant' routes through tenant-ddl, else Meta API. */
+    mode?: string;
+    endpoint: string;
+    anonKey: string;
+    serviceRoleKey?: string;
+    tenantId?: string;
+    /** Single-tenant explicit schema (default 'public'). Ignored in multi-tenant. */
+    schema?: string;
+    /** Single-tenant: use the service_role key for Meta API reads (default true). */
+    useServiceRole?: boolean;
+}
+/**
+ * Build the mode-appropriate introspector.
+ * - multi-tenant: TenantDdlDriver + information_schema scoped to DATABASE().
+ * - single-tenant: the existing MetaDriver behavior, unchanged.
+ */
+export declare function makeIntrospector(opts: MakeIntrospectorOptions): SchemaIntrospector;
+//# sourceMappingURL=introspect.d.ts.map

package/dist/db/introspect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspect.d.ts","sourceRoot":"","sources":["../../src/db/introspect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EAChB,MAAM,yBAAyB,CAAC;AAEjC;8EAC8E;AAC9E,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;AAuB5E,+EAA+E;AAC/E,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,SAAS,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,SAAS,EAAE,CAAC,CAetB;AAED,8EAA8E;AAC9E,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,WAAW,EAAE,CAAC,CAmBxB;AAED,8EAA8E;AAC9E,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,EAAE,CAAC,CAiBvB;AAED,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACnC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,uBAAuB;IACtC,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,GAAG,kBAAkB,CA+ClF"}

package/dist/db/introspect.js

@@ -0,0 +1,140 @@
+/**
+ * Schema introspection shared by `db tables`, `db schema`, and `gen types`.
+ *
+ * Why this exists (fixes defect C1): those three commands used the Meta API
+ * (`MetaDriver` -> `/pg/*`) unconditionally. In multi-tenant mode `/pg/*` only
+ * accepts the platform/global service_role key, so a per-tenant key is rejected
+ * with 401 (`Authentication failed`) — even though the same credentials work for
+ * `db query` (which already routes through tenant-ddl), `data *` (REST), and
+ * `storage`. See `db/apply-schema.ts` ("per-tenant keys are rejected 401 on
+ * /pg/query").
+ *
+ * The fix keeps single-tenant behavior EXACTLY as before (Meta API) and adds a
+ * multi-tenant path that runs the same portable `information_schema` queries
+ * through `TenantDdlDriver` (which the tenant key CAN call). The introspection
+ * SQL is backend-agnostic, so it is factored into pure functions that take an
+ * injectable `SqlRunner` — trivial to unit-test without a network.
+ */
+import { MetaDriver, TenantDdlDriver, } from '@polardbx/pxbaas-client';
+/** Escape a single-quoted SQL string literal. */
+function esc(value) {
+    return value.replace(/'/g, "''");
+}
+/**
+ * Schema predicate for information_schema filters. An explicit schema filters by
+ * name; otherwise scope to the connection's current database via DATABASE() —
+ * correct for multi-tenant, where the tenant-ddl connection is bound to the
+ * tenant's own database (tenant_<id>), not a Postgres-style `public`.
+ */
+function schemaPredicate(schema) {
+    return schema && schema !== ''
+        ? `table_schema = '${esc(schema)}'`
+        : 'table_schema = DATABASE()';
+}
+function toBool(v) {
+    return v === 1 || v === true || v === '1';
+}
+/** List tables/views via information_schema (portable across both drivers). */
+export async function listTablesViaSql(run, schema) {
+    const sql = `SELECT table_schema AS \`schema\`, table_name AS \`name\`, table_type AS \`type\`, ` +
+        `table_rows AS \`rowCount\`, table_comment AS \`comment\` ` +
+        `FROM information_schema.tables ` +
+        `WHERE ${schemaPredicate(schema)} AND table_type IN ('BASE TABLE','VIEW') ` +
+        `ORDER BY table_name`;
+    const rows = await run(sql);
+    return rows.map((t) => ({
+        schema: String(t.schema ?? ''),
+        name: String(t.name ?? ''),
+        type: String(t.type ?? '').toUpperCase() === 'VIEW' ? 'view' : 'table',
+        rowCount: t.rowCount != null ? Number(t.rowCount) : undefined,
+        comment: t.comment != null && t.comment !== '' ? String(t.comment) : undefined,
+    }));
+}
+/** List a table's columns via information_schema (mirrors MetaDriver SQL). */
+export async function getTableColumnsViaSql(run, table, schema) {
+    const sql = `SELECT column_name AS \`name\`, data_type AS \`dataType\`, ` +
+        `CASE WHEN is_nullable='YES' THEN 1 ELSE 0 END AS \`isNullable\`, ` +
+        `column_default AS \`defaultValue\`, ` +
+        `CASE WHEN column_key='PRI' THEN 1 ELSE 0 END AS \`isPrimaryKey\`, ` +
+        `column_comment AS \`comment\` ` +
+        `FROM information_schema.columns ` +
+        `WHERE ${schemaPredicate(schema)} AND table_name='${esc(table)}' ` +
+        `ORDER BY ordinal_position`;
+    const rows = await run(sql);
+    return rows.map((row) => ({
+        name: String(row.name),
+        dataType: String(row.dataType),
+        isNullable: toBool(row.isNullable),
+        defaultValue: row.defaultValue == null ? null : String(row.defaultValue),
+        isPrimaryKey: toBool(row.isPrimaryKey),
+        comment: row.comment != null && row.comment !== '' ? String(row.comment) : undefined,
+    }));
+}
+/** List a table's indexes via information_schema (mirrors MetaDriver SQL). */
+export async function getTableIndexesViaSql(run, table, schema) {
+    const sql = `SELECT index_name AS \`name\`, ` +
+        `GROUP_CONCAT(column_name ORDER BY seq_in_index) AS \`cols\`, ` +
+        `CASE WHEN MIN(non_unique)=0 THEN 1 ELSE 0 END AS \`isUnique\`, ` +
+        `CASE WHEN index_name='PRIMARY' THEN 1 ELSE 0 END AS \`isPrimary\` ` +
+        `FROM information_schema.statistics ` +
+        `WHERE ${schemaPredicate(schema)} AND table_name='${esc(table)}' ` +
+        `GROUP BY index_name`;
+    const rows = await run(sql);
+    return rows.map((row) => ({
+        name: String(row.name),
+        columns: row.cols != null && row.cols !== '' ? String(row.cols).split(',') : [],
+        isUnique: toBool(row.isUnique),
+        isPrimary: toBool(row.isPrimary),
+        type: 'BTREE',
+    }));
+}
+/**
+ * Build the mode-appropriate introspector.
+ * - multi-tenant: TenantDdlDriver + information_schema scoped to DATABASE().
+ * - single-tenant: the existing MetaDriver behavior, unchanged.
+ */
+export function makeIntrospector(opts) {
+    if (opts.mode === 'multi-tenant') {
+        if (!opts.tenantId) {
+            throw new Error('Multi-tenant profile is missing tenantId; re-run "pxbaas login --tenant-id <id>" with per-tenant keys.');
+        }
+        const tenantDriver = new TenantDdlDriver({
+            endpoint: opts.endpoint,
+            serviceRoleKey: opts.serviceRoleKey,
+        });
+        const run = async (sql) => (await tenantDriver.query(sql));
+        let cachedSchema = null;
+        return {
+            async currentSchema() {
+                if (cachedSchema == null) {
+                    const rows = await run('SELECT DATABASE() AS db');
+                    cachedSchema = rows.length > 0 ? String(rows[0].db ?? '') : '';
+                }
+                return cachedSchema;
+            },
+            listTables: () => listTablesViaSql(run),
+            getColumns: (table) => getTableColumnsViaSql(run, table),
+            getIndexes: (table) => getTableIndexesViaSql(run, table),
+        };
+    }
+    const metaDriver = new MetaDriver({
+        endpoint: opts.endpoint,
+        anonKey: opts.anonKey,
+        serviceRoleKey: opts.serviceRoleKey,
+        tenantId: opts.tenantId,
+    });
+    const schema = opts.schema ?? 'public';
+    const useServiceRole = opts.useServiceRole ?? true;
+    return {
+        async currentSchema() {
+            return schema;
+        },
+        async listTables() {
+            const all = await metaDriver.listTables(useServiceRole);
+            return all.filter((t) => t.schema === schema);
+        },
+        getColumns: (table) => metaDriver.getTableColumns(table, schema, useServiceRole),
+        getIndexes: (table) => metaDriver.getTableIndexes(table, schema, useServiceRole),
+    };
+}
+//# sourceMappingURL=introspect.js.map