@polardbx/pxbaas 0.1.0-beta.2 → 0.1.0-beta.4

package/dist/commands/profile/import-env.js

@@ -1,27 +1,38 @@
 /**
  * pxbaas profile import <env-file>
  *
- * 直接从一个 Supabase/BaaS 惯例的 .env 文件导入单租户实例凭据并落库为 profile，
+ * 直接从一个 Supabase/BaaS 惯例的 .env 文件导入实例凭据并落库为 profile，
  * 免去把 URL / anon key / service key 拆出来再拼 stdin 登录命令。
  *
  * 与 login 共用 commitProfileCredentials（JWT 过期校验 + 租户一致性校验 + keyring 存储）。
  * 密钥来自文件而非 argv/shell history，因此该命令可被 agent 非交互执行。
- * 多租户实例暂不支持（env 文件只有 global keys）——见 resolveLoginFromEnv 的显式报错。
+ * 多租户实例按 DEFAULT_TENANT_ID + TENANT_* 建 multi-tenant profile；全局键不导入
+ * ——见 resolveLoginFromEnv。
+ *
+ * 失败分支（多租户但缺租户级凭据）不再只是拒绝：先做本地诊断，再用一次**临时只读**
+ * 探测判断本机能否打开租户管理面，据此分流到「管理员自助路径」或「申请清单」。
+ * 该分支绝不创建租户，也绝不把文件里的 DASHBOARD_* 落库。
  */
 import { readFile } from 'node:fs/promises';
-import { parseEnvText, resolveLoginFromEnv, commitProfileCredentials, formatSuccess, formatError, } from '../../credentials/index.js';
+import { CredentialStore, ProfileManager, commitProfileCredentials, computeFingerprint, formatError, formatSuccess, formatWarning, parseEnvText, resolveAdminFromEnv, resolveLoginFromEnv, TenantCredentialGapError, } from '../../credentials/index.js';
+import { diagnoseTenantCredentialGap, renderAdminPath, renderRequestChecklist, tryProbeFromEnv, } from '../../tenant/guide.js';
 export function registerProfileImportCommand(profileCmd, program) {
     profileCmd
         .command('import <env-file>')
-        .description('Import a single-tenant instance profile from a .env file (non-interactive)')
+        .description('Import an instance profile from a .env file (non-interactive)')
         .option('--name <profile>', 'Profile name to create/overwrite (default: --profile or "default")')
         .option('--intranet', 'Prefer SUPABASE_INTRANET_URL over the public endpoint')
+        .option('--with-admin', 'Also bind DASHBOARD_USERNAME/DASHBOARD_PASSWORD as platform admin credentials (verified against the gateway first)')
         .option('--json', 'Output in JSON format')
         .action(async (envFile, options) => {
         try {
             await handleProfileImport(envFile, options, program);
         }
         catch (error) {
+            if (error instanceof TenantCredentialGapError) {
+                await handleTenantGap(error, envFile, options, program);
+                return;
+            }
             const message = error instanceof Error ? error.message : String(error);
             if (options.json || program.opts().json) {
                 console.log(JSON.stringify({ status: 'error', message }, null, 2));
@@ -34,18 +45,10 @@ export function registerProfileImportCommand(profileCmd, program) {
     });
 }
 async function handleProfileImport(envFile, options, program) {
-    let text;
-    try {
-        text = await readFile(envFile, 'utf-8');
-    }
-    catch (err) {
-        const reason = err instanceof Error ? err.message : String(err);
-        throw new Error(`Failed to read env file '${envFile}': ${reason}`);
-    }
-    const env = parseEnvText(text);
+    const env = parseEnvText(await readEnvText(envFile));
     const fields = resolveLoginFromEnv(env, { intranet: options.intranet });
-    // profile 名优先级：--name > 全局 --profile > 'default'
-    const profileName = options.name || program.opts().profile || 'default';
+    // profile 名优先级：--name > --profile（尾置或前置）> 'default'
+    const profileName = options.name || options.profile || program.opts().profile || 'default';
     const result = await commitProfileCredentials({
         profileName,
         endpoint: fields.endpoint,
@@ -53,6 +56,12 @@ async function handleProfileImport(envFile, options, program) {
         anonKey: fields.anonKey,
         serviceRoleKey: fields.serviceRoleKey,
     });
+    const skippedGlobalKeys = fields.skippedGlobalKeys ?? [];
+    const globalKeysNote = skippedGlobalKeys.length > 0
+        ? `${skippedGlobalKeys.join(' / ')} present in the env file but NOT imported ` +
+            '(a profile stores tenant-level keys only; global keys are for platform-level ops)'
+        : undefined;
+    const adminOutcome = await maybeBindAdminCredentials(env, options, result.endpoint, profileName);
     if (options.json || program.opts().json) {
         const output = {
             status: 'success',
@@ -65,6 +74,9 @@ async function handleProfileImport(envFile, options, program) {
             sources: fields.sources,
             anonKeyFingerprint: result.anonKeyFingerprint,
             serviceKeyFingerprint: result.serviceKeyFingerprint,
+            globalKeysImported: skippedGlobalKeys.length === 0,
+            ...(globalKeysNote ? { skippedGlobalKeys, note: globalKeysNote } : {}),
+            ...(adminOutcome ? { admin: adminOutcome } : {}),
         };
         console.log(JSON.stringify(output, null, 2));
     }
@@ -72,10 +84,123 @@ async function handleProfileImport(envFile, options, program) {
         console.log(formatSuccess(`Imported profile from env file: ${profileName}`));
         console.log(`  Env file:    ${envFile}`);
         console.log(`  Endpoint:    ${result.endpoint}  (from ${fields.sources.endpoint})`);
-        console.log(`  Tenant ID:   ${result.tenantId || '(single-tenant)'}`);
+        console.log(`  Tenant ID:   ${result.tenantId || '(single-tenant)'}` +
+            (fields.sources.tenantId ? `  (from ${fields.sources.tenantId})` : ''));
         console.log(`  Mode:        ${result.mode}`);
         console.log(`  Anon Key:    ${result.anonKeyFingerprint}  (from ${fields.sources.anonKey})`);
         console.log(`  Service Key: ${result.serviceKeyFingerprint}  (from ${fields.sources.serviceRoleKey})`);
+        if (globalKeysNote) {
+            console.log(`  Note:        ${globalKeysNote}`);
+        }
+        if (adminOutcome?.note) {
+            console.log(`  Admin:       ${adminOutcome.note}`);
+        }
+    }
+}
+/**
+ * 管理凭据默认**不外吸**：文件里有 DASHBOARD_* 时只报告"存在但未导入"。
+ * 只有显式 --with-admin 才导入，且导入前必须先用它探通一次租户管理面——存进一把
+ * 不通的口令，会让后续每条管理命令都 401 且难以归因（与"拒绝保存过期密钥"同理）。
+ */
+async function maybeBindAdminCredentials(env, options, endpoint, profileName) {
+    const admin = resolveAdminFromEnv(env);
+    if (!admin) {
+        return options.withAdmin
+            ? { bound: false, note: 'no DASHBOARD_USERNAME/DASHBOARD_PASSWORD pair found in this env file' }
+            : undefined;
+    }
+    if (!options.withAdmin) {
+        return {
+            bound: false,
+            note: `${admin.sources.username} / ${admin.sources.password} present but NOT imported ` +
+                '(platform admin credentials are never absorbed silently; pass --with-admin to bind them)',
+        };
+    }
+    const probe = await tryProbeFromEnv(env, endpoint);
+    if (!probe?.adminCapable) {
+        return {
+            bound: false,
+            note: `--with-admin refused: these dashboard credentials could not open the tenant admin channel (${probe?.status ?? 'probe unavailable'}). Tenant keys were imported normally.`,
+        };
+    }
+    const store = new CredentialStore();
+    await store.setAdminCredentials(profileName, {
+        username: admin.username,
+        password: admin.password,
+        storedAt: new Date().toISOString(),
+    });
+    const profiles = new ProfileManager();
+    const profile = await profiles.getProfile(profileName);
+    if (profile)
+        await profiles.setProfile({ ...profile, adminCapable: true });
+    return {
+        bound: true,
+        note: `platform admin credentials bound (user=${admin.username.slice(0, 2)}***, pass=${computeFingerprint(admin.password)})`,
+    };
+}
+/** 多租户缺租户级凭据：诊断 → 分流指引 → 退出 1，并明确"什么都没创建、什么都没导入"。 */
+async function handleTenantGap(error, envFile, options, program) {
+    const env = parseEnvText(await readEnvText(envFile));
+    const diagnostics = diagnoseTenantCredentialGap(env, { envFile });
+    const probe = await tryProbeFromEnv(env, diagnostics.endpoint);
+    const adminRoute = Boolean(probe?.adminCapable);
+    if (options.json || program.opts().json) {
+        console.log(JSON.stringify({
+            status: 'error',
+            code: 'TENANT_CREDENTIAL_GAP',
+            message: error.message,
+            missing: error.missing,
+            nothingWasCreated: true,
+            nothingWasImported: true,
+            diagnostics,
+            adminChannel: probe
+                ? { status: probe.status, adminCapable: probe.adminCapable, detail: probe.detail }
+                : { status: 'no-dashboard-credentials-in-env', adminCapable: false },
+            route: adminRoute ? 'admin-self-service' : 'request-from-admin',
+            nextSteps: adminRoute
+                ? [
+                    `pxbaas tenant login --endpoint ${diagnostics.endpoint ?? '<gateway url>'}`,
+                    'pxbaas tenant ls --json',
+                    `pxbaas tenant keys ${diagnostics.defaultTenantId ?? '<tenant-id>'} --as-profile`,
+                    `pxbaas tenant keys ${diagnostics.defaultTenantId ?? '<tenant-id>'} --bundle ./<tenant>.pxbaas.env`,
+                ]
+                : [
+                    'Ask the instance administrator for this tenant’s anon key and service role key.',
+                    'A tenant-level key’s JWT payload carries a tenant_id claim; a platform-global key does not and cannot reach tenant resources.',
+                ],
+        }, null, 2));
+        process.exit(1);
+    }
+    console.error(formatError(error.message));
+    console.error('');
+    console.error('Diagnosis of this env file:');
+    console.error(`  MULTI_TENANT_MODE   = ${diagnostics.multiTenantMode ?? '(absent)'}`);
+    console.error(`  DEFAULT_TENANT_ID   = ${diagnostics.defaultTenantId ?? '(absent)'}`);
+    console.error(`  tenant-level keys   = ${diagnostics.tenantLevelKeysPresent.length ? diagnostics.tenantLevelKeysPresent.join(', ') : 'NONE'}`);
+    for (const finding of diagnostics.keyFindings) {
+        console.error(`  ${finding.variable.padEnd(26)} ${finding.fingerprint}  ${finding.note}`);
+    }
+    console.error(`  admin creds present = ${diagnostics.adminCredentialsPresent ? 'yes (NOT imported)' : 'no'}`);
+    console.error('');
+    console.error('Nothing was created and nothing was imported.');
+    console.error('');
+    if (adminRoute && probe) {
+        console.error(renderAdminPath(diagnostics, probe));
+    }
+    else {
+        console.error(renderRequestChecklist(diagnostics));
+    }
+    console.error('');
+    console.error(formatWarning('If you ARE the instance administrator, start with: pxbaas tenant login --endpoint <gateway url>'));
+    process.exit(1);
+}
+async function readEnvText(envFile) {
+    try {
+        return await readFile(envFile, 'utf-8');
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        throw new Error(`Failed to read env file '${envFile}': ${reason}`);
     }
 }
 //# sourceMappingURL=import-env.js.map

package/dist/commands/profile/import-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"import-env.js","sourceRoot":"","sources":["../../../src/commands/profile/import-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,wBAAwB,EACxB,aAAa,EACb,WAAW,GACZ,MAAM,4BAA4B,CAAC;AAQpC,MAAM,UAAU,4BAA4B,CAAC,UAAmB,EAAE,OAAgB;IAChF,UAAU;SACP,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,4EAA4E,CAAC;SACzF,MAAM,CAAC,kBAAkB,EAAE,oEAAoE,CAAC;SAChG,MAAM,CAAC,YAAY,EAAE,uDAAuD,CAAC;SAC7E,MAAM,CAAC,QAAQ,EAAE,uBAAuB,CAAC;SACzC,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,OAAsB,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;gBACxC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACrE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAe,EACf,OAAsB,EACtB,OAAgB;IAEhB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,MAAM,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAExE,iDAAiD;IACjD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,IAAI,SAAS,CAAC;IAExE,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;QAC5C,WAAW;QACX,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG;YACb,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,mCAAmC,WAAW,EAAE;YACzD,OAAO,EAAE,WAAW;YACpB,OAAO;YACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,iBAAiB;YAC9C,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;SACpD,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,mCAAmC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,QAAQ,WAAW,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACpF,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,QAAQ,IAAI,iBAAiB,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,kBAAkB,WAAW,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC;QAC7F,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,qBAAqB,WAAW,MAAM,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC,CAAC;IACzG,CAAC;AACH,CAAC"}
+{"version":3,"file":"import-env.js","sourceRoot":"","sources":["../../../src/commands/profile/import-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EACL,eAAe,EACf,cAAc,EACd,wBAAwB,EACxB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,GAEzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,2BAA2B,EAC3B,eAAe,EACf,sBAAsB,EACtB,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAW/B,MAAM,UAAU,4BAA4B,CAAC,UAAmB,EAAE,OAAgB;IAChF,UAAU;SACP,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,+DAA+D,CAAC;SAC5E,MAAM,CAAC,kBAAkB,EAAE,oEAAoE,CAAC;SAChG,MAAM,CAAC,YAAY,EAAE,uDAAuD,CAAC;SAC7E,MAAM,CACL,cAAc,EACd,oHAAoH,CACrH;SACA,MAAM,CAAC,QAAQ,EAAE,uBAAuB,CAAC;SACzC,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,OAAsB,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;gBAC9C,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;gBACxC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACrE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAe,EACf,OAAsB,EACtB,OAAgB;IAEhB,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAExE,oDAAoD;IACpD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,IAAI,SAAS,CAAC;IAE3F,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;QAC5C,WAAW;QACX,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;IACzD,MAAM,cAAc,GAClB,iBAAiB,CAAC,MAAM,GAAG,CAAC;QAC1B,CAAC,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,4CAA4C;YAC5E,mFAAmF;QACrF,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAEjG,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG;YACb,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,mCAAmC,WAAW,EAAE;YACzD,OAAO,EAAE,WAAW;YACpB,OAAO;YACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,iBAAiB;YAC9C,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;YACnD,kBAAkB,EAAE,iBAAiB,CAAC,MAAM,KAAK,CAAC;YAClD,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,mCAAmC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,QAAQ,WAAW,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACpF,OAAO,CAAC,GAAG,CACT,kBAAkB,MAAM,CAAC,QAAQ,IAAI,iBAAiB,EAAE;YACtD,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CACzE,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,kBAAkB,WAAW,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC;QAC7F,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,qBAAqB,WAAW,MAAM,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC,CAAC;QACvG,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,kBAAkB,cAAc,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,YAAY,EAAE,IAAI,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,kBAAkB,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;AACH,CAAC;AAOD;;;;GAIG;AACH,KAAK,UAAU,yBAAyB,CACtC,GAAc,EACd,OAAsB,EACtB,QAAgB,EAChB,WAAmB;IAEnB,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,OAAO,CAAC,SAAS;YACtB,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,sEAAsE,EAAE;YAChG,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,IAAI,EACF,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,4BAA4B;gBACjF,0FAA0F;SAC7F,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC;QACzB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,8FAA8F,KAAK,EAAE,MAAM,IAAI,mBAAmB,wCAAwC;SACjL,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,MAAM,KAAK,CAAC,mBAAmB,CAAC,WAAW,EAAE;QAC3C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,OAAO;QAAE,MAAM,QAAQ,CAAC,UAAU,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3E,OAAO;QACL,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,0CAA0C,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG;KAC7H,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,KAAK,UAAU,eAAe,CAC5B,KAA+B,EAC/B,OAAe,EACf,OAAsB,EACtB,OAAgB;IAEhB,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,2BAA2B,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAEhD,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACxC,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;YACE,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,iBAAiB,EAAE,IAAI;YACvB,kBAAkB,EAAE,IAAI;YACxB,WAAW;YACX,YAAY,EAAE,KAAK;gBACjB,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;gBAClF,CAAC,CAAC,EAAE,MAAM,EAAE,iCAAiC,EAAE,YAAY,EAAE,KAAK,EAAE;YACtE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,oBAAoB;YAC/D,SAAS,EAAE,UAAU;gBACnB,CAAC,CAAC;oBACE,kCAAkC,WAAW,CAAC,QAAQ,IAAI,eAAe,EAAE;oBAC3E,yBAAyB;oBACzB,sBAAsB,WAAW,CAAC,eAAe,IAAI,aAAa,eAAe;oBACjF,sBAAsB,WAAW,CAAC,eAAe,IAAI,aAAa,iCAAiC;iBACpG;gBACH,CAAC,CAAC;oBACE,iFAAiF;oBACjF,+HAA+H;iBAChI;SACN,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC7C,OAAO,CAAC,KAAK,CAAC,2BAA2B,WAAW,CAAC,eAAe,IAAI,UAAU,EAAE,CAAC,CAAC;IACtF,OAAO,CAAC,KAAK,CAAC,2BAA2B,WAAW,CAAC,eAAe,IAAI,UAAU,EAAE,CAAC,CAAC;IACtF,OAAO,CAAC,KAAK,CACX,2BACE,WAAW,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAC9F,EAAE,CACH,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,WAAW,EAAE,CAAC;QAC9C,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,2BAA2B,WAAW,CAAC,uBAAuB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9G,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC/D,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAElB,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CACX,aAAa,CAAC,iGAAiG,CAAC,CACjH,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAe;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,MAAM,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC"}

package/dist/commands/profile/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/profile/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAiD7D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/profile/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAiD7D"}

package/dist/commands/profile/index.js

@@ -1,4 +1,4 @@
-import { ProfileManager, formatSuccess, formatError, } from '../../credentials/index.js';
+import { CredentialStore, ProfileManager, formatSuccess, formatError, } from '../../credentials/index.js';
 import { registerProfileImportCommand } from './import-env.js';
 export function registerProfileCommand(program) {
     const profileCmd = program
@@ -98,15 +98,27 @@ async function handleProfileRm(name, program) {
     if (!deleted) {
         throw new Error(`Profile not found: ${name}`);
     }
+    // 删 profile 必须连带删掉它的敏感项，否则租户密钥/管理凭据会变成钥匙串里
+    // 既看不见也删不掉的孤儿（profile 名已经不存在，再没有命令能定位它们）。
+    const secrets = await new CredentialStore().deleteAllForProfile(name);
     const output = {
         profile: name,
         status: 'removed',
+        credentialsRemoved: secrets.credentialsRemoved,
+        adminCredentialsRemoved: secrets.adminRemoved,
     };
     if (program.opts().json) {
         console.log(JSON.stringify(output, null, 2));
     }
     else {
         console.log(formatSuccess(`Removed profile: ${name}`));
+        if (secrets.credentialsRemoved || secrets.adminRemoved) {
+            const what = [
+                secrets.credentialsRemoved ? 'API keys' : null,
+                secrets.adminRemoved ? 'dashboard credentials' : null,
+            ].filter(Boolean).join(' and ');
+            console.log(`  Also removed stored ${what}.`);
+        }
     }
 }
 //# sourceMappingURL=index.js.map

package/dist/commands/profile/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/profile/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,cAAc,EACd,aAAa,EACb,WAAW,GACZ,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAE/D,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,UAAU,GAAG,OAAO;SACvB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,sCAAsC,CAAC,CAAC;IAEvD,aAAa;IACb,UAAU;SACP,OAAO,CAAC,IAAI,CAAC;SACb,WAAW,CAAC,mBAAmB,CAAC;SAChC,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,qBAAqB;IACrB,UAAU;SACP,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,oBAAoB;IACpB,UAAU;SACP,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,kBAAkB,CAAC;SAC/B,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,4BAA4B;IAC5B,4BAA4B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAgB;IAC7C,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,YAAY,EAAE,CAAC;IACrD,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,iBAAiB,EAAE,CAAC;IAEhE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;QAC1E,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,iBAAiB;QACzC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,CAAC,CAAC,IAAI;KACzC,CAAC,CAAC,CAAC;IAEJ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACxC,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAgB;IAC5D,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,QAAQ;KACjB,CAAC;IAEF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,OAAgB;IAC3D,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAEzD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,SAAS;KAClB,CAAC;IAEF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/profile/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,cAAc,EACd,aAAa,EACb,WAAW,GACZ,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAE/D,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,UAAU,GAAG,OAAO;SACvB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,sCAAsC,CAAC,CAAC;IAEvD,aAAa;IACb,UAAU;SACP,OAAO,CAAC,IAAI,CAAC;SACb,WAAW,CAAC,mBAAmB,CAAC;SAChC,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,qBAAqB;IACrB,UAAU;SACP,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,oBAAoB;IACpB,UAAU;SACP,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,kBAAkB,CAAC;SAC/B,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,4BAA4B;IAC5B,4BAA4B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAgB;IAC7C,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,YAAY,EAAE,CAAC;IACrD,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,iBAAiB,EAAE,CAAC;IAEhE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;QAC1E,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,iBAAiB;QACzC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,CAAC,CAAC,IAAI;KACzC,CAAC,CAAC,CAAC;IAEJ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACxC,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAgB;IAC5D,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,QAAQ;KACjB,CAAC;IAEF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,OAAgB;IAC3D,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAEzD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,2CAA2C;IAC3C,0CAA0C;IAC1C,MAAM,OAAO,GAAG,MAAM,IAAI,eAAe,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAEtE,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,SAAS;QACjB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,uBAAuB,EAAE,OAAO,CAAC,YAAY;KAC9C,CAAC;IAEF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACvD,MAAM,IAAI,GAAG;gBACX,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;gBAC9C,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI;aACtD,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,GAAG,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/commands/storage/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+D9D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8DpC,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmF9D"}

package/dist/commands/storage/index.js

@@ -1,17 +1,75 @@
+import { statSync } from 'node:fs';
+import { stat } from 'node:fs/promises';
+import { extname, isAbsolute, resolve } from 'node:path';
 import { StorageDriver } from '@polardbx/pxbaas-client';
 import { CredentialStore, ProfileManager, formatSuccess, formatError, } from '../../credentials/index.js';
+// Common static-asset types for `storage cp` uploads; anything unknown falls
+// back to application/octet-stream (server stores bytes as-is either way).
+const CONTENT_TYPES = {
+    '.html': 'text/html; charset=utf-8',
+    '.htm': 'text/html; charset=utf-8',
+    '.css': 'text/css; charset=utf-8',
+    '.js': 'text/javascript; charset=utf-8',
+    '.mjs': 'text/javascript; charset=utf-8',
+    '.json': 'application/json',
+    '.map': 'application/json',
+    '.txt': 'text/plain; charset=utf-8',
+    '.md': 'text/markdown; charset=utf-8',
+    '.csv': 'text/csv; charset=utf-8',
+    '.xml': 'application/xml',
+    '.svg': 'image/svg+xml',
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.webp': 'image/webp',
+    '.ico': 'image/x-icon',
+    '.pdf': 'application/pdf',
+    '.wasm': 'application/wasm',
+    '.woff': 'font/woff',
+    '.woff2': 'font/woff2',
+    '.ttf': 'font/ttf',
+};
+function inferContentType(filePath) {
+    return CONTENT_TYPES[extname(filePath).toLowerCase()] ?? 'application/octet-stream';
+}
+/**
+ * Classify a `cp` operand: an absolute path, a `./`-style path or anything that
+ * exists on the local filesystem is local; everything else is a remote
+ * `bucket/key` reference. Checked first so a local file named like a bucket key
+ * (e.g. `report.txt` in cwd) is uploaded rather than read from Storage.
+ */
+function isLocalRef(ref) {
+    if (isAbsolute(ref) || ref.startsWith('./') || ref.startsWith('../') || ref === '.' || ref === '..') {
+        return true;
+    }
+    try {
+        statSync(ref);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 export function registerStorageCommands(program) {
     const storageCmd = program
         .command('storage')
         .description('Storage management');
+    // `--debug` is only declared on the program, so subcommand opts() never carry it.
+    const isDebug = () => Boolean(program.opts().debug);
     // storage ls [bucket/path]
     storageCmd
         .command('ls [path]')
         .description('List buckets or objects in a bucket')
+        .option('--limit <n>', 'Maximum number of objects to list', '1000')
         .option('--json', 'Output in JSON format')
         .action(async (path, options) => {
         try {
-            await handleStorageLs(path, { ...options, json: options.json || program.opts().json });
+            await handleStorageLs(path, {
+                ...options,
+                debug: isDebug(),
+                json: options.json || program.opts().json,
+            });
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
@@ -24,9 +82,15 @@ export function registerStorageCommands(program) {
         .command('cp <src> <dst>')
         .description('Copy objects (local<->remote or remote<->remote)')
         .option('--recursive', 'Copy recursively')
+        .option('--content-type <mime>', 'Override the Content-Type inferred from the file extension')
+        .option('--json', 'Output in JSON format')
         .action(async (src, dst, options) => {
         try {
-            await handleStorageCp(src, dst, options);
+            await handleStorageCp(src, dst, {
+                ...options,
+                debug: isDebug(),
+                json: options.json || program.opts().json,
+            });
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
@@ -40,7 +104,7 @@ export function registerStorageCommands(program) {
         .description('Move/rename objects (remote only)')
         .action(async (src, dst) => {
         try {
-            await handleStorageMv(src, dst);
+            await handleStorageMv(src, dst, { debug: isDebug() });
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
@@ -55,7 +119,7 @@ export function registerStorageCommands(program) {
         .option('--recursive', 'Delete recursively')
         .action(async (path, options) => {
         try {
-            await handleStorageRm(path, options);
+            await handleStorageRm(path, { ...options, debug: isDebug() });
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
@@ -82,6 +146,7 @@ async function handleStorageLs(path, options) {
         endpoint: currentProfile.endpoint,
         serviceRoleKey: credentials.serviceRoleKey,
         tenantId: currentProfile.tenantId,
+        debug: options.debug,
     });
     // Parse path
     if (!path) {
@@ -109,8 +174,11 @@ async function handleStorageLs(path, options) {
         // List objects in bucket
         const parts = path.split('/');
         const bucket = parts[0];
+        // Keep the empty string: the Storage list schema requires `prefix`, so
+        // `prefix || undefined` made every bucket-root listing fail with HTTP 400.
         const prefix = parts.slice(1).join('/');
-        const objects = await storageDriver.listObjects(bucket, prefix || undefined);
+        const limit = parseLimit(options.limit);
+        const objects = await storageDriver.listObjects(bucket, prefix, limit);
         if (options.json) {
             console.log(JSON.stringify({ bucket, prefix, count: objects.length, objects }, null, 2));
         }
@@ -130,9 +198,141 @@ async function handleStorageLs(path, options) {
     }
 }
 async function handleStorageCp(src, dst, options) {
-    throw new Error('storage cp not yet implemented');
+    if (options.recursive) {
+        // Fail loudly: silently copying only the first entry would look like success.
+        throw new Error('storage cp --recursive is not implemented yet. Copy files one by one (directories are not traversed).');
+    }
+    const srcIsLocal = isLocalRef(src);
+    // A remote reference is always `bucket/key`, so a slash-free operand can only be
+    // a local file — including a download target that does not exist yet.
+    const dstIsLocal = isLocalRef(dst) || !dst.includes('/');
+    if (!srcIsLocal && !src.includes('/')) {
+        throw new Error(`Local source not found: ${src}. Remote references must look like bucket/key (e.g., bkt/a.txt).`);
+    }
+    if (srcIsLocal && dstIsLocal) {
+        if (!dst.includes('/')) {
+            throw new Error(`Destination "${dst}" is not a remote reference. Expected bucket/key (e.g., bkt/a.txt): Storage requires an object key.`);
+        }
+        throw new Error('Both source and destination are local paths; storage cp needs exactly one remote side (bucket/key).');
+    }
+    const storageDriver = await createStorageDriver(options.debug);
+    if (!srcIsLocal && !dstIsLocal) {
+        // Remote -> remote reuses the verified move endpoint; `POST /object/copy`
+        // exists in the driver but is not exercised by this deployment's regression.
+        const [srcBucket, srcPath] = splitRemote(src);
+        const [dstBucket, dstPath] = splitRemote(dst);
+        await storageDriver.move(srcBucket, srcPath, dstBucket, dstPath);
+        if (options.json) {
+            console.log(JSON.stringify({ operation: 'remote-copy', source: src, destination: dst, viaMove: true }, null, 2));
+        }
+        else {
+            console.log(formatSuccess(`Copied ${src} -> ${dst} (remote-to-remote reuses move; the source object is removed)`));
+        }
+        return;
+    }
+    if (srcIsLocal) {
+        await uploadLocalFile(storageDriver, src, dst, options);
+    }
+    else {
+        await downloadRemoteObject(storageDriver, src, dst, options);
+    }
+}
+/** Split `bucket/key/...`; an object key is mandatory (a bare bucket name is ambiguous). */
+function splitRemote(ref) {
+    const parts = ref.split('/');
+    if (parts.length < 2 || parts[1] === '') {
+        throw new Error(`Remote path must include bucket and object key (e.g., bucket/path/to/file), got: ${ref}`);
+    }
+    return [parts[0], parts.slice(1).join('/')];
+}
+async function uploadLocalFile(storageDriver, localPath, dst, options) {
+    const [bucket, remotePath] = splitRemote(dst);
+    const info = await stat(localPath).catch(() => {
+        throw new Error(`Local source not found or not readable: ${localPath}`);
+    });
+    if (!info.isFile()) {
+        throw new Error(`Local source is not a file: ${localPath}. Directory upload needs --recursive, which is not implemented yet.`);
+    }
+    await assertBucketExists(storageDriver, bucket);
+    const contentType = options.contentType ?? inferContentType(localPath);
+    const absolute = resolve(localPath);
+    // Print the intent BEFORE the request so a slow/failed upload still shows what was sent.
+    console.log(`Uploading ${absolute} -> ${bucket}/${remotePath} (${info.size} bytes, Content-Type: ${contentType})`);
+    const result = await storageDriver.upload(bucket, remotePath, absolute, contentType);
+    if (options.json) {
+        console.log(JSON.stringify({
+            operation: 'upload',
+            source: absolute,
+            bucket,
+            key: remotePath,
+            bytes: info.size,
+            contentType,
+            result,
+        }, null, 2));
+        return;
+    }
+    console.log(formatSuccess(`Uploaded ${info.size} byte(s) to ${bucket}/${remotePath}`));
+    if (result.Key) {
+        // Multi-tenant: the server prefixes the stored key with `<tenantId>/` itself.
+        console.log(`  Key: ${result.Key}`);
+    }
+}
+async function downloadRemoteObject(storageDriver, src, localPath, options) {
+    const [bucket, remotePath] = splitRemote(src);
+    const absolute = resolve(localPath);
+    const existing = await stat(absolute).catch(() => undefined);
+    if (existing?.isDirectory()) {
+        throw new Error(`Local destination is a directory: ${absolute}. Provide a file path.`);
+    }
+    console.log(`Downloading ${bucket}/${remotePath} -> ${absolute}`);
+    const bytes = await storageDriver.download(bucket, remotePath, absolute);
+    if (options.json) {
+        console.log(JSON.stringify({
+            operation: 'download',
+            source: `${bucket}/${remotePath}`,
+            destination: absolute,
+            bytes,
+        }, null, 2));
+        return;
+    }
+    console.log(formatSuccess(`Downloaded ${bytes} byte(s) to ${absolute}`));
+}
+/** The CLI has no bucket-create command, so point the user at the way out instead of a bare 404. */
+async function assertBucketExists(storageDriver, bucket) {
+    const buckets = await storageDriver.listBuckets();
+    if (buckets.some((b) => b.name === bucket))
+        return;
+    const known = buckets.map((b) => b.name).join(', ') || '(none)';
+    throw new Error(`Bucket "${bucket}" does not exist. Create it first (POST /storage/v1/bucket with {"name":"${bucket}"}); known buckets: ${known}`);
+}
+async function createStorageDriver(debug) {
+    const profileManager = new ProfileManager();
+    const currentProfile = await profileManager.getCurrentProfile();
+    if (!currentProfile) {
+        throw new Error('No active profile. Use "pxbaas login" to authenticate first.');
+    }
+    const credentialStore = new CredentialStore();
+    const credentials = await credentialStore.getCredentials(currentProfile.name);
+    if (!credentials) {
+        throw new Error(`No credentials found for profile: ${currentProfile.name}. Use "pxbaas login" to authenticate.`);
+    }
+    return new StorageDriver({
+        endpoint: currentProfile.endpoint,
+        serviceRoleKey: credentials.serviceRoleKey,
+        tenantId: currentProfile.tenantId,
+        debug,
+    });
+}
+function parseLimit(raw) {
+    if (raw === undefined)
+        return 1000;
+    const limit = Number(raw);
+    if (!Number.isInteger(limit) || limit <= 0) {
+        throw new Error(`--limit must be a positive integer, got: ${raw}`);
+    }
+    return limit;
 }
-async function handleStorageMv(src, dst) {
+async function handleStorageMv(src, dst, options = {}) {
     // Get current profile
     const profileManager = new ProfileManager();
     const currentProfile = await profileManager.getCurrentProfile();
@@ -160,6 +360,7 @@ async function handleStorageMv(src, dst) {
         endpoint: currentProfile.endpoint,
         serviceRoleKey: credentials.serviceRoleKey,
         tenantId: currentProfile.tenantId,
+        debug: options.debug,
     });
     // Move object
     await storageDriver.move(srcBucket, srcPath, dstBucket, dstPath);
@@ -190,6 +391,7 @@ async function handleStorageRm(path, options) {
         endpoint: currentProfile.endpoint,
         serviceRoleKey: credentials.serviceRoleKey,
         tenantId: currentProfile.tenantId,
+        debug: options.debug,
     });
     // Delete object
     await storageDriver.delete(bucket, objectPath);