@polardbx/pxbaas 0.1.0-beta.3 → 0.1.0-beta.5

package/dist/commands/tenant/index.js

@@ -0,0 +1,667 @@
+/**
+ * `pxbaas tenant` — 多租户实例的**平台运营侧**命令组。
+ *
+ * 与数据面命令的分工：`db` / `data` / `app` 等用的是租户级 anon / service_role key；
+ * 本命令组用的是实例 dashboard 的 HTTP Basic 凭据（DASHBOARD_USERNAME / PASSWORD），
+ * 二者存在凭据存储的两本独立账上（`credentials/<profile>` vs `admin/<profile>`），
+ * 数据面命令读不到管理凭据，管理命令也不需要租户密钥。
+ *
+ * 三条不可让的纪律：
+ * 1. 管理凭据只能来自 TTY 掩码输入或 stdin 管道，**绝不进 argv**（`--dashboard-*` 已被
+ *    assertNoKeyArgs 拒绝）。
+ * 2. 输出的租户信息一律经驱动层脱敏投影，**永不含 `jwt_secret`**（母密钥）；密钥值只在
+ *    写钥匙串或写 0600 交付包时经手，不打印、不进 `--json`。
+ * 3. 建租户 / 补密钥等写操作先预览再授权（`--dry-run` / `--yes` / `--confirm`）。
+ *    其中「同名软删租户会被复活并重置密钥」属破坏性动作，必须 `--reactivate` 显式确认。
+ */
+import { randomBytes } from 'node:crypto';
+import inquirer from 'inquirer';
+import { TenantAdminDriver, TenantAdminError } from '@polardbx/pxbaas-client';
+import { assertNoKeyArgs, assertTty, commitProfileCredentials, computeFingerprint, CredentialStore, formatError, formatSuccess, formatWarning, ProfileManager, readStdinLines, } from '../../credentials/index.js';
+import { loadAdminContext, probeTenantAdmin } from '../../tenant/probe.js';
+import { listHandoffs, writeBundle } from '../../tenant/bundle.js';
+import { verifyTenantUsable } from '../../tenant/verify.js';
+/** 与平台侧 sanitizeForIdentifier 的可用字符集保持交集，避免建出连库名都非法的租户。 */
+const TENANT_ID_RE = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
+const isJson = (options, program) => Boolean(options.json || program.opts().json);
+export function registerTenantCommands(program) {
+    const tenantCmd = program
+        .command('tenant')
+        .description('Platform-operator tenant management on a multi-tenant instance (dashboard credentials)');
+    tenantCmd
+        .command('login')
+        .description('Bind instance dashboard credentials to a profile (interactive by default; --user-stdin/--password-stdin for piped use)')
+        .option('--endpoint <url>', 'BaaS gateway URL (defaults to the current profile endpoint)')
+        .option('--user <name>', 'Dashboard username (not secret; the password must never be an argument)')
+        .option('--user-stdin', 'Read dashboard username from stdin (pair with --password-stdin)')
+        .option('--password-stdin', 'Read dashboard password from stdin (pair with --user-stdin)')
+        .option('--json', 'Output in JSON format')
+        .action(async (options) => {
+        try {
+            await handleTenantLogin(options, program);
+        }
+        catch (error) {
+            fail(error, isJson(options, program));
+        }
+    });
+    tenantCmd
+        .command('logout')
+        .description('Remove the dashboard credentials bound to a profile (tenant keys are untouched)')
+        .option('--json', 'Output in JSON format')
+        .action(async (options) => {
+        try {
+            await handleTenantLogout(options, program);
+        }
+        catch (error) {
+            fail(error, isJson(options, program));
+        }
+    });
+    tenantCmd
+        .command('probe')
+        .description('Read-only check: does this profile have the tenant admin channel?')
+        .option('--json', 'Output in JSON format')
+        .action(async (options) => {
+        try {
+            const ctx = await loadAdminContext({ profile: options.profile });
+            const result = await probeTenantAdmin(ctx);
+            if (isJson(options, program)) {
+                console.log(JSON.stringify({
+                    status: result.status,
+                    adminCapable: result.adminCapable,
+                    endpoint: result.endpoint,
+                    multiTenantMode: result.multiTenantMode,
+                    tenantCount: result.tenants?.length,
+                    detail: result.detail,
+                    errorCode: result.errorCode,
+                }, null, 2));
+                return;
+            }
+            const badge = result.adminCapable ? formatSuccess('admin channel OK') : formatWarning(result.status);
+            console.log(`${badge}  ${result.detail}`);
+            if (result.tenants?.length) {
+                console.log(`  Tenants visible: ${result.tenants.length}`);
+            }
+        }
+        catch (error) {
+            fail(error, isJson(options, program));
+        }
+    });
+    tenantCmd
+        .command('ls')
+        .description('List tenants on the instance (redacted: never includes key material)')
+        .option('--status <status>', 'Filter by active | suspended | deleting | deleted')
+        .option('--json', 'Output in JSON format')
+        .action(async (options) => {
+        try {
+            const ctx = await loadAdminContext({ profile: options.profile });
+            const driver = new TenantAdminDriver(ctx);
+            const result = await driver.list(options.status);
+            if (isJson(options, program)) {
+                console.log(JSON.stringify({ multiTenantMode: result.multiTenantMode, count: result.tenants.length, tenants: result.tenants }, null, 2));
+                return;
+            }
+            if (result.tenants.length === 0) {
+                console.log('No tenants on this instance. Create one: pxbaas tenant create <tenant-id>');
+                return;
+            }
+            console.log(`${result.tenants.length} tenant(s):`);
+            console.log('');
+            for (const tenant of result.tenants) {
+                console.log(`  ${tenant.tenantId}  [${tenant.status}]  plan=${tenant.plan ?? '-'}  db=${tenant.dbName ?? '-'}` +
+                    (tenant.hasAnonKey ? '' : '  ⚠ missing anon key (pxbaas tenant repair-keys)') +
+                    (tenant.softDeleted ? '  (soft-deleted: same-name create would reset its keys)' : ''));
+            }
+        }
+        catch (error) {
+            fail(error, isJson(options, program));
+        }
+    });
+    tenantCmd
+        .command('create [tenant-id]')
+        .description('Provision a new tenant (server generates jwt_secret + signs the per-tenant keys). Shows a plan and requires authorization.')
+        .option('--generate-id', 'Auto-generate a tenant id (t_<hex>) instead of passing one')
+        .option('--plan <plan>', 'Plan label passed to the platform', 'free')
+        .option('--display-name <name>', 'Display name (defaults to the tenant id)')
+        .option('--retention-days <n>', 'Pass through to the platform retention column')
+        .option('--reactivate', 'REQUIRED to reuse a soft-deleted tenant id (it resets that tenant’s jwt_secret and keys)')
+        .option('--dry-run', 'Show the plan without creating anything')
+        .option('--yes', 'Authorize non-interactively (skip the confirm prompt)')
+        .option('--as-profile [name]', 'Bind the new tenant keys into a profile (name defaults to the tenant id)')
+        .option('--bundle <file>', 'Write a 0600 tenant access bundle to hand to the end user')
+        .option('--intranet <url>', 'Also embed SUPABASE_INTRANET_URL in the bundle (same-VPC users)')
+        .option('--overwrite', 'Allow --bundle to replace an existing bundle file')
+        .option('--json', 'Output in JSON format')
+        .action(async (tenantId, options) => {
+        try {
+            await handleTenantCreate(tenantId, options, program);
+        }
+        catch (error) {
+            fail(error, isJson(options, program));
+        }
+    });
+    tenantCmd
+        .command('keys <tenant-id>')
+        .description('Fetch a tenant’s per-tenant keys into the keyring (--as-profile) or an access bundle (--bundle). Never prints plaintext.')
+        .option('--as-profile [name]', 'Bind the keys into a profile (name defaults to the tenant id)')
+        .option('--bundle <file>', 'Write a 0600 tenant access bundle to hand to the end user')
+        .option('--intranet <url>', 'Also embed SUPABASE_INTRANET_URL in the bundle')
+        .option('--overwrite', 'Allow --bundle to replace an existing bundle file')
+        .option('--json', 'Output in JSON format')
+        .action(async (tenantId, options) => {
+        try {
+            await handleTenantKeys(tenantId, options, program);
+        }
+        catch (error) {
+            fail(error, isJson(options, program));
+        }
+    });
+    tenantCmd
+        .command('repair-keys')
+        .description('Backfill the two API keys for tenants whose jwt_secret exists but keys are NULL (idempotent; not a rotation)')
+        .option('--confirm', 'Actually run the backfill (required)')
+        .option('--json', 'Output in JSON format')
+        .action(async (options) => {
+        try {
+            await handleTenantRepairKeys(options, program);
+        }
+        catch (error) {
+            fail(error, isJson(options, program));
+        }
+    });
+    tenantCmd
+        .command('handoffs')
+        .description('List locally recorded access-bundle handoffs (fingerprints and hashes only, no key material)')
+        .option('--json', 'Output in JSON format')
+        .action(async (options) => {
+        try {
+            const records = await listHandoffs();
+            if (isJson(options, program)) {
+                console.log(JSON.stringify({ count: records.length, records }, null, 2));
+                return;
+            }
+            if (records.length === 0) {
+                console.log('No bundles have been generated from this machine yet.');
+                return;
+            }
+            for (const record of records) {
+                console.log(`  ${record.generatedAt}  ${record.tenantId}  anon=${record.anonFingerprint}  service=${record.serviceFingerprint}  → ${record.bundlePath}`);
+            }
+        }
+        catch (error) {
+            fail(error, isJson(options, program));
+        }
+    });
+}
+async function handleTenantLogin(options, program) {
+    // 口令绝不允许出现在 argv（--dashboard-password / --admin-password 亦被同一守卫拦截）
+    assertNoKeyArgs(process.argv);
+    const stdinMode = Boolean(options.userStdin) || Boolean(options.passwordStdin);
+    if (stdinMode && !(options.userStdin && options.passwordStdin)) {
+        throw new Error('Both --user-stdin and --password-stdin must be specified together');
+    }
+    let endpoint = options.endpoint;
+    let username;
+    let password;
+    const profiles = new ProfileManager();
+    const existing = await resolveTargetProfile(profiles, options, program);
+    if (stdinMode) {
+        if (!endpoint && !existing) {
+            throw new Error('--endpoint is required when using --user-stdin/--password-stdin and no profile to inherit it from');
+        }
+        const [userLine, passwordLine] = await readStdinLines(2, 'dashboard username on first line, dashboard password on second line');
+        username = userLine;
+        password = passwordLine;
+    }
+    else {
+        assertTty();
+        const answers = await inquirer.prompt([
+            {
+                type: 'input',
+                name: 'endpoint',
+                message: 'BaaS gateway URL:',
+                default: options.endpoint || existing?.endpoint || 'http://localhost:8000',
+                validate: (input) => {
+                    if (!input.trim())
+                        return 'Endpoint is required';
+                    if (!input.startsWith('http://') && !input.startsWith('https://')) {
+                        return 'Endpoint must start with http:// or https://';
+                    }
+                    // 管理面只能走网关：Studio 端口自身不鉴权，绕过去等于无认证取密钥。
+                    if (/:(3100|3000|9999|5000|8085)\b/.test(input)) {
+                        return 'Use the Kong gateway URL (typically :8000); component ports do not protect this API';
+                    }
+                    return true;
+                },
+            },
+            {
+                type: 'input',
+                name: 'username',
+                message: 'Dashboard username:',
+                default: options.user || '',
+                validate: (input) => (input.trim() ? true : 'Dashboard username is required'),
+            },
+            { type: 'password', name: 'password', message: 'Dashboard password:', mask: '*' },
+        ]);
+        endpoint = answers.endpoint;
+        username = answers.username;
+        password = answers.password;
+    }
+    endpoint = (endpoint ?? existing?.endpoint ?? 'http://localhost:8000').replace(/\/+$/, '');
+    if (!username || !password) {
+        throw new Error('Dashboard username and password are both required');
+    }
+    // 先探测再落库：存一把不通的管理口令，比拒绝登录更糟（后续每条命令都 401 且难归因）。
+    const probe = await probeTenantAdmin({ endpoint, username, password });
+    if (!probe.adminCapable) {
+        throw new Error(`Not saved. These dashboard credentials could not open the tenant admin channel (${probe.status}${probe.errorCode ? `, ${probe.errorCode}` : ''}): ${probe.detail}`);
+    }
+    const profileName = existing?.name ?? options.profile ?? program.opts().profile ?? 'default';
+    const profile = existing
+        ? { ...existing, adminCapable: true, updatedAt: new Date().toISOString() }
+        : {
+            name: profileName,
+            endpoint,
+            // 管理专用 profile：不带租户级密钥，mode 保持 single-tenant 以免数据面命令误以为已就绪。
+            mode: 'single-tenant',
+            adminCapable: true,
+            createdAt: new Date().toISOString(),
+            updatedAt: new Date().toISOString(),
+        };
+    if (!existing)
+        profile.endpoint = endpoint;
+    await profiles.setProfile(profile);
+    const store = new CredentialStore();
+    await store.setAdminCredentials(profileName, {
+        username,
+        password,
+        storedAt: new Date().toISOString(),
+    });
+    const output = {
+        status: 'success',
+        profile: profileName,
+        endpoint,
+        adminUser: maskUser(username),
+        adminPasswordFingerprint: computeFingerprint(password),
+        adminCapable: true,
+        multiTenantMode: probe.multiTenantMode,
+        tenantCount: probe.tenants?.length ?? 0,
+        ...(existing ? {} : { note: 'Created an admin-only profile: it holds no tenant API keys, so data-plane commands on it will ask for pxbaas login.' }),
+    };
+    if (isJson(options, program)) {
+        console.log(JSON.stringify(output, null, 2));
+        return;
+    }
+    console.log(formatSuccess(`Dashboard credentials stored for profile: ${profileName}`));
+    console.log(`  Endpoint:    ${endpoint}`);
+    console.log(`  Admin user:  ${output.adminUser}`);
+    console.log(`  Admin pass:  ${output.adminPasswordFingerprint}`);
+    console.log(`  Probe:       ${probe.detail}`);
+    if (output.note)
+        console.log(formatWarning(output.note));
+}
+/**
+ * `tenant login` 允许把管理凭据绑到尚不存在的 profile，所以这里必须按名字查（查不到
+ * 返回 null）而不能退回 getCurrentProfile()——后者对 `--profile` 指向的未知名字是硬抛错。
+ * 尾置的 `--profile x` 由 commander 记在 program 上而非叶子上，两处都要看。
+ */
+async function resolveTargetProfile(profiles, options, program) {
+    const requested = options.profile ?? program.opts().profile;
+    if (requested)
+        return await profiles.getProfile(requested);
+    return await profiles.getCurrentProfile();
+}
+// --------------------------------------------------------------- tenant logout
+async function handleTenantLogout(options, program) {
+    const profiles = new ProfileManager();
+    const profile = await profiles.getCurrentProfile();
+    if (!profile)
+        throw new Error('No active profile. Run "pxbaas login" or "pxbaas tenant login" first.');
+    const store = new CredentialStore();
+    const deleted = await store.deleteAdminCredentials(profile.name);
+    if (profile.adminCapable) {
+        await profiles.setProfile({ ...profile, adminCapable: false, updatedAt: new Date().toISOString() });
+    }
+    const output = { status: deleted ? 'success' : 'noop', profile: profile.name, adminCredentialsRemoved: deleted };
+    if (isJson(options, program)) {
+        console.log(JSON.stringify(output, null, 2));
+        return;
+    }
+    console.log(deleted
+        ? formatSuccess(`Removed dashboard credentials for profile: ${profile.name}`)
+        : `Profile '${profile.name}' had no dashboard credentials.`);
+}
+async function handleTenantCreate(tenantIdArg, options, program) {
+    assertNoKeyArgs(process.argv);
+    const json = isJson(options, program);
+    const ctx = await loadAdminContext({ profile: options.profile });
+    const driver = new TenantAdminDriver(ctx);
+    const tenantId = resolveTenantId(tenantIdArg, options);
+    const retentionDays = parseRetentionDays(options.retentionDays);
+    // 判重：撞名在平台侧不是简单失败——软删同名的 create 会「复活并重置 jwt_secret + 两把键」，
+    // 等于把另一个使用者的凭据换掉。所以默认拒绝，复活必须显式。
+    let existing;
+    try {
+        existing = await driver.get(tenantId);
+    }
+    catch (error) {
+        if (!(error instanceof TenantAdminError) || error.code !== 'TENANT_NOT_FOUND')
+            throw error;
+    }
+    if (existing) {
+        if (!existing.softDeleted) {
+            throw new Error(`Tenant '${tenantId}' already exists with status '${existing.status}'. Refusing to touch it. ` +
+                `Use "pxbaas tenant keys ${tenantId} --as-profile" to bind its existing keys, or pick another id.`);
+        }
+        if (!options.reactivate) {
+            throw new Error(`Tenant '${tenantId}' exists in soft-deleted state. Creating with this id would RESURRECT it and ` +
+                `REGENERATE its jwt_secret and both API keys (its previous holders lose access, and any of its data ` +
+                `that is still on the instance comes back under new credentials). ` +
+                `Pass --reactivate if that is really what you want, or pick another id.`);
+        }
+    }
+    const plan = {
+        tenantId,
+        action: existing ? 'reactivate' : 'create',
+        plan: options.plan,
+        displayName: options.displayName ?? tenantId,
+        expectedDbName: existing?.dbName ?? `tenant_${tenantId}`,
+        retentionDays,
+        resetsCredentials: Boolean(existing),
+        sideEffects: [
+            'tenant row in _platform.tenants (jwt_secret generated server-side)',
+            'CREATE DATABASE + CREATE USER + GRANT (platform treats failures here as non-fatal)',
+            'RLS metadata tables in the tenant database',
+            'private Storage bucket + Realtime registration',
+        ],
+    };
+    if (options.dryRun) {
+        const preview = { status: 'dry-run', ...plan };
+        if (json)
+            console.log(JSON.stringify(preview, null, 2));
+        else
+            printPlan(preview);
+        return;
+    }
+    const authorized = await authorize(plan, options);
+    if (!authorized) {
+        const refused = { status: 'refused', ...plan, note: 'Nothing was created.' };
+        if (json)
+            console.log(JSON.stringify(refused, null, 2));
+        else
+            console.log(formatWarning('Not authorized — nothing was created.'));
+        return;
+    }
+    const created = await driver.create({
+        tenantId,
+        plan: options.plan,
+        displayName: options.displayName,
+        retentionDays,
+    });
+    // 建后验证：201 ≠ 可用（平台把建库/GRANT/RLS/Realtime 都当非致命步骤）。
+    const verification = created.keys.serviceRoleKey
+        ? await verifyTenantUsable({
+            endpoint: ctx.endpoint,
+            serviceRoleKey: created.keys.serviceRoleKey,
+            realtimeProvisioned: created.realtimeProvisioned,
+        })
+        : undefined;
+    const bound = options.asProfile
+        ? await bindTenantProfile(options.asProfile, tenantId, ctx.endpoint, created.keys)
+        : undefined;
+    const bundle = options.bundle
+        ? await writeBundle(options.bundle, {
+            tenantId,
+            endpoint: ctx.endpoint,
+            anonKey: created.keys.anonKey ?? '',
+            serviceRoleKey: created.keys.serviceRoleKey ?? '',
+            intranetEndpoint: options.intranet,
+        }, { overwrite: options.overwrite })
+        : undefined;
+    const summary = {
+        status: created.realtimeProvisioned === false ? 'created-with-warnings' : 'created',
+        tenant: created.tenant,
+        keys: {
+            anonFingerprint: created.keys.anonKey ? computeFingerprint(created.keys.anonKey) : null,
+            serviceFingerprint: created.keys.serviceRoleKey ? computeFingerprint(created.keys.serviceRoleKey) : null,
+        },
+        realtimeProvisioned: created.realtimeProvisioned,
+        verification: verification ? verificationSummary(verification) : undefined,
+        profile: bound,
+        adminProfile: ctx.profileName,
+        bundle: bundle ? { path: bundle.path, bytes: bundle.bytes, sha256: bundle.record.bundleSha256 } : undefined,
+    };
+    if (json) {
+        console.log(JSON.stringify(summary, null, 2));
+    }
+    else {
+        console.log(formatSuccess(`Tenant '${tenantId}' ${existing ? 'reactivated' : 'created'} on ${ctx.endpoint}`));
+        console.log(`  Status:      ${created.tenant.status}`);
+        console.log(`  Database:    ${created.tenant.dbName ?? '-'}`);
+        console.log(`  Anon key:    ${summary.keys.anonFingerprint ?? '(none)'}`);
+        console.log(`  Service key: ${summary.keys.serviceFingerprint ?? '(none)'}`);
+        if (verification)
+            printVerification(verification);
+        if (bound) {
+            console.log(formatSuccess(`  Profile:     ${bound} (multi-tenant, tenantId=${tenantId}, now current)`));
+            console.log(formatWarning(`  Admin ops now need --profile ${ctx.profileName} (binding made '${bound}' current).`));
+        }
+        if (bundle) {
+            console.log('');
+            console.log(formatSuccess(`  Bundle:      ${bundle.path} (0600, ${bundle.bytes} bytes)`));
+            console.log('');
+            console.log(bundle.instructions);
+        }
+        if (!bound && !bundle) {
+            console.log('');
+            console.log(formatWarning(`Keys are not stored anywhere yet. Bind them locally with --as-profile, or hand them out with --bundle <file>.`));
+        }
+    }
+    // 验证不通过时以非零退出：管理员据此脚本化判断"这个租户真的能用吗"。
+    if (verification && !verification.ok)
+        process.exitCode = 2;
+}
+function resolveTenantId(arg, options) {
+    if (arg && options.generateId) {
+        throw new Error('Pass either a <tenant-id> or --generate-id, not both');
+    }
+    const id = (arg ?? (options.generateId ? `t_${randomBytes(4).toString('hex')}` : '')).trim();
+    if (!id) {
+        throw new Error('A tenant id is required (or use --generate-id)');
+    }
+    if (!TENANT_ID_RE.test(id)) {
+        throw new Error(`Invalid tenant id '${id}'. Must start with a letter or digit and contain only letters, digits, '_' or '-', max 64 chars.`);
+    }
+    return id;
+}
+function parseRetentionDays(value) {
+    if (value === undefined)
+        return undefined;
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 0) {
+        throw new Error('--retention-days must be a non-negative integer');
+    }
+    return parsed;
+}
+function printPlan(plan) {
+    console.log(`Plan — tenant '${plan.tenantId}' (${plan.action})`);
+    console.log(`  display_name:   ${plan.displayName}`);
+    console.log(`  plan:           ${plan.plan}`);
+    console.log(`  database:       ${plan.expectedDbName ?? '-'} (name is assigned by the platform)`);
+    if (plan.retentionDays !== undefined)
+        console.log(`  retention_days: ${plan.retentionDays}`);
+    if (plan.resetsCredentials) {
+        console.log(formatWarning('  ⚠ this id is soft-deleted; creating it regenerates that tenant’s jwt_secret and both keys.'));
+    }
+    console.log('  side effects:');
+    for (const effect of plan.sideEffects)
+        console.log(`    - ${effect}`);
+}
+async function authorize(plan, options) {
+    if (options.yes)
+        return true;
+    if (!process.stdin.isTTY) {
+        return false;
+    }
+    const answers = await inquirer.prompt([
+        {
+            type: 'confirm',
+            name: 'go',
+            message: `Create tenant '${plan.tenantId}' (${plan.action}) on this instance?`,
+            default: false,
+        },
+    ]);
+    return Boolean(answers.go);
+}
+async function bindTenantProfile(asProfile, tenantId, endpoint, keys) {
+    if (!keys.anonKey || !keys.serviceRoleKey) {
+        throw new Error(`Tenant '${tenantId}' came back without both keys. Run "pxbaas tenant repair-keys --confirm", then "pxbaas tenant keys ${tenantId} --as-profile".`);
+    }
+    const name = typeof asProfile === 'string' && asProfile ? asProfile : tenantId;
+    // 复用 login 的落库校验（JWT 过期 + 租户一致性 + 切当前），不自己写一份。
+    const result = await commitProfileCredentials({
+        profileName: name,
+        endpoint,
+        tenantId,
+        anonKey: keys.anonKey,
+        serviceRoleKey: keys.serviceRoleKey,
+    });
+    // 管理凭据与新绑定的租户 profile 是分开的两本账；这里只标记该 profile 曾由管理面签发。
+    const profiles = new ProfileManager();
+    const created = await profiles.getProfile(result.profileName);
+    if (created)
+        await profiles.setProfile({ ...created, adminCapable: true });
+    return result.profileName;
+}
+async function handleTenantKeys(tenantId, options, program) {
+    assertNoKeyArgs(process.argv);
+    const json = isJson(options, program);
+    const ctx = await loadAdminContext({ profile: options.profile });
+    const driver = new TenantAdminDriver(ctx);
+    const tenant = await driver.get(tenantId);
+    const keys = await driver.getKeys(tenantId);
+    if (!keys.anonKey && !keys.serviceRoleKey) {
+        throw new Error(`Tenant '${tenantId}' has no API keys stored (status=${tenant.status}). ` +
+            `Run "pxbaas tenant repair-keys --confirm" to backfill them from its jwt_secret, then retry.`);
+    }
+    // 交付包必须是完整的两把键：半成品包到了收件人手里只会变成一条难查的导入报错。
+    if (options.bundle && (!keys.anonKey || !keys.serviceRoleKey)) {
+        throw new Error(`Tenant '${tenantId}' is missing ${keys.anonKey ? 'the service role key' : 'the anon key'}; refusing to write a half-configured bundle. Run "pxbaas tenant repair-keys --confirm" first.`);
+    }
+    const bound = options.asProfile
+        ? await bindTenantProfile(options.asProfile, tenantId, ctx.endpoint, keys)
+        : undefined;
+    const bundle = options.bundle
+        ? await writeBundle(options.bundle, {
+            tenantId,
+            endpoint: ctx.endpoint,
+            anonKey: keys.anonKey,
+            serviceRoleKey: keys.serviceRoleKey,
+            intranetEndpoint: options.intranet,
+        }, { overwrite: options.overwrite })
+        : undefined;
+    if (!bound && !bundle) {
+        throw new Error(`Nothing to do: --as-profile or --bundle is required. Keys are never printed to the terminal — ` +
+            `the only supported destinations are the OS keyring (--as-profile) or a 0600 access bundle (--bundle <file>).`);
+    }
+    const summary = {
+        status: 'ok',
+        tenant,
+        keys: {
+            anonFingerprint: keys.anonKey ? computeFingerprint(keys.anonKey) : null,
+            serviceFingerprint: keys.serviceRoleKey ? computeFingerprint(keys.serviceRoleKey) : null,
+        },
+        profile: bound,
+        adminProfile: ctx.profileName,
+        bundle: bundle ? { path: bundle.path, bytes: bundle.bytes, sha256: bundle.record.bundleSha256 } : undefined,
+    };
+    if (json) {
+        console.log(JSON.stringify(summary, null, 2));
+        return;
+    }
+    console.log(`Tenant '${tenantId}' [${tenant.status}] plan=${tenant.plan ?? '-'} db=${tenant.dbName ?? '-'}`);
+    console.log(`  Anon key:    ${summary.keys.anonFingerprint ?? '(none)'}`);
+    console.log(`  Service key: ${summary.keys.serviceFingerprint ?? '(none)'}`);
+    if (bound) {
+        console.log(formatSuccess(`  Profile:     ${bound} (tenantId=${tenantId}, now current)`));
+        console.log(formatWarning(`  Admin ops now need --profile ${ctx.profileName} (binding made '${bound}' current).`));
+    }
+    if (bundle) {
+        console.log(formatSuccess(`  Bundle:      ${bundle.path} (0600, ${bundle.bytes} bytes)`));
+        console.log('');
+        console.log(bundle.instructions);
+    }
+}
+// ------------------------------------------------------------ tenant repair-keys
+async function handleTenantRepairKeys(options, program) {
+    const json = isJson(options, program);
+    const ctx = await loadAdminContext({ profile: options.profile });
+    const driver = new TenantAdminDriver(ctx);
+    const { tenants } = await driver.list();
+    const missing = tenants.filter((tenant) => !tenant.hasAnonKey || !tenant.hasServiceRoleKey);
+    if (!options.confirm) {
+        const preview = {
+            status: 'dry-run',
+            missingKeyCount: missing.length,
+            tenants: missing.map((tenant) => ({ tenantId: tenant.tenantId, status: tenant.status, hasAnonKey: tenant.hasAnonKey, hasServiceRoleKey: tenant.hasServiceRoleKey })),
+            note: 'This re-signs keys from each tenant’s EXISTING jwt_secret. It is idempotent and does not revoke anything already issued. Pass --confirm to run.',
+        };
+        if (json)
+            console.log(JSON.stringify(preview, null, 2));
+        else {
+            console.log(`Tenants missing API keys: ${missing.length}`);
+            for (const tenant of missing)
+                console.log(`  ${tenant.tenantId}  anon=${tenant.hasAnonKey ? 'ok' : 'MISSING'}  service=${tenant.hasServiceRoleKey ? 'ok' : 'MISSING'}`);
+            console.log(formatWarning(preview.note ?? ''));
+        }
+        return;
+    }
+    if (missing.length === 0) {
+        const noop = { status: 'noop', updated: 0, note: 'Every visible tenant already has both keys.' };
+        if (json)
+            console.log(JSON.stringify(noop, null, 2));
+        else
+            console.log(noop.note ?? '');
+        return;
+    }
+    const result = await driver.repairKeys();
+    const output = { status: 'repaired', updated: result.updated, message: result.message, tenants: missing.map((t) => t.tenantId) };
+    if (json)
+        console.log(JSON.stringify(output, null, 2));
+    else
+        console.log(formatSuccess(`Backfilled keys for ${result.updated} tenant(s): ${missing.map((t) => t.tenantId).join(', ')}`));
+}
+// ------------------------------------------------------------------ formatting
+function verificationSummary(verification) {
+    return {
+        ok: verification.ok,
+        dbName: verification.dbName,
+        steps: verification.steps.map((step) => ({ name: step.name, status: step.status, detail: step.detail })),
+    };
+}
+function printVerification(verification) {
+    const icon = { pass: '✔', fail: '✗', skip: '-' };
+    console.log('  Post-create verification:');
+    for (const step of verification.steps) {
+        console.log(`    ${icon[step.status]} ${step.name}: ${step.detail}`);
+        if (step.remediation)
+            console.log(`      → ${step.remediation}`);
+    }
+    if (!verification.ok) {
+        console.log(formatWarning('The tenant was accepted by the platform but is not fully usable. The provisioning steps above are non-fatal server-side; fix the failing item before handing keys out.'));
+    }
+}
+function maskUser(username) {
+    if (username.length <= 2)
+        return '**';
+    return `${username.slice(0, 2)}***${username.slice(-1)}`;
+}
+function fail(error, json) {
+    const message = error instanceof Error ? error.message : String(error);
+    const code = error instanceof TenantAdminError ? error.code : 'CLI_ERROR';
+    if (json)
+        console.log(JSON.stringify({ code, message }, null, 2));
+    else
+        console.error(formatError(`${code}: ${message}`));
+    process.exit(1);
+}
+//# sourceMappingURL=index.js.map