@qmuse/qmuse-cli 1.0.6 → 1.0.7

package/README.md

@@ -75,6 +75,19 @@ qmuse import ./app --cloud-mode QMUSE \
 
 先用 `cloud init` 检查当前空间的云服务权益，导入时使用 `--confirm-cloud-service` 确认云资源计划。外部项目切换到 QMuse 云服务时，还需添加 `--acknowledge-empty-cloud-data`，确认外部已有数据不会自动迁移。
 
+云管理命令要求先完成 `qmuse login`，`--app-id` 可显式指定应用，省略时读取项目绑定。
+
+```bash
+qmuse cloud set-secret TOKEN --stdin --app-id <appId> --cloud-env dev
+qmuse cloud schema preflight --candidate ./schema-candidate.json --app-id <appId>
+qmuse cloud schema export --app-id <appId>
+```
+
+`set-secret --stdin` 从标准输入接收键名完全匹配的 JSON，如 `{"TOKEN":"实际密钥值"}`；请由可信密钥工具提供，避免在参数、源码或版本库保存值。命令只输出名称和保存结果；部分保存失败会返回非零退出码。更新已停用密钥会保留停用状态，返回 `updated-disabled` / `SECRET_DISABLED` 和非零退出码，表示值已保存但密钥仍不可用；需要在密钥管理面板启用。密钥保存后的云端异步同步状态在面板确认。`--cloud-env dev|prod` 是云资源环境，`--env prod|pre|local` 是平台接口环境。
+
+`schema preflight` 比较完整候选与 READY 基线，返回检查结果和差异；检查不会写 schema 或建表，未通过时命令返回非零退出码。`schema export` 输出开发环境已应用的 READY schema，失败导入后它可能比本地文件更新；核对基线后再恢复本地文件。平台仍采用 append-only 演进规则，不能用导出来的旧版本删除已创建的表。
+
+
 ### 恢复任务
 
 ```bash

package/dist/cli.js

@@ -12,6 +12,7 @@ import * as login from './login.js';
 import { prompt } from './login.js';
 import { readFileSync } from 'node:fs';
 import path from 'node:path';
+import { homedir } from 'node:os';
 import { createImportArchive } from './import/archive.js';
 import { configureAppImport, getAppOpenUrl, getImportStatusUrl, queryAppImportStatus, startAppImport, uploadImportArchive, } from './import/api.js';
 import { pollAppImport } from './import/poll.js';
@@ -19,7 +20,7 @@ import { preflightImport } from './import/preflight.js';
 import { resolveUpdateBase } from './import/update.js';
 import { clearPendingImport, completeManagedImport, createExternalProject, loadManagedProject, saveManagedProject, resolveProjectEnvironment, setPendingImport, } from './import/project.js';
 import { clearImportFailureDiagnostic, writeImportFailureDiagnostic, importRetryGuidance, } from './import/diagnostic.js';
-import { checkCloudInit, checkCloudEntitlement, CLOUD_INIT_SUCCESS_MESSAGE } from './cloud.js';
+import { checkCloudInit, checkCloudEntitlement, CLOUD_INIT_SUCCESS_MESSAGE, resolveCloudAppId, preflightCloudSchema, exportCloudSchema, parseCloudSecrets, setCloudSecrets } from './cloud.js';
 import { configurationGuidance } from './import/guidance.js';
 import { QMUSE_CLI_VERSION } from './version.js';
 import { startUpdateNotice } from './update-notice.js';
@@ -30,6 +31,7 @@ const BOOL_FLAGS = new Set([
     '--log', '--no-open', '--wait', '--force',
     '--acknowledge-empty-cloud-data',
     '--confirm-cloud-service',
+    '--stdin',
 ]);
 function parseArgs(argv) {
     const command = [];
@@ -576,8 +578,48 @@ async function cmdImport(command, flags) {
 }
 async function cmdCloud(command, flags) {
     const subcommand = command[1];
+    if (subcommand === 'set-secret' || subcommand === 'schema') {
+        const cfg = resolveCfg(flags);
+        requireAuth(cfg);
+        const appId = await resolveCloudAppId(process.cwd(), cfg, str(flags, '--env'), str(flags, '--app-id'));
+        if (subcommand === 'set-secret') {
+            if (flags['--stdin'] !== true || !command[2])
+                fail('用法: qmuse cloud set-secret KEY1,KEY2 --stdin [--cloud-env dev|prod]；通过标准输入传入 JSON，不在命令参数中传入密钥值');
+            const cloudEnv = str(flags, '--cloud-env') || 'dev';
+            if (cloudEnv !== 'dev' && cloudEnv !== 'prod')
+                fail('--cloud-env 仅支持 dev / prod');
+            if (process.stdin.isTTY)
+                fail('请通过管道向标准输入提供密钥 JSON，不要在终端直接粘贴密钥值');
+            let input = '';
+            process.stdin.setEncoding('utf8');
+            for await (const chunk of process.stdin) {
+                input += chunk;
+                if (input.length > 500_000)
+                    fail('密钥输入过大');
+            }
+            const result = await setCloudSecrets(appId, parseCloudSecrets(command[2], input), cfg, cloudEnv);
+            output(result, flags);
+            if (!result.success)
+                process.exitCode = 1;
+            return;
+        }
+        if (command[2] === 'export') {
+            const result = await exportCloudSchema(appId, cfg);
+            output(flags['--json'] === true ? result : result.schema, flags);
+            return;
+        }
+        if (command[2] !== 'preflight' || !str(flags, '--candidate'))
+            fail('用法: qmuse cloud schema preflight --candidate <schema.json>；或 qmuse cloud schema export');
+        const candidate = str(flags, '--candidate');
+        const candidatePath = candidate.replace(/^\$HOME(?=\/|$)/u, homedir());
+        const result = await preflightCloudSchema(appId, readFileSync(path.resolve(candidatePath), 'utf8'), cfg);
+        output(result, flags);
+        if (result.status !== 'passed')
+            process.exitCode = 1;
+        return;
+    }
     if (subcommand !== 'init') {
-        fail(`未知 cloud 子命令: ${subcommand ?? '(空)'}。可用: init`);
+        fail(`未知 cloud 子命令: ${subcommand ?? '(空)'}。可用: init、set-secret、schema preflight、schema export`);
     }
     if (!str(flags, '-d')?.trim()) {
         fail('用法: qmuse cloud init -d "<应用功能描述>"');
@@ -804,6 +846,10 @@ const HELP = `QMuse CLI —— 将本地 React 项目导入 QMuse
   config [get|path]                                 查看配置
 
   cloud init -d "<应用功能描述>"                    校验当前空间的 QMuse 云服务权益
+  cloud set-secret KEY1,KEY2 --stdin                从标准输入 JSON 保存密钥，不输出密钥值
+      [--app-id <id>] [--cloud-env dev|prod]
+  cloud schema preflight --candidate <schema.json>  只读校验候选与云端 READY 基线
+  cloud schema export [--app-id <id>]               输出当前开发环境的 READY schema
   dev [directory] [--port <port>]                   连接已导入应用的开发云资源并启动本地 Vite
 
   import <directory> [--space-id <id>]             导入本地 React 仓库

package/dist/cloud.js

@@ -2,6 +2,74 @@ import { apiCall } from './client.js';
 import { loadManagedProject } from './import/project.js';
 export const CLOUD_INIT_SUCCESS_MESSAGE = 'Cloud service entitlement verified successfully. Continue implementing the requested ' +
     'cloud features by following the cloud service skill instructions.';
+export async function resolveCloudAppId(rootDir, cfg, explicitEnvironment, appId) {
+    if (appId?.trim())
+        return appId.trim();
+    const project = await loadManagedProject(rootDir, cfg, explicitEnvironment);
+    if (!project?.target?.appId)
+        throw new Error('当前项目尚未绑定应用，请使用 --app-id 指定诊断中的应用 ID');
+    return project.target.appId;
+}
+export async function preflightCloudSchema(appId, schemaContent, cfg) {
+    if (schemaContent.length > 2_000_000)
+        throw new Error('候选 schema 不能超过 2,000,000 个字符');
+    try {
+        JSON.parse(schemaContent);
+    }
+    catch {
+        throw new Error('候选 schema 不是合法 JSON');
+    }
+    const result = await apiCall('POST', '/api/appwrite/schema/preflight', { appId, schemaContent }, cfg);
+    if (!result.ok || !result.data)
+        throw new Error(`schema 预检失败：${result.errorCode || `HTTP ${result.status}`}`);
+    return result.data;
+}
+export async function exportCloudSchema(appId, cfg) {
+    const result = await apiCall('POST', '/api/appwrite/schema/baseline', { appId }, cfg);
+    if (!result.ok || !result.data)
+        throw new Error(`读取 READY schema 失败：${result.errorCode || `HTTP ${result.status}`}`);
+    return result.data;
+}
+export function parseCloudSecrets(names, input) {
+    const keys = names.split(',').map(key => key.trim());
+    if (keys.length === 0 || keys.length > 50 || new Set(keys).size !== keys.length || keys.some(key => !/^[A-Za-z][A-Za-z0-9_]{0,254}$/u.test(key))) {
+        throw new Error('密钥名称必须为不重复的名称列表，以逗号分隔；不要在命令参数中传入密钥值');
+    }
+    let value;
+    try {
+        value = JSON.parse(input);
+    }
+    catch {
+        throw new Error('标准输入必须是包含密钥名和值的 JSON 对象');
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('标准输入必须是 JSON 对象');
+    const entries = Object.entries(value);
+    if (entries.length !== keys.length || entries.some(([key, item]) => !keys.includes(key) || typeof item !== 'string' || item.length === 0 || item.length > 8192)) {
+        throw new Error('标准输入必须包含且仅包含指定密钥，每个值为 1..8192 个字符的字符串');
+    }
+    return Object.fromEntries(entries);
+}
+export async function setCloudSecrets(appId, values, cfg, env = 'dev') {
+    const listed = await apiCall('POST', '/api/appwrite/secrets/list', { appId, env }, cfg);
+    if (!listed.ok || !listed.data)
+        throw new Error(`读取密钥列表失败：${listed.errorCode || `HTTP ${listed.status}`}`);
+    const results = [];
+    for (const [key, value] of Object.entries(values)) {
+        const existing = listed.data.secrets.find(secret => secret.key === key);
+        const response = await apiCall('POST', `/api/appwrite/secrets/${existing ? 'update-value' : 'create'}`, existing ? { appId, env, secretId: existing.id, value } : { appId, env, key, value }, cfg);
+        if (!response.ok) {
+            results.push({ key, status: 'failed', errorCode: response.errorCode || `HTTP_${response.status}` });
+        }
+        else if (existing?.status === 'DISABLED') {
+            results.push({ key, status: 'updated-disabled', errorCode: 'SECRET_DISABLED' });
+        }
+        else {
+            results.push({ key, status: existing ? 'updated' : 'created' });
+        }
+    }
+    return { success: results.every(result => result.status === 'updated' || result.status === 'created'), appId, env, results };
+}
 function entitlementError(snapshot) {
     if (snapshot.reason === 'CLOUD_SERVICE_LIMIT_EXCEEDED') {
         const usage = snapshot.appLimit === undefined

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qmuse/qmuse-cli",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "将本地 React 项目安全导入 QMuse 的命令行客户端",
   "type": "module",
   "bin": {