@voobase/cli 0.1.1-nonprod.2080 → 0.1.1-nonprod.2085

package/dist-bundle/index.mjs

@@ -2451,7 +2451,7 @@ Set-Acl -LiteralPath $credentialPath -AclObject $acl
     <p class="close-hint">\u8BF7\u91CD\u65B0\u5728\u7EC8\u7AEF\u6267\u884C platform login</p>
   </div>
 </body>
-</html>`}function escapeHtml(s){return s.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}async function discoverOidcEndpoints(issuer){let discoveryUrl=`${issuer.endsWith("/")?issuer.slice(0,-1):issuer}/.well-known/openid-configuration`,response=await fetch(discoveryUrl);if(!response.ok)throw new Error(`\u83B7\u53D6 OIDC discovery \u5931\u8D25: ${response.status}`);let document=await response.json();if(!document.authorization_endpoint||!document.token_endpoint)throw new Error("OIDC discovery \u7F3A\u5C11\u6388\u6743\u6216 token \u7AEF\u70B9");return{authorization_endpoint:document.authorization_endpoint,device_authorization_endpoint:document.device_authorization_endpoint,token_endpoint:document.token_endpoint}}function getCredentialPath(){return resolveCliStateFilePath("credentials.json")}function getCliContextPath(){return resolveCliStateFilePath("context.json")}function getCliStateDir(){return resolveCliStateDir()}var CliLegacyCredentialStore=class{platform;backend="file";constructor(platform){this.platform=platform}exists(){return existsSync10(getCredentialPath())}read(){return new FileCredentialStore(getCredentialPath(),{platform:this.platform}).read()}write(value){withCliStateFileWriteFallback({fileName:"credentials.json",operation:"\u5199\u5165",write:({filePath})=>new FileCredentialStore(filePath,{platform:this.platform}).write(value)})}delete(){new FileCredentialStore(getCredentialPath(),{platform:this.platform}).delete()}};function resolveCredentialStores(options={}){let stateDir=options.stateDir??getCliStateDir(),platform=options.platform??process.platform,profileName=options.profileName??getDistributionProfile().name,legacyStore=options.legacyStore??(options.stateDir?new FileCredentialStore(join6(stateDir,"credentials.json"),{platform}):new CliLegacyCredentialStore(platform)),hasInjectedStore=Object.prototype.hasOwnProperty.call(options,"secureStore")||Object.prototype.hasOwnProperty.call(options,"legacyStore"),backendPreference=options.backendPreference??(hasInjectedStore?{isFilePreferred:()=>!1,preferFile:()=>{},clear:()=>{}}:new FileCredentialBackendPreference(join6(stateDir,"credential-backend-preference.json")));if(Object.prototype.hasOwnProperty.call(options,"secureStore"))return{secureStore:options.secureStore??null,legacyStore,backendPreference};if(profileName==="developer"||profileName==="test-only")return{secureStore:null,legacyStore,backendPreference};let selectedStore=createCredentialStore({platform,stateDir,profileName});return{secureStore:selectedStore.backend==="file"?null:selectedStore,legacyStore,backendPreference}}function markCredentialOrigin(credentials,backend){return Object.defineProperty(credentials,credentialOriginBackend,{value:backend,enumerable:!1,configurable:!0}),credentials}function getCredentialOrigin(credentials){return credentials[credentialOriginBackend]}function emitCredentialStoreWarnings(warnings,backend){if(warnings.length===0&&backend!=="file"){let report2=inspectCredentialSecurity({credentialsPath:getCredentialPath(),credentialsExist:existsSync10(getCredentialPath()),backend,probeWindowsAcl:!1});emitCredentialSecurityWarnings(report2);return}let report=inspectCredentialSecurity({credentialsPath:getCredentialPath(),credentialsExist:existsSync10(getCredentialPath()),backend,probeWindowsAcl:!1}),existingCodes=new Set(report.findings.map(finding=>finding.code));for(let code2 of warnings){if(existingCodes.has(code2))continue;let detail=credentialStoreWarningDetail(code2);report.findings.push({code:code2,level:code2==="credential_store_corrupted"?"error":"warning",...detail})}report.status=report.findings.some(finding=>finding.level==="error")?"error":report.findings.length>0?"warning":"ok",report.code=report.findings[0]?.code??"credential_security_ok",emitCredentialSecurityWarnings(report)}function credentialStoreWarningDetail(code2){switch(code2){case"credential_migration_pending":return{message:"\u68C0\u6D4B\u5230\u65E7\u7248\u660E\u6587\u51ED\u636E\uFF0C\u5F53\u524D\u767B\u5F55\u6001\u4ECD\u53EF\u7EE7\u7EED\u4F7F\u7528\u3002",action:"\u8FD0\u884C `platform credentials migrate` \u5B8C\u6210\u5F53\u524D\u5E73\u53F0\u7684\u51ED\u636E\u8FC1\u79FB\u6216\u654F\u611F\u5B57\u6BB5\u51C0\u5316\u3002"};case"credential_migration_failed":return{message:"\u51ED\u636E\u5B89\u5168\u8FC1\u79FB\u672A\u5B8C\u6210\uFF0C\u5DF2\u4FDD\u7559\u539F\u6709\u53EF\u7528\u767B\u5F55\u6001\u3002",action:"\u8FD0\u884C `platform diagnostics credentials` \u67E5\u770B\u72B6\u6001\u540E\u91CD\u8BD5\u8FC1\u79FB\u3002"};case"credential_store_corrupted":return{message:"\u7CFB\u7EDF\u5B89\u5168\u5B58\u50A8\u4E2D\u7684 CLI \u51ED\u636E\u65E0\u6CD5\u8BFB\u53D6\uFF0C\u5DF2\u5C1D\u8BD5\u517C\u5BB9\u51ED\u636E\u3002",action:"\u5982\u65E0\u517C\u5BB9\u51ED\u636E\uFF0C\u8BF7\u91CD\u65B0\u6267\u884C `platform login`\u3002"};default:return{message:"\u7CFB\u7EDF\u5B89\u5168\u5B58\u50A8\u5F53\u524D\u4E0D\u53EF\u7528\uFF0C\u5DF2\u4F7F\u7528\u517C\u5BB9\u6587\u4EF6\u4E14\u672C\u6B21\u547D\u4EE4\u7EE7\u7EED\u6267\u884C\u3002",action:"\u8FD0\u884C `platform diagnostics credentials` \u67E5\u770B\u72B6\u6001\u5E76\u5728\u6062\u590D\u540E\u91CD\u8BD5\u8FC1\u79FB\u3002"}}}function loadStoredCredentials(storageOptions={}){let stores=resolveCredentialStores(storageOptions),result=readCredentialsWithFallback(stores);return emitCredentialStoreWarnings(result.warnings,result.backend),result.credentials&&result.backend!=="none"?markCredentialOrigin(result.credentials,result.backend):null}function selectApiToken(credentials){return looksLikeJwt(credentials.access_token)?credentials.access_token:looksLikeJwt(credentials.id_token)?credentials.id_token:credentials.access_token}function loadStoredCliContext(){let cliContextPath=getCliContextPath();return existsSync10(cliContextPath)?JSON.parse(readFileSync9(cliContextPath,"utf8")):null}function persistCredentials(credentials,storageOptions={}){let stores=resolveCredentialStores(storageOptions),result=writeCredentialsWithFallback(credentials,stores);return markCredentialOrigin(credentials,result.backend),emitCredentialStoreWarnings(result.warnings,result.backend),result}function migrateStoredCredentials(storageOptions={}){let stores=resolveCredentialStores(storageOptions),result=migrateLegacyCredentials(stores);return emitCredentialStoreWarnings(result.warnings,result.backend),result}function inspectStoredCredentialSecurity(storageOptions={}){let stores=resolveCredentialStores(storageOptions),credentialsPath=getCredentialPath(),legacyExists=stores.legacyStore.exists?.()??existsSync10(credentialsPath),backend=legacyExists?"file":"none",secureWarning=null;if(stores.secureStore?.exists)try{stores.secureStore.exists()&&(backend=stores.secureStore.backend)}catch(error){secureWarning=error instanceof Error&&"code"in error&&error.code==="credential_store_corrupted"?"credential_store_corrupted":"credential_secure_store_unavailable"}let report=inspectCredentialSecurity({credentialsPath,credentialsExist:legacyExists,backend});return secureWarning&&!report.findings.some(finding=>finding.code===secureWarning)&&(report.findings.push({code:secureWarning,level:secureWarning==="credential_store_corrupted"?"error":"warning",...credentialStoreWarningDetail(secureWarning)}),report.status=secureWarning==="credential_store_corrupted"?"error":"warning",report.code=report.findings[0]?.code??secureWarning),report}function clearStoredAuthentication(storageOptions={}){let stateDir=storageOptions.stateDir??getCliStateDir(),stores=resolveCredentialStores({...storageOptions,stateDir}),cleared=[],failed=[],attempt=(target,operation)=>{try{operation(),cleared.push(target)}catch{failed.push({target})}};stores.secureStore&&attempt(stores.secureStore.backend,()=>stores.secureStore.delete()),attempt("legacy_file",()=>stores.legacyStore.delete()),attempt("account_context",()=>deleteFileIfPresent(join6(stateDir,"context.json"))),attempt("warning_state",()=>deleteFileIfPresent(join6(stateDir,"credential-warning-state.json"))),attempt("backend_preference",()=>deleteFileIfPresent(join6(stateDir,"credential-backend-preference.json")));try{let temporaryFailures=deleteCredentialTemporaryFiles(stateDir,storageOptions.temporaryFileDeleter??deleteFileIfPresent);temporaryFailures.length===0&&cleared.push("orphan_temporary_files"),failed.push(...temporaryFailures.map(name=>({target:`orphan_temporary_file:${name}`})))}catch{failed.push({target:"orphan_temporary_files"})}return{status:failed.length>0?"partial":"cleared",cleared,failed}}function deleteFileIfPresent(filePath){try{unlinkSync4(filePath)}catch(error){if(error.code!=="ENOENT")throw error}}function deleteCredentialTemporaryFiles(stateDir,deleter){let entries;try{entries=readdirSync2(stateDir,{withFileTypes:!0,encoding:"utf8"})}catch(error){if(error.code==="ENOENT")return[];throw error}let failed=[];for(let entry of entries)if(!(!entry.isFile()||!/^(?:credentials\.json|credentials\.dpapi|credential-warning-state\.json|credential-backend-preference\.json)\.tmp-[a-z0-9-]+$/iu.test(entry.name)))try{deleter(join6(stateDir,entry.name))}catch{failed.push(entry.name)}return failed}function persistRefreshedCredentials(nextCredentials,previousCredentials,storageOptions){let stores=resolveCredentialStores(storageOptions);if(getCredentialOrigin(previousCredentials)==="file"){stores.legacyStore.write(toFileFallbackCredentials(nextCredentials)),markCredentialOrigin(nextCredentials,"file");let result={backend:"file",warnings:[],legacyDeleted:!1};return emitCredentialStoreWarnings(result.warnings,result.backend),result}return persistCredentials(nextCredentials,{...storageOptions,...stores})}function resolveStoredClientId(credentials){return credentials.client_id?.trim()||readAuthConfigValue(AUTH_CLI_CLIENT_ID_KEYS)||readAuthConfigValue(AUTH_TENANT_CLIENT_ID_KEYS)}function readJwtExpiryMs(token){if(!looksLikeJwt(token))return null;try{let[,payload]=token.split("."),decoded=JSON.parse(Buffer.from(payload,"base64url").toString("utf8"));return typeof decoded.exp=="number"&&Number.isFinite(decoded.exp)?decoded.exp*1e3:null}catch{return null}}function isCredentialExpired(credentials,now=Date.now()){if(typeof credentials.expires_in=="number"&&Number.isFinite(credentials.expires_in)){let issuedAt=Date.parse(credentials.issued_at);if(Number.isFinite(issuedAt))return issuedAt+credentials.expires_in*1e3-TOKEN_REFRESH_SKEW_MS<=now}let jwtExpiry=readJwtExpiryMs(credentials.access_token)??readJwtExpiryMs(credentials.id_token);return typeof jwtExpiry=="number"?jwtExpiry-TOKEN_REFRESH_SKEW_MS<=now:!1}function canUsePatExchange(credentials,now=Date.now()){if(credentials.credential_mode!=="pat_exchange"||!credentials.exchange_subject_token||!credentials.exchange_subject_token_type||!resolveStoredClientId(credentials)||!credentials.mode_expires_at)return!1;let expiresAt=Date.parse(credentials.mode_expires_at);return Number.isFinite(expiresAt)&&expiresAt>now}async function refreshCredentials(credentials,storageOptions){let issuer=process.env.OIDC_ISSUER?.trim()||getDistributionProfile().defaults?.OIDC_ISSUER?.trim();if(!issuer)throw new Error("\u5F53\u524D\u73AF\u5883\u7F3A\u5C11 OIDC_ISSUER\uFF0C\u65E0\u6CD5\u81EA\u52A8\u5237\u65B0 CLI \u51ED\u636E\u3002");let clientId=resolveStoredClientId(credentials);if(!clientId)throw new Error("\u5F53\u524D\u51ED\u636E\u7F3A\u5C11 client_id\uFF0C\u65E0\u6CD5\u81EA\u52A8\u5237\u65B0 CLI \u51ED\u636E\u3002");if(!credentials.refresh_token)throw new Error("\u5F53\u524D\u51ED\u636E\u7F3A\u5C11 refresh_token\uFF0C\u8BF7\u91CD\u65B0\u6267\u884C `platform login`\u3002");let endpoints=await discoverOidcEndpoints(issuer),body=new URLSearchParams;body.set("grant_type","refresh_token"),body.set("client_id",clientId),body.set("refresh_token",credentials.refresh_token),applyResource(body,process.env.OIDC_AUDIENCE?.trim()||getDistributionProfile().defaults?.OIDC_AUDIENCE?.trim());let response=await fetch(endpoints.token_endpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body}),payload=await response.json();if(!response.ok)throw mapTokenFailureToAuthError({error:payload.error,errorDescription:payload.error_description,fallback:"\u5237\u65B0 CLI token \u5931\u8D25"});if(typeof payload.access_token!="string"||payload.access_token.length===0)throw new Error("\u5237\u65B0\u540E\u7684 token \u54CD\u5E94\u7F3A\u5C11 access_token");let nextCredentials={access_token:payload.access_token,id_token:typeof payload.id_token=="string"?payload.id_token:credentials.id_token,refresh_token:typeof payload.refresh_token=="string"?payload.refresh_token:credentials.refresh_token,client_id:clientId,token_type:payload.token_type??credentials.token_type,expires_in:typeof payload.expires_in=="number"?payload.expires_in:credentials.expires_in,scope:payload.scope??credentials.scope,issued_at:new Date().toISOString(),credential_mode:credentials.credential_mode??"interactive",exchange_subject_token:credentials.exchange_subject_token,exchange_subject_token_type:credentials.exchange_subject_token_type,mode_expires_at:credentials.mode_expires_at};return persistRefreshedCredentials(nextCredentials,credentials,storageOptions),nextCredentials}async function exchangePatCredentials(credentials,storageOptions){let issuer=process.env.OIDC_ISSUER?.trim()||getDistributionProfile().defaults?.OIDC_ISSUER?.trim();if(!issuer)throw new Error("\u5F53\u524D\u73AF\u5883\u7F3A\u5C11 OIDC_ISSUER\uFF0C\u65E0\u6CD5\u81EA\u52A8\u5237\u65B0 PAT \u51ED\u636E\u3002");let clientId=resolveStoredClientId(credentials);if(!clientId)throw new Error("\u5F53\u524D PAT \u51ED\u636E\u7F3A\u5C11 client_id\uFF0C\u65E0\u6CD5\u81EA\u52A8\u5237\u65B0\u3002");if(!credentials.exchange_subject_token||!credentials.exchange_subject_token_type)throw new Error("\u5F53\u524D PAT \u51ED\u636E\u7F3A\u5C11 subject_token\uFF0C\u8BF7\u91CD\u65B0\u6267\u884C `platform login --pat <token>`\u3002");if(credentials.mode_expires_at){let hardExpiry=Date.parse(credentials.mode_expires_at);if(Number.isFinite(hardExpiry)&&hardExpiry<=Date.now())throw new Error("\u5F53\u524D PAT \u767B\u5F55\u5DF2\u8D85\u8FC7 7 \u5929\u6709\u6548\u671F\uFF0C\u8BF7\u91CD\u65B0\u6267\u884C `platform login --pat <token>`\u3002")}let endpoints=await discoverOidcEndpoints(issuer),body=new URLSearchParams;body.set("grant_type","urn:ietf:params:oauth:grant-type:token-exchange"),body.set("client_id",clientId),body.set("subject_token",credentials.exchange_subject_token),body.set("subject_token_type",credentials.exchange_subject_token_type),body.set("requested_token_type","urn:ietf:params:oauth:token-type:access_token"),credentials.scope?.trim()&&body.set("scope",credentials.scope.trim()),applyResource(body,process.env.OIDC_AUDIENCE?.trim()||getDistributionProfile().defaults?.OIDC_AUDIENCE?.trim());let response=await fetch(endpoints.token_endpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body}),payload=await response.json();if(!response.ok)throw mapTokenFailureToAuthError({error:payload.error,errorDescription:payload.error_description,fallback:"PAT \u4EA4\u6362 access token \u5931\u8D25"});if(typeof payload.access_token!="string"||payload.access_token.length===0)throw new Error("PAT \u4EA4\u6362\u540E\u7684 token \u54CD\u5E94\u7F3A\u5C11 access_token");let nextCredentials={access_token:payload.access_token,id_token:typeof payload.id_token=="string"?payload.id_token:credentials.id_token,client_id:clientId,token_type:payload.token_type??credentials.token_type,expires_in:typeof payload.expires_in=="number"?payload.expires_in:credentials.expires_in,scope:payload.scope??credentials.scope,issued_at:new Date().toISOString(),credential_mode:"pat_exchange",exchange_subject_token:credentials.exchange_subject_token,exchange_subject_token_type:credentials.exchange_subject_token_type,mode_expires_at:credentials.mode_expires_at};return persistRefreshedCredentials(nextCredentials,credentials,storageOptions),nextCredentials}async function loadStoredCredentialsEnsuringFresh(options={}){let storageOptions=options.storage??{},credentials=loadStoredCredentials(storageOptions);if(!credentials)return null;let expired=isCredentialExpired(credentials);if(!options.forceRefresh&&!expired)return credentials;if(credentials.refresh_token)try{return refreshCredentials(credentials,storageOptions)}catch(error){maybeWrapCredentialRefreshError(error)}if(canUsePatExchange(credentials))try{return exchangePatCredentials(credentials,storageOptions)}catch(error){maybeWrapCredentialRefreshError(error)}if(expired)throw new Error("\u5F53\u524D\u51ED\u636E\u5DF2\u8FC7\u671F\u4E14\u4E0D\u652F\u6301\u81EA\u52A8\u5237\u65B0\uFF0C\u8BF7\u91CD\u65B0\u6267\u884C `platform login` \u6216 `platform login --pat <token>`\u3002");return credentials}function persistCliContext(context){withCliStateFileWriteFallback({fileName:"context.json",operation:"\u5199\u5165",write:({filePath,stateDir})=>{mkdirSync5(stateDir,{recursive:!0}),writeFileSync5(filePath,`${JSON.stringify({...context,updated_at:new Date().toISOString()},null,2)}
+</html>`}function escapeHtml(s){return s.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}async function discoverOidcEndpoints(issuer){let discoveryUrl=`${issuer.endsWith("/")?issuer.slice(0,-1):issuer}/.well-known/openid-configuration`,response=await fetch(discoveryUrl);if(!response.ok)throw new Error(`\u83B7\u53D6 OIDC discovery \u5931\u8D25: ${response.status}`);let document=await response.json();if(!document.authorization_endpoint||!document.token_endpoint)throw new Error("OIDC discovery \u7F3A\u5C11\u6388\u6743\u6216 token \u7AEF\u70B9");return{authorization_endpoint:document.authorization_endpoint,device_authorization_endpoint:document.device_authorization_endpoint,token_endpoint:document.token_endpoint}}function getCredentialPath(){return resolveCliStateFilePath("credentials.json")}function getCliContextPath(){return resolveCliStateFilePath("context.json")}function getCliStateDir(){return resolveCliStateDir()}var CliLegacyCredentialStore=class{platform;backend="file";constructor(platform){this.platform=platform}exists(){return existsSync10(getCredentialPath())}read(){return new FileCredentialStore(getCredentialPath(),{platform:this.platform}).read()}write(value){withCliStateFileWriteFallback({fileName:"credentials.json",operation:"\u5199\u5165",write:({filePath})=>new FileCredentialStore(filePath,{platform:this.platform}).write(value)})}delete(){new FileCredentialStore(getCredentialPath(),{platform:this.platform}).delete()}};function resolveCredentialStores(options={}){let stateDir=options.stateDir??getCliStateDir(),platform=options.platform??process.platform,profileName=options.profileName??getDistributionProfile().name,legacyStore=options.legacyStore??(options.stateDir?new FileCredentialStore(join6(stateDir,"credentials.json"),{platform}):new CliLegacyCredentialStore(platform)),hasInjectedStore=Object.prototype.hasOwnProperty.call(options,"secureStore")||Object.prototype.hasOwnProperty.call(options,"legacyStore"),backendPreference=options.backendPreference??(hasInjectedStore?{isFilePreferred:()=>!1,preferFile:()=>{},clear:()=>{}}:new FileCredentialBackendPreference(join6(stateDir,"credential-backend-preference.json")));if(Object.prototype.hasOwnProperty.call(options,"secureStore"))return{secureStore:options.secureStore??null,legacyStore,backendPreference};if(profileName==="developer"||profileName==="test-only")return{secureStore:null,legacyStore,backendPreference};let selectedStore=createCredentialStore({platform,stateDir,profileName});return{secureStore:selectedStore.backend==="file"?null:selectedStore,legacyStore,backendPreference}}function markCredentialOrigin(credentials,backend){return Object.defineProperty(credentials,credentialOriginBackend,{value:backend,enumerable:!1,configurable:!0}),credentials}function getCredentialOrigin(credentials){return credentials[credentialOriginBackend]}function emitCredentialStoreWarnings(warnings,backend){if(warnings.length===0&&backend!=="file"){let report2=inspectCredentialSecurity({credentialsPath:getCredentialPath(),credentialsExist:existsSync10(getCredentialPath()),backend,probeWindowsAcl:!1});emitCredentialSecurityWarnings(report2);return}let report=inspectCredentialSecurity({credentialsPath:getCredentialPath(),credentialsExist:existsSync10(getCredentialPath()),backend,probeWindowsAcl:!1}),existingCodes=new Set(report.findings.map(finding=>finding.code));for(let code2 of warnings){if(existingCodes.has(code2))continue;let detail=credentialStoreWarningDetail(code2);report.findings.push({code:code2,level:code2==="credential_store_corrupted"?"error":"warning",...detail})}report.status=report.findings.some(finding=>finding.level==="error")?"error":report.findings.length>0?"warning":"ok",report.code=report.findings[0]?.code??"credential_security_ok",emitCredentialSecurityWarnings(report)}function credentialStoreWarningDetail(code2){switch(code2){case"credential_migration_pending":return{message:"\u68C0\u6D4B\u5230\u65E7\u7248\u660E\u6587\u51ED\u636E\uFF0C\u5F53\u524D\u767B\u5F55\u6001\u4ECD\u53EF\u7EE7\u7EED\u4F7F\u7528\u3002",action:"\u8FD0\u884C `platform credentials migrate` \u5B8C\u6210\u5F53\u524D\u5E73\u53F0\u7684\u51ED\u636E\u8FC1\u79FB\u6216\u654F\u611F\u5B57\u6BB5\u51C0\u5316\u3002"};case"credential_migration_failed":return{message:"\u51ED\u636E\u5B89\u5168\u8FC1\u79FB\u672A\u5B8C\u6210\uFF0C\u5DF2\u4FDD\u7559\u539F\u6709\u53EF\u7528\u767B\u5F55\u6001\u3002",action:"\u8FD0\u884C `platform diagnostics credentials` \u67E5\u770B\u72B6\u6001\u540E\u91CD\u8BD5\u8FC1\u79FB\u3002"};case"credential_store_corrupted":return{message:"\u7CFB\u7EDF\u5B89\u5168\u5B58\u50A8\u4E2D\u7684 CLI \u51ED\u636E\u65E0\u6CD5\u8BFB\u53D6\uFF0C\u5DF2\u5C1D\u8BD5\u517C\u5BB9\u51ED\u636E\u3002",action:"\u5982\u65E0\u517C\u5BB9\u51ED\u636E\uFF0C\u8BF7\u91CD\u65B0\u6267\u884C `platform login`\u3002"};default:return{message:"\u7CFB\u7EDF\u5B89\u5168\u5B58\u50A8\u5F53\u524D\u4E0D\u53EF\u7528\uFF0C\u5DF2\u4F7F\u7528\u517C\u5BB9\u6587\u4EF6\u4E14\u672C\u6B21\u547D\u4EE4\u7EE7\u7EED\u6267\u884C\u3002",action:"\u8FD0\u884C `platform diagnostics credentials` \u67E5\u770B\u72B6\u6001\u5E76\u5728\u6062\u590D\u540E\u91CD\u8BD5\u8FC1\u79FB\u3002"}}}function loadStoredCredentials(storageOptions={}){let stores=resolveCredentialStores(storageOptions),result=readCredentialsWithFallback(stores);return emitCredentialStoreWarnings(result.warnings,result.backend),result.credentials&&result.backend!=="none"?markCredentialOrigin(result.credentials,result.backend):null}function selectApiToken(credentials){if(looksLikeJwt(credentials.access_token)){if(isJwtCurrent(credentials.access_token))return credentials.access_token;if(!credentials.id_token)throw new CliSessionExpiredError("access token \u5DF2\u8FC7\u671F")}if(credentials.id_token){if(looksLikeJwt(credentials.id_token)&&isJwtCurrent(credentials.id_token))return credentials.id_token;throw new CliSessionExpiredError("ID Token \u5DF2\u8FC7\u671F\u6216\u683C\u5F0F\u65E0\u6548")}return credentials.access_token}function loadStoredCliContext(){let cliContextPath=getCliContextPath();return existsSync10(cliContextPath)?JSON.parse(readFileSync9(cliContextPath,"utf8")):null}function persistCredentials(credentials,storageOptions={}){let stores=resolveCredentialStores(storageOptions),result=writeCredentialsWithFallback(credentials,stores);return markCredentialOrigin(credentials,result.backend),emitCredentialStoreWarnings(result.warnings,result.backend),result}function migrateStoredCredentials(storageOptions={}){let stores=resolveCredentialStores(storageOptions),result=migrateLegacyCredentials(stores);return emitCredentialStoreWarnings(result.warnings,result.backend),result}function inspectStoredCredentialSecurity(storageOptions={}){let stores=resolveCredentialStores(storageOptions),credentialsPath=getCredentialPath(),legacyExists=stores.legacyStore.exists?.()??existsSync10(credentialsPath),backend=legacyExists?"file":"none",secureWarning=null;if(stores.secureStore?.exists)try{stores.secureStore.exists()&&(backend=stores.secureStore.backend)}catch(error){secureWarning=error instanceof Error&&"code"in error&&error.code==="credential_store_corrupted"?"credential_store_corrupted":"credential_secure_store_unavailable"}let report=inspectCredentialSecurity({credentialsPath,credentialsExist:legacyExists,backend});return secureWarning&&!report.findings.some(finding=>finding.code===secureWarning)&&(report.findings.push({code:secureWarning,level:secureWarning==="credential_store_corrupted"?"error":"warning",...credentialStoreWarningDetail(secureWarning)}),report.status=secureWarning==="credential_store_corrupted"?"error":"warning",report.code=report.findings[0]?.code??secureWarning),report}function clearStoredAuthentication(storageOptions={}){let stateDir=storageOptions.stateDir??getCliStateDir(),stores=resolveCredentialStores({...storageOptions,stateDir}),cleared=[],failed=[],attempt=(target,operation)=>{try{operation(),cleared.push(target)}catch{failed.push({target})}};stores.secureStore&&attempt(stores.secureStore.backend,()=>stores.secureStore.delete()),attempt("legacy_file",()=>stores.legacyStore.delete()),attempt("account_context",()=>deleteFileIfPresent(join6(stateDir,"context.json"))),attempt("warning_state",()=>deleteFileIfPresent(join6(stateDir,"credential-warning-state.json"))),attempt("backend_preference",()=>deleteFileIfPresent(join6(stateDir,"credential-backend-preference.json")));try{let temporaryFailures=deleteCredentialTemporaryFiles(stateDir,storageOptions.temporaryFileDeleter??deleteFileIfPresent);temporaryFailures.length===0&&cleared.push("orphan_temporary_files"),failed.push(...temporaryFailures.map(name=>({target:`orphan_temporary_file:${name}`})))}catch{failed.push({target:"orphan_temporary_files"})}return{status:failed.length>0?"partial":"cleared",cleared,failed}}function deleteFileIfPresent(filePath){try{unlinkSync4(filePath)}catch(error){if(error.code!=="ENOENT")throw error}}function deleteCredentialTemporaryFiles(stateDir,deleter){let entries;try{entries=readdirSync2(stateDir,{withFileTypes:!0,encoding:"utf8"})}catch(error){if(error.code==="ENOENT")return[];throw error}let failed=[];for(let entry of entries)if(!(!entry.isFile()||!/^(?:credentials\.json|credentials\.dpapi|credential-warning-state\.json|credential-backend-preference\.json)\.tmp-[a-z0-9-]+$/iu.test(entry.name)))try{deleter(join6(stateDir,entry.name))}catch{failed.push(entry.name)}return failed}function persistRefreshedCredentials(nextCredentials,previousCredentials,storageOptions){let stores=resolveCredentialStores(storageOptions);if(getCredentialOrigin(previousCredentials)==="file"){stores.legacyStore.write(toFileFallbackCredentials(nextCredentials)),markCredentialOrigin(nextCredentials,"file");let result={backend:"file",warnings:[],legacyDeleted:!1};return emitCredentialStoreWarnings(result.warnings,result.backend),result}return persistCredentials(nextCredentials,{...storageOptions,...stores})}function resolveStoredClientId(credentials){return credentials.client_id?.trim()||readAuthConfigValue(AUTH_CLI_CLIENT_ID_KEYS)||readAuthConfigValue(AUTH_TENANT_CLIENT_ID_KEYS)}function readJwtExpiryMs(token){if(!looksLikeJwt(token))return null;try{let[,payload]=token.split("."),decoded=JSON.parse(Buffer.from(payload,"base64url").toString("utf8"));return typeof decoded.exp=="number"&&Number.isFinite(decoded.exp)?decoded.exp*1e3:null}catch{return null}}function isJwtCurrent(token,now=Date.now()){let expiresAt=readJwtExpiryMs(token);return expiresAt!==null&&expiresAt>now}function isCredentialExpired(credentials,now=Date.now()){if(looksLikeJwt(credentials.access_token)){let accessTokenExpiry=readJwtExpiryMs(credentials.access_token);return accessTokenExpiry===null||accessTokenExpiry-TOKEN_REFRESH_SKEW_MS<=now}if(credentials.id_token!==void 0){let idTokenExpiry=readJwtExpiryMs(credentials.id_token);return idTokenExpiry===null||idTokenExpiry-TOKEN_REFRESH_SKEW_MS<=now}if(typeof credentials.expires_in=="number"&&Number.isFinite(credentials.expires_in)){let issuedAt=Date.parse(credentials.issued_at);if(Number.isFinite(issuedAt))return issuedAt+credentials.expires_in*1e3-TOKEN_REFRESH_SKEW_MS<=now}return!1}function canUsePatExchange(credentials,now=Date.now()){if(credentials.credential_mode!=="pat_exchange"||!credentials.exchange_subject_token||!credentials.exchange_subject_token_type||!resolveStoredClientId(credentials)||!credentials.mode_expires_at)return!1;let expiresAt=Date.parse(credentials.mode_expires_at);return Number.isFinite(expiresAt)&&expiresAt>now}async function refreshCredentials(credentials,storageOptions){let issuer=process.env.OIDC_ISSUER?.trim()||getDistributionProfile().defaults?.OIDC_ISSUER?.trim();if(!issuer)throw new Error("\u5F53\u524D\u73AF\u5883\u7F3A\u5C11 OIDC_ISSUER\uFF0C\u65E0\u6CD5\u81EA\u52A8\u5237\u65B0 CLI \u51ED\u636E\u3002");let clientId=resolveStoredClientId(credentials);if(!clientId)throw new Error("\u5F53\u524D\u51ED\u636E\u7F3A\u5C11 client_id\uFF0C\u65E0\u6CD5\u81EA\u52A8\u5237\u65B0 CLI \u51ED\u636E\u3002");if(!credentials.refresh_token)throw new Error("\u5F53\u524D\u51ED\u636E\u7F3A\u5C11 refresh_token\uFF0C\u8BF7\u91CD\u65B0\u6267\u884C `platform login`\u3002");let endpoints=await discoverOidcEndpoints(issuer),body=new URLSearchParams;body.set("grant_type","refresh_token"),body.set("client_id",clientId),body.set("refresh_token",credentials.refresh_token),applyResource(body,process.env.OIDC_AUDIENCE?.trim()||getDistributionProfile().defaults?.OIDC_AUDIENCE?.trim());let response=await fetch(endpoints.token_endpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body}),payload=await response.json();if(!response.ok)throw mapTokenFailureToAuthError({error:payload.error,errorDescription:payload.error_description,fallback:"\u5237\u65B0 CLI token \u5931\u8D25"});if(typeof payload.access_token!="string"||payload.access_token.length===0)throw new Error("\u5237\u65B0\u540E\u7684 token \u54CD\u5E94\u7F3A\u5C11 access_token");let nextCredentials={access_token:payload.access_token,id_token:typeof payload.id_token=="string"?payload.id_token:credentials.id_token,refresh_token:typeof payload.refresh_token=="string"?payload.refresh_token:credentials.refresh_token,client_id:clientId,token_type:payload.token_type??credentials.token_type,expires_in:typeof payload.expires_in=="number"?payload.expires_in:credentials.expires_in,scope:payload.scope??credentials.scope,issued_at:new Date().toISOString(),credential_mode:credentials.credential_mode??"interactive",exchange_subject_token:credentials.exchange_subject_token,exchange_subject_token_type:credentials.exchange_subject_token_type,mode_expires_at:credentials.mode_expires_at};return selectApiToken(nextCredentials),persistRefreshedCredentials(nextCredentials,credentials,storageOptions),nextCredentials}async function exchangePatCredentials(credentials,storageOptions){let issuer=process.env.OIDC_ISSUER?.trim()||getDistributionProfile().defaults?.OIDC_ISSUER?.trim();if(!issuer)throw new Error("\u5F53\u524D\u73AF\u5883\u7F3A\u5C11 OIDC_ISSUER\uFF0C\u65E0\u6CD5\u81EA\u52A8\u5237\u65B0 PAT \u51ED\u636E\u3002");let clientId=resolveStoredClientId(credentials);if(!clientId)throw new Error("\u5F53\u524D PAT \u51ED\u636E\u7F3A\u5C11 client_id\uFF0C\u65E0\u6CD5\u81EA\u52A8\u5237\u65B0\u3002");if(!credentials.exchange_subject_token||!credentials.exchange_subject_token_type)throw new Error("\u5F53\u524D PAT \u51ED\u636E\u7F3A\u5C11 subject_token\uFF0C\u8BF7\u91CD\u65B0\u6267\u884C `platform login --pat <token>`\u3002");if(credentials.mode_expires_at){let hardExpiry=Date.parse(credentials.mode_expires_at);if(Number.isFinite(hardExpiry)&&hardExpiry<=Date.now())throw new Error("\u5F53\u524D PAT \u767B\u5F55\u5DF2\u8D85\u8FC7 7 \u5929\u6709\u6548\u671F\uFF0C\u8BF7\u91CD\u65B0\u6267\u884C `platform login --pat <token>`\u3002")}let endpoints=await discoverOidcEndpoints(issuer),body=new URLSearchParams;body.set("grant_type","urn:ietf:params:oauth:grant-type:token-exchange"),body.set("client_id",clientId),body.set("subject_token",credentials.exchange_subject_token),body.set("subject_token_type",credentials.exchange_subject_token_type),body.set("requested_token_type","urn:ietf:params:oauth:token-type:access_token"),credentials.scope?.trim()&&body.set("scope",credentials.scope.trim()),applyResource(body,process.env.OIDC_AUDIENCE?.trim()||getDistributionProfile().defaults?.OIDC_AUDIENCE?.trim());let response=await fetch(endpoints.token_endpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body}),payload=await response.json();if(!response.ok)throw mapTokenFailureToAuthError({error:payload.error,errorDescription:payload.error_description,fallback:"PAT \u4EA4\u6362 access token \u5931\u8D25"});if(typeof payload.access_token!="string"||payload.access_token.length===0)throw new Error("PAT \u4EA4\u6362\u540E\u7684 token \u54CD\u5E94\u7F3A\u5C11 access_token");let nextCredentials={access_token:payload.access_token,id_token:typeof payload.id_token=="string"?payload.id_token:credentials.id_token,client_id:clientId,token_type:payload.token_type??credentials.token_type,expires_in:typeof payload.expires_in=="number"?payload.expires_in:credentials.expires_in,scope:payload.scope??credentials.scope,issued_at:new Date().toISOString(),credential_mode:"pat_exchange",exchange_subject_token:credentials.exchange_subject_token,exchange_subject_token_type:credentials.exchange_subject_token_type,mode_expires_at:credentials.mode_expires_at};return persistRefreshedCredentials(nextCredentials,credentials,storageOptions),nextCredentials}async function loadStoredCredentialsEnsuringFresh(options={}){let storageOptions=options.storage??{},credentials=loadStoredCredentials(storageOptions);if(!credentials)return null;let expired=isCredentialExpired(credentials);if(!options.forceRefresh&&!expired)return credentials;if(credentials.refresh_token)try{return refreshCredentials(credentials,storageOptions)}catch(error){maybeWrapCredentialRefreshError(error)}if(canUsePatExchange(credentials))try{return exchangePatCredentials(credentials,storageOptions)}catch(error){maybeWrapCredentialRefreshError(error)}if(expired)throw new Error("\u5F53\u524D\u51ED\u636E\u5DF2\u8FC7\u671F\u4E14\u4E0D\u652F\u6301\u81EA\u52A8\u5237\u65B0\uFF0C\u8BF7\u91CD\u65B0\u6267\u884C `platform login` \u6216 `platform login --pat <token>`\u3002");return credentials}function persistCliContext(context){withCliStateFileWriteFallback({fileName:"context.json",operation:"\u5199\u5165",write:({filePath,stateDir})=>{mkdirSync5(stateDir,{recursive:!0}),writeFileSync5(filePath,`${JSON.stringify({...context,updated_at:new Date().toISOString()},null,2)}
 `,"utf8"),chmodSync3(filePath,384)}})}async function performDeviceCodeLogin(config2){let endpoints=await discoverOidcEndpoints(config2.issuer);if(!endpoints.device_authorization_endpoint)throw new Error("OIDC discovery \u7F3A\u5C11 Device Flow \u7AEF\u70B9");let authBody=new URLSearchParams;authBody.set("client_id",config2.clientId),authBody.set("scope",config2.scopes.join(" ")),applyResource(authBody,config2.audience);let deviceResponse=await fetch(endpoints.device_authorization_endpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:authBody}),devicePayload=await deviceResponse.json();if(!deviceResponse.ok)throw new Error(devicePayload.error_description??devicePayload.error??"\u7533\u8BF7 device_code \u5931\u8D25");await config2.onPrompt?.({verificationUri:devicePayload.verification_uri_complete??devicePayload.verification_uri??config2.issuer,userCode:devicePayload.user_code,expiresIn:devicePayload.expires_in});let intervalSeconds=Math.max(devicePayload.interval??5,1),deadline=Date.now()+devicePayload.expires_in*1e3;for(;Date.now()<deadline;){await sleep(intervalSeconds*1e3);let tokenBody=new URLSearchParams;tokenBody.set("grant_type","urn:ietf:params:oauth:grant-type:device_code"),tokenBody.set("device_code",devicePayload.device_code),tokenBody.set("client_id",config2.clientId);let tokenResponse=await fetch(endpoints.token_endpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:tokenBody}),tokenPayload=await tokenResponse.json();if(tokenResponse.ok)return{access_token:tokenPayload.access_token,id_token:tokenPayload.id_token,refresh_token:tokenPayload.refresh_token,client_id:config2.clientId,token_type:tokenPayload.token_type,expires_in:tokenPayload.expires_in,scope:tokenPayload.scope,issued_at:new Date().toISOString(),verificationUri:devicePayload.verification_uri_complete??devicePayload.verification_uri??config2.issuer,userCode:devicePayload.user_code};if(tokenPayload.error!=="authorization_pending"){if(tokenPayload.error==="slow_down"){await sleep(intervalSeconds*1e3);continue}throw new Error(tokenPayload.error_description??tokenPayload.error??"\u8F6E\u8BE2 token \u5931\u8D25")}}throw new Error("Device Code \u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u6267\u884C `platform login`")}async function performAuthorizationCodeLogin(config2){let endpoints=await discoverOidcEndpoints(config2.issuer),redirectUrl=new URL(config2.redirectUri);if(redirectUrl.protocol!=="http:")throw new Error("CLI \u6D4F\u89C8\u5668\u6388\u6743\u4EC5\u652F\u6301 http \u56DE\u8C03\u5730\u5740");let state=randomBytes3(16).toString("base64url"),nonce=randomBytes3(16).toString("base64url"),codeVerifier=randomBytes3(32).toString("base64url"),codeChallenge=createHash5("sha256").update(codeVerifier).digest("base64url"),authorizationUrl=new URL(endpoints.authorization_endpoint);authorizationUrl.searchParams.set("client_id",config2.clientId),authorizationUrl.searchParams.set("redirect_uri",config2.redirectUri),authorizationUrl.searchParams.set("response_type","code"),authorizationUrl.searchParams.set("scope",config2.scopes.join(" ")),authorizationUrl.searchParams.set("state",state),authorizationUrl.searchParams.set("nonce",nonce),authorizationUrl.searchParams.set("code_challenge",codeChallenge),authorizationUrl.searchParams.set("code_challenge_method","S256");let normalizedPrompt=normalizeAuthorizationPrompt(config2.scopes,config2.prompt);normalizedPrompt&&authorizationUrl.searchParams.set("prompt",normalizedPrompt),applyResource(authorizationUrl.searchParams,config2.audience);let callbackResult=await new Promise((resolve20,reject)=>{let timeout=setTimeout(()=>{server.close(()=>{}),reject(new Error("\u6D4F\u89C8\u5668\u6388\u6743\u8D85\u65F6\uFF0C\u8BF7\u91CD\u65B0\u6267\u884C `platform login`"))},3e5),server=createServer((req,res)=>{let url=new URL(req.url??"/",config2.redirectUri);if(url.pathname!==redirectUrl.pathname){res.writeHead(404,{"Content-Type":"text/plain; charset=utf-8"}),res.end("Not Found");return}let returnedState=url.searchParams.get("state"),error=url.searchParams.get("error"),code2=url.searchParams.get("code");if(error){clearTimeout(timeout);let errMsg=url.searchParams.get("error_description")??error;res.writeHead(400,{"Content-Type":"text/html; charset=utf-8"}),res.end(getLoginFailureHtml(errMsg)),server.close(()=>{}),reject(new Error(errMsg));return}if(!code2||returnedState!==state){clearTimeout(timeout),res.writeHead(400,{"Content-Type":"text/html; charset=utf-8"}),res.end(getLoginFailureHtml("\u6D4F\u89C8\u5668\u56DE\u8C03\u7F3A\u5C11\u6388\u6743\u7801\u6216 state \u4E0D\u5339\u914D\u3002")),server.close(()=>{}),reject(new Error("\u6D4F\u89C8\u5668\u56DE\u8C03\u7F3A\u5C11 code \u6216 state \u4E0D\u5339\u914D"));return}clearTimeout(timeout),res.writeHead(200,{"Content-Type":"text/html; charset=utf-8"}),res.end(getLoginSuccessHtml()),server.close(()=>{}),resolve20({code:code2})});server.on("error",error=>{clearTimeout(timeout),reject(error)}),server.listen(Number(redirectUrl.port||80),redirectUrl.hostname,async()=>{try{await config2.onPrompt?.({authorizationUrl:authorizationUrl.toString(),redirectUri:config2.redirectUri})}catch(error){clearTimeout(timeout),server.close(()=>{}),reject(error)}})}),tokenBody=new URLSearchParams;tokenBody.set("grant_type","authorization_code"),tokenBody.set("client_id",config2.clientId),tokenBody.set("code",callbackResult.code),tokenBody.set("redirect_uri",config2.redirectUri),tokenBody.set("code_verifier",codeVerifier),applyResource(tokenBody,config2.audience);let tokenResponse=await fetch(endpoints.token_endpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:tokenBody}),tokenPayload=await tokenResponse.json();if(!tokenResponse.ok)throw new Error(tokenPayload.error_description??tokenPayload.error??"\u6388\u6743\u7801\u6362\u53D6 token \u5931\u8D25");return{access_token:tokenPayload.access_token,id_token:tokenPayload.id_token,refresh_token:tokenPayload.refresh_token,client_id:config2.clientId,token_type:tokenPayload.token_type,expires_in:tokenPayload.expires_in,scope:tokenPayload.scope,issued_at:new Date().toISOString(),authorizationUrl:authorizationUrl.toString(),redirectUri:config2.redirectUri}}async function performPatTokenExchangeLogin(config2){let endpoints=await discoverOidcEndpoints(config2.issuer),body=new URLSearchParams;body.set("grant_type","urn:ietf:params:oauth:grant-type:token-exchange"),body.set("client_id",config2.clientId),body.set("subject_token",config2.subjectToken),body.set("subject_token_type",config2.subjectTokenType??"urn:logto:token-type:personal_access_token"),body.set("requested_token_type","urn:ietf:params:oauth:token-type:access_token"),config2.scopes.length>0&&body.set("scope",config2.scopes.join(" ")),applyResource(body,config2.audience);let tokenResponse=await fetch(endpoints.token_endpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body}),tokenPayload=await tokenResponse.json();if(!tokenResponse.ok)throw new Error(tokenPayload.error_description??tokenPayload.error??"PAT \u4EA4\u6362 token \u5931\u8D25");return{access_token:tokenPayload.access_token,id_token:typeof tokenPayload.id_token=="string"?tokenPayload.id_token:void 0,client_id:config2.clientId,token_type:tokenPayload.token_type,expires_in:tokenPayload.expires_in,scope:tokenPayload.scope??config2.scopes.join(" "),issued_at:new Date().toISOString(),credential_mode:"pat_exchange",exchange_subject_token:config2.subjectToken,exchange_subject_token_type:config2.subjectTokenType??"urn:logto:token-type:personal_access_token",mode_expires_at:new Date(Date.now()+PAT_LOGIN_VALIDITY_MS).toISOString()}}async function fetchWhoAmI(args){return createControlApiSdk({baseUrl:args.baseUrl,accessToken:args.accessToken,tenantId:args.tenantId,capability:"auth",requestClass:"control"}).getWhoAmI()}async function fetchTenantOverview(args){return createControlApiSdk({baseUrl:args.baseUrl,accessToken:args.accessToken,tenantId:args.tenantId,capability:"dashboard",requestClass:"control"}).getTenantOverview()}async function listTenantWorkspaces(args){return createControlApiSdk({baseUrl:args.baseUrl,accessToken:args.accessToken,capability:"auth",requestClass:"control"}).listTenantWorkspaces()}function looksLikeJwt(token){if(!token)return!1;let parts=token.split(".");return parts.length>=2&&parts.every(part=>part.length>0)}import{existsSync as existsSync11,mkdirSync as mkdirSync6,mkdtempSync as mkdtempSync2,readdirSync as readdirSync3,readFileSync as readFileSync10,renameSync as renameSync3,rmSync,statSync as statSync2,writeFileSync as writeFileSync6}from"node:fs";import{createServer as createNetServer}from"node:net";import{basename as basename3,dirname as dirname7,join as join7,relative as relative2,resolve as resolve7}from"node:path";import YAML from"yaml";var DEFAULT_APP_TEMPLATE_KEY="frontend-app-vite";function normalizeAppTemplateKey(value){if(typeof value>"u"||value.trim().length===0)return;let normalized=value.trim();if(normalized==="frontend-app-vite")return"frontend-app-vite";if(normalized==="backend-app-node")return"backend-app-node";throw new Error(`\u4E0D\u652F\u6301\u7684\u5E94\u7528\u6A21\u677F: ${normalized}\u3002\u5F53\u524D\u4EC5\u652F\u6301 \`frontend-app-vite\`\u3001\`backend-app-node\`\u3002\u65E7\u6A21\u677F\u5DF2\u4E0B\u7EBF\u3002`)}var PLATFORM_DIRECTORY=".platform",APP_MANIFEST_FILE="app.yaml",LEGACY_BINDING_FILE=join7(PLATFORM_DIRECTORY,"config.json"),SOURCE_CONTEXT_FILE=join7(PLATFORM_DIRECTORY,"source-context.json"),PLATFORM_BLOCKS_LOCKFILE=join7(PLATFORM_DIRECTORY,"platform-blocks.lock.json").replace(/\\/g,"/"),SOURCE_WORKSPACE_BYTES_LIMIT=50*1024*1024,SOURCE_WORKSPACE_ASSET_EXTENSIONS=new Set([".png",".jpg",".jpeg",".gif",".webp",".svg",".ico",".bmp",".avif",".mp4",".mp3",".wav",".ogg",".pdf",".woff",".woff2",".ttf",".otf",".eot",".zip",".gz"]);function ensureDirectory(directory){mkdirSync6(directory,{recursive:!0})}function writeFileIfMissing(path3,content){if(existsSync11(path3))throw new Error(`\u6587\u4EF6\u5DF2\u5B58\u5728\uFF0C\u62D2\u7EDD\u8986\u76D6: ${path3}`);ensureDirectory(dirname7(path3)),writeFileSync6(path3,content,"utf8")}function listFilesRecursively(root,current=root){if(!existsSync11(current)||!statSync2(current).isDirectory())return[];let files=[];for(let entry of readdirSync3(current,{withFileTypes:!0})){let absolutePath=join7(current,entry.name);if(entry.isDirectory()){files.push(...listFilesRecursively(root,absolutePath));continue}entry.isFile()&&files.push(relative2(root,absolutePath))}return files.sort((left,right)=>left.localeCompare(right))}function seedRuntimeSdkVendor(targetDir){let workspaceRoot=findWorkspaceRoot(),runtimeSdkDistDir=join7(workspaceRoot,"packages","runtime-sdk","dist");if(!existsSync11(runtimeSdkDistDir)||!statSync2(runtimeSdkDistDir).isDirectory())throw new Error(`\u7F3A\u5C11\u6D4F\u89C8\u5668\u4FA7 runtime-sdk \u6784\u5EFA\u4EA7\u7269\uFF1A${runtimeSdkDistDir}\u3002\u8BF7\u5148\u6267\u884C \`pnpm --filter @platform/runtime-sdk build\`\uFF0C\u518D\u91CD\u65B0\u521D\u59CB\u5316\u8F7B\u5E94\u7528\u6A21\u677F\u3002`);let created=[];for(let relativePath of listFilesRecursively(runtimeSdkDistDir)){let sourcePath=join7(runtimeSdkDistDir,relativePath),outputPath=join7(targetDir,"vendor","runtime-sdk",relativePath);writeFileIfMissing(outputPath,readFileSync10(sourcePath,"utf8")),created.push(relative2(process.cwd(),outputPath))}return created}function normalizeAppManifest(input){let name=typeof input?.name=="string"&&input.name.trim().length>0?input.name.trim():"light-app",moduleName=typeof input?.module=="string"&&input.module.trim().length>0?input.module.trim():"light-app",templateKey=typeof input?.template_key=="string"&&input.template_key.trim().length>0?input.template_key.trim():DEFAULT_APP_TEMPLATE_KEY,normalizedEnvironments=Array.isArray(input?.environments)&&input.environments.length>0?input.environments.map(environment=>typeof environment?.name=="string"&&environment.name.trim().length>0?{name:environment.name.trim()}:null).filter(environment=>environment!==null):[];return{name,version:typeof input?.version=="string"&&input.version.trim().length>0?input.version.trim():"0.1.0",module:moduleName,template_key:templateKey,dev:{auto_restart:input?.dev?.auto_restart===!0},entry:{command:typeof input?.entry?.command=="string"&&input.entry.command.trim().length>0?input.entry.command.trim():"npm run dev",port:typeof input?.entry?.port=="number"&&Number.isFinite(input.entry.port)&&input.entry.port>0?input.entry.port:3e3,health_check:typeof input?.entry?.health_check=="string"&&input.entry.health_check.trim().length>0?input.entry.health_check.trim():"/healthz"},required_skills:Array.isArray(input?.required_skills)?input.required_skills.filter(Boolean):["db","auth"],permissions:Array.isArray(input?.permissions)?input.permissions.filter(Boolean):["app:read","app:write","app:publish"],env_vars:Array.isArray(input?.env_vars)?input.env_vars.filter(Boolean):["PORT","NODE_ENV","APP_ID","APP_ENV","TENANT_ID","DATABASE_URL","DATABASE_SCHEMA","CONTROL_API_BASE_URL"],runtime:{cpu:typeof input?.runtime?.cpu=="string"&&input.runtime.cpu.trim().length>0?input.runtime.cpu.trim():"250m",memory_mb:typeof input?.runtime?.memory_mb=="number"&&Number.isFinite(input.runtime.memory_mb)&&input.runtime.memory_mb>0?input.runtime.memory_mb:256},environments:normalizedEnvironments.length>0?normalizedEnvironments:[{name:"preview"},{name:"prod"}]}}function initProject(targetDir,_appName,templateKey=DEFAULT_APP_TEMPLATE_KEY){let absoluteTargetDir=resolve7(getInvocationCwd(),targetDir);ensureDirectory(absoluteTargetDir);let createdFiles=[],normalizedTemplateKey=normalizeAppTemplateKey(templateKey)??DEFAULT_APP_TEMPLATE_KEY,scaffoldFiles=normalizedTemplateKey==="frontend-app-vite"?assembleFrontendAppViteTemplate():normalizedTemplateKey==="backend-app-node"?assembleBackendAppNodeTemplate():assembleFrontendAppViteTemplate();for(let file of scaffoldFiles){let outputPath=join7(absoluteTargetDir,file.path);writeFileIfMissing(outputPath,file.content),createdFiles.push(relative2(getInvocationCwd(),outputPath))}let vendorCreated=scaffoldFiles.some(file=>file.path.startsWith("vendor/runtime-sdk/")||file.path.startsWith("src/vendor/runtime-sdk/"))?[]:seedRuntimeSdkVendor(absoluteTargetDir);return[...createdFiles,...vendorCreated]}function scaffoldAppDebugSurface(startDir,scaffold){let appRoot=findAppRoot(startDir),appJsPath=join7(appRoot,"src","app.js");if(!existsSync11(appJsPath))throw new Error(`\u672A\u627E\u5230\u5E94\u7528\u5165\u53E3\u6587\u4EF6: ${appJsPath}`);let spec=getAppDebugScaffoldSpec(scaffold),createdFiles=[],updatedFiles=[],targetFilePath=join7(appRoot,spec.filePath);existsSync11(targetFilePath)||(ensureDirectory(dirname7(targetFilePath)),writeFileSync6(targetFilePath,spec.source,"utf8"),createdFiles.push(relative2(appRoot,targetFilePath).replace(/\\/g,"/")));let appSource=readFileSync10(appJsPath,"utf8"),nextSource=injectDebugRouteIntoAppSource(appSource,spec);return nextSource!==appSource&&(writeFileSync6(appJsPath,nextSource,"utf8"),updatedFiles.push(relative2(appRoot,appJsPath).replace(/\\/g,"/"))),{appRoot,createdFiles,updatedFiles,routePath:spec.routePath}}function readAppManifest(startDir=getInvocationCwd()){let appRoot=findAppRoot(startDir),manifestPath=join7(appRoot,APP_MANIFEST_FILE),raw=readFileSync10(manifestPath,"utf8"),manifest=normalizeAppManifest(YAML.parse(raw));if(!manifest||typeof manifest!="object")throw new Error(`\u65E0\u6548\u7684 app.yaml: ${manifestPath}`);return{directory:appRoot,path:manifestPath,manifest}}function readLegacyBinding(startDir=getInvocationCwd()){let appRoot=findAppRoot(startDir),bindingPath=join7(appRoot,LEGACY_BINDING_FILE);if(!existsSync11(bindingPath))return null;let raw=JSON.parse(readFileSync10(bindingPath,"utf8")),binding={schema_version:typeof raw.schema_version=="number"?raw.schema_version:1,tenant_id:raw.tenant_id??"",app_id:raw.app_id??"",env:raw.env??"preview",linked_at:raw.linked_at??new Date(0).toISOString(),workspace_name:raw.workspace_name,app_name:raw.app_name,app_display_name:raw.app_display_name,validated_at:raw.validated_at};return{path:bindingPath,binding}}function readBinding(startDir=getInvocationCwd()){let sourceContext=readSourceContext(startDir);if(sourceContext?.sourceContext.tenant_id&&sourceContext.sourceContext.app_id){let context=sourceContext.sourceContext;return{path:sourceContext.path,binding:{schema_version:1,tenant_id:context.tenant_id,app_id:context.app_id,env:context.env||"preview",linked_at:context.linked_at??context.checked_out_at??context.updated_at,workspace_name:context.workspace_name,app_name:context.app_name,app_display_name:context.app_display_name,validated_at:context.validated_at}}}return readLegacyBinding(startDir)}function writeBinding(startDir,binding){let result=updateSourceContext(startDir,{tenant_id:binding.tenant_id,app_id:binding.app_id,env:binding.env,workspace_name:binding.workspace_name,app_name:binding.app_name,app_display_name:binding.app_display_name,validated_at:binding.validated_at,linked_at:new Date().toISOString()});return{appRoot:result.appRoot,path:result.path}}function readSourceContext(startDir=getInvocationCwd()){let appRoot=findAppRoot(startDir),sourceContextPath=join7(appRoot,SOURCE_CONTEXT_FILE);if(!existsSync11(sourceContextPath))return null;let raw=JSON.parse(readFileSync10(sourceContextPath,"utf8")),sourceContext={schema_version:typeof raw.schema_version=="number"?raw.schema_version:1,tenant_id:raw.tenant_id??"",app_id:raw.app_id??"",env:raw.env??"preview",linked_at:raw.linked_at,validated_at:raw.validated_at,workspace_name:raw.workspace_name,app_name:raw.app_name,app_display_name:raw.app_display_name,template_key:raw.template_key,default_directory:raw.default_directory,generated_from_template:typeof raw.generated_from_template=="boolean"?raw.generated_from_template:void 0,base_source_version_id:raw.base_source_version_id,checked_out_at:raw.checked_out_at,last_submitted_source_version_id:raw.last_submitted_source_version_id,last_submitted_at:raw.last_submitted_at,last_preview_source_version_id:raw.last_preview_source_version_id,last_preview_build_id:raw.last_preview_build_id,last_preview_generated_at:raw.last_preview_generated_at,control_plane:raw.control_plane&&typeof raw.control_plane=="object"?raw.control_plane:void 0,updated_at:raw.updated_at??new Date(0).toISOString()};return{path:sourceContextPath,sourceContext}}function writeSourceContext(startDir,sourceContext){let appRoot=findAppRoot(startDir),path3=join7(appRoot,SOURCE_CONTEXT_FILE);return ensureDirectory(dirname7(path3)),writeFileSync6(path3,`${JSON.stringify({schema_version:1,...sourceContext,updated_at:new Date().toISOString()},null,2)}
 `,"utf8"),{appRoot,path:path3}}function updateSourceContext(startDir,patch){let appRoot=findAppRoot(startDir),existing=readSourceContext(appRoot)?.sourceContext,legacyBinding=readLegacyBinding(appRoot)?.binding;return writeSourceContext(appRoot,{tenant_id:patch.tenant_id??existing?.tenant_id??legacyBinding?.tenant_id??"",app_id:patch.app_id??existing?.app_id??legacyBinding?.app_id??"",env:patch.env??existing?.env??legacyBinding?.env??"preview",linked_at:patch.linked_at??existing?.linked_at??legacyBinding?.linked_at,validated_at:patch.validated_at??existing?.validated_at??legacyBinding?.validated_at,workspace_name:patch.workspace_name??existing?.workspace_name??legacyBinding?.workspace_name,app_name:patch.app_name??existing?.app_name??legacyBinding?.app_name,app_display_name:patch.app_display_name??existing?.app_display_name??legacyBinding?.app_display_name,template_key:patch.template_key??existing?.template_key,default_directory:patch.default_directory??existing?.default_directory,generated_from_template:typeof patch.generated_from_template=="boolean"?patch.generated_from_template:existing?.generated_from_template,base_source_version_id:patch.base_source_version_id??existing?.base_source_version_id,checked_out_at:patch.checked_out_at??existing?.checked_out_at,last_submitted_source_version_id:patch.last_submitted_source_version_id??existing?.last_submitted_source_version_id,last_submitted_at:patch.last_submitted_at??existing?.last_submitted_at,last_preview_source_version_id:patch.last_preview_source_version_id??existing?.last_preview_source_version_id,last_preview_build_id:patch.last_preview_build_id??existing?.last_preview_build_id,last_preview_generated_at:patch.last_preview_generated_at??existing?.last_preview_generated_at,control_plane:patch.control_plane??existing?.control_plane})}function checkoutSourceWorkspace(targetDir,files,sourceContext){let absoluteTargetDir=resolve7(getInvocationCwd(),targetDir);if(validatePortableWorkspacePaths(files),existsSync11(absoluteTargetDir))throw new Error(`\u76EE\u6807\u76EE\u5F55\u5DF2\u5B58\u5728\uFF0C\u62D2\u7EDD\u8986\u76D6\uFF08\u5305\u62EC\u7A7A\u76EE\u5F55\uFF09: ${absoluteTargetDir}`);let parentDir=dirname7(absoluteTargetDir);ensureDirectory(parentDir);let stagingDir=mkdtempSync2(join7(parentDir,`.${basename3(absoluteTargetDir)}.platform-checkout-`));try{for(let file of files){let normalizedPath=normalizePortableWorkspacePath(file.path);writeFileIfMissing(join7(stagingDir,normalizedPath),file.content)}let now=new Date().toISOString();if(writeFileIfMissing(join7(stagingDir,SOURCE_CONTEXT_FILE),`${JSON.stringify({schema_version:1,...sourceContext,linked_at:sourceContext.linked_at??now,updated_at:now},null,2)}
 `),existsSync11(absoluteTargetDir))throw new Error(`\u76EE\u6807\u76EE\u5F55\u5728\u68C0\u51FA\u8FC7\u7A0B\u4E2D\u88AB\u521B\u5EFA\uFF0C\u62D2\u7EDD\u8986\u76D6: ${absoluteTargetDir}`);renameSync3(stagingDir,absoluteTargetDir)}catch(error){throw rmSync(stagingDir,{recursive:!0,force:!0}),error}return files.map(file=>relative2(getInvocationCwd(),join7(absoluteTargetDir,normalizePortableWorkspacePath(file.path))))}function validatePortableWorkspacePaths(files){let canonicalPaths=new Map;for(let file of files){let normalizedPath=normalizePortableWorkspacePath(file.path);if(normalizedPath.toLowerCase()===SOURCE_CONTEXT_FILE.replace(/\\/gu,"/").toLowerCase())throw new Error(`\u4E91\u7AEF\u6E90\u7801\u6587\u4EF6\u8DEF\u5F84\u975E\u6CD5\uFF08CLI \u4FDD\u7559\u8DEF\u5F84\uFF09: ${file.path}`);let canonicalPath=normalizedPath.normalize("NFC").toLowerCase(),collision=canonicalPaths.get(canonicalPath);if(collision)throw new Error(`\u4E91\u7AEF\u6E90\u7801\u6587\u4EF6\u8DEF\u5F84\u51B2\u7A81: ${collision} <-> ${file.path}`);canonicalPaths.set(canonicalPath,file.path)}for(let[canonicalPath,originalPath]of canonicalPaths){let segments=canonicalPath.split("/");for(let index=1;index<segments.length;index+=1){let parentPath=segments.slice(0,index).join("/"),parentOriginalPath=canonicalPaths.get(parentPath);if(parentOriginalPath)throw new Error(`\u4E91\u7AEF\u6E90\u7801\u6587\u4EF6\u8DEF\u5F84\u51B2\u7A81\uFF08\u6587\u4EF6\u4E0E\u76EE\u5F55\u91CD\u540D\uFF09: ${parentOriginalPath} <-> ${originalPath}`)}}}function normalizePortableWorkspacePath(inputPath){let normalizedSeparators=inputPath.replace(/\\/gu,"/");if(!normalizedSeparators||normalizedSeparators.startsWith("/")||/^[A-Za-z]:/u.test(normalizedSeparators))throw new Error(`\u4E91\u7AEF\u6E90\u7801\u6587\u4EF6\u8DEF\u5F84\u975E\u6CD5: ${inputPath}`);let segments=normalizedSeparators.split("/");for(let segment of segments){if(!segment||segment==="."||segment==="..")throw new Error(`\u4E91\u7AEF\u6E90\u7801\u6587\u4EF6\u8DEF\u5F84\u975E\u6CD5: ${inputPath}`);if(/[<>:"|?*\u0000-\u001F]/u.test(segment))throw new Error(`\u4E91\u7AEF\u6E90\u7801\u6587\u4EF6\u8DEF\u5F84\u5305\u542B Windows \u975E\u6CD5\u5B57\u7B26: ${inputPath}`);if(/[. ]$/u.test(segment))throw new Error(`\u4E91\u7AEF\u6E90\u7801\u6587\u4EF6\u8DEF\u5F84\u542B\u5C3E\u968F\u70B9\u6216\u7A7A\u683C: ${inputPath}`);let baseName=segment.split(".")[0]??segment;if(/^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/iu.test(baseName))throw new Error(`\u4E91\u7AEF\u6E90\u7801\u6587\u4EF6\u8DEF\u5F84\u4F7F\u7528 Windows \u4FDD\u7559\u540D: ${inputPath}`)}return segments.map(segment=>segment.normalize("NFC")).join("/")}function collectSourceWorkspaceFiles(startDir=getInvocationCwd()){let appRoot=findAppRoot(startDir),files=walkSourceWorkspace(appRoot,appRoot);return{appRoot,files}}function assertSourceWorkspaceCloudUploadPolicy(appRoot,commandLabel){let stats=scanSourceWorkspaceUploadPolicy(appRoot,appRoot);if(stats.sourceBytes>SOURCE_WORKSPACE_BYTES_LIMIT)throw new Error(`\u5F53\u524D\u6E90\u7801\u5305\u4F53\u79EF ${stats.sourceBytes} bytes\uFF0C\u8D85\u8FC7\u4E91\u7AEF\u6E90\u7801\u4E0A\u4F20\u4E0A\u9650 ${SOURCE_WORKSPACE_BYTES_LIMIT} bytes\u3002`);if(stats.assetHits.length>0)throw new Error([`\u68C0\u6D4B\u5230\u672C\u5730\u7D20\u6750\u8D44\u6E90\uFF0C\u5F53\u524D \`${commandLabel}\` \u4E0D\u8D1F\u8D23\u7D20\u6750\u4E0A\u4F20\u56DE\u5199\u3002`,"Agent \u8BF7\u5148\u53C2\u8003 Skill \u6587\u6863 `design-import.md` \u6267\u884C\u8BBE\u8BA1\u6E90\u7801\u9884\u5904\u7406\uFF0C\u5C06\u672C\u5730\u7D20\u6750\u4E0A\u4F20\u7D20\u6750\u5E93\u5E76\u628A\u6E90\u7801\u6539\u5199\u4E3A\u7D20\u6750\u5E93\u5F15\u7528\u540E\u518D\u8BD5\u3002",`\u793A\u4F8B\u547D\u4E2D: ${stats.assetHits.slice(0,10).join(", ")}`].join(`
@@ -2524,7 +2524,10 @@ ${unavailable?"[curl_unavailable] ":"[curl_failed] "}${curlMessage}`,{cause:erro
 `);return}process.stdout.write(["third-party design verify completed",`workspace_dir: ${output.workspace_dir}`,`status: ${output.status}`,`source_preprocess_execution_mode: ${output.state.sourcePreprocessExecutionMode}`,`has_import_summary: ${output.state.hasImportSummary}`,`has_merge_summary: ${output.state.hasMergeSummary}`,`has_imported_upstream_dir: ${output.state.hasImportedUpstreamDir}`,`pending_videos: ${output.state.pendingVideosCount}`,`pending_manual_items: ${output.state.pendingManualItemsCount}`,`path_base_violations_remaining: ${output.state.pathBaseViolationsRemaining}`,`missing_items: ${output.missing_items.length}`].join(`
 `)+`
 `)}function hasFlag(args,key){return args.options[key]===!0}function readOption(args,key){let value=args.options[key];return typeof value=="string"?value:void 0}function currentWorkspaceDir(){return process.env.PLATFORM_INVOCATION_CWD||process.env.INIT_CWD||process.cwd()}function printAppImportHelp(subcommand){switch(subcommand){case"preprocess":printAppImportPreprocessUsage();return;case"stage":printAppImportStageUsage();return;case"merge":printAppImportMergeUsage();return;case"verify":printAppImportVerifyUsage();return;default:process.stdout.write(["platform app import","","\u53EF\u7528\u5B50\u547D\u4EE4\uFF1A","  platform app import preprocess   \u751F\u6210 clean-source \u4E0E\u9884\u5904\u7406\u62A5\u544A","  platform app import stage        \u628A clean-source \u4E0E reports stage \u5230\u6A21\u677F\u5DE5\u4F5C\u533A","  platform app import merge        \u6309\u6A21\u677F\u524D\u7AEF\u6839\u76EE\u5F55\u628A\u4E0A\u6E38\u5185\u5BB9\u5B89\u5168\u5E76\u5165 imported-upstream \u843D\u70B9","  platform app import verify       \u6821\u9A8C preprocess / stage / merge \u4EA7\u7269\u72B6\u6001","","\u8BF4\u660E\uFF1A","  \u5F53\u524D P0 \u81EA\u52A8\u5316\u53EA\u8986\u76D6\u6700\u8017\u65F6\u3001\u6700\u673A\u68B0\u7684\u4E09\u6BB5\uFF1Apreprocess / stage / merge\u3002","  create / wiring / CMS-DB-Auth \u63A5\u7EBF\u4ECD\u7531\u6A21\u677F\u5DE5\u4F5C\u533A\u4E0E\u4EBA\u5DE5\u5DE5\u7A0B\u5316\u627F\u63A5\u3002",""].join(`
-`))}}async function runAppImportCommand(args,deps={}){let subcommand=args.rest[1]??"help";if(hasFlag(args,"help")||hasFlag(args,"h")){printAppImportHelp(subcommand==="help"?void 0:subcommand);return}if(subcommand==="help"){printAppImportHelp();return}if(subcommand!=="preprocess"&&subcommand!=="stage"&&subcommand!=="merge"&&subcommand!=="verify")throw new Error("`platform app import` \u76EE\u524D\u652F\u6301 `preprocess`\u3001`stage`\u3001`merge` \u6216 `verify`\u3002");if(subcommand==="preprocess"){let cliArgs2=["--dir",readOption(args,"dir")??currentWorkspaceDir()],include=readOption(args,"include"),folderId=readOption(args,"folder-id"),type=readOption(args,"type"),localReport=readOption(args,"local-report");include&&cliArgs2.push("--include",include),folderId&&cliArgs2.push("--folder-id",folderId),type&&cliArgs2.push("--type",type),localReport&&cliArgs2.push("--local-report",localReport),hasFlag(args,"dry-run")&&cliArgs2.push("--dry-run"),hasFlag(args,"resume")&&cliArgs2.push("--resume"),hasFlag(args,"reset-cache")&&cliArgs2.push("--reset-cache"),hasFlag(args,"json")&&cliArgs2.push("--json"),await runAppImportPreprocessCli(cliArgs2,deps);return}if(subcommand==="stage"){let preprocess=readOption(args,"preprocess");if(!preprocess)throw new Error("`platform app import stage` \u9700\u8981 `--preprocess <source-dir|.design-preprocess|reports|import-manifest.json>`\u3002");let cliArgs2=["--workspace-dir",readOption(args,"workspace-dir")??currentWorkspaceDir(),"--preprocess",preprocess];hasFlag(args,"dry-run")&&cliArgs2.push("--dry-run"),hasFlag(args,"json")&&cliArgs2.push("--json"),await runAppImportStageCli(cliArgs2);return}if(subcommand==="verify"){let cliArgs2=["--workspace-dir",readOption(args,"workspace-dir")??currentWorkspaceDir()];hasFlag(args,"json")&&cliArgs2.push("--json"),await runAppImportVerifyCli(cliArgs2);return}let cliArgs=["--workspace-dir",readOption(args,"workspace-dir")??currentWorkspaceDir()];hasFlag(args,"dry-run")&&cliArgs.push("--dry-run"),hasFlag(args,"json")&&cliArgs.push("--json"),await runAppImportMergeCli(cliArgs)}var AUTH_CONFIGURE_TEMPLATE_VALUES=["email_magic_link_only","admin_password_only","email_magic_link_and_admin_password","phone_sms_otp_only","email_magic_link_and_phone_sms_otp"],AUTH_CONFIGURE_TEMPLATE_VALUES_TEXT=AUTH_CONFIGURE_TEMPLATE_VALUES.map(item=>`\`${item}\``).join("\u3001");function formatAuthorizationCodeLoginPrompt(input){return input.opened?`\u5DF2\u81EA\u52A8\u6253\u5F00\u6D4F\u89C8\u5668\uFF0C\u8BF7\u5B8C\u6210\u6388\u6743\u7801\u767B\u5F55\u3002
+`))}}async function runAppImportCommand(args,deps={}){let subcommand=args.rest[1]??"help";if(hasFlag(args,"help")||hasFlag(args,"h")){printAppImportHelp(subcommand==="help"?void 0:subcommand);return}if(subcommand==="help"){printAppImportHelp();return}if(subcommand!=="preprocess"&&subcommand!=="stage"&&subcommand!=="merge"&&subcommand!=="verify")throw new Error("`platform app import` \u76EE\u524D\u652F\u6301 `preprocess`\u3001`stage`\u3001`merge` \u6216 `verify`\u3002");if(subcommand==="preprocess"){let cliArgs2=["--dir",readOption(args,"dir")??currentWorkspaceDir()],include=readOption(args,"include"),folderId=readOption(args,"folder-id"),type=readOption(args,"type"),localReport=readOption(args,"local-report");include&&cliArgs2.push("--include",include),folderId&&cliArgs2.push("--folder-id",folderId),type&&cliArgs2.push("--type",type),localReport&&cliArgs2.push("--local-report",localReport),hasFlag(args,"dry-run")&&cliArgs2.push("--dry-run"),hasFlag(args,"resume")&&cliArgs2.push("--resume"),hasFlag(args,"reset-cache")&&cliArgs2.push("--reset-cache"),hasFlag(args,"json")&&cliArgs2.push("--json"),await runAppImportPreprocessCli(cliArgs2,deps);return}if(subcommand==="stage"){let preprocess=readOption(args,"preprocess");if(!preprocess)throw new Error("`platform app import stage` \u9700\u8981 `--preprocess <source-dir|.design-preprocess|reports|import-manifest.json>`\u3002");let cliArgs2=["--workspace-dir",readOption(args,"workspace-dir")??currentWorkspaceDir(),"--preprocess",preprocess];hasFlag(args,"dry-run")&&cliArgs2.push("--dry-run"),hasFlag(args,"json")&&cliArgs2.push("--json"),await runAppImportStageCli(cliArgs2);return}if(subcommand==="verify"){let cliArgs2=["--workspace-dir",readOption(args,"workspace-dir")??currentWorkspaceDir()];hasFlag(args,"json")&&cliArgs2.push("--json"),await runAppImportVerifyCli(cliArgs2);return}let cliArgs=["--workspace-dir",readOption(args,"workspace-dir")??currentWorkspaceDir()];hasFlag(args,"dry-run")&&cliArgs.push("--dry-run"),hasFlag(args,"json")&&cliArgs.push("--json"),await runAppImportMergeCli(cliArgs)}var AUTH_CONFIGURE_TEMPLATE_VALUES=["email_magic_link_only","admin_password_only","email_magic_link_and_admin_password","phone_sms_otp_only","email_magic_link_and_phone_sms_otp"],AUTH_CONFIGURE_TEMPLATE_VALUES_TEXT=AUTH_CONFIGURE_TEMPLATE_VALUES.map(item=>`\`${item}\``).join("\u3001");function formatAuthCapabilityError(input){if(input.code==="auth_entitlement_state_unavailable")return appendDiagnosticFields("\u6682\u65F6\u65E0\u6CD5\u6821\u9A8C\u5F53\u524D\u5957\u9910\u6743\u76CA\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002",input);if(input.code!=="auth_sign_in_capability_not_entitled")return null;let message=(()=>{switch(input.detail?.capability){case"email_password_standard":return"\u5F53\u524D\u5957\u9910\u672A\u5F00\u901A\u90AE\u7BB1\u9A8C\u8BC1\uFF08\u6807\u51C6\u90AE\u7BB1\u5BC6\u7801\u767B\u5F55\uFF09\uFF0C\u53EF\u7EE7\u7EED\u4F7F\u7528\u7B80\u5316\u90AE\u7BB1\u5BC6\u7801\u767B\u5F55\u3002";case"email_magic_link":return"\u5F53\u524D\u5957\u9910\u672A\u5F00\u901A\u90AE\u7BB1 Magic Link \u767B\u5F55\u3002";case"phone_sms_otp":return"\u5F53\u524D\u5957\u9910\u672A\u5F00\u901A\u624B\u673A\u9A8C\u8BC1\u7801\u767B\u5F55\u3002";default:return input.message??"\u5F53\u524D\u5957\u9910\u672A\u5F00\u901A\u6240\u8BF7\u6C42\u7684\u767B\u5F55\u8BA4\u8BC1\u80FD\u529B\u3002"}})();return appendDiagnosticFields([`\u7528\u6237\u8BA4\u8BC1\u914D\u7F6E\u672A\u751F\u6548\uFF1A${message}`,"\u5904\u7406\u5EFA\u8BAE\uFF1A\u5347\u7EA7\u5957\u9910\u3001\u8054\u7CFB\u7BA1\u7406\u5458\u589E\u52A0\u6743\u9650\u8986\u76D6\uFF0C\u6216\u6539\u7528\u5F53\u524D\u5DF2\u5F00\u901A\u7684\u767B\u5F55\u65B9\u5F0F\u3002"].join(`
+`),input)}function formatAuthConfigureResult(payload){let methods=payload.enabled_sign_in_methods??payload.sign_in_methods.map(item=>item.method),passwordEnabled=methods.includes("admin_provisioned_password"),lines=[payload.command_status==="noop"?"\u7528\u6237\u8BA4\u8BC1\u914D\u7F6E\u672A\u53D1\u751F\u53D8\u5316":payload.auth_enabled?"\u7528\u6237\u8BA4\u8BC1\u5DF2\u5F00\u542F":"\u7528\u6237\u8BA4\u8BC1\u914D\u7F6E\u5DF2\u66F4\u65B0",`\u5E94\u7528: ${payload.tenant_id}/${payload.app_id}`,`User Store: ${payload.user_store_id??"-"}`,`\u767B\u5F55\u65B9\u5F0F: ${methods.map(formatAuthMethodLabel).join(" / ")||"\u672A\u542F\u7528"}`];return passwordEnabled&&lines.push(`\u90AE\u7BB1\u9A8C\u8BC1: ${payload.email_verification_required===!0?"\u5DF2\u5F00\u542F\uFF08\u6807\u51C6\u90AE\u7BB1\u5BC6\u7801\u767B\u5F55\uFF09":"\u672A\u5F00\u542F\uFF08\u7B80\u5316\u90AE\u7BB1\u5BC6\u7801\u767B\u5F55\uFF09"}`),lines.join(`
+`)}function formatAuthMethodLabel(method){switch(method){case"admin_provisioned_password":return"\u90AE\u7BB1\u5BC6\u7801";case"email_magic_link":return"\u90AE\u7BB1 Magic Link";case"phone_sms_otp":return"\u624B\u673A\u9A8C\u8BC1\u7801";case"wechat_oauth":return"\u5FAE\u4FE1\u767B\u5F55"}}function appendDiagnosticFields(message,input){let lines=[message];return typeof input.detail?.feature_key=="string"&&lines.push(`Feature: ${input.detail.feature_key}`),input.code&&lines.push(`Code: ${input.code}`),input.requestId&&lines.push(`Request ID: ${input.requestId}`),lines.join(`
+`)}function formatAuthorizationCodeLoginPrompt(input){return input.opened?`\u5DF2\u81EA\u52A8\u6253\u5F00\u6D4F\u89C8\u5668\uFF0C\u8BF7\u5B8C\u6210\u6388\u6743\u7801\u767B\u5F55\u3002
 `:[input.source==="cli-app"?"\u4F7F\u7528\u4E13\u7528 CLI App \u6267\u884C\u6D4F\u89C8\u5668\u6388\u6743\u7801\u767B\u5F55\uFF0C\u5E76\u81EA\u52A8\u9644\u5E26 consent \u4EE5\u6362\u53D6 refresh token\u3002":"\u4F7F\u7528 workbench \u914D\u7F6E\u56DE\u9000\u6267\u884C\u6D4F\u89C8\u5668\u6388\u6743\u7801\u767B\u5F55\uFF0C\u5E76\u5F3A\u5236 prompt=login consent \u4EE5\u907F\u514D\u590D\u7528\u9519\u8BEF SSO \u4F1A\u8BDD\u5E76\u6362\u53D6 refresh token\u3002","\u8BF7\u5728\u6D4F\u89C8\u5668\u5B8C\u6210\u6388\u6743\u7801\u767B\u5F55\u3002",`\u6388\u6743\u5730\u5740: ${input.authorizationUrl}`,`\u56DE\u8C03\u5730\u5740: ${input.redirectUri}`,input.source==="workbench-fallback"?"\u82E5\u56DE\u8C03\u7AEF\u53E3\u88AB\u672C\u5730 workbench \u5360\u7528\uFF0C\u8BF7\u5148\u6682\u65F6\u505C\u6B62\u5BF9\u5E94\u670D\u52A1\u540E\u91CD\u8BD5\u3002":"\u8BF7\u786E\u8BA4\u8BE5\u56DE\u8C03\u5730\u5740\u5DF2\u5728\u4E13\u7528 CLI App \u4E2D\u6CE8\u518C\u3002",""].join(`
 `)}function normalizeAuthTemplate(value){if(value!==void 0){if(AUTH_CONFIGURE_TEMPLATE_VALUES.includes(value))return value;throw new Error(`\u65E0\u6548\u7684 \`--template\`\uFF0C\u4EC5\u652F\u6301 ${AUTH_CONFIGURE_TEMPLATE_VALUES_TEXT}\u3002`)}}function buildAuthConfigurePayload(options){let templatePayload=buildTemplatePayload(options.template);if(options.enablePhoneSmsOtp===!1&&templatePayload.enable_phone_sms_otp===!0)throw new Error("\u5F53\u524D `--template` \u4F9D\u8D56 `phone_sms_otp`\uFF0C\u4E0D\u80FD\u540C\u65F6\u4F20 `--disable-phone-sms-otp`\u3002");return{auth_enabled:options.enable?!0:void 0,user_store_id:options.userStoreId,auth_template:templatePayload.auth_template,enable_admin_provisioned_password:options.enableAdminProvisionedPassword,enable_phone_sms_otp:typeof options.enablePhoneSmsOtp=="boolean"?options.enablePhoneSmsOtp:templatePayload.enable_phone_sms_otp,enabled_sign_in_methods:templatePayload.enabled_sign_in_methods,default_sign_in_method:templatePayload.default_sign_in_method,registration_mode:templatePayload.registration_mode}}function hasAuthConfigureChanges(payload){return payload.auth_enabled!==void 0||payload.user_store_id!==void 0||payload.auth_template!==void 0||payload.enable_admin_provisioned_password!==void 0||payload.enable_phone_sms_otp!==void 0||payload.enabled_sign_in_methods!==void 0||payload.default_sign_in_method!==void 0||payload.registration_mode!==void 0}function buildTemplatePayload(template){switch(template){case"phone_sms_otp_only":return{enable_phone_sms_otp:!0,enabled_sign_in_methods:["phone_sms_otp"],default_sign_in_method:"phone_sms_otp",registration_mode:"open"};case"email_magic_link_and_phone_sms_otp":return{enable_phone_sms_otp:!0,enabled_sign_in_methods:["email_magic_link","phone_sms_otp"],default_sign_in_method:"email_magic_link",registration_mode:"open"};case"email_magic_link_only":case"admin_password_only":case"email_magic_link_and_admin_password":return{auth_template:template};default:return{}}}var BUILD_POLL_INTERVAL_MS=1500,BUILD_POLL_TIMEOUT_MS=18e4;async function runBuildCommand(args){if(hasHelpFlag3(args)){printBuildHelp(args.rest[0]);return}let subcommand=args.rest[0];if(subcommand!=="get"&&subcommand!=="events"&&subcommand!=="validate"&&subcommand!=="run")throw new Error("`platform build` \u4EC5\u652F\u6301 `run`\u3001`get <build-id>`\u3001`events <build-id>` \u6216 `validate --source-version <srcver>`\u3002");let credentials=await loadStoredCredentialsEnsuringFresh();if(!credentials)throw new Error("\u672A\u627E\u5230\u672C\u5730\u51ED\u636E\uFF0C\u8BF7\u5148\u6267\u884C `platform login`\u3002");let binding;try{binding=readBinding(process.cwd())?.binding}catch{binding=null}let tenantId=readStringOption3(args,"tenant")??binding?.tenant_id,buildId=args.rest[1]??readStringOption3(args,"build");if((subcommand==="get"||subcommand==="events")&&!buildId)throw new Error(`\`platform build ${subcommand}\` \u9700\u8981 <build-id>\uFF0C\u6216\u4F20\u5165 \`--build <build-id>\`\u3002`);let sdk=createControlApiSdk({accessToken:selectApiToken(credentials),tenantId,capability:"m1",requestClass:"control"});if(subcommand==="run"){let appId=readStringOption3(args,"app")??binding?.app_id,sourceVersionId=readStringOption3(args,"source-version")??readStringOption3(args,"source_version");if(!tenantId||!appId||!sourceVersionId)throw new Error("`platform build run` \u9700\u8981 `--source-version <srcver>`\uFF0C\u4EE5\u53CA\u5DF2\u7ED1\u5B9A\u76EE\u5F55\u6216 `--tenant` / `--app`\u3002");let requestedBy=await resolveRequestedBy(sdk),buildConfig=await resolveBuildRunConfig(sdk,appId,sourceVersionId,readBuildConfig(args.options)),created=await sdk.createBuild({tenant_id:tenantId,app_id:appId,source_version_id:sourceVersionId,requested_by:requestedBy,...Object.keys(buildConfig).length>0?{build_config:buildConfig}:{}}).catch(error=>{throw formatBuildRunError(error,appId,sourceVersionId)}),wait=args.options.wait===!0;if(args.options.json===!0&&!wait){process.stdout.write(`${JSON.stringify(created,null,2)}
 `);return}if(!wait){printBuildStarted(created);return}let completed=await waitForBuild(sdk,created.id);if(args.options.json===!0){process.stdout.write(`${JSON.stringify(completed,null,2)}
@@ -2837,7 +2840,7 @@ ${formatDependencyInstallFailureHint(installPlan.lockfile)}`));return}resolve20(
 `);return}printAppUserRoleAssignments(appUserId,response3.items);return}let roleKeys=readCsvOption3(args,"roles");if(roleKeys.length===0)throw new Error(`\`platform auth user-role ${action2}\` \u9700\u8981 \`--roles role-a,role-b\`\u3002`);let response2=action2==="assign"?await sdk.assignTenantAppUserRoles(appId,appUserId,{role_keys:roleKeys}):await sdk.replaceTenantAppUserRoles(appId,appUserId,{role_keys:roleKeys});if(jsonMode){process7.stdout.write(`${JSON.stringify(response2,null,2)}
 `);return}printAppUserRoleAssignments(appUserId,response2.items);return}if(subcommand==="discover"){let response2=await sdk.getTenantAppEndUserAuthDiscovery(appId);if(jsonMode){process7.stdout.write(`${JSON.stringify(response2,null,2)}
 `);return}printAuthDiscoveryOutput(response2);return}if(subcommand==="inspect"){let response2=await sdk.getTenantAppEndUserAuthInspect(appId);if(await syncLocalControlPlaneSummary({sdk,startDir:process7.cwd(),tenantId,appId}),jsonMode){process7.stdout.write(`${JSON.stringify(response2,null,2)}
-`);return}printAuthInspectOutput(response2);return}if(subcommand==="configure"){let template=normalizeAuthTemplate(readOption2(args,"template")),enableAdminPassword=hasFlag2(args,"enable-admin-password")?!0:hasFlag2(args,"disable-admin-password")?!1:void 0,enablePhoneSmsOtp=hasFlag2(args,"enable-phone-sms-otp")?!0:hasFlag2(args,"disable-phone-sms-otp")?!1:void 0,payload=buildAuthConfigurePayload({enable:hasFlag2(args,"enable"),userStoreId:readOption2(args,"user-store-id"),template,enableAdminProvisionedPassword:enableAdminPassword,enablePhoneSmsOtp});if(!hasAuthConfigureChanges(payload))throw new Error("`platform auth configure` \u81F3\u5C11\u9700\u8981\u4E00\u4E2A\u53D8\u66F4\u53C2\u6570\uFF1A`--enable`\u3001`--template`\u3001`--user-store-id`\u3001`--enable-admin-password`\u3001`--disable-admin-password`\u3001`--enable-phone-sms-otp` \u6216 `--disable-phone-sms-otp`\u3002");let response2=await sdk.configureTenantAppEndUserAuth(appId,payload);if(await syncLocalControlPlaneSummary({sdk,startDir:process7.cwd(),tenantId,appId}),jsonMode){process7.stdout.write(`${JSON.stringify(response2,null,2)}
+`);return}printAuthInspectOutput(response2);return}if(subcommand==="configure"){let template=normalizeAuthTemplate(readOption2(args,"template")),enableAdminPassword=hasFlag2(args,"enable-admin-password")?!0:hasFlag2(args,"disable-admin-password")?!1:void 0,enablePhoneSmsOtp=hasFlag2(args,"enable-phone-sms-otp")?!0:hasFlag2(args,"disable-phone-sms-otp")?!1:void 0,payload=buildAuthConfigurePayload({enable:hasFlag2(args,"enable"),userStoreId:readOption2(args,"user-store-id"),template,enableAdminProvisionedPassword:enableAdminPassword,enablePhoneSmsOtp});if(!hasAuthConfigureChanges(payload))throw new Error("`platform auth configure` \u81F3\u5C11\u9700\u8981\u4E00\u4E2A\u53D8\u66F4\u53C2\u6570\uFF1A`--enable`\u3001`--template`\u3001`--user-store-id`\u3001`--enable-admin-password`\u3001`--disable-admin-password`\u3001`--enable-phone-sms-otp` \u6216 `--disable-phone-sms-otp`\u3002");let response2;try{response2=await sdk.configureTenantAppEndUserAuth(appId,payload)}catch(error){if(!jsonMode&&error instanceof PlatformApiError){let localized=formatAuthCapabilityError({code:error.code,message:error.message,detail:error.detail,requestId:error.requestId});if(localized)throw new Error(localized)}throw error}if(await syncLocalControlPlaneSummary({sdk,startDir:process7.cwd(),tenantId,appId}),jsonMode){process7.stdout.write(`${JSON.stringify(response2,null,2)}
 `);return}printAuthConfigureOutput(response2);return}let action=normalizeBindingAction(readOption2(args,"action")),userStoreId=readOption2(args,"user-store-id");if(action!=="disable"&&!userStoreId)throw new Error("`platform auth bind` \u5728 `bind` \u6216 `rebind` \u65F6\u9700\u8981 `--user-store-id`\u3002");let response=await sdk.bindTenantAppEndUserAuth(appId,{binding_action:action,user_store_id:userStoreId});if(await syncLocalControlPlaneSummary({sdk,startDir:process7.cwd(),tenantId,appId}),jsonMode){process7.stdout.write(`${JSON.stringify(response,null,2)}
 `);return}printAuthBindOutput(response)}async function runCms(args){let requestedSubcommand=args.rest[0]??"",scope=args.rest[1]??"";if(hasFlag2(args,"help")||hasFlag2(args,"h")){printCmsHelp(requestedSubcommand,scope);return}let subcommand=requestedSubcommand||"discover";if(!["discover","configure","apply","inspect","import","attach","list","ensure","batch"].includes(subcommand))throw new Error(`\u672A\u77E5 cms \u5B50\u547D\u4EE4: ${subcommand}`);let credentials=await loadStoredCredentialsEnsuringFresh(),tenantId=resolveTenantContext(args);if(!tenantId)throw new Error("`platform cms` \u9700\u8981 `--tenant` \u6216\u9ED8\u8BA4\u79DF\u6237\u4E0A\u4E0B\u6587\u3002");let sdk=createTenantScopedSdk(credentials,tenantId,{capability:"cms"}),jsonMode=args.options.json===!0,activeBinding=readBinding(process7.cwd())?.binding,syncCmsSummaryIfPossible=async()=>{!activeBinding?.app_id||activeBinding.tenant_id!==tenantId||await syncLocalControlPlaneSummary({sdk,startDir:process7.cwd(),tenantId,appId:activeBinding.app_id})};if(subcommand==="discover"){let collection=readOption2(args,"collection")??args.rest[1];if(!collection){let response2=await sdk.listTenantCmsCollections();if(await syncCmsSummaryIfPossible(),jsonMode){process7.stdout.write(`${JSON.stringify(response2,null,2)}
 `);return}printCmsCollectionListOutput(response2);return}let response=await sdk.discoverTenantCmsCollection(collection);if(await syncCmsSummaryIfPossible(),jsonMode){process7.stdout.write(`${JSON.stringify(response,null,2)}
@@ -2861,11 +2864,11 @@ ${formatDependencyInstallFailureHint(installPlan.lockfile)}`));return}resolve20(
 `);return}printCmsConfigureCategoryOutput(response);return}let applyTarget=args.rest[1];if(applyTarget==="schema"){let collection=readOption2(args,"collection")??args.rest[2],version=readIntegerOption(args,"version");if(!collection||version===void 0)throw new Error("`platform cms apply schema` \u9700\u8981 `--collection <name>` \u548C `--version <n>`\u3002");let response=await sdk.applyTenantCmsSchema({collection,target_schema_version:version});if(await syncCmsSummaryIfPossible(),jsonMode){process7.stdout.write(`${JSON.stringify(response,null,2)}
 `);return}printCmsApplySchemaOutput(response),printCmsPropagationDelayHint("schema \u6FC0\u6D3B");return}if(applyTarget==="publish"){let collection=readOption2(args,"collection")??args.rest[2],itemId=readOption2(args,"item-id"),status=readOption2(args,"status");if(!collection||!itemId||!status)throw new Error("`platform cms apply publish` \u9700\u8981 `--collection <name>`\u3001`--item-id <id>`\u3001`--status <status>`\u3002");if(!["draft","published","archived"].includes(status))throw new Error("\u65E0\u6548\u7684 `--status`\uFF0C\u4EC5\u652F\u6301 `draft`\u3001`published`\u3001`archived`\u3002");let response=await sdk.applyTenantCmsPublish({collection,item_id:itemId,target_status:status});if(await syncCmsSummaryIfPossible(),jsonMode){process7.stdout.write(`${JSON.stringify(response,null,2)}
 `);return}printCmsApplyPublishOutput(response),printCmsPropagationDelayHint("\u53D1\u5E03\u72B6\u6001\u5207\u6362");return}throw new Error("`platform cms apply` \u5F53\u524D\u4EC5\u652F\u6301 `schema`\u3001`publish`\u3002")}async function runAsset(args){let tenantId=resolveTenantContext(args);if(!tenantId)throw new Error("`platform asset` \u9700\u8981 `--tenant` \u6216\u9ED8\u8BA4\u79DF\u6237\u4E0A\u4E0B\u6587\u3002");let credentials=await loadStoredCredentialsEnsuringFresh();if(!credentials)throw new Error("\u672A\u627E\u5230\u672C\u5730\u51ED\u636E\uFF0C\u8BF7\u5148\u6267\u884C `platform login`\u3002");let sdk=createTenantScopedSdk(credentials,tenantId,{capability:"asset_library"});await runAssetCommand({rest:args.rest,options:args.options},{sdk,tenantId})}async function runBlob(args){if(isBlobHelpRequest({rest:args.rest,options:args.options})){await runBlobCommand({rest:args.rest,options:args.options},{sdk:void 0,tenantId:""});return}let tenantId=resolveTenantContext(args);if(!tenantId)throw new Error("`platform blob` \u9700\u8981 `--tenant` \u6216\u9ED8\u8BA4\u79DF\u6237\u4E0A\u4E0B\u6587\u3002");let credentials=await loadStoredCredentialsEnsuringFresh();if(!credentials)throw new Error("\u672A\u627E\u5230\u672C\u5730\u51ED\u636E\uFF0C\u8BF7\u5148\u6267\u884C `platform login`\u3002");let sdk=createTenantScopedSdk(credentials,tenantId,{capability:"object_storage"});await runBlobCommand({rest:args.rest,options:args.options},{sdk,tenantId})}function normalizeBindingAction(value){if(value===void 0||value==="bind")return"bind";if(value==="rebind"||value==="disable")return value;throw new Error("\u65E0\u6548\u7684 `--action`\uFF0C\u4EC5\u652F\u6301 `bind`\u3001`rebind`\u3001`disable`\u3002")}function printAuthDiscoveryOutput(payload){process7.stdout.write([`tenant/app: ${payload.tenant_id}/${payload.app_id}`,`Auth Enabled: ${payload.auth_enabled?"true":"false"}`,`Capability: ${payload.capability_name}@${payload.capability_version}`,`Contract Version: ${payload.contract_version}`,`User Store: ${payload.user_store_id??"-"}`,`Binding ID: ${payload.binding_id??"-"}`,`Binding Mode: ${payload.binding_mode??"-"}`,`Binding Status: ${payload.binding_status}`,`Template: ${payload.auth_template??"-"}`,`UI Driver: ${payload.ui_driver??"-"}`,`Enabled Recipes: ${payload.enabled_recipes.join(", ")||"-"}`,`Sign-in Methods: ${payload.sign_in_methods.map(item=>item.method).join(", ")||"-"}`,`Owner Service: ${payload.owner_service}`,""].join(`
-`))}function printAuthConfigureOutput(payload){process7.stdout.write([`tenant/app: ${payload.tenant_id}/${payload.app_id}`,`Command Status: ${payload.command_status}`,`Applied Changes: ${payload.applied_changes.join(", ")||"-"}`,`Auth Enabled: ${payload.auth_enabled?"true":"false"}`,`User Store: ${payload.user_store_id??"-"}`,`Binding Status: ${payload.binding_status}`,`Template: ${payload.auth_template??"-"}`,""].join(`
-`))}function printAuthBindOutput(payload){process7.stdout.write([`tenant/app: ${payload.tenant_id}/${payload.app_id}`,`Command Status: ${payload.command_status}`,`Binding Action: ${payload.binding_action}`,`Previous Binding ID: ${payload.previous_binding_id??"-"}`,`Applied Changes: ${payload.applied_changes.join(", ")||"-"}`,`Auth Enabled: ${payload.auth_enabled?"true":"false"}`,`User Store: ${payload.user_store_id??"-"}`,`Binding Mode: ${payload.binding_mode??"-"}`,`Binding Status: ${payload.binding_status}`,""].join(`
+`))}function printAuthConfigureOutput(payload){process7.stdout.write(`${formatAuthConfigureResult(payload)}
+`)}function printAuthBindOutput(payload){process7.stdout.write([`tenant/app: ${payload.tenant_id}/${payload.app_id}`,`Command Status: ${payload.command_status}`,`Binding Action: ${payload.binding_action}`,`Previous Binding ID: ${payload.previous_binding_id??"-"}`,`Applied Changes: ${payload.applied_changes.join(", ")||"-"}`,`Auth Enabled: ${payload.auth_enabled?"true":"false"}`,`User Store: ${payload.user_store_id??"-"}`,`Binding Mode: ${payload.binding_mode??"-"}`,`Binding Status: ${payload.binding_status}`,""].join(`
 `))}function printAuthInspectOutput(payload){process7.stdout.write([`tenant/app: ${payload.tenant_id}/${payload.app_id}`,`Inspect Status: ${payload.inspect_status}`,`Inspect Issues: ${payload.issues.join(", ")||"-"}`,`Suggested Actions: ${formatAuthSuggestedActions(payload.app_id,payload.suggested_actions).join(" | ")||"-"}`,...payload.environments.map(item=>`Env ${item.env}: ${item.status}  missing=[${item.missing_binding_keys.join(", ")||"-"}]  issues=[${item.issues.join(", ")||"-"}]  suggested=[${formatAuthSuggestedActions(payload.app_id,item.suggested_actions).join(" | ")||"-"}]  updated_at=${item.updated_at??"-"}`),""].join(`
 `))}function formatAuthSuggestedActions(appId,actions){return!actions||actions.length===0?[]:actions.map(action=>{switch(action){case"enable_auth":return`platform auth configure --app ${appId} --enable`;case"bind_user_store":return`platform auth bind --app ${appId} --action bind --user-store-id <user-store-id>`;case"reapply_auth_resources":return"platform resources apply";case"check_runtime_bindings":return"check auth runtime bindings / skill targets";default:return action}})}function printAuthHelp(subcommand){switch(subcommand){case"discover":process7.stdout.write(["platform auth discover","","\u7528\u6CD5\uFF1A","  platform auth discover [--tenant <tenant-id>] [--app <app-id>] [--json]","","\u4F5C\u7528\uFF1A","  \u67E5\u8BE2\u5F53\u524D app \u7684 Auth capability discovery \u89C6\u56FE\u3002",""].join(`
-`));return;case"configure":process7.stdout.write(["platform auth configure","","\u7528\u6CD5\uFF1A","  platform auth configure [--tenant <tenant-id>] [--app <app-id>] --enable [--template <template>] [--user-store-id <id>] [--enable-admin-password|--disable-admin-password] [--enable-phone-sms-otp|--disable-phone-sms-otp] [--json]","","\u4F5C\u7528\uFF1A","  \u901A\u8FC7\u7EDF\u4E00 configure contract \u542F\u7528 Auth \u6216\u66F4\u65B0\u6A21\u677F\u914D\u7F6E\u3002",`  \u652F\u6301\u6A21\u677F\uFF1A${AUTH_CONFIGURE_TEMPLATE_VALUES_TEXT}\u3002`,"  \u8BF4\u660E\uFF1A`phone_sms_otp` \u5F53\u524D\u9ED8\u8BA4\u8D70 simulated \u8054\u8C03\u6A21\u5F0F\uFF1Bpreview/dev \u9875\u9762\u4F1A\u8FD4\u56DE debug_code\uFF0C\u4E0D\u4F1A\u771F\u5B9E\u53D1\u9001\u77ED\u4FE1\u3002","","\u793A\u4F8B\uFF1A","  platform auth configure --enable --template email_magic_link_only","  platform auth configure --enable --template phone_sms_otp_only","  platform auth configure --enable --template email_magic_link_and_phone_sms_otp","  platform auth configure --enable --enable-phone-sms-otp",""].join(`
+`));return;case"configure":process7.stdout.write(["platform auth configure","","\u7528\u6CD5\uFF1A","  platform auth configure [--tenant <tenant-id>] [--app <app-id>] --enable [--template <template>] [--user-store-id <id>] [--enable-admin-password|--disable-admin-password] [--enable-phone-sms-otp|--disable-phone-sms-otp] [--json]","","\u4F5C\u7528\uFF1A","  \u901A\u8FC7\u7EDF\u4E00 configure contract \u542F\u7528 Auth \u6216\u66F4\u65B0\u6A21\u677F\u914D\u7F6E\u3002",`  \u652F\u6301\u6A21\u677F\uFF1A${AUTH_CONFIGURE_TEMPLATE_VALUES_TEXT}\u3002`,"  \u9ED8\u8BA4\uFF1A\u4EC5\u4F20 `--enable` \u65F6\u542F\u7528\u7B80\u5316\u90AE\u7BB1\u5BC6\u7801\u767B\u5F55\uFF0C\u4E0D\u8981\u6C42\u90AE\u7BB1\u9A8C\u8BC1\uFF0C\u4E5F\u4E0D\u5F00\u653E\u627E\u56DE\u5BC6\u7801\u3002","  \u5957\u9910\u9650\u5236\uFF1A\u90AE\u7BB1 Magic Link\u3001\u624B\u673A\u9A8C\u8BC1\u7801\u53CA\u6807\u51C6\u90AE\u7BB1\u5BC6\u7801\u767B\u5F55\u53EF\u80FD\u53D7\u5F53\u524D\u8BA2\u9605\u5957\u9910\u9650\u5236\u3002","  \u8BF4\u660E\uFF1A`phone_sms_otp` \u5F53\u524D\u9ED8\u8BA4\u8D70 simulated \u8054\u8C03\u6A21\u5F0F\uFF1Bpreview/dev \u9875\u9762\u4F1A\u8FD4\u56DE debug_code\uFF0C\u4E0D\u4F1A\u771F\u5B9E\u53D1\u9001\u77ED\u4FE1\u3002","","\u793A\u4F8B\uFF1A","  platform auth configure --enable --template email_magic_link_only","  platform auth configure --enable --template phone_sms_otp_only","  platform auth configure --enable --template email_magic_link_and_phone_sms_otp","  platform auth configure --enable --enable-phone-sms-otp",""].join(`
 `));return;case"bind":process7.stdout.write(["platform auth bind","","\u7528\u6CD5\uFF1A","  platform auth bind [--tenant <tenant-id>] [--app <app-id>] [--action bind|rebind|disable] [--user-store-id <id>] [--json]","","\u4F5C\u7528\uFF1A","  \u6267\u884C UserStore \u7ED1\u5B9A\u3001\u5207\u6362\u6216\u7981\u7528\u3002",""].join(`
 `));return;case"inspect":process7.stdout.write(["platform auth inspect","","\u7528\u6CD5\uFF1A","  platform auth inspect [--tenant <tenant-id>] [--app <app-id>] [--json]","","\u4F5C\u7528\uFF1A","  \u67E5\u770B\u5F53\u524D app \u7684 Auth runtime inspect / diagnose \u89C6\u56FE\u3002",""].join(`
 `));return;case"role":process7.stdout.write(["platform auth role","","\u7528\u6CD5\uFF1A","  platform auth role list [--tenant <tenant-id>] [--app <app-id>] [--json]","  platform auth role create [--tenant <tenant-id>] [--app <app-id>] --key <role-key> --name <display-name> [--description <text>] [--status active|disabled] [--json]","  platform auth role inspect [--tenant <tenant-id>] [--app <app-id>] --role <role-key> [--json]","  platform auth role update [--tenant <tenant-id>] [--app <app-id>] --role <role-key> [--name <display-name>] [--description <text> | --clear-description] [--status active|disabled] [--json]","","\u4F5C\u7528\uFF1A","  \u7BA1\u7406\u5F53\u524D\u8F7B\u5E94\u7528\u7EC8\u7AEF\u7528\u6237\u89D2\u8272\u5B9A\u4E49\u3002",""].join(`
@@ -2916,6 +2919,7 @@ ${formatDependencyInstallFailureHint(installPlan.lockfile)}`));return}resolve20(
 `));return}process7.stdout.write(["platform cms","","\u53EF\u7528\u5B50\u547D\u4EE4\uFF1A","  platform cms discover","  platform cms configure collection","  platform cms configure item","  platform cms configure category","  platform cms import markdown","  platform cms import url","  platform cms attach asset","  platform cms ensure category","  platform cms list items","  platform cms batch update","  platform cms apply schema","  platform cms apply publish","  platform cms inspect schema","  platform cms inspect item","  platform cms inspect delivery",""].join(`
 `))}async function runDeploy(args){await runDeployCommand(args)}async function runRollback(args){await runRollbackCommand(args)}async function runResources(args){await runResourcesCommand(args)}async function runLogs(args){await runLogsCommand(args)}async function runBuild(args){await runBuildCommand(args)}async function runPreview(args){await runPreviewCommand(args)}async function runPublish(args){await runPublishCommand(args)}async function runWorkflow(args){await runWorkflowCommand({rest:args.rest,options:args.options})}async function runNotification(args){await runNotificationCommand({rest:args.rest,options:args.options})}async function runWorker(args){await runWorkerCommand({rest:args.rest,options:args.options})}async function runDataForm(args){await runDataFormCommand({rest:args.rest,options:args.options})}async function runAppLibrary(args){await runAppLibraryCommand({rest:args.rest,options:args.options})}async function main(){assertSupportedNodeVersion();let args=parseArgs5(process7.argv.slice(2));switch(args.command){case"help":case"--help":case"-h":printHelp();return;case"version":case"--version":printVersion();return;case"login":await runLogin(args);return;case"logout":await runLogout(args);return;case"credentials":await runCredentials(args);return;case"whoami":await runWhoAmI(args);return;case"tenant":await runTenant(args);return;case"env":await runEnvironment(args);return;case"app":await runApp(args);return;case"init":runInit(args);return;case"link":await runLink(args);return;case"dev":await runDev(args);return;case"auth":await runAuth(args);return;case"cms":await runCms(args);return;case"asset":await runAsset(args);return;case"blob":await runBlob(args);return;case"db":await runDbCommand({rest:args.rest,options:args.options});return;case"data-form":await runDataForm(args);return;case"app-library":await runAppLibrary(args);return;case"workflow":await runWorkflow(args);return;case"notification":await runNotification(args);return;case"build":await runBuild(args);return;case"preview":await runPreview(args);return;case"publish":await runPublish(args);return;case"deploy":await runDeploy(args);return;case"rollback":await runRollback(args);return;case"resources":await runResources(args);return;case"logs":await runLogs(args);return;case"diagnostics":await runDiagnostics(args);return;case"worker":await runWorker(args);return;default:throw printHelp(),new Error(`\u672A\u77E5\u547D\u4EE4: ${args.command}`)}}main().catch(async error=>{let workspaceRoot=findWorkspaceRoot(),args=parseArgs5(process7.argv.slice(2));if(args.options.json===!0&&error instanceof PlatformBlocksVerifyError){process7.stderr.write(`${JSON.stringify({error:{code:error.code,message:error.message.split(`
 `,1)[0]},verify:error.result},null,2)}
+`),process7.exitCode=1;return}if(args.options.json===!0&&error instanceof PlatformApiError){process7.stderr.write(`${JSON.stringify({error:{code:error.code,message:error.message},...error.detail?{detail:error.detail}:{},...error.requestId?{request_id:error.requestId}:{}},null,2)}
 `),process7.exitCode=1;return}let lines=[error instanceof Error?error.message:"\u547D\u4EE4\u6267\u884C\u5931\u8D25",`\u5F53\u524D\u5DE5\u4F5C\u533A: ${workspaceRoot}`];if(requiresLoginRecovery(error)&&lines.push(formatReauthHint({credentialMode:readStoredCredentialModeSafely(),credentialPath:readCredentialPathSafely()})),error instanceof CliStateAccessError&&lines.push(formatCliStateAccessHint({workspaceRoot})),process7.stderr.write(`${lines.join(`
 `)}
 `),isLikelyControlApiConnectionError(error))try{let diagnostics=await collectControlApiFailureDiagnostics();args.options.json===!0?process7.stderr.write(`${JSON.stringify(diagnostics,null,2)}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voobase/cli",
-  "version": "0.1.1-nonprod.2080",
+  "version": "0.1.1-nonprod.2085",
   "private": false,
   "platformDistributionProfile": {
     "name": "nonprod",
@@ -56,10 +56,10 @@
   "bundleDependencies": [],
   "platformDistributionBuild": {
     "channel": "nonprod",
-    "version": "0.1.1-nonprod.2080",
-    "sequence": 2080,
-    "gitSha": "79286e2",
-    "fullGitSha": "79286e2eda61b28b145a23727a16ada248f42264",
-    "buildId": "0.1.1-nonprod.2080+79286e2"
+    "version": "0.1.1-nonprod.2085",
+    "sequence": 2085,
+    "gitSha": "1916a9e",
+    "fullGitSha": "1916a9e59f9c2ccf6a8d4dbe7cb516d544801509",
+    "buildId": "0.1.1-nonprod.2085+1916a9e"
   }
 }