fufu-cloud-cli 0.5.0__py3-none-any.whl

fufu_cloud_cli/cli.py

@@ -0,0 +1,421 @@
+import argparse
+import json
+import os
+import sys
+from importlib.resources import files
+from pathlib import Path
+
+from . import __version__
+from . import manifest
+from .docker_backend import (Backend, FUNCTIONS_IMAGE, INGRESS_IMAGE, KINDS, LAMBDA_IMAGES,
+                             MAX_PAYLOAD, build_function, build_lambda, docker,
+                             inspect_image, prepare_runtime)
+from .errors import FufuError, require
+from .api_backend import ApiClient, api_selected, remote_command
+from .remote_compute import RemoteBackend, source_archive, lambda_archive
+
+
+class Parser(argparse.ArgumentParser):
+    def __init__(self, *args, **kwargs):
+        kwargs.setdefault("allow_abbrev", False)
+        super().__init__(*args, **kwargs)
+
+    def error(self, message):
+        raise FufuError("UNSUPPORTED_ARGUMENT", "缺少必要參數，或使用尚未支援的命令／旗標；請查看 --help。", 2)
+
+
+def emit(value):
+    sys.stdout.write(json.dumps(value, ensure_ascii=False, sort_keys=True) + "\n")
+
+
+def capability_data():
+    return json.loads(files("fufu_cloud_cli").joinpath("capabilities.json").read_text())
+
+
+def env_from_names(names):
+    result = {}
+    for k in names or []:
+        require(k in os.environ, "MISSING_ENV", "必要的環境變數未注入；不會輸出值。")
+        result[k] = os.environ[k]
+    return manifest.environment(result)
+
+
+def payload(value):
+    if value is None:
+        return b"{}"
+    if value.startswith("file://") or value.startswith("fileb://"):
+        p = Path(value.split("://", 1)[1])
+        require(p.is_file() and p.stat().st_size <= MAX_PAYLOAD, "INVALID_PAYLOAD", "Payload 檔案必須存在且不超過 6 MiB。")
+        body = p.read_bytes()
+    else:
+        body = value.encode()
+    require(len(body) <= MAX_PAYLOAD, "PAYLOAD_LIMIT", "Payload 超過 6 MiB。")
+    try:
+        json.loads(body)
+    except (ValueError, UnicodeDecodeError) as exc:
+        raise FufuError("INVALID_PAYLOAD", "這個試點的 invoke 接受 JSON payload。") from exc
+    return body
+
+
+def body_json(body):
+    try:
+        return json.loads(body)
+    except (ValueError, UnicodeDecodeError):
+        return body.decode("utf-8", errors="replace")
+
+
+def deployment_options(p):
+    p.add_argument("--env", action="append", default=[], metavar="VARIABLE_NAME", help="從受控環境讀值，不接受 NAME=value")
+    p.add_argument("--startup-timeout", type=int, default=30)
+
+
+def compute_backend(kind):
+    return RemoteBackend(kind) if api_selected() else Backend()
+
+
+def generation_options(p):
+    g = p.add_mutually_exclusive_group()
+    g.add_argument('--gen2', dest='gen2', action='store_true')
+    g.add_argument('--no-gen2', dest='gen2', action='store_false')
+    p.set_defaults(gen2=True)
+
+
+def fufu_parser():
+    p = Parser(prog="fufu", description="FUFU 租戶認證、遠端部署與本機 Docker；所有輸出均為 FUFU 子集契約。")
+    p.add_argument("--version", action="version", version=__version__)
+    sub = p.add_subparsers(dest="action", required=True)
+    auth = sub.add_parser("auth", help="驗證 CLI credential，顯示目前租戶與 scope").add_subparsers(dest="auth_action", required=True)
+    identity = auth.add_parser("whoami")
+    identity.add_argument("--provider", choices=["aws", "gcp", "azure"])
+    identity.add_argument("--credential-file")
+    assume = auth.add_parser('assume-role')
+    role = assume.add_mutually_exclusive_group(required=True)
+    role.add_argument('--role-arn')
+    role.add_argument('--service-account')
+    assume.add_argument('--output-file', required=True, help='受保護 session 檔；不輸出 token')
+    auth.add_parser('logout')
+    sub.add_parser("doctor").add_argument('--provider', choices=['aws', 'gcp'], default='gcp')
+    local = sub.add_parser("local").add_subparsers(dest="local_action", required=True)
+    prepare = local.add_parser("prepare")
+    prepare.add_argument("--lambda-runtime", choices=sorted(LAMBDA_IMAGES), nargs="+", default=["python3.12"])
+    c = sub.add_parser("capabilities")
+    c.add_argument("--require", nargs="+", default=[])
+    c.add_argument('--remote', action='store_true')
+    c.add_argument('--provider', choices=['aws', 'gcp'], default='gcp')
+    for action in ("plan", "deploy"):
+        q = sub.add_parser(action)
+        q.add_argument("--file", required=True)
+        if action == "deploy":
+            deployment_options(q)
+    sub.add_parser("list").add_argument('--kind', choices=sorted(KINDS))
+    sub.add_parser("down")
+    for action in ("describe", "delete", "invoke"):
+        q = sub.add_parser(action)
+        q.add_argument("name")
+        q.add_argument("--kind", choices=sorted(KINDS), default="cloud-run-http")
+        if action == "invoke":
+            q.add_argument("--data", default="{}")
+            q.add_argument("--path", default="/")
+            q.add_argument("--request-timeout", type=int, default=15)
+    return p
+
+
+def fufu_command(argv):
+    a = fufu_parser().parse_args(argv)
+    if a.action == "auth":
+        if a.auth_action == 'assume-role':
+            import time
+            require(not os.environ.get('FUFU_SESSION_FILE'), 'UNSUPPORTED_ARGUMENT', '請使用 tenant owner credential 取得 session。')
+            os.environ['FUFU_ASSUME_ROLE'] = a.role_arn or a.service_account
+            provider = 'aws' if a.role_arn else 'gcp'
+            with ApiClient(provider) as api:
+                who = api.whoami()
+                target = Path(a.output_file)
+                fd = os.open(target, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+                with os.fdopen(fd, 'w') as f:
+                    json.dump({'endpoint': api.endpoint, 'provider': provider, 'tenant_id': who['tenantId'], 'access_token': api.token, 'expires_at': time.time() + 3500}, f)
+                api.owns_token = False
+                return {'created': True, 'expiresIn': 3500, 'iamEnforced': True}
+        if a.auth_action == 'logout':
+            with ApiClient() as api:
+                api.owns_token = True
+            return {'revoked': True}
+        with ApiClient(a.provider, a.credential_file, read_only=True) as api:
+            return api.whoami()
+    if a.action == "local":
+        return prepare_runtime(a.lambda_runtime)
+    if a.action == "capabilities":
+        d = capability_data()
+        backend = 'api' if api_selected() or a.remote else 'local-docker'
+        require(all(d["services"].get(k, {}).get("status") == "implemented"
+                    and (k not in KINDS or backend in d['services'][k].get('backends', [d['services'][k].get('backend', 'local-docker')])) for k in a.require),
+                "CAPABILITY_NOT_SUPPORTED", "必要能力尚未支援；部署應阻擋。")
+        if a.remote:
+            with ApiClient(a.provider, read_only=True) as api:
+                d['remote'] = api.request('GET', '/compute/capabilities')
+            require(all(k in d['remote']['kinds'] + d['remote'].get('features', []) for k in a.require), 'CAPABILITY_NOT_SUPPORTED', '目前 provider 的服務端不支援必要能力。')
+        d['selectedBackend'] = backend
+        return d
+    if a.action == "plan":
+        result = manifest.public_plan(manifest.load(a.file))
+        result['backend'] = 'api' if api_selected() else 'local-docker'
+        return result
+    if a.action == "doctor":
+        if api_selected():
+            with ApiClient(a.provider, read_only=True) as api:
+                return api.request('GET', '/compute/capabilities')
+        b = Backend()
+        docker("info", "--format", "{{.OSType}}")
+        available = {}
+        for label, image in {"functions-python": FUNCTIONS_IMAGE, "ingress": INGRESS_IMAGE, **LAMBDA_IMAGES}.items():
+            try:
+                inspect_image(image)
+                available[label] = True
+            except FufuError:
+                available[label] = False
+        return {"backend": "local-docker", "docker": "reachable", "workspace": b.workspace,
+                "images": available, "auth": "local-docker-permission", "remote_cloud": False}
+    if a.action == "deploy":
+        spec = manifest.load(a.file)
+        spec["env"].update(env_from_names(a.env))
+        return compute_backend('cloud-run-http').deploy(kind="cloud-run-http", service=spec["name"], image=spec["image"],
+                                port=spec["port"], env=spec["env"], startup_timeout=a.startup_timeout, **({'role': spec['role']} if spec.get('role') else {}))
+    if a.action == "down":
+        require(not api_selected(), 'UNSUPPORTED_ARGUMENT', 'API 模式請逐一刪除指定服務；不提供整個租戶清空。')
+        return Backend().down()
+    if a.action == "list":
+        if not api_selected(): return {"services": Backend().listing(a.kind)}
+        kind = a.kind or 'cloud-run-http'
+        return {"services": RemoteBackend(kind).listing(kind)}
+    b = compute_backend(a.kind)
+    if a.action == "describe":
+        return b.describe(a.kind, a.name)
+    if a.action == "delete":
+        return b.delete(a.kind, a.name)
+    status, body, failure = b.invoke(a.kind, a.name, payload(a.data), path=a.path, timeout=a.request_timeout)
+    emit({"status": status, "body": body_json(body), "function_error": failure})
+    return 0 if status < 400 and not failure else 1
+
+
+def gcloud_command(argv):
+    p = Parser(prog="gcloud-fufu", description="支援 Cloud Run 單一容器與 Python HTTP function 子集。")
+    roots = p.add_subparsers(dest="service", required=True)
+    run_p = roots.add_parser("run")
+    run_sub = run_p.add_subparsers(dest="action", required=True)
+    d = run_sub.add_parser("deploy")
+    d.add_argument("name")
+    d.add_argument("--image", required=True)
+    d.add_argument("--port", type=int, default=8080)
+    d.add_argument('--service-account')
+    deployment_options(d)
+    services = run_sub.add_parser("services").add_subparsers(dest="service_action", required=True)
+    replace = services.add_parser("replace")
+    replace.add_argument("file")
+    deployment_options(replace)
+    for action in ("describe", "delete"):
+        services.add_parser(action).add_argument("name")
+    services.add_parser("list")
+    fn = roots.add_parser("functions").add_subparsers(dest="action", required=True)
+    d = fn.add_parser("deploy")
+    d.add_argument("name")
+    d.add_argument("--source", required=True)
+    d.add_argument("--runtime", choices=["python312"], required=True)
+    d.add_argument("--entry-point", required=True)
+    d.add_argument('--service-account')
+    generation_options(d)
+    d.add_argument("--trigger-http", required=True, action="store_true")
+    deployment_options(d)
+    for action in ("describe", "delete", "call"):
+        q = fn.add_parser(action)
+        q.add_argument("name")
+        generation_options(q)
+        if action == "call":
+            q.add_argument("--data", default="{}")
+    generation_options(fn.add_parser("list"))
+    a = p.parse_args(argv)
+    kind = "cloud-run-http" if a.service == "run" else 'cloud-run-functions-http' if a.gen2 else 'cloud-functions-gen1-http'
+    action = a.service_action if a.action == "services" else a.action
+    if action == "replace":
+        spec = manifest.load(a.file)
+        spec["env"].update(env_from_names(a.env))
+        return compute_backend(kind).deploy(kind=kind, service=spec["name"], image=spec["image"], port=spec["port"],
+                                env=spec["env"], startup_timeout=a.startup_timeout, **({'role': spec['role']} if spec.get('role') else {}))
+    if action == "deploy":
+        manifest.name(a.name)
+        env = env_from_names(a.env)
+        if a.service == 'functions' and api_selected():
+            return RemoteBackend(kind).deploy(kind=kind, service=a.name, env=env,
+                archive=source_archive(a.source), runtime=a.runtime, handler=a.entry_point, startup_timeout=a.startup_timeout, role=a.service_account)
+        image = a.image if a.service == "run" else build_function(a.source, a.entry_point)
+        return compute_backend(kind).deploy(kind=kind, service=a.name, image=image, port=getattr(a, "port", 8080),
+                                env=env, startup_timeout=a.startup_timeout, **({'role': a.service_account} if a.service_account else {}))
+    b = compute_backend(kind)
+    if action == "describe":
+        return b.describe(kind, a.name)
+    if action == "delete":
+        return b.delete(kind, a.name)
+    if action == "list":
+        return {"services": b.listing(kind)}
+    status, body, failure = b.invoke(kind, a.name, payload(a.data))
+    emit({"status": status, "result": body_json(body)})
+    return 0 if status < 400 and not failure else 1
+
+
+def aws_command(argv):
+    p = Parser(prog="aws-fufu", description="Lambda ZIP 與同步 invoke、IAM workload role 子集。")
+    root = p.add_subparsers(dest="service", required=True)
+    s = root.add_parser("lambda").add_subparsers(dest="action", required=True)
+    c = s.add_parser("create-function")
+    c.add_argument("--function-name", required=True)
+    c.add_argument("--runtime", choices=sorted(LAMBDA_IMAGES), required=True)
+    c.add_argument("--handler", required=True)
+    c.add_argument("--zip-file", required=True)
+    c.add_argument('--role')
+    deployment_options(c)
+    update = s.add_parser('update-function-code')
+    update.add_argument('--function-name', required=True)
+    update.add_argument('--zip-file', required=True)
+    deployment_options(update)
+    for action in ("get-function", "delete-function", "invoke"):
+        q = s.add_parser(action)
+        q.add_argument("--function-name", required=True)
+        if action == "invoke":
+            q.add_argument("--payload", default="{}")
+            q.add_argument("--invocation-type", choices=["RequestResponse"], default="RequestResponse")
+            q.add_argument("--cli-binary-format", choices=["raw-in-base64-out"], default="raw-in-base64-out")
+            q.add_argument("--request-timeout", type=int, default=15)
+            q.add_argument("outfile")
+    s.add_parser("list-functions")
+    a = p.parse_args(argv)
+    kind = "aws-lambda-sync"
+    if a.action in {"create-function", "update-function-code"}:
+        manifest.name(a.function_name)
+        env = env_from_names(a.env)
+        require(not getattr(a, 'role', None) or api_selected(), 'IAM_BACKEND_REQUIRED', 'Lambda IAM role 需要 API 模式。')
+        require(a.zip_file.startswith("fileb://"), "INVALID_ZIP", "ZIP 參數請使用 fileb:// 路徑。")
+        b = compute_backend(kind)
+        updating = a.action == 'update-function-code'
+        if updating:
+            previous = b.describe(kind, a.function_name)
+            require(previous.get('runtime') and previous.get('handler'), 'UNSUPPORTED_CONFIG', '原服務缺少 runtime metadata；請先完成一次明確來源部署。')
+            a.runtime, a.handler = previous['runtime'], previous['handler']
+            require(not a.env, 'UNSUPPORTED_ARGUMENT', 'update-function-code 不變更環境設定；請使用明確的重新部署流程。')
+        if api_selected():
+            return b.deploy(kind=kind, service=a.function_name, archive=lambda_archive(a.zip_file[8:]),
+                            runtime=a.runtime, handler=a.handler, env=env, startup_timeout=a.startup_timeout,
+                            replace=updating, require_existing=updating, preserve_environment=updating, role=getattr(a, 'role', None))
+        # 在耗費建置前檢查重名；真正提交時仍在鎖內再次驗證。
+        with b.locked():
+            require(updating or f"{kind}:{a.function_name}" not in b.read_state()["services"], "ALREADY_EXISTS", "同名 Lambda 已存在。")
+        image = build_lambda(a.zip_file[8:], a.runtime, a.handler)
+        return b.deploy(kind=kind, service=a.function_name, image=image, env=env,
+                        startup_timeout=a.startup_timeout, replace=updating, require_existing=updating,
+                        runtime=a.runtime, handler=a.handler, preserve_environment=updating)
+    if a.action == "list-functions":
+        return {"Functions": compute_backend(kind).listing(kind)}
+    if a.action == "get-function":
+        return compute_backend(kind).describe(kind, a.function_name)
+    if a.action == "delete-function":
+        return compute_backend(kind).delete(kind, a.function_name)
+    data = payload(a.payload)
+    destination = Path(a.outfile)
+    require(not destination.exists() and not destination.is_symlink() and destination.parent.is_dir(),
+            "OUTPUT_EXISTS", "輸出檔必須是新檔案且父目錄已存在，避免覆寫既有資料。")
+    # 先保留輸出位置再 invoke，避免呼叫已發生卻沒有可保存結果的位置。
+    fd = os.open(destination, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    try:
+        with os.fdopen(fd, "wb") as out:
+            status, body, failure = compute_backend(kind).invoke(kind, a.function_name, data, timeout=a.request_timeout)
+            out.write(body)
+        result = {"StatusCode": status}
+        if failure:
+            result["FunctionError"] = failure
+        emit(result)
+        # AWS 同步 invoke 的 handler error 透過 FunctionError 與 payload 回報。
+        return 0 if status < 400 else 1
+    except Exception:
+        destination.unlink(missing_ok=True)
+        raise
+
+
+def entry(provider, argv=None):
+    try:
+        argv = sys.argv[1:] if argv is None else argv
+        argv = list(argv)
+        require(provider in {"fufu", "aws-fufu", "gcloud-fufu", "az-fufu"}, "UNSUPPORTED_CLI", "未知 CLI 入口。")
+        # Native global selectors are checked against the authenticated tenant scope.
+        if provider in {'aws-fufu', 'gcloud-fufu'}:
+            rest = []; i = 0
+            while i < len(argv):
+                flag, _, inline = argv[i].partition('=')
+                if flag in {'--region', '--project', '--output', '--format', '--impersonate-service-account'}:
+                    value = inline if '=' in argv[i] else (argv[i + 1] if i + 1 < len(argv) else '')
+                    i += 1 if '=' in argv[i] else 2
+                    require(bool(value) and not value.startswith('--'), 'UNSUPPORTED_ARGUMENT', '全域旗標缺少值。')
+                    if flag == '--impersonate-service-account':
+                        require(provider == 'gcloud-fufu', 'UNSUPPORTED_ARGUMENT', '此旗標只適用於 gcloud-fufu。')
+                        os.environ['FUFU_ASSUME_ROLE'] = value
+                    elif flag in {'--output', '--format'}: require(value == 'json', 'UNSUPPORTED_ARGUMENT', '目前輸出格式支援 json。')
+                    else: os.environ['FUFU_SELECTED_REGION' if flag == '--region' else 'FUFU_SELECTED_PROJECT'] = value
+                elif flag in {'--quiet', '--no-cli-pager'}:
+                    require('=' not in argv[i], 'UNSUPPORTED_ARGUMENT', '布林旗標不接受額外值。'); i += 1
+                else: rest.append(argv[i]); i += 1
+            argv = rest
+        if provider == 'aws-fufu' and argv and argv[0] == 'serverless':
+            from .serverless import command
+            emit(command(argv[1:], Parser)); return
+        if provider == 'fufu' and argv and argv[0] in {'gateway', 'events', 'mock'}:
+            from .control import fufu_control
+            emit(fufu_control(argv, Parser)); return
+        if provider == 'aws-fufu' and argv and argv[0] in {'iam', 'dynamodb', 's3api', 'sqs', 'ssm'}:
+            from .control import command
+            emit(command(argv, Parser)); return
+        if provider == 'gcloud-fufu' and argv and argv[0] in {'iam', 'projects'}:
+            from .control import gcp_command
+            emit(gcp_command(argv, Parser)); return
+        if provider == 'aws-fufu' and argv and argv[0] == 'apigatewayv2':
+            from .control import gateway_command
+            emit(gateway_command(argv[1:], Parser)); return
+        if provider == 'aws-fufu' and len(argv) > 1 and argv[0] == 'lambda' and argv[1] in {'create-event-source-mapping', 'list-event-source-mappings', 'delete-event-source-mapping'}:
+            from .control import mapping_command
+            emit(mapping_command(argv[1:], Parser)); return
+        if provider == 'az-fufu' and argv and argv[0] == 'functionapp':
+            raise FufuError('CAPABILITY_NOT_SUPPORTED', 'Azure Functions runtime 尚未實作。', 2)
+        remote = {"aws-fufu": "aws", "gcloud-fufu": "gcp", "az-fufu": "azure"}
+        if provider == 'aws-fufu' and argv and argv[0] in {'s3', 'sqs', 'ssm'}:
+            from .cloud_data import aws_data_command
+            emit(aws_data_command(argv, Parser))
+            return
+        api_services = {"aws-fufu": {"sts", "dynamodb"}, "gcloud-fufu": {"auth", "storage"}, "az-fufu": {"account", "group", "resource"}}
+        compute = (provider == 'aws-fufu' and argv and argv[0] == 'lambda') or (provider == 'gcloud-fufu' and argv and argv[0] in {'run', 'functions'})
+        if provider in remote and not compute and (provider == "az-fufu" or api_selected() or (argv and argv[0] in api_services[provider])):
+            result = remote_command(remote[provider], argv, Parser)
+        else:
+            result = {"fufu": fufu_command, "aws-fufu": aws_command, "gcloud-fufu": gcloud_command}[provider](argv)
+        if type(result) is int:
+            raise SystemExit(result)
+        if provider == 'az-fufu' and argv and argv[0] != 'account' and isinstance(result, dict):
+            result['Fufu'] = {'mode': 'mock-only', 'executable': False}
+        emit(result)
+    except FufuError as exc:
+        sys.stderr.write(json.dumps({"error": {"code": exc.code, "message": exc.message}}, ensure_ascii=False) + "\n")
+        raise SystemExit(exc.exit_code)
+    except (OSError, ValueError, KeyError, TypeError) as exc:
+        sys.stderr.write(json.dumps({"error": {"code": "LOCAL_OPERATION_FAILED", "message": "本機檔案或輸入操作失敗；未輸出原始設定。"}}, ensure_ascii=False) + "\n")
+        raise SystemExit(1) from exc
+
+
+def main():
+    entry("fufu")
+
+
+def aws_main():
+    entry("aws-fufu")
+
+
+def gcloud_main():
+    entry("gcloud-fufu")
+
+
+def az_main():
+    entry("az-fufu")

fufu_cloud_cli/cloud_data.py

@@ -0,0 +1,99 @@
+import base64
+import json
+import os
+from pathlib import Path
+from urllib.parse import urlencode, urlsplit
+
+from .api_backend import ApiClient, segment
+from .errors import require
+
+
+def upload_bytes(path):
+    p = Path(path)
+    require(p.is_file() and p.stat().st_size <= 6 * 1024**2, 'PAYLOAD_LIMIT', '物件上傳檔案上限為 6 MiB。')
+    return base64.b64encode(p.read_bytes()).decode()
+
+
+def download_bytes(path, encoded):
+    p = Path(path)
+    require(not p.exists() and not p.is_symlink() and p.parent.is_dir(), 'OUTPUT_EXISTS', '下載目的地必須是新檔案。')
+    data = base64.b64decode(encoded, validate=True)
+    fd = os.open(p, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    with os.fdopen(fd, 'wb') as f:
+        f.write(data)
+    return {'downloaded': True, 'bytes': len(data)}
+
+
+def s3_path(value):
+    p = urlsplit(value)
+    require(p.scheme == 's3' and p.netloc and not p.query and not p.fragment and not p.username and not p.password,
+            'INVALID_RESOURCE', '請使用 s3://bucket 或 s3://bucket/key。')
+    return '/s3/buckets/' + segment(p.netloc), p.path.lstrip('/')
+
+
+def aws_data_command(argv, Parser):
+    p = Parser(prog='aws-fufu')
+    root = p.add_subparsers(dest='service', required=True)
+    s3 = root.add_parser('s3').add_subparsers(dest='action', required=True)
+    s3.add_parser('ls').add_argument('url', nargs='?')
+    for action in ('mb', 'rb', 'rm'):
+        s3.add_parser(action).add_argument('url')
+    cp = s3.add_parser('cp'); cp.add_argument('source'); cp.add_argument('destination')
+    sqs = root.add_parser('sqs').add_subparsers(dest='action', required=True)
+    sqs.add_parser('list-queues')
+    sqs.add_parser('create-queue').add_argument('--queue-name', required=True)
+    for action in ('delete-queue', 'send-message', 'receive-message', 'delete-message'):
+        q = sqs.add_parser(action); q.add_argument('--queue-url', required=True)
+        if action == 'send-message': q.add_argument('--message-body', required=True)
+        if action == 'delete-message': q.add_argument('--receipt-handle', required=True)
+    ssm = root.add_parser('ssm').add_subparsers(dest='action', required=True)
+    for action in ('get-parameter', 'put-parameter', 'delete-parameter'):
+        q = ssm.add_parser(action); q.add_argument('--name', required=True)
+        if action == 'put-parameter':
+            values = q.add_mutually_exclusive_group(required=True)
+            values.add_argument('--value'); values.add_argument('--value-env')
+            q.add_argument('--type', choices=['String'], default='String')
+            q.add_argument('--overwrite', action='store_true')
+    a = p.parse_args(argv)
+    read_only = a.action in {'ls', 'list-queues', 'get-parameter'} or (a.action == 'cp' and a.source.startswith('s3://'))
+    with ApiClient('aws', read_only=read_only) as api:
+        if a.service == 'ssm':
+            path = '/ssm/parameter'
+            if a.action == 'put-parameter':
+                if a.value_env:
+                    require(a.value_env in os.environ, 'MISSING_ENV', '必要的設定值尚未注入。')
+                    value = os.environ[a.value_env]
+                else: value = a.value
+                return api.request('PUT', path, {'Name': a.name, 'Value': value, 'Type': a.type, 'Overwrite': a.overwrite})
+            return api.request('GET' if a.action == 'get-parameter' else 'DELETE', path + '?' + urlencode({'name': a.name}))
+        if a.service == 'sqs':
+            if a.action == 'list-queues': return api.request('GET', '/sqs/queues')
+            if a.action == 'create-queue': return api.request('POST', '/sqs/queues', {'QueueName': a.queue_name})
+            url = urlsplit(a.queue_url)
+            require(url.scheme == 'fufu' and url.netloc == 'sqs' and not url.query and not url.fragment,
+                    'INVALID_RESOURCE', 'QueueUrl 必須是 FUFU create-queue 回傳的租戶資源識別。')
+            path = '/sqs/queues/' + segment(url.path.lstrip('/'))
+            if a.action == 'delete-queue': return api.request('DELETE', path)
+            if a.action == 'receive-message': return api.request('POST', path + '/receive', {})
+            if a.action == 'delete-message': return api.request('POST', path + '/delete-message', {'ReceiptHandle': a.receipt_handle})
+            return api.request('POST', path + '/messages', {'MessageBody': a.message_body})
+        def native(operation, params):
+            return api.request('POST', '/control/native', {'service': 's3', 'operation': operation, 'params': params})
+        if a.action == 'ls' and not a.url: return native('ListBuckets', {})
+        if a.action == 'cp':
+            downloading = a.source.startswith('s3://')
+            require(downloading != a.destination.startswith('s3://'), 'UNSUPPORTED_ARGUMENT', 'cp 支援本機檔案與 S3 之間傳輸。')
+            path, key = s3_path(a.source if downloading else a.destination)
+            bucket = urlsplit(a.source if downloading else a.destination).netloc
+            require(bool(key), 'INVALID_RESOURCE', '請指定 object key。')
+            if downloading:
+                result = native('GetObject', {'Bucket': bucket, 'Key': key})
+                return download_bytes(a.destination, result['Body']['__fufu_bytes'])
+            return native('PutObject', {'Bucket': bucket, 'Key': key, 'Body': {'__fufu_bytes': upload_bytes(a.source)}})
+        path, key = s3_path(a.url)
+        bucket = urlsplit(a.url).netloc
+        if a.action == 'rm':
+            require(bool(key), 'INVALID_RESOURCE', '請指定 object key。')
+            return native('DeleteObject', {'Bucket': bucket, 'Key': key})
+        require(not key, 'UNSUPPORTED_ARGUMENT', 'Bucket 操作不接受 object key 或 prefix。')
+        return native({'mb': 'CreateBucket', 'rb': 'DeleteBucket', 'ls': 'ListObjectsV2'}[a.action], {'Bucket': bucket})