fufu-cloud-cli 0.9.2__tar.gz → 0.9.3__tar.gz

{fufu_cloud_cli-0.9.2/src/fufu_cloud_cli.egg-info → fufu_cloud_cli-0.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fufu-cloud-cli
-Version: 0.9.2
+Version: 0.9.3
 Summary: FUFU Cloud CLI for tenant-scoped mock cloud development and deployment
 License-Expression: LicenseRef-Proprietary
 Requires-Python: >=3.10
@@ -22,7 +22,7 @@ Dynamic: license-file
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
-0.9.2 新增 `gcloud-fufu secrets versions describe`，以 metadata 權限查看版本狀態而不讀取秘密；GCP 秘密內容不可為空。配套後端依真實 GCP 驗證修正 Editor／Viewer 等角色的明列權限子集、Gen 1 HTTP invoker 與 Pub/Sub 的 0 秒預設 ack deadline。這些新能力需要同步更新 FUFU 服務端；沒有完整 Google IAM、SDK／ADC 或自動擴縮相容保證。
+0.9.3 新增 gcloud 常用輸出投影、資源清單篩選／排序／limit、Cloud Run 設定與環境變數更新、Service Account 查詢／停用／啟用，以及 Pub/Sub attributes、分頁和 message ACK deadline。這些行為已用官方 gcloud、小用量真實 GCP 與隔離 Docker 驗收；不表示完整 Google IAM、SDK／ADC 或自動擴縮相容。新增後端能力需要同步更新 FUFU Console 和 compute worker。
 
 0.9.1 統一所有 CLI API 請求的 `User-Agent: fufu-cloud-cli`，涵蓋物件傳輸、
 Cloudflare 靜態檔案部署、IaC 遠端 state 與 Cloud Shell session，避免沿用
@@ -34,7 +34,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.9.2'
+pip install 'fufu-cloud-cli==0.9.3'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.3}/README.md

@@ -4,7 +4,7 @@
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
-0.9.2 新增 `gcloud-fufu secrets versions describe`，以 metadata 權限查看版本狀態而不讀取秘密；GCP 秘密內容不可為空。配套後端依真實 GCP 驗證修正 Editor／Viewer 等角色的明列權限子集、Gen 1 HTTP invoker 與 Pub/Sub 的 0 秒預設 ack deadline。這些新能力需要同步更新 FUFU 服務端；沒有完整 Google IAM、SDK／ADC 或自動擴縮相容保證。
+0.9.3 新增 gcloud 常用輸出投影、資源清單篩選／排序／limit、Cloud Run 設定與環境變數更新、Service Account 查詢／停用／啟用，以及 Pub/Sub attributes、分頁和 message ACK deadline。這些行為已用官方 gcloud、小用量真實 GCP 與隔離 Docker 驗收；不表示完整 Google IAM、SDK／ADC 或自動擴縮相容。新增後端能力需要同步更新 FUFU Console 和 compute worker。
 
 0.9.1 統一所有 CLI API 請求的 `User-Agent: fufu-cloud-cli`，涵蓋物件傳輸、
 Cloudflare 靜態檔案部署、IaC 遠端 state 與 Cloud Shell session，避免沿用
@@ -16,7 +16,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.9.2'
+pip install 'fufu-cloud-cli==0.9.3'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fufu-cloud-cli"
-version = "0.9.2"
+version = "0.9.3"
 description = "FUFU Cloud CLI for tenant-scoped mock cloud development and deployment"
 readme = "README.md"
 requires-python = ">=3.10"

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.3}/src/fufu_cloud_cli/__init__.py

@@ -1,3 +1,3 @@
 """FUFU CLI 與本機部署工具；相容範圍見 capabilities.json。"""
 
-__version__ = "0.9.2"
+__version__ = "0.9.3"

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.3}/src/fufu_cloud_cli/cli.py

@@ -224,6 +224,7 @@ def fufu_command(argv):
 
 
 def gcloud_command(argv):
+    from .gcloud_environment import flags as environment_flags, change as environment_change
     p = Parser(prog="gcloud-fufu", description="支援 Cloud Run 單一容器與 Python HTTP function 子集。")
     roots = p.add_subparsers(dest="service", required=True)
     run_p = roots.add_parser("run")
@@ -239,6 +240,7 @@ def gcloud_command(argv):
     secrets = d.add_mutually_exclusive_group()
     secrets.add_argument('--set-secrets'); secrets.add_argument('--update-secrets'); secrets.add_argument('--clear-secrets', action='store_true')
     deployment_options(d)
+    environment_flags(d)
     deployment_flags(d); run_iam_flags(d)
     services = run_sub.add_parser("services").add_subparsers(dest="service_action", required=True)
     replace = services.add_parser("replace")
@@ -259,6 +261,7 @@ def gcloud_command(argv):
     generation_options(d)
     d.add_argument("--trigger-http", required=True, action="store_true")
     deployment_options(d)
+    environment_flags(d)
     deployment_flags(d)
     for action in ("describe", "delete", "call"):
         q = fn.add_parser(action)
@@ -284,6 +287,12 @@ def gcloud_command(argv):
         env = env_from_names(a.env)
         from .secrets import references
         secret_options = {}
+        mutation = environment_change(a)
+        if mutation:
+            require(api_selected(), 'API_BACKEND_REQUIRED', '原生環境更新旗標目前需要 FUFU API 模式。')
+            secret_options['environment_patch'] = mutation
+        elif not a.env and api_selected():
+            secret_options['environment_patch'] = {'replace': False, 'values': {}, 'remove': []}
         if a.set_secrets is not None or a.clear_secrets: secret_options['secret_references'] = references(a.set_secrets)
         if a.update_secrets is not None: secret_options['secret_updates'] = references(a.update_secrets)
         require(not secret_options or api_selected(), 'API_BACKEND_REQUIRED', 'Secret references 需要 FUFU API 模式。')
@@ -391,10 +400,34 @@ def aws_command(argv):
 
 
 def entry(provider, argv=None):
+    selected_keys = ['FUFU_SELECTED_REGION', 'FUFU_SELECTED_PROJECT', 'FUFU_ASSUME_ROLE']
+    original_environment = {key: os.environ.get(key) for key in selected_keys}
+    output_format = None; output_filter = None; output_sort = None; output_limit = None
+    def emit(value):
+        if provider == 'gcloud-fufu' and (output_format or output_filter or output_sort or output_limit is not None):
+            from .gcloud_output import native, render, select
+            shaped = native(value, argv)
+            if output_filter or output_sort or output_limit is not None:
+                shaped = select(shaped, output_filter, output_sort, output_limit)
+            sys.stdout.write(render(shaped, output_format or 'json'))
+        else: sys.stdout.write(json.dumps(value, ensure_ascii=False, sort_keys=True) + '\n')
     try:
         argv = sys.argv[1:] if argv is None else argv
         argv = list(argv)
         require(provider in {"fufu", "aws-fufu", "gcloud-fufu", "az-fufu", "wrangler-fufu"}, "UNSUPPORTED_CLI", "未知 CLI 入口。")
+        if argv == ['--version']:
+            sys.stdout.write(('fufu-cloud-cli ' if provider == 'gcloud-fufu' else '') + __version__ + '\n'); return
+        if provider == 'gcloud-fufu' and argv in [['--help'], ['-h']]:
+            p = Parser(prog='gcloud-fufu', description='GCP 開發環境的可執行子集；使用 FUFU credential，功能範圍請見 fufu capabilities。')
+            for flag, description in [('--format', 'json／yaml／value／table／csv；支援 dotted path 投影'),
+                                      ('--filter', 'list 的欄位比較與 AND／OR／NOT'), ('--sort-by', 'list 排序；~ 表示降序'),
+                                      ('--limit', '篩選排序後的 list 筆數'), ('--project', '必須符合 credential 的 project'),
+                                      ('--region', '必須符合 credential 的 region')]: p.add_argument(flag, help=description)
+            p.add_argument('--quiet', '-q', action='store_true', help='非互動執行')
+            p.add_argument('--version', action='store_true', help='CLI 版本')
+            groups = p.add_subparsers(title='服務')
+            for group in ['run', 'functions', 'iam', 'projects', 'pubsub', 'secrets', 'storage', 'auth']: groups.add_parser(group)
+            p.print_help(); return
         if provider == 'wrangler-fufu':
             from .cloudflare import command
             result = command(argv, Parser)
@@ -414,19 +447,40 @@ def entry(provider, argv=None):
             rest = []; i = 0
             while i < len(argv):
                 flag, _, inline = argv[i].partition('=')
-                if flag in {'--region', '--project', '--output', '--format', '--impersonate-service-account'}:
+                if flag in {'--region', '--project', '--output', '--format', '--impersonate-service-account', '--filter', '--sort-by'} or flag == '--limit' and provider == 'gcloud-fufu' and 'list' in argv:
                     value = inline if '=' in argv[i] else (argv[i + 1] if i + 1 < len(argv) else '')
                     i += 1 if '=' in argv[i] else 2
                     require(bool(value) and not value.startswith('--'), 'UNSUPPORTED_ARGUMENT', '全域旗標缺少值。')
                     if flag == '--impersonate-service-account':
                         require(provider == 'gcloud-fufu', 'UNSUPPORTED_ARGUMENT', '此旗標只適用於 gcloud-fufu。')
                         os.environ['FUFU_ASSUME_ROLE'] = value
-                    elif flag in {'--output', '--format'}: require(value == 'json', 'UNSUPPORTED_ARGUMENT', '目前輸出格式支援 json。')
+                    elif flag == '--format' and provider == 'gcloud-fufu':
+                        from .gcloud_output import format_spec
+                        format_spec(value); output_format = value
+                    elif flag in {'--filter', '--sort-by', '--limit'}:
+                        require(provider == 'gcloud-fufu' and 'list' in argv, 'UNSUPPORTED_ARGUMENT', '清單選取旗標只適用於 gcloud-fufu list。')
+                        from .gcloud_output import Filter, field
+                        if flag == '--filter': Filter(value); output_filter = value
+                        if flag == '--sort-by':
+                            for column in value.split(','):
+                                require(not field(column.lstrip('~'))[1], 'UNSUPPORTED_ARGUMENT', '排序轉換尚未支援。')
+                            output_sort = value
+                        if flag == '--limit':
+                            require(value.isdigit(), 'UNSUPPORTED_ARGUMENT', 'limit 必須為非負整數。'); output_limit = int(value)
+                    elif flag in {'--output', '--format'}: require(value == 'json', 'UNSUPPORTED_ARGUMENT', '此入口目前輸出格式支援 json。')
                     else: os.environ['FUFU_SELECTED_REGION' if flag == '--region' else 'FUFU_SELECTED_PROJECT'] = value
-                elif flag in {'--quiet', '--no-cli-pager'}:
+                elif flag in {'--quiet', '-q', '--no-cli-pager'}:
                     require('=' not in argv[i], 'UNSUPPORTED_ARGUMENT', '布林旗標不接受額外值。'); i += 1
                 else: rest.append(argv[i]); i += 1
             argv = rest
+            if provider == 'gcloud-fufu':
+                if output_filter or output_sort or output_limit is not None:
+                    list_commands = [('run', 'services', 'list'), ('functions', 'list'), ('iam', 'service-accounts', 'list'),
+                                     ('pubsub', 'topics', 'list'), ('pubsub', 'subscriptions', 'list'), ('secrets', 'list'),
+                                     ('secrets', 'versions', 'list'), ('storage', 'buckets', 'list')]
+                    require(any(tuple(argv[:len(command)]) == command for command in list_commands), 'UNSUPPORTED_ARGUMENT', '清單選取旗標只適用於資源 list；未執行操作。')
+                if output_format and argv[:2] == ['functions', 'call']:
+                    require(output_format == 'json', 'UNSUPPORTED_FORMAT', 'Functions call 目前只支援 JSON 回應。')
         from . import public_access
         if provider == 'aws-fufu' and argv[:1] == ['secretsmanager'] or provider == 'gcloud-fufu' and argv[:1] == ['secrets']:
             from .secrets import command
@@ -487,6 +541,10 @@ def entry(provider, argv=None):
     except (OSError, ValueError, KeyError, TypeError) as exc:
         sys.stderr.write(json.dumps({"error": {"code": "LOCAL_OPERATION_FAILED", "message": "本機檔案或輸入操作失敗；未輸出原始設定。"}}, ensure_ascii=False) + "\n")
         raise SystemExit(1) from exc
+    finally:
+        for key, value in original_environment.items():
+            if value is None: os.environ.pop(key, None)
+            else: os.environ[key] = value
 
 
 def main():

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.3}/src/fufu_cloud_cli/control.py

@@ -134,16 +134,17 @@ def gcp_command(argv, Parser):
     c = sub.add_parser('create'); c.add_argument('name'); c.add_argument('--display-name'); c.add_argument('--description')
     c = sub.add_parser('update'); c.add_argument('email'); c.add_argument('--display-name'); c.add_argument('--description')
     sub.add_parser('delete').add_argument('email')
+    for action in ['describe', 'enable', 'disable']: sub.add_parser(action).add_argument('email')
     sub = roots.add_parser('projects').add_subparsers(dest='action', required=True)
     for act in ['get-iam-policy', 'add-iam-policy-binding', 'remove-iam-policy-binding']:
         q = sub.add_parser(act); q.add_argument('project')
         if act != 'get-iam-policy': q.add_argument('--member', required=True); q.add_argument('--role', required=True)
     a = p.parse_args(argv)
-    op = {'get-iam-policy': 'list', 'add-iam-policy-binding': 'add-binding', 'remove-iam-policy-binding': 'remove-binding'}.get(a.action, a.action)
+    op = {'describe': 'get', 'get-iam-policy': 'get-policy', 'add-iam-policy-binding': 'add-binding', 'remove-iam-policy-binding': 'remove-binding'}.get(a.action, a.action)
     params = {k: getattr(a, k) for k in ['name', 'email', 'project', 'member', 'role'] if hasattr(a, k)}
     if getattr(a, 'display_name', None) is not None: params['displayName'] = a.display_name
     if getattr(a, 'description', None) is not None: params['description'] = a.description
-    with ApiClient('gcp') as api: return api.request('POST', '/control/iam', {'operation': op, 'params': params})
+    with ApiClient('gcp', read_only=op in {'list', 'get', 'get-policy'}) as api: return api.request('POST', '/control/iam', {'operation': op, 'params': params})
 
 
 def gateway_command(argv, Parser):

fufu_cloud_cli-0.9.3/src/fufu_cloud_cli/gcloud_environment.py

@@ -0,0 +1,53 @@
+"""gcloud environment mutation syntax; values are never included in errors."""
+from pathlib import Path
+import yaml
+from .errors import require
+from .manifest import environment
+
+
+def dictionary(value):
+    delimiter = ','
+    if value.startswith('^'):
+        _, delimiter, value = value.split('^', 2) if value.count('^') >= 2 else ('', '', '')
+        require(bool(delimiter), 'INVALID_INPUT', '自訂 delimiter 格式為 ^DELIMITER^key=value。')
+    pairs = value.split(delimiter) if value else []
+    result = {}
+    for pair in pairs:
+        key, sep, val = pair.partition('=')
+        require(sep and key and key not in result, 'INVALID_INPUT', '請使用不重複的 key=value 配置。')
+        result[key] = val
+    return result
+
+
+def flags(parser):
+    group = parser.add_mutually_exclusive_group()
+    group.add_argument('--set-env-vars', action='append')
+    group.add_argument('--env-vars-file')
+    group.add_argument('--clear-env-vars', action='store_true')
+    parser.add_argument('--update-env-vars', action='append')
+    parser.add_argument('--remove-env-vars', action='append')
+
+
+def change(args):
+    replace = any((getattr(args, 'set_env_vars', None) is not None, getattr(args, 'env_vars_file', None), getattr(args, 'clear_env_vars', False)))
+    updates, removes = getattr(args, 'update_env_vars', None), getattr(args, 'remove_env_vars', None)
+    require(not replace or not (updates or removes), 'CONFLICTING_ARGUMENTS', '替換／清空環境變數不能與更新／移除並用。')
+    require(not getattr(args, 'env', None) or not (replace or updates or removes), 'CONFLICTING_ARGUMENTS', '--env 與原生環境旗標不可混用。')
+    values = {}
+    for item in getattr(args, 'set_env_vars', None) or updates or []: values.update(dictionary(item))
+    if getattr(args, 'env_vars_file', None):
+        file = Path(args.env_vars_file)
+        require(file.is_file() and not file.is_symlink() and file.stat().st_size <= 1024**2, 'INVALID_INPUT', '環境檔必須是不超過 1 MiB 的一般 YAML／JSON 檔。')
+        values = yaml.safe_load(file.read_text())
+    if replace or updates or removes:
+        names = [name for item in removes or [] for name in item.split(',')]
+        environment({name: '' for name in names})
+        return {'replace': replace, 'values': environment(values), 'remove': names}
+    return None
+
+
+def merge(current, mutation):
+    result = {} if mutation['replace'] else dict(current)
+    for name in mutation['remove']: result.pop(name, None)
+    result.update(mutation['values'])
+    return environment(result)

fufu_cloud_cli-0.9.3/src/fufu_cloud_cli/gcloud_output.py

@@ -0,0 +1,196 @@
+"""Explicit gcloud output and list-selection subset, without a Cloud SDK dependency."""
+import copy
+import csv
+import io
+import json
+import re
+
+import yaml
+
+from .errors import require
+
+
+def field(spec):
+    match = re.fullmatch(r'([A-Za-z_][\w-]*(?:\.[A-Za-z_][\w-]*|\[\d+\])*)(\.basename\(\))?(?::label=([A-Za-z_][\w -]*))?', spec)
+    require(match, 'UNSUPPORTED_FORMAT', '欄位支援 dotted path、數字索引、basename() 與 :label=；其他投影尚未支援。')
+    path, transform, label = match.groups()
+    parts = re.findall(r'[A-Za-z_][\w-]*|\d+', path)
+    return parts, bool(transform), label or parts[-1].upper()
+
+
+def lookup(value, parts):
+    for part in parts:
+        if isinstance(value, list) and part.isdigit(): value = value[int(part)] if int(part) < len(value) else None
+        elif isinstance(value, dict): value = value.get(part)
+        else: return None
+    return value
+
+
+def cell(value):
+    if value is None: return ''
+    if isinstance(value, (dict, list)): return json.dumps(value, ensure_ascii=False, sort_keys=True)
+    return str(value)
+
+
+def project(row, columns):
+    result = {}
+    for parts, transform, _ in columns:
+        require(not transform and not any(p.isdigit() for p in parts), 'UNSUPPORTED_FORMAT', 'JSON／YAML 投影目前支援物件欄位；轉換與索引請使用 value／table／csv。')
+        target = result
+        for p in parts[:-1]:
+            require(not p in target or isinstance(target[p], dict), 'UNSUPPORTED_FORMAT', '投影欄位彼此衝突。')
+            target = target.setdefault(p, {})
+        value = lookup(row, parts)
+        if value is not None: target[parts[-1]] = value
+    return result
+
+
+def format_spec(spec):
+    match = re.fullmatch(r'(json|yaml|value|table|csv)(\[no-heading\])?(?:\((.*)\))?', spec)
+    require(match, 'UNSUPPORTED_FORMAT', '支援 json、yaml、value(...)、table(...)、csv(...)；尚未支援的格式會明確拒絕。')
+    kind, no_heading, fields = match.groups()
+    columns = [field(s.strip()) for s in fields.split(',')] if fields else []
+    require(kind in {'json', 'yaml'} or columns, 'UNSUPPORTED_FORMAT', 'value／table／csv 請明列欄位。')
+    require(not no_heading or kind in {'table', 'csv'}, 'UNSUPPORTED_FORMAT', 'no-heading 只用於 table／csv。')
+    if kind in {'json', 'yaml'}: project({}, columns)
+    return kind, bool(no_heading), columns
+
+
+def render(value, spec):
+    kind, no_heading, columns = format_spec(spec)
+    rows = value if isinstance(value, list) else [value]
+    if kind in {'json', 'yaml'}:
+        projected = [project(row, columns) for row in rows] if columns else rows
+        if kind == 'json':
+            return json.dumps(projected if isinstance(value, list) else projected[0], ensure_ascii=False, sort_keys=True, indent=2) + '\n'
+        if isinstance(value, list):
+            return yaml.safe_dump_all(projected, allow_unicode=True, sort_keys=True, explicit_start=True) if projected else ''
+        return yaml.safe_dump(projected[0], allow_unicode=True, sort_keys=True)
+    data = []
+    for row in rows:
+        values = []
+        for parts, transform, _ in columns:
+            v = cell(lookup(row, parts))
+            values.append(v.rstrip('/').rsplit('/', 1)[-1] if transform else v)
+        data.append(values)
+    headers = [c[2] for c in columns]
+    if kind == 'value': return ''.join('\t'.join(row) + '\n' for row in data)
+    if not data: return ''
+    if kind == 'csv':
+        out = io.StringIO(); writer = csv.writer(out, lineterminator='\n')
+        if not no_heading: writer.writerow([h.lower() for h in headers])
+        writer.writerows(data); return out.getvalue()
+    table = data if no_heading else [headers, *data]
+    widths = [max(len(row[i]) for row in table) for i in range(len(columns))]
+    return ''.join('  '.join(v.ljust(widths[i]) for i, v in enumerate(row)).rstrip() + '\n' for row in table)
+
+
+class Filter:
+    """Bounded parser: no eval, shell execution or caller-controlled regular expressions."""
+    def __init__(self, expression):
+        require(len(expression) <= 4096, 'UNSUPPORTED_FILTER', 'Filter 長度上限為 4096。')
+        self.tokens = []; self.index = 0
+        pattern = re.compile(r'\s*(>=|<=|!=|[():=<>]|"(?:[^"\\]|\\.)*"|\x27(?:[^\x27\\]|\\.)*\x27|[^\s():=<>!]+)')
+        position = 0
+        while position < len(expression.rstrip()):
+            match = pattern.match(expression, position)
+            require(match, 'UNSUPPORTED_FILTER', 'Filter 語法尚未支援。')
+            self.tokens.append(match[1]); position = match.end()
+        require(len(self.tokens) <= 256, 'UNSUPPORTED_FILTER', 'Filter 條件過多。')
+        self.tree = self.group(0)
+        require(self.index == len(self.tokens), 'UNSUPPORTED_FILTER', 'Filter 必須以 AND／OR 連接條件；不支援的語法不會被忽略。')
+
+    def pop(self):
+        require(self.index < len(self.tokens), 'UNSUPPORTED_FILTER', 'Filter 不完整。')
+        v = self.tokens[self.index]; self.index += 1; return v
+
+    def peek(self): return self.tokens[self.index] if self.index < len(self.tokens) else None
+
+    def group(self, depth):
+        require(depth < 16, 'UNSUPPORTED_FILTER', 'Filter 巢狀層數過多。')
+        items = [self.term(depth)]; operator = None
+        while self.peek() in {'AND', 'OR'}:
+            op = self.pop()
+            require(operator is None or operator == op, 'UNSUPPORTED_FILTER', 'AND 與 OR 混用必須加括號。')
+            operator = op; items.append(self.term(depth))
+        return (operator or 'AND', items)
+
+    def term(self, depth):
+        require(depth < 16, 'UNSUPPORTED_FILTER', 'Filter 巢狀層數過多。')
+        if self.peek() == 'NOT': self.pop(); return ('NOT', self.term(depth + 1))
+        if self.peek() == '(':
+            self.pop(); result = self.group(depth + 1)
+            require(self.pop() == ')', 'UNSUPPORTED_FILTER', 'Filter 括號未配對。'); return result
+        parts, transform, _ = field(self.pop())
+        require(not transform, 'UNSUPPORTED_FILTER', 'Filter 轉換尚未支援。')
+        op, value = self.pop(), self.pop()
+        require(op in {'=', '!=', ':', '>', '<', '>=', '<='} and value not in {'(', ')', 'AND', 'OR'}, 'UNSUPPORTED_FILTER', '不支援此 Filter 運算子或值。')
+        if value.startswith(('"', "'")):
+            require('\\' not in value, 'UNSUPPORTED_FILTER', 'Filter 跳脫字元尚未支援。'); value = value[1:-1]
+        require('~' not in value and (not '*' in value or op == ':' and value.count('*') == 1), 'UNSUPPORTED_FILTER', '萬用字元目前僅支援 : 運算子的單一 *。')
+        return ('compare', parts, op, value)
+
+    def matches(self, row):
+        def compare(actual, op, expected):
+            if op == ':' and expected == '*': return actual is not None
+            if actual is None: return op == '!='
+            if isinstance(actual, list): return any(compare(v, op, expected) for v in actual)
+            left, right = cell(actual).casefold(), expected.casefold()
+            if op == ':':
+                if '*' in right:
+                    start, end = right.split('*'); return left.startswith(start) and left.endswith(end) and len(left) >= len(start) + len(end)
+                return right in left
+            try: left, right = float(left), float(right)
+            except ValueError: pass
+            if type(left) != type(right): return op == '!='
+            return {'=': lambda: left == right, '!=': lambda: left != right, '>': lambda: left > right,
+                    '<': lambda: left < right, '>=': lambda: left >= right, '<=': lambda: left <= right}[op]()
+        def visit(node):
+            if node[0] == 'NOT': return not visit(node[1])
+            if node[0] in {'AND', 'OR'}: return (all if node[0] == 'AND' else any)(visit(n) for n in node[1])
+            return compare(lookup(row, node[1]), node[2], node[3])
+        return visit(self.tree)
+
+
+def select(rows, expression=None, sort_by=None, limit=None):
+    require(isinstance(rows, list), 'UNSUPPORTED_ARGUMENT', 'Filter、排序與 limit 只適用於資源 list。')
+    result = list(rows)
+    if expression:
+        predicate = Filter(expression)
+        result = [row for row in result if predicate.matches(row)]
+    for spec in reversed(sort_by.split(',') if sort_by else []):
+        descending = spec.startswith('~'); parts, transform, _ = field(spec.lstrip('~'))
+        require(not transform, 'UNSUPPORTED_ARGUMENT', '排序請使用物件欄位。')
+        def key(row):
+            value = lookup(row, parts)
+            return (value is not None, 0 if isinstance(value, (int, float)) else 1, value if isinstance(value, (int, float)) else cell(value))
+        result.sort(key=key, reverse=descending)
+    return result[:limit] if limit is not None else result
+
+
+def native(value, argv):
+    """Shape only known resources; retain explicit FUFU metadata on individual records."""
+    if not isinstance(value, dict): return value
+    result = copy.deepcopy(value)
+    if tuple(argv[:3]) in {('pubsub', 'topics', 'create'), ('pubsub', 'subscriptions', 'create')}:
+        return [result]
+    if tuple(argv[:3]) == ('pubsub', 'subscriptions', 'pull'):
+        return result.get('receivedMessages', [])
+    if argv[:1] in [['run'], ['functions']] and 'kind' in result and 'name' in result:
+        run = result['kind'] == 'cloud-run-http'
+        url = result.get('publicAccess', {}).get('url')
+        if run:
+            result.update(apiVersion='serving.knative.dev/v1', kind='Service')
+            result['metadata'] = {'name': result['name']}
+            result['status'] = {'url': url} if url else {}
+        elif result['kind'] == 'cloud-run-functions-http':
+            result['serviceConfig'] = {'uri': url} if url else {}
+        else: result['httpsTrigger'] = {'url': url} if url else {}
+    lists = {('run', 'services', 'list'): 'services', ('functions', 'list'): 'services',
+             ('iam', 'service-accounts', 'list'): 'accounts', ('pubsub', 'topics', 'list'): 'topics',
+             ('pubsub', 'subscriptions', 'list'): 'subscriptions', ('secrets', 'list'): 'secrets',
+             ('secrets', 'versions', 'list'): 'versions', ('storage', 'buckets', 'list'): 'buckets'}
+    for prefix, key in lists.items():
+        if tuple(argv[:len(prefix)]) == prefix and key in result:
+            return [native(row, argv) for row in result[key]]
+    return result

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.3}/src/fufu_cloud_cli/public_access.py

@@ -98,6 +98,12 @@ def gcp_command(argv, Parser):
         p.set_defaults(gen2=True)
     if action == 'update':
         deployment_flags(p); run_iam_flags(p)
+        from .gcloud_environment import flags
+        from .cli import deployment_options
+        flags(p); deployment_options(p)
+        p.add_argument('--service-account')
+        secrets = p.add_mutually_exclusive_group()
+        secrets.add_argument('--set-secrets'); secrets.add_argument('--update-secrets'); secrets.add_argument('--clear-secrets', action='store_true')
     elif action in {'add-iam-policy-binding', 'remove-iam-policy-binding'}:
         p.add_argument('--member', required=True); p.add_argument('--role', required=True)
     elif action == 'set-iam-policy':
@@ -105,8 +111,22 @@ def gcp_command(argv, Parser):
     a = p.parse_args(args[1:])
     kind = 'cloud-run-http' if run else 'cloud-run-functions-http' if a.gen2 else 'cloud-functions-gen1-http'
     if action == 'update':
-        require(configuration(a, kind) or a.anonymous is not None, 'MISSING_CONFIGURATION', '至少提供一個存取設定旗標。')
-        return configure_gcp(a, kind, a.name)
+        from .gcloud_environment import change
+        from .cli import resource_options, env_from_names
+        from .remote_compute import RemoteBackend
+        from .secrets import references
+        mutation = change(a); body = {}
+        if mutation is not None: body['environment_patch'] = mutation
+        if a.env: body['env'] = env_from_names(a.env)
+        resources = resource_options(a, kind)
+        if resources: body['resources'] = resources
+        if a.service_account: body['role'] = a.service_account
+        if a.set_secrets is not None or a.clear_secrets: body['secret_references'] = references(a.set_secrets)
+        if a.update_secrets is not None: body['secret_updates'] = references(a.update_secrets)
+        require(configuration(a, kind) or a.anonymous is not None or body, 'MISSING_CONFIGURATION', '至少提供一個服務設定旗標。')
+        require(api_selected(), 'API_BACKEND_REQUIRED', '服務設定更新需要 FUFU API 模式。')
+        deployed = RemoteBackend(kind).configure(kind, a.name, body) if body else None
+        return configure_gcp(a, kind, a.name, deployed)
     path = access_path(kind, a.name)
     with ApiClient('gcp', read_only=action == 'get-iam-policy') as api:
         current = api.request('GET', path)

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.3}/src/fufu_cloud_cli/pubsub.py

@@ -1,8 +1,10 @@
 """gcloud Pub/Sub commands using the tenant API shared with Terraform."""
 import base64
 import re
+import time
 from .api_backend import ApiClient
 from .errors import require
+from .gcloud_environment import dictionary
 
 
 def command(argv, Parser):
@@ -13,17 +15,18 @@ def command(argv, Parser):
         for action in ['create', 'describe', 'update', 'delete', 'list']:
             q = actions.add_parser(action)
             if action != 'list': q.add_argument('name')
-            else: q.add_argument('--limit', type=int, default=100); q.add_argument('--page-token')
+            else: q.add_argument('--page-size', type=int, default=100); q.add_argument('--page-token')
             if action in {'create', 'update'}:
                 q.add_argument('--labels' if action == 'create' else '--update-labels', dest='labels')
                 if action == 'update': q.add_argument('--clear-labels', action='store_true')
                 if group == 'subscriptions': q.add_argument('--ack-deadline', type=int)
             if action == 'create' and group == 'subscriptions': q.add_argument('--topic', required=True)
         if group == 'topics':
-            q = actions.add_parser('publish'); q.add_argument('name'); q.add_argument('--message', required=True)
+            q = actions.add_parser('publish'); q.add_argument('name'); q.add_argument('--message'); q.add_argument('--attribute', action='append')
         else:
             q = actions.add_parser('pull'); q.add_argument('name'); q.add_argument('--limit', type=int, default=1); q.add_argument('--auto-ack', action='store_true')
             q = actions.add_parser('ack'); q.add_argument('name'); q.add_argument('--ack-ids', nargs='+', required=True)
+            q = actions.add_parser('modify-message-ack-deadline'); q.add_argument('name'); q.add_argument('--ack-ids', nargs='+', required=True); q.add_argument('--ack-deadline', type=int, required=True)
     a = p.parse_args(argv)
     with ApiClient('gcp', read_only=a.action in {'describe', 'list'}) as api:
         project = api.whoami()['projectId']
@@ -56,11 +59,33 @@ def command(argv, Parser):
             fields = [key for key in body if key != 'name']
             require(fields, 'INVALID_INPUT', 'update 需要 labels 或 ack-deadline。')
             return call('Update' + singular, {singular.lower(): body, 'updateMask': {'paths': fields}})
-        if a.action == 'list': return call('List' + singular + 's', {'pageSize': a.limit, **({'pageToken': a.page_token} if a.page_token else {})})
+        if a.action == 'list':
+            require(1 <= a.page_size <= 1000, 'INVALID_INPUT', 'page-size 必須介於 1–1000。')
+            rows, token, seen = [], a.page_token, set()
+            deadline = time.monotonic() + 60
+            for _ in range(1000):
+                require(time.monotonic() < deadline, 'PAGINATION_FAILED', '清單讀取超過 60 秒；未回傳不完整結果。')
+                result = call('List' + singular + 's', {'pageSize': a.page_size, **({'pageToken': token} if token else {})})
+                rows.extend(result.get(a.group, [])); token = result.get('nextPageToken')
+                if not token: return {a.group: rows}
+                require(token not in seen and len(rows) <= 100000, 'PAGINATION_FAILED', '清單分頁未前進或超過本次安全讀取範圍；未回傳不完整結果。')
+                seen.add(token)
+            require(False, 'PAGINATION_FAILED', '清單分頁超過本次安全讀取範圍；未回傳不完整結果。')
         if a.action in {'describe', 'delete'}: return call(('Get' if a.action == 'describe' else 'Delete') + singular, {singular.lower(): full})
-        if a.action == 'publish': return call('Publish', {'topic': full, 'messages': [{'data': base64.b64encode(a.message.encode()).decode()}]})
-        if a.action == 'ack': return call('Acknowledge', {'subscription': full, 'ackIds': a.ack_ids})
+        if a.action == 'publish':
+            attributes = {}
+            for value in a.attribute or []: attributes.update(dictionary(value))
+            require(a.message or attributes, 'INVALID_INPUT', 'Publish 需要非空 message 或 attribute。')
+            return call('Publish', {'topic': full, 'messages': [{'data': base64.b64encode((a.message or '').encode()).decode(), 'attributes': attributes}]})
+        if a.action in {'ack', 'modify-message-ack-deadline'}:
+            ids = [item for group in a.ack_ids for item in group.split(',')]
+            params = {'subscription': full, 'ackIds': ids}
+            if a.action == 'modify-message-ack-deadline':
+                require(0 <= a.ack_deadline <= 600, 'INVALID_INPUT', 'ack-deadline 必須介於 0–600；0 表示立即重新投遞。')
+                params['ackDeadlineSeconds'] = a.ack_deadline
+            return call('Acknowledge' if a.action == 'ack' else 'ModifyAckDeadline', params)
         result = call('Pull', {'subscription': full, 'maxMessages': a.limit})
         if a.auto_ack and result.get('receivedMessages'):
             call('Acknowledge', {'subscription': full, 'ackIds': [message['ackId'] for message in result['receivedMessages']]})
+            for message in result['receivedMessages']: message['ackStatus'] = 'SUCCESS'
         return result

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.3}/src/fufu_cloud_cli/remote_compute.py

@@ -114,7 +114,7 @@ class RemoteBackend:
 
     def deploy(self, *, kind, service, image=None, port=8080, env=None, startup_timeout=30,
                replace=True, require_existing=False, archive=None, runtime=None, handler=None, preserve_environment=False, role=None, resources=None,
-               secret_references=None, secret_updates=None):
+               secret_references=None, secret_updates=None, environment_patch=None):
         body = dict(kind=kind, name=service, port=port, env=env or {}, startup_timeout=startup_timeout,
                     replace=replace, require_existing=require_existing, preserve_environment=preserve_environment)
         if image is not None:
@@ -125,6 +125,7 @@ class RemoteBackend:
         if resources: body['resources'] = resources
         if secret_references is not None: body['secret_references'] = secret_references
         if secret_updates is not None: body['secret_updates'] = secret_updates
+        if environment_patch is not None: body['environment_patch'] = environment_patch
         with ApiClient(self.provider) as api:
             if archive is not None and len(archive) > 8*1024**2:
                 body['archive_ref'] = upload_archive(api, kind, service, archive, require_existing)
@@ -142,6 +143,10 @@ class RemoteBackend:
         with ApiClient(self.provider, read_only=True) as api:
             return api.request('GET', '/compute/services/' + segment(kind) + '/' + segment(service))
 
+    def configure(self, kind, service, body):
+        with ApiClient(self.provider) as api:
+            return self.wait(api, api.request('PATCH', '/compute/services/' + segment(kind) + '/' + segment(service) + '/configuration', body))
+
     def listing(self, kind):
         with ApiClient(self.provider, read_only=True) as api:
             return api.request('GET', '/compute/services?' + urlencode({'kind': kind}))['services']

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.3}/src/fufu_cloud_cli/terraform_bridge/google.py

@@ -15,7 +15,7 @@ def account(bridge, value):
     project = bridge.identities['gcp']['projectId']
     return {'name': 'projects/' + project + '/serviceAccounts/' + email, 'projectId': project, 'email': email,
             'uniqueId': value.get('uniqueId', str(int(hashlib.sha256(email.encode()).hexdigest()[:16], 16))),
-            'displayName': value['displayName'], 'description': value.get('description', ''), 'disabled': False}
+            'displayName': value['displayName'], 'description': value.get('description', ''), 'disabled': value.get('disabled', False)}
 
 
 def iam(bridge, method, path, body):
@@ -25,6 +25,10 @@ def iam(bridge, method, path, body):
     if project != '-': bridge.project(project)
     elif not email: raise FufuError('ACCESS_DENIED', '需要明確的 project。')
     if email: email = unquote(email)
+    if email and method == 'POST' and email.endswith((':enable', ':disable')):
+        email, action = email.rsplit(':', 1)
+        only(body, [], 'Service Account lifecycle')
+        bridge.iam(action, {'email': email}); return 200, {}, {}
     if method == 'POST' and not email:
         only(body, ['accountId', 'serviceAccount'], 'Service Account')
         options = only(body.get('serviceAccount', {}), ['displayName', 'description'], 'Service Account')

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.3/src/fufu_cloud_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fufu-cloud-cli
-Version: 0.9.2
+Version: 0.9.3
 Summary: FUFU Cloud CLI for tenant-scoped mock cloud development and deployment
 License-Expression: LicenseRef-Proprietary
 Requires-Python: >=3.10
@@ -22,7 +22,7 @@ Dynamic: license-file
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
-0.9.2 新增 `gcloud-fufu secrets versions describe`，以 metadata 權限查看版本狀態而不讀取秘密；GCP 秘密內容不可為空。配套後端依真實 GCP 驗證修正 Editor／Viewer 等角色的明列權限子集、Gen 1 HTTP invoker 與 Pub/Sub 的 0 秒預設 ack deadline。這些新能力需要同步更新 FUFU 服務端；沒有完整 Google IAM、SDK／ADC 或自動擴縮相容保證。
+0.9.3 新增 gcloud 常用輸出投影、資源清單篩選／排序／limit、Cloud Run 設定與環境變數更新、Service Account 查詢／停用／啟用，以及 Pub/Sub attributes、分頁和 message ACK deadline。這些行為已用官方 gcloud、小用量真實 GCP 與隔離 Docker 驗收；不表示完整 Google IAM、SDK／ADC 或自動擴縮相容。新增後端能力需要同步更新 FUFU Console 和 compute worker。
 
 0.9.1 統一所有 CLI API 請求的 `User-Agent: fufu-cloud-cli`，涵蓋物件傳輸、
 Cloudflare 靜態檔案部署、IaC 遠端 state 與 Cloud Shell session，避免沿用
@@ -34,7 +34,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.9.2'
+pip install 'fufu-cloud-cli==0.9.3'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.3}/src/fufu_cloud_cli.egg-info/SOURCES.txt

@@ -13,6 +13,8 @@ src/fufu_cloud_cli/cloudflare.py
 src/fufu_cloud_cli/control.py
 src/fufu_cloud_cli/docker_backend.py
 src/fufu_cloud_cli/errors.py
+src/fufu_cloud_cli/gcloud_environment.py
+src/fufu_cloud_cli/gcloud_output.py
 src/fufu_cloud_cli/http_runtime.py
 src/fufu_cloud_cli/iac_state.py
 src/fufu_cloud_cli/lambda_adapter.py