fufu-cloud-cli 0.9.2__tar.gz → 0.9.4__tar.gz

{fufu_cloud_cli-0.9.2/src/fufu_cloud_cli.egg-info → fufu_cloud_cli-0.9.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fufu-cloud-cli
-Version: 0.9.2
+Version: 0.9.4
 Summary: FUFU Cloud CLI for tenant-scoped mock cloud development and deployment
 License-Expression: LicenseRef-Proprietary
 Requires-Python: >=3.10
@@ -22,7 +22,9 @@ Dynamic: license-file
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
-0.9.2 新增 `gcloud-fufu secrets versions describe`，以 metadata 權限查看版本狀態而不讀取秘密；GCP 秘密內容不可為空。配套後端依真實 GCP 驗證修正 Editor／Viewer 等角色的明列權限子集、Gen 1 HTTP invoker 與 Pub/Sub 的 0 秒預設 ack deadline。這些新能力需要同步更新 FUFU 服務端；沒有完整 Google IAM、SDK／ADC 或自動擴縮相容保證。
+0.9.4 新增 GCS generation／metageneration 條件、`storage objects describe/update/list`、8 KiB 自訂 metadata 與二進位 `cat`。競爭寫入、過期條件、CLI metadata 和官方 gcloud 輸出欄位已對照驗收；不相符條件回傳 `PRECONDITION_FAILED`／HTTP 412。新功能需要同步更新 FUFU Console、GCS 儲存映像和 Cloud Shell。儲存升級前須停寫並備份完整 volume；新 metadata 格式可讀舊資料，回滾須還原升級前備份。
+
+0.9.3 的常用輸出投影、清單篩選／排序／limit、Cloud Run 設定更新、Service Account 啟停及 Pub/Sub attributes／ACK deadline 持續保留。僅明列子集經過官方 gcloud、小用量真實 GCP 與隔離 Docker 驗收；不表示完整 Google IAM、SDK／ADC 或自動擴縮相容。
 
 0.9.1 統一所有 CLI API 請求的 `User-Agent: fufu-cloud-cli`，涵蓋物件傳輸、
 Cloudflare 靜態檔案部署、IaC 遠端 state 與 Cloud Shell session，避免沿用
@@ -34,7 +36,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.9.2'
+pip install 'fufu-cloud-cli==0.9.4'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main
@@ -205,7 +207,8 @@ CLI 無法判斷任意原始碼或 ZIP 內的資料是否可以分享。
 | Cloud Run | 已核准 HTTP 容器或 API 自動建置 Python ASGI 來源；支援配置後的 HTTPS 入口、Invoker policy；無 autoscaling、traffic splitting、Jobs |
 | Cloud Run functions / Functions Gen 1 | Python 3.12 HTTP 函式；Gen 1 為相同 HTTP runtime 的模擬子集，無背景事件 |
 | AWS Lambda | Python 3.10 / 3.12 ZIP、同步 invoke、程式碼更新、BUFFERED Function URL；ZIP 50 MiB／解壓 250 MiB，同步 payload 6 MiB |
-| GCS / S3 | bucket 與 object 子集；分段上傳／串流下載，受主機磁碟限制；已驗證超過 1 GiB，無 versioning / signed URL |
+| GCS | bucket／object 子集、分段上傳／串流下載／binary cat、generation／metageneration 條件、metadata describe/update、前綴分頁；8 KiB custom metadata；無 versioning、signed URL、bucket IAM、一般 SDK 或 GCS IaC 資源 |
+| S3 | bucket 與 object 子集；分段上傳／串流下載，受主機磁碟限制；已驗證超過 1 GiB，無 versioning / signed URL |
 | DynamoDB / SQS / SSM | 明列資料操作；無完整交易、Streams、FIFO 或 KMS / SecureString |
 | AWS IAM / GCP IAM | 租戶內 role / service account / policy 子集；default deny、限定 session；無原生雲端全量 IAM 語義 |
 | API Gateway / Serverless profile | 簡化 HTTP Lambda proxy 和明確來源清單；不執行 plugins / CloudFormation |

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.4}/README.md

@@ -4,7 +4,9 @@
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
-0.9.2 新增 `gcloud-fufu secrets versions describe`，以 metadata 權限查看版本狀態而不讀取秘密；GCP 秘密內容不可為空。配套後端依真實 GCP 驗證修正 Editor／Viewer 等角色的明列權限子集、Gen 1 HTTP invoker 與 Pub/Sub 的 0 秒預設 ack deadline。這些新能力需要同步更新 FUFU 服務端；沒有完整 Google IAM、SDK／ADC 或自動擴縮相容保證。
+0.9.4 新增 GCS generation／metageneration 條件、`storage objects describe/update/list`、8 KiB 自訂 metadata 與二進位 `cat`。競爭寫入、過期條件、CLI metadata 和官方 gcloud 輸出欄位已對照驗收；不相符條件回傳 `PRECONDITION_FAILED`／HTTP 412。新功能需要同步更新 FUFU Console、GCS 儲存映像和 Cloud Shell。儲存升級前須停寫並備份完整 volume；新 metadata 格式可讀舊資料，回滾須還原升級前備份。
+
+0.9.3 的常用輸出投影、清單篩選／排序／limit、Cloud Run 設定更新、Service Account 啟停及 Pub/Sub attributes／ACK deadline 持續保留。僅明列子集經過官方 gcloud、小用量真實 GCP 與隔離 Docker 驗收；不表示完整 Google IAM、SDK／ADC 或自動擴縮相容。
 
 0.9.1 統一所有 CLI API 請求的 `User-Agent: fufu-cloud-cli`，涵蓋物件傳輸、
 Cloudflare 靜態檔案部署、IaC 遠端 state 與 Cloud Shell session，避免沿用
@@ -16,7 +18,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.9.2'
+pip install 'fufu-cloud-cli==0.9.4'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main
@@ -187,7 +189,8 @@ CLI 無法判斷任意原始碼或 ZIP 內的資料是否可以分享。
 | Cloud Run | 已核准 HTTP 容器或 API 自動建置 Python ASGI 來源；支援配置後的 HTTPS 入口、Invoker policy；無 autoscaling、traffic splitting、Jobs |
 | Cloud Run functions / Functions Gen 1 | Python 3.12 HTTP 函式；Gen 1 為相同 HTTP runtime 的模擬子集，無背景事件 |
 | AWS Lambda | Python 3.10 / 3.12 ZIP、同步 invoke、程式碼更新、BUFFERED Function URL；ZIP 50 MiB／解壓 250 MiB，同步 payload 6 MiB |
-| GCS / S3 | bucket 與 object 子集；分段上傳／串流下載，受主機磁碟限制；已驗證超過 1 GiB，無 versioning / signed URL |
+| GCS | bucket／object 子集、分段上傳／串流下載／binary cat、generation／metageneration 條件、metadata describe/update、前綴分頁；8 KiB custom metadata；無 versioning、signed URL、bucket IAM、一般 SDK 或 GCS IaC 資源 |
+| S3 | bucket 與 object 子集；分段上傳／串流下載，受主機磁碟限制；已驗證超過 1 GiB，無 versioning / signed URL |
 | DynamoDB / SQS / SSM | 明列資料操作；無完整交易、Streams、FIFO 或 KMS / SecureString |
 | AWS IAM / GCP IAM | 租戶內 role / service account / policy 子集；default deny、限定 session；無原生雲端全量 IAM 語義 |
 | API Gateway / Serverless profile | 簡化 HTTP Lambda proxy 和明確來源清單；不執行 plugins / CloudFormation |

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fufu-cloud-cli"
-version = "0.9.2"
+version = "0.9.4"
 description = "FUFU Cloud CLI for tenant-scoped mock cloud development and deployment"
 readme = "README.md"
 requires-python = ">=3.10"

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.4}/src/fufu_cloud_cli/__init__.py

@@ -1,3 +1,3 @@
 """FUFU CLI 與本機部署工具；相容範圍見 capabilities.json。"""
 
-__version__ = "0.9.2"
+__version__ = "0.9.4"

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.4}/src/fufu_cloud_cli/api_backend.py

@@ -185,7 +185,7 @@ class ApiClient:
         except HTTPError as exc:
             status = exc.code
             exc.close()
-            codes = {401: "AUTHENTICATION_FAILED", 403: "ACCESS_DENIED", 404: "RESOURCE_NOT_FOUND", 409: "RESOURCE_CONFLICT", 410: "UPLOAD_EXPIRED", 413: "PAYLOAD_LIMIT", 429: "RATE_LIMITED", 507: "STORAGE_CAPACITY"}
+            codes = {401: "AUTHENTICATION_FAILED", 403: "ACCESS_DENIED", 404: "RESOURCE_NOT_FOUND", 409: "RESOURCE_CONFLICT", 410: "UPLOAD_EXPIRED", 412: "PRECONDITION_FAILED", 413: "PAYLOAD_LIMIT", 429: "RATE_LIMITED", 507: "STORAGE_CAPACITY"}
             if status == 507: raise FufuError('STORAGE_CAPACITY', 'FUFU 主機磁碟容量不足；這是目前可用空間的限制，並非雲端物件大小上限。') from None
             raise FufuError(codes.get(status, "API_REQUEST_FAILED"), f"FUFU API 拒絕請求（HTTP {status}）；未輸出憑證或原始回應。") from None
         except (URLError, TimeoutError, ConnectionError) as exc:
@@ -211,7 +211,8 @@ class ApiClient:
                 return json.loads(response.read(65537))
         except HTTPError as error:
             status = error.code; error.close()
-            raise FufuError('OBJECT_TRANSFER_FAILED', f'物件傳輸未完成（HTTP {status}）；未覆寫下載目的地。') from None
+            code = 'PRECONDITION_FAILED' if self.provider == 'gcp' and status == 412 else 'OBJECT_TRANSFER_FAILED'
+            raise FufuError(code, f'物件傳輸未完成（HTTP {status}）；未覆寫下載目的地。') from None
 
     def close(self):
         if self.token and self.owns_token:
@@ -243,6 +244,9 @@ def storage_path(value):
 
 
 def remote_command(provider, argv, Parser):
+    if provider == 'gcp' and argv[:1] == ['storage']:
+        from .gcs import command
+        return command(argv[1:], Parser)
     p = Parser(prog={"aws": "aws-fufu", "gcp": "gcloud-fufu", "azure": "az-fufu"}[provider],
                description="FUFU API 憑證與租戶資源操作子集；無原生雲端 IAM／部署相容承諾。")
     roots = p.add_subparsers(dest="service", required=True)

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.4}/src/fufu_cloud_cli/capabilities.json

@@ -188,16 +188,24 @@
       "operations": [
         "bucket-create-list-delete",
         "binary-object-upload-download-list-delete",
+        "generation-match-preconditions",
+        "metageneration-match-preconditions",
+        "metadata-describe-update-merge-delete",
+        "paginated-object-list",
+        "binary-cat",
         "UTF8-preview"
       ],
       "limitations": [
         "object-5TiB-policy-subject-to-host-disk-capacity",
         "chunked-upload-streaming-download",
+        "custom-metadata-8KiB",
         "filesystem-object-name-subset",
-        "preview-32KiB",
-        "first-100-objects",
+        "UI-preview-32KiB-CLI-cat-streams",
+        "requires-generation-metadata-storage-backend",
+        "single-writer-per-volume",
         "no-signed-URLs",
-        "no-versioning"
+        "no-versioning-retention-ACL-KMS",
+        "no-GCS-Terraform-or-Pulumi-resource-adapter"
       ]
     },
     "azure-catalog-api": {

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.4}/src/fufu_cloud_cli/cli.py

@@ -224,6 +224,7 @@ def fufu_command(argv):
 
 
 def gcloud_command(argv):
+    from .gcloud_environment import flags as environment_flags, change as environment_change
     p = Parser(prog="gcloud-fufu", description="支援 Cloud Run 單一容器與 Python HTTP function 子集。")
     roots = p.add_subparsers(dest="service", required=True)
     run_p = roots.add_parser("run")
@@ -239,6 +240,7 @@ def gcloud_command(argv):
     secrets = d.add_mutually_exclusive_group()
     secrets.add_argument('--set-secrets'); secrets.add_argument('--update-secrets'); secrets.add_argument('--clear-secrets', action='store_true')
     deployment_options(d)
+    environment_flags(d)
     deployment_flags(d); run_iam_flags(d)
     services = run_sub.add_parser("services").add_subparsers(dest="service_action", required=True)
     replace = services.add_parser("replace")
@@ -259,6 +261,7 @@ def gcloud_command(argv):
     generation_options(d)
     d.add_argument("--trigger-http", required=True, action="store_true")
     deployment_options(d)
+    environment_flags(d)
     deployment_flags(d)
     for action in ("describe", "delete", "call"):
         q = fn.add_parser(action)
@@ -284,6 +287,12 @@ def gcloud_command(argv):
         env = env_from_names(a.env)
         from .secrets import references
         secret_options = {}
+        mutation = environment_change(a)
+        if mutation:
+            require(api_selected(), 'API_BACKEND_REQUIRED', '原生環境更新旗標目前需要 FUFU API 模式。')
+            secret_options['environment_patch'] = mutation
+        elif not a.env and api_selected():
+            secret_options['environment_patch'] = {'replace': False, 'values': {}, 'remove': []}
         if a.set_secrets is not None or a.clear_secrets: secret_options['secret_references'] = references(a.set_secrets)
         if a.update_secrets is not None: secret_options['secret_updates'] = references(a.update_secrets)
         require(not secret_options or api_selected(), 'API_BACKEND_REQUIRED', 'Secret references 需要 FUFU API 模式。')
@@ -391,10 +400,34 @@ def aws_command(argv):
 
 
 def entry(provider, argv=None):
+    selected_keys = ['FUFU_SELECTED_REGION', 'FUFU_SELECTED_PROJECT', 'FUFU_ASSUME_ROLE']
+    original_environment = {key: os.environ.get(key) for key in selected_keys}
+    output_format = None; output_filter = None; output_sort = None; output_limit = None
+    def emit(value):
+        if provider == 'gcloud-fufu' and (output_format or output_filter or output_sort or output_limit is not None):
+            from .gcloud_output import native, render, select
+            shaped = native(value, argv)
+            if output_filter or output_sort or output_limit is not None:
+                shaped = select(shaped, output_filter, output_sort, output_limit)
+            sys.stdout.write(render(shaped, output_format or 'json'))
+        else: sys.stdout.write(json.dumps(value, ensure_ascii=False, sort_keys=True) + '\n')
     try:
         argv = sys.argv[1:] if argv is None else argv
         argv = list(argv)
         require(provider in {"fufu", "aws-fufu", "gcloud-fufu", "az-fufu", "wrangler-fufu"}, "UNSUPPORTED_CLI", "未知 CLI 入口。")
+        if argv == ['--version']:
+            sys.stdout.write(('fufu-cloud-cli ' if provider == 'gcloud-fufu' else '') + __version__ + '\n'); return
+        if provider == 'gcloud-fufu' and argv in [['--help'], ['-h']]:
+            p = Parser(prog='gcloud-fufu', description='GCP 開發環境的可執行子集；使用 FUFU credential，功能範圍請見 fufu capabilities。')
+            for flag, description in [('--format', 'json／yaml／value／table／csv；支援 dotted path 投影'),
+                                      ('--filter', 'list 的欄位比較與 AND／OR／NOT'), ('--sort-by', 'list 排序；~ 表示降序'),
+                                      ('--limit', '篩選排序後的 list 筆數'), ('--project', '必須符合 credential 的 project'),
+                                      ('--region', '必須符合 credential 的 region')]: p.add_argument(flag, help=description)
+            p.add_argument('--quiet', '-q', action='store_true', help='非互動執行')
+            p.add_argument('--version', action='store_true', help='CLI 版本')
+            groups = p.add_subparsers(title='服務')
+            for group in ['run', 'functions', 'iam', 'projects', 'pubsub', 'secrets', 'storage', 'auth']: groups.add_parser(group)
+            p.print_help(); return
         if provider == 'wrangler-fufu':
             from .cloudflare import command
             result = command(argv, Parser)
@@ -414,19 +447,40 @@ def entry(provider, argv=None):
             rest = []; i = 0
             while i < len(argv):
                 flag, _, inline = argv[i].partition('=')
-                if flag in {'--region', '--project', '--output', '--format', '--impersonate-service-account'}:
+                if flag in {'--region', '--project', '--output', '--format', '--impersonate-service-account', '--filter', '--sort-by'} or flag == '--limit' and provider == 'gcloud-fufu' and 'list' in argv:
                     value = inline if '=' in argv[i] else (argv[i + 1] if i + 1 < len(argv) else '')
                     i += 1 if '=' in argv[i] else 2
                     require(bool(value) and not value.startswith('--'), 'UNSUPPORTED_ARGUMENT', '全域旗標缺少值。')
                     if flag == '--impersonate-service-account':
                         require(provider == 'gcloud-fufu', 'UNSUPPORTED_ARGUMENT', '此旗標只適用於 gcloud-fufu。')
                         os.environ['FUFU_ASSUME_ROLE'] = value
-                    elif flag in {'--output', '--format'}: require(value == 'json', 'UNSUPPORTED_ARGUMENT', '目前輸出格式支援 json。')
+                    elif flag == '--format' and provider == 'gcloud-fufu':
+                        from .gcloud_output import format_spec
+                        format_spec(value); output_format = value
+                    elif flag in {'--filter', '--sort-by', '--limit'}:
+                        require(provider == 'gcloud-fufu' and 'list' in argv, 'UNSUPPORTED_ARGUMENT', '清單選取旗標只適用於 gcloud-fufu list。')
+                        from .gcloud_output import Filter, field
+                        if flag == '--filter': Filter(value); output_filter = value
+                        if flag == '--sort-by':
+                            for column in value.split(','):
+                                require(not field(column.lstrip('~'))[1], 'UNSUPPORTED_ARGUMENT', '排序轉換尚未支援。')
+                            output_sort = value
+                        if flag == '--limit':
+                            require(value.isdigit(), 'UNSUPPORTED_ARGUMENT', 'limit 必須為非負整數。'); output_limit = int(value)
+                    elif flag in {'--output', '--format'}: require(value == 'json', 'UNSUPPORTED_ARGUMENT', '此入口目前輸出格式支援 json。')
                     else: os.environ['FUFU_SELECTED_REGION' if flag == '--region' else 'FUFU_SELECTED_PROJECT'] = value
-                elif flag in {'--quiet', '--no-cli-pager'}:
+                elif flag in {'--quiet', '-q', '--no-cli-pager'}:
                     require('=' not in argv[i], 'UNSUPPORTED_ARGUMENT', '布林旗標不接受額外值。'); i += 1
                 else: rest.append(argv[i]); i += 1
             argv = rest
+            if provider == 'gcloud-fufu':
+                if output_filter or output_sort or output_limit is not None:
+                    list_commands = [('run', 'services', 'list'), ('functions', 'list'), ('iam', 'service-accounts', 'list'),
+                                     ('pubsub', 'topics', 'list'), ('pubsub', 'subscriptions', 'list'), ('secrets', 'list'),
+                                     ('secrets', 'versions', 'list'), ('storage', 'buckets', 'list'), ('storage', 'objects', 'list')]
+                    require(any(tuple(argv[:len(command)]) == command for command in list_commands), 'UNSUPPORTED_ARGUMENT', '清單選取旗標只適用於資源 list；未執行操作。')
+                if output_format and argv[:2] == ['functions', 'call']:
+                    require(output_format == 'json', 'UNSUPPORTED_FORMAT', 'Functions call 目前只支援 JSON 回應。')
         from . import public_access
         if provider == 'aws-fufu' and argv[:1] == ['secretsmanager'] or provider == 'gcloud-fufu' and argv[:1] == ['secrets']:
             from .secrets import command
@@ -487,6 +541,10 @@ def entry(provider, argv=None):
     except (OSError, ValueError, KeyError, TypeError) as exc:
         sys.stderr.write(json.dumps({"error": {"code": "LOCAL_OPERATION_FAILED", "message": "本機檔案或輸入操作失敗；未輸出原始設定。"}}, ensure_ascii=False) + "\n")
         raise SystemExit(1) from exc
+    finally:
+        for key, value in original_environment.items():
+            if value is None: os.environ.pop(key, None)
+            else: os.environ[key] = value
 
 
 def main():

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.4}/src/fufu_cloud_cli/control.py

@@ -134,16 +134,17 @@ def gcp_command(argv, Parser):
     c = sub.add_parser('create'); c.add_argument('name'); c.add_argument('--display-name'); c.add_argument('--description')
     c = sub.add_parser('update'); c.add_argument('email'); c.add_argument('--display-name'); c.add_argument('--description')
     sub.add_parser('delete').add_argument('email')
+    for action in ['describe', 'enable', 'disable']: sub.add_parser(action).add_argument('email')
     sub = roots.add_parser('projects').add_subparsers(dest='action', required=True)
     for act in ['get-iam-policy', 'add-iam-policy-binding', 'remove-iam-policy-binding']:
         q = sub.add_parser(act); q.add_argument('project')
         if act != 'get-iam-policy': q.add_argument('--member', required=True); q.add_argument('--role', required=True)
     a = p.parse_args(argv)
-    op = {'get-iam-policy': 'list', 'add-iam-policy-binding': 'add-binding', 'remove-iam-policy-binding': 'remove-binding'}.get(a.action, a.action)
+    op = {'describe': 'get', 'get-iam-policy': 'get-policy', 'add-iam-policy-binding': 'add-binding', 'remove-iam-policy-binding': 'remove-binding'}.get(a.action, a.action)
     params = {k: getattr(a, k) for k in ['name', 'email', 'project', 'member', 'role'] if hasattr(a, k)}
     if getattr(a, 'display_name', None) is not None: params['displayName'] = a.display_name
     if getattr(a, 'description', None) is not None: params['description'] = a.description
-    with ApiClient('gcp') as api: return api.request('POST', '/control/iam', {'operation': op, 'params': params})
+    with ApiClient('gcp', read_only=op in {'list', 'get', 'get-policy'}) as api: return api.request('POST', '/control/iam', {'operation': op, 'params': params})
 
 
 def gateway_command(argv, Parser):

fufu_cloud_cli-0.9.4/src/fufu_cloud_cli/gcloud_environment.py

@@ -0,0 +1,53 @@
+"""gcloud environment mutation syntax; values are never included in errors."""
+from pathlib import Path
+import yaml
+from .errors import require
+from .manifest import environment
+
+
+def dictionary(value):
+    delimiter = ','
+    if value.startswith('^'):
+        _, delimiter, value = value.split('^', 2) if value.count('^') >= 2 else ('', '', '')
+        require(bool(delimiter), 'INVALID_INPUT', '自訂 delimiter 格式為 ^DELIMITER^key=value。')
+    pairs = value.split(delimiter) if value else []
+    result = {}
+    for pair in pairs:
+        key, sep, val = pair.partition('=')
+        require(sep and key and key not in result, 'INVALID_INPUT', '請使用不重複的 key=value 配置。')
+        result[key] = val
+    return result
+
+
+def flags(parser):
+    group = parser.add_mutually_exclusive_group()
+    group.add_argument('--set-env-vars', action='append')
+    group.add_argument('--env-vars-file')
+    group.add_argument('--clear-env-vars', action='store_true')
+    parser.add_argument('--update-env-vars', action='append')
+    parser.add_argument('--remove-env-vars', action='append')
+
+
+def change(args):
+    replace = any((getattr(args, 'set_env_vars', None) is not None, getattr(args, 'env_vars_file', None), getattr(args, 'clear_env_vars', False)))
+    updates, removes = getattr(args, 'update_env_vars', None), getattr(args, 'remove_env_vars', None)
+    require(not replace or not (updates or removes), 'CONFLICTING_ARGUMENTS', '替換／清空環境變數不能與更新／移除並用。')
+    require(not getattr(args, 'env', None) or not (replace or updates or removes), 'CONFLICTING_ARGUMENTS', '--env 與原生環境旗標不可混用。')
+    values = {}
+    for item in getattr(args, 'set_env_vars', None) or updates or []: values.update(dictionary(item))
+    if getattr(args, 'env_vars_file', None):
+        file = Path(args.env_vars_file)
+        require(file.is_file() and not file.is_symlink() and file.stat().st_size <= 1024**2, 'INVALID_INPUT', '環境檔必須是不超過 1 MiB 的一般 YAML／JSON 檔。')
+        values = yaml.safe_load(file.read_text())
+    if replace or updates or removes:
+        names = [name for item in removes or [] for name in item.split(',')]
+        environment({name: '' for name in names})
+        return {'replace': replace, 'values': environment(values), 'remove': names}
+    return None
+
+
+def merge(current, mutation):
+    result = {} if mutation['replace'] else dict(current)
+    for name in mutation['remove']: result.pop(name, None)
+    result.update(mutation['values'])
+    return environment(result)

fufu_cloud_cli-0.9.4/src/fufu_cloud_cli/gcloud_output.py

@@ -0,0 +1,196 @@
+"""Explicit gcloud output and list-selection subset, without a Cloud SDK dependency."""
+import copy
+import csv
+import io
+import json
+import re
+
+import yaml
+
+from .errors import require
+
+
+def field(spec):
+    match = re.fullmatch(r'([A-Za-z_][\w-]*(?:\.[A-Za-z_][\w-]*|\[\d+\])*)(\.basename\(\))?(?::label=([A-Za-z_][\w -]*))?', spec)
+    require(match, 'UNSUPPORTED_FORMAT', '欄位支援 dotted path、數字索引、basename() 與 :label=；其他投影尚未支援。')
+    path, transform, label = match.groups()
+    parts = re.findall(r'[A-Za-z_][\w-]*|\d+', path)
+    return parts, bool(transform), label or parts[-1].upper()
+
+
+def lookup(value, parts):
+    for part in parts:
+        if isinstance(value, list) and part.isdigit(): value = value[int(part)] if int(part) < len(value) else None
+        elif isinstance(value, dict): value = value.get(part)
+        else: return None
+    return value
+
+
+def cell(value):
+    if value is None: return ''
+    if isinstance(value, (dict, list)): return json.dumps(value, ensure_ascii=False, sort_keys=True)
+    return str(value)
+
+
+def project(row, columns):
+    result = {}
+    for parts, transform, _ in columns:
+        require(not transform and not any(p.isdigit() for p in parts), 'UNSUPPORTED_FORMAT', 'JSON／YAML 投影目前支援物件欄位；轉換與索引請使用 value／table／csv。')
+        target = result
+        for p in parts[:-1]:
+            require(not p in target or isinstance(target[p], dict), 'UNSUPPORTED_FORMAT', '投影欄位彼此衝突。')
+            target = target.setdefault(p, {})
+        value = lookup(row, parts)
+        if value is not None: target[parts[-1]] = value
+    return result
+
+
+def format_spec(spec):
+    match = re.fullmatch(r'(json|yaml|value|table|csv)(\[no-heading\])?(?:\((.*)\))?', spec)
+    require(match, 'UNSUPPORTED_FORMAT', '支援 json、yaml、value(...)、table(...)、csv(...)；尚未支援的格式會明確拒絕。')
+    kind, no_heading, fields = match.groups()
+    columns = [field(s.strip()) for s in fields.split(',')] if fields else []
+    require(kind in {'json', 'yaml'} or columns, 'UNSUPPORTED_FORMAT', 'value／table／csv 請明列欄位。')
+    require(not no_heading or kind in {'table', 'csv'}, 'UNSUPPORTED_FORMAT', 'no-heading 只用於 table／csv。')
+    if kind in {'json', 'yaml'}: project({}, columns)
+    return kind, bool(no_heading), columns
+
+
+def render(value, spec):
+    kind, no_heading, columns = format_spec(spec)
+    rows = value if isinstance(value, list) else [value]
+    if kind in {'json', 'yaml'}:
+        projected = [project(row, columns) for row in rows] if columns else rows
+        if kind == 'json':
+            return json.dumps(projected if isinstance(value, list) else projected[0], ensure_ascii=False, sort_keys=True, indent=2) + '\n'
+        if isinstance(value, list):
+            return yaml.safe_dump_all(projected, allow_unicode=True, sort_keys=True, explicit_start=True) if projected else ''
+        return yaml.safe_dump(projected[0], allow_unicode=True, sort_keys=True)
+    data = []
+    for row in rows:
+        values = []
+        for parts, transform, _ in columns:
+            v = cell(lookup(row, parts))
+            values.append(v.rstrip('/').rsplit('/', 1)[-1] if transform else v)
+        data.append(values)
+    headers = [c[2] for c in columns]
+    if kind == 'value': return ''.join('\t'.join(row) + '\n' for row in data)
+    if not data: return ''
+    if kind == 'csv':
+        out = io.StringIO(); writer = csv.writer(out, lineterminator='\n')
+        if not no_heading: writer.writerow([h.lower() for h in headers])
+        writer.writerows(data); return out.getvalue()
+    table = data if no_heading else [headers, *data]
+    widths = [max(len(row[i]) for row in table) for i in range(len(columns))]
+    return ''.join('  '.join(v.ljust(widths[i]) for i, v in enumerate(row)).rstrip() + '\n' for row in table)
+
+
+class Filter:
+    """Bounded parser: no eval, shell execution or caller-controlled regular expressions."""
+    def __init__(self, expression):
+        require(len(expression) <= 4096, 'UNSUPPORTED_FILTER', 'Filter 長度上限為 4096。')
+        self.tokens = []; self.index = 0
+        pattern = re.compile(r'\s*(>=|<=|!=|[():=<>]|"(?:[^"\\]|\\.)*"|\x27(?:[^\x27\\]|\\.)*\x27|[^\s():=<>!]+)')
+        position = 0
+        while position < len(expression.rstrip()):
+            match = pattern.match(expression, position)
+            require(match, 'UNSUPPORTED_FILTER', 'Filter 語法尚未支援。')
+            self.tokens.append(match[1]); position = match.end()
+        require(len(self.tokens) <= 256, 'UNSUPPORTED_FILTER', 'Filter 條件過多。')
+        self.tree = self.group(0)
+        require(self.index == len(self.tokens), 'UNSUPPORTED_FILTER', 'Filter 必須以 AND／OR 連接條件；不支援的語法不會被忽略。')
+
+    def pop(self):
+        require(self.index < len(self.tokens), 'UNSUPPORTED_FILTER', 'Filter 不完整。')
+        v = self.tokens[self.index]; self.index += 1; return v
+
+    def peek(self): return self.tokens[self.index] if self.index < len(self.tokens) else None
+
+    def group(self, depth):
+        require(depth < 16, 'UNSUPPORTED_FILTER', 'Filter 巢狀層數過多。')
+        items = [self.term(depth)]; operator = None
+        while self.peek() in {'AND', 'OR'}:
+            op = self.pop()
+            require(operator is None or operator == op, 'UNSUPPORTED_FILTER', 'AND 與 OR 混用必須加括號。')
+            operator = op; items.append(self.term(depth))
+        return (operator or 'AND', items)
+
+    def term(self, depth):
+        require(depth < 16, 'UNSUPPORTED_FILTER', 'Filter 巢狀層數過多。')
+        if self.peek() == 'NOT': self.pop(); return ('NOT', self.term(depth + 1))
+        if self.peek() == '(':
+            self.pop(); result = self.group(depth + 1)
+            require(self.pop() == ')', 'UNSUPPORTED_FILTER', 'Filter 括號未配對。'); return result
+        parts, transform, _ = field(self.pop())
+        require(not transform, 'UNSUPPORTED_FILTER', 'Filter 轉換尚未支援。')
+        op, value = self.pop(), self.pop()
+        require(op in {'=', '!=', ':', '>', '<', '>=', '<='} and value not in {'(', ')', 'AND', 'OR'}, 'UNSUPPORTED_FILTER', '不支援此 Filter 運算子或值。')
+        if value.startswith(('"', "'")):
+            require('\\' not in value, 'UNSUPPORTED_FILTER', 'Filter 跳脫字元尚未支援。'); value = value[1:-1]
+        require('~' not in value and (not '*' in value or op == ':' and value.count('*') == 1), 'UNSUPPORTED_FILTER', '萬用字元目前僅支援 : 運算子的單一 *。')
+        return ('compare', parts, op, value)
+
+    def matches(self, row):
+        def compare(actual, op, expected):
+            if op == ':' and expected == '*': return actual is not None
+            if actual is None: return op == '!='
+            if isinstance(actual, list): return any(compare(v, op, expected) for v in actual)
+            left, right = cell(actual).casefold(), expected.casefold()
+            if op == ':':
+                if '*' in right:
+                    start, end = right.split('*'); return left.startswith(start) and left.endswith(end) and len(left) >= len(start) + len(end)
+                return right in left
+            try: left, right = float(left), float(right)
+            except ValueError: pass
+            if type(left) != type(right): return op == '!='
+            return {'=': lambda: left == right, '!=': lambda: left != right, '>': lambda: left > right,
+                    '<': lambda: left < right, '>=': lambda: left >= right, '<=': lambda: left <= right}[op]()
+        def visit(node):
+            if node[0] == 'NOT': return not visit(node[1])
+            if node[0] in {'AND', 'OR'}: return (all if node[0] == 'AND' else any)(visit(n) for n in node[1])
+            return compare(lookup(row, node[1]), node[2], node[3])
+        return visit(self.tree)
+
+
+def select(rows, expression=None, sort_by=None, limit=None):
+    require(isinstance(rows, list), 'UNSUPPORTED_ARGUMENT', 'Filter、排序與 limit 只適用於資源 list。')
+    result = list(rows)
+    if expression:
+        predicate = Filter(expression)
+        result = [row for row in result if predicate.matches(row)]
+    for spec in reversed(sort_by.split(',') if sort_by else []):
+        descending = spec.startswith('~'); parts, transform, _ = field(spec.lstrip('~'))
+        require(not transform, 'UNSUPPORTED_ARGUMENT', '排序請使用物件欄位。')
+        def key(row):
+            value = lookup(row, parts)
+            return (value is not None, 0 if isinstance(value, (int, float)) else 1, value if isinstance(value, (int, float)) else cell(value))
+        result.sort(key=key, reverse=descending)
+    return result[:limit] if limit is not None else result
+
+
+def native(value, argv):
+    """Shape only known resources; retain explicit FUFU metadata on individual records."""
+    if not isinstance(value, dict): return value
+    result = copy.deepcopy(value)
+    if tuple(argv[:3]) in {('pubsub', 'topics', 'create'), ('pubsub', 'subscriptions', 'create')}:
+        return [result]
+    if tuple(argv[:3]) == ('pubsub', 'subscriptions', 'pull'):
+        return result.get('receivedMessages', [])
+    if argv[:1] in [['run'], ['functions']] and 'kind' in result and 'name' in result:
+        run = result['kind'] == 'cloud-run-http'
+        url = result.get('publicAccess', {}).get('url')
+        if run:
+            result.update(apiVersion='serving.knative.dev/v1', kind='Service')
+            result['metadata'] = {'name': result['name']}
+            result['status'] = {'url': url} if url else {}
+        elif result['kind'] == 'cloud-run-functions-http':
+            result['serviceConfig'] = {'uri': url} if url else {}
+        else: result['httpsTrigger'] = {'url': url} if url else {}
+    lists = {('run', 'services', 'list'): 'services', ('functions', 'list'): 'services',
+             ('iam', 'service-accounts', 'list'): 'accounts', ('pubsub', 'topics', 'list'): 'topics',
+             ('pubsub', 'subscriptions', 'list'): 'subscriptions', ('secrets', 'list'): 'secrets',
+             ('secrets', 'versions', 'list'): 'versions', ('storage', 'buckets', 'list'): 'buckets'}
+    for prefix, key in lists.items():
+        if tuple(argv[:len(prefix)]) == prefix and key in result:
+            return [native(row, argv) for row in result[key]]
+    return result

fufu_cloud_cli-0.9.4/src/fufu_cloud_cli/gcs.py

@@ -0,0 +1,137 @@
+"""GCS CLI subset with atomic generation and metadata preconditions."""
+import mimetypes
+import re
+import sys
+import time
+from pathlib import Path
+from urllib.parse import quote, urlencode, urlsplit
+
+from .api_backend import ApiClient
+from .errors import require
+from .gcloud_environment import dictionary
+from .object_transfer import upload_file, download_file
+
+
+def location(value):
+    parsed = urlsplit(value)
+    require(parsed.scheme == 'gs' and parsed.netloc and not parsed.query and not parsed.username and not parsed.password,
+            'INVALID_RESOURCE', '請指定 gs://bucket/object。')
+    generation = parsed.fragment or None
+    if generation:
+        require(re.fullmatch(r'[1-9][0-9]{0,18}', generation) and int(generation) <= 2**63-1,
+                'INVALID_RESOURCE', '物件版本必須是正整數 generation。')
+    return parsed.netloc, parsed.path.removeprefix('/'), generation
+
+
+def conditions(args):
+    result = {}
+    for flag, field in [('if_generation_match', 'ifGenerationMatch'), ('if_metageneration_match', 'ifMetagenerationMatch')]:
+        raw = getattr(args, flag, None)
+        if raw is not None:
+            require(re.fullmatch(r'0|[1-9][0-9]{0,18}', raw) and int(raw) <= 2**63-1,
+                    'INVALID_INPUT', 'Generation 條件必須是非負的 64-bit 整數。')
+            result[field] = raw
+    return result
+
+
+def display(obj):
+    mapping = {'bucket': 'bucket', 'name': 'name', 'generation': 'generation', 'metageneration': 'metageneration', 'size': 'size',
+               'contentType': 'content_type', 'cacheControl': 'cache_control', 'contentDisposition': 'content_disposition',
+               'contentLanguage': 'content_language', 'contentEncoding': 'content_encoding', 'storageClass': 'storage_class',
+               'timeCreated': 'creation_time', 'timeStorageClassUpdated': 'storage_class_update_time', 'updated': 'update_time',
+               'crc32c': 'crc32c_hash', 'md5Hash': 'md5_hash', 'etag': 'etag', 'metadata': 'custom_fields'}
+    result = {target: obj[source] for source, target in mapping.items() if source in obj}
+    for field in ['size', 'metageneration']:
+        if field in result: result[field] = int(result[field])
+    result['storage_url'] = 'gs://' + obj['bucket'] + '/' + obj['name'] + '#' + obj['generation']
+    return result
+
+
+def pages(api, path, params=None):
+    params = dict(params or {}); rows, seen, deadline = [], set(), time.monotonic()+300
+    while True:
+        require(time.monotonic() < deadline, 'LIST_TIMEOUT', '清單超過五分鐘；請縮小物件前綴範圍。')
+        page = api.request('GET', path + '?' + urlencode(params))
+        rows.extend(page.get('items', [])); token = page.get('nextPageToken')
+        if not token: return rows
+        require(isinstance(token, str) and token not in seen, 'INVALID_PAGINATION', 'Storage 回傳重複分頁；未提供不完整清單。')
+        seen.add(token); params['pageToken'] = token
+
+
+def command(argv, Parser):
+    parser = Parser(prog='gcloud-fufu storage', description='GCS 物件與 generation 條件子集；不支援歷史版本保留、ACL、保留政策或 KMS。')
+    root = parser.add_subparsers(dest='action', required=True)
+    buckets = root.add_parser('buckets').add_subparsers(dest='verb', required=True)
+    buckets.add_parser('list')
+    for verb in ['create', 'delete']: buckets.add_parser(verb).add_argument('url')
+    objects = root.add_parser('objects').add_subparsers(dest='verb', required=True)
+    for verb in ['list', 'describe', 'update']:
+        p = objects.add_parser(verb); p.add_argument('url')
+        if verb in ['list', 'describe']: p.add_argument('--raw', action='store_true')
+        else:
+            for flag in ['content-type', 'cache-control', 'content-disposition', 'content-language', 'content-encoding',
+                         'update-custom-metadata', 'remove-custom-metadata', 'if-generation-match', 'if-metageneration-match']:
+                p.add_argument('--'+flag)
+            p.add_argument('--clear-custom-metadata', action='store_true')
+    root.add_parser('ls').add_argument('url')
+    for action in ['cp', 'rm', 'cat']:
+        p = root.add_parser(action)
+        if action == 'cp':
+            p.add_argument('source'); p.add_argument('destination'); p.add_argument('--content-type'); p.add_argument('--custom-metadata')
+        else: p.add_argument('url')
+        for flag in ['if-generation-match', 'if-metageneration-match']: p.add_argument('--'+flag)
+    args = parser.parse_args(argv); preconditions = conditions(args)
+    downloading = args.action == 'cp' and args.source.startswith('gs://')
+    readonly = args.action in ['ls', 'cat'] or downloading or getattr(args, 'verb', None) in ['list', 'describe']
+    with ApiClient('gcp', read_only=readonly) as api:
+        if args.action == 'buckets' and args.verb == 'list': return pages(api, '/storage/buckets')
+        url = args.source if downloading else args.destination if args.action == 'cp' else args.url
+        bucket, key, generation = location(url); path = '/storage/buckets/' + quote(bucket, safe='')
+        if generation:
+            require(args.action != 'cp' or downloading, 'INVALID_RESOURCE', '上傳目的地不能指定歷史 generation。')
+            preconditions['generation'] = generation
+        if args.action == 'buckets':
+            require(not key and not generation, 'INVALID_RESOURCE', 'Bucket 操作不接受物件路徑或版本。')
+            return api.request('POST', '/storage/buckets', {'name': bucket}) if args.verb == 'create' else api.request('DELETE', path)
+        if args.action == 'ls' or args.action == 'objects' and args.verb == 'list':
+            require(not generation, 'UNSUPPORTED_ARGUMENT', '清單不接受單一 generation。')
+            prefix = key[:-2] if key.endswith('**') else key
+            require(not any(c in prefix for c in '*?[]'), 'UNSUPPORTED_ARGUMENT', '目前清單支援 bucket、名稱前綴及結尾 **。')
+            rows = pages(api, path+'/objects', {'prefix': prefix})
+            return rows if getattr(args, 'raw', False) else [display(row) for row in rows]
+        if args.action == 'cp' and not downloading and (not key or key.endswith('/')): key += Path(args.source).name
+        require(bool(key), 'INVALID_RESOURCE', '請指定 object 名稱。')
+        target = path+'/metadata?'+urlencode({'name': key, **preconditions})
+        if args.action == 'objects':
+            if args.verb == 'describe':
+                obj = api.request('GET', target)
+                return obj if args.raw else display(obj)
+            body = {}
+            for flag, field in [('content_type', 'contentType'), ('cache_control', 'cacheControl'), ('content_disposition', 'contentDisposition'),
+                                ('content_language', 'contentLanguage'), ('content_encoding', 'contentEncoding')]:
+                if getattr(args, flag) is not None: body[field] = getattr(args, flag) or None
+            require(not args.clear_custom_metadata or not (args.update_custom_metadata or args.remove_custom_metadata),
+                    'CONFLICTING_ARGUMENTS', '清空自訂 metadata 不可與更新／移除並用。')
+            if args.clear_custom_metadata: body['metadata'] = None
+            elif args.update_custom_metadata is not None or args.remove_custom_metadata is not None:
+                values = {name: None for name in (args.remove_custom_metadata or '').split(',') if name}
+                values.update(dictionary(args.update_custom_metadata or '')); body['metadata'] = values
+            require(bool(body), 'INVALID_INPUT', '請指定至少一項 metadata 更新。')
+            return display(api.request('PATCH', target, body))
+        if args.action == 'rm': return api.request('DELETE', path+'/object?'+urlencode({'name': key, **preconditions}))
+        if args.action == 'cat':
+            deadline = time.monotonic()+3600
+            with api.binary('GET', '/objects/download?'+urlencode({'bucket': bucket, 'key': key, **preconditions})) as response:
+                while True:
+                    require(time.monotonic() < deadline, 'TRANSFER_TIMEOUT', 'Storage cat 超過一小時。')
+                    data = response.read(65536)
+                    if not data: break
+                    sys.stdout.buffer.write(data)
+            return 0
+        if downloading:
+            require(not args.destination.startswith('gs://') and args.content_type is None and args.custom_metadata is None,
+                    'UNSUPPORTED_ARGUMENT', '下載不接受上傳 metadata；目前支援本機與 GCS 之間傳輸。')
+            return download_file(api, args.destination, bucket, key, conditions=preconditions)
+        return upload_file(api, args.source, bucket, key, conditions=preconditions,
+                           content_type=args.content_type or mimetypes.guess_type(args.source)[0] or 'application/octet-stream',
+                           metadata=dictionary(args.custom_metadata) if args.custom_metadata is not None else None)

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.4}/src/fufu_cloud_cli/object_transfer.py

@@ -19,8 +19,9 @@ class FileRange:
         return data
 
 
-def upload(api, stream, size, bucket, key, *, content_type=None, metadata=None):
+def upload(api, stream, size, bucket, key, *, content_type=None, metadata=None, conditions=None):
     body = {'bucket': bucket, 'key': key, 'size': size}
+    if conditions: body.update(conditions)
     if content_type is not None: body['contentType'] = content_type
     if metadata is not None: body['metadata'] = metadata
     transfer = api.request('POST', '/objects/uploads', body)
@@ -52,13 +53,13 @@ def upload_file(api, filename, bucket, key, **options):
         return upload(api, stream, os.fstat(stream.fileno()).st_size, bucket, key, **options)
 
 
-def download_file(api, filename, bucket, key):
+def download_file(api, filename, bucket, key, *, conditions=None):
     path = Path(filename)
     if path.exists() or path.is_symlink() or not path.parent.is_dir():
         raise ValueError('Object download requires a new destination file')
     descriptor, temporary = tempfile.mkstemp(prefix='.fufu-download-', dir=path.parent)
     try:
-        with os.fdopen(descriptor, 'wb') as output, api.binary('GET', '/objects/download?'+urlencode({'bucket': bucket, 'key': key})) as response:
+        with os.fdopen(descriptor, 'wb') as output, api.binary('GET', '/objects/download?'+urlencode({'bucket': bucket, 'key': key, **(conditions or {})})) as response:
             expected, received, digest = int(response.headers['Content-Length']), 0, hashlib.sha256()
             deadline = time.monotonic()+3600
             while True:

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.4}/src/fufu_cloud_cli/public_access.py

@@ -98,6 +98,12 @@ def gcp_command(argv, Parser):
         p.set_defaults(gen2=True)
     if action == 'update':
         deployment_flags(p); run_iam_flags(p)
+        from .gcloud_environment import flags
+        from .cli import deployment_options
+        flags(p); deployment_options(p)
+        p.add_argument('--service-account')
+        secrets = p.add_mutually_exclusive_group()
+        secrets.add_argument('--set-secrets'); secrets.add_argument('--update-secrets'); secrets.add_argument('--clear-secrets', action='store_true')
     elif action in {'add-iam-policy-binding', 'remove-iam-policy-binding'}:
         p.add_argument('--member', required=True); p.add_argument('--role', required=True)
     elif action == 'set-iam-policy':
@@ -105,8 +111,22 @@ def gcp_command(argv, Parser):
     a = p.parse_args(args[1:])
     kind = 'cloud-run-http' if run else 'cloud-run-functions-http' if a.gen2 else 'cloud-functions-gen1-http'
     if action == 'update':
-        require(configuration(a, kind) or a.anonymous is not None, 'MISSING_CONFIGURATION', '至少提供一個存取設定旗標。')
-        return configure_gcp(a, kind, a.name)
+        from .gcloud_environment import change
+        from .cli import resource_options, env_from_names
+        from .remote_compute import RemoteBackend
+        from .secrets import references
+        mutation = change(a); body = {}
+        if mutation is not None: body['environment_patch'] = mutation
+        if a.env: body['env'] = env_from_names(a.env)
+        resources = resource_options(a, kind)
+        if resources: body['resources'] = resources
+        if a.service_account: body['role'] = a.service_account
+        if a.set_secrets is not None or a.clear_secrets: body['secret_references'] = references(a.set_secrets)
+        if a.update_secrets is not None: body['secret_updates'] = references(a.update_secrets)
+        require(configuration(a, kind) or a.anonymous is not None or body, 'MISSING_CONFIGURATION', '至少提供一個服務設定旗標。')
+        require(api_selected(), 'API_BACKEND_REQUIRED', '服務設定更新需要 FUFU API 模式。')
+        deployed = RemoteBackend(kind).configure(kind, a.name, body) if body else None
+        return configure_gcp(a, kind, a.name, deployed)
     path = access_path(kind, a.name)
     with ApiClient('gcp', read_only=action == 'get-iam-policy') as api:
         current = api.request('GET', path)

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.4}/src/fufu_cloud_cli/pubsub.py

@@ -1,8 +1,10 @@
 """gcloud Pub/Sub commands using the tenant API shared with Terraform."""
 import base64
 import re
+import time
 from .api_backend import ApiClient
 from .errors import require
+from .gcloud_environment import dictionary
 
 
 def command(argv, Parser):
@@ -13,17 +15,18 @@ def command(argv, Parser):
         for action in ['create', 'describe', 'update', 'delete', 'list']:
             q = actions.add_parser(action)
             if action != 'list': q.add_argument('name')
-            else: q.add_argument('--limit', type=int, default=100); q.add_argument('--page-token')
+            else: q.add_argument('--page-size', type=int, default=100); q.add_argument('--page-token')
             if action in {'create', 'update'}:
                 q.add_argument('--labels' if action == 'create' else '--update-labels', dest='labels')
                 if action == 'update': q.add_argument('--clear-labels', action='store_true')
                 if group == 'subscriptions': q.add_argument('--ack-deadline', type=int)
             if action == 'create' and group == 'subscriptions': q.add_argument('--topic', required=True)
         if group == 'topics':
-            q = actions.add_parser('publish'); q.add_argument('name'); q.add_argument('--message', required=True)
+            q = actions.add_parser('publish'); q.add_argument('name'); q.add_argument('--message'); q.add_argument('--attribute', action='append')
         else:
             q = actions.add_parser('pull'); q.add_argument('name'); q.add_argument('--limit', type=int, default=1); q.add_argument('--auto-ack', action='store_true')
             q = actions.add_parser('ack'); q.add_argument('name'); q.add_argument('--ack-ids', nargs='+', required=True)
+            q = actions.add_parser('modify-message-ack-deadline'); q.add_argument('name'); q.add_argument('--ack-ids', nargs='+', required=True); q.add_argument('--ack-deadline', type=int, required=True)
     a = p.parse_args(argv)
     with ApiClient('gcp', read_only=a.action in {'describe', 'list'}) as api:
         project = api.whoami()['projectId']
@@ -56,11 +59,33 @@ def command(argv, Parser):
             fields = [key for key in body if key != 'name']
             require(fields, 'INVALID_INPUT', 'update 需要 labels 或 ack-deadline。')
             return call('Update' + singular, {singular.lower(): body, 'updateMask': {'paths': fields}})
-        if a.action == 'list': return call('List' + singular + 's', {'pageSize': a.limit, **({'pageToken': a.page_token} if a.page_token else {})})
+        if a.action == 'list':
+            require(1 <= a.page_size <= 1000, 'INVALID_INPUT', 'page-size 必須介於 1–1000。')
+            rows, token, seen = [], a.page_token, set()
+            deadline = time.monotonic() + 60
+            for _ in range(1000):
+                require(time.monotonic() < deadline, 'PAGINATION_FAILED', '清單讀取超過 60 秒；未回傳不完整結果。')
+                result = call('List' + singular + 's', {'pageSize': a.page_size, **({'pageToken': token} if token else {})})
+                rows.extend(result.get(a.group, [])); token = result.get('nextPageToken')
+                if not token: return {a.group: rows}
+                require(token not in seen and len(rows) <= 100000, 'PAGINATION_FAILED', '清單分頁未前進或超過本次安全讀取範圍；未回傳不完整結果。')
+                seen.add(token)
+            require(False, 'PAGINATION_FAILED', '清單分頁超過本次安全讀取範圍；未回傳不完整結果。')
         if a.action in {'describe', 'delete'}: return call(('Get' if a.action == 'describe' else 'Delete') + singular, {singular.lower(): full})
-        if a.action == 'publish': return call('Publish', {'topic': full, 'messages': [{'data': base64.b64encode(a.message.encode()).decode()}]})
-        if a.action == 'ack': return call('Acknowledge', {'subscription': full, 'ackIds': a.ack_ids})
+        if a.action == 'publish':
+            attributes = {}
+            for value in a.attribute or []: attributes.update(dictionary(value))
+            require(a.message or attributes, 'INVALID_INPUT', 'Publish 需要非空 message 或 attribute。')
+            return call('Publish', {'topic': full, 'messages': [{'data': base64.b64encode((a.message or '').encode()).decode(), 'attributes': attributes}]})
+        if a.action in {'ack', 'modify-message-ack-deadline'}:
+            ids = [item for group in a.ack_ids for item in group.split(',')]
+            params = {'subscription': full, 'ackIds': ids}
+            if a.action == 'modify-message-ack-deadline':
+                require(0 <= a.ack_deadline <= 600, 'INVALID_INPUT', 'ack-deadline 必須介於 0–600；0 表示立即重新投遞。')
+                params['ackDeadlineSeconds'] = a.ack_deadline
+            return call('Acknowledge' if a.action == 'ack' else 'ModifyAckDeadline', params)
         result = call('Pull', {'subscription': full, 'maxMessages': a.limit})
         if a.auto_ack and result.get('receivedMessages'):
             call('Acknowledge', {'subscription': full, 'ackIds': [message['ackId'] for message in result['receivedMessages']]})
+            for message in result['receivedMessages']: message['ackStatus'] = 'SUCCESS'
         return result

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.4}/src/fufu_cloud_cli/remote_compute.py

@@ -114,7 +114,7 @@ class RemoteBackend:
 
     def deploy(self, *, kind, service, image=None, port=8080, env=None, startup_timeout=30,
                replace=True, require_existing=False, archive=None, runtime=None, handler=None, preserve_environment=False, role=None, resources=None,
-               secret_references=None, secret_updates=None):
+               secret_references=None, secret_updates=None, environment_patch=None):
         body = dict(kind=kind, name=service, port=port, env=env or {}, startup_timeout=startup_timeout,
                     replace=replace, require_existing=require_existing, preserve_environment=preserve_environment)
         if image is not None:
@@ -125,6 +125,7 @@ class RemoteBackend:
         if resources: body['resources'] = resources
         if secret_references is not None: body['secret_references'] = secret_references
         if secret_updates is not None: body['secret_updates'] = secret_updates
+        if environment_patch is not None: body['environment_patch'] = environment_patch
         with ApiClient(self.provider) as api:
             if archive is not None and len(archive) > 8*1024**2:
                 body['archive_ref'] = upload_archive(api, kind, service, archive, require_existing)
@@ -142,6 +143,10 @@ class RemoteBackend:
         with ApiClient(self.provider, read_only=True) as api:
             return api.request('GET', '/compute/services/' + segment(kind) + '/' + segment(service))
 
+    def configure(self, kind, service, body):
+        with ApiClient(self.provider) as api:
+            return self.wait(api, api.request('PATCH', '/compute/services/' + segment(kind) + '/' + segment(service) + '/configuration', body))
+
     def listing(self, kind):
         with ApiClient(self.provider, read_only=True) as api:
             return api.request('GET', '/compute/services?' + urlencode({'kind': kind}))['services']

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.4}/src/fufu_cloud_cli/terraform_bridge/google.py

@@ -15,7 +15,7 @@ def account(bridge, value):
     project = bridge.identities['gcp']['projectId']
     return {'name': 'projects/' + project + '/serviceAccounts/' + email, 'projectId': project, 'email': email,
             'uniqueId': value.get('uniqueId', str(int(hashlib.sha256(email.encode()).hexdigest()[:16], 16))),
-            'displayName': value['displayName'], 'description': value.get('description', ''), 'disabled': False}
+            'displayName': value['displayName'], 'description': value.get('description', ''), 'disabled': value.get('disabled', False)}
 
 
 def iam(bridge, method, path, body):
@@ -25,6 +25,10 @@ def iam(bridge, method, path, body):
     if project != '-': bridge.project(project)
     elif not email: raise FufuError('ACCESS_DENIED', '需要明確的 project。')
     if email: email = unquote(email)
+    if email and method == 'POST' and email.endswith((':enable', ':disable')):
+        email, action = email.rsplit(':', 1)
+        only(body, [], 'Service Account lifecycle')
+        bridge.iam(action, {'email': email}); return 200, {}, {}
     if method == 'POST' and not email:
         only(body, ['accountId', 'serviceAccount'], 'Service Account')
         options = only(body.get('serviceAccount', {}), ['displayName', 'description'], 'Service Account')

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.4/src/fufu_cloud_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fufu-cloud-cli
-Version: 0.9.2
+Version: 0.9.4
 Summary: FUFU Cloud CLI for tenant-scoped mock cloud development and deployment
 License-Expression: LicenseRef-Proprietary
 Requires-Python: >=3.10
@@ -22,7 +22,9 @@ Dynamic: license-file
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
-0.9.2 新增 `gcloud-fufu secrets versions describe`，以 metadata 權限查看版本狀態而不讀取秘密；GCP 秘密內容不可為空。配套後端依真實 GCP 驗證修正 Editor／Viewer 等角色的明列權限子集、Gen 1 HTTP invoker 與 Pub/Sub 的 0 秒預設 ack deadline。這些新能力需要同步更新 FUFU 服務端；沒有完整 Google IAM、SDK／ADC 或自動擴縮相容保證。
+0.9.4 新增 GCS generation／metageneration 條件、`storage objects describe/update/list`、8 KiB 自訂 metadata 與二進位 `cat`。競爭寫入、過期條件、CLI metadata 和官方 gcloud 輸出欄位已對照驗收；不相符條件回傳 `PRECONDITION_FAILED`／HTTP 412。新功能需要同步更新 FUFU Console、GCS 儲存映像和 Cloud Shell。儲存升級前須停寫並備份完整 volume；新 metadata 格式可讀舊資料，回滾須還原升級前備份。
+
+0.9.3 的常用輸出投影、清單篩選／排序／limit、Cloud Run 設定更新、Service Account 啟停及 Pub/Sub attributes／ACK deadline 持續保留。僅明列子集經過官方 gcloud、小用量真實 GCP 與隔離 Docker 驗收；不表示完整 Google IAM、SDK／ADC 或自動擴縮相容。
 
 0.9.1 統一所有 CLI API 請求的 `User-Agent: fufu-cloud-cli`，涵蓋物件傳輸、
 Cloudflare 靜態檔案部署、IaC 遠端 state 與 Cloud Shell session，避免沿用
@@ -34,7 +36,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.9.2'
+pip install 'fufu-cloud-cli==0.9.4'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main
@@ -205,7 +207,8 @@ CLI 無法判斷任意原始碼或 ZIP 內的資料是否可以分享。
 | Cloud Run | 已核准 HTTP 容器或 API 自動建置 Python ASGI 來源；支援配置後的 HTTPS 入口、Invoker policy；無 autoscaling、traffic splitting、Jobs |
 | Cloud Run functions / Functions Gen 1 | Python 3.12 HTTP 函式；Gen 1 為相同 HTTP runtime 的模擬子集，無背景事件 |
 | AWS Lambda | Python 3.10 / 3.12 ZIP、同步 invoke、程式碼更新、BUFFERED Function URL；ZIP 50 MiB／解壓 250 MiB，同步 payload 6 MiB |
-| GCS / S3 | bucket 與 object 子集；分段上傳／串流下載，受主機磁碟限制；已驗證超過 1 GiB，無 versioning / signed URL |
+| GCS | bucket／object 子集、分段上傳／串流下載／binary cat、generation／metageneration 條件、metadata describe/update、前綴分頁；8 KiB custom metadata；無 versioning、signed URL、bucket IAM、一般 SDK 或 GCS IaC 資源 |
+| S3 | bucket 與 object 子集；分段上傳／串流下載，受主機磁碟限制；已驗證超過 1 GiB，無 versioning / signed URL |
 | DynamoDB / SQS / SSM | 明列資料操作；無完整交易、Streams、FIFO 或 KMS / SecureString |
 | AWS IAM / GCP IAM | 租戶內 role / service account / policy 子集；default deny、限定 session；無原生雲端全量 IAM 語義 |
 | API Gateway / Serverless profile | 簡化 HTTP Lambda proxy 和明確來源清單；不執行 plugins / CloudFormation |

{fufu_cloud_cli-0.9.2 → fufu_cloud_cli-0.9.4}/src/fufu_cloud_cli.egg-info/SOURCES.txt

@@ -13,6 +13,9 @@ src/fufu_cloud_cli/cloudflare.py
 src/fufu_cloud_cli/control.py
 src/fufu_cloud_cli/docker_backend.py
 src/fufu_cloud_cli/errors.py
+src/fufu_cloud_cli/gcloud_environment.py
+src/fufu_cloud_cli/gcloud_output.py
+src/fufu_cloud_cli/gcs.py
 src/fufu_cloud_cli/http_runtime.py
 src/fufu_cloud_cli/iac_state.py
 src/fufu_cloud_cli/lambda_adapter.py