feat(credential): resolve the active app from the invocation context

Each lark-cli invocation can now carry its own app identity, so callers
bound to different apps no longer compete over a single stored default
profile.

cmd/bootstrap.go

@@ -6,14 +6,21 @@ package cmd
 import (
 	"errors"
 	"io"
+	"os"
+	"strings"
 
 	"github.com/larksuite/cli/internal/cmdutil"
+	"github.com/larksuite/cli/internal/envvars"
 	"github.com/spf13/pflag"
 )
 
 // BootstrapInvocationContext extracts global invocation options before
 // the real command tree is built, so provider-backed config resolution sees
 // the correct profile from the start.
+//
+// Profile resolution: --profile flag > CliRuntimeAppID env > "" (defers to
+// MultiAppConfig.CurrentApp). The env value flows through FindApp which
+// matches by Name first, then by AppId — so callers can pass either form.
 func BootstrapInvocationContext(args []string) (cmdutil.InvocationContext, error) {
 	var globals GlobalOptions
 
@@ -26,5 +33,9 @@ func BootstrapInvocationContext(args []string) (cmdutil.InvocationContext, error
 	if err := fs.Parse(args); err != nil && !errors.Is(err, pflag.ErrHelp) {
 		return cmdutil.InvocationContext{}, err
 	}
-	return cmdutil.InvocationContext{Profile: globals.Profile}, nil
+	profile := globals.Profile
+	if profile == "" {
+		profile = strings.TrimSpace(os.Getenv(envvars.CliRuntimeAppID))
+	}
+	return cmdutil.InvocationContext{Profile: profile}, nil
 }

cmd/bootstrap_test.go

@@ -3,7 +3,11 @@
 
 package cmd
 
-import "testing"
+import (
+	"testing"
+
+	"github.com/larksuite/cli/internal/envvars"
+)
 
 func TestBootstrapInvocationContext_ProfileFlag(t *testing.T) {
 	inv, err := BootstrapInvocationContext([]string{"--profile", "target", "auth", "status"})
@@ -70,3 +74,25 @@ func TestBootstrapInvocationContext_HelpWithProfile(t *testing.T) {
 		t.Fatalf("profile = %q, want %q", inv.Profile, "target")
 	}
 }
+
+func TestBootstrapInvocationContext_RuntimeAppIDEnv(t *testing.T) {
+	t.Setenv(envvars.CliRuntimeAppID, " env-app ")
+	inv, err := BootstrapInvocationContext([]string{"auth", "status"})
+	if err != nil {
+		t.Fatalf("BootstrapInvocationContext() error = %v", err)
+	}
+	if inv.Profile != "env-app" {
+		t.Fatalf("profile = %q, want %q (env value, trimmed)", inv.Profile, "env-app")
+	}
+}
+
+func TestBootstrapInvocationContext_ProfileFlagBeatsRuntimeAppIDEnv(t *testing.T) {
+	t.Setenv(envvars.CliRuntimeAppID, "env-app")
+	inv, err := BootstrapInvocationContext([]string{"--profile", "flag-app", "auth", "status"})
+	if err != nil {
+		t.Fatalf("BootstrapInvocationContext() error = %v", err)
+	}
+	if inv.Profile != "flag-app" {
+		t.Fatalf("profile = %q, want %q (--profile wins over env)", inv.Profile, "flag-app")
+	}
+}

cmd/config/bind.go

@@ -7,6 +7,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
+	"sort"
 	"strings"
 
 	"github.com/charmbracelet/huh"
@@ -55,6 +56,11 @@ type BindOptions struct {
 	// configBindRun; downstream branches read this instead of rechecking
 	// IOStreams.IsTerminal. Do not set from outside — it is overwritten.
 	IsTUI bool
+
+	// All binds every account exposed by the agent source as a multi-app
+	// config. Hidden flag, currently openclaw source only, mutually
+	// exclusive with --app-id.
+	All bool
 }
 
 // NewCmdConfigBind creates the config bind subcommand.
@@ -107,6 +113,8 @@ Interactive terminal use: run with no flags to enter the TUI form.`,
 	cmd.Flags().StringVar(&opts.Identity, "identity", "", "identity preset (bot-only|user-default); defaults to bot-only in flag mode (safer: no impersonation)")
 	cmd.Flags().BoolVar(&opts.Force, "force", false, "confirm a risky transition (currently: bot-only → user-default identity change in flag mode)")
 	cmd.Flags().StringVar(&opts.Lang, "lang", "", "language preference (e.g. zh or zh_cn)")
+	cmd.Flags().BoolVar(&opts.All, "all", false, "bind every account from the agent source as a multi-app config (currently openclaw source only)")
+	_ = cmd.Flags().MarkHidden("all")
 	cmdutil.SetRisk(cmd, "write")
 
 	return cmd
@@ -124,6 +132,10 @@ func configBindRun(opts *BindOptions) error {
 	// opts.IsTUI instead of re-checking IOStreams.IsTerminal.
 	opts.IsTUI = opts.Source == "" && opts.Factory.IOStreams.IsTerminal
 
+	if opts.All {
+		return configBindAllRun(opts)
+	}
+
 	source, err := finalizeSource(opts)
 	if err != nil {
 		return err
@@ -632,6 +644,15 @@ func validateBindFlags(opts *BindOptions) error {
 			return errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --identity %q; valid values: bot-only, user-default", opts.Identity).WithParam("--identity")
 		}
 	}
+	if opts.All {
+		if opts.AppID != "" {
+			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--all is mutually exclusive with --app-id").WithParam("--all")
+		}
+		src := strings.TrimSpace(strings.ToLower(opts.Source))
+		if src != "" && src != "openclaw" {
+			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--all only supports --source openclaw").WithParam("--all")
+		}
+	}
 	lang, err := cmdutil.ParseLangFlag(opts.Lang)
 	if err != nil {
 		return err
@@ -677,3 +698,173 @@ func tuiSelectIdentity(opts *BindOptions) (string, error) {
 	}
 	return value, nil
 }
+
+// configBindAllRun binds every account exposed by the agent source as a
+// multi-app config. Flag-mode only; bot-only identity by default;
+// silently overwrites prior bindings.
+func configBindAllRun(opts *BindOptions) error {
+	// --all is flag-mode only: resolve the source through the same flag/env
+	// reconciliation as a single bind (including the explicit-vs-detected
+	// mismatch guard), but never prompt.
+	opts.IsTUI = false
+	source, err := finalizeSource(opts)
+	if err != nil {
+		return err
+	}
+	if source != "openclaw" {
+		return errs.NewValidationError(errs.SubtypeInvalidArgument,
+			"--all only supports --source openclaw").WithParam("--all")
+	}
+	core.SetCurrentWorkspace(core.Workspace(source))
+	targetConfigPath := core.GetConfigPath()
+	previousConfigBytes, _ := vfs.ReadFile(targetConfigPath)
+
+	binder, err := newBinder(source, opts)
+	if err != nil {
+		return err
+	}
+	candidates, err := binder.ListCandidates()
+	if err != nil {
+		return err
+	}
+	if len(candidates) == 0 {
+		return errs.NewConfigError(errs.SubtypeNotConfigured,
+			"no Feishu accounts found in openclaw.json").
+			WithHint("configure channels.feishu.accounts first")
+	}
+
+	if opts.Identity == "" {
+		opts.Identity = "bot-only"
+	}
+	if err := warnIdentityEscalation(opts, previousConfigBytes); err != nil {
+		return err
+	}
+	noticeUserDefaultRisk(opts)
+	prior := priorLang(previousConfigBytes)
+
+	oc, ok := binder.(*openclawBinder)
+	if !ok {
+		return errs.NewInternalError(errs.SubtypeSDKError, "internal: --all requires openclawBinder, got %T", binder)
+	}
+	apps, err := oc.BuildAll()
+	if err != nil {
+		return err
+	}
+	for i := range apps {
+		applyPreferences(&apps[i], opts, prior)
+	}
+	sortAppsDefaultFirst(apps)
+	apps = dedupAndOrderApps(apps)
+
+	return commitMultiAppBinding(opts, apps, previousConfigBytes, source, targetConfigPath)
+}
+
+// sortAppsDefaultFirst orders the bound apps deterministically: the "default"
+// alias first, then named accounts alphabetically. Account enumeration
+// upstream follows Go map order, and CurrentApp is taken from the first
+// entry — without a stable order the selected default app would vary
+// between runs of the same bind.
+func sortAppsDefaultFirst(apps []core.AppConfig) {
+	sort.SliceStable(apps, func(i, j int) bool {
+		di, dj := strings.EqualFold(apps[i].Name, "default"), strings.EqualFold(apps[j].Name, "default")
+		if di != dj {
+			return di
+		}
+		return apps[i].Name < apps[j].Name
+	})
+}
+
+// dedupAndOrderApps collapses entries that share an AppId. Per OpenClaw
+// semantics, "default" is an implicit fallback alias that inherits the
+// top-level appId; when an explicit named account exposes the same appId,
+// "default" is redundant and discarded. Insertion order is preserved.
+func dedupAndOrderApps(apps []core.AppConfig) []core.AppConfig {
+	byID := make(map[string]int, len(apps))
+	out := make([]core.AppConfig, 0, len(apps))
+	for _, a := range apps {
+		if idx, seen := byID[a.AppId]; seen {
+			if strings.EqualFold(out[idx].Name, "default") && !strings.EqualFold(a.Name, "default") {
+				out[idx] = a
+			}
+			continue
+		}
+		byID[a.AppId] = len(out)
+		out = append(out, a)
+	}
+	return out
+}
+
+// commitMultiAppBinding writes a MultiAppConfig containing every bound
+// account. CurrentApp defaults to the first entry so existing single-app
+// callers keep their behaviour; callers select another profile with
+// --profile or LARKSUITE_CLI_RUNTIME_APP_ID.
+func commitMultiAppBinding(opts *BindOptions, apps []core.AppConfig, previousConfigBytes []byte, source, configPath string) error {
+	multi := &core.MultiAppConfig{
+		CurrentApp: apps[0].ProfileName(),
+		Apps:       apps,
+	}
+
+	if err := vfs.MkdirAll(core.GetConfigDir(), 0700); err != nil {
+		return errs.NewInternalError(errs.SubtypeFileIO, "failed to create workspace directory: %v", err).WithCause(err)
+	}
+	data, err := json.MarshalIndent(multi, "", "  ")
+	if err != nil {
+		return errs.NewInternalError(errs.SubtypeStorage, "failed to marshal config: %v", err).WithCause(err)
+	}
+	if err := validate.AtomicWrite(configPath, append(data, '\n'), 0600); err != nil {
+		return errs.NewInternalError(errs.SubtypeStorage, "failed to write config %s: %v", configPath, err).WithCause(err)
+	}
+
+	replaced := previousConfigBytes != nil
+	if replaced {
+		cleanupKeychainFromDataMulti(opts.Factory.Keychain, previousConfigBytes, apps)
+	}
+
+	appIDs := make([]string, len(apps))
+	for i := range apps {
+		appIDs[i] = apps[i].AppId
+	}
+
+	uiMsg := getBindMsg(opts.UILang)
+	display := sourceDisplayName(source)
+	fmt.Fprintln(opts.Factory.IOStreams.ErrOut,
+		fmt.Sprintf(uiMsg.BindSuccessHeader, display)+"\n"+
+			fmt.Sprintf("bound %d Feishu apps: %s", len(appIDs), strings.Join(appIDs, ", ")))
+
+	envelope := map[string]interface{}{
+		"ok":          true,
+		"workspace":   source,
+		"app_ids":     appIDs,
+		"config_path": configPath,
+		"replaced":    replaced,
+		"identity":    opts.Identity,
+		"all":         true,
+	}
+	resultJSON, _ := json.Marshal(envelope)
+	fmt.Fprintln(opts.Factory.IOStreams.Out, string(resultJSON))
+	return nil
+}
+
+// cleanupKeychainFromDataMulti is cleanupKeychainFromData with a keep set,
+// used when re-binding multiple apps in one pass.
+func cleanupKeychainFromDataMulti(kc keychain.KeychainAccess, data []byte, keep []core.AppConfig) {
+	var multi core.MultiAppConfig
+	if err := json.Unmarshal(data, &multi); err != nil {
+		return
+	}
+	keepIDs := make(map[string]struct{}, len(keep))
+	for i := range keep {
+		ref := keep[i].AppSecret.Ref
+		if ref != nil && ref.Source == "keychain" {
+			keepIDs[ref.ID] = struct{}{}
+		}
+	}
+	for _, app := range multi.Apps {
+		if app.AppSecret.Ref != nil && app.AppSecret.Ref.Source == "keychain" {
+			if _, ok := keepIDs[app.AppSecret.Ref.ID]; ok {
+				continue
+			}
+		}
+		core.RemoveSecretStore(app.AppSecret, kc)
+	}
+}

cmd/config/bind_test.go

@@ -1907,3 +1907,270 @@ func TestConfigBindRun_LangExplicit_PrintsConfirmation(t *testing.T) {
 		t.Errorf("stderr = %q, want it to contain confirmation %q", got, want)
 	}
 }
+
+// ── --all flag tests (hidden multi-account bind) ──
+
+func TestConfigBindCmd_AllFlagParsing(t *testing.T) {
+	f, _, _, _ := cmdutil.TestFactory(t, nil)
+
+	var gotOpts *BindOptions
+	cmd := NewCmdConfigBind(f, func(opts *BindOptions) error {
+		gotOpts = opts
+		return nil
+	})
+	cmd.SetArgs([]string{"--source", "openclaw", "--all"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !gotOpts.All {
+		t.Error("expected All=true")
+	}
+
+	// --all is hidden but still parseable.
+	flag := cmd.Flags().Lookup("all")
+	if flag == nil {
+		t.Fatal("--all flag must be registered")
+	}
+	if !flag.Hidden {
+		t.Error("--all must be hidden")
+	}
+}
+
+// requireAllValidationParam asserts err is a typed validation error of
+// subtype invalid_argument carrying the named param, locking the contract
+// beyond the prose message.
+func requireAllValidationParam(t *testing.T, err error, wantParam string) {
+	t.Helper()
+	var ve *errs.ValidationError
+	if !errors.As(err, &ve) {
+		t.Fatalf("expected *errs.ValidationError, got %T (%v)", err, err)
+	}
+	if ve.Category != errs.CategoryValidation || ve.Subtype != errs.SubtypeInvalidArgument {
+		t.Fatalf("expected validation/invalid_argument, got %s/%s", ve.Category, ve.Subtype)
+	}
+	if ve.Param != wantParam {
+		t.Fatalf("param = %q, want %q", ve.Param, wantParam)
+	}
+}
+
+func TestConfigBindRun_AllRejectsAppID(t *testing.T) {
+	f, _, _, _ := cmdutil.TestFactory(t, nil)
+	err := configBindRun(&BindOptions{
+		Factory: f,
+		Source:  "openclaw",
+		AppID:   "cli_x",
+		All:     true,
+	})
+	if err == nil {
+		t.Fatal("expected validation error")
+	}
+	if !strings.Contains(err.Error(), "--all is mutually exclusive with --app-id") {
+		t.Errorf("unexpected error: %v", err)
+	}
+	requireAllValidationParam(t, err, "--all")
+}
+
+func TestDedupAndOrderApps_NamedWinsOverDefault(t *testing.T) {
+	// OpenClaw semantics: "default" is an implicit fallback alias; when a
+	// named account exposes the same appId, default is dropped.
+	apps := []core.AppConfig{
+		{Name: "acct-a", AppId: "cli_main"},
+		{Name: "acct-b", AppId: "cli_product"},
+		{Name: "default", AppId: "cli_main"},
+	}
+	got := dedupAndOrderApps(apps)
+	if len(got) != 2 {
+		t.Fatalf("len=%d, want 2", len(got))
+	}
+	if got[0].Name != "acct-a" || got[0].AppId != "cli_main" {
+		t.Errorf("apps[0]=%+v, want acct-a cli_main", got[0])
+	}
+	if got[1].Name != "acct-b" {
+		t.Errorf("apps[1]=%+v, want acct-b", got[1])
+	}
+}
+
+func TestDedupAndOrderApps_DefaultFirstThenNamedOverwrites(t *testing.T) {
+	// default arrives before its named alias — named still wins.
+	apps := []core.AppConfig{
+		{Name: "default", AppId: "cli_main"},
+		{Name: "acct-a", AppId: "cli_main"},
+	}
+	got := dedupAndOrderApps(apps)
+	if len(got) != 1 {
+		t.Fatalf("len=%d, want 1", len(got))
+	}
+	if got[0].Name != "acct-a" {
+		t.Errorf("apps[0]=%+v, want acct-a", got[0])
+	}
+}
+
+func TestDedupAndOrderApps_NoDuplicatesPreservesOrder(t *testing.T) {
+	apps := []core.AppConfig{
+		{Name: "acct-a", AppId: "cli_main"},
+		{Name: "acct-b", AppId: "cli_product"},
+		{Name: "acct-c", AppId: "cli_extra"},
+	}
+	got := dedupAndOrderApps(apps)
+	if len(got) != 3 {
+		t.Fatalf("len=%d, want 3", len(got))
+	}
+	want := []string{"acct-a", "acct-b", "acct-c"}
+	for i := range got {
+		if got[i].Name != want[i] {
+			t.Errorf("apps[%d]=%q, want %q", i, got[i].Name, want[i])
+		}
+	}
+}
+
+func TestDedupAndOrderApps_DefaultAlreadyFirst(t *testing.T) {
+	apps := []core.AppConfig{
+		{Name: "default", AppId: "cli_main"},
+		{Name: "acct-b", AppId: "cli_product"},
+	}
+	got := dedupAndOrderApps(apps)
+	if len(got) != 2 || got[0].Name != "default" {
+		t.Fatalf("got %+v, want default first", got)
+	}
+}
+
+func TestConfigBindRun_AllRejectsNonOpenClawSource(t *testing.T) {
+	f, _, _, _ := cmdutil.TestFactory(t, nil)
+	err := configBindRun(&BindOptions{
+		Factory: f,
+		Source:  "hermes",
+		All:     true,
+	})
+	if err == nil {
+		t.Fatal("expected validation error")
+	}
+	if !strings.Contains(err.Error(), "--all only supports --source openclaw") {
+		t.Errorf("unexpected error: %v", err)
+	}
+	requireAllValidationParam(t, err, "--all")
+}
+
+func TestConfigBindRun_AllRejectsSourceEnvMismatch(t *testing.T) {
+	saveWorkspace(t)
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+	clearAgentEnv(t)
+	t.Setenv("HERMES_HOME", t.TempDir()) // env says hermes, flag says openclaw
+
+	f, _, _, _ := cmdutil.TestFactory(t, nil)
+	err := configBindRun(&BindOptions{Factory: f, Source: "openclaw", All: true})
+	if err == nil {
+		t.Fatal("expected source/env mismatch error")
+	}
+	if !strings.Contains(err.Error(), "does not match detected Agent environment") {
+		t.Errorf("unexpected error: %v", err)
+	}
+	requireAllValidationParam(t, err, "--source")
+}
+
+func TestConfigBindRun_AllBindsEveryAccount(t *testing.T) {
+	saveWorkspace(t)
+	configDir := t.TempDir()
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", configDir)
+	clearAgentEnv(t)
+
+	openclawHome := t.TempDir()
+	t.Setenv("OPENCLAW_HOME", openclawHome)
+	openclawDir := filepath.Join(openclawHome, ".openclaw")
+	if err := os.MkdirAll(openclawDir, 0700); err != nil {
+		t.Fatalf("mkdir: %v", err)
+	}
+	// Top-level credentials surface as a "default" candidate aliasing the
+	// "work" account; dedup must collapse them and keep the named entry.
+	cfg := `{"channels":{"feishu":{"appId":"cli_main","appSecret":"sec_main","domain":"feishu","accounts":{"work":{"appId":"cli_main","appSecret":"sec_main"},"personal":{"appId":"cli_personal","appSecret":"sec_personal"}}}}}`
+	if err := os.WriteFile(filepath.Join(openclawDir, "openclaw.json"), []byte(cfg), 0600); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+
+	f, stdout, _, _ := cmdutil.TestFactory(t, nil)
+	err := configBindRun(&BindOptions{Factory: f, All: true})
+	if err != nil {
+		t.Fatalf("expected success, got %v", err)
+	}
+
+	configPath := filepath.Join(configDir, "openclaw", "config.json")
+	assertEnvelope(t, stdout.Bytes(), map[string]any{
+		"ok":          true,
+		"workspace":   "openclaw",
+		"app_ids":     []any{"cli_main", "cli_personal"},
+		"config_path": configPath,
+		"replaced":    false,
+		"identity":    "bot-only",
+		"all":         true,
+	})
+
+	data, err := os.ReadFile(configPath)
+	if err != nil {
+		t.Fatalf("read written config: %v", err)
+	}
+	var multi core.MultiAppConfig
+	if err := json.Unmarshal(data, &multi); err != nil {
+		t.Fatalf("written config is not a MultiAppConfig: %v", err)
+	}
+	if len(multi.Apps) != 2 {
+		t.Fatalf("apps = %d, want 2", len(multi.Apps))
+	}
+	// The account aliased by top-level "default" stays first and becomes
+	// the initial CurrentApp.
+	if multi.CurrentApp != "work" {
+		t.Errorf("currentApp = %q, want %q", multi.CurrentApp, "work")
+	}
+	if multi.Apps[0].Name != "work" || multi.Apps[1].Name != "personal" {
+		t.Errorf("app order = [%q, %q], want [work, personal]", multi.Apps[0].Name, multi.Apps[1].Name)
+	}
+}
+
+func TestConfigBindRun_AllEscalationRequiresForce(t *testing.T) {
+	saveWorkspace(t)
+	configDir := t.TempDir()
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", configDir)
+	clearAgentEnv(t)
+
+	openclawHome := t.TempDir()
+	t.Setenv("OPENCLAW_HOME", openclawHome)
+	openclawDir := filepath.Join(openclawHome, ".openclaw")
+	if err := os.MkdirAll(openclawDir, 0700); err != nil {
+		t.Fatalf("mkdir: %v", err)
+	}
+	cfg := `{"channels":{"feishu":{"appId":"cli_main","appSecret":"sec_main","domain":"feishu"}}}`
+	if err := os.WriteFile(filepath.Join(openclawDir, "openclaw.json"), []byte(cfg), 0600); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+
+	// Pre-existing binding locked to bot-only.
+	ocDir := filepath.Join(configDir, "openclaw")
+	if err := os.MkdirAll(ocDir, 0700); err != nil {
+		t.Fatalf("mkdir: %v", err)
+	}
+	locked := `{"apps":[{"appId":"cli_old","strictMode":"bot"}]}`
+	if err := os.WriteFile(filepath.Join(ocDir, "config.json"), []byte(locked), 0600); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+
+	f, _, _, _ := cmdutil.TestFactory(t, nil)
+	err := configBindRun(&BindOptions{Factory: f, All: true, Identity: "user-default"})
+	if err == nil {
+		t.Fatal("expected confirmation-required error without --force")
+	}
+	var ce *errs.ConfirmationRequiredError
+	if !errors.As(err, &ce) {
+		t.Fatalf("expected *errs.ConfirmationRequiredError, got %T (%v)", err, err)
+	}
+
+	// Same escalation with --force proceeds.
+	f2, stdout, _, _ := cmdutil.TestFactory(t, nil)
+	if err := configBindRun(&BindOptions{Factory: f2, All: true, Identity: "user-default", Force: true}); err != nil {
+		t.Fatalf("expected --force to allow escalation, got %v", err)
+	}
+	envelope := map[string]any{}
+	if err := json.Unmarshal(stdout.Bytes(), &envelope); err != nil {
+		t.Fatalf("invalid JSON output: %v", err)
+	}
+	if envelope["replaced"] != true || envelope["identity"] != "user-default" {
+		t.Errorf("envelope = %v, want replaced=true identity=user-default", envelope)
+	}
+}

cmd/config/binder.go

@@ -172,40 +172,54 @@ func (b *openclawBinder) Build(appID string) (*core.AppConfig, error) {
 	if b.cfg == nil {
 		return nil, errs.NewInternalError(errs.SubtypeSDKError, "internal: Build called before ListCandidates")
 	}
-
-	var selected *binding.CandidateApp
 	for i := range b.rawApps {
 		if b.rawApps[i].AppID == appID {
-			selected = &b.rawApps[i]
-			break
+			return b.buildFromCandidate(&b.rawApps[i])
 		}
 	}
-	if selected == nil {
-		return nil, errs.NewInternalError(errs.SubtypeSDKError, "internal: appID %q not in candidates", appID)
-	}
+	return nil, errs.NewInternalError(errs.SubtypeSDKError, "internal: appID %q not in candidates", appID)
+}
 
-	if selected.AppSecret.IsZero() {
-		return nil, errs.NewConfigError(errs.SubtypeInvalidClient, "appSecret is empty for app %s in %s", selected.AppID, b.path).
+// BuildAll builds every candidate without appID lookup so duplicate-appID
+// entries (e.g. OpenClaw's "default" alias of a named account) keep their own
+// Label. --all callers must use this; Build(appID) collapses duplicates.
+func (b *openclawBinder) BuildAll() ([]core.AppConfig, error) {
+	if b.cfg == nil {
+		return nil, errs.NewInternalError(errs.SubtypeSDKError, "internal: BuildAll called before ListCandidates")
+	}
+	out := make([]core.AppConfig, 0, len(b.rawApps))
+	for i := range b.rawApps {
+		cfg, err := b.buildFromCandidate(&b.rawApps[i])
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, *cfg)
+	}
+	return out, nil
+}
+
+func (b *openclawBinder) buildFromCandidate(c *binding.CandidateApp) (*core.AppConfig, error) {
+	if c.AppSecret.IsZero() {
+		return nil, errs.NewConfigError(errs.SubtypeInvalidClient, "appSecret is empty for app %s in %s", c.AppID, b.path).
 			WithHint("configure channels.feishu.appSecret in openclaw.json")
 	}
-	secret, err := binding.ResolveSecretInput(selected.AppSecret, b.cfg.Secrets, os.Getenv)
+	secret, err := binding.ResolveSecretInput(c.AppSecret, b.cfg.Secrets, os.Getenv)
 	if err != nil {
-		return nil, errs.NewConfigError(errs.SubtypeInvalidClient, "failed to resolve appSecret for %s: %v", selected.AppID, err).
+		return nil, errs.NewConfigError(errs.SubtypeInvalidClient, "failed to resolve appSecret for %s: %v", c.AppID, err).
 			WithHint("check appSecret configuration in %s", b.path).
 			WithCause(err)
 	}
-
-	stored, err := core.ForStorage(selected.AppID, core.PlainSecret(secret), b.opts.Factory.Keychain)
+	stored, err := core.ForStorage(c.AppID, core.PlainSecret(secret), b.opts.Factory.Keychain)
 	if err != nil {
 		return nil, errs.NewInternalError(errs.SubtypeStorage, "keychain unavailable: %v", err).
 			WithHint("use file: reference in config to bypass keychain").
 			WithCause(err)
 	}
-
 	return &core.AppConfig{
-		AppId:     selected.AppID,
+		Name:      c.Label,
+		AppId:     c.AppID,
 		AppSecret: stored,
-		Brand:     core.LarkBrand(normalizeBrand(selected.Brand)),
+		Brand:     core.LarkBrand(normalizeBrand(c.Brand)),
 	}, nil
 }
 

cmd/event/format_helpers_test.go

@@ -143,6 +143,79 @@ func TestWriteStatusText_CoversAllStates(t *testing.T) {
 	}
 }
 
+func TestWriteStatusText_ShowsSubColumn(t *testing.T) {
+	var buf bytes.Buffer
+	writeStatusText(&buf, []appStatus{
+		{
+			AppID:     "cli_RUNNINGXXXXXXXXX",
+			State:     stateRunning,
+			PID:       1234,
+			UptimeSec: 60,
+			Active:    2,
+			Consumers: []protocol.ConsumerInfo{
+				{PID: 1001, EventKey: "mail.x", SubscriptionID: "mail.x:alice", Received: 5, Dropped: 0},
+				{PID: 1002, EventKey: "mail.x", SubscriptionID: "mail.x:bob", Received: 3, Dropped: 0},
+			},
+		},
+	})
+	out := buf.String()
+	if !strings.Contains(out, "SUB") {
+		t.Errorf("missing SUB column header: %s", out)
+	}
+	if !strings.Contains(out, "alice") {
+		t.Errorf("missing alice suffix in SUB column: %s", out)
+	}
+	if !strings.Contains(out, "bob") {
+		t.Errorf("missing bob suffix in SUB column: %s", out)
+	}
+}
+
+func TestWriteStatusText_LegacySubscriptionID_RendersDash(t *testing.T) {
+	var buf bytes.Buffer
+	writeStatusText(&buf, []appStatus{
+		{
+			AppID:     "cli_RUNNINGXXXXXXXXX",
+			State:     stateRunning,
+			PID:       1234,
+			UptimeSec: 60,
+			Active:    1,
+			Consumers: []protocol.ConsumerInfo{
+				{PID: 1001, EventKey: "im.x", SubscriptionID: "", Received: 5},
+			},
+		},
+	})
+	out := buf.String()
+	if !strings.Contains(out, "SUB") {
+		t.Errorf("missing SUB header: %s", out)
+	}
+	if !strings.Contains(out, "-") {
+		t.Errorf("missing dash placeholder for empty SubscriptionID: %s", out)
+	}
+}
+
+func TestWriteStatusText_EventKeyEqualSubscriptionID_RendersDash(t *testing.T) {
+	var buf bytes.Buffer
+	writeStatusText(&buf, []appStatus{
+		{
+			AppID:     "cli_RUNNINGXXXXXXXXX",
+			State:     stateRunning,
+			PID:       1234,
+			UptimeSec: 60,
+			Active:    1,
+			Consumers: []protocol.ConsumerInfo{
+				{PID: 1001, EventKey: "im.x", SubscriptionID: "im.x", Received: 5},
+			},
+		},
+	})
+	out := buf.String()
+	if !strings.Contains(out, "SUB") {
+		t.Errorf("missing SUB header: %s", out)
+	}
+	if !strings.Contains(out, "-") {
+		t.Errorf("missing dash placeholder when SubscriptionID==EventKey: %s", out)
+	}
+}
+
 func TestWriteStatusJSON_OrphanHint(t *testing.T) {
 	var buf bytes.Buffer
 	if err := writeStatusJSON(&buf, []appStatus{

cmd/event/schema.go

@@ -134,12 +134,16 @@ func runSchema(f *cmdutil.Factory, key string, asJSON bool) error {
 	if len(def.Params) > 0 {
 		fmt.Fprintf(out, "\nParameters:\n")
 		w := tabwriter.NewWriter(out, 0, 4, 2, ' ', 0)
-		fmt.Fprintf(w, "  NAME\tTYPE\tREQUIRED\tDEFAULT\tDESCRIPTION\n")
+		fmt.Fprintf(w, "  NAME\tTYPE\tREQUIRED\tSUB-KEY\tDEFAULT\tDESCRIPTION\n")
 		for _, p := range def.Params {
 			required := "no"
 			if p.Required {
 				required = "yes"
 			}
+			subKey := "no"
+			if p.SubscriptionKey {
+				subKey = "yes"
+			}
 			defaultVal := p.Default
 			if defaultVal == "" {
 				defaultVal = "-"
@@ -148,7 +152,7 @@ func runSchema(f *cmdutil.Factory, key string, asJSON bool) error {
 			if desc == "" {
 				desc = "-"
 			}
-			fmt.Fprintf(w, "  %s\t%s\t%s\t%s\t%s\n", p.Name, p.Type, required, defaultVal, desc)
+			fmt.Fprintf(w, "  %s\t%s\t%s\t%s\t%s\t%s\n", p.Name, p.Type, required, subKey, defaultVal, desc)
 		}
 		w.Flush()
 

cmd/event/schema_test.go

@@ -96,6 +96,79 @@ func TestRunSchema_JSONOutput(t *testing.T) {
 	}
 }
 
+func TestSchema_RendersSubscriptionKeyMarker(t *testing.T) {
+	const syntheticKey = "test.evt_sub"
+	t.Cleanup(func() { eventlib.UnregisterKeyForTest(syntheticKey) })
+
+	eventlib.RegisterKey(eventlib.KeyDefinition{
+		Key:       syntheticKey,
+		EventType: syntheticKey,
+		Params: []eventlib.ParamDef{
+			{Name: "mailbox", SubscriptionKey: true, Description: "subscription id source"},
+			{Name: "folders", Description: "filter only"},
+		},
+		Schema: eventlib.SchemaDef{Native: &eventlib.SchemaSpec{Type: reflect.TypeOf(struct{ X string }{})}},
+	})
+
+	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
+	if err := runSchema(f, syntheticKey, false); err != nil {
+		t.Fatalf("runSchema: %v", err)
+	}
+
+	out := stdout.String()
+	if !strings.Contains(out, "SUB-KEY") {
+		t.Errorf("missing SUB-KEY column header in:\n%s", out)
+	}
+
+	// Find the mailbox row and verify "yes" is present
+	var mailboxRow string
+	for _, ln := range strings.Split(out, "\n") {
+		if strings.Contains(ln, "mailbox") && !strings.Contains(ln, "NAME") {
+			mailboxRow = ln
+			break
+		}
+	}
+	if !strings.Contains(mailboxRow, "yes") {
+		t.Errorf("mailbox row missing yes SUB-KEY marker: %q", mailboxRow)
+	}
+
+	// Find the folders row and verify "no" is present
+	var foldersRow string
+	for _, ln := range strings.Split(out, "\n") {
+		if strings.Contains(ln, "folders") && !strings.Contains(ln, "NAME") {
+			foldersRow = ln
+			break
+		}
+	}
+	if !strings.Contains(foldersRow, "no") {
+		t.Errorf("folders row missing no SUB-KEY marker: %q", foldersRow)
+	}
+}
+
+func TestSchema_JSON_IncludesSubscriptionKey(t *testing.T) {
+	const syntheticKey = "test.evt_json"
+	t.Cleanup(func() { eventlib.UnregisterKeyForTest(syntheticKey) })
+
+	eventlib.RegisterKey(eventlib.KeyDefinition{
+		Key:       syntheticKey,
+		EventType: syntheticKey,
+		Params:    []eventlib.ParamDef{{Name: "mailbox", SubscriptionKey: true}},
+		Schema:    eventlib.SchemaDef{Native: &eventlib.SchemaSpec{Type: reflect.TypeOf(struct{ X string }{})}},
+	})
+
+	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
+	if err := runSchema(f, syntheticKey, true); err != nil {
+		t.Fatalf("runSchema json: %v", err)
+	}
+
+	if !strings.Contains(stdout.String(), `"subscription_key"`) {
+		t.Errorf("JSON output missing subscription_key field: %s", stdout.String())
+	}
+	if !strings.Contains(stdout.String(), `true`) {
+		t.Errorf("JSON output missing subscription_key: true value: %s", stdout.String())
+	}
+}
+
 func TestResolveSchemaJSON_CustomWithOverlay(t *testing.T) {
 	const syntheticKey = "t.custom.overlay"
 	t.Cleanup(func() { eventlib.UnregisterKeyForTest(syntheticKey) })

cmd/event/status.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"sort"
+	"strings"
 	"sync"
 	"time"
 
@@ -242,12 +243,17 @@ func writeStatusText(out io.Writer, statuses []appStatus) {
 				s.PID, (time.Duration(s.UptimeSec) * time.Second).String())
 			fmt.Fprintf(out, "  Active consumers: %d\n", s.Active)
 			if len(s.Consumers) > 0 {
-				headers := []string{"CONSUMER", "EVENT KEY", "RECEIVED", "DROPPED"}
+				headers := []string{"CONSUMER", "EVENT KEY", "SUB", "RECEIVED", "DROPPED"}
 				rows := make([][]string, 0, len(s.Consumers))
 				for _, c := range s.Consumers {
+					subDisplay := "-"
+					if c.SubscriptionID != "" && c.SubscriptionID != c.EventKey {
+						subDisplay = strings.TrimPrefix(c.SubscriptionID, c.EventKey+":")
+					}
 					rows = append(rows, []string{
 						fmt.Sprintf("pid=%d", c.PID),
 						c.EventKey,
+						subDisplay,
 						fmt.Sprintf("%d", c.Received),
 						fmt.Sprintf("%d", c.Dropped),
 					})

events/minutes/preconsume.go

@@ -13,8 +13,8 @@ import (
 
 const cleanupTimeout = 5 * time.Second
 
-func subscriptionPreConsume(eventType, subscribePath, unsubscribePath string) func(context.Context, event.APIClient, map[string]string) (func(), error) {
-	return func(ctx context.Context, rt event.APIClient, _ map[string]string) (func(), error) {
+func subscriptionPreConsume(eventType, subscribePath, unsubscribePath string) func(context.Context, event.APIClient, map[string]string) (func() error, error) {
+	return func(ctx context.Context, rt event.APIClient, _ map[string]string) (func() error, error) {
 		if rt == nil {
 			return nil, errs.NewInternalError(errs.SubtypeUnknown,
 				"runtime API client is required for pre-consume subscription")
@@ -25,10 +25,13 @@ func subscriptionPreConsume(eventType, subscribePath, unsubscribePath string) fu
 			return nil, err
 		}
 
-		return func() {
+		return func() error {
 			cleanupCtx, cancel := context.WithTimeout(context.Background(), cleanupTimeout)
 			defer cancel()
-			_, _ = rt.CallAPI(cleanupCtx, "POST", unsubscribePath, body)
+			if _, err := rt.CallAPI(cleanupCtx, "POST", unsubscribePath, body); err != nil {
+				return err
+			}
+			return nil
 		}, nil
 	}
 }

events/vc/preconsume.go

@@ -13,8 +13,8 @@ import (
 
 const cleanupTimeout = 5 * time.Second
 
-func subscriptionPreConsume(eventType, subscribePath, unsubscribePath string) func(context.Context, event.APIClient, map[string]string) (func(), error) {
-	return func(ctx context.Context, rt event.APIClient, _ map[string]string) (func(), error) {
+func subscriptionPreConsume(eventType, subscribePath, unsubscribePath string) func(context.Context, event.APIClient, map[string]string) (func() error, error) {
+	return func(ctx context.Context, rt event.APIClient, _ map[string]string) (func() error, error) {
 		if rt == nil {
 			return nil, errs.NewInternalError(errs.SubtypeUnknown,
 				"runtime API client is required for pre-consume subscription")
@@ -25,10 +25,13 @@ func subscriptionPreConsume(eventType, subscribePath, unsubscribePath string) fu
 			return nil, err
 		}
 
-		return func() {
+		return func() error {
 			cleanupCtx, cancel := context.WithTimeout(context.Background(), cleanupTimeout)
 			defer cancel()
-			_, _ = rt.CallAPI(cleanupCtx, "POST", unsubscribePath, body)
+			if _, err := rt.CallAPI(cleanupCtx, "POST", unsubscribePath, body); err != nil {
+				return err
+			}
+			return nil
 		}, nil
 	}
 }

events/whiteboard/preconsume.go

@@ -22,8 +22,8 @@ const cleanupTimeout = 5 * time.Second
 //
 // board.whiteboard.updated_v1 is subscribed per-whiteboard (by whiteboard_id),
 // so the path contains a :whiteboard_id placeholder that must be supplied via params.
-func whiteboardSubscriptionPreConsume(eventType string) func(context.Context, event.APIClient, map[string]string) (func(), error) {
-	return func(ctx context.Context, rt event.APIClient, params map[string]string) (func(), error) {
+func whiteboardSubscriptionPreConsume(eventType string) func(context.Context, event.APIClient, map[string]string) (func() error, error) {
+	return func(ctx context.Context, rt event.APIClient, params map[string]string) (func() error, error) {
 		if rt == nil {
 			return nil, errs.NewInternalError(errs.SubtypeUnknown,
 				"runtime API client is required for pre-consume subscription")
@@ -44,10 +44,13 @@ func whiteboardSubscriptionPreConsume(eventType string) func(context.Context, ev
 			return nil, err
 		}
 
-		return func() {
+		return func() error {
 			cleanupCtx, cancel := context.WithTimeout(context.Background(), cleanupTimeout)
 			defer cancel()
-			_, _ = rt.CallAPI(cleanupCtx, "POST", unsubscribePath, body)
+			if _, err := rt.CallAPI(cleanupCtx, "POST", unsubscribePath, body); err != nil {
+				return err
+			}
+			return nil
 		}, nil
 	}
 }

internal/cmdutil/iostreams.go

@@ -18,26 +18,17 @@ type IOStreams struct {
 	Out        io.Writer
 	ErrOut     io.Writer
 	IsTerminal bool
-	// ErrIsTerminal reports whether ErrOut is an interactive terminal. Use it to
-	// gate stderr-only animations (spinners) so pipes / CI / captured stderr stay
-	// clean. Derived from ErrOut's underlying *os.File; non-file writers → false.
-	ErrIsTerminal bool
 }
 
 // NewIOStreams builds an IOStreams from arbitrary readers/writers.
 // IsTerminal is derived from in's underlying *os.File, if any; non-file
 // readers (bytes.Buffer, strings.Reader, …) yield IsTerminal=false.
-// ErrIsTerminal is derived the same way from errOut.
 func NewIOStreams(in io.Reader, out, errOut io.Writer) *IOStreams {
 	isTerminal := false
 	if f, ok := in.(*os.File); ok {
 		isTerminal = term.IsTerminal(int(f.Fd()))
 	}
-	errIsTerminal := false
-	if f, ok := errOut.(*os.File); ok {
-		errIsTerminal = term.IsTerminal(int(f.Fd()))
-	}
-	return &IOStreams{In: in, Out: out, ErrOut: errOut, IsTerminal: isTerminal, ErrIsTerminal: errIsTerminal}
+	return &IOStreams{In: in, Out: out, ErrOut: errOut, IsTerminal: isTerminal}
 }
 
 // SystemIO creates an IOStreams wired to the process's standard file descriptors.
@@ -66,7 +57,6 @@ func normalizeStreams(s *IOStreams) *IOStreams {
 		}
 		if out.ErrOut == nil {
 			out.ErrOut = sys.ErrOut
-			out.ErrIsTerminal = sys.ErrIsTerminal
 		}
 	}
 	return &out

internal/credential/default_provider.go

@@ -68,6 +68,8 @@ func (p *DefaultAccountProvider) ResolveAccount(ctx context.Context) (*Account,
 		return nil, core.NotConfiguredError()
 	}
 
+	// p.profile already incorporates --profile / CliRuntimeAppID precedence
+	// (resolved in cmd/bootstrap.go before Factory construction).
 	cfg, err := core.ResolveConfigFromMulti(multi, p.keychain(), p.profile)
 	if err != nil {
 		return nil, err

internal/envvars/envvars.go

@@ -4,8 +4,11 @@
 package envvars
 
 const (
-	CliAppID             = "LARKSUITE_CLI_APP_ID"
-	CliAppSecret         = "LARKSUITE_CLI_APP_SECRET"
+	CliAppID     = "LARKSUITE_CLI_APP_ID"
+	CliAppSecret = "LARKSUITE_CLI_APP_SECRET"
+	// CliRuntimeAppID pins a profile by appId when --profile is unset.
+	// Selector only; credentials still come from config.json / keychain.
+	CliRuntimeAppID      = "LARKSUITE_CLI_RUNTIME_APP_ID"
 	CliBrand             = "LARKSUITE_CLI_BRAND"
 	CliUserAccessToken   = "LARKSUITE_CLI_USER_ACCESS_TOKEN"
 	CliTenantAccessToken = "LARKSUITE_CLI_TENANT_ACCESS_TOKEN"

internal/event/bus/bus.go

@@ -262,19 +262,23 @@ func (b *Bus) handleConn(conn net.Conn) {
 
 // handleHello registers a consume connection with the hub; reader carries bytes already pulled off conn.
 func (b *Bus) handleHello(conn net.Conn, reader *bufio.Reader, hello *protocol.Hello) {
-	bc := NewConn(conn, reader, hello.EventKey, hello.EventTypes, hello.PID)
+	subID := hello.SubscriptionID
+	if subID == "" {
+		subID = hello.EventKey
+	}
+	bc := NewConn(conn, reader, hello.EventKey, hello.EventTypes, hello.PID, subID)
 	bc.SetLogger(b.logger)
 
 	// Register + isFirst under one lock; blocks on any in-progress cleanup lock for the same EventKey.
 	firstForKey := b.hub.RegisterAndIsFirst(bc)
 
-	bc.SetCheckLastForKey(func(eventKey string) bool {
-		return b.hub.AcquireCleanupLock(eventKey)
+	bc.SetCheckLastForKey(func(scope string) bool {
+		return b.hub.AcquireCleanupLock(scope)
 	})
 	bc.SetOnClose(func(c *Conn) {
 		b.hub.UnregisterAndIsLast(c)
 		// Release is idempotent and must fire on every disconnect path so waiters don't block forever.
-		b.hub.ReleaseCleanupLock(c.EventKey())
+		b.hub.ReleaseCleanupLock(c.SubscriptionID())
 		b.mu.Lock()
 		delete(b.conns, c)
 		remaining := len(b.conns)

internal/event/bus/bus_shutdown_test.go

@@ -33,7 +33,7 @@ func TestRunShutdownWithMultipleConns(t *testing.T) {
 		server, client := net.Pipe()
 		pipes = append(pipes, server, client)
 
-		bc := NewConn(server, nil, "im.msg", []string{"im.message.receive_v1"}, 1000+i)
+		bc := NewConn(server, nil, "im.msg", []string{"im.message.receive_v1"}, 1000+i, "")
 		bc.SetLogger(logger)
 		hub.RegisterAndIsFirst(bc)
 

internal/event/bus/conn.go

@@ -29,9 +29,10 @@ type Conn struct {
 	writeMu         sync.Mutex // serialises all net.Conn writes (Encode+SetWriteDeadline is a 2-call sequence)
 	eventKey        string
 	eventTypes      []string
+	subID           string
 	pid             int
 	onClose         func(*Conn)
-	checkLastForKey func(eventKey string) bool
+	checkLastForKey func(scope string) bool
 	logger          *log.Logger
 	closed          chan struct{}
 	closeOnce       sync.Once
@@ -41,7 +42,7 @@ type Conn struct {
 }
 
 // NewConn creates a Conn; pass a reader with pre-buffered bytes (handoff from Bus.handleConn) or nil for a fresh one.
-func NewConn(conn net.Conn, reader *bufio.Reader, eventKey string, eventTypes []string, pid int) *Conn {
+func NewConn(conn net.Conn, reader *bufio.Reader, eventKey string, eventTypes []string, pid int, subID string) *Conn {
 	if reader == nil {
 		reader = bufio.NewReader(conn)
 	}
@@ -52,10 +53,20 @@ func NewConn(conn net.Conn, reader *bufio.Reader, eventKey string, eventTypes []
 		eventKey:   eventKey,
 		eventTypes: eventTypes,
 		pid:        pid,
+		subID:      subID,
 		closed:     make(chan struct{}),
 	}
 }
 
+// SubscriptionID returns the subscription identity. Falls back to EventKey
+// when the stored subID is empty (legacy clients / no-SubscriptionKey EventKeys).
+func (c *Conn) SubscriptionID() string {
+	if c.subID == "" {
+		return c.eventKey
+	}
+	return c.subID
+}
+
 func (c *Conn) SetOnClose(fn func(*Conn)) { c.onClose = fn }
 
 // SetCheckLastForKey: returning true means "you are the last subscriber, run cleanup".
@@ -132,13 +143,19 @@ func (c *Conn) ReaderLoop() {
 }
 
 func (c *Conn) handleControlMessage(msg interface{}) {
-	switch m := msg.(type) {
+	switch msg.(type) {
 	case *protocol.Bye:
 		c.shutdown()
 	case *protocol.PreShutdownCheck:
+		// Use the connection's own authoritative subscription identity rather
+		// than recomputing from the incoming message: a stale or mismatched
+		// PreShutdownCheck must not ask about the wrong scope (which would
+		// suppress or mistrigger per-subscription cleanup). Conn.SubscriptionID()
+		// already falls back to EventKey when its stored subID is empty.
+		scope := c.SubscriptionID()
 		lastForKey := true
 		if c.checkLastForKey != nil {
-			lastForKey = c.checkLastForKey(m.EventKey)
+			lastForKey = c.checkLastForKey(scope)
 		}
 		ack := protocol.NewPreShutdownAck(lastForKey)
 		if err := c.writeFrame(ack); err != nil && c.logger != nil {

internal/event/bus/conn_test.go

@@ -21,7 +21,7 @@ func TestConn_SenderWritesEvents(t *testing.T) {
 	defer server.Close()
 	defer client.Close()
 
-	bc := NewConn(server, nil, "im.msg", []string{"im.message.receive_v1"}, 12345)
+	bc := NewConn(server, nil, "im.msg", []string{"im.message.receive_v1"}, 12345, "")
 	go bc.SenderLoop()
 
 	bc.SendCh() <- &protocol.Event{
@@ -62,7 +62,7 @@ func TestConn_ConcurrentWritesSerialised(t *testing.T) {
 	defer client.Close()
 
 	det := &serializingDetector{Conn: server}
-	bc := NewConn(det, nil, "im.msg", []string{"im.msg"}, 12345)
+	bc := NewConn(det, nil, "im.msg", []string{"im.msg"}, 12345, "")
 
 	go func() { _, _ = io.Copy(io.Discard, client) }()
 
@@ -106,7 +106,7 @@ func TestConn_TrySend_NonEvicting(t *testing.T) {
 	server, client := net.Pipe()
 	defer server.Close()
 	defer client.Close()
-	bc := NewConn(server, nil, "im.msg", []string{"im.msg"}, 12345)
+	bc := NewConn(server, nil, "im.msg", []string{"im.msg"}, 12345, "")
 
 	for i := 0; i < sendChCap; i++ {
 		if !bc.TrySend(i) {
@@ -126,7 +126,7 @@ func TestConn_ReaderDetectsEOF(t *testing.T) {
 	server, client := net.Pipe()
 	defer server.Close()
 
-	bc := NewConn(server, nil, "im.msg", []string{"im.msg"}, 12345)
+	bc := NewConn(server, nil, "im.msg", []string{"im.msg"}, 12345, "")
 
 	done := make(chan struct{})
 	go func() {
@@ -142,3 +142,23 @@ func TestConn_ReaderDetectsEOF(t *testing.T) {
 		t.Fatal("ReaderLoop did not exit on EOF")
 	}
 }
+
+func TestConn_SubscriptionID(t *testing.T) {
+	c1, c2 := net.Pipe()
+	defer c1.Close()
+	defer c2.Close()
+	conn := NewConn(c1, nil, "mail.x", []string{"mail.x"}, 999, "mail.x:abc")
+	if got := conn.SubscriptionID(); got != "mail.x:abc" {
+		t.Errorf("SubscriptionID() = %q, want %q", got, "mail.x:abc")
+	}
+}
+
+func TestConn_SubscriptionID_EmptyFallsBackToEventKey(t *testing.T) {
+	c1, c2 := net.Pipe()
+	defer c1.Close()
+	defer c2.Close()
+	conn := NewConn(c1, nil, "mail.x", []string{"mail.x"}, 999, "")
+	if got := conn.SubscriptionID(); got != "mail.x" {
+		t.Errorf("SubscriptionID() with empty input = %q, want fallback %q", got, "mail.x")
+	}
+}

internal/event/bus/handle_hello_test.go

@@ -63,3 +63,134 @@ func TestHandleHello_HelloAckWriteFailureUnregisters(t *testing.T) {
 		t.Errorf("b.conns after failed HelloAck = %d entries, want 0", remaining)
 	}
 }
+
+// TestHandleHello_LegacyClient_FallsBackToEventKey: a Hello with empty
+// subscription_id registers under EventKey (today's behavior preserved).
+func TestHandleHello_LegacyClient_FallsBackToEventKey(t *testing.T) {
+	logger := log.New(io.Discard, "", 0)
+	hub := NewHub()
+	b := &Bus{
+		hub:        hub,
+		logger:     logger,
+		conns:      make(map[*Conn]struct{}),
+		idleTimer:  time.NewTimer(30 * time.Second),
+		shutdownCh: make(chan struct{}, 1),
+	}
+
+	server, client := net.Pipe()
+	defer server.Close()
+	defer client.Close()
+
+	// Legacy client: no subscription_id field (empty string).
+	hello := &protocol.Hello{
+		PID:            9999,
+		EventKey:       "im.message",
+		EventTypes:     []string{"im.message.receive_v1"},
+		SubscriptionID: "", // legacy: empty, should fallback to EventKey
+	}
+
+	br := bufio.NewReader(server)
+
+	done := make(chan struct{})
+	go func() {
+		b.handleHello(server, br, hello)
+		close(done)
+	}()
+
+	// Read the HelloAck from client side to let handleHello complete.
+	clientReader := bufio.NewReader(client)
+	ackLine, err := clientReader.ReadString('\n')
+	if err != nil {
+		t.Fatalf("failed to read HelloAck: %v", err)
+	}
+
+	select {
+	case <-done:
+	case <-time.After(3 * time.Second):
+		t.Fatal("handleHello did not return within 3s")
+	}
+
+	// Assertions: registered under EventKey (not a qualified subscription ID).
+	if got := hub.ConnCount(); got != 1 {
+		t.Errorf("hub.ConnCount = %d, want 1", got)
+	}
+	if got := hub.EventKeyCount("im.message"); got != 1 {
+		t.Errorf("hub.EventKeyCount(im.message) = %d, want 1", got)
+	}
+	if got := hub.SubCount("im.message"); got != 1 {
+		t.Errorf("hub.SubCount(im.message) = %d, want 1 (legacy fallback to EventKey)", got)
+	}
+	if got := hub.SubCount("im.message:something"); got != 0 {
+		t.Errorf("hub.SubCount(im.message:something) = %d, want 0 (should not exist)", got)
+	}
+
+	if ackLine == "" {
+		t.Fatal("HelloAck was empty")
+	}
+}
+
+// TestHandleHello_ModernClient_UsesSubscriptionID: a Hello with
+// non-empty subscription_id registers under that ID, not EventKey.
+func TestHandleHello_ModernClient_UsesSubscriptionID(t *testing.T) {
+	logger := log.New(io.Discard, "", 0)
+	hub := NewHub()
+	b := &Bus{
+		hub:        hub,
+		logger:     logger,
+		conns:      make(map[*Conn]struct{}),
+		idleTimer:  time.NewTimer(30 * time.Second),
+		shutdownCh: make(chan struct{}, 1),
+	}
+
+	server, client := net.Pipe()
+	defer server.Close()
+	defer client.Close()
+
+	// Modern client: subscription_id explicitly set.
+	subscriptionID := "mail.message:alice@example.com"
+	hello := &protocol.Hello{
+		PID:            8888,
+		EventKey:       "mail.message",
+		EventTypes:     []string{"mail.message.receive_v1"},
+		SubscriptionID: subscriptionID, // modern: per-resource subscription
+	}
+
+	br := bufio.NewReader(server)
+
+	done := make(chan struct{})
+	go func() {
+		b.handleHello(server, br, hello)
+		close(done)
+	}()
+
+	// Read the HelloAck from client side to let handleHello complete.
+	clientReader := bufio.NewReader(client)
+	ackLine, err := clientReader.ReadString('\n')
+	if err != nil {
+		t.Fatalf("failed to read HelloAck: %v", err)
+	}
+
+	select {
+	case <-done:
+	case <-time.After(3 * time.Second):
+		t.Fatal("handleHello did not return within 3s")
+	}
+
+	// Assertions: registered under the subscription_id, not bare EventKey.
+	if got := hub.ConnCount(); got != 1 {
+		t.Errorf("hub.ConnCount = %d, want 1", got)
+	}
+	if got := hub.EventKeyCount("mail.message"); got != 1 {
+		t.Errorf("hub.EventKeyCount(mail.message) = %d, want 1", got)
+	}
+	if got := hub.SubCount(subscriptionID); got != 1 {
+		t.Errorf("hub.SubCount(%q) = %d, want 1 (modern: uses SubscriptionID)", subscriptionID, got)
+	}
+	if got := hub.SubCount("mail.message"); got != 0 {
+		t.Errorf("hub.SubCount(mail.message) = %d, want 0 (modern: NOT registered under bare EventKey)", got)
+	}
+
+	if ackLine == "" {
+		t.Fatal("HelloAck was empty")
+	}
+}

internal/event/bus/hub.go

@@ -16,6 +16,9 @@ import (
 // Subscriber is the interface a connection must satisfy for Hub registration.
 type Subscriber interface {
 	EventKey() string
+	// SubscriptionID identifies the per-resource subscription for dedup purposes.
+	// When no resource qualifier is needed it equals EventKey.
+	SubscriptionID() string
 	EventTypes() []string
 	SendCh() chan interface{}
 	PID() int
@@ -34,8 +37,11 @@ type Subscriber interface {
 type Hub struct {
 	mu          sync.RWMutex
 	subscribers map[Subscriber]struct{}
-	keyCounts   map[string]int
-	// cleanupInProgress[key] holds a channel closed on release; presence means a cleanup lock is held.
+	// subCounts is keyed by SubscriptionID (not EventKey) so that different
+	// per-resource subscriptions sharing the same EventKey are deduped independently.
+	subCounts map[string]int
+	// cleanupInProgress[subscriptionID] holds a channel closed on release;
+	// presence means a cleanup lock is held for that subscription.
 	cleanupInProgress map[string]chan struct{}
 	logger            atomic.Pointer[log.Logger]
 }
@@ -43,7 +49,7 @@ type Hub struct {
 func NewHub() *Hub {
 	return &Hub{
 		subscribers:       make(map[Subscriber]struct{}),
-		keyCounts:         make(map[string]int),
+		subCounts:         make(map[string]int),
 		cleanupInProgress: make(map[string]chan struct{}),
 	}
 }
@@ -51,7 +57,7 @@ func NewHub() *Hub {
 // SetLogger attaches a logger (nil tolerated).
 func (h *Hub) SetLogger(l *log.Logger) { h.logger.Store(l) }
 
-// UnregisterAndIsLast removes s and reports whether it was last for its EventKey; stale unregisters are no-ops.
+// UnregisterAndIsLast removes s and reports whether it was last for its SubscriptionID; stale unregisters are no-ops.
 func (h *Hub) UnregisterAndIsLast(s Subscriber) bool {
 	h.mu.Lock()
 	defer h.mu.Unlock()
@@ -59,34 +65,35 @@ func (h *Hub) UnregisterAndIsLast(s Subscriber) bool {
 		return false
 	}
 	delete(h.subscribers, s)
-	h.keyCounts[s.EventKey()]--
-	isLast := h.keyCounts[s.EventKey()] == 0
+	sid := s.SubscriptionID()
+	h.subCounts[sid]--
+	isLast := h.subCounts[sid] == 0
 	if isLast {
-		delete(h.keyCounts, s.EventKey())
+		delete(h.subCounts, sid)
 	}
 	return isLast
 }
 
-// AcquireCleanupLock reserves cleanup rights iff exactly one subscriber exists for eventKey and no lock is held.
+// AcquireCleanupLock reserves cleanup rights iff exactly one subscriber exists for subscriptionID and no lock is held.
 // Count==0 is rejected (would block future Register calls). On true return, caller MUST Release.
-func (h *Hub) AcquireCleanupLock(eventKey string) bool {
+func (h *Hub) AcquireCleanupLock(subscriptionID string) bool {
 	h.mu.Lock()
 	defer h.mu.Unlock()
-	if h.keyCounts[eventKey] != 1 {
+	if h.subCounts[subscriptionID] != 1 {
 		return false
 	}
-	if _, alreadyLocked := h.cleanupInProgress[eventKey]; alreadyLocked {
+	if _, alreadyLocked := h.cleanupInProgress[subscriptionID]; alreadyLocked {
 		return false
 	}
-	h.cleanupInProgress[eventKey] = make(chan struct{})
+	h.cleanupInProgress[subscriptionID] = make(chan struct{})
 	return true
 }
 
 // ReleaseCleanupLock is idempotent; OnClose calls unconditionally.
-func (h *Hub) ReleaseCleanupLock(eventKey string) {
+func (h *Hub) ReleaseCleanupLock(subscriptionID string) {
 	h.mu.Lock()
-	ch := h.cleanupInProgress[eventKey]
-	delete(h.cleanupInProgress, eventKey)
+	ch := h.cleanupInProgress[subscriptionID]
+	delete(h.cleanupInProgress, subscriptionID)
 	h.mu.Unlock()
 	if ch != nil {
 		close(ch)
@@ -94,23 +101,24 @@ func (h *Hub) ReleaseCleanupLock(eventKey string) {
 }
 
 // RegisterAndIsFirst adds s to the hub and reports whether it's the first
-// subscriber for its EventKey. If a cleanup is in progress for
-// s.EventKey() (another conn holds the cleanup lock), this waits until
+// subscriber for its SubscriptionID. If a cleanup is in progress for
+// s.SubscriptionID() (another conn holds the cleanup lock), this waits until
 // cleanup releases before registering — closing the PreShutdownCheck ×
 // Hello TOCTOU race. The wait releases h.mu before blocking on the
-// channel, so concurrent operations on other keys aren't stalled.
+// channel, so concurrent operations on other subscriptions aren't stalled.
 func (h *Hub) RegisterAndIsFirst(s Subscriber) bool {
+	sid := s.SubscriptionID()
 	for {
 		h.mu.Lock()
-		ch, locked := h.cleanupInProgress[s.EventKey()]
+		ch, locked := h.cleanupInProgress[sid]
 		if locked {
 			h.mu.Unlock()
 			<-ch // wait for release, then re-check (defensive against races)
 			continue
 		}
-		isFirst := h.keyCounts[s.EventKey()] == 0
+		isFirst := h.subCounts[sid] == 0
 		h.subscribers[s] = struct{}{}
-		h.keyCounts[s.EventKey()]++
+		h.subCounts[sid]++
 		h.mu.Unlock()
 		return isFirst
 	}
@@ -176,11 +184,25 @@ func (h *Hub) ConnCount() int {
 	return len(h.subscribers)
 }
 
-// EventKeyCount returns the number of subscribers registered for eventKey.
+// EventKeyCount returns total subscribers for the given EventKey, aggregating
+// across all SubscriptionIDs. For per-subscription counts use SubCount.
 func (h *Hub) EventKeyCount(eventKey string) int {
 	h.mu.RLock()
 	defer h.mu.RUnlock()
-	return h.keyCounts[eventKey]
+	count := 0
+	for s := range h.subscribers {
+		if s.EventKey() == eventKey {
+			count++
+		}
+	}
+	return count
+}
+
+// SubCount returns the count of subscribers for the given SubscriptionID.
+func (h *Hub) SubCount(subscriptionID string) int {
+	h.mu.RLock()
+	defer h.mu.RUnlock()
+	return h.subCounts[subscriptionID]
 }
 
 // BroadcastSourceStatus fans out a source-level status change to every
@@ -205,10 +227,11 @@ func (h *Hub) Consumers() []protocol.ConsumerInfo {
 	result := make([]protocol.ConsumerInfo, 0, len(h.subscribers))
 	for s := range h.subscribers {
 		result = append(result, protocol.ConsumerInfo{
-			PID:      s.PID(),
-			EventKey: s.EventKey(),
-			Received: s.Received(),
-			Dropped:  s.DroppedCount(),
+			PID:            s.PID(),
+			EventKey:       s.EventKey(),
+			SubscriptionID: s.SubscriptionID(),
+			Received:       s.Received(),
+			Dropped:        s.DroppedCount(),
 		})
 	}
 	return result

internal/event/bus/hub_observability_test.go

@@ -17,7 +17,7 @@ func TestHubDroppedCountIncrements(t *testing.T) {
 	server, client := testNetPipe(t)
 	defer server.Close()
 	defer client.Close()
-	c := NewConn(server, nil, "k", []string{"t"}, 1)
+	c := NewConn(server, nil, "k", []string{"t"}, 1, "")
 	c.sendCh = make(chan interface{}, 1)
 	h.RegisterAndIsFirst(c)
 
@@ -35,7 +35,7 @@ func TestPublishAssignsIncrementalSeq(t *testing.T) {
 	server, client := testNetPipe(t)
 	defer server.Close()
 	defer client.Close()
-	c := NewConn(server, nil, "k", []string{"t"}, 1)
+	c := NewConn(server, nil, "k", []string{"t"}, 1, "")
 	c.sendCh = make(chan interface{}, 10)
 	h.RegisterAndIsFirst(c)
 
@@ -60,7 +60,7 @@ func TestPublishPopulatesEventIDAndSourceTime(t *testing.T) {
 	server, client := testNetPipe(t)
 	defer server.Close()
 	defer client.Close()
-	c := NewConn(server, nil, "k", []string{"t"}, 1)
+	c := NewConn(server, nil, "k", []string{"t"}, 1, "")
 	c.sendCh = make(chan interface{}, 1)
 	h.RegisterAndIsFirst(c)
 
@@ -87,7 +87,7 @@ func TestPublishSourceTimeTakesPrecedence(t *testing.T) {
 	server, client := testNetPipe(t)
 	defer server.Close()
 	defer client.Close()
-	c := NewConn(server, nil, "k", []string{"t"}, 1)
+	c := NewConn(server, nil, "k", []string{"t"}, 1, "")
 	c.sendCh = make(chan interface{}, 1)
 	h.RegisterAndIsFirst(c)
 
@@ -111,7 +111,7 @@ func TestPublishSourceTimeFallback(t *testing.T) {
 	server, client := testNetPipe(t)
 	defer server.Close()
 	defer client.Close()
-	c := NewConn(server, nil, "k", []string{"t"}, 1)
+	c := NewConn(server, nil, "k", []string{"t"}, 1, "")
 	c.sendCh = make(chan interface{}, 1)
 	h.RegisterAndIsFirst(c)
 

internal/event/bus/hub_publish_race_test.go

@@ -111,6 +111,7 @@ type alwaysFailSubscriber struct {
 }
 
 func (s *alwaysFailSubscriber) EventKey() string         { return s.eventKey }
+func (s *alwaysFailSubscriber) SubscriptionID() string   { return s.eventKey }
 func (s *alwaysFailSubscriber) EventTypes() []string     { return s.eventTypes }
 func (s *alwaysFailSubscriber) SendCh() chan interface{} { return s.sendCh }
 func (s *alwaysFailSubscriber) PID() int                 { return 0 }
@@ -153,6 +154,7 @@ func newRaceSubscriber(key string, types []string, capacity int) *raceSubscriber
 }
 
 func (s *raceSubscriber) EventKey() string         { return s.eventKey }
+func (s *raceSubscriber) SubscriptionID() string   { return s.eventKey }
 func (s *raceSubscriber) EventTypes() []string     { return s.eventTypes }
 func (s *raceSubscriber) SendCh() chan interface{} { return s.sendCh }
 func (s *raceSubscriber) PID() int                 { return s.pid }

internal/event/bus/hub_test.go

@@ -5,6 +5,7 @@ package bus
 
 import (
 	"encoding/json"
+	"net"
 	"sync"
 	"sync/atomic"
 	"testing"
@@ -235,7 +236,10 @@ func newTestConn(eventKey string, eventTypes []string) *testConn {
 	}
 }
 
-func (c *testConn) EventKey() string         { return c.eventKey }
+func (c *testConn) EventKey() string { return c.eventKey }
+
+// SubscriptionID falls back to EventKey for test mocks that don't set a separate subscription ID.
+func (c *testConn) SubscriptionID() string   { return c.eventKey }
 func (c *testConn) EventTypes() []string     { return c.eventTypes }
 func (c *testConn) SendCh() chan interface{} { return c.sendCh }
 func (c *testConn) PID() int                 { return c.pid }
@@ -275,3 +279,79 @@ func (c *testConn) TrySend(msg interface{}) bool {
 		return false
 	}
 }
+
+func TestHub_SubscriptionID_Isolation(t *testing.T) {
+	h := NewHub()
+	c1, _ := net.Pipe()
+	c2, _ := net.Pipe()
+	defer c1.Close()
+	defer c2.Close()
+	s1 := NewConn(c1, nil, "mail.x", []string{"mail.x"}, 1, "mail.x:alice")
+	s2 := NewConn(c2, nil, "mail.x", []string{"mail.x"}, 2, "mail.x:bob")
+
+	if !h.RegisterAndIsFirst(s1) {
+		t.Error("s1 should be first for its subscription")
+	}
+	if !h.RegisterAndIsFirst(s2) {
+		t.Error("s2 should ALSO be first (different SubscriptionID)")
+	}
+	if !h.UnregisterAndIsLast(s1) {
+		t.Error("s1 should be last for mail.x:alice")
+	}
+	if !h.UnregisterAndIsLast(s2) {
+		t.Error("s2 should be last for mail.x:bob")
+	}
+}
+
+func TestHub_SameSubscriptionID_NotFirst(t *testing.T) {
+	h := NewHub()
+	c1, _ := net.Pipe()
+	c2, _ := net.Pipe()
+	defer c1.Close()
+	defer c2.Close()
+	s1 := NewConn(c1, nil, "mail.x", []string{"mail.x"}, 1, "mail.x:alice")
+	s2 := NewConn(c2, nil, "mail.x", []string{"mail.x"}, 2, "mail.x:alice")
+
+	if !h.RegisterAndIsFirst(s1) {
+		t.Error("s1 first")
+	}
+	if h.RegisterAndIsFirst(s2) {
+		t.Error("s2 same SubscriptionID should NOT be first")
+	}
+}
+
+func TestHub_EventKeyCount_AggregatesAcrossSubscriptions(t *testing.T) {
+	h := NewHub()
+	c1, _ := net.Pipe()
+	c2, _ := net.Pipe()
+	defer c1.Close()
+	defer c2.Close()
+	s1 := NewConn(c1, nil, "mail.x", []string{"mail.x"}, 1, "mail.x:alice")
+	s2 := NewConn(c2, nil, "mail.x", []string{"mail.x"}, 2, "mail.x:bob")
+	h.RegisterAndIsFirst(s1)
+	h.RegisterAndIsFirst(s2)
+	if got := h.EventKeyCount("mail.x"); got != 2 {
+		t.Errorf("EventKeyCount(mail.x) = %d, want 2 (aggregated across subscriptions)", got)
+	}
+	if got := h.SubCount("mail.x:alice"); got != 1 {
+		t.Errorf("SubCount(mail.x:alice) = %d, want 1", got)
+	}
+	if got := h.SubCount("mail.x:bob"); got != 1 {
+		t.Errorf("SubCount(mail.x:bob) = %d, want 1", got)
+	}
+}
+
+func TestHub_Consumers_PopulatesSubscriptionID(t *testing.T) {
+	h := NewHub()
+	c1, _ := net.Pipe()
+	defer c1.Close()
+	s1 := NewConn(c1, nil, "mail.x", []string{"mail.x"}, 1, "mail.x:alice")
+	h.RegisterAndIsFirst(s1)
+	consumers := h.Consumers()
+	if len(consumers) != 1 {
+		t.Fatalf("got %d consumers, want 1", len(consumers))
+	}
+	if consumers[0].SubscriptionID != "mail.x:alice" {
+		t.Errorf("Consumers()[0].SubscriptionID = %q, want %q", consumers[0].SubscriptionID, "mail.x:alice")
+	}
+}

internal/event/consume/consume.go

@@ -61,6 +61,22 @@ func Run(ctx context.Context, tr transport.IPC, appID, profileName, domain strin
 		}
 	}
 
+	// Normalize params (resolve aliases like "me" -> real email) before fingerprint
+	// compute, PreConsume, Match, Process. Must happen BEFORE doHello so the
+	// SubscriptionID we send to bus reflects canonical values.
+	if keyDef.NormalizeParams != nil {
+		if err := keyDef.NormalizeParams(ctx, opts.Runtime, opts.Params); err != nil {
+			if _, ok := errs.ProblemOf(err); ok {
+				return err
+			}
+			return errs.NewInternalError(errs.SubtypeUnknown,
+				"normalize params for %s: %s", opts.EventKey, err).WithCause(err)
+		}
+	}
+
+	// Compute subscription identity from normalized params + SubscriptionKey flags.
+	subscriptionID := ComputeSubscriptionID(keyDef, opts.Params)
+
 	if opts.Timeout > 0 {
 		var cancel context.CancelFunc
 		ctx, cancel = context.WithTimeout(ctx, opts.Timeout)
@@ -81,13 +97,13 @@ func Run(ctx context.Context, tr transport.IPC, appID, profileName, domain strin
 	}
 	defer conn.Close()
 
-	ack, br, err := doHello(conn, opts.EventKey, []string{keyDef.EventType})
+	ack, br, err := doHello(conn, opts.EventKey, []string{keyDef.EventType}, subscriptionID)
 	if err != nil {
 		return errs.NewInternalError(errs.SubtypeUnknown,
 			"event bus handshake failed: %s", err).WithCause(err)
 	}
 
-	var cleanup func()
+	var cleanup func() error
 	if ack.FirstForKey && keyDef.PreConsume != nil {
 		if !opts.Quiet {
 			fmt.Fprintf(errOut, "[event] running pre-consume setup...\n")
@@ -113,14 +129,22 @@ func Run(ctx context.Context, tr transport.IPC, appID, profileName, domain strin
 		if cleanup != nil {
 			switch {
 			case r != nil:
-				fmt.Fprintf(errOut, "WARN: panic recovered; running cleanup unconditionally (may affect other consumers of %s)\n", opts.EventKey)
-				cleanup()
+				fmt.Fprintf(errOut,
+					"WARN: panic recovered; running cleanup unconditionally (may affect other consumers of %s)\n",
+					opts.EventKey)
+				if cleanupErr := cleanup(); cleanupErr != nil {
+					fmt.Fprintf(errOut,
+						"WARN: cleanup also failed during panic recovery: %v\n", cleanupErr)
+				}
 			case lastForKey:
 				if !opts.Quiet {
 					fmt.Fprintf(errOut, "[event] running cleanup...\n")
 				}
-				cleanup()
-				if !opts.Quiet {
+				if cleanupErr := cleanup(); cleanupErr != nil {
+					fmt.Fprintf(errOut,
+						"WARN: cleanup failed: %v (server-side subscribe is idempotent — residual record will be overwritten on next subscribe)\n",
+						cleanupErr)
+				} else if !opts.Quiet {
 					fmt.Fprintf(errOut, "[event] cleanup done.\n")
 				}
 			}
@@ -144,7 +168,7 @@ func Run(ctx context.Context, tr transport.IPC, appID, profileName, domain strin
 
 	writeReadyMarker(errOut, opts)
 
-	return consumeLoop(ctx, conn, br, keyDef, opts, &lastForKey, &emitted)
+	return consumeLoop(ctx, conn, br, keyDef, opts, subscriptionID, &lastForKey, &emitted)
 }
 
 func truncateDuration(d time.Duration) time.Duration {

internal/event/consume/consume_test.go

@@ -0,0 +1,101 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package consume
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"net"
+	"strings"
+	"testing"
+
+	"github.com/larksuite/cli/internal/event"
+	"github.com/larksuite/cli/internal/event/protocol"
+	"github.com/larksuite/cli/internal/event/transport"
+)
+
+// fakeRT is a minimal event.APIClient mock.
+type fakeRT struct {
+	err error
+}
+
+func (f *fakeRT) CallAPI(_ context.Context, _, _ string, _ interface{}) (json.RawMessage, error) {
+	return nil, f.err
+}
+
+func TestNormalizeParams_ErrorIsWrappedWithEventKey(t *testing.T) {
+	// Drives the real Run() path: NormalizeParams fails before EnsureBus, so no
+	// bus is contacted, yet the production error-wrapping is exercised — if Run()
+	// ever stops wrapping, this test fails.
+	const key = "test.evt_normalize_fail"
+	event.RegisterKey(event.KeyDefinition{
+		Key:       key,
+		EventType: key,
+		Schema:    event.SchemaDef{Custom: &event.SchemaSpec{Raw: json.RawMessage(`{"type":"object"}`)}},
+		NormalizeParams: func(_ context.Context, _ event.APIClient, _ map[string]string) error {
+			return errors.New("simulated normalize failure")
+		},
+	})
+	defer event.UnregisterKeyForTest(key)
+
+	err := Run(context.Background(), transport.New(), "app", "", "", Options{
+		EventKey: key,
+		Runtime:  &fakeRT{},
+		Quiet:    true,
+	})
+	if err == nil {
+		t.Fatal("expected Run to fail when NormalizeParams errors")
+	}
+	if !strings.Contains(err.Error(), "normalize params for "+key+":") {
+		t.Errorf("error not wrapped with EventKey prefix: %v", err)
+	}
+	if !strings.Contains(err.Error(), "simulated normalize failure") {
+		t.Errorf("underlying error not propagated: %v", err)
+	}
+}
+
+func TestDoHello_PassesSubscriptionIDToWire(t *testing.T) {
+	a, b := net.Pipe()
+	defer a.Close()
+	defer b.Close()
+
+	// Server-side: read Hello, decode, assert SubscriptionID, send ack
+	done := make(chan string, 1)
+	go func() {
+		br := bufio.NewReader(b)
+		line, err := protocol.ReadFrame(br)
+		if err != nil {
+			done <- "READ_ERR:" + err.Error()
+			return
+		}
+		msg, err := protocol.Decode(bytes.TrimRight(line, "\n"))
+		if err != nil {
+			done <- "DECODE_ERR:" + err.Error()
+			return
+		}
+		if hello, ok := msg.(*protocol.Hello); ok {
+			done <- hello.SubscriptionID
+			// send ack so client can return
+			ack := protocol.NewHelloAck("v1", true)
+			_ = protocol.EncodeWithDeadline(b, ack, protocol.WriteTimeout)
+		} else {
+			done <- "WRONG_TYPE"
+		}
+	}()
+
+	ack, _, err := doHello(a, "mail.x", []string{"mail.x"}, "mail.x:alice")
+	if err != nil {
+		t.Fatalf("doHello error: %v", err)
+	}
+	if ack == nil {
+		t.Fatal("got nil ack")
+	}
+	got := <-done
+	if got != "mail.x:alice" {
+		t.Errorf("Hello.SubscriptionID on wire = %q, want %q", got, "mail.x:alice")
+	}
+}

internal/event/consume/fingerprint.go

@@ -0,0 +1,41 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package consume
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"sort"
+
+	"github.com/larksuite/cli/internal/event"
+)
+
+// ComputeSubscriptionID returns a stable identifier scoped to (EventKey, values
+// of the ParamDefs marked SubscriptionKey); the framework uses it to dedup
+// PreConsume/cleanup gates and key Hub counts per-subscription. No SubscriptionKey
+// params -> returns def.Key verbatim (legacy one-dimensional behavior).
+//
+// Stability contract: same EventKey + same normalized param values -> same ID
+// across CLI versions; changing the encoding requires a wire-format bump.
+func ComputeSubscriptionID(def *event.KeyDefinition, params map[string]string) string {
+	type kv struct {
+		Name  string `json:"name"`
+		Value string `json:"value"`
+	}
+	var subParams []kv
+	for _, p := range def.Params {
+		if !p.SubscriptionKey {
+			continue
+		}
+		subParams = append(subParams, kv{Name: p.Name, Value: params[p.Name]})
+	}
+	if len(subParams) == 0 {
+		return def.Key
+	}
+	sort.Slice(subParams, func(i, j int) bool { return subParams[i].Name < subParams[j].Name })
+	raw, _ := json.Marshal(subParams) // err impossible: kv has no unmarshalable fields
+	sum := sha256.Sum256(raw)
+	return def.Key + ":" + base64.RawURLEncoding.EncodeToString(sum[:12])
+}

internal/event/consume/fingerprint_test.go

@@ -0,0 +1,126 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package consume
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/larksuite/cli/internal/event"
+)
+
+func TestComputeSubscriptionID(t *testing.T) {
+	makeDef := func(subKeyNames ...string) *event.KeyDefinition {
+		def := &event.KeyDefinition{Key: "test.evt"}
+		marked := make(map[string]bool, len(subKeyNames))
+		for _, n := range subKeyNames {
+			marked[n] = true
+		}
+		for _, n := range []string{"alpha", "beta", "gamma"} {
+			def.Params = append(def.Params, event.ParamDef{Name: n, SubscriptionKey: marked[n]})
+		}
+		return def
+	}
+
+	t.Run("no SubscriptionKey params returns EventKey verbatim", func(t *testing.T) {
+		def := makeDef()
+		got := ComputeSubscriptionID(def, map[string]string{"alpha": "x", "beta": "y"})
+		if got != "test.evt" {
+			t.Errorf("got %q, want %q", got, "test.evt")
+		}
+	})
+
+	t.Run("single SubscriptionKey param: non-sub params do not leak into ID", func(t *testing.T) {
+		def := makeDef("alpha")
+		id1 := ComputeSubscriptionID(def, map[string]string{"alpha": "value1", "beta": "ignored"})
+		id2 := ComputeSubscriptionID(def, map[string]string{"alpha": "value1", "beta": "different"})
+		if id1 != id2 {
+			t.Errorf("non-SubscriptionKey param change leaked into ID: %q vs %q", id1, id2)
+		}
+	})
+
+	t.Run("different SubscriptionKey value produces different ID", func(t *testing.T) {
+		def := makeDef("alpha")
+		id1 := ComputeSubscriptionID(def, map[string]string{"alpha": "v1"})
+		id2 := ComputeSubscriptionID(def, map[string]string{"alpha": "v2"})
+		if id1 == id2 {
+			t.Errorf("different values produced same ID: %q", id1)
+		}
+	})
+}
+
+func TestComputeSubscriptionID_Stability(t *testing.T) {
+	// Param order in the ParamDef list must not affect the result (sorted by name internally).
+	def1 := &event.KeyDefinition{
+		Key: "test.evt",
+		Params: []event.ParamDef{
+			{Name: "b", SubscriptionKey: true},
+			{Name: "a", SubscriptionKey: true},
+		},
+	}
+	def2 := &event.KeyDefinition{
+		Key: "test.evt",
+		Params: []event.ParamDef{
+			{Name: "a", SubscriptionKey: true},
+			{Name: "b", SubscriptionKey: true},
+		},
+	}
+	id1 := ComputeSubscriptionID(def1, map[string]string{"a": "1", "b": "2"})
+	id2 := ComputeSubscriptionID(def2, map[string]string{"a": "1", "b": "2"})
+	if id1 != id2 {
+		t.Errorf("order-sensitive: id1=%q id2=%q", id1, id2)
+	}
+}
+
+func TestComputeSubscriptionID_Format(t *testing.T) {
+	def := &event.KeyDefinition{
+		Key:    "mail.user_mailbox.event.message_received_v1",
+		Params: []event.ParamDef{{Name: "mailbox", SubscriptionKey: true}},
+	}
+	id := ComputeSubscriptionID(def, map[string]string{"mailbox": "liuxinyang@example.com"})
+	prefix := "mail.user_mailbox.event.message_received_v1:"
+	if !strings.HasPrefix(id, prefix) {
+		t.Fatalf("missing prefix: %q", id)
+	}
+	suffix := strings.TrimPrefix(id, prefix)
+	if len(suffix) != 16 {
+		t.Errorf("fingerprint length = %d, want 16", len(suffix))
+	}
+	for _, c := range suffix {
+		isValid := (c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || c == '-' || c == '_'
+		if !isValid {
+			t.Errorf("non-base64URL char in fingerprint: %q", suffix)
+			break
+		}
+	}
+}
+
+func TestComputeSubscriptionID_UnicodeAndSpecialChars(t *testing.T) {
+	def := &event.KeyDefinition{
+		Key:    "test.evt",
+		Params: []event.ParamDef{{Name: "value", SubscriptionKey: true}},
+	}
+	for _, val := range []string{"中文", "emoji🚀", "with spaces", "with:colons", "with\"quotes"} {
+		id := ComputeSubscriptionID(def, map[string]string{"value": val})
+		if !strings.HasPrefix(id, "test.evt:") || len(id) != len("test.evt:")+16 {
+			t.Errorf("ID malformed for value=%q: %q (len=%d)", val, id, len(id))
+		}
+	}
+}
+
+func TestComputeSubscriptionID_EmptyValue(t *testing.T) {
+	def := &event.KeyDefinition{
+		Key:    "test.evt",
+		Params: []event.ParamDef{{Name: "x", SubscriptionKey: true}},
+	}
+	id1 := ComputeSubscriptionID(def, map[string]string{"x": ""})
+	id2 := ComputeSubscriptionID(def, map[string]string{}) // missing entirely
+	if id1 != id2 {
+		t.Errorf("empty value should be indistinguishable from missing: %q vs %q", id1, id2)
+	}
+	id3 := ComputeSubscriptionID(def, map[string]string{"x": "nonempty"})
+	if id1 == id3 {
+		t.Errorf("empty and nonempty produced same ID: %q", id1)
+	}
+}

internal/event/consume/handshake.go

@@ -18,8 +18,8 @@ const helloAckTimeout = 5 * time.Second // symmetric with bus-side hello read de
 
 // doHello returns a bufio.Reader holding any bytes already pulled off conn so events
 // buffered with the ack in one TCP segment aren't dropped.
-func doHello(conn net.Conn, eventKey string, eventTypes []string) (*protocol.HelloAck, *bufio.Reader, error) {
-	hello := protocol.NewHello(os.Getpid(), eventKey, eventTypes, "v1")
+func doHello(conn net.Conn, eventKey string, eventTypes []string, subscriptionID string) (*protocol.HelloAck, *bufio.Reader, error) {
+	hello := protocol.NewHello(os.Getpid(), eventKey, eventTypes, "v1", subscriptionID)
 	if err := protocol.EncodeWithDeadline(conn, hello, protocol.WriteTimeout); err != nil {
 		return nil, nil, err
 	}

internal/event/consume/handshake_test.go

@@ -27,7 +27,7 @@ func TestDoHello_ReadDeadline(t *testing.T) {
 	start := time.Now()
 	done := make(chan error, 1)
 	go func() {
-		_, _, err := doHello(client, "im.msg", []string{"im.msg"})
+		_, _, err := doHello(client, "im.msg", []string{"im.msg"}, "")
 		done <- err
 	}()
 

internal/event/consume/loop.go

@@ -22,7 +22,7 @@ import (
 )
 
 // consumeLoop reads events and dispatches to workers; cancels on terminal sink errors.
-func consumeLoop(ctx context.Context, conn net.Conn, br *bufio.Reader, keyDef *event.KeyDefinition, opts Options, lastForKey *bool, emitted *atomic.Int64) error {
+func consumeLoop(ctx context.Context, conn net.Conn, br *bufio.Reader, keyDef *event.KeyDefinition, opts Options, subscriptionID string, lastForKey *bool, emitted *atomic.Int64) error {
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 
@@ -185,7 +185,7 @@ func consumeLoop(ctx context.Context, conn net.Conn, br *bufio.Reader, keyDef *e
 		close(stopReader)
 		<-readerDone
 		conn.SetReadDeadline(time.Time{})
-		*lastForKey = checkLastForKey(conn, opts.EventKey)
+		*lastForKey = checkLastForKey(conn, opts.EventKey, subscriptionID)
 		conn.Close()
 	case <-allDone:
 		// bus-side close; can't query, assume last
@@ -199,13 +199,19 @@ func consumeLoop(ctx context.Context, conn net.Conn, br *bufio.Reader, keyDef *e
 
 // processAndOutput returns (wrote, err); err non-nil only for sink.Write failures.
 func processAndOutput(ctx context.Context, keyDef *event.KeyDefinition, evt *protocol.Event, opts Options, sink Sink, jqCode *gojq.Code) (bool, error) {
+	raw := &event.RawEvent{
+		EventType: evt.EventType,
+		Payload:   evt.Payload,
+	}
+
+	// Synchronous Match filter runs before any work (Process / sink write).
+	if keyDef.Match != nil && !keyDef.Match(raw, opts.Params) {
+		return false, nil
+	}
+
 	var result json.RawMessage
 
 	if keyDef.Process != nil {
-		raw := &event.RawEvent{
-			EventType: evt.EventType,
-			Payload:   evt.Payload,
-		}
 		var err error
 		result, err = keyDef.Process(ctx, opts.Runtime, raw, opts.Params)
 		if err != nil {

internal/event/consume/loop_test.go

@@ -89,7 +89,7 @@ func TestConsumeLoop_DeliversEventsAndExitsOnMaxEvents(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	err := consumeLoop(ctx, client, bufio.NewReader(client), echoKeyDef("test.key"), opts, &lastForKey, &emitted)
+	err := consumeLoop(ctx, client, bufio.NewReader(client), echoKeyDef("test.key"), opts, "", &lastForKey, &emitted)
 	if err != nil {
 		t.Fatalf("consumeLoop: %v", err)
 	}
@@ -132,7 +132,7 @@ func TestConsumeLoop_SeqGapEmitsWarning(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	if err := consumeLoop(ctx, client, bufio.NewReader(client), echoKeyDef("test.key"), opts, &lastForKey, &emitted); err != nil {
+	if err := consumeLoop(ctx, client, bufio.NewReader(client), echoKeyDef("test.key"), opts, "", &lastForKey, &emitted); err != nil {
 		t.Fatalf("consumeLoop: %v", err)
 	}
 	if got := emitted.Load(); got != 2 {
@@ -169,7 +169,7 @@ func TestConsumeLoop_JQFilterAppliedPerEvent(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	if err := consumeLoop(ctx, client, bufio.NewReader(client), echoKeyDef("test.key"), opts, &lastForKey, &emitted); err != nil {
+	if err := consumeLoop(ctx, client, bufio.NewReader(client), echoKeyDef("test.key"), opts, "", &lastForKey, &emitted); err != nil {
 		t.Fatalf("consumeLoop: %v", err)
 	}
 	if got := emitted.Load(); got != 1 {
@@ -196,12 +196,96 @@ func TestConsumeLoop_CompileJQFailsEarly(t *testing.T) {
 
 	var lastForKey bool
 	var emitted atomic.Int64
-	err := consumeLoop(context.Background(), client, bufio.NewReader(client), echoKeyDef("test.key"), opts, &lastForKey, &emitted)
+	err := consumeLoop(context.Background(), client, bufio.NewReader(client), echoKeyDef("test.key"), opts, "", &lastForKey, &emitted)
 	if err == nil {
 		t.Fatal("consumeLoop should fail immediately on bad jq expression")
 	}
 }
 
+// captureSink is a minimal Sink for unit-testing processAndOutput directly.
+type captureSink struct {
+	written []json.RawMessage
+}
+
+func (s *captureSink) Write(data json.RawMessage) error {
+	s.written = append(s.written, data)
+	return nil
+}
+
+func TestProcessAndOutput_Match_DropsEvent(t *testing.T) {
+	calledProcess := false
+	keyDef := &event.KeyDefinition{
+		Key: "test.evt",
+		Match: func(raw *event.RawEvent, params map[string]string) bool {
+			return false
+		},
+		Process: func(ctx context.Context, rt event.APIClient, raw *event.RawEvent, params map[string]string) (json.RawMessage, error) {
+			calledProcess = true
+			return json.RawMessage(`{}`), nil
+		},
+	}
+	sink := &captureSink{}
+	wrote, err := processAndOutput(context.Background(), keyDef,
+		&protocol.Event{Type: protocol.MsgTypeEvent, EventType: "test.evt", Payload: json.RawMessage(`{"x":1}`)},
+		Options{}, sink, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if wrote {
+		t.Error("Match returned false but event was written")
+	}
+	if calledProcess {
+		t.Error("Process was called even though Match returned false")
+	}
+	if len(sink.written) != 0 {
+		t.Errorf("sink received %d events, want 0", len(sink.written))
+	}
+}
+
+func TestProcessAndOutput_Match_NilAcceptsAll(t *testing.T) {
+	keyDef := &event.KeyDefinition{Key: "test.evt"} // no Match, no Process
+	sink := &captureSink{}
+	wrote, err := processAndOutput(context.Background(), keyDef,
+		&protocol.Event{Type: protocol.MsgTypeEvent, EventType: "test.evt", Payload: json.RawMessage(`{"x":1}`)},
+		Options{}, sink, nil)
+	if err != nil || !wrote {
+		t.Errorf("expected wrote=true err=nil; got wrote=%v err=%v", wrote, err)
+	}
+	if len(sink.written) != 1 {
+		t.Errorf("sink received %d events, want 1", len(sink.written))
+	}
+}
+
+func TestProcessAndOutput_Match_RunsBeforeProcess(t *testing.T) {
+	// Record the actual call sequence — a bare call-count check would still
+	// pass if Process ran before Match.
+	var order []string
+	keyDef := &event.KeyDefinition{
+		Key: "test.evt",
+		Match: func(raw *event.RawEvent, params map[string]string) bool {
+			order = append(order, "match")
+			return true
+		},
+		Process: func(ctx context.Context, rt event.APIClient, raw *event.RawEvent, params map[string]string) (json.RawMessage, error) {
+			order = append(order, "process")
+			return raw.Payload, nil
+		},
+	}
+	sink := &captureSink{}
+	wrote, err := processAndOutput(context.Background(), keyDef,
+		&protocol.Event{Type: protocol.MsgTypeEvent, EventType: "test.evt", Payload: json.RawMessage(`{}`)},
+		Options{}, sink, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !wrote {
+		t.Error("expected wrote=true")
+	}
+	if len(order) != 2 || order[0] != "match" || order[1] != "process" {
+		t.Errorf("call order = %v, want [match process]", order)
+	}
+}
+
 func TestIsTerminalSinkError(t *testing.T) {
 	for _, tc := range []struct {
 		name string

internal/event/consume/shutdown.go

@@ -16,8 +16,8 @@ const preShutdownAckTimeout = 2 * time.Second
 
 // checkLastForKey atomically reserves a cleanup lock; on any error defaults to true
 // (cleanup-on-error is safer than leaking server state). Discards non-ack frames in flight.
-func checkLastForKey(conn net.Conn, eventKey string) bool {
-	msg := protocol.NewPreShutdownCheck(eventKey)
+func checkLastForKey(conn net.Conn, eventKey string, subscriptionID string) bool {
+	msg := protocol.NewPreShutdownCheck(eventKey, subscriptionID)
 	if err := protocol.EncodeWithDeadline(conn, msg, protocol.WriteTimeout); err != nil {
 		return true
 	}

internal/event/consume/shutdown_test.go

@@ -4,6 +4,8 @@
 package consume
 
 import (
+	"bufio"
+	"bytes"
 	"encoding/json"
 	"io"
 	"net"
@@ -38,7 +40,7 @@ func TestCheckLastForKey_IgnoresNonAckFrames(t *testing.T) {
 		}
 	}()
 
-	got := checkLastForKey(client, "im.msg")
+	got := checkLastForKey(client, "im.msg", "")
 	if got != false {
 		t.Errorf("checkLastForKey = %v, want false", got)
 	}
@@ -62,7 +64,7 @@ func TestCheckLastForKey_ReturnsAckValue(t *testing.T) {
 		_ = protocol.Encode(server, ack)
 	}()
 
-	got := checkLastForKey(client, "im.msg")
+	got := checkLastForKey(client, "im.msg", "")
 	if got != true {
 		t.Errorf("checkLastForKey = %v, want true", got)
 	}
@@ -83,7 +85,7 @@ func TestCheckLastForKey_DefaultsToTrueOnTimeout(t *testing.T) {
 	}()
 
 	start := time.Now()
-	got := checkLastForKey(client, "im.msg")
+	got := checkLastForKey(client, "im.msg", "")
 	elapsed := time.Since(start)
 
 	if got != true {
@@ -93,3 +95,39 @@ func TestCheckLastForKey_DefaultsToTrueOnTimeout(t *testing.T) {
 		t.Errorf("elapsed = %v, expected ~%v (timeout-bounded)", elapsed, preShutdownAckTimeout)
 	}
 }
+
+func TestCheckLastForKey_SendsSubscriptionID(t *testing.T) {
+	a, b := net.Pipe()
+	defer a.Close()
+	defer b.Close()
+
+	done := make(chan string, 1)
+	go func() {
+		br := bufio.NewReader(b)
+		line, err := protocol.ReadFrame(br)
+		if err != nil {
+			done <- "READ_ERR"
+			return
+		}
+		msg, err := protocol.Decode(bytes.TrimRight(line, "\n"))
+		if err != nil {
+			done <- "DECODE_ERR"
+			return
+		}
+		check, ok := msg.(*protocol.PreShutdownCheck)
+		if !ok {
+			done <- "WRONG_TYPE"
+			return
+		}
+		done <- check.SubscriptionID
+		// Reply with ack so client returns
+		ack := protocol.NewPreShutdownAck(true)
+		_ = protocol.EncodeWithDeadline(b, ack, protocol.WriteTimeout)
+	}()
+
+	_ = checkLastForKey(a, "mail.x", "mail.x:alice")
+	got := <-done
+	if got != "mail.x:alice" {
+		t.Errorf("PreShutdownCheck.SubscriptionID on wire = %q, want %q", got, "mail.x:alice")
+	}
+}

internal/event/protocol/codec_test.go

@@ -77,3 +77,88 @@ func TestDecodeUnknownType(t *testing.T) {
 		t.Error("expected error for unknown type")
 	}
 }
+
+func TestEncodeDecodeHello_WithSubscriptionID(t *testing.T) {
+	msg := &Hello{
+		Type:           MsgTypeHello,
+		PID:            12345,
+		EventKey:       "mail.user_mailbox.event.message_received_v1",
+		EventTypes:     []string{"mail.user_mailbox.event.message_received_v1"},
+		Version:        "v1",
+		SubscriptionID: "mail.user_mailbox.event.message_received_v1:a7Bx9Kp2Lm3Qv4Rs",
+	}
+	buf := &bytes.Buffer{}
+	if err := Encode(buf, msg); err != nil {
+		t.Fatal(err)
+	}
+	line := buf.Bytes()
+	if !bytes.Contains(line, []byte(`"subscription_id":"mail.user_mailbox.event.message_received_v1:a7Bx9Kp2Lm3Qv4Rs"`)) {
+		t.Errorf("subscription_id not serialized: %s", string(line))
+	}
+	decoded, err := Decode(bytes.TrimRight(line, "\n"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	hello, ok := decoded.(*Hello)
+	if !ok {
+		t.Fatalf("expected *Hello, got %T", decoded)
+	}
+	if hello.SubscriptionID != msg.SubscriptionID {
+		t.Errorf("roundtrip subscription_id: got %q want %q", hello.SubscriptionID, msg.SubscriptionID)
+	}
+}
+
+func TestEncodeDecodeHello_EmptySubscriptionIDOmitted(t *testing.T) {
+	msg := &Hello{
+		Type:       MsgTypeHello,
+		PID:        1,
+		EventKey:   "k",
+		EventTypes: []string{"k"},
+		Version:    "v1",
+	}
+	buf := &bytes.Buffer{}
+	if err := Encode(buf, msg); err != nil {
+		t.Fatal(err)
+	}
+	if bytes.Contains(buf.Bytes(), []byte("subscription_id")) {
+		t.Errorf("empty subscription_id should be omitted: %s", buf.String())
+	}
+	decoded, _ := Decode(bytes.TrimRight(buf.Bytes(), "\n"))
+	hello := decoded.(*Hello)
+	if hello.SubscriptionID != "" {
+		t.Errorf("got %q, want empty", hello.SubscriptionID)
+	}
+}
+
+func TestEncodeDecodePreShutdownCheck_WithSubscriptionID(t *testing.T) {
+	msg := &PreShutdownCheck{
+		Type:           MsgTypePreShutdownCheck,
+		EventKey:       "mail.x",
+		SubscriptionID: "mail.x:abc",
+	}
+	buf := &bytes.Buffer{}
+	if err := Encode(buf, msg); err != nil {
+		t.Fatal(err)
+	}
+	decoded, err := Decode(bytes.TrimRight(buf.Bytes(), "\n"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := decoded.(*PreShutdownCheck)
+	if got.SubscriptionID != msg.SubscriptionID {
+		t.Errorf("roundtrip: got %q want %q", got.SubscriptionID, msg.SubscriptionID)
+	}
+}
+
+func TestStatusResponse_ConsumerInfo_SubscriptionID(t *testing.T) {
+	msg := NewStatusResponse(7, 120, 1, []ConsumerInfo{
+		{PID: 99, EventKey: "mail.x", SubscriptionID: "mail.x:abc", Received: 5, Dropped: 0},
+	})
+	buf := &bytes.Buffer{}
+	if err := Encode(buf, msg); err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Contains(buf.Bytes(), []byte(`"subscription_id":"mail.x:abc"`)) {
+		t.Errorf("ConsumerInfo.SubscriptionID missing from JSON: %s", buf.String())
+	}
+}

internal/event/protocol/messages.go

@@ -34,11 +34,12 @@ type SourceStatus struct {
 }
 
 type Hello struct {
-	Type       string   `json:"type"`
-	PID        int      `json:"pid"`
-	EventKey   string   `json:"event_key"`
-	EventTypes []string `json:"event_types"`
-	Version    string   `json:"version"`
+	Type           string   `json:"type"`
+	PID            int      `json:"pid"`
+	EventKey       string   `json:"event_key"`
+	EventTypes     []string `json:"event_types"`
+	Version        string   `json:"version"`
+	SubscriptionID string   `json:"subscription_id,omitempty"` // empty = fallback to EventKey on bus side
 }
 
 type HelloAck struct {
@@ -61,10 +62,11 @@ type Bye struct {
 	Type string `json:"type"`
 }
 
-// PreShutdownCheck atomically reserves the cleanup lock for EventKey.
+// PreShutdownCheck atomically reserves the cleanup lock for (EventKey, SubscriptionID).
 type PreShutdownCheck struct {
-	Type     string `json:"type"`
-	EventKey string `json:"event_key"`
+	Type           string `json:"type"`
+	EventKey       string `json:"event_key"`
+	SubscriptionID string `json:"subscription_id,omitempty"` // empty = fallback to EventKey
 }
 
 type PreShutdownAck struct {
@@ -77,10 +79,11 @@ type StatusQuery struct {
 }
 
 type ConsumerInfo struct {
-	PID      int    `json:"pid"`
-	EventKey string `json:"event_key"`
-	Received int64  `json:"received"`
-	Dropped  int64  `json:"dropped"`
+	PID            int    `json:"pid"`
+	EventKey       string `json:"event_key"`
+	SubscriptionID string `json:"subscription_id,omitempty"`
+	Received       int64  `json:"received"`
+	Dropped        int64  `json:"dropped"`
 }
 
 type StatusResponse struct {
@@ -95,13 +98,14 @@ type Shutdown struct {
 	Type string `json:"type"`
 }
 
-func NewHello(pid int, eventKey string, eventTypes []string, version string) *Hello {
+func NewHello(pid int, eventKey string, eventTypes []string, version string, subscriptionID string) *Hello {
 	return &Hello{
-		Type:       MsgTypeHello,
-		PID:        pid,
-		EventKey:   eventKey,
-		EventTypes: eventTypes,
-		Version:    version,
+		Type:           MsgTypeHello,
+		PID:            pid,
+		EventKey:       eventKey,
+		EventTypes:     eventTypes,
+		Version:        version,
+		SubscriptionID: subscriptionID,
 	}
 }
 
@@ -124,8 +128,8 @@ func NewEvent(eventType, eventID, sourceTime string, seq uint64, payload json.Ra
 	}
 }
 
-func NewPreShutdownCheck(eventKey string) *PreShutdownCheck {
-	return &PreShutdownCheck{Type: MsgTypePreShutdownCheck, EventKey: eventKey}
+func NewPreShutdownCheck(eventKey, subscriptionID string) *PreShutdownCheck {
+	return &PreShutdownCheck{Type: MsgTypePreShutdownCheck, EventKey: eventKey, SubscriptionID: subscriptionID}
 }
 
 func NewPreShutdownAck(lastForKey bool) *PreShutdownAck {

internal/event/protocol/messages_test.go

@@ -17,7 +17,7 @@ import (
 
 // Every NewXxx helper must set the Type discriminator (Decode rejects messages without it).
 func TestConstructors_PinTypeField(t *testing.T) {
-	if got := NewHello(1, "k", []string{"t"}, "v1"); got.Type != MsgTypeHello {
+	if got := NewHello(1, "k", []string{"t"}, "v1", ""); got.Type != MsgTypeHello {
 		t.Errorf("NewHello.Type = %q, want %q", got.Type, MsgTypeHello)
 	}
 	if got := NewHelloAck("v1", true); got.Type != MsgTypeHelloAck || !got.FirstForKey {
@@ -26,7 +26,7 @@ func TestConstructors_PinTypeField(t *testing.T) {
 	if got := NewEvent("im.msg", "e1", "", 7, json.RawMessage(`{}`)); got.Type != MsgTypeEvent || got.Seq != 7 {
 		t.Errorf("NewEvent mismatch: %+v", got)
 	}
-	if got := NewPreShutdownCheck("k"); got.Type != MsgTypePreShutdownCheck || got.EventKey != "k" {
+	if got := NewPreShutdownCheck("k", ""); got.Type != MsgTypePreShutdownCheck || got.EventKey != "k" {
 		t.Errorf("NewPreShutdownCheck mismatch: %+v", got)
 	}
 	if got := NewPreShutdownAck(true); got.Type != MsgTypePreShutdownAck || !got.LastForKey {
@@ -63,7 +63,7 @@ func TestEncode_DecodeRoundtripAllTypes(t *testing.T) {
 		}
 	}
 	roundtrip(t, NewHelloAck("v1", true), &HelloAck{})
-	roundtrip(t, NewPreShutdownCheck("im.msg"), &PreShutdownCheck{})
+	roundtrip(t, NewPreShutdownCheck("im.msg", ""), &PreShutdownCheck{})
 	roundtrip(t, NewPreShutdownAck(false), &PreShutdownAck{})
 	roundtrip(t, NewStatusQuery(), &StatusQuery{})
 	roundtrip(t, NewStatusResponse(7, 120, 1, []ConsumerInfo{{PID: 99, EventKey: "k"}}), &StatusResponse{})

internal/event/types.go

@@ -55,6 +55,23 @@ type ParamDef struct {
 	Default     string       `json:"default,omitempty"`
 	Description string       `json:"description"`
 	Values      []ParamValue `json:"values,omitempty"`
+
+	// SubscriptionKey marks this param as part of the subscription identity.
+	// Two consumers of the same EventKey but different values for any
+	// SubscriptionKey-marked param are treated as DISTINCT subscriptions:
+	// PreConsume runs once per (EventKey, SubscriptionID), cleanup runs once per
+	// (EventKey, SubscriptionID).
+	//
+	// CONTRACT: only mark a param SubscriptionKey if the EventKey's server-side
+	// subscribe/unsubscribe API is itself scoped to that resource. Lark keys the
+	// subscription record by (app, user, event_type) and overwrites it rather
+	// than reference-counting, so for a non-per-resource API the cleanup of one
+	// resource's last consumer unsubscribes the shared record and silently cuts
+	// off every other resource sharing that event_type.
+	//
+	// Default false = the param is a filter / formatting / metadata param
+	// and does not affect subscription identity.
+	SubscriptionKey bool `json:"subscription_key,omitempty"`
 }
 
 type ProcessFunc = func(ctx context.Context, rt APIClient, raw *RawEvent, params map[string]string) (json.RawMessage, error)
@@ -83,10 +100,44 @@ type KeyDefinition struct {
 
 	Schema SchemaDef `json:"schema"`
 
+	// NormalizeParams canonicalizes param values BEFORE fingerprint compute,
+	// PreConsume, Match, and Process. Mutates the params map in place.
+	// May call OAPI; runs once per consumer at startup.
+	//
+	// Use cases: resolve aliases ("me" -> real email, a name -> an ID),
+	// trim whitespace. On error, consume fails (no retry); caller gets the
+	// wrapped error.
+	//
+	// Default nil = no normalization, params pass through unchanged.
+	NormalizeParams func(ctx context.Context, rt APIClient, params map[string]string) error `json:"-"`
+
 	// Process required when Schema.Custom is Processed output; must be nil when Native is used.
+	//
+	// Convention: returning (nil, nil) signals "drop this event" — the
+	// consumer loop will skip writing it to sink and not advance the
+	// emitted counter. Useful for async filtering (e.g. fetch metadata,
+	// drop if folder doesn't match). For sync filters that don't need
+	// OAPI, use Match instead.
 	Process func(ctx context.Context, rt APIClient, raw *RawEvent, params map[string]string) (json.RawMessage, error) `json:"-"`
 
-	PreConsume func(ctx context.Context, rt APIClient, params map[string]string) (cleanup func(), err error) `json:"-"`
+	// Match is a synchronous payload filter run on every received event
+	// BEFORE Process. Return false to drop the event without further work.
+	//
+	// Signature deliberately omits ctx/rt to physically enforce "no OAPI
+	// calls in Match". For filters that need a metadata fetch first, use
+	// Process and return nil to drop.
+	//
+	// Default nil = accept all events.
+	Match func(raw *RawEvent, params map[string]string) bool `json:"-"`
+
+	// PreConsume runs once per (EventKey, SubscriptionID) when this consumer
+	// is first for that scope. Returns a cleanup function that the framework
+	// invokes when this consumer is the last for its scope.
+	//
+	// The cleanup's error return is honored: on nil the framework prints
+	// "[event] cleanup done."; on non-nil it prints a WARN with an
+	// idempotency note.
+	PreConsume func(ctx context.Context, rt APIClient, params map[string]string) (cleanup func() error, err error) `json:"-"`
 
 	Scopes []string `json:"scopes,omitempty"`
 

internal/output/spinner.go

@@ -1,80 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package output
-
-import (
-	"fmt"
-	"io"
-	"sync"
-	"time"
-)
-
-// spinnerFrames are braille spinner glyphs cycled to animate progress.
-var spinnerFrames = []string{"⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"}
-
-const (
-	spinnerInterval   = 80 * time.Millisecond
-	spinnerHideCursor = "\x1b[?25l"
-	spinnerShowCursor = "\x1b[?25h"
-	spinnerClearLine  = "\r\x1b[K" // CR + clear-to-end-of-line
-)
-
-// StartSpinner renders a braille spinner with an elapsed-seconds counter to w
-// until the returned stop() is called, e.g.:
-//
-//	⠹ Publishing dev → main... 3s
-//
-// It is meant for slow operations (long polls, first-time provisioning) so the
-// user sees the CLI is alive. Always write to STDERR (w = IO().ErrOut) so the
-// animation never pollutes stdout — the JSON/pretty result stays clean.
-//
-// When enabled is false (stderr is not a TTY: pipes, CI, captured output) it is
-// a no-op returning a no-op stop, so non-interactive runs emit nothing. Gate on
-// the stderr-TTY check (IOStreams.ErrIsTerminal), not the output format: the
-// spinner is stderr-only and self-clears, so it is shown in JSON mode too.
-//
-// stop() clears the spinner line, restores the cursor, and blocks until the
-// render goroutine has finished — so callers can safely write the result to
-// stdout/stderr immediately after. Call stop() BEFORE printing the result, and
-// it is safe to call more than once (e.g. an explicit call plus a defer).
-func StartSpinner(w io.Writer, enabled bool, label string) func() {
-	if !enabled || w == nil {
-		return func() {}
-	}
-
-	done := make(chan struct{})
-	finished := make(chan struct{})
-	start := time.Now()
-
-	go func() {
-		defer close(finished)
-		frame := 0
-		fmt.Fprint(w, spinnerHideCursor)
-		render := func() {
-			elapsed := int(time.Since(start).Seconds())
-			fmt.Fprintf(w, "%s%s %s... %ds", spinnerClearLine, spinnerFrames[frame], label, elapsed)
-			frame = (frame + 1) % len(spinnerFrames)
-		}
-		render()
-		ticker := time.NewTicker(spinnerInterval)
-		defer ticker.Stop()
-		for {
-			select {
-			case <-done:
-				fmt.Fprint(w, spinnerClearLine+spinnerShowCursor)
-				return
-			case <-ticker.C:
-				render()
-			}
-		}
-	}()
-
-	var once sync.Once
-	return func() {
-		once.Do(func() {
-			close(done)
-			<-finished // wait for the line to be cleared before returning
-		})
-	}
-}

internal/output/spinner_test.go

@@ -1,54 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package output
-
-import (
-	"bytes"
-	"strings"
-	"testing"
-)
-
-// TestStartSpinner_DisabledIsNoop asserts that a disabled spinner writes nothing and its stop func is idempotent.
-func TestStartSpinner_DisabledIsNoop(t *testing.T) {
-	var buf bytes.Buffer
-	stop := StartSpinner(&buf, false, "working")
-	stop()
-	stop() // idempotent
-	if buf.Len() != 0 {
-		t.Fatalf("disabled spinner wrote %q, want nothing", buf.String())
-	}
-}
-
-// TestStartSpinner_NilWriterIsNoop asserts that a nil writer is a no-op and stopping does not panic.
-func TestStartSpinner_NilWriterIsNoop(t *testing.T) {
-	stop := StartSpinner(nil, true, "working")
-	stop() // must not panic
-}
-
-// TestStartSpinner_EnabledAnimatesAndCleansUp asserts that an enabled spinner renders a frame and label, then clears the line and restores the cursor on stop.
-func TestStartSpinner_EnabledAnimatesAndCleansUp(t *testing.T) {
-	var buf bytes.Buffer
-	stop := StartSpinner(&buf, true, "Publishing")
-	// The goroutine renders the first frame synchronously before selecting on
-	// the stop channel, so even an immediate stop() yields one full cycle.
-	stop()
-	stop() // idempotent, must not panic or double-write after finished
-
-	out := buf.String()
-	if !strings.Contains(out, spinnerHideCursor) {
-		t.Errorf("missing hide-cursor escape:\n%q", out)
-	}
-	if !strings.Contains(out, spinnerFrames[0]) {
-		t.Errorf("missing first spinner frame %q:\n%q", spinnerFrames[0], out)
-	}
-	if !strings.Contains(out, "Publishing...") {
-		t.Errorf("missing label:\n%q", out)
-	}
-	if !strings.Contains(out, spinnerClearLine) {
-		t.Errorf("missing clear-line escape:\n%q", out)
-	}
-	if !strings.HasSuffix(out, spinnerShowCursor) {
-		t.Errorf("must end by restoring the cursor:\n%q", out)
-	}
-}

shortcuts/apps/apps_db_audit_list.go

@@ -1,300 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// AppsDBAuditList 列出数据表的行级审计事件（INSERT/UPDATE/DELETE 的变更追溯）。
-//
-// GET /apps/{app_id}/db/audit_list（cursor 分页）。--table 可重复传多张表；--since/--until 多格式时间。
-// operator 透传 {id,name}（json 还原对象、pretty 取 name）；before/after 是条件出现的 JSON
-// （INSERT 无 before、DELETE 无 after），json 还原成对象。
-//
-// 多表查询时，CLI 先用 schema（表是否存在）+ status（审计是否开启）在本地过滤，把不存在 /
-// 未开启审计的表剔除后再查 audit_list，被剔除的表及原因放进 skipped（服务端不再返该字段）。
-var AppsDBAuditList = common.Shortcut{
-	Service:     appsService,
-	Command:     "+db-audit-list",
-	Description: "List row-change audit events for one or more tables (cursor pagination)",
-	Risk:        "read",
-	Tips: []string{
-		"Example: lark-cli apps +db-audit-list --app-id <app_id> --table orders",
-		"Multiple tables: repeat --table; filter time with --since 7d / --until 2026-04-15.",
-	},
-	Scopes:    []string{"spark:app:read"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "table", Type: "string_slice", Desc: "table(s) to list audit events for (repeatable)", Required: true},
-		{Name: "env", Default: "online", Enum: []string{"dev", "online"}, Desc: "target db environment"},
-		{Name: "since", Desc: "filter: event at or after; relative (7d/2h) | date | datetime | ISO 8601 w/ TZ"},
-		{Name: "until", Desc: "filter: event at or before; same formats as --since"},
-		{Name: "page-size", Type: "int", Default: "20", Desc: "page size"},
-		{Name: "page-token", Desc: "pagination cursor from previous response"},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		if _, err := requireAppID(rctx.Str("app-id")); err != nil {
-			return err
-		}
-		if len(auditListTables(rctx)) == 0 {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--table is required (at least one table)").WithParam("--table")
-		}
-		return normalizeTimeFlags(rctx, "since", "until")
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		return common.NewDryRunAPI().
-			GET(appAuditListPath(appID)).
-			Desc("List Miaoda app table audit events").
-			Params(buildAuditListParams(rctx, auditListTables(rctx)))
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		requested := auditListTables(rctx)
-		env := rctx.Str("env")
-
-		// 多表查询：CLI 侧先用 schema（表是否存在）+ status（审计是否开启）过滤，
-		// 不存在 / 未开启审计的表不进 audit_list 查询，单独在 skipped 里给出原因。
-		// 单表查询直接打 audit_list，由后端就 table-not-found / audit-not-enabled 报错。
-		queryTables := requested
-		var skipped []auditSkippedEntry
-		if len(requested) > 1 {
-			queryTables, skipped, err = filterAuditTables(rctx, appID, env, requested)
-			if err != nil {
-				return withAppsHint(err, dbChangelogHint)
-			}
-			// 所有请求表都被过滤掉 → 无可查询表，直接返回空 + skipped 提示，不调 audit_list。
-			if len(queryTables) == 0 {
-				out := map[string]interface{}{"items": []auditLogItem{}, "has_more": false, "skipped": skipped}
-				rctx.OutFormat(out, nil, func(w io.Writer) {
-					io.WriteString(w, "No audit events found.\n")
-					writeAuditSkipped(w, skipped, len(requested))
-				})
-				return nil
-			}
-		}
-
-		data, err := rctx.CallAPITyped("GET", appAuditListPath(appID), buildAuditListParams(rctx, queryTables), nil)
-		if err != nil {
-			return withAppsHint(err, dbChangelogHint)
-		}
-		items := projectAuditLogItems(data["items"])
-		data["items"] = items
-		// 服务端不再返 skipped；改由 CLI 算出的 skipped 写回输出。
-		if len(skipped) > 0 {
-			data["skipped"] = skipped
-		} else {
-			delete(data, "skipped")
-		}
-		multi := len(requested) > 1
-		rctx.OutFormat(data, nil, func(w io.Writer) {
-			renderAuditListPretty(w, items, skipped, len(requested), multi)
-		})
-		return nil
-	},
-}
-
-// auditSkippedEntry 是被 CLI 预过滤掉的表及原因（替代已删除的服务端 skipped 字段）。
-type auditSkippedEntry struct {
-	Table  string `json:"table"`
-	Reason string `json:"reason"`
-}
-
-// filterAuditTables 用 schema（存在性）+ status（审计开关）把请求表分成「可查询」与「跳过」两组。
-func filterAuditTables(rctx *common.RuntimeContext, appID, env string, requested []string) ([]string, []auditSkippedEntry, error) {
-	existing, err := fetchExistingTables(rctx, appID, env)
-	if err != nil {
-		return nil, nil, err
-	}
-	enabled, err := fetchAuditEnabledTables(rctx, appID, env)
-	if err != nil {
-		return nil, nil, err
-	}
-	valid := make([]string, 0, len(requested))
-	var skipped []auditSkippedEntry
-	for _, t := range requested {
-		switch {
-		case !existing[t]:
-			skipped = append(skipped, auditSkippedEntry{Table: t, Reason: "table not found"})
-		case !enabled[t]:
-			skipped = append(skipped, auditSkippedEntry{Table: t, Reason: "audit not enabled"})
-		default:
-			valid = append(valid, t)
-		}
-	}
-	return valid, skipped, nil
-}
-
-// fetchExistingTables 翻页拉全量表清单，返回存在表名集合（schema 命令同源接口）。
-func fetchExistingTables(rctx *common.RuntimeContext, appID, env string) (map[string]bool, error) {
-	existing := map[string]bool{}
-	token := ""
-	for {
-		params := map[string]interface{}{"env": env, "page_size": 100}
-		if token != "" {
-			params["page_token"] = token
-		}
-		data, err := rctx.CallAPITyped("GET", appTablesPath(appID), params, nil)
-		if err != nil {
-			return nil, err
-		}
-		for _, it := range asMapSlice(data["items"]) {
-			if name := common.GetString(it, "name"); name != "" {
-				existing[name] = true
-			}
-		}
-		token = common.GetString(data, "page_token")
-		if data["has_more"] != true || token == "" {
-			break
-		}
-	}
-	return existing, nil
-}
-
-// fetchAuditEnabledTables 拉审计状态，返回当前已开启审计的表名集合（status 命令同源接口）。
-func fetchAuditEnabledTables(rctx *common.RuntimeContext, appID, env string) (map[string]bool, error) {
-	data, err := rctx.CallAPITyped("GET", appAuditStatusPath(appID), map[string]interface{}{"env": env}, nil)
-	if err != nil {
-		return nil, err
-	}
-	enabled := map[string]bool{}
-	for _, it := range asMapSlice(data["items"]) {
-		if it["enabled"] == true {
-			if name := common.GetString(it, "table"); name != "" {
-				enabled[name] = true
-			}
-		}
-	}
-	return enabled, nil
-}
-
-// asMapSlice 把 interface{}（[]interface{}）里的每个 map 元素取出，非 map 丢弃。
-func asMapSlice(raw interface{}) []map[string]interface{} {
-	arr, _ := raw.([]interface{})
-	out := make([]map[string]interface{}, 0, len(arr))
-	for _, it := range arr {
-		if m, ok := it.(map[string]interface{}); ok {
-			out = append(out, m)
-		}
-	}
-	return out
-}
-
-// auditListTables 取 --table 切片，trim 去空。
-func auditListTables(rctx *common.RuntimeContext) []string {
-	out := make([]string, 0)
-	for _, t := range rctx.StrSlice("table") {
-		if v := strings.TrimSpace(t); v != "" {
-			out = append(out, v)
-		}
-	}
-	return out
-}
-
-// buildAuditListParams 组装 audit_list 查询参数：env / tables(逗号拼接) / page_size 及可选 since/until/page_token。
-func buildAuditListParams(rctx *common.RuntimeContext, tables []string) map[string]interface{} {
-	params := map[string]interface{}{
-		"env":       rctx.Str("env"),
-		"tables":    strings.Join(tables, ","),
-		"page_size": rctx.Int("page-size"),
-	}
-	addStr := func(flag, key string) {
-		if v := strings.TrimSpace(rctx.Str(flag)); v != "" {
-			params[key] = v
-		}
-	}
-	addStr("since", "since")
-	addStr("until", "until")
-	addStr("page-token", "page_token")
-	return params
-}
-
-type auditLogItem struct {
-	EventID     string       `json:"event_id"`
-	EventTime   string       `json:"event_time"`
-	TargetTable string       `json:"target_table"`
-	Type        string       `json:"type"`
-	Operator    *operatorRef `json:"operator,omitempty"`
-	Summary     string       `json:"summary"`
-	Before      interface{}  `json:"before,omitempty"`
-	After       interface{}  `json:"after,omitempty"`
-}
-
-// projectAuditLogItems 把服务端原始审计事件投影为白名单 auditLogItem（operator 解析、before/after 还原成对象）。
-func projectAuditLogItems(raw interface{}) []auditLogItem {
-	arr, _ := raw.([]interface{})
-	out := make([]auditLogItem, 0, len(arr))
-	for _, it := range arr {
-		m, ok := it.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		row := auditLogItem{
-			EventID:     common.GetString(m, "event_id"),
-			EventTime:   common.GetString(m, "event_time"),
-			TargetTable: common.GetString(m, "target_table"),
-			Type:        common.GetString(m, "type"),
-			Operator:    parseOperator(common.GetString(m, "operator")),
-			Summary:     common.GetString(m, "summary"),
-		}
-		// before/after 条件出现：INSERT 无 before、DELETE 无 after。JSON 字符串 → 还原对象。
-		if b := common.GetString(m, "before"); b != "" {
-			row.Before = safeParseJSON(b)
-		}
-		if a := common.GetString(m, "after"); a != "" {
-			row.After = safeParseJSON(a)
-		}
-		out = append(out, row)
-	}
-	return out
-}
-
-// renderAuditListPretty 单表 5 列 / 多表 6 列（首列 target_table）；末尾列出 skipped 表。
-func renderAuditListPretty(w io.Writer, items []auditLogItem, skipped []auditSkippedEntry, totalRequested int, multi bool) {
-	if len(items) == 0 {
-		io.WriteString(w, "No audit events found.\n")
-		writeAuditSkipped(w, skipped, totalRequested)
-		return
-	}
-	var headers []string
-	if multi {
-		headers = []string{"target_table", "event_time", "type", "event_id", "operator", "summary"}
-	} else {
-		headers = []string{"event_time", "type", "event_id", "operator", "summary"}
-	}
-	rows := make([][]string, 0, len(items))
-	for _, it := range items {
-		cells := []string{dashIfEmpty(it.EventTime), it.Type, it.EventID, operatorName(it.Operator), dashIfEmpty(it.Summary)}
-		if multi {
-			cells = append([]string{dashIfEmpty(it.TargetTable)}, cells...)
-		}
-		rows = append(rows, cells)
-	}
-	renderAlignedTable(w, headers, rows)
-	writeAuditSkipped(w, skipped, totalRequested)
-}
-
-// writeAuditSkipped 打 "— Skipped N of M tables: orders (audit not enabled), foo (table not found)"。
-func writeAuditSkipped(w io.Writer, skipped []auditSkippedEntry, totalRequested int) {
-	if len(skipped) == 0 {
-		return
-	}
-	parts := make([]string, 0, len(skipped))
-	for _, s := range skipped {
-		parts = append(parts, fmt.Sprintf("%s (%s)", s.Table, s.Reason))
-	}
-	fmt.Fprintf(w, "— Skipped %d of %d tables: %s\n", len(skipped), totalRequested, strings.Join(parts, ", "))
-}

shortcuts/apps/apps_db_audit_set.go

@@ -1,142 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"strings"
-
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// 审计保留期合法取值。
-var auditRetentions = []string{"7d", "30d", "180d", "360d", "forever"}
-
-const dbAuditSetHint = "verify --app-id and --table; check current config with `lark-cli apps +db-audit-status --app-id <app_id>`"
-
-// AppsDBAuditEnable 为某张表开启行级审计（变更追溯）。
-//
-// POST /apps/{app_id}/db/audit_set，body {table, enabled:true, retention}。--retention 默认 7d。
-var AppsDBAuditEnable = common.Shortcut{
-	Service:     appsService,
-	Command:     "+db-audit-enable",
-	Description: "Enable row-change audit logging for a table",
-	Risk:        "write",
-	Tips: []string{
-		"Example: lark-cli apps +db-audit-enable --app-id <app_id> --table orders --retention 30d",
-	},
-	Scopes:    []string{"spark:app:write"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "table", Desc: "table to enable audit for", Required: true},
-		{Name: "retention", Default: "7d", Enum: auditRetentions, Desc: "how long to keep audit logs"},
-		{Name: "env", Default: "online", Enum: []string{"dev", "online"}, Desc: "target db environment"},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		_, err := requireAppID(rctx.Str("app-id"))
-		return err
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		return common.NewDryRunAPI().
-			POST(appAuditSetPath(appID)).
-			Desc("Enable table audit").
-			Params(map[string]interface{}{"env": rctx.Str("env")}).
-			Body(map[string]interface{}{"table": strings.TrimSpace(rctx.Str("table")), "enabled": true, "retention": rctx.Str("retention")})
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		table := strings.TrimSpace(rctx.Str("table"))
-		retention := rctx.Str("retention")
-		stop := rctx.StartSpinner("Enabling audit logging for " + table)
-		defer stop()
-		data, err := rctx.CallAPITyped("POST", appAuditSetPath(appID),
-			map[string]interface{}{"env": rctx.Str("env")},
-			map[string]interface{}{"table": table, "enabled": true, "retention": retention})
-		stop()
-		if err != nil {
-			return withAppsHint(err, dbAuditSetHint)
-		}
-		st := auditSetStatus(data, table)
-		ret := common.GetString(st, "retention")
-		if ret == "" {
-			ret = retention
-		}
-		out := map[string]interface{}{"table": common.GetString(st, "table"), "enabled": true, "retention": ret}
-		rctx.OutFormat(out, nil, func(w io.Writer) {
-			fmt.Fprintf(w, "✓ Audit enabled for table '%s' (retention: %s)\n", common.GetString(out, "table"), ret)
-		})
-		return nil
-	},
-}
-
-// AppsDBAuditDisable 关闭某张表的行级审计。
-//
-// POST /apps/{app_id}/db/audit_set，body {table, enabled:false}。
-var AppsDBAuditDisable = common.Shortcut{
-	Service:     appsService,
-	Command:     "+db-audit-disable",
-	Description: "Disable row-change audit logging for a table",
-	Risk:        "write",
-	Tips: []string{
-		"Example: lark-cli apps +db-audit-disable --app-id <app_id> --table orders",
-	},
-	Scopes:    []string{"spark:app:write"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "table", Desc: "table to disable audit for", Required: true},
-		{Name: "env", Default: "online", Enum: []string{"dev", "online"}, Desc: "target db environment"},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		_, err := requireAppID(rctx.Str("app-id"))
-		return err
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		return common.NewDryRunAPI().
-			POST(appAuditSetPath(appID)).
-			Desc("Disable table audit").
-			Params(map[string]interface{}{"env": rctx.Str("env")}).
-			Body(map[string]interface{}{"table": strings.TrimSpace(rctx.Str("table")), "enabled": false})
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		table := strings.TrimSpace(rctx.Str("table"))
-		data, err := rctx.CallAPITyped("POST", appAuditSetPath(appID),
-			map[string]interface{}{"env": rctx.Str("env")},
-			map[string]interface{}{"table": table, "enabled": false})
-		if err != nil {
-			return withAppsHint(err, dbAuditSetHint)
-		}
-		st := auditSetStatus(data, table)
-		out := map[string]interface{}{"table": common.GetString(st, "table"), "enabled": false}
-		rctx.OutFormat(out, nil, func(w io.Writer) {
-			fmt.Fprintf(w, "✓ Audit disabled for table '%s'\n", common.GetString(out, "table"))
-		})
-		return nil
-	},
-}
-
-// auditSetStatus 取响应里的 status 对象（缺失时用入参 table 兜底）。
-func auditSetStatus(data map[string]interface{}, table string) map[string]interface{} {
-	if st, ok := data["status"].(map[string]interface{}); ok {
-		if common.GetString(st, "table") == "" {
-			st["table"] = table
-		}
-		return st
-	}
-	return map[string]interface{}{"table": table}
-}

shortcuts/apps/apps_db_audit_status.go

@@ -1,139 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"io"
-	"strings"
-
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// AppsDBAuditStatus 查看数据表的审计开关状态（哪些表开了行级审计、保留期）。
-//
-// GET /apps/{app_id}/db/audit_status。--table 指定单表（无记录时占位 enabled=false）；
-// 不指定返回所有已配置表。json 单表返对象、多表返数组；pretty 单表 key/value、多表表格。
-var AppsDBAuditStatus = common.Shortcut{
-	Service:     appsService,
-	Command:     "+db-audit-status",
-	Description: "Show table audit (row-change tracking) status",
-	Risk:        "read",
-	Tips: []string{
-		"Example: lark-cli apps +db-audit-status --app-id <app_id>",
-		"Check one table: --table orders",
-	},
-	Scopes:    []string{"spark:app:read"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "env", Default: "online", Enum: []string{"dev", "online"}, Desc: "target db environment"},
-		{Name: "table", Desc: "show status for a single table (default: all configured tables)"},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		_, err := requireAppID(rctx.Str("app-id"))
-		return err
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		return common.NewDryRunAPI().
-			GET(appAuditStatusPath(appID)).
-			Desc("Get table audit status").
-			Params(buildAuditStatusParams(rctx))
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		data, err := rctx.CallAPITyped("GET", appAuditStatusPath(appID), buildAuditStatusParams(rctx), nil)
-		if err != nil {
-			return withAppsHint(err, dbChangelogHint)
-		}
-		table := strings.TrimSpace(rctx.Str("table"))
-		items := projectAuditStatusItems(data["items"])
-		// 单表查询但后端无记录 → 占位 enabled=false（与 miaoda 一致）。
-		if table != "" && len(items) == 0 {
-			items = []map[string]interface{}{{"table": table, "enabled": false}}
-		}
-		// json：单表返对象、多表返数组。
-		var out interface{}
-		if table != "" && len(items) == 1 {
-			out = items[0]
-		} else {
-			out = map[string]interface{}{"items": items}
-		}
-		rctx.OutFormat(out, nil, func(w io.Writer) {
-			renderAuditStatusPretty(w, items, table)
-		})
-		return nil
-	},
-}
-
-// buildAuditStatusParams 组装 audit_status 查询参数：env 及可选 table（单表查询）。
-func buildAuditStatusParams(rctx *common.RuntimeContext) map[string]interface{} {
-	params := map[string]interface{}{"env": rctx.Str("env")}
-	if t := strings.TrimSpace(rctx.Str("table")); t != "" {
-		params["table"] = t
-	}
-	return params
-}
-
-// projectAuditStatusItems 透出 {table, enabled, enabled_at?, retention?}。
-func projectAuditStatusItems(raw interface{}) []map[string]interface{} {
-	arr, _ := raw.([]interface{})
-	out := make([]map[string]interface{}, 0, len(arr))
-	for _, it := range arr {
-		m, ok := it.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		row := map[string]interface{}{
-			"table":   common.GetString(m, "table"),
-			"enabled": m["enabled"] == true,
-		}
-		if v := common.GetString(m, "enabled_at"); v != "" {
-			row["enabled_at"] = v
-		}
-		if v := common.GetString(m, "retention"); v != "" {
-			row["retention"] = v
-		}
-		out = append(out, row)
-	}
-	return out
-}
-
-// renderAuditStatusPretty 单表渲染 key/value、多表渲染对齐表格（table/enabled/enabled_at/retention）。
-func renderAuditStatusPretty(w io.Writer, items []map[string]interface{}, table string) {
-	if len(items) == 0 {
-		io.WriteString(w, "No audit configuration found.\n")
-		return
-	}
-	yesNo := func(m map[string]interface{}) string {
-		if m["enabled"] == true {
-			return "yes"
-		}
-		return "no"
-	}
-	get := func(m map[string]interface{}, k string) string { return dashIfEmpty(common.GetString(m, k)) }
-	// 单表 → key/value
-	if table != "" && len(items) == 1 {
-		it := items[0]
-		renderKeyValuePairs(w, [][2]string{
-			{"table", common.GetString(it, "table")},
-			{"enabled", yesNo(it)},
-			{"enabled_at", get(it, "enabled_at")},
-			{"retention", get(it, "retention")},
-		})
-		return
-	}
-	// 多表 → 表格
-	headers := []string{"table", "enabled", "enabled_at", "retention"}
-	rows := make([][]string, 0, len(items))
-	for _, it := range items {
-		rows = append(rows, []string{common.GetString(it, "table"), yesNo(it), get(it, "enabled_at"), get(it, "retention")})
-	}
-	renderAlignedTable(w, headers, rows)
-}

shortcuts/apps/apps_db_audit_test.go

@@ -1,316 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"encoding/json"
-	"errors"
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-const (
-	dbAuditStatusURL = "/open-apis/spark/v1/apps/app_x/db/audit_status"
-	dbAuditSetURL    = "/open-apis/spark/v1/apps/app_x/db/audit_set"
-	dbAuditListURL   = "/open-apis/spark/v1/apps/app_x/db/audit_list"
-	dbTablesListURL  = "/open-apis/spark/v1/apps/app_x/tables"
-)
-
-// ── audit-status ──
-
-// TestAppsDBAuditStatus_SingleTableObjectWithPlaceholder 验证单表查询无记录时返回 enabled:false 的占位对象（非数组）。
-func TestAppsDBAuditStatus_SingleTableObjectWithPlaceholder(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbAuditStatusURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"items": []interface{}{}}},
-	})
-	if err := runAppsShortcut(t, AppsDBAuditStatus,
-		[]string{"+db-audit-status", "--app-id", "app_x", "--table", "orders", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	// 单表无记录 → 占位对象 enabled:false（不是数组）。
-	var env struct {
-		Data struct {
-			Table   string `json:"table"`
-			Enabled bool   `json:"enabled"`
-		} `json:"data"`
-	}
-	if err := json.Unmarshal([]byte(stdout.String()), &env); err != nil {
-		t.Fatalf("decode: %v\n%s", err, stdout.String())
-	}
-	if env.Data.Table != "orders" || env.Data.Enabled {
-		t.Fatalf("expected placeholder {orders,false}, got %+v", env.Data)
-	}
-}
-
-// TestAppsDBAuditStatus_MultiTablePrettyTable 验证多表 pretty 输出含 enabled/yes/no 列与 retention 值。
-func TestAppsDBAuditStatus_MultiTablePrettyTable(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbAuditStatusURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"items": []interface{}{
-			map[string]interface{}{"table": "orders", "enabled": true, "enabled_at": "2026-04-15T10:30:00Z", "retention": "30d"},
-			map[string]interface{}{"table": "users", "enabled": false},
-		}}},
-	})
-	if err := runAppsShortcut(t, AppsDBAuditStatus,
-		[]string{"+db-audit-status", "--app-id", "app_x", "--format", "pretty", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	got := stdout.String()
-	if !strings.Contains(got, "enabled") || !strings.Contains(got, "yes") || !strings.Contains(got, "no") || !strings.Contains(got, "30d") {
-		t.Fatalf("pretty table malformed:\n%s", got)
-	}
-}
-
-// ── audit-enable / disable ──
-
-// TestAppsDBAuditEnable_RequiresTableAndValidRetention 验证缺 --table 报必填错、非法 --retention 报 ValidationError。
-func TestAppsDBAuditEnable_RequiresTableAndValidRetention(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	// 缺 --table → cobra required, exit 1
-	if err := runAppsShortcut(t, AppsDBAuditEnable,
-		[]string{"+db-audit-enable", "--app-id", "app_x", "--as", "user"}, factory, stdout); err == nil {
-		t.Fatalf("expected required --table error")
-	}
-	// 非法 retention → enum 校验 (validation)
-	factory2, stdout2, _ := newAppsExecuteFactory(t)
-	err := runAppsShortcut(t, AppsDBAuditEnable,
-		[]string{"+db-audit-enable", "--app-id", "app_x", "--table", "orders", "--retention", "99d", "--as", "user"}, factory2, stdout2)
-	var ve *errs.ValidationError
-	if !errors.As(err, &ve) {
-		t.Fatalf("err = %T %v, want *errs.ValidationError", err, err)
-	}
-	if ve.Param != "--retention" {
-		t.Fatalf("Param = %q, want --retention", ve.Param)
-	}
-}
-
-// TestAppsDBAuditEnable_DryRunAndSuccess 验证 dry-run 发出 enabled:true+retention 的 POST，成功时打印 pretty 确认行。
-func TestAppsDBAuditEnable_DryRunAndSuccess(t *testing.T) {
-	// dry-run body {table, enabled:true, retention}
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	if err := runAppsShortcut(t, AppsDBAuditEnable,
-		[]string{"+db-audit-enable", "--app-id", "app_x", "--table", "orders", "--retention", "30d", "--dry-run", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("dry-run err=%v", err)
-	}
-	var env struct {
-		API []struct {
-			Method string                 `json:"method"`
-			URL    string                 `json:"url"`
-			Body   map[string]interface{} `json:"body"`
-		} `json:"api"`
-	}
-	_ = json.Unmarshal([]byte(stdout.String()), &env)
-	a := env.API[0]
-	if a.Method != "POST" || a.URL != dbAuditSetURL || a.Body["enabled"] != true || a.Body["retention"] != "30d" || a.Body["table"] != "orders" {
-		t.Fatalf("dry-run = %s %s body=%v", a.Method, a.URL, a.Body)
-	}
-
-	// success
-	factory2, stdout2, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: dbAuditSetURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"status": map[string]interface{}{"table": "orders", "enabled": true, "retention": "30d"}}},
-	})
-	if err := runAppsShortcut(t, AppsDBAuditEnable,
-		[]string{"+db-audit-enable", "--app-id", "app_x", "--table", "orders", "--retention", "30d", "--format", "pretty", "--as", "user"}, factory2, stdout2); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	if !strings.Contains(stdout2.String(), "✓ Audit enabled for table 'orders' (retention: 30d)") {
-		t.Fatalf("pretty: %s", stdout2.String())
-	}
-}
-
-// TestAppsDBAuditDisable_DryRunAndSuccess 验证 dry-run 发出 enabled:false 的 POST，成功时打印 pretty 确认行。
-func TestAppsDBAuditDisable_DryRunAndSuccess(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	if err := runAppsShortcut(t, AppsDBAuditDisable,
-		[]string{"+db-audit-disable", "--app-id", "app_x", "--table", "orders", "--dry-run", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("dry-run err=%v", err)
-	}
-	var env struct {
-		API []struct {
-			Body map[string]interface{} `json:"body"`
-		} `json:"api"`
-	}
-	_ = json.Unmarshal([]byte(stdout.String()), &env)
-	if env.API[0].Body["enabled"] != false || env.API[0].Body["table"] != "orders" {
-		t.Fatalf("dry-run body=%v (want enabled:false)", env.API[0].Body)
-	}
-
-	factory2, stdout2, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: dbAuditSetURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"status": map[string]interface{}{"table": "orders", "enabled": false}}},
-	})
-	if err := runAppsShortcut(t, AppsDBAuditDisable,
-		[]string{"+db-audit-disable", "--app-id", "app_x", "--table", "orders", "--format", "pretty", "--as", "user"}, factory2, stdout2); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	if !strings.Contains(stdout2.String(), "✓ Audit disabled for table 'orders'") {
-		t.Fatalf("pretty: %s", stdout2.String())
-	}
-}
-
-// ── audit-list ──
-
-// TestAppsDBAuditList_RequiresTable 验证缺 --table 时报必填错误。
-func TestAppsDBAuditList_RequiresTable(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	if err := runAppsShortcut(t, AppsDBAuditList,
-		[]string{"+db-audit-list", "--app-id", "app_x", "--as", "user"}, factory, stdout); err == nil {
-		t.Fatalf("expected required --table error")
-	}
-}
-
-// TestAppsDBAuditList_DryRunJoinsTables 验证 dry-run 将多个 --table 合并为 tables=orders,users 且归一化 since。
-func TestAppsDBAuditList_DryRunJoinsTables(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	if err := runAppsShortcut(t, AppsDBAuditList,
-		[]string{"+db-audit-list", "--app-id", "app_x", "--table", "orders", "--table", "users", "--since", "7d", "--dry-run", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("dry-run err=%v", err)
-	}
-	var env struct {
-		API []struct {
-			Method string                 `json:"method"`
-			URL    string                 `json:"url"`
-			Params map[string]interface{} `json:"params"`
-		} `json:"api"`
-	}
-	_ = json.Unmarshal([]byte(stdout.String()), &env)
-	a := env.API[0]
-	if a.Method != "GET" || a.URL != dbAuditListURL || a.Params["tables"] != "orders,users" {
-		t.Fatalf("dry-run = %s %s tables=%v", a.Method, a.URL, a.Params["tables"])
-	}
-	if s, _ := a.Params["since"].(string); !strings.HasSuffix(s, "Z") {
-		t.Fatalf("since not normalized: %v", a.Params["since"])
-	}
-}
-
-// 单表查询：不预过滤、直接打 audit_list（后端就 not-found/not-enabled 报错），无 skipped。
-// TestAppsDBAuditList_SingleTableNoPreflight 验证单表查询不预过滤、operator/before/after 还原为对象、无 skipped。
-func TestAppsDBAuditList_SingleTableNoPreflight(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbAuditListURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"has_more": false, "page_token": "",
-			"items": []interface{}{map[string]interface{}{
-				"event_id": "01525", "event_time": "2026-04-16T10:30:00Z", "target_table": "users",
-				"type": "UPDATE", "operator": `{"id":"7311","name":"alice"}`, "summary": "UPDATE 1 field",
-				"before": `{"amount":100}`, "after": `{"amount":999}`,
-			}},
-		}},
-	})
-	if err := runAppsShortcut(t, AppsDBAuditList,
-		[]string{"+db-audit-list", "--app-id", "app_x", "--table", "users", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	got := stdout.String()
-	// operator → 对象；before/after → 还原成对象（非字符串）。
-	for _, want := range []string{`"name": "alice"`, `"before"`, `"amount": 100`, `"after"`, `"amount": 999`} {
-		if !strings.Contains(got, want) {
-			t.Errorf("missing %q:\n%s", want, got)
-		}
-	}
-	if strings.Contains(got, `"skipped"`) {
-		t.Errorf("single-table query must not emit skipped:\n%s", got)
-	}
-	if strings.Contains(got, `"before": "{`) {
-		t.Errorf("before should be an object, not a JSON string:\n%s", got)
-	}
-}
-
-// TestAppsDBAuditList_SingleTableEmptyPretty 验证单表无事件时不报错、pretty 打印 "No audit events found." 且无 Skipped。
-func TestAppsDBAuditList_SingleTableEmptyPretty(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbAuditListURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"items": []interface{}{}}},
-	})
-	if err := runAppsShortcut(t, AppsDBAuditList,
-		[]string{"+db-audit-list", "--app-id", "app_x", "--table", "orders", "--format", "pretty", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("empty audit list should NOT error (ok read), got %v", err)
-	}
-	got := stdout.String()
-	if !strings.Contains(got, "No audit events found.") || strings.Contains(got, "Skipped") {
-		t.Fatalf("expected empty, no skipped for single table:\n%s", got)
-	}
-}
-
-// 多表查询：CLI 用 schema（存在性）+ status（审计开关）预过滤，只把有效表传给 audit_list，
-// 不存在 / 未开启审计的表进 skipped。
-// TestAppsDBAuditList_MultiTablePreflightFilters 验证多表查询用 schema+status 预过滤，仅传有效表，不存在/未开审计的表进 skipped。
-func TestAppsDBAuditList_MultiTablePreflightFilters(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	// schema：orders/users/carts 存在，ghost 不存在。
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbTablesListURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"has_more": false, "items": []interface{}{
-			map[string]interface{}{"name": "orders"}, map[string]interface{}{"name": "users"}, map[string]interface{}{"name": "carts"},
-		}}},
-	})
-	// status：orders/users 开启审计，carts 未开启。
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbAuditStatusURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"items": []interface{}{
-			map[string]interface{}{"table": "orders", "enabled": true}, map[string]interface{}{"table": "users", "enabled": true},
-			map[string]interface{}{"table": "carts", "enabled": false},
-		}}},
-	})
-	// audit_list 只应被传入有效表 orders,users。
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbAuditListURL,
-		OnMatch: func(req *http.Request) {
-			if got := req.URL.Query().Get("tables"); got != "orders,users" {
-				t.Errorf("audit_list tables = %q, want orders,users (filtered)", got)
-			}
-		},
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"has_more": false, "items": []interface{}{
-			map[string]interface{}{"event_id": "e1", "event_time": "2026-04-16T10:30:00Z", "target_table": "orders", "type": "INSERT", "summary": "INSERT"},
-		}}},
-	})
-	if err := runAppsShortcut(t, AppsDBAuditList,
-		[]string{"+db-audit-list", "--app-id", "app_x", "--table", "orders", "--table", "users", "--table", "carts", "--table", "ghost", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	got := stdout.String()
-	// skipped：carts(audit not enabled) + ghost(table not found)，结构化 {table,reason}。
-	for _, want := range []string{`"skipped"`, `"table": "carts"`, `"reason": "audit not enabled"`, `"table": "ghost"`, `"reason": "table not found"`} {
-		if !strings.Contains(got, want) {
-			t.Errorf("missing %q:\n%s", want, got)
-		}
-	}
-}
-
-// 多表查询且全部被过滤掉 → 不调 audit_list，直接空 + skipped 提示。
-// TestAppsDBAuditList_MultiTableAllFilteredSkipsQuery 验证多表全部被过滤时跳过 audit_list 调用，直接输出空结果加 Skipped 提示。
-func TestAppsDBAuditList_MultiTableAllFilteredSkipsQuery(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbTablesListURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"has_more": false, "items": []interface{}{
-			map[string]interface{}{"name": "orders"},
-		}}},
-	})
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbAuditStatusURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"items": []interface{}{}}},
-	})
-	// 不注册 audit_list：若被调用会命中未注册请求而报错。
-	if err := runAppsShortcut(t, AppsDBAuditList,
-		[]string{"+db-audit-list", "--app-id", "app_x", "--table", "ghost1", "--table", "ghost2", "--format", "pretty", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("all-filtered should still succeed (empty), got %v", err)
-	}
-	got := stdout.String()
-	if !strings.Contains(got, "No audit events found.") || !strings.Contains(got, "Skipped 2 of 2 tables") {
-		t.Fatalf("expected empty + 'Skipped 2 of 2 tables':\n%s", got)
-	}
-}

shortcuts/apps/apps_db_changelog_list.go

@@ -1,150 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"strings"
-
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-const dbChangelogHint = "verify --app-id is correct; if targeting --env dev, create it first with `lark-cli apps +db-env-create --app-id <app_id> --env dev`"
-
-// AppsDBChangelogList 列出应用数据库的 DDL 变更记录（建表/改表/索引等结构变更追溯）。
-//
-// GET /apps/{app_id}/db/changelog_list（cursor 分页）。过滤：--table、--since/--until（多格式时间）。
-// --change-id 精确查单条（命中返单条、否则空）。operator 后端以 JSON 字符串透传 {id,name}，
-// json 还原成对象、pretty 只展示 name。
-var AppsDBChangelogList = common.Shortcut{
-	Service:     appsService,
-	Command:     "+db-changelog-list",
-	Description: "List a Miaoda app database's DDL change history (cursor pagination)",
-	Risk:        "read",
-	Tips: []string{
-		"Example: lark-cli apps +db-changelog-list --app-id <app_id>",
-		"Pin a single change with --change-id; filter time with --since 7d / --until 2026-04-15.",
-	},
-	Scopes:    []string{"spark:app:read"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "env", Default: "online", Enum: []string{"dev", "online"}, Desc: "target db environment"},
-		{Name: "table", Desc: "filter by target table"},
-		{Name: "change-id", Desc: "look up a single change by id (returns that one record only)"},
-		{Name: "since", Desc: "filter: changed at or after; relative (7d/2h) | date | datetime | ISO 8601 w/ TZ"},
-		{Name: "until", Desc: "filter: changed at or before; same formats as --since"},
-		{Name: "page-size", Type: "int", Default: "20", Desc: "page size"},
-		{Name: "page-token", Desc: "pagination cursor from previous response"},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		if _, err := requireAppID(rctx.Str("app-id")); err != nil {
-			return err
-		}
-		return normalizeTimeFlags(rctx, "since", "until")
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		return common.NewDryRunAPI().
-			GET(appChangelogListPath(appID)).
-			Desc("List Miaoda app DDL changelog").
-			Params(buildChangelogParams(rctx))
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		data, err := rctx.CallAPITyped("GET", appChangelogListPath(appID), buildChangelogParams(rctx), nil)
-		if err != nil {
-			return withAppsHint(err, dbChangelogHint)
-		}
-		items := projectChangelogItems(data["items"])
-		data["items"] = items
-		changeID := strings.TrimSpace(rctx.Str("change-id"))
-		rctx.OutFormat(data, nil, func(w io.Writer) {
-			renderChangelogPretty(w, items, changeID)
-		})
-		return nil
-	},
-}
-
-// buildChangelogParams 组装 changelog_list 查询参数：env / page_size 及可选 table/change_id/since/until/page_token。
-func buildChangelogParams(rctx *common.RuntimeContext) map[string]interface{} {
-	params := map[string]interface{}{
-		"env":       rctx.Str("env"),
-		"page_size": rctx.Int("page-size"),
-	}
-	addStr := func(flag, key string) {
-		if v := strings.TrimSpace(rctx.Str(flag)); v != "" {
-			params[key] = v
-		}
-	}
-	addStr("table", "table")
-	addStr("change-id", "change_id")
-	addStr("since", "since")
-	addStr("until", "until")
-	addStr("page-token", "page_token")
-	return params
-}
-
-type changelogItem struct {
-	ChangeID    string       `json:"change_id"`
-	ChangedAt   string       `json:"changed_at"`
-	Operator    *operatorRef `json:"operator,omitempty"`
-	TargetTable string       `json:"target_table"`
-	ChangeType  string       `json:"change_type"`
-	Summary     string       `json:"summary"`
-	Statement   string       `json:"statement,omitempty"`
-}
-
-// projectChangelogItems 把服务端原始 DDL 变更记录投影为白名单 changelogItem（operator 解析成对象）。
-func projectChangelogItems(raw interface{}) []changelogItem {
-	arr, _ := raw.([]interface{})
-	out := make([]changelogItem, 0, len(arr))
-	for _, it := range arr {
-		m, ok := it.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		out = append(out, changelogItem{
-			ChangeID:    common.GetString(m, "change_id"),
-			ChangedAt:   common.GetString(m, "changed_at"),
-			Operator:    parseOperator(common.GetString(m, "operator")),
-			TargetTable: common.GetString(m, "target_table"),
-			ChangeType:  common.GetString(m, "change_type"),
-			Summary:     common.GetString(m, "summary"),
-			Statement:   common.GetString(m, "statement"),
-		})
-	}
-	return out
-}
-
-// renderChangelogPretty 6 列：change_id / changed_at / operator(name) / target_table / change_type / summary。
-func renderChangelogPretty(w io.Writer, items []changelogItem, changeID string) {
-	if len(items) == 0 {
-		if changeID != "" {
-			fmt.Fprintf(w, "No DDL change with id=%s found.\n", changeID)
-		} else {
-			io.WriteString(w, "No DDL changes found.\n")
-		}
-		return
-	}
-	headers := []string{"change_id", "changed_at", "operator", "target_table", "change_type", "summary"}
-	rows := make([][]string, 0, len(items))
-	for _, it := range items {
-		rows = append(rows, []string{
-			it.ChangeID,
-			dashIfEmpty(it.ChangedAt),
-			operatorName(it.Operator),
-			dashIfEmpty(it.TargetTable),
-			it.ChangeType,
-			dashIfEmpty(it.Summary),
-		})
-	}
-	renderAlignedTable(w, headers, rows)
-}

shortcuts/apps/apps_db_changelog_list_test.go

@@ -1,143 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"encoding/json"
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-const dbChangelogURL = "/open-apis/spark/v1/apps/app_x/db/changelog_list"
-
-// TestAppsDBChangelogList_RequiresAppID 验证空白 --app-id 报 --app-id 的 ValidationError。
-func TestAppsDBChangelogList_RequiresAppID(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	err := runAppsShortcut(t, AppsDBChangelogList,
-		[]string{"+db-changelog-list", "--app-id", "  ", "--as", "user"}, factory, stdout)
-	var ve *errs.ValidationError
-	if !errors.As(err, &ve) {
-		t.Fatalf("err = %T %v, want *errs.ValidationError", err, err)
-	}
-	if ve.Param != "--app-id" {
-		t.Fatalf("Param = %q, want --app-id", ve.Param)
-	}
-}
-
-// TestAppsDBChangelogList_DryRunFiltersAndTimeNormalize 验证 dry-run 透传 env/table/change_id 过滤参数并将 since 归一化为 RFC3339 UTC。
-func TestAppsDBChangelogList_DryRunFiltersAndTimeNormalize(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	if err := runAppsShortcut(t, AppsDBChangelogList,
-		[]string{"+db-changelog-list", "--app-id", "app_x", "--env", "dev", "--table", "orders",
-			"--change-id", "01J", "--since", "2026-01-01", "--page-size", "5", "--dry-run", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("dry-run err=%v", err)
-	}
-	var env struct {
-		API []struct {
-			Method string                 `json:"method"`
-			URL    string                 `json:"url"`
-			Params map[string]interface{} `json:"params"`
-		} `json:"api"`
-	}
-	_ = json.Unmarshal([]byte(stdout.String()), &env)
-	a := env.API[0]
-	if a.Method != "GET" || a.URL != dbChangelogURL {
-		t.Fatalf("dry-run = %s %s", a.Method, a.URL)
-	}
-	if a.Params["env"] != "dev" || a.Params["table"] != "orders" || a.Params["change_id"] != "01J" {
-		t.Fatalf("params = %v", a.Params)
-	}
-	if s, _ := a.Params["since"].(string); !strings.HasSuffix(s, "Z") {
-		t.Fatalf("since not normalized to RFC3339 UTC: %v", a.Params["since"])
-	}
-}
-
-// TestAppsDBChangelogList_RejectsBadSince 验证不可解析的 --since 报 --since 的 ValidationError。
-func TestAppsDBChangelogList_RejectsBadSince(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	err := runAppsShortcut(t, AppsDBChangelogList,
-		[]string{"+db-changelog-list", "--app-id", "app_x", "--since", "notatime", "--as", "user"}, factory, stdout)
-	var ve *errs.ValidationError
-	if !errors.As(err, &ve) {
-		t.Fatalf("err = %T %v, want *errs.ValidationError", err, err)
-	}
-	if ve.Param != "--since" {
-		t.Fatalf("Param = %q, want --since", ve.Param)
-	}
-}
-
-// TestAppsDBChangelogList_SuccessParsesOperator 验证成功响应中 operator JSON 串被解析为对象并输出变更字段。
-func TestAppsDBChangelogList_SuccessParsesOperator(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbChangelogURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"has_more": false, "page_token": "",
-			"items": []interface{}{map[string]interface{}{
-				"change_id": "01J", "changed_at": "2026-04-15T10:30:00Z",
-				"operator": `{"id":"7311","name":"alice"}`, "target_table": "orders",
-				"change_type": "ALTER_TABLE", "summary": "add column", "statement": "ALTER TABLE orders ...",
-			}},
-		}},
-	})
-	if err := runAppsShortcut(t, AppsDBChangelogList,
-		[]string{"+db-changelog-list", "--app-id", "app_x", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	got := stdout.String()
-	for _, want := range []string{`"operator"`, `"name": "alice"`, `"id": "7311"`, `"change_type": "ALTER_TABLE"`, `"statement"`} {
-		if !strings.Contains(got, want) {
-			t.Errorf("missing %q:\n%s", want, got)
-		}
-	}
-}
-
-// TestAppsDBChangelogList_ChangeIDNotFoundPretty 验证按 --change-id 查询无结果时 pretty 打印 not-found 提示。
-func TestAppsDBChangelogList_ChangeIDNotFoundPretty(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbChangelogURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"items": []interface{}{}}},
-	})
-	if err := runAppsShortcut(t, AppsDBChangelogList,
-		[]string{"+db-changelog-list", "--app-id", "app_x", "--change-id", "nope", "--format", "pretty", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	if !strings.Contains(stdout.String(), "No DDL change with id=nope found.") {
-		t.Fatalf("expected not-found message, got: %s", stdout.String())
-	}
-}
-
-// TestParseOperator_Cases 验证 parseOperator 处理合法 JSON、空 name 回退 id、非 JSON 原样、空串返回 nil，以及 operatorName(nil) 为占位符。
-func TestParseOperator_Cases(t *testing.T) {
-	if op := parseOperator(`{"id":"1","name":"a"}`); op == nil || op.ID != "1" || op.Name != "a" {
-		t.Fatalf("valid: %#v", op)
-	}
-	if op := parseOperator(`{"id":"1","name":""}`); op == nil || op.Name != "1" {
-		t.Fatalf("name fallback to id: %#v", op)
-	}
-	if op := parseOperator("plain-user"); op == nil || op.ID != "plain-user" || op.Name != "plain-user" {
-		t.Fatalf("non-json raw: %#v", op)
-	}
-	if op := parseOperator(""); op != nil {
-		t.Fatalf("empty → nil, got %#v", op)
-	}
-	if operatorName(nil) != "—" {
-		t.Fatalf("nil operatorName should be —")
-	}
-}
-
-// TestSafeParseJSON_Cases 验证 safeParseJSON 合法 JSON 解析为对象、非法 JSON 原样返回字符串。
-func TestSafeParseJSON_Cases(t *testing.T) {
-	if v := safeParseJSON(`{"a":1}`); v == nil {
-		t.Fatalf("valid json → object")
-	}
-	if v, ok := safeParseJSON("not json").(string); !ok || v != "not json" {
-		t.Fatalf("invalid json → raw string, got %v", v)
-	}
-}

shortcuts/apps/apps_db_data_export.go

@@ -1,189 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io"
-	"net/http"
-	"path/filepath"
-	"strconv"
-	"strings"
-
-	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/extension/fileio"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-const dbDataExportMaxRows = 5000
-const dbDataExportMaxBytes = 1 * 1024 * 1024 // 1 MB
-
-const dbDataExportHint = "verify --app-id and --table; if too large, filter rows with +db-execute (WHERE/LIMIT) and export smaller subsets"
-
-// AppsDBDataExport 把应用数据表导出到本地文件（csv/json/sql）。
-//
-// GET /apps/{app_id}/db/data_export，返回原始字节（非 JSON 信封）。
-// 行数不随导出文件返回：CLI 原子编排——先查 GetAppTableRecordList 的 total，再导出文件。
-// 数据格式由 --output 扩展名推断（默认 csv，缺省输出 <table>.csv）；上限 5000 行 / 1 MB。
-var AppsDBDataExport = common.Shortcut{
-	Service:     appsService,
-	Command:     "+db-data-export",
-	Description: "Export rows from a Miaoda app table to a local file (csv/json/sql)",
-	Risk:        "read",
-	Tips: []string{
-		"Example: lark-cli apps +db-data-export --app-id <app_id> --table orders --output ./orders.csv",
-		"Format follows the --output extension: .csv / .json / .sql (default csv).",
-	},
-	Scopes:    []string{"spark:app:read"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "table", Desc: "source table", Required: true},
-		{Name: "output", Desc: "local output path; extension picks format .csv/.json/.sql (default: <table>.csv)"},
-		{Name: "limit", Type: "int", Default: "5000", Desc: "max rows to export (1..5000)"},
-		{Name: "env", Default: "online", Enum: []string{"dev", "online"}, Desc: "source db environment"},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		if _, err := requireAppID(rctx.Str("app-id")); err != nil {
-			return err
-		}
-		if strings.TrimSpace(rctx.Str("table")) == "" {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--table is required").WithParam("--table")
-		}
-		if n := rctx.Int("limit"); n <= 0 || n > dbDataExportMaxRows {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--limit must be a positive integer ≤ %d", dbDataExportMaxRows).WithParam("--limit")
-		}
-		if _, _, err := exportFormatAndOutput(rctx); err != nil {
-			return err
-		}
-		return nil
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		format, _, _ := exportFormatAndOutput(rctx)
-		return common.NewDryRunAPI().
-			GET(appDataExportPath(appID)).
-			Desc("Export Miaoda app table data (raw bytes)").
-			Params(map[string]interface{}{
-				"env": rctx.Str("env"), "table": strings.TrimSpace(rctx.Str("table")),
-				"format": format, "limit": rctx.Int("limit"),
-			})
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		table := strings.TrimSpace(rctx.Str("table"))
-		format, out, err := exportFormatAndOutput(rctx)
-		if err != nil {
-			return err
-		}
-
-		// 原子编排第 1 步：先查总行数（records 列表的 total），再导出文件。
-		// total 查询失败不阻断导出——回退到按导出文件内容数行。
-		total, totalErr := queryExportTotal(rctx, appID, rctx.Str("env"), table)
-
-		resp, err := rctx.DoAPI(&larkcore.ApiReq{
-			HttpMethod: http.MethodGet,
-			ApiPath:    appDataExportPath(appID),
-			QueryParams: larkcore.QueryParams{
-				"env":    []string{rctx.Str("env")},
-				"table":  []string{table},
-				"format": []string{format},
-				"limit":  []string{strconv.Itoa(rctx.Int("limit"))},
-			},
-		})
-		if err != nil {
-			return withAppsHint(errs.NewNetworkError(errs.SubtypeNetworkTransport, "export request failed").WithCause(err).WithRetryable(), dbDataExportHint)
-		}
-		// 成功是原始字节；业务错误网关以 JSON 信封 {code,msg} 返回（以 '{' 开头）。
-		if b := bytes.TrimSpace(resp.RawBody); len(b) > 0 && b[0] == '{' {
-			if _, cerr := rctx.ClassifyAPIResponse(resp); cerr != nil {
-				return withAppsHint(cerr, dbDataExportHint)
-			}
-		}
-		if resp.StatusCode >= 400 {
-			return withAppsHint(errs.NewNetworkError(errs.SubtypeNetworkServer, "export failed: HTTP %d", resp.StatusCode).WithRetryable(), dbDataExportHint)
-		}
-		body := resp.RawBody
-		if len(body) > dbDataExportMaxBytes {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "export exceeds 1 MB limit (%d bytes); filter rows with +db-execute (WHERE/LIMIT) and export smaller subsets", len(body))
-		}
-
-		saved, err := rctx.FileIO().Save(out, fileio.SaveOptions{
-			ContentType:   resp.Header.Get("Content-Type"),
-			ContentLength: int64(len(body)),
-		}, bytes.NewReader(body))
-		if err != nil {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--output: %v", err).WithParam("--output")
-		}
-		// 行数取自预查的 total（导出最多 limit 行，故取 min）；total 查询失败时按导出内容数行兜底。
-		rows := 0
-		if totalErr == nil {
-			rows = total
-			if lim := rctx.Int("limit"); rows > lim {
-				rows = lim
-			}
-		} else {
-			rows = countDataRows(body, format)
-		}
-		resolved, perr := rctx.FileIO().ResolvePath(out)
-		if perr != nil || resolved == "" {
-			resolved = out
-		}
-		result := map[string]interface{}{
-			"table": table, "output": resolved, "format": format,
-			"rows": rows, "size_bytes": saved.Size(),
-		}
-		rctx.OutFormat(result, nil, func(w io.Writer) {
-			fmt.Fprintf(w, "✓ Exported %s → %s (%d rows)\n", table, resolved, rows)
-		})
-		return nil
-	},
-}
-
-// queryExportTotal 调 GetAppTableRecordList（page_size=1）取 total（符合条件的记录总数）。
-// 该接口与 +db-data-export 同为 spark:app:read scope，避免导出命令被迫升级到写权限。
-func queryExportTotal(rctx *common.RuntimeContext, appID, env, table string) (int, error) {
-	raw, err := rctx.CallAPITyped("GET", appTableRecordsPath(appID, table),
-		map[string]interface{}{"env": env, "page_size": 1}, nil)
-	if err != nil {
-		return 0, err
-	}
-	return totalAsInt(raw["total"]), nil
-}
-
-// totalAsInt 把 total 解析成 int，兼容 JSON number 与 i64-as-string 两种 wire 形态。
-func totalAsInt(v interface{}) int {
-	if f, ok := numericAsFloat(v); ok {
-		return int(f)
-	}
-	if s, ok := v.(string); ok {
-		if n, err := strconv.Atoi(strings.TrimSpace(s)); err == nil {
-			return n
-		}
-	}
-	return 0
-}
-
-// exportFormatAndOutput 由 --output 推断数据格式与落盘路径：
-// 给了 --output → 取其扩展名定 format（csv/json/sql）；未给 → 默认 csv、输出 <table>.csv。
-func exportFormatAndOutput(rctx *common.RuntimeContext) (format, outPath string, err error) {
-	table := strings.TrimSpace(rctx.Str("table"))
-	out := strings.TrimSpace(rctx.Str("output"))
-	if out == "" {
-		return "csv", table + ".csv", nil
-	}
-	f, ferr := resolveDataFormat(filepath.Ext(out), true)
-	if ferr != nil {
-		return "", "", ferr
-	}
-	return f, out, nil
-}

shortcuts/apps/apps_db_data_export_test.go

@@ -1,193 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"encoding/json"
-	"errors"
-	"net/http"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-const dbDataExportURL = "/open-apis/spark/v1/apps/app_x/db/data_export"
-const dbOrdersRecordsURL = "/open-apis/spark/v1/apps/app_x/tables/orders/records"
-
-// TestAppsDBDataExport_RequiresTable 验证缺 --table 时报必填错误。
-func TestAppsDBDataExport_RequiresTable(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	// 缺 --table → cobra required-flag, exit 1
-	err := runAppsShortcut(t, AppsDBDataExport,
-		[]string{"+db-data-export", "--app-id", "app_x", "--as", "user"}, factory, stdout)
-	if err == nil {
-		t.Fatalf("expected required-flag error for missing --table")
-	}
-}
-
-// TestAppsDBDataExport_RejectsBadLimit 验证越界 --limit（0/-1/5001）均报 --limit 的 ValidationError。
-func TestAppsDBDataExport_RejectsBadLimit(t *testing.T) {
-	for _, lim := range []string{"0", "-1", "5001"} {
-		factory, stdout, _ := newAppsExecuteFactory(t)
-		err := runAppsShortcut(t, AppsDBDataExport,
-			[]string{"+db-data-export", "--app-id", "app_x", "--table", "orders", "--limit", lim, "--as", "user"}, factory, stdout)
-		var ve *errs.ValidationError
-		if !errors.As(err, &ve) {
-			t.Fatalf("limit=%s err = %T %v, want *errs.ValidationError", lim, err, err)
-		}
-		if ve.Param != "--limit" {
-			t.Fatalf("limit=%s Param = %q, want --limit", lim, ve.Param)
-		}
-	}
-}
-
-// TestAppsDBDataExport_RejectsBadOutputExtension 验证不支持的 --output 扩展名（.xml）报校验错误。
-func TestAppsDBDataExport_RejectsBadOutputExtension(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	err := runAppsShortcut(t, AppsDBDataExport,
-		[]string{"+db-data-export", "--app-id", "app_x", "--table", "orders", "--output", "dump.xml", "--as", "user"}, factory, stdout)
-	p, ok := errs.ProblemOf(err)
-	if !ok || p.Category != errs.CategoryValidation || p.Subtype != errs.SubtypeInvalidArgument {
-		t.Fatalf("expected unsupported-format validation for .xml, got %v", err)
-	}
-}
-
-// dry-run：format 跟随 --output 扩展名；缺省 csv。
-// TestAppsDBDataExport_DryRunFormatFromOutput 验证 dry-run 的 format 参数跟随 --output 扩展名、缺省为 csv，并带 limit。
-func TestAppsDBDataExport_DryRunFormatFromOutput(t *testing.T) {
-	cases := []struct{ output, wantFmt string }{
-		{"", "csv"}, {"orders.csv", "csv"}, {"orders.json", "json"}, {"dump.sql", "sql"},
-	}
-	for _, c := range cases {
-		factory, stdout, _ := newAppsExecuteFactory(t)
-		args := []string{"+db-data-export", "--app-id", "app_x", "--table", "orders", "--dry-run", "--as", "user"}
-		if c.output != "" {
-			args = append(args, "--output", c.output)
-		}
-		if err := runAppsShortcut(t, AppsDBDataExport, args, factory, stdout); err != nil {
-			t.Fatalf("dry-run err=%v", err)
-		}
-		var env struct {
-			API []struct {
-				Method string                 `json:"method"`
-				URL    string                 `json:"url"`
-				Params map[string]interface{} `json:"params"`
-			} `json:"api"`
-		}
-		_ = json.Unmarshal([]byte(stdout.String()), &env)
-		a := env.API[0]
-		if a.Method != "GET" || a.URL != dbDataExportURL {
-			t.Fatalf("dry-run = %s %s", a.Method, a.URL)
-		}
-		if a.Params["format"] != c.wantFmt || a.Params["table"] != "orders" {
-			t.Errorf("output=%q params.format=%v want %q", c.output, a.Params["format"], c.wantFmt)
-		}
-		if _, ok := a.Params["limit"]; !ok {
-			t.Errorf("dry-run missing limit param")
-		}
-	}
-}
-
-// 成功：先查 records 列表 total 计行，再把原始字节落盘。
-// TestAppsDBDataExport_SuccessWritesFile 验证成功路径先查 records total 计行、再将导出原始字节落盘并输出 rows/format/table。
-func TestAppsDBDataExport_SuccessWritesFile(t *testing.T) {
-	dir := chdirTemp(t)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	// 第 1 步：records 列表 total=2（行数来源）。
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbOrdersRecordsURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"total": 2, "has_more": false, "items": "[]"}},
-	})
-	// 第 2 步：导出原始字节。
-	reg.Register(&httpmock.Stub{
-		Method:  "GET",
-		URL:     dbDataExportURL,
-		RawBody: []byte("id,name\n1,a\n2,b\n"),
-		Headers: http.Header{"Content-Type": []string{"text/csv"}},
-	})
-	if err := runAppsShortcut(t, AppsDBDataExport,
-		[]string{"+db-data-export", "--app-id", "app_x", "--table", "orders", "--output", "orders.csv", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	b, err := os.ReadFile(dir + "/orders.csv")
-	if err != nil || string(b) != "id,name\n1,a\n2,b\n" {
-		t.Fatalf("output file wrong: %q err=%v", string(b), err)
-	}
-	got := stdout.String()
-	if !strings.Contains(got, `"rows": 2`) || !strings.Contains(got, `"format": "csv"`) || !strings.Contains(got, `"table": "orders"`) {
-		t.Fatalf("output json missing fields:\n%s", got)
-	}
-}
-
-// 行数取自 records total，且按 --limit 截顶（min(total, limit)）。
-// TestAppsDBDataExport_RowsFromTotalCappedByLimit 验证行数取 records total 并按 --limit 截顶（total=10000、limit=100 → rows=100）。
-func TestAppsDBDataExport_RowsFromTotalCappedByLimit(t *testing.T) {
-	chdirTemp(t)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbOrdersRecordsURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"total": 10000, "has_more": true, "items": "[]"}},
-	})
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbDataExportURL,
-		RawBody: []byte("id\n1\n2\n3\n"), Headers: http.Header{"Content-Type": []string{"text/csv"}},
-	})
-	if err := runAppsShortcut(t, AppsDBDataExport,
-		[]string{"+db-data-export", "--app-id", "app_x", "--table", "orders", "--output", "orders.csv", "--limit", "100", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	if !strings.Contains(stdout.String(), `"rows": 100`) {
-		t.Fatalf("expected rows capped to limit 100 from total=10000:\n%s", stdout.String())
-	}
-}
-
-// total 查询失败（records 列表报错）→ 回退按导出文件内容数行，不阻断导出。
-// TestAppsDBDataExport_FallsBackToFileCountWhenTotalUnavailable 验证 records total 查询失败时回退按导出文件内容数行，不阻断落盘。
-func TestAppsDBDataExport_FallsBackToFileCountWhenTotalUnavailable(t *testing.T) {
-	dir := chdirTemp(t)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbOrdersRecordsURL,
-		Body: map[string]interface{}{"code": 1254000, "msg": "records unavailable"},
-	})
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbDataExportURL,
-		RawBody: []byte("id,name\n1,a\n2,b\n3,c\n"), Headers: http.Header{"Content-Type": []string{"text/csv"}},
-	})
-	if err := runAppsShortcut(t, AppsDBDataExport,
-		[]string{"+db-data-export", "--app-id", "app_x", "--table", "orders", "--output", "orders.csv", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("export should still succeed via fallback, got %v", err)
-	}
-	b, _ := os.ReadFile(dir + "/orders.csv")
-	if string(b) != "id,name\n1,a\n2,b\n3,c\n" {
-		t.Fatalf("file not written on fallback path: %q", string(b))
-	}
-	if !strings.Contains(stdout.String(), `"rows": 3`) {
-		t.Fatalf("expected fallback file-count rows:3:\n%s", stdout.String())
-	}
-}
-
-// 业务错误：网关回 JSON 信封 {code,msg}（非原始字节）→ typed error，不落盘。
-// TestAppsDBDataExport_BusinessErrorEnvelope 验证响应为 JSON 错误信封（非原始字节）时返回 typed error 且不落盘。
-func TestAppsDBDataExport_BusinessErrorEnvelope(t *testing.T) {
-	chdirTemp(t)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method:  "GET",
-		URL:     dbDataExportURL,
-		RawBody: []byte(`{"code":1254043,"msg":"table not found"}`),
-		Headers: http.Header{"Content-Type": []string{"application/json"}},
-	})
-	err := runAppsShortcut(t, AppsDBDataExport,
-		[]string{"+db-data-export", "--app-id", "app_x", "--table", "nope", "--output", "nope.csv", "--as", "user"}, factory, stdout)
-	if err == nil {
-		t.Fatalf("expected business error to surface, got nil; stdout=%s", stdout.String())
-	}
-	if _, statErr := os.Stat("nope.csv"); statErr == nil {
-		t.Fatalf("error path must not write the output file")
-	}
-}

shortcuts/apps/apps_db_data_import.go

@@ -1,142 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io"
-	"net/http"
-	"path/filepath"
-	"strings"
-
-	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-const dbDataImportMaxBytes = 1 * 1024 * 1024 // 1 MB
-
-const dbDataImportHint = "verify --app-id and --table; data file must be .csv/.json and ≤1 MB — split larger files and import in batches"
-
-// AppsDBDataImport 把本地 csv/json 文件直传到应用数据表（high-risk-write）。
-//
-// POST /apps/{app_id}/db/data_import，multipart 表单：file_name + 可选 table + 文件本体（与
-// +file-upload / UploadFileForOpenAPI 一致）。文件的格式解析与转换在服务端 integration 层完成
-// （按 file_name 扩展名推断 csv/json），CLI 不再本地解析。表名缺省取文件名（去扩展名）。上限 1 MB。
-var AppsDBDataImport = common.Shortcut{
-	Service:     appsService,
-	Command:     "+db-data-import",
-	Description: "Import rows from a local csv/json file into a Miaoda app table",
-	Risk:        "high-risk-write",
-	Tips: []string{
-		"Example: lark-cli apps +db-data-import --app-id <app_id> --file ./orders.csv --yes",
-		"Table defaults to the file name; override with --table.",
-	},
-	Scopes:    []string{"spark:app:write"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "file", Desc: "local data file (.csv/.json), relative to cwd", Required: true},
-		{Name: "table", Desc: "target table (default: file name without extension)"},
-		{Name: "env", Default: "online", Enum: []string{"dev", "online"}, Desc: "target db environment"},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		if _, err := requireAppID(rctx.Str("app-id")); err != nil {
-			return err
-		}
-		if strings.TrimSpace(rctx.Str("file")) == "" {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--file is required").WithParam("--file")
-		}
-		// 文件名即可校验格式（服务端按扩展名推断）与推断表名，无需读取内容。
-		if _, err := resolveDataFormat(filepath.Ext(rctx.Str("file")), false); err != nil {
-			return err
-		}
-		// 体积守卫前移到 Validate：用 Stat 先查大小（不读内容），dry-run 也能拦超大文件、且
-		// 在读整个文件进内存之前就失败（对齐 +file-upload）。Stat 失败不在此报错，留给 Execute
-		// 的 ReadInputFile 产出更精确的「文件不存在/越界」错误。
-		if st, serr := rctx.FileIO().Stat(strings.TrimSpace(rctx.Str("file"))); serr == nil && st.Size() > dbDataImportMaxBytes {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "import data exceeds 1 MB limit (file is %d bytes); split into ≤1 MB chunks", st.Size()).WithParam("--file")
-		}
-		if importTableName(rctx) == "" {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "cannot infer target table from file name; specify --table").WithParam("--table")
-		}
-		return nil
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		fileName := filepath.Base(strings.TrimSpace(rctx.Str("file")))
-		return common.NewDryRunAPI().
-			POST(appDataImportPath(appID)).
-			Desc("Import data file into Miaoda app table (multipart upload)").
-			Params(map[string]interface{}{"env": rctx.Str("env"), "table": importTableName(rctx)}).
-			Body(map[string]interface{}{"file_name": fileName, "file": "<contents of --file>"})
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		file := strings.TrimSpace(rctx.Str("file"))
-		content, err := cmdutil.ReadInputFile(rctx.FileIO(), file)
-		if err != nil {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--file: %v", err).WithParam("--file")
-		}
-		if len(content) > dbDataImportMaxBytes {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "import data exceeds 1 MB limit (file is %d bytes); split into ≤1 MB chunks", len(content)).WithParam("--file")
-		}
-		fileName := filepath.Base(file)
-		table := importTableName(rctx)
-
-		// multipart：file_name 走表单字段、文件本体走 form-files；env / table 走 query。
-		fd := larkcore.NewFormdata()
-		fd.AddField("file_name", fileName)
-		fd.AddFile("file", bytes.NewReader(content))
-
-		resp, err := rctx.DoAPI(&larkcore.ApiReq{
-			HttpMethod:  http.MethodPost,
-			ApiPath:     appDataImportPath(appID),
-			QueryParams: larkcore.QueryParams{"env": []string{rctx.Str("env")}, "table": []string{table}},
-			Body:        fd,
-		}, larkcore.WithFileUpload())
-		if err != nil {
-			return withAppsHint(errs.NewNetworkError(errs.SubtypeNetworkTransport, "import request failed").WithCause(err).WithRetryable(), dbDataImportHint)
-		}
-		data, err := rctx.ClassifyAPIResponse(resp)
-		if err != nil {
-			return withAppsHint(err, dbDataImportHint)
-		}
-
-		outTable := common.GetString(data, "table")
-		if outTable == "" {
-			outTable = table
-		}
-		rows := int64(0)
-		if f, ok := numericAsFloat(data["rows"]); ok {
-			rows = int64(f)
-		}
-		out := map[string]interface{}{"file": file, "table": outTable, "rows": rows}
-		rctx.OutFormat(out, nil, func(w io.Writer) {
-			fmt.Fprintf(w, "✓ Imported %s → table '%s' (%d rows)\n", file, outTable, rows)
-		})
-		return nil
-	},
-}
-
-// importTableName 取目标表名：--table 优先，否则文件名去扩展名。
-func importTableName(rctx *common.RuntimeContext) string {
-	if t := strings.TrimSpace(rctx.Str("table")); t != "" {
-		return t
-	}
-	f := strings.TrimSpace(rctx.Str("file"))
-	if f == "" {
-		return ""
-	}
-	base := filepath.Base(f)
-	return strings.TrimSuffix(base, filepath.Ext(base))
-}

shortcuts/apps/apps_db_data_import_test.go

@@ -1,161 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"encoding/json"
-	"errors"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-const dbDataImportURL = "/open-apis/spark/v1/apps/app_x/db/data_import"
-
-// chdirTemp 切到临时工作目录（--file 走 cwd 内相对路径），返回该目录。
-func chdirTemp(t *testing.T) string {
-	t.Helper()
-	dir := t.TempDir()
-	old, _ := os.Getwd()
-	if err := os.Chdir(dir); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = os.Chdir(old) })
-	return dir
-}
-
-// TestAppsDBDataImport_RequiresAppID 验证空白 --app-id 报 --app-id 的 ValidationError。
-func TestAppsDBDataImport_RequiresAppID(t *testing.T) {
-	chdirTemp(t)
-	_ = os.WriteFile("orders.csv", []byte("id\n1\n"), 0o600)
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	err := runAppsShortcut(t, AppsDBDataImport,
-		[]string{"+db-data-import", "--app-id", "  ", "--file", "orders.csv", "--yes", "--as", "user"}, factory, stdout)
-	var ve *errs.ValidationError
-	if !errors.As(err, &ve) {
-		t.Fatalf("err = %T %v, want *errs.ValidationError", err, err)
-	}
-	if ve.Param != "--app-id" {
-		t.Fatalf("Param = %q, want --app-id", ve.Param)
-	}
-}
-
-// TestAppsDBDataImport_RejectsUnsupportedFormat 验证非 csv/json 文件（.txt）报不支持格式的校验错误。
-func TestAppsDBDataImport_RejectsUnsupportedFormat(t *testing.T) {
-	chdirTemp(t)
-	_ = os.WriteFile("data.txt", []byte("x\n"), 0o600)
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	err := runAppsShortcut(t, AppsDBDataImport,
-		[]string{"+db-data-import", "--app-id", "app_x", "--file", "data.txt", "--yes", "--as", "user"}, factory, stdout)
-	p, ok := errs.ProblemOf(err)
-	if !ok || p.Category != errs.CategoryValidation || p.Subtype != errs.SubtypeInvalidArgument {
-		t.Fatalf("expected unsupported-format validation, got %v", err)
-	}
-}
-
-// TestAppsDBDataImport_RequiresConfirmation 验证缺 --yes 时报 requires confirmation 错误。
-func TestAppsDBDataImport_RequiresConfirmation(t *testing.T) {
-	chdirTemp(t)
-	_ = os.WriteFile("orders.csv", []byte("id\n1\n"), 0o600)
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	err := runAppsShortcut(t, AppsDBDataImport,
-		[]string{"+db-data-import", "--app-id", "app_x", "--file", "orders.csv", "--as", "user"}, factory, stdout)
-	if err == nil || !strings.Contains(err.Error(), "requires confirmation") {
-		t.Fatalf("expected confirmation_required, got %v", err)
-	}
-}
-
-// TestAppsDBDataImport_RejectsOversizeFile 验证超过 1MB 上限的文件报 --file 的 ValidationError。
-func TestAppsDBDataImport_RejectsOversizeFile(t *testing.T) {
-	chdirTemp(t)
-	// >1MB → size 校验
-	big := append([]byte("id\n"), make([]byte, dbDataImportMaxBytes+1)...)
-	_ = os.WriteFile("big.csv", big, 0o600)
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	err := runAppsShortcut(t, AppsDBDataImport,
-		[]string{"+db-data-import", "--app-id", "app_x", "--file", "big.csv", "--yes", "--as", "user"}, factory, stdout)
-	var ve *errs.ValidationError
-	if !errors.As(err, &ve) {
-		t.Fatalf("expected 1MB limit error, got %T %v", err, err)
-	}
-	if ve.Param != "--file" {
-		t.Fatalf("Param = %q, want --file", ve.Param)
-	}
-}
-
-// dry-run：multipart 上传——file_name + file 走 body，env + table 走 query（table 缺省取文件名）。
-// TestAppsDBDataImport_DryRunMultipartShape 验证 dry-run 的 multipart 形态：file_name+file 走 body、env+table 走 query 且不再发 format。
-func TestAppsDBDataImport_DryRunMultipartShape(t *testing.T) {
-	chdirTemp(t)
-	_ = os.WriteFile("orders.csv", []byte("id\n1\n"), 0o600)
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	if err := runAppsShortcut(t, AppsDBDataImport,
-		[]string{"+db-data-import", "--app-id", "app_x", "--file", "orders.csv", "--env", "dev", "--dry-run", "--yes", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("dry-run err=%v", err)
-	}
-	var env struct {
-		API []struct {
-			Method string                 `json:"method"`
-			URL    string                 `json:"url"`
-			Params map[string]interface{} `json:"params"`
-			Body   map[string]interface{} `json:"body"`
-		} `json:"api"`
-	}
-	_ = json.Unmarshal([]byte(stdout.String()), &env)
-	a := env.API[0]
-	if a.Method != "POST" || a.URL != dbDataImportURL {
-		t.Fatalf("dry-run = %s %s", a.Method, a.URL)
-	}
-	if a.Body["file_name"] != "orders.csv" || a.Body["file"] == nil {
-		t.Fatalf("dry-run body should carry file_name + file: %v", a.Body)
-	}
-	if _, ok := a.Body["format"]; ok {
-		t.Fatalf("format must no longer be sent: %v", a.Body)
-	}
-	if a.Params["env"] != "dev" || a.Params["table"] != "orders" {
-		t.Fatalf("dry-run params (env+table) = %v", a.Params)
-	}
-}
-
-// TestAppsDBDataImport_Success 验证成功导入后输出含 table、rows 与回显的 file 名。
-func TestAppsDBDataImport_Success(t *testing.T) {
-	chdirTemp(t)
-	_ = os.WriteFile("orders.csv", []byte("id,name\n1,a\n2,b\n"), 0o600)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: dbDataImportURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"table": "orders", "rows": 2}},
-	})
-	if err := runAppsShortcut(t, AppsDBDataImport,
-		[]string{"+db-data-import", "--app-id", "app_x", "--file", "orders.csv", "--table", "orders", "--yes", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	got := stdout.String()
-	if !strings.Contains(got, `"table": "orders"`) || !strings.Contains(got, `"rows": 2`) || !strings.Contains(got, `"file": "orders.csv"`) {
-		t.Fatalf("output missing fields:\n%s", got)
-	}
-}
-
-// TestAppsDBDataImport_TableDefaultsToFileBasename 验证未传 --table 时表名缺省取文件名去扩展名（customers.json→customers）。
-func TestAppsDBDataImport_TableDefaultsToFileBasename(t *testing.T) {
-	chdirTemp(t)
-	_ = os.WriteFile("customers.json", []byte(`[{"id":1}]`), 0o600)
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	if err := runAppsShortcut(t, AppsDBDataImport,
-		[]string{"+db-data-import", "--app-id", "app_x", "--file", "customers.json", "--dry-run", "--yes", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("dry-run err=%v", err)
-	}
-	var env struct {
-		API []struct {
-			Params map[string]interface{} `json:"params"`
-		} `json:"api"`
-	}
-	_ = json.Unmarshal([]byte(stdout.String()), &env)
-	if env.API[0].Params["table"] != "customers" {
-		t.Fatalf("expected table=customers (from file basename) in params, got %v", env.API[0].Params)
-	}
-}

shortcuts/apps/apps_db_env_migrate.go

@@ -1,191 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"strings"
-	"time"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-const dbEnvMigrateHint = "ensure the app is multi-env (`+db-env-create`) and has pending dev changes; preview with `+db-env-diff`"
-
-// AppsDBEnvDiff 预览 dev→online 待发布的结构变更（不落地）。
-//
-// POST /apps/{app_id}/db/env_migrate，body {dry_run:true}，同步返 {from,to,changes[]}。
-// 与 +db-env-migrate 同端点、dry_run 区分；预览也需 spark:app:write scope。
-var AppsDBEnvDiff = common.Shortcut{
-	Service:     appsService,
-	Command:     "+db-env-diff",
-	Description: "Preview pending dev→online schema changes (no apply)",
-	Risk:        "read",
-	Tips: []string{
-		"Example: lark-cli apps +db-env-diff --app-id <app_id>",
-		"Apply the previewed changes with +db-env-migrate --yes.",
-	},
-	Scopes:    []string{"spark:app:write"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		_, err := requireAppID(rctx.Str("app-id"))
-		return err
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		return common.NewDryRunAPI().POST(appEnvMigratePath(appID)).Desc("Preview dev→online migration").Body(map[string]interface{}{"dry_run": true})
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		stop := rctx.StartSpinner("Previewing migration diff (dev → online)")
-		defer stop()
-		data, err := rctx.CallAPITyped("POST", appEnvMigratePath(appID), nil, map[string]interface{}{"dry_run": true})
-		stop()
-		if err != nil {
-			return withAppsHint(err, dbEnvMigrateHint)
-		}
-		from, to := common.GetString(data, "from"), common.GetString(data, "to")
-		changes := projectMigrationChanges(data["changes"])
-		out := map[string]interface{}{"from": from, "to": to, "changes": changes}
-		rctx.OutFormat(out, nil, func(w io.Writer) {
-			renderMigrationDiff(w, from, to, changes)
-		})
-		return nil
-	},
-}
-
-// AppsDBEnvMigrate 把 dev 的待发布结构变更发布到 online（异步，CLI 轮询至完成）。
-//
-// POST /apps/{app_id}/db/env_migrate，body {dry_run:false} → task_id，轮询 env_migrate_status
-// 至 success；后端 status:applied，CLI 对外统一呈现 migrated。high-risk-write。
-var AppsDBEnvMigrate = common.Shortcut{
-	Service:     appsService,
-	Command:     "+db-env-migrate",
-	Description: "Publish pending dev→online schema changes (irreversible)",
-	Risk:        "high-risk-write",
-	Tips: []string{
-		"Example: lark-cli apps +db-env-migrate --app-id <app_id> --yes",
-		"Preview first with +db-env-diff.",
-	},
-	Scopes:    []string{"spark:app:write"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		_, err := requireAppID(rctx.Str("app-id"))
-		return err
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		return common.NewDryRunAPI().POST(appEnvMigratePath(appID)).Desc("Apply dev→online migration").Body(map[string]interface{}{"dry_run": false})
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		stop := rctx.StartSpinner("Applying migration (dev → online)")
-		defer stop()
-		submit, err := rctx.CallAPITyped("POST", appEnvMigratePath(appID), nil, map[string]interface{}{"dry_run": false})
-		if err != nil {
-			return withAppsHint(err, dbEnvMigrateHint)
-		}
-		from, to := common.GetString(submit, "from"), common.GetString(submit, "to")
-		taskID := common.GetString(submit, "task_id")
-		applied := intFromAny(submit["changes_applied"])
-		if applied == 0 {
-			applied = len(projectMigrationChanges(submit["changes"]))
-		}
-		// 有 task_id → 异步，轮询至终态；无 task_id（同步完成）则直接用 submit 结果。
-		if taskID != "" {
-			final, perr := pollUntil(rctx.Ctx(), 1*time.Second, 10*time.Minute,
-				func() (map[string]interface{}, error) {
-					return rctx.CallAPITyped("GET", appEnvMigrateStatusPath(appID), map[string]interface{}{"task_id": taskID}, nil)
-				},
-				func(d map[string]interface{}) (bool, error) {
-					switch strings.ToLower(common.GetString(d, "status")) {
-					case "success", "applied", "migrated":
-						return true, nil
-					case "failed":
-						return false, withAppsHint(errs.NewAPIError(errs.SubtypeServerError, "%s", migrateFailMsg(d, taskID)), dbEnvMigrateHint)
-					}
-					return false, nil
-				})
-			if perr != nil {
-				return perr
-			}
-			if n := intFromAny(final["changes_applied"]); n > 0 {
-				applied = n
-			}
-		}
-		stop() // clear spinner before printing the result
-		out := map[string]interface{}{"status": "migrated", "from": from, "to": to, "changes_applied": applied}
-		rctx.OutFormat(out, nil, func(w io.Writer) {
-			fmt.Fprintf(w, "✓ Migrated %s → %s (%d changes)\n", from, to, applied)
-		})
-		return nil
-	},
-}
-
-type migrationChange struct {
-	Type      string `json:"type"`
-	Table     string `json:"table"`
-	Statement string `json:"statement"`
-}
-
-// projectMigrationChanges 把服务端原始变更项投影为白名单 migrationChange（type/table/statement）。
-func projectMigrationChanges(raw interface{}) []migrationChange {
-	arr, _ := raw.([]interface{})
-	out := make([]migrationChange, 0, len(arr))
-	for _, it := range arr {
-		if m, ok := it.(map[string]interface{}); ok {
-			out = append(out, migrationChange{
-				Type:      common.GetString(m, "type"),
-				Table:     common.GetString(m, "table"),
-				Statement: common.GetString(m, "statement"),
-			})
-		}
-	}
-	return out
-}
-
-// renderMigrationDiff 渲染 dev→online 待发布变更：无变更打提示，否则逐条打 statement。
-func renderMigrationDiff(w io.Writer, from, to string, changes []migrationChange) {
-	if len(changes) == 0 {
-		fmt.Fprintf(w, "No pending changes from %s to %s.\n", from, to)
-		return
-	}
-	fmt.Fprintf(w, "%s → %s (%d changes):\n\n", from, to, len(changes))
-	for _, c := range changes {
-		fmt.Fprintf(w, "  %s\n", c.Statement)
-	}
-}
-
-// migrateFailMsg 取发布失败信息：优先服务端 error_message，缺失则用带 task_id 的兜底文案。
-func migrateFailMsg(d map[string]interface{}, taskID string) string {
-	if m := common.GetString(d, "error_message"); m != "" {
-		return m
-	}
-	return fmt.Sprintf("migration apply failed (task_id=%s)", taskID)
-}
-
-// intFromAny 把 JSON number / json.Number 转 int（计数用）。
-func intFromAny(v interface{}) int {
-	if f, ok := numericAsFloat(v); ok {
-		return int(f)
-	}
-	return 0
-}

shortcuts/apps/apps_db_env_recovery_quota_test.go

@@ -1,369 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-const (
-	dbEnvMigrateURL       = "/open-apis/spark/v1/apps/app_x/db/env_migrate"
-	dbEnvMigrateStatusURL = "/open-apis/spark/v1/apps/app_x/db/env_migrate_status"
-	dbRecoveryURL         = "/open-apis/spark/v1/apps/app_x/db/env_recovery"
-	dbRecoveryDiffURL     = "/open-apis/spark/v1/apps/app_x/db/env_recovery_diff_status"
-	dbRecoveryApplyURL    = "/open-apis/spark/v1/apps/app_x/db/env_recovery_apply_status"
-	dbQuotaURL            = "/open-apis/spark/v1/apps/app_x/db/quota"
-)
-
-// ── env-diff ──
-
-// TestAppsDBEnvDiff_DryRunBody 校验 dry-run 请求体：POST env_migrate 且 dry_run=true。
-func TestAppsDBEnvDiff_DryRunBody(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	if err := runAppsShortcut(t, AppsDBEnvDiff,
-		[]string{"+db-env-diff", "--app-id", "app_x", "--dry-run", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("dry-run err=%v", err)
-	}
-	var env struct {
-		API []struct {
-			Method string                 `json:"method"`
-			URL    string                 `json:"url"`
-			Body   map[string]interface{} `json:"body"`
-		} `json:"api"`
-	}
-	_ = json.Unmarshal([]byte(stdout.String()), &env)
-	a := env.API[0]
-	if a.Method != "POST" || a.URL != dbEnvMigrateURL || a.Body["dry_run"] != true {
-		t.Fatalf("dry-run = %s %s body=%v", a.Method, a.URL, a.Body)
-	}
-}
-
-// TestAppsDBEnvDiff_SuccessRendersChanges 验证 pretty 输出渲染出 dev → online 变更摘要及 DDL 语句。
-func TestAppsDBEnvDiff_SuccessRendersChanges(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: dbEnvMigrateURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"from": "dev", "to": "online",
-			"changes": []interface{}{
-				map[string]interface{}{"type": "ALTER_TABLE", "table": "orders", "statement": "ALTER TABLE orders ADD COLUMN note text"},
-			},
-		}},
-	})
-	if err := runAppsShortcut(t, AppsDBEnvDiff,
-		[]string{"+db-env-diff", "--app-id", "app_x", "--format", "pretty", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	got := stdout.String()
-	if !strings.Contains(got, "dev → online (1 changes)") || !strings.Contains(got, "ALTER TABLE orders ADD COLUMN note text") {
-		t.Fatalf("pretty diff malformed:\n%s", got)
-	}
-}
-
-// TestAppsDBEnvDiff_EmptyChanges 验证无变更时 pretty 输出"无待发布变更"提示。
-func TestAppsDBEnvDiff_EmptyChanges(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: dbEnvMigrateURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"from": "dev", "to": "online", "changes": []interface{}{}}},
-	})
-	if err := runAppsShortcut(t, AppsDBEnvDiff,
-		[]string{"+db-env-diff", "--app-id", "app_x", "--format", "pretty", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	if !strings.Contains(stdout.String(), "No pending changes from dev to online.") {
-		t.Fatalf("expected empty message, got: %s", stdout.String())
-	}
-}
-
-// ── env-migrate ──
-
-// TestAppsDBEnvMigrate_DryRunBody 校验 migrate 的 dry-run 请求体里 dry_run=false（真实迁移）。
-func TestAppsDBEnvMigrate_DryRunBody(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	if err := runAppsShortcut(t, AppsDBEnvMigrate,
-		[]string{"+db-env-migrate", "--app-id", "app_x", "--dry-run", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("dry-run err=%v", err)
-	}
-	var env struct {
-		API []struct {
-			Body map[string]interface{} `json:"body"`
-		} `json:"api"`
-	}
-	_ = json.Unmarshal([]byte(stdout.String()), &env)
-	if env.API[0].Body["dry_run"] != false {
-		t.Fatalf("dry-run body=%v (want dry_run:false)", env.API[0].Body)
-	}
-}
-
-// 异步：submit 返 task_id，status 立刻 applied → CLI 对外统一 migrated。
-func TestAppsDBEnvMigrate_AsyncPollSuccess(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: dbEnvMigrateURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"from": "dev", "to": "online", "task_id": "t1"}},
-	})
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbEnvMigrateStatusURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"task_id": "t1", "status": "applied", "changes_applied": 3}},
-	})
-	if err := runAppsShortcut(t, AppsDBEnvMigrate,
-		[]string{"+db-env-migrate", "--app-id", "app_x", "--yes", "--format", "pretty", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	got := stdout.String()
-	if !strings.Contains(got, "✓ Migrated dev → online (3 changes)") {
-		t.Fatalf("pretty: %s", got)
-	}
-}
-
-// TestAppsDBEnvMigrate_PollFailedSurfacesError 验证轮询到 failed 时返回 API/server_error 类型错误，携带服务端 message 与恢复 hint。
-func TestAppsDBEnvMigrate_PollFailedSurfacesError(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: dbEnvMigrateURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"from": "dev", "to": "online", "task_id": "t1"}},
-	})
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbEnvMigrateStatusURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"task_id": "t1", "status": "failed", "error_message": "lock timeout"}},
-	})
-	err := runAppsShortcut(t, AppsDBEnvMigrate,
-		[]string{"+db-env-migrate", "--app-id", "app_x", "--yes", "--as", "user"}, factory, stdout)
-	p, ok := errs.ProblemOf(err)
-	if !ok || p.Category != errs.CategoryAPI || p.Subtype != errs.SubtypeServerError {
-		t.Fatalf("got %T %v, want API/server_error typed error", err, err)
-	}
-	if !strings.Contains(p.Message, "lock timeout") {
-		t.Fatalf("Message = %q, want it to contain 'lock timeout'", p.Message)
-	}
-	if !strings.Contains(p.Hint, "+db-env-diff") {
-		t.Fatalf("Hint = %q, want the db-env-migrate recovery hint", p.Hint)
-	}
-}
-
-// TestAppsDBEnvMigrate_RequiresConfirmation 验证 high-risk-write 无 --yes 时被确认门拦截。
-func TestAppsDBEnvMigrate_RequiresConfirmation(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	// high-risk-write 无 --yes → 应被确认门拦截（非 0 退出）。
-	if err := runAppsShortcut(t, AppsDBEnvMigrate,
-		[]string{"+db-env-migrate", "--app-id", "app_x", "--as", "user"}, factory, stdout); err == nil {
-		t.Fatalf("expected confirmation gate without --yes")
-	}
-}
-
-// ── recovery-diff ──
-
-// TestAppsDBRecoveryDiff_RequiresTarget 验证缺少 --target 时报必填错误。
-func TestAppsDBRecoveryDiff_RequiresTarget(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	if err := runAppsShortcut(t, AppsDBRecoveryDiff,
-		[]string{"+db-recovery-diff", "--app-id", "app_x", "--as", "user"}, factory, stdout); err == nil {
-		t.Fatalf("expected required --target error")
-	}
-}
-
-// TestAppsDBRecoveryDiff_DryRunNormalizesTarget 验证 dry-run 走 POST env_recovery 且 --target 被归一化为 RFC3339 UTC。
-func TestAppsDBRecoveryDiff_DryRunNormalizesTarget(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	if err := runAppsShortcut(t, AppsDBRecoveryDiff,
-		[]string{"+db-recovery-diff", "--app-id", "app_x", "--target", "2026-04-15", "--dry-run", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("dry-run err=%v", err)
-	}
-	var env struct {
-		API []struct {
-			Method string                 `json:"method"`
-			URL    string                 `json:"url"`
-			Body   map[string]interface{} `json:"body"`
-		} `json:"api"`
-	}
-	_ = json.Unmarshal([]byte(stdout.String()), &env)
-	a := env.API[0]
-	if a.Method != "POST" || a.URL != dbRecoveryURL || a.Body["dry_run"] != true {
-		t.Fatalf("dry-run = %s %s body=%v", a.Method, a.URL, a.Body)
-	}
-	if s, _ := a.Body["target"].(string); !strings.HasSuffix(s, "Z") {
-		t.Fatalf("target not normalized to RFC3339 UTC: %v", a.Body["target"])
-	}
-}
-
-// TestAppsDBRecoveryDiff_SuccessRendersChanges 验证 preview 成功后 pretty 渲染受影响表数、行增删与预估耗时。
-func TestAppsDBRecoveryDiff_SuccessRendersChanges(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: dbRecoveryURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"preview_request_id": "p1"}},
-	})
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbRecoveryDiffURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"preview_status": "success", "tables_affected": 2, "estimated_seconds": 12,
-			"changes": []interface{}{
-				map[string]interface{}{"table": "orders", "inserted": 5, "deleted": 2},
-				map[string]interface{}{"table": "carts", "action": "restore_table"},
-			},
-		}},
-	})
-	if err := runAppsShortcut(t, AppsDBRecoveryDiff,
-		[]string{"+db-recovery-diff", "--app-id", "app_x", "--target", "2h", "--format", "pretty", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	got := stdout.String()
-	for _, want := range []string{"tables affected: 2", "orders: +5 rows, -2 rows", "carts: table will be restored", "estimated time: ~12s"} {
-		if !strings.Contains(got, want) {
-			t.Errorf("missing %q:\n%s", want, got)
-		}
-	}
-}
-
-// TestAppsDBRecoveryDiff_PreviewFailed 验证 preview_status=failed 时返回 API/server_error，携带 message 与 PITR window hint。
-func TestAppsDBRecoveryDiff_PreviewFailed(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: dbRecoveryURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"preview_request_id": "p1"}},
-	})
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbRecoveryDiffURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"preview_status": "failed", "error_message": "snapshot expired"}},
-	})
-	err := runAppsShortcut(t, AppsDBRecoveryDiff,
-		[]string{"+db-recovery-diff", "--app-id", "app_x", "--target", "2h", "--as", "user"}, factory, stdout)
-	p, ok := errs.ProblemOf(err)
-	if !ok || p.Category != errs.CategoryAPI || p.Subtype != errs.SubtypeServerError {
-		t.Fatalf("got %T %v, want API/server_error typed error", err, err)
-	}
-	if !strings.Contains(p.Message, "snapshot expired") {
-		t.Fatalf("Message = %q, want it to contain 'snapshot expired'", p.Message)
-	}
-	if !strings.Contains(p.Hint, "PITR window") {
-		t.Fatalf("Hint = %q, want the db-recovery recovery hint", p.Hint)
-	}
-}
-
-// ── recovery-apply ──
-
-// TestAppsDBRecoveryApply_NoChangesShortCircuits 验证 status=no_changes 时短路输出"已是该状态"，不再轮询。
-func TestAppsDBRecoveryApply_NoChangesShortCircuits(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: dbRecoveryURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"status": "no_changes"}},
-	})
-	if err := runAppsShortcut(t, AppsDBRecoveryApply,
-		[]string{"+db-recovery-apply", "--app-id", "app_x", "--target", "2h", "--yes", "--format", "pretty", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	if !strings.Contains(stdout.String(), "No changes — database is already at this state.") {
-		t.Fatalf("expected no-changes short-circuit, got: %s", stdout.String())
-	}
-}
-
-// TestAppsDBRecoveryApply_AsyncPollSuccess 验证 running → 轮询 success 后 pretty 输出恢复完成及耗时。
-func TestAppsDBRecoveryApply_AsyncPollSuccess(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: dbRecoveryURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"status": "running"}},
-	})
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbRecoveryApplyURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"status": "success", "restore_time_sec": 8}},
-	})
-	if err := runAppsShortcut(t, AppsDBRecoveryApply,
-		[]string{"+db-recovery-apply", "--app-id", "app_x", "--target", "2h", "--yes", "--format", "pretty", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	if !strings.Contains(stdout.String(), "✓ Database restored to") || !strings.Contains(stdout.String(), "(8s elapsed)") {
-		t.Fatalf("pretty: %s", stdout.String())
-	}
-}
-
-// TestAppsDBRecoveryApply_RequiresConfirmation 验证无 --yes 时被确认门拦截。
-func TestAppsDBRecoveryApply_RequiresConfirmation(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	if err := runAppsShortcut(t, AppsDBRecoveryApply,
-		[]string{"+db-recovery-apply", "--app-id", "app_x", "--target", "2h", "--as", "user"}, factory, stdout); err == nil {
-		t.Fatalf("expected confirmation gate without --yes")
-	}
-}
-
-// ── quota-get ──
-
-// TestAppsDBQuotaGet_WithQuotaPretty 验证已对接配额时 pretty 渲染存储用量、百分比及 tables/views 数。
-func TestAppsDBQuotaGet_WithQuotaPretty(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbQuotaURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"storage_used_bytes": 1048576, "storage_quota_bytes": 10485760, "usage_percent": 10.0,
-			"tables": 4, "views": 1,
-		}},
-	})
-	if err := runAppsShortcut(t, AppsDBQuotaGet,
-		[]string{"+db-quota-get", "--app-id", "app_x", "--format", "pretty", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	got := stdout.String()
-	for _, want := range []string{"Storage", "(10.0%)", "Tables", "4", "Views", "1"} {
-		if !strings.Contains(got, want) {
-			t.Errorf("missing %q:\n%s", want, got)
-		}
-	}
-}
-
-// 配额未对接（storage_quota_bytes=0）→ json 删 quota/usage_percent，仅留已用量与 tables/views。
-func TestAppsDBQuotaGet_NoQuotaOmitsFields(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: dbQuotaURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"storage_used_bytes": 2048, "storage_quota_bytes": 0, "tables": 2, "views": 0,
-		}},
-	})
-	if err := runAppsShortcut(t, AppsDBQuotaGet,
-		[]string{"+db-quota-get", "--app-id", "app_x", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	got := stdout.String()
-	if strings.Contains(got, "storage_quota_bytes") || strings.Contains(got, "usage_percent") {
-		t.Fatalf("quota fields should be omitted when not provisioned:\n%s", got)
-	}
-	if !strings.Contains(got, "storage_used_bytes") || !strings.Contains(got, "\"tables\"") {
-		t.Fatalf("expected used + tables retained:\n%s", got)
-	}
-}
-
-// TestProjectDbQuota_WhitelistsFields 验证 projectDbQuota 白名单投影：只保留 used/tables/views（及配额已对接时的
-// quota/usage_percent），后端额外字段不透传。
-func TestProjectDbQuota_WhitelistsFields(t *testing.T) {
-	out := projectDbQuota(map[string]interface{}{
-		"storage_used_bytes": 2048, "storage_quota_bytes": float64(0), "usage_percent": float64(0),
-		"tables": 2, "views": 1, "tenant_key": "leak", "internal_shard": "s1",
-	})
-	if _, ok := out["storage_quota_bytes"]; ok {
-		t.Errorf("zero quota should be omitted: %v", out)
-	}
-	if out["storage_used_bytes"] != 2048 || out["tables"] != 2 || out["views"] != 1 {
-		t.Errorf("whitelisted fields should be kept: %v", out)
-	}
-	for _, leaked := range []string{"tenant_key", "internal_shard"} {
-		if _, ok := out[leaked]; ok {
-			t.Errorf("non-whitelisted field %q must be dropped: %v", leaked, out)
-		}
-	}
-
-	out2 := projectDbQuota(map[string]interface{}{"storage_used_bytes": 2048, "storage_quota_bytes": float64(4096), "usage_percent": float64(50), "tables": 2})
-	if _, ok := out2["storage_quota_bytes"]; !ok {
-		t.Errorf("non-zero quota should be kept: %v", out2)
-	}
-	if _, ok := out2["usage_percent"]; !ok {
-		t.Errorf("usage_percent should be kept when quota>0: %v", out2)
-	}
-}

shortcuts/apps/apps_db_execute.go

@@ -12,7 +12,6 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/shortcuts/common"
@@ -32,18 +31,11 @@ import (
 //   - 多语句部分失败：`Statement K: ✗ <message> [<code>]` + 末尾「前序语句已落地」提示
 //
 // 失败语义：server 多语句失败仍返 code:0，把失败语句标成 ERROR 哨兵塞进 result。Execute 检测到哨兵
-// 后升级成 typed errs.APIError（CategoryAPI → exit 1），避免 agent 误判 ok:true 假成功。诊断信息
-// （第几条失败 / 共几条 / 是否整批回滚 / 前序是否落地）写进 message+hint 文案（errs.* 信封扁平、无
-// detail 容器）：失败在用户显式 BEGIN…COMMIT 事务内 → 整批回滚、前序未落库；否则前序语句已逐条
-// commit、未回滚。rolled_back 语义由 inferRolledBack 按 BEGIN/COMMIT 计数推断。
+// 后升级成 typed api_error（exit 非 0、detail 带 statement_index / completed / rolled_back），
+// 避免 agent 误判 ok:true 假成功。CLI 永远 DBA 模式（transactional=false），失败前的语句已 auto-commit
+// 落地，故 rolled_back=false（真机 boe 实证）。
 //
-// JSON（成功路径）按 SQL 类型归一化 `data`（不透传后端 result 字符串）：
-//   - 单 SELECT → data 是行数组 `[{...}]`（空 → `[]`）
-//   - 单 DML    → data = `{command, rows_affected}`
-//   - 单 DDL    → data = `{command}`
-//   - 多语句    → data = `[{command:"SELECT",rows:[...]} | {command,rows_affected} | {command}]`
-//
-// 字段裁剪用框架原生 --jq/-q。
+// JSON envelope（成功路径）：CLI 把 server 返的 result 字符串解出来放进 `data.results` 数组。
 //
 // Risk: high-risk-write —— SQL 可含 DML/DDL，框架对所有执行强制 --yes 确认关卡（--dry-run 预览豁免）。
 //
@@ -57,7 +49,7 @@ var AppsDBExecute = common.Shortcut{
 	Tips: []string{
 		`Example: lark-cli apps +db-execute --app-id <app_id> --sql "SELECT * FROM orders LIMIT 10" --yes`,
 		`Example: lark-cli apps +db-execute --app-id <app_id> --env dev --file ./migration.sql --yes`,
-		"Tip: single SELECT returns data as a row array — filter with --jq, e.g. -q '.data[].id'",
+		"Tip: filter fields with --jq, e.g. -q '.data.results[].sql_type'",
 	},
 	Scopes:    []string{"spark:app:write"},
 	AuthTypes: []string{"user"},
@@ -112,18 +104,13 @@ var AppsDBExecute = common.Shortcut{
 			return withAppsHint(err, "verify table/column names with `lark-cli apps +db-table-get --app-id "+appID+" --table <table>`; for day-to-day debugging target the dev database with `--env dev`")
 		}
 
-		// server `result: string` 内嵌结构化数组 —— CLI 解出来后按 SQL 类型归一化成 PRD 形态，
+		// server `result: string` 内嵌结构化数组 —— CLI 解出来放进 envelope 的 data.results，
 		// 让 json/pretty 路径都基于同一份反序列化产物渲染。
 		stmts := parseSQLResult(common.GetString(raw, "result"))
-		// JSON data 形态（不再透传后端 result 字符串）：
-		//   - 单 SELECT → data 是行数组 [{...}]（空 → []）
-		//   - 单 DML    → data = {command, rows_affected}
-		//   - 单 DDL    → data = {command}
-		//   - 多语句    → data = [{command:"SELECT",rows:[...]} | {command,rows_affected} | {command}]
-		// 字段裁剪走框架原生 --jq/-q（不引入 miaoda 的 --json <fields>）。
-		// 这不是无界 token 黑洞 —— server 对单条 SELECT 结果集有 1000 行硬上限，超出直接报错
-		// （而非静默截断）。需要更大结果集时请在 SQL 里显式 LIMIT/分页，由调用方控制规模。
-		data := shapeSQLData(stmts)
+		// 注意：data.results 在 json（默认）路径下原样透出全部行，CLI 侧不再二次截断。
+		// 这不是无界 token 黑洞 —— server 对单条 SELECT 结果集有 1000 行硬上限，超出会直接
+		// 返报错（而非静默截断）。需要更大结果集时请在 SQL 里显式 LIMIT/分页，由调用方控制规模。
+		data := map[string]interface{}{"results": stmts}
 
 		// 多语句 / 单语句失败：server 仍返 code:0，把失败语句标成 ERROR 哨兵塞进 result。
 		// 升级成 typed api_error（exit 非 0），别让 agent 误判 ok:true 假成功。
@@ -142,70 +129,6 @@ var AppsDBExecute = common.Shortcut{
 	},
 }
 
-// shapeSQLData 把解析出的 statements 归一化成 PRD 约定的 JSON `data` 形态：
-//   - 无语句       → []（空数组）
-//   - 单条语句     → singleStatementJSON（SELECT 是行数组、DML/DDL 是对象）
-//   - 多条语句     → []multiStatementElement（每条统一成 {command,...} 对象，SELECT 行放 rows）
-//
-// 不再透传后端 result 字符串（旧形态 data.results[].data 是 JSON 字符串，对 agent 不友好）。
-func shapeSQLData(stmts []map[string]interface{}) interface{} {
-	if len(stmts) == 0 {
-		return []interface{}{}
-	}
-	if len(stmts) == 1 {
-		return singleStatementJSON(stmts[0])
-	}
-	out := make([]interface{}, 0, len(stmts))
-	for _, s := range stmts {
-		out = append(out, multiStatementElement(s))
-	}
-	return out
-}
-
-// singleStatementJSON 单条语句的 PRD JSON 形态：
-//   - SELECT → 行数组（空 → []）
-//   - DML    → {command, rows_affected}
-//   - DDL / OK / 其它 → {command}
-func singleStatementJSON(s map[string]interface{}) interface{} {
-	sqlType := common.GetString(s, "sql_type")
-	switch {
-	case sqlType == "SELECT":
-		return selectRows(s)
-	case isDMLType(sqlType):
-		return map[string]interface{}{"command": sqlType, "rows_affected": intOrZero(s["affected_rows"])}
-	default:
-		return map[string]interface{}{"command": sqlType}
-	}
-}
-
-// multiStatementElement 多语句里单条的 PRD JSON 形态：与单条一致，但 SELECT 包成
-// {command:"SELECT", rows:[...]}（避免数组里直接嵌套数组造成歧义）。
-func multiStatementElement(s map[string]interface{}) map[string]interface{} {
-	sqlType := common.GetString(s, "sql_type")
-	switch {
-	case sqlType == "SELECT":
-		return map[string]interface{}{"command": "SELECT", "rows": selectRows(s)}
-	case isDMLType(sqlType):
-		return map[string]interface{}{"command": sqlType, "rows_affected": intOrZero(s["affected_rows"])}
-	default:
-		return map[string]interface{}{"command": sqlType}
-	}
-}
-
-// selectRows 把 SELECT statement 的 data 字段（行 JSON 数组字符串）解析成行数组；
-// 空 / 非法一律返回非 nil 的空数组（保证 JSON 序列化成 [] 而非 null）。
-func selectRows(s map[string]interface{}) []map[string]interface{} {
-	dataJSON := strings.TrimSpace(common.GetString(s, "data"))
-	if dataJSON == "" || dataJSON == "null" {
-		return []map[string]interface{}{}
-	}
-	var rows []map[string]interface{}
-	if err := json.Unmarshal([]byte(dataJSON), &rows); err != nil || rows == nil {
-		return []map[string]interface{}{}
-	}
-	return rows
-}
-
 // findErrorSentinel 在 statements 里找 ERROR 哨兵（server 失败时追加在失败语句位置）。
 // 返回失败语句下标（0-based）、该 ERROR statement、是否命中。
 func findErrorSentinel(stmts []map[string]interface{}) (int, map[string]interface{}, bool) {
@@ -217,48 +140,31 @@ func findErrorSentinel(stmts []map[string]interface{}) (int, map[string]interfac
 	return 0, nil, false
 }
 
-// sqlStatementError 把 ERROR 哨兵升级成 typed errs.APIError（CategoryAPI → exit 1）。
+// sqlStatementError 把 ERROR 哨兵升级成 typed api_error。
 //
-// 多语句失败的诊断信息——第几条失败 / 共几条 / 是否整批回滚 / 前序是否落地——都写进
-// message + hint 的人类可读文案（errs.* 信封是扁平字段、不带结构化 detail 容器）。文案对齐
-// miaoda-cli（src/cli/handlers/db/sql.ts、src/api/db/api.ts）：
-//   - message 末尾 "(at statement N of M)" 给出失败位置；
-//   - hint 由 inferRolledBack 推断（实测后端把 BEGIN/COMMIT 也作为 statement 返回）：
-//     失败仍在用户显式事务内 → 服务端整批回滚，用 miaoda 原句 "Transaction rolled back; no changes persisted."；
-//     否则前序语句已逐条 commit、未回滚（flat 信封无逐句 breakdown，故 hint 简述前序已落地 + 从失败处续跑）。
+// CLI 永远 DBA 模式（transactional=false），真机 boe 实证：失败语句之前的语句已逐条 auto-commit
+// 落地，不存在外层事务回滚。因此 rolled_back=false、completed 列出已落地的前序语句，hint 提示用户
+// 别整批重跑（否则会重复写入）。
 func sqlStatementError(stmts []map[string]interface{}, errIdx int, errStmt map[string]interface{}) error {
 	code, msg := parseErrorSentinel(common.GetString(errStmt, "data"))
 	stmtNo := errIdx + 1 // 1-based 给人看
 	fullMsg := fmt.Sprintf("%s (at statement %d of %d)", msg, stmtNo, len(stmts))
 
-	var hint string
-	switch {
-	case inferRolledBack(stmts[:errIdx]):
-		hint = "Transaction rolled back; no changes persisted."
-	case errIdx > 0:
-		hint = fmt.Sprintf("Earlier statements were committed and not rolled back; fix statement %d and re-run the remaining statements.", stmtNo)
-	default:
-		hint = "No statements were applied; fix the SQL and re-run."
-	}
-	return errs.NewAPIError(errs.SubtypeServerError, "%s", fullMsg).WithCode(code).WithHint("%s", hint)
-}
-
-// inferRolledBack 推断失败时是否处于用户显式事务内（→ 服务端整批回滚）。
-// 遍历已完成语句的 sql_type：BEGIN/START TRANSACTION +1，COMMIT/ROLLBACK/END -1；
-// 结束 depth>0 说明事务还开着、已被服务端回滚。对齐 miaoda-cli inferRolledBack。
-func inferRolledBack(completed []map[string]interface{}) bool {
-	depth := 0
-	for _, s := range completed {
-		switch strings.ToUpper(strings.TrimSpace(common.GetString(s, "sql_type"))) {
-		case "BEGIN", "START TRANSACTION", "START_TRANSACTION":
-			depth++
-		case "COMMIT", "ROLLBACK", "END":
-			if depth > 0 {
-				depth--
-			}
+	apiErr := output.ErrAPI(code, fullMsg, map[string]interface{}{
+		"statement_index": errIdx,
+		"completed":       stmts[:errIdx],
+		"rolled_back":     false,
+	})
+	if apiErr.Detail != nil {
+		if errIdx > 0 {
+			apiErr.Detail.Hint = fmt.Sprintf(
+				"statements 1-%d were already applied (DBA mode auto-commits each statement); fix statement %d and re-run only the remaining statements.",
+				errIdx, stmtNo)
+		} else {
+			apiErr.Detail.Hint = "no statements were applied; fix the SQL and re-run."
 		}
 	}
-	return depth > 0
+	return apiErr
 }
 
 // parseErrorSentinel 解析 ERROR 哨兵的 data（`{code,message}` JSON），返回数值 code 与 message。
@@ -440,10 +346,10 @@ func renderMultiStatementPretty(w io.Writer, stmts []map[string]interface{}) {
 	}
 	fmt.Fprintln(w)
 	if failedIdx >= 0 {
-		// CLI 永远传 transactional=false，失败语句之前的语句已逐条 commit 落地、不会整批回滚——
-		// 如实告诉用户，避免整批重跑导致重复写入。
+		// CLI 永远 DBA 模式（transactional=false），失败语句之前的语句已 auto-commit 落地，
+		// 不存在整批回滚 —— 如实告诉用户，避免整批重跑导致重复写入。
 		if successCount > 0 {
-			fmt.Fprintf(w, "(statement %d failed; %d statement%s before it committed and not rolled back)\n",
+			fmt.Fprintf(w, "(statement %d failed; %d statement%s before it already applied — DBA mode auto-commits each)\n",
 				failedIdx+1, successCount, plural(int64(successCount)))
 		} else {
 			fmt.Fprintf(w, "(statement %d failed; no statements applied)\n", failedIdx+1)
@@ -547,7 +453,6 @@ func isDMLType(sqlType string) bool {
 	return false
 }
 
-// dmlVerb 把 DML sql_type 映射成过去分词动词：INSERT→inserted / UPDATE→updated / DELETE→deleted / MERGE→merged，未知 → affected。
 func dmlVerb(sqlType string) string {
 	switch strings.ToUpper(sqlType) {
 	case "INSERT":
@@ -562,7 +467,6 @@ func dmlVerb(sqlType string) string {
 	return "affected"
 }
 
-// plural 返回英文复数后缀：n==1 时空串，否则 "s"。
 func plural(n int64) string {
 	if n == 1 {
 		return ""

shortcuts/apps/apps_db_execute_test.go

@@ -5,18 +5,17 @@ package apps
 
 import (
 	"encoding/json"
+	"errors"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 
-	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/output"
 )
 
-// TestAppsDBExecute_SingleSELECTJSONIsRowArray 断言单条 SELECT 的 JSON data 直接是行数组（不再透传 result 字符串）。
-func TestAppsDBExecute_SingleSELECTJSONIsRowArray(t *testing.T) {
+func TestAppsDBExecute_SingleSELECTJSONEnvelopeWrapsResults(t *testing.T) {
 	factory, stdout, reg := newAppsExecuteFactory(t)
 	reg.Register(&httpmock.Stub{
 		Method: "POST",
@@ -34,130 +33,23 @@ func TestAppsDBExecute_SingleSELECTJSONIsRowArray(t *testing.T) {
 		factory, stdout); err != nil {
 		t.Fatalf("execute err=%v", err)
 	}
-	// PRD 单 SELECT：data 直接是行数组（不再是 data.results[].data 字符串）
+	// JSON envelope 应该把 result 字符串 parse 之后放进 data.results
 	var env struct {
-		Data []map[string]interface{} `json:"data"`
+		Data struct {
+			Results []map[string]interface{} `json:"results"`
+		} `json:"data"`
 	}
 	if err := json.Unmarshal(stdout.Bytes(), &env); err != nil {
 		t.Fatalf("decode envelope: %v\n%s", err, stdout.String())
 	}
-	if len(env.Data) != 1 {
-		t.Fatalf("data = %d rows (want 1)\n%s", len(env.Data), stdout.String())
+	if len(env.Data.Results) != 1 {
+		t.Fatalf("data.results = %d items (want 1)", len(env.Data.Results))
 	}
-	if env.Data[0]["id"] != float64(101) || env.Data[0]["total_cents"] != float64(2500) {
-		t.Fatalf("data[0] = %v, want {id:101,total_cents:2500}", env.Data[0])
+	if env.Data.Results[0]["sql_type"] != "SELECT" {
+		t.Fatalf("results[0].sql_type = %v", env.Data.Results[0]["sql_type"])
 	}
 }
 
-// TestAppsDBExecute_SingleDMLJSONShape 断言单条 DML 的 JSON data 形如 {command, rows_affected}。
-func TestAppsDBExecute_SingleDMLJSONShape(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/spark/v1/apps/app_x/sql_commands",
-		Body: map[string]interface{}{
-			"code": 0,
-			"data": map[string]interface{}{
-				"result": `[{"sql_type":"INSERT","data":"","affected_rows":3}]`,
-			},
-		},
-	})
-	if err := runAppsShortcut(t, AppsDBExecute,
-		[]string{"+db-execute", "--yes", "--app-id", "app_x", "--sql", "insert", "--as", "user"},
-		factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	// PRD 单 DML：data = {command, rows_affected}
-	var env struct {
-		Data struct {
-			Command      string `json:"command"`
-			RowsAffected int    `json:"rows_affected"`
-		} `json:"data"`
-	}
-	if err := json.Unmarshal(stdout.Bytes(), &env); err != nil {
-		t.Fatalf("decode: %v\n%s", err, stdout.String())
-	}
-	if env.Data.Command != "INSERT" || env.Data.RowsAffected != 3 {
-		t.Fatalf("data = %+v, want {command:INSERT, rows_affected:3}", env.Data)
-	}
-}
-
-// TestAppsDBExecute_SingleDDLJSONShape 断言单条 DDL 的 JSON data 形如 {command}。
-func TestAppsDBExecute_SingleDDLJSONShape(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/spark/v1/apps/app_x/sql_commands",
-		Body: map[string]interface{}{
-			"code": 0,
-			"data": map[string]interface{}{
-				"result": `[{"sql_type":"CREATE_TABLE","data":"[]"}]`,
-			},
-		},
-	})
-	if err := runAppsShortcut(t, AppsDBExecute,
-		[]string{"+db-execute", "--yes", "--app-id", "app_x", "--sql", "create", "--as", "user"},
-		factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	// PRD 单 DDL：data = {command}
-	var env struct {
-		Data struct {
-			Command string `json:"command"`
-		} `json:"data"`
-	}
-	if err := json.Unmarshal(stdout.Bytes(), &env); err != nil {
-		t.Fatalf("decode: %v\n%s", err, stdout.String())
-	}
-	if env.Data.Command != "CREATE_TABLE" {
-		t.Fatalf("data.command = %q, want CREATE_TABLE", env.Data.Command)
-	}
-}
-
-// TestAppsDBExecute_MultiStatementJSONShape 断言多语句的 JSON data 是元素数组，且 SELECT 包成 {command:"SELECT", rows:[...]}。
-func TestAppsDBExecute_MultiStatementJSONShape(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/spark/v1/apps/app_x/sql_commands",
-		Body: map[string]interface{}{
-			"code": 0,
-			"data": map[string]interface{}{
-				"result": `[` +
-					`{"sql_type":"INSERT","data":"","affected_rows":1},` +
-					`{"sql_type":"SELECT","data":"[{\"id\":999}]","record_count":1}` +
-					`]`,
-			},
-		},
-	})
-	if err := runAppsShortcut(t, AppsDBExecute,
-		[]string{"+db-execute", "--yes", "--app-id", "app_x", "--sql", "x", "--as", "user"},
-		factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	// PRD 多语句：data 是元素数组；SELECT 包成 {command:"SELECT", rows:[...]}
-	var env struct {
-		Data []map[string]interface{} `json:"data"`
-	}
-	if err := json.Unmarshal(stdout.Bytes(), &env); err != nil {
-		t.Fatalf("decode: %v\n%s", err, stdout.String())
-	}
-	if len(env.Data) != 2 {
-		t.Fatalf("data = %d elements (want 2)\n%s", len(env.Data), stdout.String())
-	}
-	if env.Data[0]["command"] != "INSERT" || env.Data[0]["rows_affected"] != float64(1) {
-		t.Fatalf("data[0] = %v, want {command:INSERT, rows_affected:1}", env.Data[0])
-	}
-	if env.Data[1]["command"] != "SELECT" {
-		t.Fatalf("data[1].command = %v, want SELECT", env.Data[1]["command"])
-	}
-	rows, ok := env.Data[1]["rows"].([]interface{})
-	if !ok || len(rows) != 1 {
-		t.Fatalf("data[1].rows = %v, want 1 row", env.Data[1]["rows"])
-	}
-}
-
-// TestAppsDBExecute_DryRunSendsTransactionalFalse 断言 dry-run 发出的请求是 POST、params 带 transactional=false（DBA 模式）且 transactional 不在 body 里。
 func TestAppsDBExecute_DryRunSendsTransactionalFalse(t *testing.T) {
 	factory, stdout, _ := newAppsExecuteFactory(t)
 	if err := runAppsShortcut(t, AppsDBExecute,
@@ -193,7 +85,6 @@ func TestAppsDBExecute_DryRunSendsTransactionalFalse(t *testing.T) {
 	}
 }
 
-// TestAppsDBExecute_RejectsEmptySQL 断言 --sql 全空白时校验报错（提示需要 --sql 或 --file）。
 func TestAppsDBExecute_RejectsEmptySQL(t *testing.T) {
 	factory, stdout, _ := newAppsExecuteFactory(t)
 	err := runAppsShortcut(t, AppsDBExecute,
@@ -256,7 +147,6 @@ func TestAppsDBExecute_FileReadsSQLIntoBody(t *testing.T) {
 // 输入用 BOE 真实抓包数据（test_scripts/boe_e2e/run.log）。
 // ============================================================================
 
-// TestAppsDBExecute_LegacyWireSingleSelect 断言 legacy 字符串数组 wire 的单 SELECT 能正常渲染表格、不回退到 RAW。
 func TestAppsDBExecute_LegacyWireSingleSelect(t *testing.T) {
 	// BOE 实测：SELECT 1 AS x  →  result: "[\"[{\\\"x\\\":1}]\"]"
 	factory, stdout, reg := newAppsExecuteFactory(t)
@@ -288,9 +178,8 @@ func TestAppsDBExecute_LegacyWireSingleSelect(t *testing.T) {
 	}
 }
 
-// TestAppsDBExecute_LegacyWireSingleSelectJSONIsRowArray 断言 legacy wire 的 SELECT 同样归一化成 PRD 行数组形态。
-func TestAppsDBExecute_LegacyWireSingleSelectJSONIsRowArray(t *testing.T) {
-	// 验证 legacy wire 的 SELECT 也归一化成 PRD 行数组形态（data 直接是行）
+func TestAppsDBExecute_LegacyWireSingleSelectJSONEnvelope(t *testing.T) {
+	// 验证 JSON envelope 也把 legacy result 正确归一化进 data.results
 	factory, stdout, reg := newAppsExecuteFactory(t)
 	reg.Register(&httpmock.Stub{
 		Method: "POST",
@@ -308,20 +197,24 @@ func TestAppsDBExecute_LegacyWireSingleSelectJSONIsRowArray(t *testing.T) {
 		t.Fatalf("execute err=%v", err)
 	}
 	var env struct {
-		Data []map[string]interface{} `json:"data"`
+		Data struct {
+			Results []map[string]interface{} `json:"results"`
+		} `json:"data"`
 	}
 	if err := json.Unmarshal(stdout.Bytes(), &env); err != nil {
 		t.Fatalf("decode: %v\n%s", err, stdout.String())
 	}
-	if len(env.Data) != 1 {
-		t.Fatalf("data length = %d, want 1; got: %v", len(env.Data), env.Data)
+	if len(env.Data.Results) != 1 {
+		t.Fatalf("results length = %d, want 1; got: %v", len(env.Data.Results), env.Data.Results)
 	}
-	if env.Data[0]["x"] != float64(1) {
-		t.Fatalf("data[0].x = %v, want 1", env.Data[0]["x"])
+	if env.Data.Results[0]["sql_type"] != "SELECT" {
+		t.Fatalf("results[0].sql_type = %v, want SELECT", env.Data.Results[0]["sql_type"])
+	}
+	if env.Data.Results[0]["record_count"] != float64(1) {
+		t.Fatalf("results[0].record_count = %v, want 1", env.Data.Results[0]["record_count"])
 	}
 }
 
-// TestAppsDBExecute_LegacyWireMultiSelect 断言 legacy wire 多 SELECT 输出带 Statement N header 与末尾 "✓ N statements executed" 汇总。
 func TestAppsDBExecute_LegacyWireMultiSelect(t *testing.T) {
 	// BOE 实测：SELECT 1; SELECT 2  →  result: "[\"[{\\\"?column?\\\":1}]\",\"[{\\\"?column?\\\":2}]\"]"
 	factory, stdout, reg := newAppsExecuteFactory(t)
@@ -351,7 +244,6 @@ func TestAppsDBExecute_LegacyWireMultiSelect(t *testing.T) {
 	}
 }
 
-// TestAppsDBExecute_LegacyWireDDLEmptyResult 断言 result 为空字符串时（legacy DDL）pretty 输出 "(empty result)"。
 func TestAppsDBExecute_LegacyWireDDLEmptyResult(t *testing.T) {
 	// BOE 实测：CREATE TABLE  →  result: "" （空字符串，无 rows）
 	// 老 wire 不区分 DDL/DML/无返回，统一标 "ok"
@@ -378,7 +270,6 @@ func TestAppsDBExecute_LegacyWireDDLEmptyResult(t *testing.T) {
 	}
 }
 
-// TestAppsDBExecute_LegacyWireMultiSelectWithRealTable 断言含 CJK / uuid / int 字段的真实表行能正确显示在 pretty 表格里。
 func TestAppsDBExecute_LegacyWireMultiSelectWithRealTable(t *testing.T) {
 	// BOE 实测真实表抓包（course 表第一行）：复杂 JSON 含 CJK / timestamp / uuid 字段
 	factory, stdout, reg := newAppsExecuteFactory(t)
@@ -437,7 +328,6 @@ func TestAppsDBExecute_PrettySingleSelectTable(t *testing.T) {
 	}
 }
 
-// TestAppsDBExecute_PrettyEmptySelect 断言空 SELECT 的 pretty 输出为 "(0 rows)"。
 func TestAppsDBExecute_PrettyEmptySelect(t *testing.T) {
 	factory, stdout, reg := newAppsExecuteFactory(t)
 	reg.Register(&httpmock.Stub{
@@ -460,7 +350,6 @@ func TestAppsDBExecute_PrettyEmptySelect(t *testing.T) {
 	}
 }
 
-// TestAppsDBExecute_PrettySingleDMLAndDDL 断言单条 DML 渲染 "✓ N row(s) <verb>"、各类 DDL（含细粒度动词）渲染 "✓ DDL executed"。
 func TestAppsDBExecute_PrettySingleDMLAndDDL(t *testing.T) {
 	cases := []struct {
 		name    string
@@ -497,7 +386,6 @@ func TestAppsDBExecute_PrettySingleDMLAndDDL(t *testing.T) {
 	}
 }
 
-// TestAppsDBExecute_PrettyMultiStatementsAllSuccess 断言多语句全成功时逐条 Statement 摘要 + 末尾 "✓ N statements executed"。
 func TestAppsDBExecute_PrettyMultiStatementsAllSuccess(t *testing.T) {
 	factory, stdout, reg := newAppsExecuteFactory(t)
 	reg.Register(&httpmock.Stub{
@@ -567,7 +455,6 @@ func TestAppsDBExecute_PrettyMultiStatementsDDL(t *testing.T) {
 	}
 }
 
-// TestAppsDBExecute_PrettyMultiStatementsPartialFailureWithErrorSentinel 断言多语句部分失败时 pretty 仍打逐条 ✓/✗ 摘要、声明前序已 commit 未回滚，且返回 typed error、不打成功汇总。
 func TestAppsDBExecute_PrettyMultiStatementsPartialFailureWithErrorSentinel(t *testing.T) {
 	factory, stdout, reg := newAppsExecuteFactory(t)
 	reg.Register(&httpmock.Stub{
@@ -599,20 +486,19 @@ func TestAppsDBExecute_PrettyMultiStatementsPartialFailureWithErrorSentinel(t *t
 			t.Errorf("missing %q in pretty output\nfull:\n%s", line, got)
 		}
 	}
-	// 非事务（transactional=false）前序语句已逐条 commit 落地，须如实说明「committed and not rolled back」，
-	// 绝不能误报整批回滚。
-	if !strings.Contains(got, "committed and not rolled back") {
-		t.Errorf("non-tx failure must state prior statements committed & not rolled back; got:\n%s", got)
+	// DBA 模式（transactional=false）前序语句已 auto-commit 落地，绝不能误报「rolled back」。
+	if strings.Contains(got, "rolled back") {
+		t.Errorf("DBA mode must NOT claim rollback (prior statements persisted); got:\n%s", got)
 	}
 	if strings.Contains(got, "statements executed") {
 		t.Errorf("failed run should NOT print success summary; got:\n%s", got)
 	}
 }
 
-// TestAppsDBExecute_MultiStatementFailureReturnsTypedError 钉死「多语句失败 → typed errs.APIError」：
-// json 默认不再打 ok:true 假成功，而是返回 typed errs.* 错误（type=api / subtype=server_error、
-// exit=1）。失败位置在 message 的 "(at statement N of M)"，前序是否落地/是否回滚写在 hint。
-// 本例无 BEGIN → 前序逐条 commit、未回滚（hint 含 "committed and not rolled back"）。
+// TestAppsDBExecute_MultiStatementFailureReturnsTypedError 钉死「多语句失败 → typed api_error」：
+// json 默认不再打 ok:true 假成功，而是返回 *output.ExitError（type=api_error、非零 exit），
+// detail 带 statement_index / completed / rolled_back。rolled_back=false 因 CLI 永远 DBA 模式
+// （真机 boe 实证：失败前的语句已落地）。
 func TestAppsDBExecute_MultiStatementFailureReturnsTypedError(t *testing.T) {
 	factory, stdout, reg := newAppsExecuteFactory(t)
 	reg.Register(&httpmock.Stub{
@@ -638,26 +524,35 @@ func TestAppsDBExecute_MultiStatementFailureReturnsTypedError(t *testing.T) {
 	if strings.Contains(stdout.String(), `"ok": true`) {
 		t.Errorf("must not emit ok:true success envelope on failure; stdout:\n%s", stdout.String())
 	}
-	p, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("want a typed errs.* error, got %T: %v", err, err)
+	var exitErr *output.ExitError
+	if !errors.As(err, &exitErr) || exitErr.Detail == nil {
+		t.Fatalf("want *output.ExitError with detail, got %T: %v", err, err)
 	}
-	if p.Category != errs.CategoryAPI || p.Subtype != errs.SubtypeServerError {
-		t.Errorf("category/subtype = %s/%s, want api/server_error", p.Category, p.Subtype)
+	if exitErr.Detail.Type != "api_error" {
+		t.Errorf("error.type = %q, want api_error", exitErr.Detail.Type)
 	}
-	if p.Code != 1300002 {
-		t.Errorf("code = %d, want 1300002", p.Code)
+	if exitErr.Detail.Code != 1300002 {
+		t.Errorf("error.code = %d, want 1300002", exitErr.Detail.Code)
 	}
-	if !strings.Contains(p.Message, "(at statement 2 of 2)") {
-		t.Errorf("message missing statement locator: %q", p.Message)
-	}
-	// 无 BEGIN → 前序逐条 commit、未回滚，语义写在 hint。
-	if !strings.Contains(p.Hint, "committed and not rolled back") {
-		t.Errorf("hint should state prior statements committed & not rolled back: %q", p.Hint)
+	if !strings.Contains(exitErr.Detail.Message, "(at statement 2 of 2)") {
+		t.Errorf("error.message missing statement locator: %q", exitErr.Detail.Message)
 	}
 	if output.ExitCodeOf(err) != output.ExitAPI {
 		t.Errorf("exit = %d, want %d (ExitAPI)", output.ExitCodeOf(err), output.ExitAPI)
 	}
+	detail, ok := exitErr.Detail.Detail.(map[string]interface{})
+	if !ok {
+		t.Fatalf("error.detail not a map: %T", exitErr.Detail.Detail)
+	}
+	if detail["statement_index"] != 1 {
+		t.Errorf("statement_index = %v, want 1", detail["statement_index"])
+	}
+	if detail["rolled_back"] != false {
+		t.Errorf("rolled_back = %v, want false (DBA mode persists prior statements)", detail["rolled_back"])
+	}
+	if completed, ok := detail["completed"].([]map[string]interface{}); !ok || len(completed) != 1 {
+		t.Errorf("completed = %v, want 1 persisted statement", detail["completed"])
+	}
 }
 
 // TestAppsDBExecute_SingleErrorReturnsTypedError 单条语句失败（server 也返 code:0 + ERROR 哨兵）
@@ -680,90 +575,22 @@ func TestAppsDBExecute_SingleErrorReturnsTypedError(t *testing.T) {
 	if err == nil {
 		t.Fatalf("single ERROR sentinel must return a typed error; stdout:\n%s", stdout.String())
 	}
-	p, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("want a typed errs.* error, got %T: %v", err, err)
+	var exitErr *output.ExitError
+	if !errors.As(err, &exitErr) || exitErr.Detail == nil {
+		t.Fatalf("want *output.ExitError with detail, got %T: %v", err, err)
 	}
-	if p.Category != errs.CategoryAPI || p.Subtype != errs.SubtypeServerError {
-		t.Errorf("category/subtype = %s/%s, want api/server_error", p.Category, p.Subtype)
+	if !strings.Contains(exitErr.Detail.Message, "(at statement 1 of 1)") {
+		t.Errorf("error.message missing locator: %q", exitErr.Detail.Message)
 	}
-	if !strings.Contains(p.Message, "(at statement 1 of 1)") {
-		t.Errorf("message missing locator: %q", p.Message)
+	detail, _ := exitErr.Detail.Detail.(map[string]interface{})
+	if detail["statement_index"] != 0 {
+		t.Errorf("statement_index = %v, want 0", detail["statement_index"])
 	}
-	// 第一条就失败、无落地 的语义写在 hint。
-	if !strings.Contains(p.Hint, "No statements were applied") {
-		t.Errorf("hint should state nothing applied: %q", p.Hint)
+	if completed, ok := detail["completed"].([]map[string]interface{}); !ok || len(completed) != 0 {
+		t.Errorf("completed = %v, want empty", detail["completed"])
 	}
 }
 
-// TestAppsDBExecute_TransactionFailureRolledBack 钉死「显式事务内失败 → 整批回滚」：
-// 实测后端把 BEGIN 也作为 statement 返回；completed 含未配对 BEGIN → inferRolledBack 判定回滚。
-// 回滚语义现写在 hint（miaoda 原句 "Transaction rolled back; no changes persisted."），失败位置在 message。
-func TestAppsDBExecute_TransactionFailureRolledBack(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/spark/v1/apps/app_x/sql_commands",
-		Body: map[string]interface{}{
-			"code": 0,
-			"data": map[string]interface{}{
-				// BOE 实测 wire：BEGIN; CREATE; INSERT(ok); INSERT(dup→ERROR)
-				"result": `[` +
-					`{"sql_type":"BEGIN","data":"[]"},` +
-					`{"sql_type":"CREATE_TABLE","data":"[]"},` +
-					`{"sql_type":"INSERT","data":"[{\"rowCount\":1}]","affected_rows":1},` +
-					`{"sql_type":"ERROR","data":"{\"code\":\"k_dl_1300002\",\"message\":\"duplicate key value violates unique constraint\"}"}` +
-					`]`,
-			},
-		},
-	})
-	err := runAppsShortcut(t, AppsDBExecute,
-		[]string{"+db-execute", "--yes", "--app-id", "app_x", "--sql", "x", "--as", "user"},
-		factory, stdout)
-	if err == nil {
-		t.Fatalf("transaction failure must return a typed error; stdout:\n%s", stdout.String())
-	}
-	p, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("want a typed errs.* error, got %T: %v", err, err)
-	}
-	if p.Category != errs.CategoryAPI || p.Subtype != errs.SubtypeServerError {
-		t.Errorf("category/subtype = %s/%s, want api/server_error", p.Category, p.Subtype)
-	}
-	if !strings.Contains(p.Message, "(at statement 4 of 4)") {
-		t.Errorf("message missing statement locator: %q", p.Message)
-	}
-	// 事务整批回滚 / 前序未落库 的语义写在 hint（miaoda 原句）。
-	if !strings.Contains(p.Hint, "Transaction rolled back; no changes persisted.") {
-		t.Errorf("hint should state transaction rolled back & nothing persisted: %q", p.Hint)
-	}
-}
-
-// TestInferRolledBack_Cases 断言 inferRolledBack 按 BEGIN/COMMIT/ROLLBACK 计数判定失败时事务是否仍开着（即整批回滚）。
-func TestInferRolledBack_Cases(t *testing.T) {
-	stmt := func(t string) map[string]interface{} { return map[string]interface{}{"sql_type": t} }
-	cases := []struct {
-		name      string
-		completed []map[string]interface{}
-		want      bool
-	}{
-		{"empty", nil, false},
-		{"autocommit single", []map[string]interface{}{stmt("INSERT")}, false},
-		{"open tx (unmatched BEGIN)", []map[string]interface{}{stmt("BEGIN"), stmt("CREATE_TABLE"), stmt("INSERT")}, true},
-		{"closed tx (BEGIN+COMMIT)", []map[string]interface{}{stmt("BEGIN"), stmt("INSERT"), stmt("COMMIT")}, false},
-		{"reopened tx", []map[string]interface{}{stmt("BEGIN"), stmt("COMMIT"), stmt("BEGIN"), stmt("INSERT")}, true},
-		{"rollback closes tx", []map[string]interface{}{stmt("BEGIN"), stmt("INSERT"), stmt("ROLLBACK")}, false},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			if got := inferRolledBack(c.completed); got != c.want {
-				t.Errorf("inferRolledBack(%s) = %v, want %v", c.name, got, c.want)
-			}
-		})
-	}
-}
-
-// TestCellString_AllKinds 断言 cellString 对 nil/string/bool/整数/小数/对象各类型的字符串化结果。
 func TestCellString_AllKinds(t *testing.T) {
 	cases := []struct {
 		name string
@@ -787,7 +614,6 @@ func TestCellString_AllKinds(t *testing.T) {
 	}
 }
 
-// TestCodeString_Forms 断言 codeString 处理 nil / "k_dl_xxx" / 纯数字串 / float64 / 不支持类型各形态。
 func TestCodeString_Forms(t *testing.T) {
 	cases := []struct {
 		name string
@@ -809,7 +635,6 @@ func TestCodeString_Forms(t *testing.T) {
 	}
 }
 
-// TestDmlVerb_AllVerbs 断言 dmlVerb 对 INSERT/UPDATE/DELETE/MERGE 的动词映射（大小写不敏感），非 DML 返回 affected。
 func TestDmlVerb_AllVerbs(t *testing.T) {
 	cases := map[string]string{
 		"INSERT":       "inserted",
@@ -825,7 +650,6 @@ func TestDmlVerb_AllVerbs(t *testing.T) {
 	}
 }
 
-// TestIntOrZero_Cases 断言 intOrZero 对 JSON number 取整、对非数字 / nil 返回 0。
 func TestIntOrZero_Cases(t *testing.T) {
 	if got := intOrZero(float64(5)); got != 5 {
 		t.Errorf("intOrZero(5)=%d want 5", got)
@@ -838,7 +662,6 @@ func TestIntOrZero_Cases(t *testing.T) {
 	}
 }
 
-// TestErrorSummary_Cases 断言 errorSummary 对空 / 非法 JSON / 带 code / 无 code 各情形生成 "message [code]" 文案。
 func TestErrorSummary_Cases(t *testing.T) {
 	cases := []struct {
 		name, in, want string
@@ -857,7 +680,6 @@ func TestErrorSummary_Cases(t *testing.T) {
 	}
 }
 
-// TestParseErrorSentinel_Cases 断言 parseErrorSentinel 解析 ERROR 哨兵 data 得到数值 code 与 message（含空 / 非法 / 空 message 回退）。
 func TestParseErrorSentinel_Cases(t *testing.T) {
 	cases := []struct {
 		name, in string
@@ -879,7 +701,6 @@ func TestParseErrorSentinel_Cases(t *testing.T) {
 	}
 }
 
-// TestIsStructuredResult_Cases 断言 isStructuredResult 仅在首元素含 sql_type 时判为新结构化形态。
 func TestIsStructuredResult_Cases(t *testing.T) {
 	if !isStructuredResult([]map[string]interface{}{{"sql_type": "SELECT"}}) {
 		t.Error("expected structured=true when sql_type present")
@@ -892,7 +713,6 @@ func TestIsStructuredResult_Cases(t *testing.T) {
 	}
 }
 
-// TestNormalizeLegacyStatement_Cases 断言 normalizeLegacyStatement 把空 / null / 非 JSON 标为 OK、把 rows 数组标为 SELECT 并带 record_count。
 func TestNormalizeLegacyStatement_Cases(t *testing.T) {
 	t.Run("empty -> OK", func(t *testing.T) {
 		got := normalizeLegacyStatement("")
@@ -923,7 +743,6 @@ func TestNormalizeLegacyStatement_Cases(t *testing.T) {
 	})
 }
 
-// TestCellString_MarshalFallback 断言 cellString 对 json.Marshal 拒绝的类型（如 complex）回退到 fmt %v。
 func TestCellString_MarshalFallback(t *testing.T) {
 	// complex128 is not switch-handled and json.Marshal rejects it →
 	// falls back to fmt.Sprintf("%v", v), which is deterministic for complex.
@@ -932,7 +751,6 @@ func TestCellString_MarshalFallback(t *testing.T) {
 	}
 }
 
-// TestRenderSingleStatementPretty_Branches 断言 renderSingleStatementPretty 对 SELECT/ERROR/DML/legacy OK/DDL 各分支的输出。
 func TestRenderSingleStatementPretty_Branches(t *testing.T) {
 	cases := []struct {
 		name   string
@@ -956,7 +774,6 @@ func TestRenderSingleStatementPretty_Branches(t *testing.T) {
 	}
 }
 
-// TestRenderSelectRowsAsTable_Branches 断言 renderSelectRowsAsTable 对空串 / 空数组 / 非法 JSON 回退 / 正常 rows 各分支的输出。
 func TestRenderSelectRowsAsTable_Branches(t *testing.T) {
 	cases := []struct {
 		name   string

shortcuts/apps/apps_db_quota_get.go

@@ -1,100 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"fmt"
-	"io"
-
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// AppsDBQuotaGet reports an app's database storage usage and object counts.
-//
-// GET /apps/{app_id}/db/quota。storage_quota_bytes / usage_percent 在配额未对接（=0）时
-// 不输出（与 +file-quota-get 一致）；tables / views 始终输出。
-var AppsDBQuotaGet = common.Shortcut{
-	Service:     appsService,
-	Command:     "+db-quota-get",
-	Description: "Get an app's database storage usage",
-	Risk:        "read",
-	Tips: []string{
-		"Example: lark-cli apps +db-quota-get --app-id <app_id>",
-		"Example: lark-cli apps +db-quota-get --app-id <app_id> --env dev",
-	},
-	Scopes:    []string{"spark:app:read"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "env", Default: "online", Enum: []string{"dev", "online"}, Desc: "target db environment"},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		_, err := requireAppID(rctx.Str("app-id"))
-		return err
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		return common.NewDryRunAPI().
-			GET(appDbQuotaPath(appID)).
-			Desc("Get Miaoda app database storage usage").
-			Params(map[string]interface{}{"env": rctx.Str("env")})
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		data, err := rctx.CallAPITyped("GET", appDbQuotaPath(appID), map[string]interface{}{"env": rctx.Str("env")}, nil)
-		if err != nil {
-			return withAppsHint(err, appIDListHint)
-		}
-		out := projectDbQuota(data)
-		rctx.OutFormat(out, nil, func(w io.Writer) {
-			renderDbQuotaPretty(w, out)
-		})
-		return nil
-	},
-}
-
-// projectDbQuota 白名单投影 db quota 字段：只保留 storage_used_bytes / tables / views，
-// 配额已对接时再加 storage_quota_bytes / usage_percent。不透传后端其它字段，避免无用字段消耗上下文。
-func projectDbQuota(data map[string]interface{}) map[string]interface{} {
-	out := map[string]interface{}{"storage_used_bytes": data["storage_used_bytes"]}
-	for _, k := range []string{"tables", "views"} {
-		if v, ok := data[k]; ok {
-			out[k] = v
-		}
-	}
-	// 配额未对接（storage_quota_bytes=0/缺失）时不输出 quota / usage_percent。
-	if q, ok := numericAsFloat(data["storage_quota_bytes"]); ok && q > 0 {
-		out["storage_quota_bytes"] = data["storage_quota_bytes"]
-		if v, ok := data["usage_percent"]; ok {
-			out["usage_percent"] = v
-		}
-	}
-	return out
-}
-
-// renderDbQuotaPretty 打 Storage（已用 / 配额 (百分比)）与 Tables / Views 行（标签对齐 miaoda-cli）。
-func renderDbQuotaPretty(w io.Writer, data map[string]interface{}) {
-	used := humanBytes(data["storage_used_bytes"])
-	usage := used
-	if q, ok := numericAsFloat(data["storage_quota_bytes"]); ok && q > 0 {
-		pct := ""
-		if p, ok := numericAsFloat(data["usage_percent"]); ok {
-			pct = fmt.Sprintf(" (%.1f%%)", p)
-		}
-		usage = fmt.Sprintf("%s / %s%s", used, humanBytes(data["storage_quota_bytes"]), pct)
-	}
-	pairs := [][2]string{{"Storage", usage}}
-	if f, ok := numericAsFloat(data["tables"]); ok {
-		pairs = append(pairs, [2]string{"Tables", fmt.Sprintf("%d", int64(f))})
-	}
-	if f, ok := numericAsFloat(data["views"]); ok {
-		pairs = append(pairs, [2]string{"Views", fmt.Sprintf("%d", int64(f))})
-	}
-	renderKeyValuePairs(w, pairs)
-}

shortcuts/apps/apps_db_recovery.go

@@ -1,267 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"strings"
-	"time"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-const dbRecoveryHint = "PITR window is up to 7 days back, limited by your last `+db-env-migrate`; pass --target as a time (e.g. 2h / 2026-04-15 / 2026-04-15T10:00:00Z)"
-
-// AppsDBRecoveryDiff 预览把数据库恢复到某个时间点会带来的变更（PITR diff，不落地）。
-//
-// POST /apps/{app_id}/db/env_recovery，body {target, dry_run:true} → preview_request_id，
-// 轮询 env_recovery_diff_status 至终态，返回受影响表与行数变化。预览也需 spark:app:write scope。
-var AppsDBRecoveryDiff = common.Shortcut{
-	Service:     appsService,
-	Command:     "+db-recovery-diff",
-	Description: "Preview restoring the database to a point in time (PITR diff)",
-	Risk:        "read",
-	Tips: []string{
-		"Example: lark-cli apps +db-recovery-diff --app-id <app_id> --target 2h",
-		"Apply with +db-recovery-apply --target <same> --yes.",
-	},
-	Scopes:    []string{"spark:app:write"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "target", Desc: "point in time to restore to; relative (2h/3d) | date | datetime | ISO 8601 w/ TZ", Required: true},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		if _, err := requireAppID(rctx.Str("app-id")); err != nil {
-			return err
-		}
-		return normalizeTimeFlags(rctx, "target")
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		return common.NewDryRunAPI().POST(appRecoveryPath(appID)).Desc("Preview PITR recovery").
-			Body(map[string]interface{}{"target": rctx.Str("target"), "dry_run": true})
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		target := rctx.Str("target")
-		preview, err := runRecoveryPreview(rctx, appID, target)
-		if err != nil {
-			return err
-		}
-		out := recoveryDiffOutput(target, preview)
-		rctx.OutFormat(out, nil, func(w io.Writer) {
-			renderRecoveryDiff(w, target, out)
-		})
-		return nil
-	},
-}
-
-// AppsDBRecoveryApply 把数据库恢复到某个时间点（覆盖当前数据，异步，CLI 轮询至完成）。
-//
-// POST /apps/{app_id}/db/env_recovery，body {target, dry_run:false}；目标=当前态时短路 no_changes，
-// 否则轮询 env_recovery_apply_status 至 success。high-risk-write。
-var AppsDBRecoveryApply = common.Shortcut{
-	Service:     appsService,
-	Command:     "+db-recovery-apply",
-	Description: "Restore the database to a point in time (overwrites current data, irreversible)",
-	Risk:        "high-risk-write",
-	Tips: []string{
-		"Example: lark-cli apps +db-recovery-apply --app-id <app_id> --target 2026-04-15T10:00:00Z --yes",
-		"Preview first with +db-recovery-diff.",
-	},
-	Scopes:    []string{"spark:app:write"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "target", Desc: "point in time to restore to; relative (2h/3d) | date | datetime | ISO 8601 w/ TZ", Required: true},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		if _, err := requireAppID(rctx.Str("app-id")); err != nil {
-			return err
-		}
-		return normalizeTimeFlags(rctx, "target")
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		return common.NewDryRunAPI().POST(appRecoveryPath(appID)).Desc("Apply PITR recovery").
-			Body(map[string]interface{}{"target": rctx.Str("target"), "dry_run": false})
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		target := rctx.Str("target")
-		stop := rctx.StartSpinner("Restoring database (target: " + target + ")")
-		defer stop()
-		submit, err := rctx.CallAPITyped("POST", appRecoveryPath(appID), nil, map[string]interface{}{"target": target, "dry_run": false})
-		if err != nil {
-			return withAppsHint(err, dbRecoveryHint)
-		}
-		// 目标=当前态 → 后端短路 no_changes，不轮询。
-		if strings.ToLower(common.GetString(submit, "status")) == "no_changes" {
-			stop()
-			out := map[string]interface{}{"status": "no_changes", "target": target}
-			rctx.OutFormat(out, nil, func(w io.Writer) {
-				io.WriteString(w, "No changes — database is already at this state.\n")
-			})
-			return nil
-		}
-		final, perr := pollUntil(rctx.Ctx(), 2*time.Second, 30*time.Minute,
-			func() (map[string]interface{}, error) {
-				return rctx.CallAPITyped("GET", appRecoveryApplyStatusPath(appID), nil, nil)
-			},
-			func(d map[string]interface{}) (bool, error) {
-				switch strings.ToLower(common.GetString(d, "status")) {
-				case "success", "restored", "ready":
-					return true, nil
-				case "failed":
-					msg := common.GetString(d, "error_message")
-					if msg == "" {
-						msg = fmt.Sprintf("recovery to %s failed", target)
-					}
-					return false, withAppsHint(errs.NewAPIError(errs.SubtypeServerError, "%s", msg), dbRecoveryHint)
-				}
-				return false, nil
-			})
-		if perr != nil {
-			return perr
-		}
-		stop()
-		out := map[string]interface{}{"status": "restored", "target": target}
-		if n := intFromAny(final["restore_time_sec"]); n > 0 {
-			out["restore_time_sec"] = n
-		}
-		rctx.OutFormat(out, nil, func(w io.Writer) {
-			if n, ok := out["restore_time_sec"].(int); ok {
-				fmt.Fprintf(w, "✓ Database restored to %s (%ds elapsed)\n", target, n)
-			} else {
-				fmt.Fprintf(w, "✓ Database restored to %s\n", target)
-			}
-		})
-		return nil
-	},
-}
-
-// runRecoveryPreview 触发 PITR 预览（dry_run=true）拿 preview_request_id，轮询 diff_status 至终态。
-func runRecoveryPreview(rctx *common.RuntimeContext, appID, target string) (map[string]interface{}, error) {
-	stop := rctx.StartSpinner("Previewing recovery impact (target: " + target + ")")
-	defer stop()
-	submit, err := rctx.CallAPITyped("POST", appRecoveryPath(appID), nil, map[string]interface{}{"target": target, "dry_run": true})
-	if err != nil {
-		return nil, withAppsHint(err, dbRecoveryHint)
-	}
-	prid := common.GetString(submit, "preview_request_id")
-	if prid == "" {
-		return nil, errs.NewInternalError(errs.SubtypeInvalidResponse, "recovery diff did not return preview_request_id")
-	}
-	return pollUntil(rctx.Ctx(), 1*time.Second, 10*time.Minute,
-		func() (map[string]interface{}, error) {
-			return rctx.CallAPITyped("GET", appRecoveryDiffStatusPath(appID), map[string]interface{}{"preview_request_id": prid}, nil)
-		},
-		func(d map[string]interface{}) (bool, error) {
-			switch strings.ToLower(common.GetString(d, "preview_status")) {
-			case "success":
-				return true, nil
-			case "failed":
-				msg := common.GetString(d, "error_message")
-				if msg == "" {
-					msg = "recovery preview failed"
-				}
-				return false, withAppsHint(errs.NewAPIError(errs.SubtypeServerError, "%s", msg), dbRecoveryHint)
-			}
-			return false, nil
-		})
-}
-
-type recoveryChange struct {
-	Table     string      `json:"table"`
-	Inserted  interface{} `json:"inserted,omitempty"`
-	Deleted   interface{} `json:"deleted,omitempty"`
-	Action    string      `json:"action,omitempty"`
-	DroppedAt string      `json:"dropped_at,omitempty"`
-}
-
-// recoveryDiffOutput 组装 diff 输出：target / tables_affected / changes[] / estimated_seconds。
-func recoveryDiffOutput(target string, preview map[string]interface{}) map[string]interface{} {
-	arr, _ := preview["changes"].([]interface{})
-	changes := make([]recoveryChange, 0, len(arr))
-	for _, it := range arr {
-		m, ok := it.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		changes = append(changes, recoveryChange{
-			Table:     common.GetString(m, "table"),
-			Inserted:  m["inserted"],
-			Deleted:   m["deleted"],
-			Action:    common.GetString(m, "action"),
-			DroppedAt: common.GetString(m, "dropped_at"),
-		})
-	}
-	tablesAffected := intFromAny(preview["tables_affected"])
-	if tablesAffected == 0 {
-		tablesAffected = len(changes)
-	}
-	est := intFromAny(preview["estimated_seconds"])
-	if est == 0 {
-		est = 30 // PRD 兜底
-	}
-	return map[string]interface{}{
-		"target": target, "tables_affected": tablesAffected,
-		"changes": changes, "estimated_seconds": est,
-	}
-}
-
-// renderRecoveryDiff 渲染 PITR 恢复预览：受影响表数、逐表变化描述及预估耗时；无变更打提示。
-func renderRecoveryDiff(w io.Writer, target string, out map[string]interface{}) {
-	changes, _ := out["changes"].([]recoveryChange)
-	if len(changes) == 0 {
-		io.WriteString(w, "No changes — database is already at this state.\n")
-		return
-	}
-	fmt.Fprintf(w, "Recovery preview (→ %s):\n\n", target)
-	fmt.Fprintf(w, "  tables affected: %d\n", intFromAny(out["tables_affected"]))
-	for _, c := range changes {
-		fmt.Fprintf(w, "  %s: %s\n", c.Table, describeRecoveryChange(c))
-	}
-	fmt.Fprintf(w, "\n  estimated time: ~%ds\n", intFromAny(out["estimated_seconds"]))
-}
-
-// describeRecoveryChange：schema 动作 或 数据行变化二选一（无 modified，对齐设计）。
-func describeRecoveryChange(c recoveryChange) string {
-	switch c.Action {
-	case "restore_table":
-		return "table will be restored"
-	case "drop_table":
-		return "table will be dropped"
-	case "alter_table":
-		return "table will be altered"
-	case "unavailable":
-		if c.DroppedAt != "" {
-			return "diff unavailable: " + c.DroppedAt
-		}
-		return "diff unavailable"
-	}
-	parts := make([]string, 0, 2)
-	if n := intFromAny(c.Inserted); n != 0 {
-		parts = append(parts, fmt.Sprintf("+%d rows", n))
-	}
-	if n := intFromAny(c.Deleted); n != 0 {
-		parts = append(parts, fmt.Sprintf("-%d rows", n))
-	}
-	if len(parts) == 0 {
-		return "no changes"
-	}
-	return strings.Join(parts, ", ")
-}

shortcuts/apps/apps_file_delete.go

@@ -1,148 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// AppsFileDelete batch-deletes files by remote path（high-risk-write，框架自动注入 --yes 确认）。
-//
-// POST /apps/{app_id}/storage/file_batch_remove，body {paths:[...]}。网关把该路由注册为 POST
-// （DELETE-with-body 不被网关支持，实测 DELETE→404 / POST→200）。后端 results[] 与请求 paths
-// 顺序一一对应：成功项带 file，失败项带 error_code（CLI 据下标回填 path）。
-// 部分失败整体仍 ok:true —— 失败项落在 data.results[].error，不翻成非 0 退出码（lark-cli 信封语义）。
-var AppsFileDelete = common.Shortcut{
-	Service:     appsService,
-	Command:     "+file-delete",
-	Description: "Delete one or more files by remote path (batch)",
-	Risk:        "high-risk-write",
-	Tips: []string{
-		"Example: lark-cli apps +file-delete --app-id <app_id> --path /1858537546760216.png --yes",
-		"Repeat --path for batch delete.",
-	},
-	Scopes:    []string{"spark:app:write"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "path", Type: "string_slice", Desc: "remote file path to delete (repeatable)", Required: true},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		if _, err := requireAppID(rctx.Str("app-id")); err != nil {
-			return err
-		}
-		if len(cleanDeletePaths(rctx)) == 0 {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--path is required (at least one remote path)").WithParam("--path")
-		}
-		return nil
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		return common.NewDryRunAPI().
-			POST(appFileBatchRemovePath(appID)).
-			Desc("Batch delete Miaoda app files").
-			Body(map[string]interface{}{"paths": cleanDeletePaths(rctx)})
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		paths := cleanDeletePaths(rctx)
-		data, err := rctx.CallAPITyped("POST", appFileBatchRemovePath(appID), nil, map[string]interface{}{"paths": paths})
-		if err != nil {
-			return err
-		}
-		results := projectDeleteResults(data["results"], paths)
-		out := map[string]interface{}{"results": results}
-		rctx.OutFormat(out, nil, func(w io.Writer) {
-			renderFileDeletePretty(w, results)
-		})
-		return nil
-	},
-}
-
-// cleanDeletePaths 取 --path 切片，trim 去空。
-func cleanDeletePaths(rctx *common.RuntimeContext) []string {
-	out := make([]string, 0)
-	for _, p := range rctx.StrSlice("path") {
-		if t := strings.TrimSpace(p); t != "" {
-			out = append(out, t)
-		}
-	}
-	return out
-}
-
-// projectDeleteResults 把后端 results[] 按下标 zip 回请求 paths，回填 path，
-// 失败项把 error_code 包成 {code,message} 便于消费。
-func projectDeleteResults(raw interface{}, inputs []string) []map[string]interface{} {
-	arr, _ := raw.([]interface{})
-	out := make([]map[string]interface{}, 0, len(inputs))
-	for i, input := range inputs {
-		var r map[string]interface{}
-		if i < len(arr) {
-			r, _ = arr[i].(map[string]interface{})
-		}
-		status := "ok"
-		if r != nil && common.GetString(r, "status") != "" {
-			status = common.GetString(r, "status")
-		}
-		item := map[string]interface{}{"status": status, "path": input}
-		if status == "ok" {
-			if r != nil {
-				if f, ok := r["file"].(map[string]interface{}); ok {
-					item["file_name"] = common.GetString(f, "file_name")
-				}
-			}
-		} else {
-			code := ""
-			if r != nil {
-				code = common.GetString(r, "error_code")
-			}
-			if code == "" {
-				code = "DELETE_FAILED"
-			}
-			item["error"] = map[string]interface{}{
-				"code":    code,
-				"message": deleteErrorMessage(code, input),
-			}
-		}
-		out = append(out, item)
-	}
-	return out
-}
-
-// deleteErrorMessage 据 error_code 生成删除失败文案：FILE_NOT_FOUND 提示文件不存在，其余统一删除失败。
-func deleteErrorMessage(code, path string) string {
-	if code == "FILE_NOT_FOUND" {
-		return fmt.Sprintf("File '%s' does not exist", path)
-	}
-	return fmt.Sprintf("Failed to delete '%s'", path)
-}
-
-// renderFileDeletePretty 逐项打 ✓ / ✗，末行汇总 deleted 计数。
-func renderFileDeletePretty(w io.Writer, results []map[string]interface{}) {
-	okCount := 0
-	for _, r := range results {
-		path := common.GetString(r, "path")
-		if common.GetString(r, "status") == "ok" {
-			fmt.Fprintf(w, "✓ %s\n", path)
-			okCount++
-			continue
-		}
-		code := ""
-		if e, ok := r["error"].(map[string]interface{}); ok {
-			code = common.GetString(e, "code")
-		}
-		fmt.Fprintf(w, "✗ %s (%s)\n", path, code)
-	}
-	fmt.Fprintf(w, "\n%d/%d deleted\n", okCount, len(results))
-}

shortcuts/apps/apps_file_delete_test.go

@@ -1,132 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"encoding/json"
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-const fileDeleteURL = "/open-apis/spark/v1/apps/app_x/storage/file_batch_remove"
-
-// TestAppsFileDelete_RequiresAppIDAndPath 验证仅含空白的 --path 去空后为空时，Validate 报 --path typed 校验错误。
-func TestAppsFileDelete_RequiresAppIDAndPath(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	// 传入仅含空白的 --path：满足 cobra 的 Required 检查，但 cleanDeletePaths 去空后为空，
-	// 触发 Validate 内的 typed --path 校验。
-	err := runAppsShortcut(t, AppsFileDelete,
-		[]string{"+file-delete", "--app-id", "app_x", "--path", "  ", "--yes", "--as", "user"}, factory, stdout)
-	var ve *errs.ValidationError
-	if !errors.As(err, &ve) {
-		t.Fatalf("err = %T %v, want *errs.ValidationError", err, err)
-	}
-	if ve.Param != "--path" {
-		t.Fatalf("Param = %q, want --path", ve.Param)
-	}
-}
-
-// high-risk-write：无 --yes → confirmation_required（exit 10）。
-func TestAppsFileDelete_RequiresConfirmation(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	err := runAppsShortcut(t, AppsFileDelete,
-		[]string{"+file-delete", "--app-id", "app_x", "--path", "/a.png", "--as", "user"}, factory, stdout)
-	if err == nil || !strings.Contains(err.Error(), "requires confirmation") {
-		t.Fatalf("expected confirmation_required, got %v", err)
-	}
-}
-
-// TestAppsFileDelete_DryRunSendsPaths 验证 dry-run 输出 POST file_batch_remove，body.paths 按序携带多个 --path。
-func TestAppsFileDelete_DryRunSendsPaths(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	if err := runAppsShortcut(t, AppsFileDelete,
-		[]string{"+file-delete", "--app-id", "app_x", "--path", "/a.png", "--path", "/b.png", "--yes", "--dry-run", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("dry-run err=%v", err)
-	}
-	var env struct {
-		API []struct {
-			Method string                 `json:"method"`
-			URL    string                 `json:"url"`
-			Body   map[string]interface{} `json:"body"`
-		} `json:"api"`
-	}
-	_ = json.Unmarshal([]byte(stdout.String()), &env)
-	a := env.API[0]
-	if a.Method != "POST" || a.URL != fileDeleteURL {
-		t.Fatalf("dry-run = %s %s", a.Method, a.URL)
-	}
-	paths, _ := a.Body["paths"].([]interface{})
-	if len(paths) != 2 || paths[0] != "/a.png" || paths[1] != "/b.png" {
-		t.Fatalf("body.paths = %v", a.Body["paths"])
-	}
-}
-
-// 部分失败仍 ok:true；results 按下标 zip 回 path；失败项带 error{code,message}。
-func TestAppsFileDelete_PartialFailureStillOK(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: fileDeleteURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"results": []interface{}{
-				map[string]interface{}{"status": "ok", "file": map[string]interface{}{"file_name": "a.png", "path": "/a.png"}},
-				map[string]interface{}{"status": "error", "error_code": "FILE_NOT_FOUND"},
-			},
-		}},
-	})
-	err := runAppsShortcut(t, AppsFileDelete,
-		[]string{"+file-delete", "--app-id", "app_x", "--path", "/a.png", "--path", "/missing.png", "--yes", "--as", "user"}, factory, stdout)
-	if err != nil {
-		t.Fatalf("partial failure should NOT error (ok:true semantics), got %v", err)
-	}
-	got := stdout.String()
-	var env struct {
-		Data struct {
-			Results []map[string]interface{} `json:"results"`
-		} `json:"data"`
-	}
-	if err := json.Unmarshal([]byte(got), &env); err != nil {
-		t.Fatalf("decode: %v\n%s", err, got)
-	}
-	if len(env.Data.Results) != 2 {
-		t.Fatalf("want 2 results, got %d: %s", len(env.Data.Results), got)
-	}
-	r0, r1 := env.Data.Results[0], env.Data.Results[1]
-	if r0["status"] != "ok" || r0["path"] != "/a.png" {
-		t.Errorf("result[0] = %v", r0)
-	}
-	if r1["status"] != "error" || r1["path"] != "/missing.png" {
-		t.Errorf("result[1] = %v (path must be back-filled by index)", r1)
-	}
-	if e, ok := r1["error"].(map[string]interface{}); !ok || e["code"] != "FILE_NOT_FOUND" {
-		t.Errorf("result[1].error = %v (want code FILE_NOT_FOUND)", r1["error"])
-	}
-}
-
-// TestAppsFileDelete_PrettySummary 验证 pretty 输出逐项 ✓/✗ 标记并汇总 "1/2 deleted"。
-func TestAppsFileDelete_PrettySummary(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: fileDeleteURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"results": []interface{}{
-				map[string]interface{}{"status": "ok", "file": map[string]interface{}{"file_name": "a.png"}},
-				map[string]interface{}{"status": "error", "error_code": "FILE_NOT_FOUND"},
-			},
-		}},
-	})
-	if err := runAppsShortcut(t, AppsFileDelete,
-		[]string{"+file-delete", "--app-id", "app_x", "--path", "/a.png", "--path", "/missing.png", "--yes", "--format", "pretty", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	got := stdout.String()
-	for _, want := range []string{"✓ /a.png", "✗ /missing.png (FILE_NOT_FOUND)", "1/2 deleted"} {
-		if !strings.Contains(got, want) {
-			t.Errorf("pretty missing %q:\n%s", want, got)
-		}
-	}
-}

shortcuts/apps/apps_file_download.go

@@ -1,122 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net/http"
-	"path"
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/extension/fileio"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// AppsFileDownload downloads a file to a local path via a signed URL。
-//
-// 两步：POST /apps/{app_id}/storage/file_sign 拿 signed_url（presigned，直连对象存储），
-// 再客户端 GET signed_url 落盘到 --output（默认远端 basename）。不单设 download 接口。
-var AppsFileDownload = common.Shortcut{
-	Service:     appsService,
-	Command:     "+file-download",
-	Description: "Download a file to a local path (via a signed URL)",
-	Risk:        "read",
-	Tips: []string{
-		"Example: lark-cli apps +file-download --app-id <app_id> --path /1858537546760216.png --output ./logo.png",
-		"Example (omit --output): lark-cli apps +file-download --app-id <app_id> --path /1858537546760216.png   # saves to ./1858537546760216.png",
-	},
-	Scopes:    []string{"spark:app:read"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "path", Desc: "remote file path", Required: true},
-		{Name: "output", Desc: "local output path (default: remote file basename in cwd)"},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		if _, err := requireAppID(rctx.Str("app-id")); err != nil {
-			return err
-		}
-		_, err := requireFilePath(rctx.Str("path"))
-		return err
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		remotePath, _ := requireFilePath(rctx.Str("path"))
-		return common.NewDryRunAPI().
-			POST(appFileSignPath(appID)).
-			Desc("Sign a download URL, then GET it to --output").
-			Body(map[string]interface{}{"path": remotePath})
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		remotePath, err := requireFilePath(rctx.Str("path"))
-		if err != nil {
-			return err
-		}
-
-		// 1. 签名拿 presigned signed_url。
-		signData, err := rctx.CallAPITyped("POST", appFileSignPath(appID), nil, map[string]interface{}{"path": remotePath})
-		if err != nil {
-			return err
-		}
-		signedURL := common.GetString(signData, "signed_url")
-		if signedURL == "" {
-			return errs.NewInternalError(errs.SubtypeInvalidResponse, "sign returned no signed_url")
-		}
-
-		// 2. 直连 GET signed_url 落盘。
-		out := strings.TrimSpace(rctx.Str("output"))
-		if out == "" {
-			out = path.Base(strings.TrimPrefix(remotePath, "/"))
-			if out == "" || out == "." || out == "/" {
-				out = "download"
-			}
-		}
-		req, err := http.NewRequestWithContext(rctx.Ctx(), http.MethodGet, signedURL, nil) //nolint:forbidigo // GET from a presigned object-storage URL bypasses the Lark gateway; raw HTTP required (not a Lark API call).
-		if err != nil {
-			return errs.NewNetworkError(errs.SubtypeNetworkTransport, "build download request").WithCause(err)
-		}
-		resp, err := newFileTransferClient().Do(req) //nolint:forbidigo // see above: direct presigned-URL download, RuntimeContext.DoAPI does not apply.
-		if err != nil {
-			// dial/transport 失败是典型可重试场景。
-			return errs.NewNetworkError(errs.SubtypeNetworkTransport, "download failed").WithCause(err).WithRetryable()
-		}
-		defer resp.Body.Close()
-		if resp.StatusCode >= 400 {
-			io.Copy(io.Discard, io.LimitReader(resp.Body, 4096))
-			// 5xx 是上游瞬时故障，标 retryable；4xx（如签名过期）需重新签名而非盲重试，不标。
-			if resp.StatusCode >= 500 {
-				return errs.NewNetworkError(errs.SubtypeNetworkServer, "download failed: HTTP %d", resp.StatusCode).WithRetryable()
-			}
-			return errs.NewNetworkError(errs.SubtypeNetworkTransport, "download failed: HTTP %d", resp.StatusCode)
-		}
-		saved, err := rctx.FileIO().Save(out, fileio.SaveOptions{
-			ContentType:   resp.Header.Get("Content-Type"),
-			ContentLength: resp.ContentLength,
-		}, resp.Body)
-		if err != nil {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--output: %v", err).WithParam("--output").WithCause(err)
-		}
-		resolved, perr := rctx.FileIO().ResolvePath(out)
-		if perr != nil || resolved == "" {
-			resolved = out
-		}
-		result := map[string]interface{}{
-			"path":       remotePath,
-			"output":     resolved,
-			"size_bytes": saved.Size(),
-		}
-		rctx.OutFormat(result, nil, func(w io.Writer) {
-			fmt.Fprintf(w, "✓ Downloaded %s → %s (%s)\n", remotePath, resolved, humanBytes(saved.Size()))
-		})
-		return nil
-	},
-}

shortcuts/apps/apps_file_download_test.go

@@ -1,122 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"encoding/json"
-	"errors"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-const fileSignURLForDownload = "/open-apis/spark/v1/apps/app_x/storage/file_sign"
-
-// TestAppsFileDownload_RequiresAppIDAndPath 验证仅含空白的 --path 触发 --path typed 校验错误。
-func TestAppsFileDownload_RequiresAppIDAndPath(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	err := runAppsShortcut(t, AppsFileDownload,
-		[]string{"+file-download", "--app-id", "app_x", "--path", "  ", "--as", "user"}, factory, stdout)
-	var ve *errs.ValidationError
-	if !errors.As(err, &ve) {
-		t.Fatalf("err = %T %v, want *errs.ValidationError", err, err)
-	}
-	if ve.Param != "--path" {
-		t.Fatalf("Param = %q, want --path", ve.Param)
-	}
-}
-
-// TestAppsFileDownload_DryRunSignsFirst 验证 dry-run 第一步是 POST file_sign。
-func TestAppsFileDownload_DryRunSignsFirst(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	if err := runAppsShortcut(t, AppsFileDownload,
-		[]string{"+file-download", "--app-id", "app_x", "--path", "/x.png", "--dry-run", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("dry-run err=%v", err)
-	}
-	var env struct {
-		API []struct {
-			Method string `json:"method"`
-			URL    string `json:"url"`
-		} `json:"api"`
-	}
-	_ = json.Unmarshal([]byte(stdout.String()), &env)
-	if env.API[0].Method != "POST" || env.API[0].URL != fileSignURLForDownload {
-		t.Fatalf("dry-run = %s %s (want POST sign)", env.API[0].Method, env.API[0].URL)
-	}
-}
-
-// sign → 客户端 GET presigned signed_url → 落盘 --output。
-func TestAppsFileDownload_EndToEnd(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method != http.MethodGet {
-			w.WriteHeader(http.StatusMethodNotAllowed)
-			return
-		}
-		w.Header().Set("Content-Type", "image/png")
-		io.WriteString(w, "PNGDATA")
-	}))
-	defer srv.Close()
-
-	dir := t.TempDir()
-	oldWD, _ := os.Getwd()
-	if err := os.Chdir(dir); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = os.Chdir(oldWD) })
-
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: fileSignURLForDownload,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"signed_url": srv.URL}},
-	})
-	if err := runAppsShortcut(t, AppsFileDownload,
-		[]string{"+file-download", "--app-id", "app_x", "--path", "/x.png", "--output", "out.png", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	b, err := os.ReadFile(filepath.Join(dir, "out.png"))
-	if err != nil {
-		t.Fatalf("read output file: %v", err)
-	}
-	if string(b) != "PNGDATA" {
-		t.Fatalf("downloaded content = %q, want PNGDATA", b)
-	}
-	if !strings.Contains(stdout.String(), `"size_bytes": 7`) {
-		t.Errorf("output json missing size_bytes:7\n%s", stdout.String())
-	}
-}
-
-// 不传 --output → 默认远端 basename。
-func TestAppsFileDownload_DefaultsOutputToBasename(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		io.WriteString(w, "DATA")
-	}))
-	defer srv.Close()
-
-	dir := t.TempDir()
-	oldWD, _ := os.Getwd()
-	if err := os.Chdir(dir); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = os.Chdir(oldWD) })
-
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: fileSignURLForDownload,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"signed_url": srv.URL}},
-	})
-	if err := runAppsShortcut(t, AppsFileDownload,
-		[]string{"+file-download", "--app-id", "app_x", "--path", "/1858537546760216.png", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	if _, err := os.Stat(filepath.Join(dir, "1858537546760216.png")); err != nil {
-		t.Fatalf("default output basename not written: %v", err)
-	}
-}

shortcuts/apps/apps_file_get.go

@@ -1,87 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"io"
-
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// AppsFileGet gets one file's metadata by exact remote path（动词对齐 +file-list）。
-//
-// GET /apps/{app_id}/storage/file?path=<path>。file 仅按 path 精确寻址，无按名寻址。
-// pretty 渲染 key/value：file_name / path / size(含 bytes) / type / uploaded_by(只 name) / uploaded_at /
-// download_url（条件出现）。server created_at/created_by → uploaded_at/uploaded_by。
-var AppsFileGet = common.Shortcut{
-	Service:     appsService,
-	Command:     "+file-get",
-	Description: "Get a single file's metadata by path",
-	Risk:        "read",
-	Tips: []string{
-		"Example: lark-cli apps +file-get --app-id <app_id> --path /1858537546760216.png",
-		"Tip: extract a single field with --jq, e.g. -q '.size_bytes' or -q '.download_url'",
-	},
-	Scopes:    []string{"spark:app:read"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "path", Desc: "remote file path", Required: true},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		if _, err := requireAppID(rctx.Str("app-id")); err != nil {
-			return err
-		}
-		_, err := requireFilePath(rctx.Str("path"))
-		return err
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		return common.NewDryRunAPI().
-			GET(appFileGetPath(appID)).
-			Desc("Get Miaoda app file metadata").
-			Params(buildFileGetParams(rctx))
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		data, err := rctx.CallAPITyped("GET", appFileGetPath(appID), buildFileGetParams(rctx), nil)
-		if err != nil {
-			return err
-		}
-		info := projectFileInfo(data)
-		rctx.OutFormat(info, nil, func(w io.Writer) {
-			renderFileGetPretty(w, info)
-		})
-		return nil
-	},
-}
-
-// buildFileGetParams 组装 file_get 查询参数：按 path 精确寻址单文件。
-func buildFileGetParams(rctx *common.RuntimeContext) map[string]interface{} {
-	path, _ := requireFilePath(rctx.Str("path"))
-	return map[string]interface{}{"path": path}
-}
-
-// renderFileGetPretty 输出对齐 key/value；uploaded_by 只展示 name（id 仅 json 保留）。
-func renderFileGetPretty(w io.Writer, info fileInfo) {
-	pairs := [][2]string{
-		{"file_name", dashIfEmpty(info.FileName)},
-		{"path", info.Path},
-		{"size", fileSizeDetail(info.SizeBytes)},
-		{"type", dashIfEmpty(info.Type)},
-	}
-	if info.UploadedBy != nil {
-		pairs = append(pairs, [2]string{"uploaded_by", info.UploadedBy.Name})
-	}
-	pairs = append(pairs, [2]string{"uploaded_at", dashIfEmpty(info.UploadedAt)})
-	if info.DownloadURL != "" {
-		pairs = append(pairs, [2]string{"download_url", info.DownloadURL})
-	}
-	renderKeyValuePairs(w, pairs)
-}

shortcuts/apps/apps_file_get_test.go

@@ -1,89 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"encoding/json"
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-const fileGetURL = "/open-apis/spark/v1/apps/app_x/storage/file"
-
-// TestAppsFileGet_RequiresAppIDAndPath 验证空白 --app-id 与空白 --path 分别触发对应的 typed 校验错误。
-func TestAppsFileGet_RequiresAppIDAndPath(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	err := runAppsShortcut(t, AppsFileGet,
-		[]string{"+file-get", "--app-id", "  ", "--path", "/x.png", "--as", "user"}, factory, stdout)
-	var ve *errs.ValidationError
-	if !errors.As(err, &ve) {
-		t.Fatalf("err = %T %v, want *errs.ValidationError", err, err)
-	}
-	if ve.Param != "--app-id" {
-		t.Fatalf("Param = %q, want --app-id", ve.Param)
-	}
-	factory2, stdout2, _ := newAppsExecuteFactory(t)
-	err2 := runAppsShortcut(t, AppsFileGet,
-		[]string{"+file-get", "--app-id", "app_x", "--path", "  ", "--as", "user"}, factory2, stdout2)
-	var ve2 *errs.ValidationError
-	if !errors.As(err2, &ve2) {
-		t.Fatalf("err = %T %v, want *errs.ValidationError", err2, err2)
-	}
-	if ve2.Param != "--path" {
-		t.Fatalf("Param = %q, want --path", ve2.Param)
-	}
-}
-
-// TestAppsFileGet_DryRunSendsPathQuery 验证 dry-run 输出 GET file，path 作为 query 参数下发。
-func TestAppsFileGet_DryRunSendsPathQuery(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	if err := runAppsShortcut(t, AppsFileGet,
-		[]string{"+file-get", "--app-id", "app_x", "--path", "/x.png", "--dry-run", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("dry-run err=%v", err)
-	}
-	var env struct {
-		API []struct {
-			Method string                 `json:"method"`
-			URL    string                 `json:"url"`
-			Params map[string]interface{} `json:"params"`
-		} `json:"api"`
-	}
-	_ = json.Unmarshal([]byte(stdout.String()), &env)
-	if env.API[0].Method != "GET" || env.API[0].URL != fileGetURL || env.API[0].Params["path"] != "/x.png" {
-		t.Fatalf("dry-run = %s %s params=%v", env.API[0].Method, env.API[0].URL, env.API[0].Params)
-	}
-}
-
-// TestAppsFileGet_SuccessAndPrettyKeyValue 验证 pretty key/value 展示 size 含 bytes、uploaded_by 只显示 name 且不泄漏 user id。
-func TestAppsFileGet_SuccessAndPrettyKeyValue(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: fileGetURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"file_name": "logo.png", "path": "/1858537546760216.png",
-			"size_bytes": 24580, "type": "image/png",
-			"created_at": "2026-04-15T10:30:00Z",
-			"created_by": `{"id":"7311","name":"alice"}`,
-		}},
-	})
-	if err := runAppsShortcut(t, AppsFileGet,
-		[]string{"+file-get", "--app-id", "app_x", "--path", "/1858537546760216.png", "--format", "pretty", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	got := stdout.String()
-	// pretty key/value：size 含 bytes、uploaded_by 只展示 name。
-	for _, want := range []string{"file_name:", "24 KB (24580 bytes)", "uploaded_by: alice", "uploaded_at: 2026-04-15T10:30:00Z"} {
-		if !strings.Contains(got, want) {
-			t.Errorf("pretty missing %q:\n%s", want, got)
-		}
-	}
-	// pretty 不该泄漏 user id。
-	if strings.Contains(got, "7311") {
-		t.Errorf("pretty should show name only, not id:\n%s", got)
-	}
-}

shortcuts/apps/apps_file_list.go

@@ -1,145 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"io"
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// AppsFileList lists files in a Miaoda app's storage (cursor pagination)。
-//
-// GET /apps/{app_id}/storage/file_list。过滤器：--name / --path / --type / --size-gt /
-// --size-lt / --uploaded-since / --uploaded-until（精确或区间），分页 --page-size/--page-token。
-// file 域不分 dev/online，无 --env。
-//
-// pretty 渲染 5 列：file_name / path / size / type / uploaded_at；空结果打 "No files found."。
-// server 字段 created_at → 产品语义 uploaded_at。
-var AppsFileList = common.Shortcut{
-	Service:     appsService,
-	Command:     "+file-list",
-	Description: "List files in a Miaoda app's storage (cursor pagination)",
-	Risk:        "read",
-	Tips: []string{
-		"Example: lark-cli apps +file-list --app-id <app_id>",
-		"Tip: filter fields with --jq, e.g. -q '.data.items[].path'",
-	},
-	Scopes:    []string{"spark:app:read"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "name", Desc: "filter by exact file name"},
-		{Name: "path", Desc: "filter by exact remote path"},
-		{Name: "type", Desc: "filter by MIME type"},
-		{Name: "size-gt", Type: "int", Desc: "filter: size greater than (bytes)"},
-		{Name: "size-lt", Type: "int", Desc: "filter: size less than (bytes)"},
-		{Name: "uploaded-since", Desc: "filter: uploaded at or after; relative (7d/2h/30s) | date (2026-04-15) | datetime (2026-04-15T10:00:00) | ISO 8601 w/ TZ"},
-		{Name: "uploaded-until", Desc: "filter: uploaded at or before; relative (7d/2h/30s) | date (2026-04-15) | datetime (2026-04-15T10:00:00) | ISO 8601 w/ TZ"},
-		{Name: "page-size", Type: "int", Default: "20", Desc: "page size"},
-		{Name: "page-token", Desc: "pagination cursor from previous response"},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		if _, err := requireAppID(rctx.Str("app-id")); err != nil {
-			return err
-		}
-		// 设计原则三：<timestamp> 多格式 → 归一化为 RFC3339 UTC，回写到 flag 供 buildFileListParams 透传。
-		for _, f := range []string{"uploaded-since", "uploaded-until"} {
-			if strings.TrimSpace(rctx.Str(f)) == "" {
-				continue
-			}
-			n, err := normalizeTimestamp(rctx.Str(f))
-			if err != nil {
-				return errs.NewValidationError(errs.SubtypeInvalidArgument, "--%s: %v", f, err).WithParam("--" + f)
-			}
-			_ = rctx.Cmd.Flags().Set(f, n)
-		}
-		return nil
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		return common.NewDryRunAPI().
-			GET(appFileListPath(appID)).
-			Desc("List Miaoda app files").
-			Params(buildFileListParams(rctx))
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		data, err := rctx.CallAPITyped("GET", appFileListPath(appID), buildFileListParams(rctx), nil)
-		if err != nil {
-			return err
-		}
-		// 白名单投影：server created_at/created_by → uploaded_at/uploaded_by，替换原始 items[]。
-		items := projectFileItems(data["items"])
-		data["items"] = items
-		rctx.OutFormat(data, nil, func(w io.Writer) {
-			renderFileListPretty(w, items)
-		})
-		return nil
-	},
-}
-
-// projectFileItems 把服务端原始 items 逐项投影为白名单 fileInfo（created_*→uploaded_*）。
-func projectFileItems(raw interface{}) []fileInfo {
-	arr, _ := raw.([]interface{})
-	out := make([]fileInfo, 0, len(arr))
-	for _, it := range arr {
-		if m, ok := it.(map[string]interface{}); ok {
-			out = append(out, projectFileInfo(m))
-		}
-	}
-	return out
-}
-
-// buildFileListParams 组装 file_list 查询参数：page_size 及可选 name/path/type/size_gt/size_lt/uploaded_since/uploaded_until/page_token。
-func buildFileListParams(rctx *common.RuntimeContext) map[string]interface{} {
-	params := map[string]interface{}{
-		"page_size": rctx.Int("page-size"),
-	}
-	addStr := func(flag, key string) {
-		if v := strings.TrimSpace(rctx.Str(flag)); v != "" {
-			params[key] = v
-		}
-	}
-	addStr("name", "name")
-	addStr("path", "path")
-	addStr("type", "type")
-	addStr("uploaded-since", "uploaded_since")
-	addStr("uploaded-until", "uploaded_until")
-	addStr("page-token", "page_token")
-	if v := rctx.Int("size-gt"); v > 0 {
-		params["size_gt"] = v
-	}
-	if v := rctx.Int("size-lt"); v > 0 {
-		params["size_lt"] = v
-	}
-	return params
-}
-
-// renderFileListPretty 5 列对齐表：file_name / path / size / type / uploaded_at。
-func renderFileListPretty(w io.Writer, items []fileInfo) {
-	if len(items) == 0 {
-		io.WriteString(w, "No files found.\n")
-		return
-	}
-	headers := []string{"file_name", "path", "size", "type", "uploaded_at"}
-	rows := make([][]string, 0, len(items))
-	for _, it := range items {
-		rows = append(rows, []string{
-			dashIfEmpty(it.FileName),
-			it.Path,
-			humanBytes(it.SizeBytes),
-			dashIfEmpty(it.Type),
-			dashIfEmpty(it.UploadedAt),
-		})
-	}
-	renderAlignedTable(w, headers, rows)
-}

shortcuts/apps/apps_file_list_test.go

@@ -1,252 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"encoding/json"
-	"errors"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-// 设计原则三：<timestamp> 四种格式 → 统一 RFC3339 UTC。
-func TestNormalizeTimestamp_AllFormats(t *testing.T) {
-	// 空串透传
-	if got, err := normalizeTimestamp("  "); err != nil || got != "" {
-		t.Fatalf("empty → %q,%v want \"\",nil", got, err)
-	}
-
-	// ISO 8601 带 TZ：Z 原样、显式偏移换算到 UTC
-	mustEq := func(in, want string) {
-		got, err := normalizeTimestamp(in)
-		if err != nil || got != want {
-			t.Errorf("normalizeTimestamp(%q)=%q,%v want %q", in, got, err, want)
-		}
-	}
-	mustEq("2026-04-15T10:00:00Z", "2026-04-15T10:00:00Z")
-	mustEq("2026-04-15T10:00:00+08:00", "2026-04-15T02:00:00Z") // +08:00 → UTC -8h
-
-	// date / local datetime：按本地时区解释再转 UTC（与 time.ParseInLocation 对齐）
-	dExp, _ := time.ParseInLocation("2006-01-02", "2026-04-15", time.Local)
-	mustEq("2026-04-15", dExp.UTC().Format(time.RFC3339))
-	ldExp, _ := time.ParseInLocation("2006-01-02T15:04:05", "2026-04-15T10:00:00", time.Local)
-	mustEq("2026-04-15T10:00:00", ldExp.UTC().Format(time.RFC3339))
-
-	// 相对：从现在往前推，结果应 ≈ now-dur（5s 容差）
-	for _, c := range []struct {
-		in  string
-		dur time.Duration
-	}{{"30s", 30 * time.Second}, {"5m", 5 * time.Minute}, {"2h", 2 * time.Hour}, {"3d", 72 * time.Hour}, {"1w", 7 * 24 * time.Hour}} {
-		got, err := normalizeTimestamp(c.in)
-		if err != nil {
-			t.Errorf("normalizeTimestamp(%q) err=%v", c.in, err)
-			continue
-		}
-		ts, perr := time.Parse(time.RFC3339, got)
-		if perr != nil {
-			t.Errorf("normalizeTimestamp(%q)=%q not RFC3339", c.in, got)
-			continue
-		}
-		want := time.Now().Add(-c.dur)
-		if diff := want.Sub(ts); diff > 5*time.Second || diff < -5*time.Second {
-			t.Errorf("normalizeTimestamp(%q)=%q off by %v from now-%v", c.in, got, diff, c.dur)
-		}
-	}
-
-	// 非法格式 → error
-	for _, bad := range []string{"notatime", "7x", "2026/04/15", "2026-13-99"} {
-		if _, err := normalizeTimestamp(bad); err == nil {
-			t.Errorf("normalizeTimestamp(%q) expected error", bad)
-		}
-	}
-}
-
-const fileListURL = "/open-apis/spark/v1/apps/app_x/storage/file_list"
-
-// TestAppsFileList_RequiresAppID 验证空白 --app-id 触发 --app-id typed 校验错误。
-func TestAppsFileList_RequiresAppID(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	err := runAppsShortcut(t, AppsFileList,
-		[]string{"+file-list", "--app-id", "  ", "--as", "user"}, factory, stdout)
-	var ve *errs.ValidationError
-	if !errors.As(err, &ve) {
-		t.Fatalf("err = %T %v, want *errs.ValidationError", err, err)
-	}
-	if ve.Param != "--app-id" {
-		t.Fatalf("Param = %q, want --app-id", ve.Param)
-	}
-}
-
-// 过滤器 + 分页全部进 query（size-gt/lt 走 int，uploaded_since/until 原样）。
-func TestAppsFileList_DryRunSendsFiltersAndPagination(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	if err := runAppsShortcut(t, AppsFileList,
-		[]string{"+file-list", "--app-id", "app_x",
-			"--name", "logo.png", "--path", "/x.png", "--type", "image/png",
-			"--size-gt", "100", "--size-lt", "9000",
-			"--uploaded-since", "2026-01-01", "--uploaded-until", "2026-02-01",
-			"--page-size", "5", "--page-token", "cur-1",
-			"--dry-run", "--as", "user"},
-		factory, stdout); err != nil {
-		t.Fatalf("dry-run err=%v", err)
-	}
-	var env struct {
-		API []struct {
-			Method string                 `json:"method"`
-			URL    string                 `json:"url"`
-			Params map[string]interface{} `json:"params"`
-		} `json:"api"`
-	}
-	if err := json.Unmarshal([]byte(stdout.String()), &env); err != nil {
-		t.Fatalf("decode dry-run: %v\n%s", err, stdout.String())
-	}
-	a := env.API[0]
-	if a.Method != "GET" || a.URL != fileListURL {
-		t.Fatalf("method/url = %s %s", a.Method, a.URL)
-	}
-	// 设计原则三：date 入参会被归一化为 RFC3339 UTC，期望值用 normalizeTimestamp 计算（避开本地时区脆弱断言）。
-	sinceN, _ := normalizeTimestamp("2026-01-01")
-	untilN, _ := normalizeTimestamp("2026-02-01")
-	wantStr := map[string]string{
-		"name": "logo.png", "path": "/x.png", "type": "image/png",
-		"uploaded_since": sinceN, "uploaded_until": untilN, "page_token": "cur-1",
-	}
-	for k, v := range wantStr {
-		if a.Params[k] != v {
-			t.Errorf("params.%s = %v, want %v", k, a.Params[k], v)
-		}
-	}
-	// 且确实归一化成了 UTC（以 Z 结尾），不是原样透传。
-	if s, _ := a.Params["uploaded_since"].(string); !strings.HasSuffix(s, "Z") {
-		t.Errorf("uploaded_since not normalized to RFC3339 UTC: %v", a.Params["uploaded_since"])
-	}
-	for _, k := range []string{"size_gt", "size_lt", "page_size"} {
-		if _, ok := a.Params[k]; !ok {
-			t.Errorf("params missing %s: %v", k, a.Params)
-		}
-	}
-}
-
-// 0 值过滤器不下发（size-gt/lt 缺省 0、空字符串过滤器）。
-func TestAppsFileList_DryRunOmitsEmptyFilters(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	if err := runAppsShortcut(t, AppsFileList,
-		[]string{"+file-list", "--app-id", "app_x", "--dry-run", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("dry-run err=%v", err)
-	}
-	var env struct {
-		API []struct {
-			Params map[string]interface{} `json:"params"`
-		} `json:"api"`
-	}
-	_ = json.Unmarshal([]byte(stdout.String()), &env)
-	for _, banned := range []string{"name", "path", "type", "size_gt", "size_lt", "uploaded_since", "uploaded_until", "page_token"} {
-		if _, ok := env.API[0].Params[banned]; ok {
-			t.Errorf("params should omit empty %s: %v", banned, env.API[0].Params)
-		}
-	}
-	if _, ok := env.API[0].Params["page_size"]; !ok {
-		t.Errorf("params should always carry page_size: %v", env.API[0].Params)
-	}
-}
-
-// created_at/created_by → uploaded_at/uploaded_by；created_by 是 JSON 字符串 → parse 成对象。
-func TestAppsFileList_SuccessProjectsCreatedToUploaded(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET",
-		URL:    fileListURL,
-		Body: map[string]interface{}{
-			"code": 0,
-			"data": map[string]interface{}{
-				"has_more":   false,
-				"page_token": "",
-				"items": []interface{}{
-					map[string]interface{}{
-						"file_name":    "logo.png",
-						"path":         "/1858537546760216.png",
-						"size_bytes":   24580,
-						"type":         "image/png",
-						"created_at":   "2026-04-15T10:30:00Z",
-						"created_by":   `{"id":"7311","name":"alice"}`,
-						"download_url": "/spark/app/x/1858537546760216.png",
-					},
-				},
-			},
-		},
-	})
-	if err := runAppsShortcut(t, AppsFileList,
-		[]string{"+file-list", "--app-id", "app_x", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	got := stdout.String()
-	for _, want := range []string{`"uploaded_at": "2026-04-15T10:30:00Z"`, `"uploaded_by"`, `"name": "alice"`, `"id": "7311"`} {
-		if !strings.Contains(got, want) {
-			t.Errorf("stdout missing %q:\n%s", want, got)
-		}
-	}
-	// created_* 不应再出现在输出。
-	for _, banned := range []string{"created_at", "created_by"} {
-		if strings.Contains(got, banned) {
-			t.Errorf("stdout should not contain %q (renamed to uploaded_*):\n%s", banned, got)
-		}
-	}
-}
-
-// TestAppsFileList_PrettyTableAndEmpty 验证 pretty 非空时渲染表头与人类可读 size，空结果时输出 "No files found."。
-func TestAppsFileList_PrettyTableAndEmpty(t *testing.T) {
-	// 非空：5 列表头。
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: fileListURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"items": []interface{}{map[string]interface{}{
-				"file_name": "logo.png", "path": "/x.png", "size_bytes": 24576, "type": "image/png",
-				"created_at": "2026-04-15T10:30:00Z",
-			}},
-		}},
-	})
-	if err := runAppsShortcut(t, AppsFileList,
-		[]string{"+file-list", "--app-id", "app_x", "--format", "pretty", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	got := stdout.String()
-	if !strings.Contains(got, "file_name") || !strings.Contains(got, "uploaded_at") || !strings.Contains(got, "24 KB") {
-		t.Fatalf("pretty table malformed:\n%s", got)
-	}
-
-	// 空：No files found.
-	factory2, stdout2, reg2 := newAppsExecuteFactory(t)
-	reg2.Register(&httpmock.Stub{
-		Method: "GET", URL: fileListURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"items": []interface{}{}}},
-	})
-	if err := runAppsShortcut(t, AppsFileList,
-		[]string{"+file-list", "--app-id", "app_x", "--format", "pretty", "--as", "user"}, factory2, stdout2); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	if !strings.Contains(stdout2.String(), "No files found.") {
-		t.Fatalf("empty pretty should say 'No files found.', got: %s", stdout2.String())
-	}
-}
-
-// TestParseFileUser_Cases 验证 parseFileUser：合法 JSON 解析成对象，空串/非法/全空字段均返回 nil。
-func TestParseFileUser_Cases(t *testing.T) {
-	if u := parseFileUser(`{"id":"1","name":"a"}`); u == nil || u.ID != "1" || u.Name != "a" {
-		t.Fatalf("valid parse failed: %#v", u)
-	}
-	if u := parseFileUser(""); u != nil {
-		t.Errorf("empty → nil, got %#v", u)
-	}
-	if u := parseFileUser("not json"); u != nil {
-		t.Errorf("invalid → nil, got %#v", u)
-	}
-	if u := parseFileUser(`{"id":"","name":""}`); u != nil {
-		t.Errorf("all-empty → nil, got %#v", u)
-	}
-}

shortcuts/apps/apps_file_quota_get.go

@@ -1,93 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"fmt"
-	"io"
-
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// AppsFileQuotaGet reports an app's file-storage usage（动词对齐 +db-quota-get）。
-//
-// GET /apps/{app_id}/storage/file_quota。storage_quota_bytes / usage_percent 在配额未对接（=0）时
-// 不输出（json 删字段、pretty 只打已用量）。
-var AppsFileQuotaGet = common.Shortcut{
-	Service:     appsService,
-	Command:     "+file-quota-get",
-	Description: "Get an app's file-storage usage",
-	Risk:        "read",
-	Tips: []string{
-		"Example: lark-cli apps +file-quota-get --app-id <app_id>",
-		"Tip: get just the usage percent with -q '.usage_percent'",
-	},
-	Scopes:    []string{"spark:app:read"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		_, err := requireAppID(rctx.Str("app-id"))
-		return err
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		return common.NewDryRunAPI().
-			GET(appFileQuotaPath(appID)).
-			Desc("Get Miaoda app file-storage usage")
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		data, err := rctx.CallAPITyped("GET", appFileQuotaPath(appID), nil, nil)
-		if err != nil {
-			return err
-		}
-		out := projectFileQuota(data)
-		rctx.OutFormat(out, nil, func(w io.Writer) {
-			renderFileQuotaPretty(w, out)
-		})
-		return nil
-	},
-}
-
-// projectFileQuota 白名单投影 file quota 字段：只保留 agent 需要的 storage_used_bytes / files，
-// 配额已对接时再加 storage_quota_bytes / usage_percent。不透传后端其它字段，避免无用字段消耗上下文。
-func projectFileQuota(data map[string]interface{}) map[string]interface{} {
-	out := map[string]interface{}{"storage_used_bytes": data["storage_used_bytes"]}
-	if v, ok := data["files"]; ok {
-		out["files"] = v
-	}
-	// 配额未对接（storage_quota_bytes=0/缺失）时不输出 quota / usage_percent，避免误导。
-	if q, ok := numericAsFloat(data["storage_quota_bytes"]); ok && q > 0 {
-		out["storage_quota_bytes"] = data["storage_quota_bytes"]
-		if v, ok := data["usage_percent"]; ok {
-			out["usage_percent"] = v
-		}
-	}
-	return out
-}
-
-// renderFileQuotaPretty 打 Storage（已用 / 配额 (百分比)）与 Files 行（标签对齐 miaoda-cli）。
-func renderFileQuotaPretty(w io.Writer, data map[string]interface{}) {
-	used := humanBytes(data["storage_used_bytes"])
-	usage := used
-	if q, ok := numericAsFloat(data["storage_quota_bytes"]); ok && q > 0 {
-		pct := ""
-		if p, ok := numericAsFloat(data["usage_percent"]); ok {
-			pct = fmt.Sprintf(" (%.1f%%)", p)
-		}
-		usage = fmt.Sprintf("%s / %s%s", used, humanBytes(data["storage_quota_bytes"]), pct)
-	}
-	pairs := [][2]string{{"Storage", usage}}
-	if f, ok := numericAsFloat(data["files"]); ok {
-		pairs = append(pairs, [2]string{"Files", fmt.Sprintf("%d", int64(f))})
-	}
-	renderKeyValuePairs(w, pairs)
-}

shortcuts/apps/apps_file_quota_get_test.go

@@ -1,96 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-const fileQuotaURL = "/open-apis/spark/v1/apps/app_x/storage/file_quota"
-
-// TestAppsFileQuotaGet_QuotaConnectedShowsAllFields 验证配额已对接时输出 storage_quota_bytes/usage_percent/files 全字段。
-func TestAppsFileQuotaGet_QuotaConnectedShowsAllFields(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: fileQuotaURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"storage_used_bytes":  157286400,
-			"storage_quota_bytes": 1073741824,
-			"usage_percent":       14.6,
-			"files":               42,
-		}},
-	})
-	if err := runAppsShortcut(t, AppsFileQuotaGet,
-		[]string{"+file-quota-get", "--app-id", "app_x", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	got := stdout.String()
-	for _, want := range []string{`"storage_quota_bytes"`, `"usage_percent"`, `"files"`} {
-		if !strings.Contains(got, want) {
-			t.Errorf("quota json missing %q:\n%s", want, got)
-		}
-	}
-}
-
-// 配额未对接（=0）：storage_quota_bytes / usage_percent 不输出。
-func TestAppsFileQuotaGet_UnconnectedOmitsQuotaFields(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: fileQuotaURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"storage_used_bytes":  157286400,
-			"storage_quota_bytes": 0,
-			"usage_percent":       0,
-			"files":               42,
-		}},
-	})
-	if err := runAppsShortcut(t, AppsFileQuotaGet,
-		[]string{"+file-quota-get", "--app-id", "app_x", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	got := stdout.String()
-	for _, banned := range []string{"storage_quota_bytes", "usage_percent"} {
-		if strings.Contains(got, banned) {
-			t.Errorf("unconnected quota should omit %q:\n%s", banned, got)
-		}
-	}
-	if !strings.Contains(got, `"storage_used_bytes"`) || !strings.Contains(got, `"files"`) {
-		t.Errorf("should still show used/files:\n%s", got)
-	}
-}
-
-// TestProjectFileQuota_OmitsZeroQuotaAndDropsUnknownFields 验证 projectFileQuota 白名单投影：
-// quota=0 时不输出 storage_quota_bytes/usage_percent，非零时保留；后端额外字段不透传。
-func TestProjectFileQuota_OmitsZeroQuotaAndDropsUnknownFields(t *testing.T) {
-	out := projectFileQuota(map[string]interface{}{
-		"storage_used_bytes": 100, "storage_quota_bytes": float64(0), "usage_percent": float64(0),
-		"files": 3, "tenant_key": "leak", "request_id": "rid",
-	})
-	if _, ok := out["storage_quota_bytes"]; ok {
-		t.Errorf("zero quota should be omitted: %v", out)
-	}
-	if _, ok := out["usage_percent"]; ok {
-		t.Errorf("usage_percent should be omitted when quota=0: %v", out)
-	}
-	if out["storage_used_bytes"] != 100 || out["files"] != 3 {
-		t.Errorf("whitelisted fields should be kept: %v", out)
-	}
-	// 白名单外的字段必须被丢弃，避免无用字段消耗 agent 上下文。
-	for _, leaked := range []string{"tenant_key", "request_id"} {
-		if _, ok := out[leaked]; ok {
-			t.Errorf("non-whitelisted field %q must be dropped: %v", leaked, out)
-		}
-	}
-
-	out2 := projectFileQuota(map[string]interface{}{"storage_used_bytes": 100, "storage_quota_bytes": float64(1024), "usage_percent": float64(9.8), "files": 3})
-	if _, ok := out2["storage_quota_bytes"]; !ok {
-		t.Errorf("non-zero quota should be kept: %v", out2)
-	}
-	if _, ok := out2["usage_percent"]; !ok {
-		t.Errorf("usage_percent should be kept when quota>0: %v", out2)
-	}
-}

shortcuts/apps/apps_file_sign.go

@@ -1,82 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"fmt"
-	"io"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// fileSignMaxExpiresSeconds 是签名链接最长有效期（30 天）。超出 → 校验失败。
-const fileSignMaxExpiresSeconds = 30 * 24 * 60 * 60
-
-// AppsFileSign generates a temporary signed download URL for a file。
-//
-// POST /apps/{app_id}/storage/file_sign，body {path, expires_in}。
-// pretty 模式只打 signed_url（便于直接管道 / curl）；json 返 {file_name,path,signed_url,expires_at}。
-var AppsFileSign = common.Shortcut{
-	Service:     appsService,
-	Command:     "+file-sign",
-	Description: "Generate a temporary signed download URL for a file",
-	Risk:        "read",
-	Tips: []string{
-		"Example: lark-cli apps +file-sign --app-id <app_id> --path /1858537546760216.png",
-		"Tip: curl the signed_url directly to download.",
-	},
-	Scopes:    []string{"spark:app:read"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "path", Desc: "remote file path", Required: true},
-		{Name: "expires-in", Type: "int", Default: "86400", Desc: "link validity in seconds (max 2592000 = 30d)"},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		if _, err := requireAppID(rctx.Str("app-id")); err != nil {
-			return err
-		}
-		if _, err := requireFilePath(rctx.Str("path")); err != nil {
-			return err
-		}
-		if rctx.Int("expires-in") > fileSignMaxExpiresSeconds {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--expires-in exceeds the maximum of %d seconds (30d)", fileSignMaxExpiresSeconds).WithParam("--expires-in")
-		}
-		return nil
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		return common.NewDryRunAPI().
-			POST(appFileSignPath(appID)).
-			Desc("Sign a temporary download URL").
-			Body(buildFileSignBody(rctx))
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		data, err := rctx.CallAPITyped("POST", appFileSignPath(appID), nil, buildFileSignBody(rctx))
-		if err != nil {
-			return err
-		}
-		rctx.OutFormat(data, nil, func(w io.Writer) {
-			fmt.Fprintln(w, common.GetString(data, "signed_url"))
-		})
-		return nil
-	},
-}
-
-// buildFileSignBody 组装 file_sign 请求体：path 及可选 expires_in（秒）。
-func buildFileSignBody(rctx *common.RuntimeContext) map[string]interface{} {
-	path, _ := requireFilePath(rctx.Str("path"))
-	body := map[string]interface{}{"path": path}
-	if v := rctx.Int("expires-in"); v > 0 {
-		body["expires_in"] = v
-	}
-	return body
-}

shortcuts/apps/apps_file_sign_test.go

@@ -1,74 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"encoding/json"
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-const fileSignURL = "/open-apis/spark/v1/apps/app_x/storage/file_sign"
-
-// TestAppsFileSign_DryRunBody 验证 dry-run 输出 POST file_sign，body 携带 path 与 expires_in。
-func TestAppsFileSign_DryRunBody(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	if err := runAppsShortcut(t, AppsFileSign,
-		[]string{"+file-sign", "--app-id", "app_x", "--path", "/x.png", "--expires-in", "3600", "--dry-run", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("dry-run err=%v", err)
-	}
-	var env struct {
-		API []struct {
-			Method string                 `json:"method"`
-			URL    string                 `json:"url"`
-			Body   map[string]interface{} `json:"body"`
-		} `json:"api"`
-	}
-	_ = json.Unmarshal([]byte(stdout.String()), &env)
-	a := env.API[0]
-	if a.Method != "POST" || a.URL != fileSignURL || a.Body["path"] != "/x.png" {
-		t.Fatalf("dry-run = %s %s body=%v", a.Method, a.URL, a.Body)
-	}
-	if ei, _ := a.Body["expires_in"].(float64); int(ei) != 3600 {
-		t.Fatalf("body.expires_in = %v, want 3600", a.Body["expires_in"])
-	}
-}
-
-// TestAppsFileSign_RejectsDurationOverMax 验证 --expires-in 超过上限时触发 --expires-in typed 校验错误。
-func TestAppsFileSign_RejectsDurationOverMax(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	err := runAppsShortcut(t, AppsFileSign,
-		[]string{"+file-sign", "--app-id", "app_x", "--path", "/x.png", "--expires-in", "9999999", "--as", "user"}, factory, stdout)
-	var ve *errs.ValidationError
-	if !errors.As(err, &ve) {
-		t.Fatalf("err = %T %v, want *errs.ValidationError", err, err)
-	}
-	if ve.Param != "--expires-in" {
-		t.Fatalf("Param = %q, want --expires-in", ve.Param)
-	}
-}
-
-// TestAppsFileSign_PrettyPrintsSignedURL 验证 pretty 只输出 signed_url 本身。
-func TestAppsFileSign_PrettyPrintsSignedURL(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: fileSignURL,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"file_name": "x.png", "path": "/x.png",
-			"signed_url": "https://tos.example/x.png?sig=abc", "expires_at": "2026-04-16T10:30:00Z",
-		}},
-	})
-	if err := runAppsShortcut(t, AppsFileSign,
-		[]string{"+file-sign", "--app-id", "app_x", "--path", "/x.png", "--format", "pretty", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	got := strings.TrimSpace(stdout.String())
-	if got != "https://tos.example/x.png?sig=abc" {
-		t.Fatalf("pretty should print only signed_url, got: %q", got)
-	}
-}

shortcuts/apps/apps_file_upload.go

@@ -1,206 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io"
-	"mime"
-	"net/http"
-	"path/filepath"
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// fileUploadMaxBytes 是单文件上传上限（100 MB，对齐 miaoda）。
-const fileUploadMaxBytes = 100 * 1024 * 1024
-
-// AppsFileUpload uploads a local file to an app's storage（三步直传）。
-//
-// 1. POST /apps/{app_id}/storage/file_pre_upload {file_name,file_size,content_type} → {upload_url,upload_id}
-// 2. 客户端 PUT 文件字节到 presigned upload_url，取响应 ETag
-// 3. POST /apps/{app_id}/storage/file_upload_callback {upload_id,etag} → 文件元数据
-// file_name 取本地 basename；path 由平台生成 16 位 ID（不可指定）。仅收 --file。
-var AppsFileUpload = common.Shortcut{
-	Service:     appsService,
-	Command:     "+file-upload",
-	Description: "Upload a local file to an app's storage",
-	Risk:        "write",
-	Tips: []string{
-		"Example: lark-cli apps +file-upload --app-id <app_id> --file ./logo.png",
-		"Example: lark-cli apps +file-upload --app-id <app_id> --file ./report.pdf -q '.path'   # print the platform-generated file path",
-	},
-	Scopes:    []string{"spark:app:write"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "file", Desc: "local file to upload (file_name = basename)", Required: true},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		if _, err := requireAppID(rctx.Str("app-id")); err != nil {
-			return err
-		}
-		f := strings.TrimSpace(rctx.Str("file"))
-		if f == "" {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--file is required").WithParam("--file")
-		}
-		st, err := rctx.FileIO().Stat(f)
-		if err != nil {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--file: %v", err).WithParam("--file").WithCause(err)
-		}
-		if st.IsDir() {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--file must be a file, not a directory").WithParam("--file")
-		}
-		if st.Size() > fileUploadMaxBytes {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "file size %d bytes exceeds the 100 MB upload limit", st.Size()).WithParam("--file")
-		}
-		return nil
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		return common.NewDryRunAPI().
-			POST(appFilePreUploadPath(appID)).
-			Desc("Pre-upload → client PUT bytes → callback (3-step)").
-			Body(map[string]interface{}{"file_name": filepath.Base(strings.TrimSpace(rctx.Str("file")))})
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		localPath := strings.TrimSpace(rctx.Str("file"))
-		content, err := cmdutil.ReadInputFile(rctx.FileIO(), localPath)
-		if err != nil {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--file: %v", err).WithParam("--file").WithCause(err)
-		}
-		fileName := filepath.Base(localPath)
-		contentType := mimeByExt(fileName)
-
-		// 1. pre-upload
-		pre, err := rctx.CallAPITyped("POST", appFilePreUploadPath(appID), nil, map[string]interface{}{
-			"file_name":    fileName,
-			"file_size":    len(content),
-			"content_type": contentType,
-		})
-		if err != nil {
-			return err
-		}
-		uploadURL := common.GetString(pre, "upload_url")
-		uploadID := common.GetString(pre, "upload_id")
-		if uploadURL == "" || uploadID == "" {
-			return errs.NewInternalError(errs.SubtypeInvalidResponse, "pre-upload returned no upload_url / upload_id")
-		}
-
-		// 2. PUT 文件字节到 presigned URL，取 ETag（带 Content-Disposition 透传原始文件名）
-		etag, err := putFileBytes(rctx.Ctx(), uploadURL, content, contentType, fileName)
-		if err != nil {
-			return err
-		}
-
-		// 3. callback
-		result, err := rctx.CallAPITyped("POST", appFileUploadCallbackPath(appID), nil, map[string]interface{}{
-			"upload_id": uploadID,
-			"etag":      etag,
-		})
-		if err != nil {
-			return err
-		}
-		info := projectFileInfo(result)
-		rctx.OutFormat(info, nil, func(w io.Writer) {
-			renderFileUploadPretty(w, fileName, info)
-		})
-		return nil
-	},
-}
-
-// putFileBytes 直连 PUT 文件字节到 presigned URL，返回响应的 ETag。
-//
-// Content-Disposition 透传原始文件名：TOS 把它存成对象 metadata，callback 阶段后端
-// HeadObject 读回解析出 filename 写入 DB 的 display name。不传则后端兜底用 storage key
-// （平台 16 位 ID）当文件名 —— 即「上传后文件名变成 ID」的根因。
-//
-//nolint:forbidigo // direct PUT to a presigned object-storage URL bypasses the Lark gateway — raw HTTP is required (no Lark auth/gateway); RuntimeContext.DoAPI cannot target a presigned URL.
-func putFileBytes(ctx context.Context, url string, content []byte, contentType, fileName string) (string, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodPut, url, bytes.NewReader(content))
-	if err != nil {
-		return "", errs.NewNetworkError(errs.SubtypeNetworkTransport, "build upload request").WithCause(err)
-	}
-	req.ContentLength = int64(len(content))
-	if contentType != "" {
-		req.Header.Set("Content-Type", contentType)
-	}
-	req.Header.Set("Content-Disposition", "attachment; filename=\""+sanitizeUploadFileName(fileName)+"\"")
-	resp, err := newFileTransferClient().Do(req)
-	if err != nil {
-		// dial/transport 失败是典型可重试场景。
-		return "", errs.NewNetworkError(errs.SubtypeNetworkTransport, "upload failed").WithCause(err).WithRetryable()
-	}
-	defer resp.Body.Close()
-	io.Copy(io.Discard, io.LimitReader(resp.Body, 4096))
-	if resp.StatusCode >= 400 {
-		// 5xx 是上游瞬时故障，标 retryable；4xx（如签名过期）需重新签名而非盲重试，不标。
-		if resp.StatusCode >= 500 {
-			return "", errs.NewNetworkError(errs.SubtypeNetworkServer, "upload failed: HTTP %d", resp.StatusCode).WithRetryable()
-		}
-		return "", errs.NewNetworkError(errs.SubtypeNetworkTransport, "upload failed: HTTP %d", resp.StatusCode)
-	}
-	return resp.Header.Get("ETag"), nil
-}
-
-// sanitizeUploadFileName 对齐 miaoda：先去掉 TOS 非法字符 [:"\/*?<>|,;]，再 encodeURIComponent
-// （UTF-8 百分号编码，兼容中文等非 ASCII，且让 Content-Disposition header 合法），空则兜底 download_file。
-func sanitizeUploadFileName(name string) string {
-	var b strings.Builder
-	for _, r := range name {
-		switch r {
-		case ':', '"', '\\', '/', '*', '?', '<', '>', '|', ',', ';':
-			continue
-		default:
-			b.WriteRune(r)
-		}
-	}
-	enc := encodeURIComponent(b.String())
-	if enc == "" {
-		return "download_file"
-	}
-	return enc
-}
-
-// encodeURIComponent 复刻 JS encodeURIComponent：除 A-Za-z0-9-_.!~*'() 外按 UTF-8 字节 %XX 编码。
-func encodeURIComponent(s string) string {
-	const keep = "-_.!~*'()"
-	var b strings.Builder
-	for i := 0; i < len(s); i++ {
-		c := s[i]
-		if (c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || strings.IndexByte(keep, c) >= 0 {
-			b.WriteByte(c)
-		} else {
-			b.WriteString(fmt.Sprintf("%%%02X", c))
-		}
-	}
-	return b.String()
-}
-
-// mimeByExt 按扩展名推断 Content-Type，未知回退 application/octet-stream。
-func mimeByExt(name string) string {
-	if t := mime.TypeByExtension(filepath.Ext(name)); t != "" {
-		return t
-	}
-	return "application/octet-stream"
-}
-
-// renderFileUploadPretty 打 ✓ Uploaded <local> → <path> + size / download_url。
-func renderFileUploadPretty(w io.Writer, localName string, info fileInfo) {
-	fmt.Fprintf(w, "✓ Uploaded %s → %s\n", localName, info.Path)
-	fmt.Fprintf(w, "size:         %s\n", fileSizeDetail(info.SizeBytes))
-	if info.DownloadURL != "" {
-		fmt.Fprintf(w, "download_url: %s\n", info.DownloadURL)
-	}
-}

shortcuts/apps/apps_file_upload_test.go

@@ -1,179 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"encoding/json"
-	"errors"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-// TestAppsFileUpload_RequiresAppIDAndFile 验证仅含空白的 --file 经 Validate 去空后触发 --file typed 校验错误。
-func TestAppsFileUpload_RequiresAppIDAndFile(t *testing.T) {
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	// --file is a cobra-required flag; pass whitespace so cobra's required check
-	// passes and our Validate (which trims) rejects it with a typed error.
-	err := runAppsShortcut(t, AppsFileUpload,
-		[]string{"+file-upload", "--app-id", "app_x", "--file", "  ", "--as", "user"}, factory, stdout)
-	var ve *errs.ValidationError
-	if !errors.As(err, &ve) {
-		t.Fatalf("err = %T %v, want *errs.ValidationError", err, err)
-	}
-	if ve.Param != "--file" {
-		t.Fatalf("Param = %q, want --file", ve.Param)
-	}
-}
-
-// TestAppsFileUpload_RejectsDirectory 验证 --file 指向目录时触发 --file typed 校验错误。
-func TestAppsFileUpload_RejectsDirectory(t *testing.T) {
-	dir := t.TempDir()
-	oldWD, _ := os.Getwd()
-	if err := os.Chdir(dir); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = os.Chdir(oldWD) })
-	if err := os.Mkdir(filepath.Join(dir, "sub"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	err := runAppsShortcut(t, AppsFileUpload,
-		[]string{"+file-upload", "--app-id", "app_x", "--file", "sub", "--as", "user"}, factory, stdout)
-	var ve *errs.ValidationError
-	if !errors.As(err, &ve) {
-		t.Fatalf("err = %T %v, want *errs.ValidationError", err, err)
-	}
-	if ve.Param != "--file" {
-		t.Fatalf("Param = %q, want --file", ve.Param)
-	}
-}
-
-// TestAppsFileUpload_DryRunPreUpload 验证 dry-run 输出 POST file_pre_upload，body.file_name 取文件 basename。
-func TestAppsFileUpload_DryRunPreUpload(t *testing.T) {
-	// Validate 会 Stat --file（在 DryRun 之前），故 dry-run 也需要真实存在的文件。
-	dir := t.TempDir()
-	if err := os.WriteFile(filepath.Join(dir, "logo.png"), []byte("x"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	oldWD, _ := os.Getwd()
-	if err := os.Chdir(dir); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = os.Chdir(oldWD) })
-
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	if err := runAppsShortcut(t, AppsFileUpload,
-		[]string{"+file-upload", "--app-id", "app_x", "--file", "logo.png", "--dry-run", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("dry-run err=%v", err)
-	}
-	var env struct {
-		API []struct {
-			Method string                 `json:"method"`
-			URL    string                 `json:"url"`
-			Body   map[string]interface{} `json:"body"`
-		} `json:"api"`
-	}
-	_ = json.Unmarshal([]byte(stdout.String()), &env)
-	a := env.API[0]
-	if a.Method != "POST" || a.URL != "/open-apis/spark/v1/apps/app_x/storage/file_pre_upload" {
-		t.Fatalf("dry-run = %s %s", a.Method, a.URL)
-	}
-	if a.Body["file_name"] != "logo.png" {
-		t.Fatalf("dry-run body.file_name = %v, want logo.png (basename)", a.Body["file_name"])
-	}
-}
-
-// 三步直传：pre-upload → 客户端 PUT 字节 → callback。
-func TestAppsFileUpload_EndToEnd(t *testing.T) {
-	var putBody []byte
-	var putContentType, putCD string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method != http.MethodPut {
-			w.WriteHeader(http.StatusMethodNotAllowed)
-			return
-		}
-		putBody, _ = io.ReadAll(r.Body)
-		putContentType = r.Header.Get("Content-Type")
-		putCD = r.Header.Get("Content-Disposition")
-		w.Header().Set("ETag", `"etag-123"`)
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	dir := t.TempDir()
-	if err := os.WriteFile(filepath.Join(dir, "logo.png"), []byte("PNGBYTES"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	oldWD, _ := os.Getwd()
-	if err := os.Chdir(dir); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = os.Chdir(oldWD) })
-
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: "/open-apis/spark/v1/apps/app_x/storage/file_pre_upload",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"upload_url": srv.URL, "upload_id": "up-1"}},
-	})
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: "/open-apis/spark/v1/apps/app_x/storage/file_upload_callback",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"file_name": "logo.png", "path": "/1858537546760216.png", "size_bytes": 8, "type": "image/png",
-			"download_url": "/spark/app/x/1858537546760216.png",
-		}},
-	})
-
-	if err := runAppsShortcut(t, AppsFileUpload,
-		[]string{"+file-upload", "--app-id", "app_x", "--file", "logo.png", "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-	if string(putBody) != "PNGBYTES" {
-		t.Fatalf("PUT body = %q, want file bytes", putBody)
-	}
-	if putContentType != "image/png" {
-		t.Errorf("PUT Content-Type = %q, want image/png", putContentType)
-	}
-	// 原始文件名必须经 Content-Disposition 透传给 TOS（否则后端用 storage key 当文件名）。
-	if putCD != `attachment; filename="logo.png"` {
-		t.Errorf("PUT Content-Disposition = %q, want attachment; filename=\"logo.png\"", putCD)
-	}
-	got := stdout.String()
-	if !strings.Contains(got, `"path": "/1858537546760216.png"`) {
-		t.Errorf("output missing uploaded path:\n%s", got)
-	}
-}
-
-// TestSanitizeUploadFileName_Cases 验证 sanitizeUploadFileName：空格转 %20、去 TOS 非法字符、全非法兜底、非 ASCII 百分号编码。
-func TestSanitizeUploadFileName_Cases(t *testing.T) {
-	cases := []struct{ in, want string }{
-		{"logo.png", "logo.png"},
-		{"a b.png", "a%20b.png"},     // 空格 → %20（encodeURIComponent）
-		{`a:b/c*d?.png`, "abcd.png"}, // 去掉 TOS 非法字符
-		{"///", "download_file"},     // 全非法 → 兜底
-		{"中.txt", "%E4%B8%AD.txt"},   // 非 ASCII → UTF-8 百分号编码
-	}
-	for _, c := range cases {
-		if got := sanitizeUploadFileName(c.in); got != c.want {
-			t.Errorf("sanitizeUploadFileName(%q)=%q want %q", c.in, got, c.want)
-		}
-	}
-}
-
-// TestMimeByExt_Cases 验证 mimeByExt：按扩展名识别 image/png，未知扩展名兜底 application/octet-stream。
-func TestMimeByExt_Cases(t *testing.T) {
-	if got := mimeByExt("a.png"); !strings.HasPrefix(got, "image/png") {
-		t.Errorf("mimeByExt(a.png)=%q want image/png", got)
-	}
-	if got := mimeByExt("data.unknownext"); got != "application/octet-stream" {
-		t.Errorf("mimeByExt(unknown)=%q want application/octet-stream", got)
-	}
-}

shortcuts/apps/db_common.go

@@ -4,50 +4,13 @@
 package apps
 
 import (
-	"context"
-	"encoding/json"
 	"fmt"
 	"strings"
-	"time"
 
-	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/validate"
 )
 
-// pollUntil 轮询异步任务直到 check 判定终态。async migrate/recovery 用：dataloom 立即返
-// task_id/preview_request_id，CLI 自己 poll（避免单连接长挂被网关/SDK 30s 中断）。
-// 首次立即 fetch（不睡）；check 返 done→返回；返 err→透传（失败终态）；否则按 interval 间隔重试至 maxWait。
-func pollUntil(ctx context.Context, interval, maxWait time.Duration,
-	fetch func() (map[string]interface{}, error),
-	check func(map[string]interface{}) (done bool, err error)) (map[string]interface{}, error) {
-	maxAttempts := int(maxWait / interval)
-	if maxAttempts < 1 {
-		maxAttempts = 1
-	}
-	for i := 0; ; i++ {
-		data, err := fetch()
-		if err != nil {
-			return nil, err
-		}
-		done, cerr := check(data)
-		if cerr != nil {
-			return nil, cerr
-		}
-		if done {
-			return data, nil
-		}
-		if i+1 >= maxAttempts {
-			// async 任务多半还在服务端推进，poll 超时是可重试的——标 retryable 让 agent 重新轮询而非放弃。
-			return nil, errs.NewNetworkError(errs.SubtypeNetworkTimeout, "timed out waiting for completion after %s", maxWait).WithRetryable()
-		}
-		select {
-		case <-ctx.Done():
-			return nil, errs.NewNetworkError(errs.SubtypeNetworkTransport, "cancelled while waiting").WithCause(ctx.Err())
-		case <-time.After(interval):
-		}
-	}
-}
-
 // URL helpers for the db CLI commands.
 
 // appTablesPath 返回 app db 表列表 URL（复用存量「获取数据表列表」接口）。
@@ -70,167 +33,11 @@ func appDbEnvCreatePath(appID string) string {
 	return fmt.Sprintf("%s/apps/%s/db_dev_init", apiBasePath, validate.EncodePathSegment(appID))
 }
 
-// ── 多环境发布（env diff/migrate）/ 数据恢复（recovery）/ 配额 路由 ──
-
-// appEnvMigratePath 返回 dev→online 发布（预览/落地共用）URL：db/env_migrate。
-func appEnvMigratePath(appID string) string {
-	return fmt.Sprintf("%s/apps/%s/db/env_migrate", apiBasePath, validate.EncodePathSegment(appID))
-}
-
-// appEnvMigrateStatusPath 返回发布异步任务状态查询 URL：db/env_migrate_status。
-func appEnvMigrateStatusPath(appID string) string {
-	return fmt.Sprintf("%s/apps/%s/db/env_migrate_status", apiBasePath, validate.EncodePathSegment(appID))
-}
-
-// appRecoveryPath 返回 PITR 数据恢复（预览/落地共用）URL：db/env_recovery。
-func appRecoveryPath(appID string) string {
-	return fmt.Sprintf("%s/apps/%s/db/env_recovery", apiBasePath, validate.EncodePathSegment(appID))
-}
-
-// appRecoveryDiffStatusPath 返回恢复预览（diff）异步状态查询 URL：db/env_recovery_diff_status。
-func appRecoveryDiffStatusPath(appID string) string {
-	return fmt.Sprintf("%s/apps/%s/db/env_recovery_diff_status", apiBasePath, validate.EncodePathSegment(appID))
-}
-
-// appRecoveryApplyStatusPath 返回恢复落地异步状态查询 URL：db/env_recovery_apply_status。
-func appRecoveryApplyStatusPath(appID string) string {
-	return fmt.Sprintf("%s/apps/%s/db/env_recovery_apply_status", apiBasePath, validate.EncodePathSegment(appID))
-}
-
-// appDbQuotaPath 返回 db 配额查询 URL：db/quota。
-func appDbQuotaPath(appID string) string {
-	return fmt.Sprintf("%s/apps/%s/db/quota", apiBasePath, validate.EncodePathSegment(appID))
-}
-
-// ── 变更追溯（changelog / audit）路由 ──
-
-// appChangelogListPath 返回 DDL 变更记录列表 URL：db/changelog_list。
-func appChangelogListPath(appID string) string {
-	return fmt.Sprintf("%s/apps/%s/db/changelog_list", apiBasePath, validate.EncodePathSegment(appID))
-}
-
-// appAuditStatusPath 返回表审计开关状态查询 URL：db/audit_status。
-func appAuditStatusPath(appID string) string {
-	return fmt.Sprintf("%s/apps/%s/db/audit_status", apiBasePath, validate.EncodePathSegment(appID))
-}
-
-// appAuditSetPath 返回表审计开关设置 URL：db/audit_set。
-func appAuditSetPath(appID string) string {
-	return fmt.Sprintf("%s/apps/%s/db/audit_set", apiBasePath, validate.EncodePathSegment(appID))
-}
-
-// appAuditListPath 返回行级审计事件列表 URL：db/audit_list。
-func appAuditListPath(appID string) string {
-	return fmt.Sprintf("%s/apps/%s/db/audit_list", apiBasePath, validate.EncodePathSegment(appID))
-}
-
-// operatorRef 是 operator 的 {id,name}。后端用 JSON 字符串内嵌透传，CLI parse：
-// json 输出还原成对象（下游能区分同名用户），pretty 只取 name。
-type operatorRef struct {
-	ID   string `json:"id"`
-	Name string `json:"name"`
-}
-
-// parseOperator 解析 operator 字符串：空→nil；非 JSON→{raw,raw}；JSON→{id,name}（name 空兜底 id）。
-func parseOperator(raw string) *operatorRef {
-	s := strings.TrimSpace(raw)
-	if s == "" {
-		return nil
-	}
-	if !strings.HasPrefix(s, "{") {
-		return &operatorRef{ID: s, Name: s}
-	}
-	var o operatorRef
-	if json.Unmarshal([]byte(s), &o) != nil {
-		return &operatorRef{ID: s, Name: s}
-	}
-	if o.Name == "" {
-		o.Name = o.ID
-	}
-	return &o
-}
-
-// operatorName 取 operator 的展示名（pretty），空用 "—"。
-func operatorName(op *operatorRef) string {
-	if op == nil || op.Name == "" {
-		return "—"
-	}
-	return op.Name
-}
-
-// safeParseJSON 把 before/after 的 JSON 字符串还原成结构化对象供下游消费；失败时透传原始串。
-func safeParseJSON(s string) interface{} {
-	var v interface{}
-	if json.Unmarshal([]byte(s), &v) == nil {
-		return v
-	}
-	return s
-}
-
-// appDataImportPath 返回 db 数据导入 URL（新增 db/ 域段路由）。
-func appDataImportPath(appID string) string {
-	return fmt.Sprintf("%s/apps/%s/db/data_import", apiBasePath, validate.EncodePathSegment(appID))
-}
-
-// appDataExportPath 返回 db 数据导出 URL（返原始字节）。
-func appDataExportPath(appID string) string {
-	return fmt.Sprintf("%s/apps/%s/db/data_export", apiBasePath, validate.EncodePathSegment(appID))
-}
-
-// appTableRecordsPath 返回数据表记录列表 URL（复用 GetAppTableRecordList，其 total 即符合条件的记录总数）。
-func appTableRecordsPath(appID, table string) string {
-	return appTablePath(appID, table) + "/records"
-}
-
-// resolveDataFormat 由文件扩展名推断数据格式。lark-cli 的 --format 已被框架占用（输出渲染），
-// 故数据格式从文件名推断：import 接受 csv/json，export 还接受 sql。
-func resolveDataFormat(ext string, allowSQL bool) (string, error) {
-	raw := strings.TrimPrefix(strings.ToLower(strings.TrimSpace(ext)), ".")
-	switch raw {
-	case "csv", "json":
-		return raw, nil
-	case "sql":
-		if allowSQL {
-			return "sql", nil
-		}
-	}
-	if allowSQL {
-		return "", errs.NewValidationError(errs.SubtypeInvalidArgument, "unsupported data format %q (file must end in .csv, .json or .sql)", raw)
-	}
-	return "", errs.NewValidationError(errs.SubtypeInvalidArgument, "unsupported data format %q (file must end in .csv or .json)", raw)
-}
-
-// countDataRows 粗估数据行数（用于导入上限校验、导出兜底计数）。
-// csv：非空行数 - 1（表头）；json：顶层数组长度，非数组算 1，解析失败算 0。
-func countDataRows(body []byte, format string) int {
-	if format == "csv" {
-		lines := 0
-		for _, ln := range strings.Split(string(body), "\n") {
-			if strings.TrimRight(ln, "\r") != "" {
-				lines++
-			}
-		}
-		if lines > 0 {
-			return lines - 1
-		}
-		return 0
-	}
-	var arr []json.RawMessage
-	if err := json.Unmarshal(body, &arr); err == nil {
-		return len(arr)
-	}
-	var obj map[string]json.RawMessage
-	if err := json.Unmarshal(body, &obj); err == nil {
-		return 1
-	}
-	return 0
-}
-
 // requireAppID trims --app-id and rejects blank, returning a uniform validation error.
 func requireAppID(raw string) (string, error) {
 	id := strings.TrimSpace(raw)
 	if id == "" {
-		return "", errs.NewValidationError(errs.SubtypeInvalidArgument, "--app-id is required").WithParam("--app-id")
+		return "", output.ErrValidation("--app-id is required")
 	}
 	return id, nil
 }

shortcuts/apps/file_common.go

@@ -1,228 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"regexp"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/validate"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-var (
-	reTsRelative      = regexp.MustCompile(`^([0-9]+)([smhdw])$`)
-	reTsDate          = regexp.MustCompile(`^[0-9]{4}-[0-9]{2}-[0-9]{2}$`)
-	reTsLocalDateTime = regexp.MustCompile(`^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}$`)
-)
-
-// normalizeTimestamp 实现设计原则三的 <timestamp> 多格式输入，统一归一化为 RFC3339 UTC：
-//   - 相对：30s / 5m / 2h / 3d / 1w（从现在往前推）
-//   - date：2026-04-15（本地时区 00:00:00）
-//   - local datetime：2026-04-15T10:00:00（本地时区，T 分隔）
-//   - ISO 8601 带 TZ：...Z（UTC）/ ...+08:00（显式偏移）
-//
-// 归一化到 UTC 是必须的：服务端对无 TZ 的串按 UTC 裸解析，故 date / local datetime 的「本地」
-// 语义只能在 CLI 端换算；相对时间服务端也不认。空串原样返回（调用方据此跳过该过滤）。
-func normalizeTimestamp(raw string) (string, error) {
-	s := strings.TrimSpace(raw)
-	if s == "" {
-		return "", nil
-	}
-	if m := reTsRelative.FindStringSubmatch(s); m != nil {
-		n, _ := strconv.Atoi(m[1])
-		var unit time.Duration
-		switch m[2] {
-		case "s":
-			unit = time.Second
-		case "m":
-			unit = time.Minute
-		case "h":
-			unit = time.Hour
-		case "d":
-			unit = 24 * time.Hour
-		case "w":
-			unit = 7 * 24 * time.Hour
-		}
-		return time.Now().Add(-time.Duration(n) * unit).UTC().Format(time.RFC3339), nil
-	}
-	if reTsDate.MatchString(s) {
-		t, err := time.ParseInLocation("2006-01-02", s, time.Local)
-		if err != nil {
-			return "", fmt.Errorf("invalid date %q", s)
-		}
-		return t.UTC().Format(time.RFC3339), nil
-	}
-	if reTsLocalDateTime.MatchString(s) {
-		t, err := time.ParseInLocation("2006-01-02T15:04:05", s, time.Local)
-		if err != nil {
-			return "", fmt.Errorf("invalid local datetime %q", s)
-		}
-		return t.UTC().Format(time.RFC3339), nil
-	}
-	if t, err := time.Parse(time.RFC3339, s); err == nil {
-		return t.UTC().Format(time.RFC3339), nil
-	}
-	return "", fmt.Errorf("invalid timestamp %q (want relative 7d/2h/30s, date 2026-04-15, datetime 2026-04-15T10:00:00, or ISO 8601 with TZ)", s)
-}
-
-// newFileTransferClient 直传 / 直下对象存储 presigned URL 用（绕开 Lark 网关，无需 auth、无超时以容纳大文件）。
-//
-//nolint:forbidigo // presigned object-storage transfer bypasses the Lark gateway — raw http.Client is required (no Lark auth, no gateway routing); not a Lark API call, so RuntimeContext.DoAPI does not apply.
-func newFileTransferClient() *http.Client {
-	return &http.Client{Transport: http.DefaultTransport}
-}
-
-// URL helpers for the file (storage) CLI commands.
-//
-// 全部走 spark OpenAPI，path 形如 /open-apis/spark/v1/apps/{app_id}/storage/<name>。
-// 路由段不含 HTTP 方法名（file_get→file、file_delete→file_batch_remove、file_quota_get→file_quota）。
-
-// appFileListPath 返回文件列表 URL：storage/file_list。
-func appFileListPath(appID string) string {
-	return fmt.Sprintf("%s/apps/%s/storage/file_list", apiBasePath, validate.EncodePathSegment(appID))
-}
-
-// appFileGetPath 返回单文件元数据 URL：storage/file（file_get→file，路由不含方法名）。
-func appFileGetPath(appID string) string {
-	return fmt.Sprintf("%s/apps/%s/storage/file", apiBasePath, validate.EncodePathSegment(appID))
-}
-
-// appFileSignPath 返回临时签名下载 URL 生成接口：storage/file_sign。
-func appFileSignPath(appID string) string {
-	return fmt.Sprintf("%s/apps/%s/storage/file_sign", apiBasePath, validate.EncodePathSegment(appID))
-}
-
-// appFilePreUploadPath 返回上传预处理（取 presigned 直传地址）URL：storage/file_pre_upload。
-func appFilePreUploadPath(appID string) string {
-	return fmt.Sprintf("%s/apps/%s/storage/file_pre_upload", apiBasePath, validate.EncodePathSegment(appID))
-}
-
-// appFileUploadCallbackPath 返回直传完成回调（登记文件）URL：storage/file_upload_callback。
-func appFileUploadCallbackPath(appID string) string {
-	return fmt.Sprintf("%s/apps/%s/storage/file_upload_callback", apiBasePath, validate.EncodePathSegment(appID))
-}
-
-// appFileBatchRemovePath 返回批量删除文件 URL：storage/file_batch_remove（file_delete→file_batch_remove）。
-func appFileBatchRemovePath(appID string) string {
-	return fmt.Sprintf("%s/apps/%s/storage/file_batch_remove", apiBasePath, validate.EncodePathSegment(appID))
-}
-
-// appFileQuotaPath 返回存储配额查询 URL：storage/file_quota（file_quota_get→file_quota）。
-func appFileQuotaPath(appID string) string {
-	return fmt.Sprintf("%s/apps/%s/storage/file_quota", apiBasePath, validate.EncodePathSegment(appID))
-}
-
-// requireFilePath trims --path and rejects blank, returning a uniform validation error.
-func requireFilePath(raw string) (string, error) {
-	p := strings.TrimSpace(raw)
-	if p == "" {
-		return "", errs.NewValidationError(errs.SubtypeInvalidArgument, "--path is required").WithParam("--path")
-	}
-	return p, nil
-}
-
-// fileUser 是 uploaded_by 的 {id,name}。OpenAPI 以 created_by 的 JSON 字符串透传，CLI parse。
-type fileUser struct {
-	ID   string `json:"id"`
-	Name string `json:"name"`
-}
-
-// fileInfo 是 file 命令对外输出的白名单字段。
-// OpenAPI 字段 created_at / created_by → CLI 产品语义 uploaded_at / uploaded_by。
-type fileInfo struct {
-	FileName    string      `json:"file_name"`
-	Path        string      `json:"path"`
-	SizeBytes   interface{} `json:"size_bytes,omitempty"`
-	Type        string      `json:"type,omitempty"`
-	UploadedBy  *fileUser   `json:"uploaded_by,omitempty"`
-	UploadedAt  string      `json:"uploaded_at,omitempty"`
-	DownloadURL string      `json:"download_url,omitempty"`
-}
-
-// projectFileInfo 把 server 原始 file map 投影为 CLI fileInfo（created_*→uploaded_*）。
-func projectFileInfo(m map[string]interface{}) fileInfo {
-	return fileInfo{
-		FileName:    common.GetString(m, "file_name"),
-		Path:        common.GetString(m, "path"),
-		SizeBytes:   m["size_bytes"],
-		Type:        common.GetString(m, "type"),
-		UploadedBy:  parseFileUser(common.GetString(m, "created_by")),
-		UploadedAt:  common.GetString(m, "created_at"),
-		DownloadURL: common.GetString(m, "download_url"),
-	}
-}
-
-// parseFileUser 解析 created_by 的 JSON 字符串 {id,name}；空 / 非法 / 全空 → nil。
-func parseFileUser(raw string) *fileUser {
-	s := strings.TrimSpace(raw)
-	if s == "" {
-		return nil
-	}
-	var u fileUser
-	if err := json.Unmarshal([]byte(s), &u); err != nil {
-		return nil
-	}
-	if u.ID == "" && u.Name == "" {
-		return nil
-	}
-	return &u
-}
-
-// normalizeTimeFlags 把若干时间 flag（如 --since/--until/--uploaded-since）就地归一化为 RFC3339 UTC
-// 并回写，供 build*Params 透传。空 flag 跳过；非法格式 → validation 错误。复用 normalizeTimestamp。
-func normalizeTimeFlags(rctx *common.RuntimeContext, flags ...string) error {
-	for _, f := range flags {
-		if strings.TrimSpace(rctx.Str(f)) == "" {
-			continue
-		}
-		n, err := normalizeTimestamp(rctx.Str(f))
-		if err != nil {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--%s: %v", f, err).WithParam("--" + f)
-		}
-		_ = rctx.Cmd.Flags().Set(f, n)
-	}
-	return nil
-}
-
-// dashIfEmpty 空白串用 "—" 占位（pretty 列对齐）。
-func dashIfEmpty(s string) string {
-	if strings.TrimSpace(s) == "" {
-		return "—"
-	}
-	return s
-}
-
-// fileSizeDetail 把 size_bytes 渲染成 "24 KB (24580 bytes)"（pretty 单文件详情用）。
-func fileSizeDetail(raw interface{}) string {
-	n, ok := numericAsFloat(raw)
-	if !ok {
-		return "—"
-	}
-	return fmt.Sprintf("%s (%d bytes)", humanBytes(raw), int64(n))
-}
-
-// renderKeyValuePairs 输出对齐的 key: value（key 列按最长 key 右填充）。
-func renderKeyValuePairs(w io.Writer, pairs [][2]string) {
-	width := 0
-	for _, p := range pairs {
-		if dw := displayWidth(p[0]); dw > width {
-			width = dw
-		}
-	}
-	for _, p := range pairs {
-		io.WriteString(w, p[0]+":")
-		if pad := width - displayWidth(p[0]); pad > 0 {
-			io.WriteString(w, strings.Repeat(" ", pad))
-		}
-		io.WriteString(w, " "+p[1]+"\n")
-	}
-}

shortcuts/apps/shortcuts.go

@@ -23,25 +23,6 @@ func Shortcuts() []common.Shortcut {
 		AppsDBTableGet,
 		AppsDBExecute,
 		AppsDBEnvCreate,
-		AppsDBDataImport,
-		AppsDBDataExport,
-		AppsDBChangelogList,
-		AppsDBAuditStatus,
-		AppsDBAuditEnable,
-		AppsDBAuditDisable,
-		AppsDBAuditList,
-		AppsDBEnvDiff,
-		AppsDBEnvMigrate,
-		AppsDBRecoveryDiff,
-		AppsDBRecoveryApply,
-		AppsDBQuotaGet,
-		AppsFileList,
-		AppsFileGet,
-		AppsFileSign,
-		AppsFileDownload,
-		AppsFileUpload,
-		AppsFileDelete,
-		AppsFileQuotaGet,
 		AppsGitCredentialInit,
 		AppsGitCredentialList,
 		AppsGitCredentialRemove,

shortcuts/apps/shortcuts_test.go

@@ -10,16 +10,12 @@ import (
 )
 
 // 钉死域内 shortcut 数量。少一条（漏挂）或多一条（误加）都会被这个测试拦截。
-// 6 基础 + 1 init + 3 publish + 1 env-pull
-//   - 16 db（table-list/table-schema/sql/dev-init/data-import/data-export/changelog-list/
-//     audit-status/audit-enable/audit-disable/audit-list/
-//     env-diff/env-migrate/recovery-diff/recovery-apply/quota-get）
-//   - 3 git-credential + 5 session（create/list/get/stop/chat）
-//   - 7 file（list/get/sign/download/upload/delete/quota-get）= 42。
-func TestAppsShortcuts_Returns42(t *testing.T) {
+// 6 基础 + 1 init + 3 publish + 1 env-pull + 4 db（table-list/table-schema/sql/dev-init）
+// + 3 git-credential + 5 session（create/list/get/stop/chat）= 23。
+func TestAppsShortcuts_Returns23(t *testing.T) {
 	got := Shortcuts()
-	if len(got) != 42 {
-		t.Fatalf("Shortcuts() returned %d entries, want 42", len(got))
+	if len(got) != 23 {
+		t.Fatalf("Shortcuts() returned %d entries, want 23", len(got))
 	}
 }
 
@@ -44,7 +40,6 @@ func TestAppsShortcuts_IncludesSessionCommands(t *testing.T) {
 	}
 }
 
-// TestAppsGitCredentialHelper_IsNotAShortcut 确认 git credential helper 不作为 shortcut 暴露。
 func TestAppsGitCredentialHelper_IsNotAShortcut(t *testing.T) {
 	for _, shortcut := range Shortcuts() {
 		if shortcut.Command == "git-credential-helper" {
@@ -53,21 +48,18 @@ func TestAppsGitCredentialHelper_IsNotAShortcut(t *testing.T) {
 	}
 }
 
-// TestAppsGitCredentialRemove_IsLocalCleanupWithoutScopes 确认 git credential remove 是本地清理、不带任何 scope。
 func TestAppsGitCredentialRemove_IsLocalCleanupWithoutScopes(t *testing.T) {
 	if len(AppsGitCredentialRemove.Scopes) != 0 {
 		t.Fatalf("git credential remove scopes = %#v, want none for local cleanup", AppsGitCredentialRemove.Scopes)
 	}
 }
 
-// TestAppsGitCredentialList_IsLocalReadWithoutScopes 确认 git credential list 是本地读取、不带任何 scope。
 func TestAppsGitCredentialList_IsLocalReadWithoutScopes(t *testing.T) {
 	if len(AppsGitCredentialList.Scopes) != 0 {
 		t.Fatalf("git credential list scopes = %#v, want none for local read", AppsGitCredentialList.Scopes)
 	}
 }
 
-// TestInstallOnApps_AddsHiddenGitCredentialHelper 验证 InstallOnApps 挂载一个隐藏、带 RunE 且独立于 shortcut 管线的 git-credential-helper 命令。
 func TestInstallOnApps_AddsHiddenGitCredentialHelper(t *testing.T) {
 	parent := &cobra.Command{Use: "apps"}
 	InstallOnApps(parent, nil)

shortcuts/apps/walk_html_publish_candidates.go

@@ -56,6 +56,15 @@ func walkHTMLPublishCandidates(fio fileio.FileIO, rootPath string) ([]htmlPublis
 		if walkErr != nil {
 			return walkErr
 		}
+		// Skip a stray git repo: a directory named .git skips the whole subtree,
+		// and a .git file (the gitdir pointer used by submodules/worktrees) is
+		// skipped too.
+		if d.Name() == ".git" {
+			if d.IsDir() {
+				return filepath.SkipDir
+			}
+			return nil
+		}
 		if d.IsDir() {
 			return nil
 		}

shortcuts/apps/walk_html_publish_candidates_test.go

@@ -113,6 +113,102 @@ func TestIsUnsafeRelPath(t *testing.T) {
 	}
 }
 
+func TestWalkHTMLPublishCandidates_ExcludesGitDir(t *testing.T) {
+	dir := t.TempDir()
+	files := map[string]string{
+		"index.html":               "<html></html>",
+		".git/config":              "[core]\n",
+		".git/HEAD":                "ref: refs/heads/main\n",
+		".git/objects/ab/cdef123":  "binary",
+		".github/workflows/ci.yml": "on: push\n",
+		".gitignore":               "node_modules\n",
+	}
+	for rel, content := range files {
+		full := filepath.Join(dir, rel)
+		if err := os.MkdirAll(filepath.Dir(full), 0o755); err != nil {
+			t.Fatalf("mkdir: %v", err)
+		}
+		if err := os.WriteFile(full, []byte(content), 0o644); err != nil {
+			t.Fatalf("write: %v", err)
+		}
+	}
+
+	got, err := walkHTMLPublishCandidates(newTestFIO(), dir)
+	if err != nil {
+		t.Fatalf("err=%v", err)
+	}
+	rels := make(map[string]bool)
+	for _, c := range got {
+		rels[c.RelPath] = true
+	}
+	// .git 子树整体排除
+	for _, banned := range []string{".git/config", ".git/HEAD", ".git/objects/ab/cdef123"} {
+		if rels[banned] {
+			t.Errorf("%q should be excluded from candidates", banned)
+		}
+	}
+	// 相邻名不受影响
+	for _, kept := range []string{"index.html", ".github/workflows/ci.yml", ".gitignore"} {
+		if !rels[kept] {
+			t.Errorf("%q should be kept in candidates, got %+v", kept, got)
+		}
+	}
+}
+
+func TestWalkHTMLPublishCandidates_ExcludesNestedGitDir(t *testing.T) {
+	dir := t.TempDir()
+	files := map[string]string{
+		"index.html":      "<html></html>",
+		"sub/.git/config": "[core]\n",
+		"sub/page.html":   "<html></html>",
+	}
+	for rel, content := range files {
+		full := filepath.Join(dir, rel)
+		if err := os.MkdirAll(filepath.Dir(full), 0o755); err != nil {
+			t.Fatalf("mkdir: %v", err)
+		}
+		if err := os.WriteFile(full, []byte(content), 0o644); err != nil {
+			t.Fatalf("write: %v", err)
+		}
+	}
+
+	got, err := walkHTMLPublishCandidates(newTestFIO(), dir)
+	if err != nil {
+		t.Fatalf("err=%v", err)
+	}
+	rels := make(map[string]bool)
+	for _, c := range got {
+		rels[c.RelPath] = true
+	}
+	if rels["sub/.git/config"] {
+		t.Errorf("nested sub/.git/config should be excluded, got %+v", got)
+	}
+	if !rels["sub/page.html"] || !rels["index.html"] {
+		t.Errorf("non-git files should be kept, got %+v", got)
+	}
+}
+
+func TestWalkHTMLPublishCandidates_ExcludesGitFile(t *testing.T) {
+	// submodule / worktree 场景：.git 是个 gitdir 指针文件，不是目录。
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "index.html"), []byte("<html></html>"), 0o644); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, ".git"), []byte("gitdir: /elsewhere\n"), 0o644); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+
+	got, err := walkHTMLPublishCandidates(newTestFIO(), dir)
+	if err != nil {
+		t.Fatalf("err=%v", err)
+	}
+	for _, c := range got {
+		if c.RelPath == ".git" {
+			t.Errorf(".git pointer file should be excluded, got %+v", got)
+		}
+	}
+}
+
 func TestWalkHTMLPublishCandidates_SymlinkSkipped(t *testing.T) {
 	// Walker 只接受 regular file —— symlink 跳过（避免 loop + out-of-root 引用，
 	// 且 fio.Open 对 symlink 行为不一致）。real.html 仍然被收，link.html 不在结果里。

shortcuts/common/runner.go

@@ -407,8 +407,6 @@ func (ctx *RuntimeContext) StreamPages(method, url string, params map[string]int
 	return ac.StreamPages(ctx.ctx, req, onItems, opts)
 }
 
-// buildRequest assembles a client.RawApiRequest for the current identity,
-// attaching any shortcut-scoped header options carried on the context.
 func (ctx *RuntimeContext) buildRequest(method, url string, params map[string]interface{}, data interface{}) client.RawApiRequest {
 	req := client.RawApiRequest{
 		Method: method,
@@ -423,8 +421,6 @@ func (ctx *RuntimeContext) buildRequest(method, url string, params map[string]in
 	return req
 }
 
-// callRaw issues the request via the cached APIClient.CallAPI and returns the
-// raw result; it is the shared transport behind CallAPI and RawAPI.
 func (ctx *RuntimeContext) callRaw(method, url string, params map[string]interface{}, data interface{}) (interface{}, error) {
 	ac, err := ctx.getAPIClient()
 	if err != nil {
@@ -518,8 +514,6 @@ func (ctx *RuntimeContext) DoAPIJSONTyped(method, apiPath string, query larkcore
 	return ctx.ClassifyAPIResponse(resp)
 }
 
-// doAPIJSON issues an API request and decodes the response into a JSON map, mapping
-// HTTP/business errors to typed output errors (optionally attaching the log id when includeLogID).
 func (ctx *RuntimeContext) doAPIJSON(method, apiPath string, query larkcore.QueryParams, body any, includeLogID bool) (map[string]any, error) {
 	req := &larkcore.ApiReq{
 		HttpMethod:  method,
@@ -594,20 +588,6 @@ func (ctx *RuntimeContext) IO() *cmdutil.IOStreams {
 	return ctx.Factory.IOStreams
 }
 
-// StartSpinner shows a braille spinner with elapsed time on stderr for a slow
-// operation, until the returned stop() runs. It is a no-op unless stderr is an
-// interactive terminal, so pipes / CI / captured output emit nothing and stdout
-// (JSON/pretty) is never polluted — hence it is shown in JSON mode too. Call
-// stop() before printing the result; stop() is safe to call multiple times
-// (e.g. `defer stop()` plus an explicit call on the success path).
-func (ctx *RuntimeContext) StartSpinner(label string) func() {
-	io := ctx.IO()
-	if io == nil {
-		return func() {}
-	}
-	return output.StartSpinner(io.ErrOut, io.ErrIsTerminal, label)
-}
-
 // FileIO resolves the FileIO using the current execution context.
 // Falls back to the globally registered provider when Factory or its
 // FileIOProvider is nil (e.g. in lightweight test helpers).
@@ -827,8 +807,6 @@ func (ctx *RuntimeContext) OutFormatRaw(data interface{}, meta *output.Meta, pre
 	ctx.outFormat(data, meta, prettyFn, true)
 }
 
-// outFormat renders data according to ctx.Format (pretty/json/table/csv/ndjson), running the
-// safety scan and pretty renderer for pretty mode; raw selects the unwrapped output sink.
 func (ctx *RuntimeContext) outFormat(data interface{}, meta *output.Meta, prettyFn func(w io.Writer), raw bool) {
 	outFn := ctx.Out
 	if raw {
@@ -939,17 +917,12 @@ func (s Shortcut) Mount(parent *cobra.Command, f *cmdutil.Factory) {
 	s.MountWithContext(context.Background(), parent, f)
 }
 
-// MountWithContext registers the shortcut on parent using the given context,
-// dispatching to mountDeclarative when the shortcut defines an Execute func.
 func (s Shortcut) MountWithContext(ctx context.Context, parent *cobra.Command, f *cmdutil.Factory) {
 	if s.Execute != nil {
 		s.mountDeclarative(ctx, parent, f)
 	}
 }
 
-// mountDeclarative builds the cobra.Command for a declarative shortcut — wiring
-// RunE to runShortcut, registering flags, identities, tips and risk, and adding
-// it to parent — defaulting AuthTypes to user and deriving the bot-only flag.
 func (s Shortcut) mountDeclarative(ctx context.Context, parent *cobra.Command, f *cmdutil.Factory) {
 	shortcut := s
 	if len(shortcut.AuthTypes) == 0 {
@@ -1077,8 +1050,6 @@ func runShortcut(cmd *cobra.Command, f *cmdutil.Factory, s *Shortcut, botOnly bo
 	return rctx.outputErr
 }
 
-// resolveShortcutIdentity determines the effective identity (--as > default-as >
-// auto-detect), enforces strict mode, and verifies the shortcut supports it.
 func resolveShortcutIdentity(cmd *cobra.Command, f *cmdutil.Factory, s *Shortcut) (core.Identity, error) {
 	// Step 1: determine identity (--as > default-as > auto-detect).
 	asFlag, _ := cmd.Flags().GetString("as")
@@ -1095,9 +1066,6 @@ func resolveShortcutIdentity(cmd *cobra.Command, f *cmdutil.Factory, s *Shortcut
 	return as, nil
 }
 
-// checkShortcutScopes runs the pre-flight scope check for the resolved identity,
-// returning a typed PermissionError (with a login hint) when scopes are missing;
-// it is a no-op when no scopes are required or scope metadata is unavailable.
 func checkShortcutScopes(f *cmdutil.Factory, ctx context.Context, as core.Identity, config *core.CliConfig, scopes []string) error {
 	if len(scopes) == 0 {
 		return nil
@@ -1116,9 +1084,6 @@ func checkShortcutScopes(f *cmdutil.Factory, ctx context.Context, as core.Identi
 		WithHint("run `lark-cli auth login --scope \"%s\"` in the background. It blocks and outputs a verification URL — retrieve the URL and open it in a browser to complete login.", strings.Join(missing, " "))
 }
 
-// newRuntimeContext builds a RuntimeContext for a shortcut invocation: it seeds
-// the shortcut context, lazily wires the API client and bot-info providers,
-// eagerly initializes the Lark SDK, and reads the format and jq flags.
 func newRuntimeContext(cmd *cobra.Command, f *cmdutil.Factory, s *Shortcut, config *core.CliConfig, as core.Identity, botOnly bool) (*RuntimeContext, error) {
 	ctx := cmd.Context()
 	ctx = cmdutil.ContextWithShortcut(ctx, s.Service+":"+s.Command, uuid.New().String())
@@ -1221,8 +1186,6 @@ func resolveInputFlags(rctx *RuntimeContext, flags []Flag) error {
 	return nil
 }
 
-// validateEnumFlags checks that every flag with an Enum constraint holds an
-// allowed value, returning a validation error naming the flag otherwise.
 func validateEnumFlags(rctx *RuntimeContext, flags []Flag) error {
 	for _, fl := range flags {
 		if len(fl.Enum) == 0 {
@@ -1247,8 +1210,6 @@ func validateEnumFlags(rctx *RuntimeContext, flags []Flag) error {
 	return nil
 }
 
-// handleShortcutDryRun runs the shortcut's DryRun hook and prints its result
-// (pretty or JSON per --format), erroring if the shortcut declares no DryRun.
 func handleShortcutDryRun(f *cmdutil.Factory, rctx *RuntimeContext, s *Shortcut) error {
 	if s.DryRun == nil {
 		return ValidationErrorf("--dry-run is not supported for %s %s", s.Service, s.Command).
@@ -1277,16 +1238,10 @@ func rejectPositionalArgs() cobra.PositionalArgs {
 	}
 }
 
-// registerShortcutFlags registers the shortcut's flags using a background
-// context; a convenience wrapper over registerShortcutFlagsWithContext.
 func registerShortcutFlags(cmd *cobra.Command, f *cmdutil.Factory, s *Shortcut) {
 	registerShortcutFlagsWithContext(context.Background(), cmd, f, s)
 }
 
-// registerShortcutFlagsWithContext declares all of the shortcut's flags on cmd —
-// typed flags with enum/input hints, completions, required and hidden markers —
-// plus the framework flags (--dry-run, --format/--json, --jq, identity, and the
-// --print-schema/--flag-name introspection flags when opted in).
 func registerShortcutFlagsWithContext(ctx context.Context, cmd *cobra.Command, f *cmdutil.Factory, s *Shortcut) {
 	for _, fl := range s.Flags {
 		desc := fl.Desc

shortcuts/im/builders_test.go

@@ -317,6 +317,17 @@ func TestShortcutValidateBranches(t *testing.T) {
 		}
 	})
 
+	t.Run("ImChatSearch invalid chat-modes value", func(t *testing.T) {
+		runtime := newTestRuntimeContext(t, map[string]string{
+			"query":      "ok",
+			"chat-modes": "group,bogus",
+		}, nil)
+		err := ImChatSearch.Validate(context.Background(), runtime)
+		if err == nil || !strings.Contains(err.Error(), "invalid --chat-modes value") {
+			t.Fatalf("ImChatSearch.Validate() error = %v", err)
+		}
+	})
+
 	t.Run("ImChatUpdate requires fields", func(t *testing.T) {
 		runtime := newTestRuntimeContext(t, map[string]string{
 			"chat-id": "oc_123",
@@ -693,6 +704,39 @@ func TestShortcutDryRunShapes(t *testing.T) {
 		}
 	})
 
+	t.Run("ImChatSearch dry run maps chat-modes to wire values", func(t *testing.T) {
+		runtime := newTestRuntimeContext(t, map[string]string{
+			"query":      "team-alpha",
+			"chat-modes": "group,topic",
+		}, nil)
+		got := mustMarshalDryRun(t, ImChatSearch.DryRun(context.Background(), runtime))
+		if !strings.Contains(got, `"chat_modes":["default","thread"]`) {
+			t.Fatalf("ImChatSearch.DryRun() chat_modes mapping = %s", got)
+		}
+	})
+
+	t.Run("ImChatSearch dry run maps single chat-mode topic", func(t *testing.T) {
+		runtime := newTestRuntimeContext(t, map[string]string{
+			"query":      "team-alpha",
+			"chat-modes": "topic",
+		}, nil)
+		got := mustMarshalDryRun(t, ImChatSearch.DryRun(context.Background(), runtime))
+		if !strings.Contains(got, `"chat_modes":["thread"]`) {
+			t.Fatalf("ImChatSearch.DryRun() chat_modes mapping = %s", got)
+		}
+	})
+
+	t.Run("ImChatSearch dry run dedupes chat-modes", func(t *testing.T) {
+		runtime := newTestRuntimeContext(t, map[string]string{
+			"query":      "team-alpha",
+			"chat-modes": "group, group",
+		}, nil)
+		got := mustMarshalDryRun(t, ImChatSearch.DryRun(context.Background(), runtime))
+		if !strings.Contains(got, `"chat_modes":["default"]`) {
+			t.Fatalf("ImChatSearch.DryRun() chat_modes dedupe = %s", got)
+		}
+	})
+
 	t.Run("ImMessagesSearch dry run uses messages search endpoint", func(t *testing.T) {
 		runtime := newMessagesSearchTestRuntimeContext(t, map[string]string{
 			"query":      "incident",

shortcuts/im/im_chat_search.go

@@ -31,6 +31,7 @@ var ImChatSearch = common.Shortcut{
 	Flags: []common.Flag{
 		{Name: "query", Desc: "search keyword (max 64 chars)"},
 		{Name: "search-types", Desc: "chat types, comma-separated (private, external, public_joined, public_not_joined)"},
+		{Name: "chat-modes", Desc: "filter by chat mode, comma-separated (group, topic)"},
 		{Name: "member-ids", Desc: "filter by member open_ids, comma-separated"},
 		{Name: "is-manager", Type: "bool", Desc: "only show chats you created or manage"},
 		{Name: "disable-search-by-user", Type: "bool", Desc: "disable search-by-member-name (default: search by member name first, then group name)"},
@@ -72,6 +73,13 @@ var ImChatSearch = common.Shortcut{
 				}
 			}
 		}
+		if cm := runtime.Str("chat-modes"); cm != "" {
+			for _, mode := range common.SplitCSV(cm) {
+				if mode != "group" && mode != "topic" {
+					return errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --chat-modes value %q: expected one of group, topic", mode).WithParam("--chat-modes")
+				}
+			}
+		}
 		if mi := runtime.Str("member-ids"); mi != "" {
 			ids := common.SplitCSV(mi)
 			if len(ids) > 50 {
@@ -217,6 +225,24 @@ func buildSearchChatBody(runtime *common.RuntimeContext) map[string]interface{}
 	if st := runtime.Str("search-types"); st != "" {
 		filter["search_types"] = common.SplitCSV(st)
 	}
+	// chat_modes is a server-side filter. The CLI exposes group/topic; the wire
+	// expects default/thread. Map and dedupe (the API caps the list at 2, and
+	// there are only 2 distinct modes) while preserving the user's order.
+	if cm := runtime.Str("chat-modes"); cm != "" {
+		seen := map[string]bool{}
+		var modes []string
+		for _, mode := range common.SplitCSV(cm) {
+			wire := map[string]string{"group": "default", "topic": "thread"}[mode]
+			if wire == "" || seen[wire] {
+				continue
+			}
+			seen[wire] = true
+			modes = append(modes, wire)
+		}
+		if len(modes) > 0 {
+			filter["chat_modes"] = modes
+		}
+	}
 	if mi := runtime.Str("member-ids"); mi != "" {
 		filter["member_ids"] = common.SplitCSV(mi)
 	}

skills/lark-apps/SKILL.md

@@ -24,9 +24,7 @@ metadata:
 | 发布本地 `index.html` 或静态目录为可访问 URL | `+html-publish` | [`lark-apps-html-publish.md`](references/lark-apps-html-publish.md) |
 | 开发已有应用 / 初始化本地仓库（开发方式已定为本地后；先解析 app_id，勿 `+create` 新建） | `+init`（或手动 `+git-credential-init` + 原生 git） | [`lark-apps-local-dev.md`](references/lark-apps-local-dev.md), [`lark-apps-init.md`](references/lark-apps-init.md), [`lark-apps-git-credential.md`](references/lark-apps-git-credential.md) |
 | 本地开发时 `.env.local` 损坏/丢失，重新拉取启动期环境变量 | `+env-pull` | [`lark-apps-env-pull.md`](references/lark-apps-env-pull.md) |
-| 看表 / 看结构 / 初始化多环境 / 导入导出数据 / 变更追溯 / 行级审计 / dev→online 发布 / 时间点恢复 / 查 DB 用量 | `+db-table-list`、`+db-table-get`、`+db-env-create`、`+db-data-export`/`+db-data-import`、`+db-changelog-list`、`+db-audit-status`/`+db-audit-enable`/`+db-audit-disable`/`+db-audit-list`、`+db-env-diff`/`+db-env-migrate`、`+db-recovery-diff`/`+db-recovery-apply`、`+db-quota-get` | [`lark-apps-db.md`](references/lark-apps-db.md) |
-| 逐条执行 SQL（SELECT / DML / DDL） | `+db-execute` | [`lark-apps-db-execute.md`](references/lark-apps-db-execute.md) |
-| 管理应用文件存储：上传/下载本地文件、列出/查看/删除已存文件、生成临时分享链接、查存储用量 | `+file-upload`/`+file-download`/`+file-list`/`+file-get`/`+file-sign`/`+file-delete`/`+file-quota-get` | [`lark-apps-file.md`](references/lark-apps-file.md) |
+| 看表、看 schema、跑 SQL、初始化 dev/online 多环境 DB | `+db-table-list`, `+db-table-get`, `+db-execute`, `+db-env-create` | 对应 `lark-apps-db-*.md` |
 | **部署/上线全栈应用**（"部署""上线""推上去并部署""发布到云端"）；查发布状态/历史 | `+release-create`（部署上线动作）, `+release-get`（轮询发布结果，finished 给 online_url / failed 给 error_logs）, `+release-list` | [`lark-apps-release-create.md`](references/lark-apps-release-create.md), [`lark-apps-release-get.md`](references/lark-apps-release-get.md), [`lark-apps-release-list.md`](references/lark-apps-release-list.md) |
 | 设置或查看运行时可见范围 | `+access-scope-set`, `+access-scope-get` | 对应 access-scope reference |
 | 云端 Agent 生成/迭代应用（开发方式已定为云端后） | `+session-create` -> `+chat` -> `+session-get` | [`lark-apps-cloud-dev.md`](references/lark-apps-cloud-dev.md) |

skills/lark-apps/references/lark-apps-db-env-create.md

@@ -0,0 +1,31 @@
+# apps +db-env-create
+
+把存量单库应用初始化为 `dev` / `online` 多环境数据库。运行时命令事实以 `lark-cli apps +db-env-create --help` 为准。
+
+## 何时用
+
+仅用于存量单库应用需要拆成 `dev` / `online` 两套数据库的场景。普通查看表、查 schema、执行 SQL 不需要先初始化。注意：通过 `+create --app-type full_stack` 新建的应用通常已自带多环境，无需再初始化（重复初始化会返回「已初始化」错误）。
+
+## 命令骨架
+
+- 必填：`--app-id`。
+- `--env`：要创建的环境，由调用方传入，目前只支持 `dev`（默认 `dev`）。
+- `--sync-data`：bool 开关，传 `--sync-data` 则把现有 online 数据复制到新环境；不传则不复制（默认）。
+- risk 是 `high-risk-write`；单库拆成 dev/online 后不可逆。
+
+## 示例
+
+```bash
+lark-cli apps +db-env-create --app-id app_xxx --env dev --dry-run
+lark-cli apps +db-env-create --app-id app_xxx --env dev --sync-data --yes
+```
+
+## 输出契约
+
+- 成功读取 `data.status`、`data.environments`、`data.data_synced`；pretty 会提示是否初始化、多环境列表、是否同步数据。
+- 未确认时返回 `confirmation_required` / exit 10；按 lark-shared 询问用户后再补 `--yes` 重试。
+- 如果服务端提示已启用多环境（`Multi-env is already initialized`），转述状态即可，不要重复初始化。
+
+## Agent 规则
+
+不要静默追加 `--yes`。遇到 confirmation_required 时，按 `lark-shared` 的 exit-10 协议向用户确认不可逆风险；用户明确同意后才在原 argv 末尾追加 `--yes` 重试。

skills/lark-apps/references/lark-apps-db-execute.md

@@ -26,19 +26,15 @@ lark-cli apps +db-execute --app-id app_xxx --env dev --sql - --yes < /Users/.../
 
 ## 输出契约
 
-- 成功默认 JSON 的 `data` 按 SQL 类型自适应（不透传后端原始串）：
-  - 单 SELECT → `data` 是行数组 `[{...}]`（空 → `[]`），直接 `-q '.data[].col'` 取字段。
-  - 单 DML → `data = {command, rows_affected}`（如 `{"command":"INSERT","rows_affected":1}`）。
-  - 单 DDL → `data = {command}`（如 `{"command":"CREATE_TABLE"}`）。
-  - 多语句 → `data` 是元素数组：SELECT 为 `{command:"SELECT", rows:[...]}`，DML 为 `{command, rows_affected}`，DDL 为 `{command}`。
+- 成功默认 JSON 读取 `data.results[]`；每个元素对应一条 SQL，常见字段有 `sql_type`、`data`、`record_count`、`affected_rows`。
 - pretty 会按 SELECT/DML/DDL 自适应渲染；多语句会逐条显示 Statement 摘要。
-- 失败返回 typed `error`（`type:"api"`、`subtype:"server_error"`、`code`、`message`、`hint`）：失败位置在 `message` 的「(at statement N of M)」；前序是否落地 / 是否整批回滚写在 `hint`——事务内失败「Transaction rolled back; no changes persisted.」；非事务多语句前序已落地「Earlier statements were committed and not rolled back; fix statement N and re-run the remaining statements.」；首句即失败（无前序落地）「No statements were applied; fix the SQL and re-run.」。据此决定整段重跑还是只跑剩余语句。
+- 失败可能仍有前序语句已执行；看 `error.detail.statement_index`、`completed`、`rolled_back` 和 `hint` 决定从哪条继续。
 
 ## Agent 规则
 
 - 该命令为 high-risk-write，执行一律需 `--yes`；无 `--yes` 会返回 `confirmation_required` / exit 10。
   - **只读查询、以及不删除/不丢失既有数据且可撤回的语句**：已授权时可直接带 `--yes` 执行。
   - **会删除或丢失既有数据、或难以撤回的语句**：先 `--dry-run` 预览（无需 `--yes`），向用户确认后再带 `--yes` 执行；不要在用户不知情时自动补 `--yes`。
-- 多语句失败时，失败前的语句可能已经 commit 落地。不要整批重跑；按错误 message/hint 修失败语句，并从剩余语句继续。
+- 多语句失败时，失败前的语句可能已经 auto-commit。不要整批重跑；按错误 detail/hint 修失败语句，并从剩余语句继续。
 - 如果需要原子性，让用户在 SQL 内显式写 `BEGIN` / `COMMIT`，不要假设 CLI 会包事务。
 - 不要把数据库连接串从 env 中取出来裸连。

skills/lark-apps/references/lark-apps-db-table-get.md

@@ -0,0 +1,29 @@
+# apps +db-table-get
+
+查看妙搭应用数据库某张表的结构。运行时命令事实以 `lark-cli apps +db-table-get --help` 为准。
+
+## 何时用
+
+用于查看已知表的字段、索引、约束，或给 SQL/迁移生成提供依据。只想知道有哪些表时先 `+db-table-list`。
+
+## 命令骨架
+
+- 必填：`--app-id`、`--table`。
+- `--env` 枚举：`dev` / `online`，默认 `online`。
+- `--format pretty` 会向服务端请求 DDL，并直接输出 DDL 文本；默认 JSON 返回结构化 columns/indexes/constraints/stats。
+
+## 示例
+
+```bash
+lark-cli apps +db-table-get --app-id app_xxx --table orders
+lark-cli apps +db-table-get --app-id app_xxx --table orders --env dev --format pretty
+```
+
+## 输出契约
+
+- 默认 JSON 读取 `data.name`、`columns`、`indexes`、`constraints`、`estimated_row_count`、`size_bytes`。
+- `--format pretty` stdout 是服务端返回的 DDL 文本，不是 JSON envelope；需要建表语句时可原样给用户。
+
+## Agent 规则
+
+需要给用户看建表语句或迁移参照时用 `--format pretty`；需要程序化分析字段/索引/约束时保留默认 JSON。

skills/lark-apps/references/lark-apps-db-table-list.md

@@ -0,0 +1,31 @@
+# apps +db-table-list
+
+列出妙搭应用某个数据库环境的数据表。运行时命令事实以 `lark-cli apps +db-table-list --help` 为准。
+
+## 何时用
+
+用于先摸清应用数据库里有哪些表，或在用户只给业务对象名时定位可能的表名。已知表名且要字段/索引时直接用 `+db-table-get`。
+
+## 命令骨架
+
+- 必填：`--app-id`。
+- `--env` 枚举：`dev` / `online`，默认 `online`。
+- 分页：`--page-size` 默认 20，`--page-token` 使用上一页 cursor。
+- pretty 输出列包含 `name`、`description`、`estimated_row_count`、`size`、`columns`（列数）。
+
+## 示例
+
+```bash
+lark-cli apps +db-table-list --app-id app_xxx
+lark-cli apps +db-table-list --app-id app_xxx --env dev --page-size 50
+```
+
+## 输出契约
+
+- 成功读取 `data.items[]`；每项字段是 `name`、`description`、`estimated_row_count`、`size_bytes`、`column_count`（列数）。CLI 默认不透出每表完整 `columns[]`（与 `+db-table-get` 重复且放大 token），只给 `column_count`；要完整列定义/索引/约束用 `+db-table-get`。
+- pretty 输出是 5 列扫描表：`name`、`description`、`estimated_row_count`、`size`、`columns`（即列数）。
+- 若响应带 `has_more=true`，用返回的 `page_token` / `next_page_token` 翻页。
+
+## Agent 规则
+
+用户说“本地/开发库/调试库”时优先 `--env dev`；线上问题排查用 `--env online`。如果 dev 返回服务端错误提示未初始化，多环境入口是 [`+db-env-create`](lark-apps-db-env-create.md)。

skills/lark-apps/references/lark-apps-db.md

@@ -1,160 +0,0 @@
-# apps db 域命令
-
-管理妙搭应用数据库：看表与结构、初始化与发布多环境、数据搬运、变更治理、时间点恢复、用量。逐条跑 SQL（SELECT/DML/DDL）走 [`+db-execute`](lark-apps-db-execute.md)（单独一篇）。运行时命令事实以 `lark-cli apps +<cmd> --help` 为准；认证、`--as user`、exit 码、`_notice` 等通用处理见 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md) 与本域 [`SKILL.md`](../SKILL.md)。
-
-## 何时用
-
-用户要看应用里有哪些表 / 某张表的结构、把单库应用拆成 dev/online 多环境、把数据导进导出表、查谁在什么时候改了表结构或表数据、开关行级审计、把开发环境的库结构发布到线上、把库恢复到过去某个时间点、或看数据库用量时。逐条执行 SQL 走 [`+db-execute`](lark-apps-db-execute.md)；文件存储（上传/下载文件）走 [`lark-apps-file.md`](lark-apps-file.md)。
-
-## 命令一览
-
-| 命令 | 做什么 | 关键参数 |
-|---|---|---|
-| `+db-table-list` | 列出某环境的数据表 | `--env`、`--page-size`/`--page-token` |
-| `+db-table-get` | 看单张表的结构（字段/索引/约束/DDL） | `--table`、`--env`、`--format` |
-| `+db-env-create` | 把单库应用初始化为 dev/online 多环境（高危） | `--env`、`--sync-data`、`--yes` |
-| `+db-data-export` | 把一张表的数据导出到本地文件 | `--table`、`--output`、`--limit`、`--env` |
-| `+db-data-import` | 把本地 csv/json 文件导进一张表（高危） | `--file`、`--table`、`--env`、`--yes` |
-| `+db-changelog-list` | 查表结构变更（DDL）历史 | `--table`、`--change-id`、`--since`/`--until`、`--env` |
-| `+db-audit-status` | 看哪些表开了行级审计、保留期 | `--table`、`--env` |
-| `+db-audit-enable` | 给某表开启行级变更审计 | `--table`、`--retention`、`--env` |
-| `+db-audit-disable` | 关闭某表的行级审计 | `--table`、`--env` |
-| `+db-audit-list` | 列出表的行级变更事件（增删改追溯） | `--table`（可重复）、`--since`/`--until`、`--env` |
-| `+db-env-diff` | 预览开发环境待发布到线上的结构变更 | `--app-id` |
-| `+db-env-migrate` | 把开发环境的结构变更发布到线上（高危） | `--app-id`、`--yes` |
-| `+db-recovery-diff` | 预览把库恢复到某时间点会带来的变更 | `--target` |
-| `+db-recovery-apply` | 把库恢复到某个时间点、覆盖当前数据（高危） | `--target`、`--yes` |
-| `+db-quota-get` | 查数据库存储用量 | `--env` |
-
-## 约定（先读）
-
-- **环境 `--env dev|online`（默认 online）**：看表、看结构、数据导入导出、变更追溯、审计、配额、初始化都按环境区分，写操作建议先在 `dev` 验。`+db-env-diff`/`+db-env-migrate` 是「dev→online 发布」语义、`+db-recovery-*` 作用于当前库，二者**没有** `--env`。
-- **本地文件用工作目录内相对路径**：导入 `--file ./orders.csv`、导出 `--output ./out.csv`；路径在别处先 `cd` 过去或改成相对路径。
-- **高危操作必须带 `--yes`**：`+db-env-create`、`+db-data-import`、`+db-env-migrate`、`+db-recovery-apply` 缺省会被确认关卡拦下；动手前先用对应的预览命令或 `--dry-run` 看清影响。
-- **时间参数按口语自然传**（`--since`/`--until`/`--target`），格式见末尾。
-
-## 各命令
-
-### 表与结构
-
-**`+db-table-list`**：列出某环境的数据表。分页 `--page-size`（默认 20）/ `--page-token`（上一页 cursor）。每项给表名、描述、估算行数、大小、列数；要完整列定义 / 索引 / 约束用 `+db-table-get`。只知道业务对象名时，先用它定位可能的表名。
-
-```bash
-lark-cli apps +db-table-list --app-id app_xxx
-lark-cli apps +db-table-list --app-id app_xxx --env dev --page-size 50
-```
-
-**`+db-table-get`**：看单张表的结构。默认 JSON 给结构化的字段 / 索引 / 约束 / 估算行数 / 大小；`--format pretty` 直接输出建表 DDL 文本（给用户看建表语句或做迁移参照时用）。
-
-```bash
-lark-cli apps +db-table-get --app-id app_xxx --table orders
-lark-cli apps +db-table-get --app-id app_xxx --table orders --env dev --format pretty
-```
-
-### 多环境数据库（初始化 + 发布）
-
-**`+db-env-create`（高危）**：把存量单库应用初始化为 dev/online 两套库，不可逆，必须带 `--yes`。`--env` 目前只支持 `dev`（默认 `dev`）；`--sync-data` 把现有 online 数据复制到新环境（不传则不复制）。注意：`+create --app-type full_stack` 新建的应用通常已自带多环境，重复初始化会返回冲突错误（应用已是多环境）——按 `error.hint` 转述状态即可，别重复初始化。
-
-```bash
-lark-cli apps +db-env-create --app-id app_xxx --env dev --dry-run
-lark-cli apps +db-env-create --app-id app_xxx --env dev --sync-data --yes
-```
-
-**`+db-env-diff`**：预览开发环境里待发布到线上的表结构变更，不落地。发布前先看这个。无待发布变更时明确返回「无变更」。
-
-**`+db-env-migrate`（高危）**：把开发环境的结构变更正式发布到线上，不可逆，必须带 `--yes`，返回实际发布的变更条数。发布是异步的，命令会等到完成再返回结果。
-
-> 预览与发布同一端点，故 `+db-env-diff` 也需 `spark:app:write` scope（不是纯只读权限）。
-
-```bash
-lark-cli apps +db-env-diff --app-id app_xxx
-lark-cli apps +db-env-migrate --app-id app_xxx --yes
-```
-
-### 数据导入导出
-
-**`+db-data-export`**：把一张表导出到本地文件。导出格式**只由 `--output` 的扩展名决定**——`.csv` / `.json` / `.sql`，缺省按 `<表名>.csv` 落在当前目录。注意：全局 `--format json|pretty` 只控制**命令自身输出**（成功摘要 / 错误信封）的渲染，**不影响导出文件的格式**；`--output` 后缀必须是 `.csv/.json/.sql` 之一，否则报 validation 错误（exit 2），且不支持导出到 stdout。两道体量约束：
-
-- `--limit`（1..5000，默认 5000）是**行数上限守卫**：表的行数超过它会被整体拒掉（不是「只导前 N 行」）；
-- 导出产物 >1 MB 也会被拒。
-
-超大表别硬导：先用 `+db-execute` 加 `WHERE` / `LIMIT` 缩小范围、分批导。
-
-```bash
-lark-cli apps +db-data-export --app-id app_xxx --table orders --output ./orders.csv
-lark-cli apps +db-data-export --app-id app_xxx --table orders --output ./orders.json --env dev
-```
-
-**`+db-data-import`（高危）**：把本地 csv/json 文件的数据导进表。文件需是 `.csv`/`.json`、≤1 MB，必须带 `--yes`。目标表缺省取文件名去掉**最后一个**扩展名（如 `orders.csv`→`orders`，`orders.2026.csv`→`orders.2026`）；文件名带点号时建议显式传 `--table` 以免落到意外的表名。
-
-```bash
-lark-cli apps +db-data-import --app-id app_xxx --table orders --file ./orders.csv --env dev --yes
-```
-
-**导入/导出限额**：体积 ≤ **1 MB**、行数 ≤ **5000**，导入导出都一样，超限会被拒。超限就分批——导入拆成 ≤1 MB / ≤5000 行的多个文件，导出用 `WHERE` / `LIMIT` 缩小范围。
-
-### 变更追溯与审计
-
-**`+db-changelog-list`**：查表结构变更（DDL）历史——谁、什么时候、改了哪张表、做了什么。可按 `--table` 过滤、按 `--change-id` 精确定位某条、用 `--since`/`--until` 圈时间区间，分页 `--page-size`/`--page-token`。
-
-```bash
-lark-cli apps +db-changelog-list --app-id app_xxx --table orders --since 7d
-```
-
-**`+db-audit-status`**：看审计开关状态。给 `--table` 看单表，不给则列出所有已配置的表（开没开、保留期）。
-
-**`+db-audit-enable` / `+db-audit-disable`**：开 / 关某张表的行级变更审计。`--retention` 设保留期，取值 `7d`/`30d`/`180d`/`360d`/`forever`（默认 `7d`）。不要对已经开启审计的表重复 enable——不确定就先用 `+db-audit-status` 查。
-
-```bash
-lark-cli apps +db-audit-enable --app-id app_xxx --table orders --retention 30d
-lark-cli apps +db-audit-disable --app-id app_xxx --table orders
-```
-
-**`+db-audit-list`**：列出表的行级变更事件（INSERT/UPDATE/DELETE 的前后值与操作人）。`--table` 必填、可重复传多张表；`--since`/`--until` 圈时间。
-- **多表查询**：会先帮用户把不存在、或没开审计的表过滤掉再查，被过滤的表及原因列在结果的 `skipped` 里——据此告诉用户哪些表没纳入及为什么。
-- **单表查询**：不预过滤，表不存在 / 未开审计会直接报错（按 `error.hint` 转述给用户，引导先 `+db-audit-enable`）。
-
-```bash
-lark-cli apps +db-audit-list --app-id app_xxx --table orders --since 24h
-lark-cli apps +db-audit-list --app-id app_xxx --table orders --table users
-```
-
-### 时间点恢复（PITR）
-
-**`+db-recovery-diff`**：预览把库恢复到 `--target` 时间点会带来哪些变更（受影响的表、行数、预计耗时），不落地。同样需 `spark:app:write` scope。
-
-**`+db-recovery-apply`（高危）**：把库恢复到某个时间点，**会覆盖当前数据**，不可逆，必须带 `--yes`。
-
-- 可恢复窗口最长 **7 天**，且不早于**最近一次 `+db-env-migrate`**；超出窗口的目标会被拒。
-- 目标时间点与当前库一致时返回 `no_changes`（空操作），不算失败。
-- 动手前务必先 `+db-recovery-diff` 给用户确认。
-
-```bash
-lark-cli apps +db-recovery-diff --app-id app_xxx --target 2h
-lark-cli apps +db-recovery-apply --app-id app_xxx --target 2026-04-15T10:00:00Z --yes
-```
-
-### 配额
-
-**`+db-quota-get`**：查数据库存储用量（已用量、表数、视图数；配额接入后还会给总配额与使用率）。
-
-```bash
-lark-cli apps +db-quota-get --app-id app_xxx --env dev
-```
-
-## 时间格式（`--since` / `--until` / `--target`）
-
-按用户口语自然传入即可，支持：
-- 相对时间 `7d` / `2h` / `30s`（从现在往前推）
-- 日期 `2026-04-15`
-- 日期时间 `2026-04-15T10:00:00`
-- 带时区的 ISO 8601 `2026-04-15T10:00:00Z` / `2026-04-15T10:00:00+08:00`
-
-## Agent 规则
-
-- 用户说「本地 / 开发库 / 调试库」优先 `--env dev`，线上排查用 `--env online`；数据面写操作（导入 / 审计开关）默认先在 `dev` 验再动 `online`。
-- 看表用 `+db-table-list`，看结构用 `+db-table-get`（要建表语句加 `--format pretty`）；`+db-env-create` 仅用于存量单库拆多环境，新建的 full_stack 应用一般不需要。
-- 四个高危命令（`+db-env-create`、`+db-data-import`、`+db-env-migrate`、`+db-recovery-apply`）动手前先看清影响再带 `--yes`：发布 / 恢复先跑对应预览 `+db-env-diff` / `+db-recovery-diff`，导入无预览命令、可先 `--dry-run` 看请求或先在 `--env dev` 验；不要静默追加 `--yes`，遇 confirmation_required（exit 10）按 lark-shared 协议向用户确认不可逆风险后再补 `--yes` 重试。
-- 导入 / 导出的本地路径用工作目录内相对路径；超大表导出会被行数 / 体积上限拒，改用 `+db-execute` 分批。
-- `+db-audit-list` 多表查询时，把结果里 `skipped` 的表（不存在 / 未开审计）连同原因一并向用户说明，不要让用户以为这些表「没有变更」。
-- 恢复是覆盖式且不可逆：`+db-recovery-apply` 前必须先 `+db-recovery-diff`，并明确告知用户会覆盖当前数据。

skills/lark-apps/references/lark-apps-file.md

@@ -1,94 +0,0 @@
-# apps file 域命令（应用存储）
-
-管理妙搭应用的文件存储：上传 / 下载本地文件、列出与查看已存文件、生成临时分享链接、批量删除、查看用量。运行时命令事实以 `lark-cli apps +<cmd> --help` 为准；认证、`--as user`、exit 码、`_notice` 等通用处理见 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md) 与本域 [`SKILL.md`](../SKILL.md)。
-
-## 何时用
-
-用户要在某个妙搭应用里上传 / 下载 / 列出 / 删除文件、拿文件的临时分享链接、或看存储用量时。普通飞书云盘走 [`lark-drive`](../../lark-drive/SKILL.md)；数据库里的表数据走 `+db-*`。
-
-## 命令一览
-
-| 命令 | 做什么 | 关键参数 |
-|---|---|---|
-| `+file-list` | 列出文件，可按名/路径/类型/大小/上传时间过滤 | `--app-id`、过滤器、`--page-size`/`--page-token` |
-| `+file-get` | 查单个文件的元数据 | `--app-id`、`--path` |
-| `+file-sign` | 生成有时效的下载链接（用于分享 / 直接下载） | `--app-id`、`--path`、`--expires-in` |
-| `+file-download` | 把远端文件保存到本地 | `--app-id`、`--path`、`--output` |
-| `+file-upload` | 上传本地文件到应用存储 | `--app-id`、`--file` |
-| `+file-delete` | 按路径批量删除文件 | `--app-id`、`--path`（可重复）、`--yes` |
-| `+file-quota-get` | 查应用的文件存储用量 | `--app-id` |
-
-## 寻址与约定（先读）
-
-- **远端文件统一用 `--path` 精确寻址**（远端路径，带前导 `/`）。只知道文件名时，先用 `+file-list --name <名>` 定位拿到 `path`，再做后续操作。
-- **本地文件 / 输出路径用工作目录内的相对路径**（如 `--file ./report.pdf`、`--output ./out.png`）；路径在别处时先 `cd` 过去或改成相对路径。
-- 上传只接收本地 `--file`：文件名沿用本地文件名，远端路径由平台分配、全局唯一（无需也无法手填）。
-- file 域不区分环境，没有 `--env`。
-
-## 各命令
-
-### +file-list
-列出应用文件，支持精确过滤：`--name`（文件名）、`--path`（远端路径）、`--type`（MIME 类型）、`--size-gt`/`--size-lt`（字节）、`--uploaded-since`/`--uploaded-until`（上传时间区间，时间格式见末尾）。分页 `--page-size`（默认 20）/ `--page-token`。列表每项给名称、路径、大小、类型、上传时间（pretty 表格即这 5 列）；上传者、下载地址（如有）仅在 JSON 输出里，单文件详情用 `+file-get`。
-
-```bash
-lark-cli apps +file-list --app-id app_xxx
-lark-cli apps +file-list --app-id app_xxx --type image/png --uploaded-since 7d
-```
-
-### +file-get
-按 `--path` 查单个文件的元数据。路径不存在时返回明确的「文件不存在」错误。
-
-```bash
-lark-cli apps +file-get --app-id app_xxx --path /1858537546760216.png
-```
-
-### +file-sign
-为指定文件生成一个**有时效的下载链接**——适合发给用户分享、或直接下载。`--expires-in` 设有效期秒数（默认 1 天，最长 30 天）。`pretty` 模式只输出链接本身，便于复制 / 管道；要把到期时间一并告诉用户时用默认 JSON 输出（含到期时间）。
-
-```bash
-lark-cli apps +file-sign --app-id app_xxx --path /1858537546760216.png --expires-in 3600
-```
-
-### +file-download
-把远端文件保存到本地。`--output` 指定保存路径，缺省时按远端文件名保存到当前目录。
-
-```bash
-lark-cli apps +file-download --app-id app_xxx --path /1858537546760216.png --output ./logo.png
-```
-
-### +file-upload
-上传一个本地文件。文件名沿用本地文件名，远端路径由平台分配。单文件上限 100 MB。
-
-```bash
-lark-cli apps +file-upload --app-id app_xxx --file ./report.pdf
-```
-
-### +file-delete（高危）
-按路径批量删除，`--path` 可重复传多个。删除是高危操作，必须带 `--yes`；缺省会被确认关卡拦下。**逐项返回结果**：部分文件删除失败（如某个路径不存在）不影响其余文件，整体仍算成功，失败项在结果里单独标出原因。
-
-```bash
-lark-cli apps +file-delete --app-id app_xxx --path /1858537546760216.png --yes
-lark-cli apps +file-delete --app-id app_xxx --path /a.png --path /b.png --yes
-```
-
-### +file-quota-get
-查应用的文件存储用量（已用量、文件数；配额接入后还会给总配额与使用率）。
-
-```bash
-lark-cli apps +file-quota-get --app-id app_xxx
-```
-
-## 时间格式（`--uploaded-since` / `--uploaded-until`）
-
-按用户口语自然传入即可，支持：
-- 相对时间 `7d` / `2h` / `30s`（从现在往前推）
-- 日期 `2026-04-15`
-- 日期时间 `2026-04-15T10:00:00`
-- 带时区的 ISO 8601 `2026-04-15T10:00:00Z` / `2026-04-15T10:00:00+08:00`
-
-## Agent 规则
-
-- 寻址一律用 `--path`；用户只给文件名时先 `+file-list --name <名>` 定位，多个同名再让用户确认。
-- 上传 / 下载的本地路径用工作目录内相对路径；不在当前目录就 `cd` 过去或改相对路径。
-- 用户要「分享链接 / 临时下载地址」时用 `+file-sign`，把返回的链接转述给用户。
-- 删除前判断意图：已明确要删且授权时可直接带 `--yes`；不确定删哪些时先 `+file-list` 给用户确认。批量删除部分失败不报错，按逐项结果向用户说明哪些成功、哪些没删掉及原因。

skills/lark-apps/references/lark-apps-html-publish.md

@@ -38,7 +38,7 @@ lark-cli apps +html-publish --app-id app_xxx --path ./index.html --dry-run
 - 用户只说“用 HTML 写个 PPT/页面给我看看”时，先生成本地文件或目录，返回路径并问是否发布到妙搭分享；不要默认创建应用或部署。
 - 用户明确说“部署出去/发链接/可分享”时，才创建 `html` 应用并用 `+html-publish`。
 - 用户要发布但没有 app_id 时，先 `+create --app-type html` 创建应用；应用名可从页面/站点主题生成，不要让用户手动提供 app_id。
-- 若产物首页不是 `index.html`，发布前改名或复制为 `index.html`；目录发布时只传干净产物目录，例如 `./dist`，不要把 `.git`、`node_modules`、源码缓存一起带上。
+- 若产物首页不是 `index.html`，发布前改名或复制为 `index.html`；目录发布时只传干净产物目录，例如 `./dist`。`.git` 目录会被自动排除，不会进入压缩包；`node_modules`、源码缓存等仍建议手动精简以控制包体。
 - 重新部署同一个 HTML 应用时复用原 `app_id`，只重新执行 `+html-publish --app-id <id> --path <dir-or-index.html>`。
 
 ## 安全规则

skills/lark-doc/references/lark-doc-xml.md

@@ -78,6 +78,12 @@ p, h1-h9, ul, ol, li, table, thead, tbody, tr, th, td, blockquote, pre, code, hr
    ```
 
 
+## 用户名写入规则
+
+- 当从 IM 消息、日历、审批、任务等来源获取到用户的 `open_id` 时，写入文档**必须**使用 `<cite type="user" user-id="open_id">` 标签，而非纯文本名字。这样文档中会渲染为可点击的 @人。
+- 典型场景：IM 消息的 `sender`、`mentions`、reactions 的 `operator`、卡片消息中引用的用户、系统消息中的用户名、合并转发中的用户名。
+- 当只有纯文本名字而没有 `open_id` 时（如系统消息、合并转发内容），先通过 `lark-cli contact +search-user --query "名字" --as user` 反查 `open_id`，再写入 cite 标签。
+
 ## 表格扩展
 标准 HTML table 结构不变，扩展点：
 - `<colgroup>` / `<col>` 定义列宽，紧跟 `<table>` 之后：`<col span="2" width="100"/>`

skills/lark-doc/references/style/lark-doc-style.md

@@ -7,7 +7,7 @@
 1. **结构优于文字**：能用结构化 block 表达的信息，不用纯文本段落
 2. **Front-load 结论**：文档以 `<callout>` 开头概括核心结论；每章节首段点明要旨
 3. **视觉节奏**：连续纯文本不超过 3 段；不同主题章节间用 `<hr/>` 分隔
-4. **最少惊讶**：同类信息使用同类元素，全篇风格统一
+4. **风格一致**：同类信息使用同类元素，全篇风格统一
 5. **重要信息画板化**：核心流程、架构、对比、风险、路线图、指标趋势等重要信息优先使用画板表达
 
 ## 二、元素选择指南
@@ -24,7 +24,7 @@
 | 代码片段                                       | `<pre lang="x" caption="说明">`         |
 | 引用 / 公式                                    | `<blockquote>` / `<latex>`            |
 | 操作入口 / 跳转链接                                | `<button>` / `<a type="url-preview">` |
-| 流程图 / 时间线 / 示意图 / 自定义图形 / 架构图 / 数据图 /思维导图等 | 画板图表                                  |
+| 流程图 / 时间线 / 示意图 / 自定义图形 / 架构图 / 数据图 / 思维导图等 | 画板图表                                  |
 
 
 ### 画板意图识别
@@ -69,7 +69,7 @@
 ## 四、排版规范
 
 - 标题层级 ≤ 4 层，段落单段 ≤ 5 行，列表嵌套 ≤ 2 层，Grid ≤ 3 列
-- 文档开头用 `<callout>` front-load 结论；
+- 文档开头用 `<callout>` front-load 结论。
 
 ## 五、丰富度自检
 

skills/lark-im/SKILL.md

@@ -134,6 +134,21 @@ lark-cli im <resource> <method> [flags] # 调用 API
   - `delete` — 将用户或机器人移出群聊。Identity: supports `user` and `bot`; only group owner, admin, or creator bot can remove others; max 50 users or 5 bots per request.
   - `get` — 获取群成员列表。Identity: supports `user` and `bot`; the caller must be in the target chat and must belong to the same tenant for internal chats.
 
+### chat.user_setting
+
+  - `batch_query` — 批量查询当前用户在群内的个人偏好设置 (e.g. `is_muted` mutes normal messages, `is_mute_at_all` mutes @all messages); up to 10 chats per request. Identity: `user` only (`user_access_token`); the caller must be in each target chat.
+  - `batch_update` — 批量更新当前用户在群内的个人偏好设置 (e.g. `is_muted` mutes normal messages, `is_mute_at_all` mutes @all messages); up to 10 chats per request. Identity: `user` only (`user_access_token`); the caller must be in each target chat.
+
+### chat.managers
+
+  - `add_managers` — 指定群管理员。Identity: supports `user` and `bot`; only the group owner can add managers; max 10 managers per chat (20 for super-large chats), and at most 5 bots per request.
+  - `delete_managers` — 删除群管理员。Identity: supports `user` and `bot`; only the group owner can remove managers; max 50 users or 5 bots per request.
+
+### chat.moderation
+
+  - `get` — 获取群成员发言权限。Identity: supports `user` and `bot`; the caller must be in the target chat and belong to the same tenant.
+  - `update` — 更新群发言权限。Identity: supports `user` and `bot`; only the group owner (or creator bot with `im:chat:operate_as_owner`) can update; the caller must be in the chat.
+
 ### messages
 
   - `delete` — 撤回消息。Identity: supports `user` and `bot`; for `bot` calls, the bot must be in the chat to revoke group messages; to revoke another user's group message, the bot must be the owner, an admin, or the creator; for user P2P recalls, the target user must be within the bot's availability.
@@ -186,6 +201,12 @@ lark-cli im <resource> <method> [flags] # 调用 API
 | `chat.members.create` | `im:chat.members:write_only` |
 | `chat.members.delete` | `im:chat.members:write_only` |
 | `chat.members.get` | `im:chat.members:read` |
+| `chat.user_setting.batch_query` | `im:chat.user_setting:read` |
+| `chat.user_setting.batch_update` | `im:chat.user_setting:write` |
+| `chat.managers.add_managers` | `im:chat.managers:write_only` |
+| `chat.managers.delete_managers` | `im:chat.managers:write_only` |
+| `chat.moderation.get` | `im:chat.moderation:read` |
+| `chat.moderation.update` | `im:chat:moderation:write_only` |
 | `messages.delete` | `im:message:recall` |
 | `messages.forward` | `im:message` |
 | `messages.merge_forward` | `im:message` |

skills/lark-im/references/lark-im-chat-search.md

@@ -15,6 +15,9 @@ lark-cli im +chat-search --query "project"
 # Restrict by search types
 lark-cli im +chat-search --query "project" --search-types "private,public_joined"
 
+# Filter by chat mode (group = regular group, topic = topic/thread group)
+lark-cli im +chat-search --query "project" --chat-modes "topic"
+
 # Filter by member open_ids (with keyword)
 lark-cli im +chat-search --query "project" --member-ids "ou_xxx,ou_yyy"
 
@@ -43,6 +46,7 @@ lark-cli im +chat-search --query "project" --dry-run
 |------|------|------|------|
 | `--query <keyword>` | No (at least one of `--query` / `--member-ids` required) | Max 64 characters | Search keyword. Supports matching localized chat names, member names, multilingual search, pinyin, and prefix fuzzy search. If the query contains `-`, it is automatically wrapped in quotes |
 | `--search-types <types>` | No | Comma-separated: `private`, `external`, `public_joined`, `public_not_joined` | Restrict the visible chat types returned by search |
+| `--chat-modes <modes>` | No | Comma-separated: `group`, `topic` | Filter by chat mode (server-side): `group` = regular group, `topic` = topic/thread group |
 | `--member-ids <ids>` | No (at least one of `--query` / `--member-ids` required) | Up to 50, format `ou_xxx` | Filter by member open_ids; can be used alone or combined with `--query` |
 | `--is-manager` | No | - | Only show chats you created or manage |
 | `--disable-search-by-user` | No | - | Disable member-name-based matching and search by group name only |

tests/cli_e2e/apps/apps_html_publish_dryrun_test.go

@@ -87,9 +87,11 @@ func TestAppsHTMLPublishDryRun(t *testing.T) {
 		assert.Equal(t, "page.html", gjson.Get(result.Stdout, "files.0").String())
 	})
 
-	t.Run("HiddenFilesIncluded", func(t *testing.T) {
-		// Walker MUST NOT silently filter .git / .DS_Store — that's an explicit
-		// design decision so users pass clean ./dist trees, not source repos.
+	t.Run("HiddenFilesIncludedExceptGit", func(t *testing.T) {
+		// The walker filters the .git directory (and a .git gitdir pointer file)
+		// so a stray repo under --path doesn't ship its history / remote URL to a
+		// public share URL. Generic hidden files like .DS_Store are NOT filtered —
+		// only .git is — so users still see everything else they pointed --path at.
 		dir := t.TempDir()
 		require.NoError(t, os.MkdirAll(filepath.Join(dir, "dist"), 0o755))
 		require.NoError(t, os.WriteFile(filepath.Join(dir, "dist", "index.html"), []byte("<html/>"), 0o644))
@@ -112,8 +114,17 @@ func TestAppsHTMLPublishDryRun(t *testing.T) {
 		})
 		require.NoError(t, err)
 		result.AssertExitCode(t, 0)
-		assert.Equal(t, int64(3), gjson.Get(result.Stdout, "file_count").Int(),
-			"walker must include hidden files; got: %s", result.Stdout)
+		// index.html + .DS_Store kept; .git/HEAD filtered out → 2 files.
+		assert.Equal(t, int64(2), gjson.Get(result.Stdout, "file_count").Int(),
+			"walker must keep non-.git hidden files but drop .git; got: %s", result.Stdout)
+		names := gjson.Get(result.Stdout, "files").Array()
+		var got []string
+		for _, n := range names {
+			got = append(got, n.String())
+		}
+		assert.Contains(t, got, "index.html")
+		assert.Contains(t, got, ".DS_Store")
+		assert.NotContains(t, got, ".git/HEAD", "walker must exclude .git contents")
 	})
 
 	t.Run("EmptyDir_ManifestEmpty", func(t *testing.T) {