@cloudbase/cloudbase-mcp 2.21.1 → 2.22.0-beta.0

package/dist/index.js

@@ -13,6 +13,7 @@ import * as __WEBPACK_EXTERNAL_MODULE_https__ from "https";
 import * as __WEBPACK_EXTERNAL_MODULE_net__ from "net";
 import * as __WEBPACK_EXTERNAL_MODULE_fs__ from "fs";
 import * as __WEBPACK_EXTERNAL_MODULE__modelcontextprotocol_sdk_server_mcp_js_45c326f0__ from "@modelcontextprotocol/sdk/server/mcp.js";
+import * as __WEBPACK_EXTERNAL_MODULE_node_path_02319fef__ from "node:path";
 import * as __WEBPACK_EXTERNAL_MODULE_child_process__ from "child_process";
 import * as __WEBPACK_EXTERNAL_MODULE_ws__ from "ws";
 import * as __WEBPACK_EXTERNAL_MODULE__cloudbase_manager_node_6a52ea40__ from "@cloudbase/manager-node";
@@ -23,6 +24,7 @@ import * as __WEBPACK_EXTERNAL_MODULE_crypto__ from "crypto";
 import * as __WEBPACK_EXTERNAL_MODULE_fs_promises_f8dae9d1__ from "fs/promises";
 import * as __WEBPACK_EXTERNAL_MODULE_os__ from "os";
 import * as __WEBPACK_EXTERNAL_MODULE_winston__ from "winston";
+import * as __WEBPACK_EXTERNAL_MODULE_node_fs_75ed2103__ from "node:fs";
 /******/ var __webpack_modules__ = ({
 
 /***/ 622:
@@ -183,17 +185,17 @@ function buildEnvDomainManagementResult(params) {
             operation: action,
             targetDomains: domains,
             asyncState: "PENDING",
-            message: '安全域名已提交添加请求。该变更通常需要约 10 分钟传播，请继续轮询 envQuery(action="domains")，直到目标域名状态为 ENABLE。',
+            message: '安全域名已提交添加请求。该变更通常需要约 10 分钟传播，请继续轮询 queryEnv(action="domains")，直到目标域名状态为 ENABLE。',
             propagation: {
                 requiresPolling: true,
-                pollTool: "envQuery",
+                pollTool: "queryEnv",
                 pollAction: "domains",
                 pollIntervalSuggestionSeconds: 10,
                 timeoutSuggestionSeconds: 600,
-                successCondition: '目标域名出现在 envQuery(action="domains") 返回中，且 Status 为 ENABLE。',
+                successCondition: '目标域名出现在 queryEnv(action="domains") 返回中，且 Status 为 ENABLE。',
             },
             next_step: {
-                tool: "envQuery",
+                tool: "queryEnv",
                 action: "domains",
                 suggested_args: {
                     action: "domains",
@@ -208,17 +210,17 @@ function buildEnvDomainManagementResult(params) {
         operation: action,
         targetDomains: domains,
         asyncState: "PENDING",
-        message: '安全域名已提交删除请求。该变更可能需要数分钟传播，请继续轮询 envQuery(action="domains")，直到目标域名不再出现。',
+        message: '安全域名已提交删除请求。该变更可能需要数分钟传播，请继续轮询 queryEnv(action="domains")，直到目标域名不再出现。',
         propagation: {
             requiresPolling: true,
-            pollTool: "envQuery",
+            pollTool: "queryEnv",
             pollAction: "domains",
             pollIntervalSuggestionSeconds: 10,
             timeoutSuggestionSeconds: 600,
-            successCondition: '目标域名不再出现在 envQuery(action="domains") 返回中。',
+            successCondition: '目标域名不再出现在 queryEnv(action="domains") 返回中。',
         },
         next_step: {
-            tool: "envQuery",
+            tool: "queryEnv",
             action: "domains",
             suggested_args: {
                 action: "domains",
@@ -492,7 +494,7 @@ function buildEnvQueryListResult(params) {
     const paginated = paginateEnvList(filteredList, params.filters.offset, params.filters.limit);
     const exactEnvIdSummaryHint = params.filters.envId
         ? {
-            tool: "envQuery",
+            tool: "queryEnv",
             action: "info",
             reason: "action=list with envId only returns a concise summary. Use action=info to fetch detailed environment information such as full resource metadata and additional environment details.",
         }
@@ -557,13 +559,122 @@ async function enrichEnvInfoWithBilling(params) {
         return params.result;
     }
 }
+/**
+ * Derive a RuntimeMode hint from the EnvInfo payload so the AI agent can
+ * immediately tell which CloudBase data backends are actually present in
+ * this environment.
+ *
+ * Reality model (revised after observing a real PG environment): a single
+ * CloudBase environment can have any combination of:
+ * - PostgreSQL (CloudBase PG / pgstore): signaled by `EnvInfo.PostgreSQL[]`
+ *   non-empty and/or `EnvInfo.Meta` containing `postgresql=enable`.
+ * - NoSQL document database + the matching legacy COS-style bucket:
+ *   signaled by `EnvInfo.Databases[]` (with InstanceId / RUNNING) and the
+ *   bucket exposed in `EnvInfo.Storages[]`.
+ * - MySQL: signaled by a non-empty `EnvInfo.MysqlInstances[]` (or similar
+ *   field, name varies). In a pure PG environment this is absent.
+ *
+ * In particular: a CloudBase PG environment commonly STILL has the NoSQL
+ * Database + Storage running in parallel. NoSQL is therefore "co-present"
+ * — its collection APIs, NoSQL `securityRule`s, and the legacy
+ * `app.uploadFile()` upload flow remain valid for collections / files
+ * that already live there. The thing that is NOT a substitute for the new
+ * PG surface is using NoSQL collections to model a brand-new business
+ * table that the task explicitly puts in PG.
+ *
+ * What this enrichment does:
+ * - Adds `EnvInfo.RuntimeMode = "postgresql" | "nosql"` based on whether
+ *   PG is present. This is the recommended primary backend for new
+ *   business data when set to "postgresql".
+ * - Adds `EnvInfo.RuntimeBackends`, a structured snapshot of which
+ *   backends are actually available (postgresql / nosql / mysql), so the
+ *   agent does not have to re-read `Databases`/`Storages`/`PostgreSQL`.
+ * - Adds `EnvInfo.RuntimeModeHints` summarizing which API/tool to prefer
+ *   for new code, including an explicit `MysqlNotAvailable` line when
+ *   MySQL is absent — that one IS a hard "do not use" signal.
+ */
+function enrichEnvInfoWithRuntimeMode(result) {
+    const envInfo = result?.EnvInfo;
+    if (!envInfo || typeof envInfo !== "object") {
+        return result;
+    }
+    const pgList = Array.isArray(envInfo.PostgreSQL) ? envInfo.PostgreSQL : [];
+    const metaList = Array.isArray(envInfo.Meta) ? envInfo.Meta : [];
+    const metaPostgresEnabled = metaList.some((item) => item &&
+        typeof item.Key === "string" &&
+        /^postgre[_]?sql$/i.test(item.Key) &&
+        String(item.Value).toLowerCase() === "enable");
+    const hasPostgresql = pgList.length > 0 || metaPostgresEnabled;
+    // NoSQL document DB shows up under Databases[]; the matching legacy bucket
+    // shows up under Storages[]. Treat NoSQL as available when either side is
+    // non-empty (an old env may keep one without the other).
+    const databasesList = Array.isArray(envInfo.Databases)
+        ? envInfo.Databases
+        : [];
+    const storagesList = Array.isArray(envInfo.Storages) ? envInfo.Storages : [];
+    const hasNoSql = databasesList.length > 0 || storagesList.length > 0;
+    // MySQL field name has been seen as MysqlInstances / MySQLInstances /
+    // MySQL across API versions; check any of them.
+    const mysqlList = (() => {
+        for (const k of ["MysqlInstances", "MySQLInstances", "MySQL"]) {
+            const v = envInfo[k];
+            if (Array.isArray(v) && v.length > 0)
+                return v;
+        }
+        return [];
+    })();
+    const hasMysql = mysqlList.length > 0;
+    // Primary mode: prefer PG when it is provisioned, otherwise fall back to
+    // legacy NoSQL labeling. This drives "what skill to read first / what API
+    // to reach for when starting new business code".
+    const runtimeMode = hasPostgresql
+        ? "postgresql"
+        : "nosql";
+    const hints = hasPostgresql
+        ? {
+            PrimaryBackend: "PostgreSQL (CloudBase PG) is provisioned — prefer it for any NEW business data the task introduces.",
+            BusinessDataAPI: "For NEW business data on PG: use CloudBase JS SDK v3 `app.rdb()` (Supabase-style chained query). Existing NoSQL collections in this env keep working through `app.database()`; do not migrate them unless the task asks.",
+            Permissions: "PG table permissions use Row-Level Security. Run `ALTER TABLE ... ENABLE ROW LEVEL SECURITY` and `CREATE POLICY` via `managePgDatabase(action=\"execute\", confirm=true)`. `managePermissions(resourceType=\"noSqlDatabase\", securityRule=...)` only governs NoSQL collection rules and has NO effect on PG tables — keep using it for the NoSQL collections that already exist here.",
+            Storage: "PG-mode browser uploads should use `app.storage.from().upload(<bucket>/<key>, file)` against an explicitly-created `pgstore` bucket (same model as Supabase Storage; the v3 SDK does not auto-create one). `EnvInfo.Storages[]` here is the legacy NoSQL bucket — it is still usable for the legacy `app.uploadFile()` flow but is NOT a valid pgstore target.",
+            CoexistingNoSQL: hasNoSql
+                ? "This env also has the legacy NoSQL Database + Storage running. Existing collections, existing `app.uploadFile()` calls, existing `managePermissions(resourceType=\"noSqlDatabase\")` rules all remain valid for legacy data."
+                : "No legacy NoSQL Database/Storage observed in this env.",
+            MysqlNotAvailable: hasMysql
+                ? "MySQL instance(s) detected — see EnvInfo.MysqlInstances."
+                : "No MySQL instance is provisioned for this env. Do NOT use `manageSqlDatabase` / `querySqlDatabase` (those are MySQL-specific) and do NOT read the `relational-database-tool` skill — that family targets MySQL, not CloudBase PG.",
+            RecommendedSkills: "Read `postgresql-development` first for new PG code. `no-sql-web-sdk` is still applicable for existing NoSQL collections in this env. Skip `relational-database-tool` (MySQL-only) entirely.",
+        }
+        : {
+            PrimaryBackend: "PostgreSQL is NOT provisioned in this env — this is a legacy NoSQL CloudBase backend.",
+            BusinessDataAPI: "Use `app.database()` collections via `@cloudbase/js-sdk` for browser business data. Do not switch to `app.rdb()` here — PG is not available.",
+            Permissions: "Use `managePermissions(resourceType=\"noSqlDatabase\", securityRule=...)` for collection rules. PG-only RLS guidance (e.g. `auth.uid()` SQL policies) does not apply here.",
+            Storage: "Browser uploads use `app.uploadFile()` against the bucket exposed in `EnvInfo.Storages[].Bucket`.",
+            MysqlNotAvailable: hasMysql
+                ? "MySQL instance(s) detected — see EnvInfo.MysqlInstances."
+                : "No MySQL instance in this env. `manageSqlDatabase` / `querySqlDatabase` and the `relational-database-tool` skill are not applicable.",
+            RecommendedSkills: "Read `no-sql-web-sdk` (and `cloud-storage-web` for uploads). `postgresql-development` and `relational-database-tool` are not applicable to this env.",
+        };
+    return {
+        ...result,
+        EnvInfo: {
+            ...envInfo,
+            RuntimeMode: runtimeMode,
+            RuntimeBackends: {
+                postgresql: hasPostgresql,
+                nosql: hasNoSql,
+                mysql: hasMysql,
+            },
+            RuntimeModeHints: hints,
+        },
+    };
+}
 function normalizeOptionalToolString(value) {
     return typeof value === "string" && value.trim().length > 0
         ? value.trim()
         : undefined;
 }
 /**
- * Build enhanced error message for envQuery tool errors
+ * Build enhanced error message for queryEnv tool errors
  * Provides actionable guidance based on error patterns
  */
 function buildEnvQueryErrorMessage(error, action) {
@@ -579,7 +690,7 @@ function buildEnvQueryErrorMessage(error, action) {
         suggestions.push("参数错误：可能是认证信息无效或已过期，请尝试以下步骤：");
         suggestions.push("1. 先调用 auth(action=\"status\") 检查当前登录状态");
         suggestions.push("2. 如果未登录，调用 auth(action=\"start_auth\", authMode=\"device\") 完成登录");
-        suggestions.push("3. 登录完成后再次调用 envQuery(action=\"list\")");
+        suggestions.push("3. 登录完成后再次调用 queryEnv(action=\"list\")");
     }
     if (hasAuthError) {
         suggestions.push("认证错误：当前未登录或认证已过期。");
@@ -591,7 +702,7 @@ function buildEnvQueryErrorMessage(error, action) {
     }
     if (hasEnvNotFoundError) {
         suggestions.push("环境错误：指定的环境不存在或无法访问。");
-        suggestions.push("请使用 envQuery(action=\"list\") 查看可用的环境列表。");
+        suggestions.push("请使用 queryEnv(action=\"list\") 查看可用的环境列表。");
     }
     if (hasNetworkError) {
         suggestions.push("网络错误：请检查网络连接，稍后重试。");
@@ -603,7 +714,7 @@ function buildEnvQueryErrorMessage(error, action) {
         suggestions.push("2. 如未登录，执行 auth(action=\"start_auth\") 完成认证");
         suggestions.push("3. 确认环境 ID 正确且可访问");
     }
-    return `[envQuery/${action}] 调用失败: ${baseMessage}\n\n解决建议：\n${suggestions.join("\n")}`;
+    return `[queryEnv/${action}] 调用失败: ${baseMessage}\n\n解决建议：\n${suggestions.join("\n")}`;
 }
 function normalizeOptionalToolBoolean(value) {
     return typeof value === "boolean" ? value : undefined;
@@ -632,519 +743,500 @@ function registerEnvTools(server) {
     const supportedAuthActions = getSupportedAuthActions(server);
     const authActionEnum = [...supportedAuthActions];
     // auth - CloudBase (云开发) 开发阶段登录与环境绑定
-    server.registerTool?.("auth", {
-        title: "CloudBase 开发阶段登录与环境",
-        description: "CloudBase（腾讯云开发）开发阶段登录与环境绑定。登录后即可访问云资源；环境(env)是云函数、数据库、静态托管等资源的隔离单元，绑定环境后其他 MCP 工具才能操作该环境。支持：查询状态、发起登录、绑定环境(set_env)、退出登录。",
-        inputSchema: {
-            action: zod_1.z
-                .enum(authActionEnum)
-                .optional()
-                .describe("动作：status=查询状态，start_auth=发起登录，set_env=绑定环境(传envId)，logout=退出登录"),
-            ...(supportedAuthActions.includes("start_auth")
-                ? {
-                    authMode: zod_1.z
-                        .enum(["device", "web"])
-                        .optional()
-                        .describe("认证模式：device=设备码授权，web=浏览器回调授权"),
-                    oauthEndpoint: zod_1.z
-                        .string()
-                        .optional()
-                        .describe("高级可选：自定义 device-code 登录 endpoint。配置后 oauthCustom 默认按 true 处理"),
-                    clientId: zod_1.z
-                        .string()
-                        .optional()
-                        .describe("高级可选：自定义 device-code 登录 client_id，不传则使用默认值"),
-                    oauthCustom: zod_1.z
-                        .boolean()
-                        .optional()
-                        .describe("高级可选：自定义 endpoint 返回格式开关。未配置 endpoint 时默认 false；配置 endpoint 后默认 true，且不能设为 false"),
-                }
-                : {}),
-            envId: zod_1.z
-                .string()
-                .optional()
-                .describe("环境ID(CloudBase 环境唯一标识)，绑定后工具将操作该环境。action=set_env 时必填"),
-            ...(supportedAuthActions.includes("logout")
-                ? {
-                    confirm: zod_1.z
-                        .literal("yes")
-                        .optional()
-                        .describe("action=logout 时确认操作，传 yes"),
-                }
-                : {}),
-            ...(supportedAuthActions.includes("get_temp_credentials")
-                ? {
-                    reveal: zod_1.z
-                        .boolean()
-                        .optional()
-                        .describe("action=get_temp_credentials 时可选。true=返回明文临时密钥；默认 false 仅返回脱敏结果"),
-                }
-                : {}),
-        },
-        annotations: {
-            readOnlyHint: false,
-            destructiveHint: false,
-            idempotentHint: false,
-            openWorldHint: true,
-            category: "env",
-        },
-    }, async (rawArgs) => {
-        const action = rawArgs.action ?? "status";
-        const authMode = rawArgs.authMode === "device" || rawArgs.authMode === "web"
-            ? rawArgs.authMode
-            : undefined;
-        const oauthEndpoint = normalizeOptionalToolString(rawArgs.oauthEndpoint);
-        const clientId = normalizeOptionalToolString(rawArgs.clientId);
-        const oauthCustom = normalizeOptionalToolBoolean(rawArgs.oauthCustom);
-        const envId = rawArgs.envId;
-        const confirm = rawArgs.confirm === "yes" ? "yes" : undefined;
-        const reveal = normalizeOptionalToolBoolean(rawArgs.reveal) === true;
-        const resolvedAuthOptions = resolveToolAuthOptions(server, {
-            authMode,
-            oauthEndpoint,
-            clientId,
-            oauthCustom,
-        });
-        const authConfigSummary = (0, auth_js_1.buildAuthConfigSummary)(resolvedAuthOptions);
-        let deviceAuthInfo;
-        const onDeviceCode = (info) => {
-            deviceAuthInfo = info;
-            (0, auth_js_1.setPendingAuthProgressState)(info, "device");
-            // emitDeviceAuthNotice(server, info);
-        };
-        const authChallenge = () => (0, auth_js_1.buildDeviceAuthChallengePayload)(deviceAuthInfo);
-        try {
-            if (!supportedAuthActions.includes(action)) {
-                return (0, tool_result_js_1.buildJsonToolResult)({
-                    ok: false,
-                    code: "NOT_SUPPORTED",
-                    message: `当前 IDE 不支持 auth(action="${action}")。`,
-                    next_step: (0, tool_result_js_1.buildAuthNextStep)("status", {
-                        suggestedArgs: { action: "status" },
-                    }),
-                });
-            }
-            if (action === "status") {
-                const loginState = await (0, auth_js_1.peekLoginState)();
-                const authFlowState = await (0, auth_js_1.getAuthProgressState)();
-                // 判断是否为 API Key 模式
-                const isApiKeyMode = !!(process.env.CLOUDBASE_API_KEY && process.env.CLOUDBASE_ENV_ID);
-                const authStatus = loginState
-                    ? "READY"
-                    : authFlowState.status === "PENDING"
-                        ? "PENDING"
-                        : "REQUIRED";
-                let envPreparation;
-                const message = authStatus === "READY"
-                    ? undefined
-                    : authStatus === "PENDING"
-                        ? "设备码授权进行中，请完成浏览器授权后再次调用 auth(action=\"status\")"
-                        : isCodeBuddyIde(server)
-                            ? "当前未登录。CodeBuddy 暂不支持在 tool 内发起认证，请在外部完成认证后再次调用 auth(action=\"status\")。"
-                            : "当前未登录，请先执行 auth(action=\"start_auth\")";
-                if (authStatus === "READY" && loginState) {
-                    envPreparation = await prepareAuthEnvironment({
-                        server,
-                        cloudBaseOptions,
-                        loginState,
-                    });
-                }
-                return (0, tool_result_js_1.buildJsonToolResult)({
-                    ok: true,
-                    code: "STATUS",
-                    auth_status: authStatus,
-                    ...(isApiKeyMode ? { auth_mode: "api_key" } : {}),
-                    auth_config: authConfigSummary,
-                    ...(envPreparation
-                        ? buildAuthEnvSetupPayload(envPreparation)
-                        : {
-                            env_status: "NONE",
-                            current_env_id: null,
-                            ...buildEnvCandidatePayload([]),
-                        }),
-                    auth_challenge: authFlowState.status === "PENDING"
-                        ? (0, auth_js_1.buildDeviceAuthChallengePayload)(authFlowState.authChallenge)
-                        : undefined,
-                    message,
-                    next_step: authStatus === "REQUIRED"
-                        ? buildAuthRequiredNextStep(server)
-                        : authStatus === "PENDING"
-                            ? (0, tool_result_js_1.buildAuthNextStep)("status", {
-                                suggestedArgs: { action: "status" },
-                            })
-                            : envPreparation?.nextStep,
-                });
-            }
-            if (action === "start_auth") {
-                // API Key 模式：尝试换取临时密钥
-                if (process.env.CLOUDBASE_API_KEY && process.env.CLOUDBASE_ENV_ID) {
-                    try {
-                        const existingLoginState = await (0, auth_js_1.peekLoginState)();
-                        if (existingLoginState) {
-                            return (0, tool_result_js_1.buildJsonToolResult)({
-                                ok: true,
-                                code: "AUTH_READY",
-                                message: "当前使用 API Key 认证模式，已自动完成登录，无需手动授权。",
-                                auth_mode: "api_key",
-                                envId: process.env.CLOUDBASE_ENV_ID,
-                            });
-                        }
+    // 微信 IDE 使用票据认证，不需要登录工具
+    if (server.ide !== 'wxide') {
+        server.registerTool?.("auth", {
+            title: "CloudBase 开发阶段登录与环境",
+            description: "CloudBase（腾讯云开发）开发阶段登录与环境绑定。登录后即可访问云资源；环境(env)是云函数、数据库、静态托管等资源的隔离单元，绑定环境后其他 MCP 工具才能操作该环境。支持：查询状态、发起登录、绑定环境(set_env)、退出登录。",
+            inputSchema: {
+                action: zod_1.z
+                    .enum(authActionEnum)
+                    .optional()
+                    .describe("动作：status=查询状态，start_auth=发起登录，set_env=绑定环境(传envId)，logout=退出登录"),
+                ...(supportedAuthActions.includes("start_auth")
+                    ? {
+                        authMode: zod_1.z
+                            .enum(["device", "web"])
+                            .optional()
+                            .describe("认证模式：device=设备码授权，web=浏览器回调授权"),
+                        oauthEndpoint: zod_1.z
+                            .string()
+                            .optional()
+                            .describe("高级可选：自定义 device-code 登录 endpoint。配置后 oauthCustom 默认按 true 处理"),
+                        clientId: zod_1.z
+                            .string()
+                            .optional()
+                            .describe("高级可选：自定义 device-code 登录 client_id，不传则使用默认值"),
+                        oauthCustom: zod_1.z
+                            .boolean()
+                            .optional()
+                            .describe("高级可选：自定义 endpoint 返回格式开关。未配置 endpoint 时默认 false；配置 endpoint 后默认 true，且不能设为 false"),
                     }
-                    catch (e) {
-                        // peekLoginState 内部异常，记录后 fall through
-                        (0, logger_js_1.debug)("start_auth: peekLoginState threw", { error: e instanceof Error ? e.message : String(e) });
+                    : {}),
+                envId: zod_1.z
+                    .string()
+                    .optional()
+                    .describe("环境ID(CloudBase 环境唯一标识)，绑定后工具将操作该环境。action=set_env 时必填"),
+                ...(supportedAuthActions.includes("logout")
+                    ? {
+                        confirm: zod_1.z
+                            .literal("yes")
+                            .optional()
+                            .describe("action=logout 时确认操作，传 yes"),
                     }
-                    // API Key 换取失败：返回详细诊断信息
-                    // 尝试获取更详细的错误信息
-                    let diagMessage = "当前配置了 API Key 认证模式，但换取临时密钥失败。";
-                    const endpoint = process.env.CLOUDBASE_API_ENDPOINT || `https://${process.env.CLOUDBASE_ENV_ID}.ap-shanghai.tcb-api.tencentcloudapi.com`;
-                    diagMessage += `\n\n诊断信息：`;
-                    diagMessage += `\n- CLOUDBASE_ENV_ID: ${process.env.CLOUDBASE_ENV_ID}`;
-                    diagMessage += `\n- CLOUDBASE_API_KEY: ${process.env.CLOUDBASE_API_KEY.slice(0, 20)}...（已截断）`;
-                    diagMessage += `\n- Endpoint: ${endpoint}`;
-                    diagMessage += `\n\n可能原因：`;
-                    diagMessage += `\n1. API Key 已过期或被删除`;
-                    diagMessage += `\n2. Endpoint 不可达（网络/DNS 问题）`;
-                    diagMessage += `\n3. CLOUDBASE_ENV_ID 与 API Key 所属环境不匹配`;
-                    diagMessage += `\n\n建议：检查 MCP 配置中的 CLOUDBASE_API_KEY 和 CLOUDBASE_ENV_ID 环境变量是否正确。`;
+                    : {}),
+                ...(supportedAuthActions.includes("get_temp_credentials")
+                    ? {
+                        reveal: zod_1.z
+                            .boolean()
+                            .optional()
+                            .describe("action=get_temp_credentials 时可选。true=返回明文临时密钥；默认 false 仅返回脱敏结果"),
+                    }
+                    : {}),
+            },
+            annotations: {
+                readOnlyHint: false,
+                destructiveHint: false,
+                idempotentHint: false,
+                openWorldHint: true,
+                category: "env",
+            },
+        }, async (rawArgs) => {
+            const action = rawArgs.action ?? "status";
+            const authMode = rawArgs.authMode === "device" || rawArgs.authMode === "web"
+                ? rawArgs.authMode
+                : undefined;
+            const oauthEndpoint = normalizeOptionalToolString(rawArgs.oauthEndpoint);
+            const clientId = normalizeOptionalToolString(rawArgs.clientId);
+            const oauthCustom = normalizeOptionalToolBoolean(rawArgs.oauthCustom);
+            const envId = rawArgs.envId;
+            const confirm = rawArgs.confirm === "yes" ? "yes" : undefined;
+            const reveal = normalizeOptionalToolBoolean(rawArgs.reveal) === true;
+            const resolvedAuthOptions = resolveToolAuthOptions(server, {
+                authMode,
+                oauthEndpoint,
+                clientId,
+                oauthCustom,
+            });
+            const authConfigSummary = (0, auth_js_1.buildAuthConfigSummary)(resolvedAuthOptions);
+            let deviceAuthInfo;
+            const onDeviceCode = (info) => {
+                deviceAuthInfo = info;
+                (0, auth_js_1.setPendingAuthProgressState)(info, "device");
+                // emitDeviceAuthNotice(server, info);
+            };
+            const authChallenge = () => (0, auth_js_1.buildDeviceAuthChallengePayload)(deviceAuthInfo);
+            try {
+                if (!supportedAuthActions.includes(action)) {
                     return (0, tool_result_js_1.buildJsonToolResult)({
                         ok: false,
-                        code: "API_KEY_AUTH_FAILED",
-                        message: diagMessage,
-                        auth_mode: "api_key",
-                        envId: process.env.CLOUDBASE_ENV_ID,
-                        endpoint,
-                    });
-                }
-                const region = server.cloudBaseOptions?.region || process.env.TCB_REGION;
-                const auth = toolbox_1.AuthSupervisor.getInstance({});
-                const authFlowState = await (0, auth_js_1.getAuthProgressState)();
-                if (authFlowState.status === "PENDING" && authFlowState.authChallenge) {
-                    return (0, tool_result_js_1.buildJsonToolResult)({
-                        ok: true,
-                        code: "AUTH_PENDING",
-                        message: "设备码授权进行中，请在浏览器中打开 verification_uri 并输入 user_code 完成授权。",
-                        auth_challenge: (0, auth_js_1.buildDeviceAuthChallengePayload)(authFlowState.authChallenge),
+                        code: "NOT_SUPPORTED",
+                        message: `当前 IDE 不支持 auth(action="${action}")。`,
                         next_step: (0, tool_result_js_1.buildAuthNextStep)("status", {
                             suggestedArgs: { action: "status" },
                         }),
                     });
                 }
-                // 1. 如果已经有登录态，直接返回 AUTH_READY
-                try {
-                    const existingLoginState = await (0, auth_js_1.peekLoginState)();
-                    if (existingLoginState) {
-                        const envPreparation = await prepareAuthEnvironment({
+                if (action === "status") {
+                    const loginState = await (0, auth_js_1.peekLoginState)();
+                    const authFlowState = await (0, auth_js_1.getAuthProgressState)();
+                    // 判断是否为 API Key 模式
+                    const isApiKeyMode = !!(process.env.CLOUDBASE_API_KEY && process.env.CLOUDBASE_ENV_ID);
+                    const authStatus = loginState
+                        ? "READY"
+                        : authFlowState.status === "PENDING"
+                            ? "PENDING"
+                            : "REQUIRED";
+                    let envPreparation;
+                    const message = authStatus === "READY"
+                        ? undefined
+                        : authStatus === "PENDING"
+                            ? "设备码授权进行中，请完成浏览器授权后再次调用 auth(action=\"status\")"
+                            : isCodeBuddyIde(server)
+                                ? "当前未登录。CodeBuddy 暂不支持在 tool 内发起认证，请在外部完成认证后再次调用 auth(action=\"status\")。"
+                                : "当前未登录，请先执行 auth(action=\"start_auth\")";
+                    if (authStatus === "READY" && loginState) {
+                        envPreparation = await prepareAuthEnvironment({
                             server,
                             cloudBaseOptions,
-                            loginState: existingLoginState,
-                        });
-                        return (0, tool_result_js_1.buildJsonToolResult)({
-                            ok: true,
-                            code: "AUTH_READY",
-                            message: envPreparation.message,
-                            auth_challenge: authChallenge(),
-                            ...buildAuthEnvSetupPayload(envPreparation),
-                            next_step: envPreparation.nextStep,
+                            loginState,
                         });
                     }
-                }
-                catch {
-                    // 忽略 getLoginState 错误，继续尝试发起登录
-                }
-                const validationError = (0, auth_js_1.getAuthConfigValidationError)(resolvedAuthOptions);
-                if (validationError) {
                     return (0, tool_result_js_1.buildJsonToolResult)({
-                        ok: false,
-                        code: "INVALID_ARGS",
-                        message: validationError,
+                        ok: true,
+                        code: "STATUS",
+                        auth_status: authStatus,
+                        ...(isApiKeyMode ? { auth_mode: "api_key" } : {}),
                         auth_config: authConfigSummary,
-                        next_step: (0, tool_result_js_1.buildAuthNextStep)("start_auth", {
-                            suggestedArgs: { action: "start_auth", authMode: "device" },
-                        }),
+                        ...(envPreparation
+                            ? buildAuthEnvSetupPayload(envPreparation)
+                            : {
+                                env_status: "NONE",
+                                current_env_id: null,
+                                ...buildEnvCandidatePayload([]),
+                            }),
+                        auth_challenge: authFlowState.status === "PENDING"
+                            ? (0, auth_js_1.buildDeviceAuthChallengePayload)(authFlowState.authChallenge)
+                            : undefined,
+                        message,
+                        next_step: authStatus === "REQUIRED"
+                            ? buildAuthRequiredNextStep(server)
+                            : authStatus === "PENDING"
+                                ? (0, tool_result_js_1.buildAuthNextStep)("status", {
+                                    suggestedArgs: { action: "status" },
+                                })
+                                : envPreparation?.nextStep,
                     });
                 }
-                // 2. 设备码模式：监听到 device code 即返回 AUTH_PENDING，后续由 toolbox 异步轮询并更新本地 credential
-                const effectiveMode = resolvedAuthOptions.authMode;
-                if (effectiveMode === "device") {
-                    let resolveCode;
-                    let rejectCode;
-                    const codeReady = new Promise((resolve, reject) => {
-                        resolveCode = resolve;
-                        rejectCode = reject;
-                    });
-                    const deviceOnCode = (info) => {
-                        onDeviceCode(info);
-                        if (resolveCode) {
-                            resolveCode();
-                        }
-                    };
-                    try {
-                        // 启动 Device Flow，全流程由 toolbox 负责轮询和写入 credential，这里不等待完成
-                        auth
-                            .loginByWebAuth({
-                            flow: "device",
-                            ...(resolvedAuthOptions.clientId
-                                ? { client_id: resolvedAuthOptions.clientId }
-                                : {}),
-                            ...(resolvedAuthOptions.oauthEndpoint
-                                ? { getOAuthEndpoint: () => resolvedAuthOptions.oauthEndpoint }
-                                : {}),
-                            ...(resolvedAuthOptions.oauthCustom
-                                ? { custom: true }
-                                : {}),
-                            onDeviceCode: deviceOnCode,
-                        })
-                            .then(() => {
-                            (0, auth_js_1.resolveAuthProgressState)();
-                        })
-                            .catch((err) => {
-                            (0, auth_js_1.rejectAuthProgressState)(err);
-                            // 如果在拿到 device code 之前就失败，则唤醒当前调用并返回错误
-                            if (!deviceAuthInfo && rejectCode) {
-                                rejectCode(err);
+                if (action === "start_auth") {
+                    // API Key 模式：尝试换取临时密钥
+                    if (process.env.CLOUDBASE_API_KEY && process.env.CLOUDBASE_ENV_ID) {
+                        try {
+                            const existingLoginState = await (0, auth_js_1.peekLoginState)();
+                            if (existingLoginState) {
+                                return (0, tool_result_js_1.buildJsonToolResult)({
+                                    ok: true,
+                                    code: "AUTH_READY",
+                                    message: "当前使用 API Key 认证模式，已自动完成登录，无需手动授权。",
+                                    auth_mode: "api_key",
+                                    envId: process.env.CLOUDBASE_ENV_ID,
+                                });
                             }
+                        }
+                        catch (e) {
+                            // peekLoginState 内部异常，记录后 fall through
+                            (0, logger_js_1.debug)("start_auth: peekLoginState threw", { error: e instanceof Error ? e.message : String(e) });
+                        }
+                        // API Key 换取失败：返回详细诊断信息
+                        // 尝试获取更详细的错误信息
+                        let diagMessage = "当前配置了 API Key 认证模式，但换取临时密钥失败。";
+                        const endpoint = process.env.CLOUDBASE_API_ENDPOINT || `https://${process.env.CLOUDBASE_ENV_ID}.ap-shanghai.tcb-api.tencentcloudapi.com`;
+                        diagMessage += `\n\n诊断信息：`;
+                        diagMessage += `\n- CLOUDBASE_ENV_ID: ${process.env.CLOUDBASE_ENV_ID}`;
+                        diagMessage += `\n- CLOUDBASE_API_KEY: ${process.env.CLOUDBASE_API_KEY.slice(0, 20)}...（已截断）`;
+                        diagMessage += `\n- Endpoint: ${endpoint}`;
+                        diagMessage += `\n\n可能原因：`;
+                        diagMessage += `\n1. API Key 已过期或被删除`;
+                        diagMessage += `\n2. Endpoint 不可达（网络/DNS 问题）`;
+                        diagMessage += `\n3. CLOUDBASE_ENV_ID 与 API Key 所属环境不匹配`;
+                        diagMessage += `\n\n建议：检查 MCP 配置中的 CLOUDBASE_API_KEY 和 CLOUDBASE_ENV_ID 环境变量是否正确。`;
+                        return (0, tool_result_js_1.buildJsonToolResult)({
+                            ok: false,
+                            code: "API_KEY_AUTH_FAILED",
+                            message: diagMessage,
+                            auth_mode: "api_key",
+                            envId: process.env.CLOUDBASE_ENV_ID,
+                            endpoint,
                         });
                     }
-                    catch (err) {
-                        if (rejectCode) {
-                            rejectCode(err);
-                        }
+                    const region = server.cloudBaseOptions?.region || process.env.TCB_REGION;
+                    const auth = toolbox_1.AuthSupervisor.getInstance({});
+                    const authFlowState = await (0, auth_js_1.getAuthProgressState)();
+                    if (authFlowState.status === "PENDING" && authFlowState.authChallenge) {
+                        return (0, tool_result_js_1.buildJsonToolResult)({
+                            ok: true,
+                            code: "AUTH_PENDING",
+                            message: "设备码授权进行中，请在浏览器中打开 verification_uri 并输入 user_code 完成授权。",
+                            auth_challenge: (0, auth_js_1.buildDeviceAuthChallengePayload)(authFlowState.authChallenge),
+                            next_step: (0, tool_result_js_1.buildAuthNextStep)("status", {
+                                suggestedArgs: { action: "status" },
+                            }),
+                        });
                     }
+                    // 1. 如果已经有登录态，直接返回 AUTH_READY
                     try {
-                        await codeReady;
+                        const existingLoginState = await (0, auth_js_1.peekLoginState)();
+                        if (existingLoginState) {
+                            const envPreparation = await prepareAuthEnvironment({
+                                server,
+                                cloudBaseOptions,
+                                loginState: existingLoginState,
+                            });
+                            return (0, tool_result_js_1.buildJsonToolResult)({
+                                ok: true,
+                                code: "AUTH_READY",
+                                message: envPreparation.message,
+                                auth_challenge: authChallenge(),
+                                ...buildAuthEnvSetupPayload(envPreparation),
+                                next_step: envPreparation.nextStep,
+                            });
+                        }
+                    }
+                    catch {
+                        // 忽略 getLoginState 错误，继续尝试发起登录
                     }
-                    catch (err) {
-                        const message = err instanceof Error ? err.message : String(err ?? "unknown error");
+                    const validationError = (0, auth_js_1.getAuthConfigValidationError)(resolvedAuthOptions);
+                    if (validationError) {
                         return (0, tool_result_js_1.buildJsonToolResult)({
                             ok: false,
-                            code: "AUTH_REQUIRED",
-                            message: `设备码登录初始化失败: ${message}`,
+                            code: "INVALID_ARGS",
+                            message: validationError,
+                            auth_config: authConfigSummary,
                             next_step: (0, tool_result_js_1.buildAuthNextStep)("start_auth", {
                                 suggestedArgs: { action: "start_auth", authMode: "device" },
                             }),
                         });
                     }
-                    if (!deviceAuthInfo) {
+                    // 2. 设备码模式：监听到 device code 即返回 AUTH_PENDING，后续由 toolbox 异步轮询并更新本地 credential
+                    const effectiveMode = resolvedAuthOptions.authMode;
+                    if (effectiveMode === "device") {
+                        let resolveCode;
+                        let rejectCode;
+                        const codeReady = new Promise((resolve, reject) => {
+                            resolveCode = resolve;
+                            rejectCode = reject;
+                        });
+                        const deviceOnCode = (info) => {
+                            onDeviceCode(info);
+                            if (resolveCode) {
+                                resolveCode();
+                            }
+                        };
+                        try {
+                            // 启动 Device Flow，全流程由 toolbox 负责轮询和写入 credential，这里不等待完成
+                            auth
+                                .loginByWebAuth({
+                                flow: "device",
+                                ...(resolvedAuthOptions.clientId
+                                    ? { client_id: resolvedAuthOptions.clientId }
+                                    : {}),
+                                ...(resolvedAuthOptions.oauthEndpoint
+                                    ? { getOAuthEndpoint: () => resolvedAuthOptions.oauthEndpoint }
+                                    : {}),
+                                ...(resolvedAuthOptions.oauthCustom
+                                    ? { custom: true }
+                                    : {}),
+                                onDeviceCode: deviceOnCode,
+                            })
+                                .then(() => {
+                                (0, auth_js_1.resolveAuthProgressState)();
+                            })
+                                .catch((err) => {
+                                (0, auth_js_1.rejectAuthProgressState)(err);
+                                // 如果在拿到 device code 之前就失败，则唤醒当前调用并返回错误
+                                if (!deviceAuthInfo && rejectCode) {
+                                    rejectCode(err);
+                                }
+                            });
+                        }
+                        catch (err) {
+                            if (rejectCode) {
+                                rejectCode(err);
+                            }
+                        }
+                        try {
+                            await codeReady;
+                        }
+                        catch (err) {
+                            const message = err instanceof Error ? err.message : String(err ?? "unknown error");
+                            return (0, tool_result_js_1.buildJsonToolResult)({
+                                ok: false,
+                                code: "AUTH_REQUIRED",
+                                message: `设备码登录初始化失败: ${message}`,
+                                next_step: (0, tool_result_js_1.buildAuthNextStep)("start_auth", {
+                                    suggestedArgs: { action: "start_auth", authMode: "device" },
+                                }),
+                            });
+                        }
+                        if (!deviceAuthInfo) {
+                            return (0, tool_result_js_1.buildJsonToolResult)({
+                                ok: false,
+                                code: "AUTH_REQUIRED",
+                                message: "未获取到设备码信息，请重试设备码登录",
+                                next_step: (0, tool_result_js_1.buildAuthNextStep)("start_auth", {
+                                    suggestedArgs: { action: "start_auth", authMode: "device" },
+                                }),
+                            });
+                        }
+                        const envCandidates = await fetchAvailableEnvCandidates(cloudBaseOptions, server);
+                        return (0, tool_result_js_1.buildJsonToolResult)({
+                            ok: true,
+                            code: "AUTH_PENDING",
+                            message: "已发起设备码登录，请在浏览器中打开 verification_uri 并输入 user_code 完成授权。授权完成后请再次调用 auth(action=\"status\")。",
+                            auth_challenge: authChallenge(),
+                            ...buildEnvCandidatePayload(envCandidates),
+                            next_step: (0, tool_result_js_1.buildAuthNextStep)("status", {
+                                suggestedArgs: { action: "status" },
+                            }),
+                        });
+                    }
+                    // 3. 非 Device Flow（显式 web 模式）仍然使用 getLoginState 阻塞等待
+                    const loginState = await (0, auth_js_1.ensureLogin)({
+                        region,
+                        authMode: effectiveMode,
+                        clientId: resolvedAuthOptions.clientId,
+                        oauthEndpoint: resolvedAuthOptions.oauthEndpoint,
+                        oauthCustom: resolvedAuthOptions.oauthCustom,
+                    });
+                    if (!loginState) {
                         return (0, tool_result_js_1.buildJsonToolResult)({
                             ok: false,
                             code: "AUTH_REQUIRED",
-                            message: "未获取到设备码信息，请重试设备码登录",
+                            message: "未获取到登录态，请先完成认证",
                             next_step: (0, tool_result_js_1.buildAuthNextStep)("start_auth", {
-                                suggestedArgs: { action: "start_auth", authMode: "device" },
+                                suggestedArgs: { action: "start_auth", authMode: effectiveMode },
                             }),
                         });
                     }
-                    const envCandidates = await fetchAvailableEnvCandidates(cloudBaseOptions, server);
+                    const envPreparation = await prepareAuthEnvironment({
+                        server,
+                        cloudBaseOptions,
+                        loginState,
+                    });
                     return (0, tool_result_js_1.buildJsonToolResult)({
                         ok: true,
-                        code: "AUTH_PENDING",
-                        message: "已发起设备码登录，请在浏览器中打开 verification_uri 并输入 user_code 完成授权。授权完成后请再次调用 auth(action=\"status\")。",
+                        code: "AUTH_READY",
+                        message: envPreparation.message,
                         auth_challenge: authChallenge(),
-                        ...buildEnvCandidatePayload(envCandidates),
-                        next_step: (0, tool_result_js_1.buildAuthNextStep)("status", {
-                            suggestedArgs: { action: "status" },
-                        }),
-                    });
-                }
-                // 3. 非 Device Flow（显式 web 模式）仍然使用 getLoginState 阻塞等待
-                const loginState = await (0, auth_js_1.ensureLogin)({
-                    region,
-                    authMode: effectiveMode,
-                    clientId: resolvedAuthOptions.clientId,
-                    oauthEndpoint: resolvedAuthOptions.oauthEndpoint,
-                    oauthCustom: resolvedAuthOptions.oauthCustom,
-                });
-                if (!loginState) {
-                    return (0, tool_result_js_1.buildJsonToolResult)({
-                        ok: false,
-                        code: "AUTH_REQUIRED",
-                        message: "未获取到登录态，请先完成认证",
-                        next_step: (0, tool_result_js_1.buildAuthNextStep)("start_auth", {
-                            suggestedArgs: { action: "start_auth", authMode: effectiveMode },
-                        }),
+                        ...buildAuthEnvSetupPayload(envPreparation),
+                        next_step: envPreparation.nextStep,
                     });
                 }
-                const envPreparation = await prepareAuthEnvironment({
-                    server,
-                    cloudBaseOptions,
-                    loginState,
-                });
-                return (0, tool_result_js_1.buildJsonToolResult)({
-                    ok: true,
-                    code: "AUTH_READY",
-                    message: envPreparation.message,
-                    auth_challenge: authChallenge(),
-                    ...buildAuthEnvSetupPayload(envPreparation),
-                    next_step: envPreparation.nextStep,
-                });
-            }
-            if (action === "set_env") {
-                const loginState = await (0, auth_js_1.peekLoginState)();
-                if (!loginState) {
+                if (action === "set_env") {
+                    const loginState = await (0, auth_js_1.peekLoginState)();
+                    if (!loginState) {
+                        return (0, tool_result_js_1.buildJsonToolResult)({
+                            ok: false,
+                            code: "AUTH_REQUIRED",
+                            message: isCodeBuddyIde(server)
+                                ? "当前未登录。CodeBuddy 暂不支持在 tool 内发起认证，请在外部完成认证后再次调用 auth(action=\"status\")。"
+                                : "当前未登录，请先执行 auth(action=\"start_auth\")。",
+                            next_step: buildAuthRequiredNextStep(server),
+                        });
+                    }
+                    const envCandidates = await fetchAvailableEnvCandidates(cloudBaseOptions, server);
+                    if (!envId) {
+                        return (0, tool_result_js_1.buildJsonToolResult)({
+                            ok: false,
+                            code: "INVALID_ARGS",
+                            message: "action=set_env 时必须提供 envId",
+                            ...buildEnvCandidatePayload(envCandidates),
+                            next_step: buildSetEnvNextStep(envCandidates),
+                        });
+                    }
+                    const target = envCandidates.find((item) => item.envId === envId);
+                    if (envCandidates.length > 0 && !target) {
+                        return (0, tool_result_js_1.buildJsonToolResult)({
+                            ok: false,
+                            code: "INVALID_ARGS",
+                            message: `未找到环境: ${envId}`,
+                            ...buildEnvCandidatePayload(envCandidates),
+                            next_step: buildSetEnvNextStep(envCandidates),
+                        });
+                    }
+                    await cloudbase_manager_js_1.envManager.setEnvId(envId);
                     return (0, tool_result_js_1.buildJsonToolResult)({
-                        ok: false,
-                        code: "AUTH_REQUIRED",
-                        message: isCodeBuddyIde(server)
-                            ? "当前未登录。CodeBuddy 暂不支持在 tool 内发起认证，请在外部完成认证后再次调用 auth(action=\"status\")。"
-                            : "当前未登录，请先执行 auth(action=\"start_auth\")。",
-                        next_step: buildAuthRequiredNextStep(server),
+                        ok: true,
+                        code: "ENV_READY",
+                        message: `环境设置成功，当前环境: ${envId}`,
+                        current_env_id: envId,
                     });
                 }
-                const envCandidates = await fetchAvailableEnvCandidates(cloudBaseOptions, server);
-                if (!envId) {
+                if (action === "logout") {
+                    // API Key 模式下不允许 logout
+                    if (process.env.CLOUDBASE_API_KEY && process.env.CLOUDBASE_ENV_ID) {
+                        return (0, tool_result_js_1.buildJsonToolResult)({
+                            ok: false,
+                            code: "LOGOUT_NOT_ALLOWED",
+                            message: "当前使用 API Key 认证模式，不支持退出登录。如需切换认证方式，请移除 CLOUDBASE_API_KEY 环境变量后重启。",
+                            auth_mode: "api_key",
+                        });
+                    }
+                    if (confirm !== "yes") {
+                        return (0, tool_result_js_1.buildJsonToolResult)({
+                            ok: false,
+                            code: "INVALID_ARGS",
+                            message: "action=logout 时必须传 confirm=\"yes\"",
+                            next_step: (0, tool_result_js_1.buildAuthNextStep)("logout", {
+                                suggestedArgs: { action: "logout", confirm: "yes" },
+                            }),
+                        });
+                    }
+                    await (0, auth_js_1.logout)();
+                    (0, cloudbase_manager_js_1.resetCloudBaseManagerCache)();
                     return (0, tool_result_js_1.buildJsonToolResult)({
-                        ok: false,
-                        code: "INVALID_ARGS",
-                        message: "action=set_env 时必须提供 envId",
-                        ...buildEnvCandidatePayload(envCandidates),
-                        next_step: buildSetEnvNextStep(envCandidates),
+                        ok: true,
+                        code: "LOGGED_OUT",
+                        message: "✅ 已退出登录",
                     });
                 }
-                const target = envCandidates.find((item) => item.envId === envId);
-                if (envCandidates.length > 0 && !target) {
+                if (action === "get_temp_credentials") {
+                    const loginState = (await (0, auth_js_1.peekLoginState)());
+                    if (!loginState) {
+                        return (0, tool_result_js_1.buildJsonToolResult)({
+                            ok: false,
+                            code: "AUTH_REQUIRED",
+                            message: "当前未登录，请先完成管理端认证后再获取临时密钥。",
+                            next_step: buildAuthRequiredNextStep(server),
+                        });
+                    }
+                    if (confirm !== "yes") {
+                        return (0, tool_result_js_1.buildJsonToolResult)({
+                            ok: false,
+                            code: "INVALID_ARGS",
+                            message: "action=get_temp_credentials 时必须显式传 confirm=\"yes\"，以确认你要导出当前管理端临时密钥。",
+                            next_step: (0, tool_result_js_1.buildAuthNextStep)("get_temp_credentials", {
+                                suggestedArgs: { action: "get_temp_credentials", confirm: "yes" },
+                            }),
+                        });
+                    }
+                    if (!isTemporaryCredentialLoginState(loginState)) {
+                        return (0, tool_result_js_1.buildJsonToolResult)({
+                            ok: false,
+                            code: "UNSUPPORTED_CREDENTIAL_TYPE",
+                            message: "当前登录态不是可导出的临时密钥。仅支持通过 Web / device 登录得到的临时密钥，永久密钥登录不允许导出。",
+                        });
+                    }
+                    const secretId = normalizeOptionalToolString(loginState.secretId);
+                    const secretKey = normalizeOptionalToolString(loginState.secretKey);
+                    const token = normalizeOptionalToolString(loginState.token);
+                    if (!secretId || !secretKey || !token) {
+                        return (0, tool_result_js_1.buildJsonToolResult)({
+                            ok: false,
+                            code: "INTERNAL_ERROR",
+                            message: "当前登录态缺少完整的临时密钥字段，请重新登录后再试。",
+                        });
+                    }
                     return (0, tool_result_js_1.buildJsonToolResult)({
-                        ok: false,
-                        code: "INVALID_ARGS",
-                        message: `未找到环境: ${envId}`,
-                        ...buildEnvCandidatePayload(envCandidates),
-                        next_step: buildSetEnvNextStep(envCandidates),
+                        ok: true,
+                        code: "TEMP_CREDENTIALS_READY",
+                        message: reveal
+                            ? "当前管理端临时密钥已准备好，请注意避免泄露。"
+                            : "当前管理端临时密钥已准备好，默认仅返回脱敏结果。",
+                        env_id: normalizeOptionalToolString(loginState.envId) ?? null,
+                        credentials: {
+                            secretId: reveal ? secretId : maskSensitiveValue(secretId),
+                            secretKey: reveal ? secretKey : maskSensitiveValue(secretKey),
+                            token: reveal ? token : maskSensitiveValue(token),
+                            masked: !reveal,
+                        },
                     });
                 }
-                await cloudbase_manager_js_1.envManager.setEnvId(envId);
                 return (0, tool_result_js_1.buildJsonToolResult)({
-                    ok: true,
-                    code: "ENV_READY",
-                    message: `环境设置成功，当前环境: ${envId}`,
-                    current_env_id: envId,
+                    ok: false,
+                    code: "NOT_SUPPORTED",
+                    message: `不支持的 auth action: ${action}`,
+                    next_step: (0, tool_result_js_1.buildAuthNextStep)("status", {
+                        suggestedArgs: { action: "status" },
+                    }),
                 });
             }
-            if (action === "logout") {
-                // API Key 模式下不允许 logout
-                if (process.env.CLOUDBASE_API_KEY && process.env.CLOUDBASE_ENV_ID) {
-                    return (0, tool_result_js_1.buildJsonToolResult)({
-                        ok: false,
-                        code: "LOGOUT_NOT_ALLOWED",
-                        message: "当前使用 API Key 认证模式，不支持退出登录。如需切换认证方式，请移除 CLOUDBASE_API_KEY 环境变量后重启。",
-                        auth_mode: "api_key",
-                    });
-                }
-                if (confirm !== "yes") {
-                    return (0, tool_result_js_1.buildJsonToolResult)({
-                        ok: false,
-                        code: "INVALID_ARGS",
-                        message: "action=logout 时必须传 confirm=\"yes\"",
-                        next_step: (0, tool_result_js_1.buildAuthNextStep)("logout", {
-                            suggestedArgs: { action: "logout", confirm: "yes" },
-                        }),
-                    });
-                }
-                await (0, auth_js_1.logout)();
-                (0, cloudbase_manager_js_1.resetCloudBaseManagerCache)();
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
                 return (0, tool_result_js_1.buildJsonToolResult)({
-                    ok: true,
-                    code: "LOGGED_OUT",
-                    message: "✅ 已退出登录",
+                    ok: false,
+                    code: "INTERNAL_ERROR",
+                    message: `auth 执行失败: ${message}`,
+                    auth_challenge: authChallenge(),
+                    next_step: (0, tool_result_js_1.buildAuthNextStep)("status", {
+                        suggestedArgs: { action: "status" },
+                    }),
                 });
             }
-            if (action === "get_temp_credentials") {
-                const loginState = (await (0, auth_js_1.peekLoginState)());
-                if (!loginState) {
-                    return (0, tool_result_js_1.buildJsonToolResult)({
-                        ok: false,
-                        code: "AUTH_REQUIRED",
-                        message: "当前未登录，请先完成管理端认证后再获取临时密钥。",
-                        next_step: buildAuthRequiredNextStep(server),
-                    });
-                }
-                if (confirm !== "yes") {
-                    return (0, tool_result_js_1.buildJsonToolResult)({
-                        ok: false,
-                        code: "INVALID_ARGS",
-                        message: "action=get_temp_credentials 时必须显式传 confirm=\"yes\"，以确认你要导出当前管理端临时密钥。",
-                        next_step: (0, tool_result_js_1.buildAuthNextStep)("get_temp_credentials", {
-                            suggestedArgs: { action: "get_temp_credentials", confirm: "yes" },
-                        }),
-                    });
-                }
-                if (!isTemporaryCredentialLoginState(loginState)) {
-                    return (0, tool_result_js_1.buildJsonToolResult)({
-                        ok: false,
-                        code: "UNSUPPORTED_CREDENTIAL_TYPE",
-                        message: "当前登录态不是可导出的临时密钥。仅支持通过 Web / device 登录得到的临时密钥，永久密钥登录不允许导出。",
-                    });
-                }
-                const secretId = normalizeOptionalToolString(loginState.secretId);
-                const secretKey = normalizeOptionalToolString(loginState.secretKey);
-                const token = normalizeOptionalToolString(loginState.token);
-                if (!secretId || !secretKey || !token) {
-                    return (0, tool_result_js_1.buildJsonToolResult)({
-                        ok: false,
-                        code: "INTERNAL_ERROR",
-                        message: "当前登录态缺少完整的临时密钥字段，请重新登录后再试。",
-                    });
-                }
-                return (0, tool_result_js_1.buildJsonToolResult)({
-                    ok: true,
-                    code: "TEMP_CREDENTIALS_READY",
-                    message: reveal
-                        ? "当前管理端临时密钥已准备好，请注意避免泄露。"
-                        : "当前管理端临时密钥已准备好，默认仅返回脱敏结果。",
-                    env_id: normalizeOptionalToolString(loginState.envId) ?? null,
-                    credentials: {
-                        secretId: reveal ? secretId : maskSensitiveValue(secretId),
-                        secretKey: reveal ? secretKey : maskSensitiveValue(secretKey),
-                        token: reveal ? token : maskSensitiveValue(token),
-                        masked: !reveal,
-                    },
-                });
-            }
-            return (0, tool_result_js_1.buildJsonToolResult)({
-                ok: false,
-                code: "NOT_SUPPORTED",
-                message: `不支持的 auth action: ${action}`,
-                next_step: (0, tool_result_js_1.buildAuthNextStep)("status", {
-                    suggestedArgs: { action: "status" },
-                }),
-            });
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            return (0, tool_result_js_1.buildJsonToolResult)({
-                ok: false,
-                code: "INTERNAL_ERROR",
-                message: `auth 执行失败: ${message}`,
-                auth_challenge: authChallenge(),
-                next_step: (0, tool_result_js_1.buildAuthNextStep)("status", {
-                    suggestedArgs: { action: "status" },
-                }),
-            });
-        }
-    });
-    // envQuery - 环境查询（合并 listEnvs + getEnvInfo + getEnvAuthDomains）
-    server.registerTool?.("envQuery", {
-        title: "CloudBase 环境查询",
-        description: "查询 CloudBase 环境相关信息，支持查询环境列表、指定环境详情和安全域名。（原工具名：listEnvs/getEnvInfo/getEnvAuthDomains，为兼容旧AI规则可继续使用这些名称）当 action=list 时，会按 DescribeEnvs 语义做列表/筛选，标准返回字段为 EnvId、Alias、Status、EnvType、Region、PackageId、PackageName、IsDefault，并支持通过 fields 白名单裁剪这些字段；aliasExact=true 时会按别名精确筛选，避免把前缀相近的环境误当作候选；即使传入 envId，action=list 也只返回摘要，不会返回完整资源明细或 expiry。如需查询某个已知 EnvId 对应环境的详细信息（包括资源字段和计费信息），必须使用 action=info 并传入目标环境的 envId 参数。action=info 会在可用时补充 BillingInfo（如 ExpireTime、PayMode、IsAutoRenew 等计费字段）。",
-        inputSchema: {
-            action: zod_1.z
-                .enum(["list", "info", "domains"])
-                .describe("查询类型：list=环境列表/摘要筛选（按 DescribeEnvs 语义筛选，支持通过 envId 筛选，返回 EnvId、Alias、Status、EnvType、Region、PackageId、PackageName、IsDefault，不支持 expiry），info=指定环境的详细信息（必须传入 envId，返回资源字段和计费信息），domains=安全域名列表"),
-            alias: zod_1.z.string().optional().describe("按环境别名筛选。action=list 时可选"),
-            aliasExact: zod_1.z.boolean().optional().describe("按环境别名精确筛选。action=list 时可选；与 alias 配合使用"),
-            envId: zod_1.z.string().optional().describe("按环境 ID 筛选。action=list 时可选（仅按 DescribeEnvs 语义做筛选，仍返回摘要）；action=info 时必填（返回该环境的详细信息，包含资源字段和计费信息）。如果任务已经给出了明确的 EnvId 并要求查询详情，请直接使用 action=info + envId，而不是 action=list"),
-            limit: zod_1.z.number().int().positive().optional().describe("返回数量上限。action=list 时可选"),
-            offset: zod_1.z.number().int().min(0).optional().describe("分页偏移。action=list 时可选"),
-            fields: zod_1.z
-                .array(zod_1.z.enum(DEFAULT_ENV_FIELDS))
-                .optional()
-                .describe("返回字段白名单。仅支持 EnvId、Alias、Status、EnvType、Region、PackageId、PackageName、IsDefault。action=list 时可选"),
-        },
-        annotations: {
-            readOnlyHint: true,
-            openWorldHint: true,
-            category: "env",
-        },
-    }, async ({ action, alias, aliasExact, envId, limit, offset, fields, }) => {
+        });
+    } // end: wxide guard for auth tool
+    // queryEnv - 环境查询（合并 listEnvs + getEnvInfo + getEnvAuthDomains）
+    const queryEnvHandler = async ({ action, alias, aliasExact, envId, limit, offset, fields, }) => {
         try {
             let result;
             switch (action) {
@@ -1158,7 +1250,8 @@ function registerEnvTools(server) {
                         // 当环境变量设置了 CLOUDBASE_ENV_ID 时（如 API Key 模式），
                         // 避免调用 DescribeEnvs（临时密钥可能不支持该接口），
                         // 改为通过 DescribeEnvInfo 获取单环境信息
-                        const envIdFromEnv = process.env.CLOUDBASE_ENV_ID;
+                        // 注意：requestFn 模式（如微信 IDE）使用 DescribeEnvs，不走此分支
+                        const envIdFromEnv = !cloudBaseOptions?.requestFn && process.env.CLOUDBASE_ENV_ID;
                         if (envIdFromEnv) {
                             try {
                                 const envInfo = await cloudbaseList.env.describeEnvInfo({ EnvId: envIdFromEnv });
@@ -1262,6 +1355,7 @@ function registerEnvTools(server) {
                         envId,
                         logger: server.logger,
                     });
+                    result = enrichEnvInfoWithRuntimeMode(result);
                     break;
                 case "domains":
                     const cloudbaseDomains = await getManager();
@@ -1325,61 +1419,91 @@ function registerEnvTools(server) {
                 ],
             };
         }
-    });
-    // envDomainManagement - 环境域名管理（合并 createEnvDomain + deleteEnvDomain）
-    server.registerTool?.("envDomainManagement", {
-        title: "CloudBase 环境域名管理（安全域名 / CORS 白名单）",
-        description: "管理 CloudBase 环境的安全域名（安全域名 / CORS 白名单），支持添加和删除操作。（原工具名：createEnvDomain/deleteEnvDomain，为兼容旧AI规则可继续使用这些名称）当浏览器 Web 应用需要从本地 Vite / dev server 直接访问 CloudBase 资源时，应先用 envQuery(action=domains) 检查当前实际浏览器 origin 对应的 host:port 是否已在白名单中，再按该实际值添加。新增或删除后通常需要继续轮询 envQuery(action=domains) 确认状态收敛；安全域名一般约 10 分钟生效。⚠️ 重要：此工具仅用于 CORS/请求来源验证，不涉及 SSL 证书。如需绑定自定义域名供公网 HTTPS 访问，请使用 manageGateway(action=\"bindCustomDomain\")。",
+    };
+    // Register primary tool name (queryEnv)
+    const queryEnvToolSchema = {
+        title: "CloudBase 环境查询",
+        description: "查询 CloudBase 环境相关信息，支持查询环境列表、指定环境详情和安全域名。（曾用名：envQuery、listEnvs、getEnvInfo、getEnvAuthDomains）当 action=list 时，会按 DescribeEnvs 语义做列表/筛选，标准返回字段为 EnvId、Alias、Status、EnvType、Region、PackageId、PackageName、IsDefault，并支持通过 fields 白名单裁剪这些字段；aliasExact=true 时会按别名精确筛选，避免把前缀相近的环境误当作候选；即使传入 envId，action=list 也只返回摘要，不会返回完整资源明细或 expiry。如需查询某个已知 EnvId 对应环境的详细信息（包括资源字段和计费信息），必须使用 action=info 并传入目标环境的 envId 参数。action=info 会在可用时补充 BillingInfo（如 ExpireTime、PayMode、IsAutoRenew 等计费字段）。\n\n🔍 action=info 还会派生三个用于后端选型的字段：\n- `EnvInfo.RuntimeMode`：'postgresql' 或 'nosql'，表示新业务建议默认使用的后端（PG 已开通时为 postgresql，否则为 nosql）。\n- `EnvInfo.RuntimeBackends`：`{postgresql, nosql, mysql}` 三个布尔值，描述当前环境实际并存的后端。\n- `EnvInfo.RuntimeModeHints`：每个后端对应的 API/工具/skill 提示。\n\nAI 在写业务/权限/存储代码前必须先看这三项：PG 模式下新业务推荐 `app.rdb()` + RLS（`managePgDatabase action=execute` 跑 `CREATE POLICY`）+ pgstore；已存在的 NoSQL 集合 / 旧 storage / `managePermissions(resourceType=\"noSqlDatabase\")` 在 PG 环境下仍然有效。真正不适用的是 MySQL：当 `RuntimeBackends.mysql === false` 时，`manageSqlDatabase` / `querySqlDatabase` / `relational-database-tool` skill 都不该使用。",
         inputSchema: {
             action: zod_1.z
-                .enum(["create", "delete"])
-                .describe("操作类型：create=添加安全域名，delete=删除安全域名"),
-            domains: zod_1.z.array(zod_1.z.string()).describe("安全域名数组（格式：host:port，例如 localhost:5173 或 127.0.0.1:4173）。注意：不是自定义域名，不需要证书。"),
+                .enum(["list", "info", "domains"])
+                .describe("查询类型：list=环境列表/摘要筛选（按 DescribeEnvs 语义筛选，支持通过 envId 筛选，返回 EnvId、Alias、Status、EnvType、Region、PackageId、PackageName、IsDefault，不支持 expiry），info=指定环境的详细信息（必须传入 envId，返回资源字段和计费信息），domains=安全域名列表"),
+            alias: zod_1.z.string().optional().describe("按环境别名筛选。action=list 时可选"),
+            aliasExact: zod_1.z.boolean().optional().describe("按环境别名精确筛选。action=list 时可选；与 alias 配合使用"),
+            envId: zod_1.z.string().optional().describe("按环境 ID 筛选。action=list 时可选（仅按 DescribeEnvs 语义做筛选，仍返回摘要）；action=info 时必填（返回该环境的详细信息，包含资源字段和计费信息）。如果任务已经给出了明确的 EnvId 并要求查询详情，请直接使用 action=info + envId，而不是 action=list"),
+            limit: zod_1.z.number().int().positive().optional().describe("返回数量上限。action=list 时可选"),
+            offset: zod_1.z.number().int().min(0).optional().describe("分页偏移。action=list 时可选"),
+            fields: zod_1.z
+                .array(zod_1.z.enum(DEFAULT_ENV_FIELDS))
+                .optional()
+                .describe("返回字段白名单。仅支持 EnvId、Alias、Status、EnvType、Region、PackageId、PackageName、IsDefault。action=list 时可选"),
         },
         annotations: {
-            readOnlyHint: false,
-            destructiveHint: false, // 注意：delete操作虽然是破坏性的，但这里采用较宽松的标注
-            idempotentHint: false,
+            readOnlyHint: true,
             openWorldHint: true,
             category: "env",
         },
-    }, async ({ action, domains, }) => {
-        try {
-            const cloudbase = await getManager();
-            let result;
-            switch (action) {
-                case "create":
-                    result = await cloudbase.env.createEnvDomain(domains);
-                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-                    break;
-                case "delete":
-                    result = await cloudbase.env.deleteEnvDomain(domains);
-                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-                    break;
-                default:
-                    throw new Error(`不支持的操作类型: ${action}`);
+    };
+    server.registerTool?.("queryEnv", queryEnvToolSchema, queryEnvHandler);
+    // 向后兼容：envQuery 作为 queryEnv 的别名注册
+    server.registerTool?.("envQuery", queryEnvToolSchema, queryEnvHandler);
+    // envDomainManagement - 环境域名管理（合并 createEnvDomain + deleteEnvDomain）
+    // 微信 IDE 场景不需要域名管理
+    if (server.ide !== 'wxide') {
+        server.registerTool?.("envDomainManagement", {
+            title: "CloudBase 环境域名管理（安全域名 / CORS 白名单）",
+            description: "管理 CloudBase 环境的安全域名（安全域名 / CORS 白名单），支持添加和删除操作。（原工具名：createEnvDomain/deleteEnvDomain，为兼容旧AI规则可继续使用这些名称）当浏览器 Web 应用需要从本地 Vite / dev server 直接访问 CloudBase 资源时，应先用 queryEnv(action=domains) 检查当前实际浏览器 origin 对应的 host:port 是否已在白名单中，再按该实际值添加。新增或删除后通常需要继续轮询 queryEnv(action=domains) 确认状态收敛；安全域名一般约 10 分钟生效。⚠️ 重要：此工具仅用于 CORS/请求来源验证，不涉及 SSL 证书。如需绑定自定义域名供公网 HTTPS 访问，请使用 manageGateway(action=\"bindCustomDomain\")。",
+            inputSchema: {
+                action: zod_1.z
+                    .enum(["create", "delete"])
+                    .describe("操作类型：create=添加安全域名，delete=删除安全域名"),
+                domains: zod_1.z.array(zod_1.z.string()).describe("安全域名数组（格式：host:port，例如 localhost:5173 或 127.0.0.1:4173）。注意：不是自定义域名，不需要证书。"),
+            },
+            annotations: {
+                readOnlyHint: false,
+                destructiveHint: false, // 注意：delete操作虽然是破坏性的，但这里采用较宽松的标注
+                idempotentHint: false,
+                openWorldHint: true,
+                category: "env",
+            },
+        }, async ({ action, domains, }) => {
+            try {
+                const cloudbase = await getManager();
+                let result;
+                switch (action) {
+                    case "create":
+                        result = await cloudbase.env.createEnvDomain(domains);
+                        (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                        break;
+                    case "delete":
+                        result = await cloudbase.env.deleteEnvDomain(domains);
+                        (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                        break;
+                    default:
+                        throw new Error(`不支持的操作类型: ${action}`);
+                }
+                return (0, tool_result_js_1.buildJsonToolResult)(buildEnvDomainManagementResult({
+                    action,
+                    domains,
+                    result,
+                }));
             }
-            return (0, tool_result_js_1.buildJsonToolResult)(buildEnvDomainManagementResult({
-                action,
-                domains,
-                result,
-            }));
-        }
-        catch (error) {
-            const toolPayloadResult = (0, tool_result_js_1.toolPayloadErrorToResult)(error);
-            if (toolPayloadResult) {
-                return toolPayloadResult;
+            catch (error) {
+                const toolPayloadResult = (0, tool_result_js_1.toolPayloadErrorToResult)(error);
+                if (toolPayloadResult) {
+                    return toolPayloadResult;
+                }
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `域名管理操作失败: ${error instanceof Error ? error.message : String(error)}`,
+                        },
+                    ],
+                };
             }
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `域名管理操作失败: ${error instanceof Error ? error.message : String(error)}`,
-                    },
-                ],
-            };
-        }
-    });
+        });
+    } // end: wxide guard for envDomainManagement
 }
 
 
@@ -1703,7 +1827,7 @@ ${envIdSection}
 ## 环境信息
 - 操作系统: ${os_1.default.type()} ${os_1.default.release()}
 - Node.js版本: ${process.version}
-- MCP 版本：${process.env.npm_package_version || "2.21.1" || 0}
+- MCP 版本：${process.env.npm_package_version || "2.22.0-beta.0" || 0}
 - 系统架构: ${os_1.default.arch()}
 - 时间: ${new Date().toISOString()}
 - 请求ID: ${requestId}
@@ -1784,7 +1908,7 @@ function createWrappedHandler(name, handler, server) {
                 requestId: (typeof error === 'object' && error && 'requestId' in error) ? error.requestId : '',
                 ide: server.ide || process.env.INTEGRATION_IDE || ''
             });
-            const mcpVersion =  true ? "2.21.1" : 0;
+            const mcpVersion =  true ? "2.22.0-beta.0" : 0;
             const requestIdSuffix = requestId ? `\n🆔 RequestId: ${requestId}` : '';
             const enhancedErrorMessage = `${errorMessage}${requestIdSuffix}\n\n📦 CloudBase MCP v${mcpVersion}\n🔗 遇到问题？请复制以下链接到浏览器打开\n即可自动携带错误详情快速创建 GitHub Issue：\n${issueLink}`;
             // 创建新的错误对象，保持原有的错误类型但更新消息
@@ -1936,6 +2060,7 @@ exports.createCloudBaseMcpServer = createCloudBaseMcpServer;
 exports.getDefaultServer = getDefaultServer;
 const mcp_js_1 = __webpack_require__(4619);
 const databaseNoSQL_js_1 = __webpack_require__(3903);
+const databasePG_js_1 = __webpack_require__(6473);
 const databaseSQL_js_1 = __webpack_require__(9782);
 const download_js_1 = __webpack_require__(9097);
 const env_js_1 = __webpack_require__(622);
@@ -1943,6 +2068,7 @@ const functions_js_1 = __webpack_require__(5936);
 const hosting_js_1 = __webpack_require__(7279);
 const rag_js_1 = __webpack_require__(4215);
 const setup_js_1 = __webpack_require__(6556);
+const storagePG_js_1 = __webpack_require__(9189);
 const storage_js_1 = __webpack_require__(4848);
 // import { registerMiniprogramTools } from "./tools/miniprogram.js";
 const types_js_1 = __webpack_require__(2344);
@@ -1965,6 +2091,8 @@ const tool_wrapper_js_1 = __webpack_require__(1363);
 const DEFAULT_PLUGINS = [
     "env",
     "database",
+    "pg_database",
+    "pg_storage",
     "functions",
     "hosting",
     "storage",
@@ -1987,13 +2115,31 @@ function registerDatabase(server) {
     if (!(0, tencent_cloud_js_1.isInternationalRegion)(region)) {
         (0, databaseNoSQL_js_1.registerDatabaseTools)(server);
     }
-    (0, databaseSQL_js_1.registerSQLDatabaseTools)(server);
+    const pgPluginEnabled = server.enabledPlugins?.some((pluginName) => pluginName === "pg_database" || pluginName === "pg_storage");
+    if (!pgPluginEnabled) {
+        (0, databaseSQL_js_1.registerSQLDatabaseTools)(server);
+    }
     (0, dataModel_js_1.registerDataModelTools)(server);
 }
+function registerMysqlDatabase(server) {
+    (0, databaseSQL_js_1.registerSQLDatabaseTools)(server);
+}
+function registerNoSQLDatabase(server) {
+    const region = server.cloudBaseOptions?.region || process.env.TCB_REGION;
+    if (!(0, tencent_cloud_js_1.isInternationalRegion)(region)) {
+        (0, databaseNoSQL_js_1.registerDatabaseTools)(server);
+    }
+}
 // 可用插件映射
 const AVAILABLE_PLUGINS = {
     env: { name: "env", register: env_js_1.registerEnvTools },
     database: { name: "database", register: registerDatabase },
+    mysql_database: { name: "mysql_database", register: registerMysqlDatabase },
+    pg_database: { name: "pg_database", register: databasePG_js_1.registerPGDatabaseTools },
+    pg_storage: { name: "pg_storage", register: storagePG_js_1.registerPGStorageTools },
+    "database-nosql": { name: "database-nosql", register: registerNoSQLDatabase },
+    "database-sql": { name: "database-sql", register: databaseSQL_js_1.registerSQLDatabaseTools },
+    "data-model": { name: "data-model", register: dataModel_js_1.registerDataModelTools },
     functions: { name: "functions", register: functions_js_1.registerFunctionTools },
     hosting: { name: "hosting", register: hosting_js_1.registerHostingTools },
     storage: { name: "storage", register: storage_js_1.registerStorageTools },
@@ -2017,6 +2163,9 @@ const PLUGIN_ALIASES = {
     "security-rules": "permissions",
     "secret-rule": "permissions",
     "secret-rules": "permissions",
+    mysql: "mysql_database",
+    "mysql-database": "mysql_database",
+    "sql-database": "mysql_database",
     users: "permissions",
 };
 function normalizePluginName(name) {
@@ -2081,7 +2230,7 @@ function parseEnabledPlugins(pluginsEnabled, pluginsDisabled) {
  * await server.connect(transport);
  */
 async function createCloudBaseMcpServer(options) {
-    const { name = "cloudbase-mcp", version = "1.0.0", enableTelemetry = true, cloudBaseOptions, authOptions, cloudMode = false, ide, logger, pluginsEnabled, pluginsDisabled, } = options ?? {};
+    const { name = "cloudbase-mcp", version = "1.0.0", enableTelemetry = true, cloudBaseOptions, authOptions, cloudMode = false, ide, logger, pluginsEnabled, pluginsDisabled, pluginOptions, } = options ?? {};
     // Enable cloud mode if specified
     if (cloudMode) {
         (0, cloud_mode_js_1.enableCloudMode)();
@@ -2096,20 +2245,31 @@ async function createCloudBaseMcpServer(options) {
             ...(ide === "CodeBuddy" ? { logging: {} } : {}),
         },
     });
+    // 初始化 toolDefs，用于外部提取工具列表（如微信 IDE）
+    server.toolDefs = [];
     const originalRegisterTool = server.registerTool.bind(server);
-    server.registerTool = ((name, meta, handler) => originalRegisterTool(name, meta, async (args) => {
-        try {
-            return await handler(args);
-        }
-        catch (error) {
-            if ((0, tool_result_js_1.isToolPayloadError)(error)) {
-                // 在结构化错误返回中注入 MCP 版本号
-                const payload = { ...error.payload, mcpVersion: version };
-                return (0, tool_result_js_1.buildJsonToolResult)(payload);
+    server.registerTool = ((name, meta, handler) => {
+        // 同步记录到 toolDefs
+        server.toolDefs.push({
+            name,
+            description: meta?.description ?? meta?.title ?? '',
+            inputSchema: meta?.inputSchema ?? {},
+            handler,
+        });
+        return originalRegisterTool(name, meta, async (args) => {
+            try {
+                return await handler(args);
             }
-            throw error;
-        }
-    }));
+            catch (error) {
+                if ((0, tool_result_js_1.isToolPayloadError)(error)) {
+                    // 在结构化错误返回中注入 MCP 版本号
+                    const payload = { ...error.payload, mcpVersion: version };
+                    return (0, tool_result_js_1.buildJsonToolResult)(payload);
+                }
+                throw error;
+            }
+        });
+    });
     // Only set logging handler if logging capability is declared
     if (ide === "CodeBuddy") {
         server.server.setRequestHandler(types_js_1.SetLevelRequestSchema, (request, extra) => {
@@ -2124,6 +2284,10 @@ async function createCloudBaseMcpServer(options) {
     if (authOptions) {
         server.authOptions = authOptions;
     }
+    // Store pluginOptions in server instance for plugins to access
+    if (pluginOptions) {
+        server.pluginOptions = pluginOptions;
+    }
     // Store ide in server instance for telemetry
     if (ide) {
         server.ide = ide;
@@ -2141,6 +2305,7 @@ async function createCloudBaseMcpServer(options) {
     }
     // Register plugins based on configuration
     const enabledPlugins = parseEnabledPlugins(pluginsEnabled, pluginsDisabled);
+    server.enabledPlugins = enabledPlugins;
     for (const pluginName of enabledPlugins) {
         const plugin = AVAILABLE_PLUGINS[pluginName];
         if (plugin) {
@@ -2231,8 +2396,8 @@ function registerLogTools(server) {
     const cloudBaseOptions = server.cloudBaseOptions;
     const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
     server.registerTool?.("queryLogs", {
-        title: "查询日志服务",
-        description: "日志域统一只读入口。支持检查日志服务状态并搜索 CLS 日志。" +
+        title: "查询 CloudBase 日志服务",
+        description: "CloudBase 日志域统一只读入口。支持检查日志服务状态并搜索 CLS 日志。" +
             "\n\n**重要区分**：" +
             "\n- 查询云函数日志：使用 `queryFunctions(action=\"listFunctionLogs\", functionName=\"xxx\")`" +
             "\n- 查询 CLS 日志（跨服务日志聚合）：使用本工具 `queryLogs(action=\"searchLogs\")`" +
@@ -3284,7 +3449,7 @@ if (shouldUseConsole()) {
         stderrLevels: ['error', 'warn', 'info', 'debug'], // All logs go to stderr
     }));
 }
-if (!(0, cloud_mode_js_1.isCloudMode)()) {
+if (!(0, cloud_mode_js_1.isCloudMode)() && process.env.CLOUDBASE_MCP_DISABLE_LOG_FILE !== 'true') {
     // File transport with daily rotation
     transports.push(new DailyRotateFile({
         dirname: logDir,
@@ -3703,8 +3868,9 @@ async function getDatabaseInstanceId(options) {
 async function getCloudBaseManager(options = {}) {
     const { requireEnvId = true, cloudBaseOptions, authStrategy = 'fail_fast', } = options;
     const hasDirectCredentials = !!(cloudBaseOptions?.secretId && cloudBaseOptions?.secretKey);
-    // 如果传入了完整凭据，优先使用显式 CloudBase 配置
-    if (cloudBaseOptions && hasDirectCredentials) {
+    const hasRequestFn = !!(cloudBaseOptions?.requestFn);
+    // 如果传入了完整凭据或 requestFn，优先使用显式 CloudBase 配置
+    if (cloudBaseOptions && (hasDirectCredentials || hasRequestFn)) {
         let resolvedEnvId = cloudBaseOptions.envId;
         if (requireEnvId && !resolvedEnvId) {
             const envCandidates = await listAvailableEnvCandidates({ cloudBaseOptions });
@@ -4018,6 +4184,13 @@ async function callNoSqlContentApi(options) {
             instanceIdSource: "envId",
             requestId: result?.RequestId,
         });
+        // 检查 API 层返回的业务错误（如集合不存在）并抛出
+        if (result?.Error) {
+            const err = new Error(`${result.Error.Code}: ${result.Error.Message}`);
+            err.code = result.Error.Code;
+            err.requestId = result.RequestId;
+            throw err;
+        }
         return result;
     }
     catch (error) {
@@ -4031,7 +4204,7 @@ async function callNoSqlContentApi(options) {
         throw error;
     }
 }
-async function waitForCollectionReady({ cloudbase, collectionName, logger, timeoutMs = COLLECTION_READY_TIMEOUT_MS, pollIntervalMs = COLLECTION_READY_POLL_INTERVAL_MS, }) {
+async function waitForCollectionReady({ cloudbase, collectionName, logger, cloudBaseOptions, timeoutMs = COLLECTION_READY_TIMEOUT_MS, pollIntervalMs = COLLECTION_READY_POLL_INTERVAL_MS, }) {
     const startedAt = Date.now();
     const deadline = startedAt + timeoutMs;
     let lastError;
@@ -4045,17 +4218,40 @@ async function waitForCollectionReady({ cloudbase, collectionName, logger, timeo
     });
     while (Date.now() <= deadline) {
         try {
-            // 直接用 commonService 调用 DescribeTable 检查集合是否存在，避免 SDK lazyInit → DescribeEnvs
-            const envId = await (0, cloudbase_manager_js_1.getEnvId)();
-            const result = await cloudbase.commonService("tcb", "2018-06-08").call({
-                Action: "DescribeTable",
+            // 用 PutItem 探测集合是否真正就绪（DescribeTable 可能误报），插入一个空占位文档
+            // 如果成功，立即删除该文档；如果仍 ResourceNotFound，继续等待
+            const envId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
+            const probeDoc = JSON.stringify({ _readyProbe: true, _ts: Date.now() });
+            const probeResult = await cloudbase.commonService("tcb", "2018-06-08").call({
+                Action: "PutItem",
                 Param: {
                     EnvId: envId,
                     TableName: collectionName,
+                    MgoDocs: [probeDoc],
                 },
             });
-            (0, cloudbase_manager_js_1.logCloudBaseResult)(logger, result);
-            // DescribeTable 成功返回即表示集合存在
+            (0, cloudbase_manager_js_1.logCloudBaseResult)(logger, probeResult);
+            if (probeResult?.Error) {
+                // 集合还未就绪，继续轮询
+                throw new Error(probeResult.Error.Message);
+            }
+            // 集合就绪，清理探测文档
+            if (Array.isArray(probeResult?.InsertedIds) && probeResult.InsertedIds.length > 0) {
+                try {
+                    await cloudbase.commonService("tcb", "2018-06-08").call({
+                        Action: "DeleteItem",
+                        Param: {
+                            EnvId: envId,
+                            TableName: collectionName,
+                            MgoQuery: JSON.stringify({ _readyProbe: true }),
+                            MgoIsMulti: true,
+                        },
+                    });
+                }
+                catch {
+                    // 清理失败不影响主流程
+                }
+            }
             logger?.({
                 type: "toolInfo",
                 toolName: "writeNoSqlDatabaseStructure",
@@ -4094,8 +4290,8 @@ function registerDatabaseTools(server) {
     const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
     // readNoSqlDatabaseStructure
     server.registerTool?.("readNoSqlDatabaseStructure", {
-        title: "读取 NoSQL 数据库结构",
-        description: "读取 NoSQL 数据库集合与索引结构，支持列出集合、查看集合详情、列出索引以及检查索引是否存在。本工具为服务端管理工具，用于管理端查询数据库结构，不用于编写客户端代码。",
+        title: "读取 CloudBase NoSQL 数据库结构",
+        description: "读取 CloudBase NoSQL 数据库集合与索引结构，支持列出集合、查看集合详情、列出索引以及检查索引是否存在。本工具为服务端管理工具，用于管理端查询数据库结构，不用于编写客户端代码。",
         inputSchema: {
             action: zod_1.z.enum([
                 "listCollections",
@@ -4282,8 +4478,8 @@ checkIndex: 检查指定索引是否存在`),
     });
     // writeNoSqlDatabaseStructure
     server.registerTool?.("writeNoSqlDatabaseStructure", {
-        title: "创建并管理 NoSQL 数据库集合",
-        description: "创建、删除和管理 NoSQL 数据库集合（collection）。支持创建新集合、删除现有集合，以及通过 updateCollection 的 updateOptions.CreateIndexes / updateOptions.DropIndexes 添加索引和删除索引。当需要新建集合时，使用 action=createCollection。本工具为服务端管理工具，用于管理端操作集合和索引结构，不用于编写客户端代码。",
+        title: "创建并管理 CloudBase NoSQL 数据库集合",
+        description: "创建、删除和管理 CloudBase NoSQL 数据库集合（collection）。支持创建新集合、删除现有集合，以及通过 updateCollection 的 updateOptions.CreateIndexes / updateOptions.DropIndexes 添加索引和删除索引。当需要新建集合时，使用 action=createCollection。本工具为服务端管理工具，用于管理端操作集合和索引结构，不用于编写客户端代码。",
         inputSchema: {
             action: zod_1.z.enum([
                 "createCollection",
@@ -4343,8 +4539,14 @@ deleteCollection: 删除集合`),
                     Action: "DescribeTable",
                     Param: { EnvId: envId, TableName: collectionName },
                 });
-                collectionExists = true;
-                existsRequestId = descResult?.RequestId ?? "";
+                if (descResult?.Error) {
+                    // 集合不存在（ResourceNotFound）或其他错误，继续创建
+                    existsRequestId = descResult.RequestId ?? "";
+                }
+                else {
+                    collectionExists = true;
+                    existsRequestId = descResult?.RequestId ?? "";
+                }
             }
             catch (e) {
                 existsRequestId = e?.requestId ?? "";
@@ -4377,6 +4579,7 @@ deleteCollection: 删除集合`),
                 cloudbase,
                 collectionName,
                 logger: server.logger,
+                cloudBaseOptions: server.cloudBaseOptions,
             });
             return {
                 content: [
@@ -4459,8 +4662,8 @@ deleteCollection: 删除集合`),
     });
     // readNoSqlDatabaseContent
     server.registerTool?.("readNoSqlDatabaseContent", {
-        title: "查询并获取 NoSQL 数据库数据记录",
-        description: "查询并获取 NoSQL 数据库数据记录。⚠️ 本工具为服务端管理工具，用于管理端/运维端查询。当任务要求编写客户端应用代码时（例如「用 JS SDK 读取数据」），不应使用本工具，而应在项目代码中编写 @cloudbase/js-sdk 客户端代码（如 db.collection().where().get()）。",
+        title: "查询并获取 CloudBase NoSQL 数据库数据记录",
+        description: "查询 CloudBase NoSQL 数据库中的数据记录。支持按条件筛选、分页、排序，适用于管理端数据查询与运维。",
         inputSchema: {
             collectionName: zod_1.z.string().describe("集合名称"),
             instanceId: zod_1.z
@@ -4546,8 +4749,10 @@ deleteCollection: 删除集合`),
     });
     // writeNoSqlDatabaseContent
     server.registerTool?.("writeNoSqlDatabaseContent", {
-        title: "修改 NoSQL 数据库数据记录",
-        description: "修改 NoSQL 数据库数据记录。⚠️ 本工具为服务端管理工具，用于管理端/运维端操作（如后台脚本、数据迁移、批量修改）。当任务要求编写客户端应用代码时（例如「用 JS SDK 登录并插入数据」、「在前端读写数据库」），不应使用本工具，而应在项目代码中编写 @cloudbase/js-sdk 客户端代码（如 app.database().collection().add()、db.collection().where().get() 等）。可按 MongoDB updateOne/updateMany 的心智模型理解：部分更新必须使用 `$set`、`$inc`、`$push` 等更新操作符；如果直接传「字段到值的普通对象」这类内容，底层会把它当作替换内容，存在覆盖整条文档的风险。⚠️ 嵌套对象部分更新务必使用点号路径：要更新 `shipping.city`，应传 `$set: {\"shipping.city\": \"guangzhou\"}`，绝不能传 `$set: {\"shipping\": {\"city\": \"guangzhou\"}}`（后者会丢失 shipping 下的其他字段）。若集合中的角色/档案文档会在前端通过 `db.collection(...).doc(uid)` 读取，请确保文档 `_id` 就是该 `uid`；不要用按 `uid` 条件查询再配合 `upsert=true` 的方式去更新 `users` / `profiles`，否则经常会生成一个不同的 `_id`，导致后续 `doc(uid)` 读取命中不到。",
+        title: "修改 CloudBase NoSQL 数据库数据记录",
+        description: "修改 CloudBase NoSQL 数据库中的数据记录。支持插入、更新（含 $set/$inc/$push 等操作符）、删除、upsert 等操作，适用于管理端数据写入与运维。" +
+            "⚠️ 服务端写入不含 _openid：若集合依赖客户端 SDK（@cloudbase/js-sdk 或微信小程序 wx.cloud.database()）的行级安全规则（如 doc._openid == auth.openid），服务端写入时需手动补充 _openid 字段，否则客户端将无法读取到该数据。" +
+            "⚠️ 部分更新嵌套字段须使用点号路径，如 `$set: {\"shipping.city\": \"guangzhou\"}`，直接传嵌套对象会覆盖整个字段。",
         inputSchema: {
             action: zod_1.z
                 .enum(["insert", "update", "delete"])
@@ -6287,7 +6492,7 @@ async function registerRagTools(server) {
             .map((skill) => `文档名：${path.basename(path.dirname(skill.absolutePath))} 文档介绍：${skill.description}`)
             .join("\n")}
 
-      OpenAPI 文档 (openapi) 查询当前支持 ${openapis.length} 个 API 文档，分别是：
+      OpenAPI 文档 (openapi) 查询只需要传 mode="openapi" 和 apiName，不要传 action；action 仅用于 mode="docs"。当前支持 ${openapis.length} 个 API 文档，分别是：
       ${openapis
             .map((api) => `API名：${api.name} API介绍：${api.description}`)
             .join("\n")}`,
@@ -6295,7 +6500,7 @@ async function registerRagTools(server) {
             mode: SearchKnowledgeModeEnum,
             skillName: buildOptionalStringEnum(skillNames, "mode=skill 时指定。技能名称。"),
             apiName: buildOptionalStringEnum(openapiNames, "mode=openapi 时指定。API 名称。"),
-            action: CloudBaseDocsActionEnum.optional().describe("mode=docs 时指定。CloudBase 文档操作类型：listModules=列出所有文档模块，listModuleDocs=获取指定模块的目录结构，findByName=按名称/路径/URL 智能查找，readDoc=读取指定文档 Markdown，searchDocs=全文搜索官方文档。"),
+            action: CloudBaseDocsActionEnum.optional().describe("仅 mode=docs 时指定；mode=openapi 不要传 action。CloudBase 文档操作类型：listModules=列出所有文档模块，listModuleDocs=获取指定模块的目录结构，findByName=按名称/路径/URL 智能查找，readDoc=读取指定文档 Markdown，searchDocs=全文搜索官方文档。"),
             moduleName: zod_1.z
                 .string()
                 .optional()
@@ -7251,12 +7456,13 @@ async function resolveStoragePublicAccess(params) {
 function registerStorageTools(server) {
     // 获取 cloudBaseOptions，如果没有则为 undefined
     const cloudBaseOptions = server.cloudBaseOptions;
+    const storageOverrides = server.pluginOptions?.storage;
     // 创建闭包函数来获取 CloudBase Manager
     const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
     // Tool 1: queryStorage - 查询存储信息（只读操作）
     server.registerTool("queryStorage", {
         title: "查询 CloudBase 存储信息",
-        description: "查询 CloudBase 云存储信息，支持列出目录文件、获取文件信息、获取临时下载链接等只读操作。返回的文件信息包括文件名、大小、修改时间、下载链接等。注意：action=url 返回的 temporaryUrl 是临时签名链接，有效期由 maxAge 参数决定（默认1小时），不要当作永久公网地址使用。工具还会基于 DescribeEnvs 返回的 Storages[0].CdnDomain 推导出 publicUrl，⚠️ 警告：publicUrl 仅在存储桶 ACL 为公有读（所有用户可读）时才能被匿名访问；默认私有读写存储桶返回的 publicUrl 会 403，此时请继续使用 temporaryUrl 或先通过控制台/SDK 将目标路径设置为公有读。\n\n💡 存储桶 ACL 权限管理请使用 permissions 工具：queryPermissions(action=\"getResourcePermission\", resourceType=\"storage\", resourceId=\"bucket-name\") 查询，managePermissions(action=\"updateResourcePermission\", resourceType=\"storage\", resourceId=\"bucket-name\", permission=\"READONLY\") 设置。",
+        description: "查询 CloudBase 云存储信息，支持列出目录文件、获取文件信息、获取临时下载链接等只读操作。返回的文件信息包括文件名、大小、修改时间、下载链接等。注意：action=url 返回的 temporaryUrl 是临时签名链接，有效期由 maxAge 参数决定（默认1小时），不要当作永久公网地址使用。工具还会基于 DescribeEnvs 返回的 Storages[0].CdnDomain 推导 publicUrl，⚠️ 警告：publicUrl 仅在存储桶 ACL 为公有读（所有用户可读）时才能被匿名访问；默认私有读写存储桶返回的 publicUrl 会 403，此时请继续使用 temporaryUrl 或先通过控制台/SDK 将目标路径设置为公有读。\n\n💡 存储桶 ACL 权限管理请使用 permissions 工具：queryPermissions(action=\"getResourcePermission\", resourceType=\"storage\", resourceId=\"bucket-name\") 查询，managePermissions(action=\"updateResourcePermission\", resourceType=\"storage\", resourceId=\"bucket-name\", permission=\"READONLY\") 设置。\n\n📦 CloudBase PG / pgstore 环境：`DescribeEnvs.Storages[]` 列出的 bucket 是旧 NoSQL 后端的，不等于 pgstore bucket。本工具用于查看常规存储；为 PG 浏览器上传准备 bucket 时，请确认目标 bucket 是 pgstore 后端可用的，否则浏览器 `app.storage.from().upload(...)` 会得到 `STORAGE_BUCKET_NOT_FOUND` 并出现 `PUT https://undefined/`。",
         inputSchema: queryStorageInputSchema,
         annotations: {
             readOnlyHint: true,
@@ -7272,7 +7478,14 @@ function registerStorageTools(server) {
         const storageService = manager.storage;
         switch (input.action) {
             case 'list': {
-                const result = await storageService.listDirectoryFiles(input.cloudPath);
+                let files;
+                if (storageOverrides?.listFiles) {
+                    files = await storageOverrides.listFiles({ cloudPath: input.cloudPath });
+                }
+                else {
+                    const result = await storageService.listDirectoryFiles(input.cloudPath);
+                    files = result || [];
+                }
                 return {
                     content: [
                         {
@@ -7282,17 +7495,23 @@ function registerStorageTools(server) {
                                 data: {
                                     action: 'list',
                                     cloudPath: input.cloudPath,
-                                    files: result || [],
-                                    totalCount: result?.length || 0
+                                    files,
+                                    totalCount: files.length
                                 },
-                                message: `Successfully listed ${result?.length || 0} files in directory '${input.cloudPath}'`
+                                message: `Successfully listed ${files.length} files in directory '${input.cloudPath}'`
                             }, null, 2)
                         }
                     ]
                 };
             }
             case 'info': {
-                const result = await storageService.getFileInfo(input.cloudPath);
+                let fileInfo;
+                if (storageOverrides?.getFileInfo) {
+                    fileInfo = await storageOverrides.getFileInfo({ cloudPath: input.cloudPath });
+                }
+                else {
+                    fileInfo = await storageService.getFileInfo(input.cloudPath);
+                }
                 return {
                     content: [
                         {
@@ -7302,7 +7521,7 @@ function registerStorageTools(server) {
                                 data: {
                                     action: 'info',
                                     cloudPath: input.cloudPath,
-                                    fileInfo: result
+                                    fileInfo
                                 },
                                 message: `Successfully retrieved file info for '${input.cloudPath}'`
                             }, null, 2)
@@ -7311,10 +7530,24 @@ function registerStorageTools(server) {
                 };
             }
             case 'url': {
-                const result = await storageService.getTemporaryUrl([{
+                let temporaryUrl = "";
+                let fileId = "";
+                if (storageOverrides?.getFileUrl) {
+                    const urlResult = await storageOverrides.getFileUrl({
                         cloudPath: input.cloudPath,
-                        maxAge: input.maxAge || 3600
-                    }]);
+                        maxAge: input.maxAge || 3600,
+                    });
+                    temporaryUrl = urlResult.url;
+                    fileId = urlResult.fileId || "";
+                }
+                else {
+                    const result = await storageService.getTemporaryUrl([{
+                            cloudPath: input.cloudPath,
+                            maxAge: input.maxAge || 3600
+                        }]);
+                    temporaryUrl = result[0]?.url || "";
+                    fileId = result[0]?.fileId || "";
+                }
                 const publicAccess = await resolveStoragePublicAccess({
                     cloudPath: input.cloudPath,
                     cloudBaseOptions,
@@ -7329,9 +7562,9 @@ function registerStorageTools(server) {
                                 data: {
                                     action: 'url',
                                     cloudPath: input.cloudPath,
-                                    temporaryUrl: result[0]?.url || "",
+                                    temporaryUrl,
                                     expireTime: `${input.maxAge || 3600}秒`,
-                                    fileId: result[0]?.fileId || "",
+                                    fileId,
                                     storageCdnDomain: publicAccess.storageCdnDomain,
                                     publicUrl: publicAccess.publicUrl,
                                     note: "temporaryUrl 是临时签名链接，会按 expireTime 过期。publicUrl 基于 DescribeEnvs 返回的 Storages[0].CdnDomain 推导，⚠️ 仅在存储桶 ACL 为公有读（所有用户可读）时才能被匿名访问；默认私有读写存储桶返回的 publicUrl 会 403，此时请继续使用 temporaryUrl 或先将目标路径设置为公有读。"
@@ -7346,10 +7579,15 @@ function registerStorageTools(server) {
                 const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), STORAGE_READ_TEMP_PREFIX));
                 const localPath = path.join(tempDir, getStorageTempFileName(input.cloudPath));
                 try {
-                    await storageService.downloadFile({
-                        cloudPath: input.cloudPath,
-                        localPath
-                    });
+                    if (storageOverrides?.downloadFile) {
+                        await storageOverrides.downloadFile({ cloudPath: input.cloudPath, localPath });
+                    }
+                    else {
+                        await storageService.downloadFile({
+                            cloudPath: input.cloudPath,
+                            localPath
+                        });
+                    }
                     const buffer = await fs.readFile(localPath);
                     const decoded = decodeInlineTextContent(buffer);
                     return {
@@ -7385,7 +7623,7 @@ function registerStorageTools(server) {
     // Tool 2: manageStorage - 管理存储文件（写操作）
     server.registerTool("manageStorage", {
         title: "管理 CloudBase 存储文件",
-        description: "管理 CloudBase 云存储文件，仅用于 COS/Storage 对象，不用于静态网站托管。支持上传文件/目录、下载文件/目录、删除文件/目录等操作。删除操作需要设置force=true进行确认，防止误删除重要文件。注意：上传后返回的 temporaryUrl 是临时签名链接，1小时后过期，不要当作永久公网地址写入配置或持久化存储。工具还会基于 DescribeEnvs 返回的 Storages[0].CdnDomain 推导 publicUrl，⚠️ 警告：publicUrl 仅在存储桶 ACL 为公有读（所有用户可读）时才能被匿名访问；默认私有读写存储桶返回的 publicUrl 会 403，此时请继续使用 temporaryUrl 或先通过控制台/SDK 将目标路径设置为公有读。\n\n💡 存储桶 ACL 权限管理请使用 permissions 工具：queryPermissions(action=\"getResourcePermission\", resourceType=\"storage\", resourceId=\"bucket-name\") 查询，managePermissions(action=\"updateResourcePermission\", resourceType=\"storage\", resourceId=\"bucket-name\", permission=\"READONLY\") 设置。",
+        description: "管理 CloudBase 云存储文件，仅用于 COS/Storage 对象，不用于静态网站托管。支持上传文件/目录、下载文件/目录、删除文件/目录等操作。删除操作需要设置force=true进行确认，防止误删除重要文件。注意：上传后返回的 temporaryUrl 是临时签名链接，1小时后过期，不要当作永久公网地址写入配置或持久化存储。工具还会基于 DescribeEnvs 返回的 Storages[0].CdnDomain 推导 publicUrl，⚠️ 警告：publicUrl 仅在存储桶 ACL 为公有读（所有用户可读）时才能被匿名访问；默认私有读写存储桶返回的 publicUrl 会 403，此时请继续使用 temporaryUrl 或先通过控制台/SDK 将目标路径设置为公有读。\n\n💡 存储桶 ACL 权限管理请使用 permissions 工具：queryPermissions(action=\"getResourcePermission\", resourceType=\"storage\", resourceId=\"bucket-name\") 查询，managePermissions(action=\"updateResourcePermission\", resourceType=\"storage\", resourceId=\"bucket-name\", permission=\"READONLY\") 设置。\n\n📦 CloudBase PG / pgstore 桶必须先创建后使用（与 Supabase Storage 一致：upload 前 bucket 必须存在）。浏览器 SDK `app.storage.from().upload(path, file)` 不会自动建桶，且 `path` 的第一段就是 bucket 名（例如 `covers/foo.png` → bucket=`covers`）；`from('covers')` 这个参数当前不会被拼到 path 里。如果上传时浏览器看到 `STORAGE_BUCKET_NOT_FOUND` 或 `PUT https://undefined/`（DevTools 表现为 `net::ERR_NAME_NOT_RESOLVED`），先用本工具或控制台确认 / 创建对应的 pgstore bucket，再让前端重试上传，不要让前端把上传失败静默吞掉。`DescribeEnvs.Storages[]` 返回的旧 NoSQL bucket（形如 `<hash>-<envId>-<appId>`）不是可用的 pgstore bucket，切勿当作默认目标使用。",
         inputSchema: manageStorageInputSchema,
         annotations: {
             readOnlyHint: false,
@@ -7404,32 +7642,69 @@ function registerStorageTools(server) {
         switch (input.action) {
             case 'upload': {
                 if (input.isDirectory) {
-                    await storageService.uploadDirectory({
-                        localPath: input.localPath,
+                    if (storageOverrides?.uploadDirectory) {
+                        await storageOverrides.uploadDirectory({ localPath: input.localPath, cloudPath: input.cloudPath });
+                    }
+                    else {
+                        await storageService.uploadDirectory({
+                            localPath: input.localPath,
+                            cloudPath: input.cloudPath,
+                            onProgress: (progressData) => {
+                                console.log("Upload directory progress:", progressData);
+                            }
+                        });
+                    }
+                }
+                else {
+                    if (storageOverrides?.uploadFile) {
+                        await storageOverrides.uploadFile({ localPath: input.localPath, cloudPath: input.cloudPath });
+                    }
+                    else {
+                        await storageService.uploadFile({
+                            localPath: input.localPath,
+                            cloudPath: input.cloudPath,
+                            onProgress: (progressData) => {
+                                console.log("Upload file progress:", progressData);
+                            }
+                        });
+                    }
+                }
+                // 上传成功后获取临时 URL 和公网访问信息
+                let temporaryUrl = "";
+                let fileId = "";
+                if (storageOverrides?.getFileUrl) {
+                    const urlResult = await storageOverrides.getFileUrl({
                         cloudPath: input.cloudPath,
-                        onProgress: (progressData) => {
-                            console.log("Upload directory progress:", progressData);
-                        }
+                        maxAge: 3600,
                     });
+                    temporaryUrl = urlResult.url;
+                    fileId = urlResult.fileId || "";
                 }
                 else {
-                    await storageService.uploadFile({
-                        localPath: input.localPath,
+                    try {
+                        const fileUrls = await storageService.getTemporaryUrl([{
+                                cloudPath: input.cloudPath,
+                                maxAge: 3600
+                            }]);
+                        temporaryUrl = fileUrls[0]?.url || "";
+                        fileId = fileUrls[0]?.fileId || "";
+                    }
+                    catch {
+                        // StorageOverrides 下 getTemporaryUrl 可能不可用
+                    }
+                }
+                let publicAccess = {};
+                try {
+                    publicAccess = await resolveStoragePublicAccess({
                         cloudPath: input.cloudPath,
-                        onProgress: (progressData) => {
-                            console.log("Upload file progress:", progressData);
-                        }
+                        cloudBaseOptions,
+                        manager,
                     });
                 }
-                const fileUrls = await storageService.getTemporaryUrl([{
-                        cloudPath: input.cloudPath,
-                        maxAge: 3600
-                    }]);
-                const publicAccess = await resolveStoragePublicAccess({
-                    cloudPath: input.cloudPath,
-                    cloudBaseOptions,
-                    manager,
-                });
+                catch {
+                    // DescribeEnvs 可能不支持（IDE 模式下会绕过）
+                    publicAccess = {};
+                }
                 return {
                     content: [
                         {
@@ -7441,7 +7716,7 @@ function registerStorageTools(server) {
                                     localPath: input.localPath,
                                     cloudPath: input.cloudPath,
                                     isDirectory: input.isDirectory,
-                                    temporaryUrl: fileUrls[0]?.url || "",
+                                    temporaryUrl,
                                     expireTime: "1小时",
                                     storageCdnDomain: publicAccess.storageCdnDomain,
                                     publicUrl: publicAccess.publicUrl,
@@ -7455,16 +7730,26 @@ function registerStorageTools(server) {
             }
             case 'download': {
                 if (input.isDirectory) {
-                    await storageService.downloadDirectory({
-                        cloudPath: input.cloudPath,
-                        localPath: input.localPath
-                    });
+                    if (storageOverrides?.downloadDirectory) {
+                        await storageOverrides.downloadDirectory({ cloudPath: input.cloudPath, localPath: input.localPath });
+                    }
+                    else {
+                        await storageService.downloadDirectory({
+                            cloudPath: input.cloudPath,
+                            localPath: input.localPath
+                        });
+                    }
                 }
                 else {
-                    await storageService.downloadFile({
-                        cloudPath: input.cloudPath,
-                        localPath: input.localPath
-                    });
+                    if (storageOverrides?.downloadFile) {
+                        await storageOverrides.downloadFile({ cloudPath: input.cloudPath, localPath: input.localPath });
+                    }
+                    else {
+                        await storageService.downloadFile({
+                            cloudPath: input.cloudPath,
+                            localPath: input.localPath
+                        });
+                    }
                 }
                 return {
                     content: [
@@ -7500,10 +7785,20 @@ function registerStorageTools(server) {
                     };
                 }
                 if (input.isDirectory) {
-                    await storageService.deleteDirectory(input.cloudPath);
+                    if (storageOverrides?.deleteDirectory) {
+                        await storageOverrides.deleteDirectory({ cloudPath: input.cloudPath });
+                    }
+                    else {
+                        await storageService.deleteDirectory(input.cloudPath);
+                    }
                 }
                 else {
-                    await storageService.deleteFile([input.cloudPath]);
+                    if (storageOverrides?.deleteFiles) {
+                        await storageOverrides.deleteFiles({ cloudPaths: [input.cloudPath] });
+                    }
+                    else {
+                        await storageService.deleteFile([input.cloudPath]);
+                    }
                 }
                 return {
                     content: [
@@ -8658,7 +8953,7 @@ function buildWebSdkHint(loginMethods) {
     }
     return {
         blocked: false,
-        register: "auth.signUp({ username, password })",
+        register: "direct username/password signUp is SDK/provider dependent; verify before use, otherwise create users through a backend or management API boundary",
         login: "auth.signInWithPassword({ username, password })",
         accountInputType: "text",
         avoidEmailHelpers: true,
@@ -9113,6 +9408,13 @@ function registerAppAuthTools(server) {
 }
 
 
+/***/ }),
+
+/***/ 5663:
+/***/ ((module) => {
+
+module.exports = __WEBPACK_EXTERNAL_MODULE_node_path_02319fef__;
+
 /***/ }),
 
 /***/ 5814:
@@ -9182,7 +9484,7 @@ class TelemetryReporter {
         const nodeVersion = process.version; // Node.js版本
         const arch = os_1.default.arch(); // 系统架构
         // 从构建时注入的版本号获取MCP版本信息
-        const mcpVersion = process.env.npm_package_version || "2.21.1" || 0;
+        const mcpVersion = process.env.npm_package_version || "2.22.0-beta.0" || 0;
         return {
             userAgent: `${osType} ${osRelease} ${arch} ${nodeVersion} CloudBase-MCP/${mcpVersion}`,
             deviceId: this.deviceId,
@@ -9573,6 +9875,7 @@ exports.MANAGE_FUNCTION_ACTIONS = [
     "attachLayer",
     "detachLayer",
     "updateFunctionLayers",
+    "incrementalDeployFunction", // 增量部署，需通过 pluginOptions.functions 注入实现
 ];
 const VPC_SCHEMA = zod_1.z.object({
     vpcId: zod_1.z.string(),
@@ -9754,6 +10057,7 @@ function wrapFunctionOperationError(operation, functionName, functionRootPath, e
 }
 function registerFunctionTools(server) {
     const cloudBaseOptions = server.cloudBaseOptions;
+    const deployOverrides = server.pluginOptions?.functions;
     const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
     const buildEnvelope = (data, message, nextActions) => ({
         success: true,
@@ -10118,6 +10422,16 @@ function registerFunctionTools(server) {
         ensureActionAllowedInCloudMode(input);
         switch (input.action) {
             case "createFunction": {
+                if (deployOverrides?.createFunction) {
+                    const result = await deployOverrides.createFunction({
+                        functionName: String(input.func?.name ?? input.functionName ?? ''),
+                        functionRootPath: input.functionRootPath ?? '',
+                        runtime: input.func?.runtime,
+                        force: input.force,
+                        installDependency: input.func?.installDependency,
+                    });
+                    return buildEnvelope({ action: input.action, result }, '云函数部署成功（override）');
+                }
                 if (!input.func?.name || typeof input.func.name !== "string") {
                     throw new Error("createFunction 操作时，func.name 参数是必需的");
                 }
@@ -10205,6 +10519,15 @@ function registerFunctionTools(server) {
                 }, message, nextActions);
             }
             case "updateFunctionCode": {
+                if (deployOverrides?.updateFunctionCode) {
+                    const result = await deployOverrides.updateFunctionCode({
+                        functionName: input.functionName ?? '',
+                        functionRootPath: input.functionRootPath ?? '',
+                        force: input.force,
+                        installDependency: input.func?.installDependency,
+                    });
+                    return buildEnvelope({ action: input.action, result }, '云函数代码更新成功（override）');
+                }
                 if (!input.functionName) {
                     throw new Error("updateFunctionCode 操作时，functionName 参数是必需的");
                 }
@@ -10538,133 +10861,1404 @@ function registerFunctionTools(server) {
                 ]);
             }
             default:
+                // incrementalDeployFunction：无默认实现，必须通过 pluginOptions 注入
+                if (input.action === 'incrementalDeployFunction') {
+                    const fn = deployOverrides?.incrementalDeployFunction;
+                    if (!fn) {
+                        throw new Error('incrementalDeployFunction 需要通过 pluginOptions.functions.incrementalDeployFunction 注入实现（仅在支持的 IDE 环境中可用）');
+                    }
+                    const result = await fn({
+                        functionName: input.functionName ?? '',
+                        functionRootPath: input.functionRootPath ?? '',
+                        incrementalFile: input.incrementalFile ?? '',
+                    });
+                    return buildEnvelope({ action: input.action, result }, '云函数增量部署成功');
+                }
                 throw new Error(`不支持的操作类型: ${input.action}`);
         }
     };
-    server.registerTool?.("queryFunctions", {
-        title: "查询 CloudBase 云函数",
-        description: "CloudBase 云函数统一只读入口。通过更自解释的 action 查询 CloudBase 云函数列表、函数详情、执行日志、层、触发器和代码下载地址。" +
-            "\n\n**分页说明**：`listFunctions`、`listLayers` 支持 `limit` 和 `offset` 参数。" +
-            "\n- `limit`: 分页数量，默认值由后端决定" +
-            "\n- `offset`: 分页偏移，从 0 开始" +
-            "\n- 示例：`queryFunctions(action=\"listFunctions\", offset=10, limit=10)`" +
-            "\n\n**查询 CloudBase 云函数日志**：使用 `action=\"listFunctionLogs\"`，需要提供 `functionName` 参数。" +
-            "\n- 示例：`queryFunctions(action=\"listFunctionLogs\", functionName=\"my-function\")`" +
-            "\n- 如需查看日志详情：`queryFunctions(action=\"getFunctionLogDetail\", requestId=\"xxx\")`" +
-            "\n\n**定时任务 / cron / 定时跑**：使用 `listFunctionTriggers` 查询函数的 timer 触发器配置。" +
-            "\n\n**区分 `queryLogs` 工具**：" +
-            "\n- 本工具用于查询特定 CloudBase 云函数的执行日志" +
-            "\n- `queryLogs` 工具用于搜索 CLS 日志服务（跨服务日志聚合）",
+    server.registerTool?.("queryFunctions", {
+        title: "查询 CloudBase 云函数",
+        description: "CloudBase 云函数统一只读入口。通过更自解释的 action 查询 CloudBase 云函数列表、函数详情、执行日志、层、触发器和代码下载地址。" +
+            "\n\n**分页说明**：`listFunctions`、`listLayers` 支持 `limit` 和 `offset` 参数。" +
+            "\n- `limit`: 分页数量，默认值由后端决定" +
+            "\n- `offset`: 分页偏移，从 0 开始" +
+            "\n- 示例：`queryFunctions(action=\"listFunctions\", offset=10, limit=10)`" +
+            "\n\n**查询 CloudBase 云函数日志**：使用 `action=\"listFunctionLogs\"`，需要提供 `functionName` 参数。" +
+            "\n- 示例：`queryFunctions(action=\"listFunctionLogs\", functionName=\"my-function\")`" +
+            "\n- 如需查看日志详情：`queryFunctions(action=\"getFunctionLogDetail\", requestId=\"xxx\")`" +
+            "\n\n**定时任务 / cron / 定时跑**：使用 `listFunctionTriggers` 查询函数的 timer 触发器配置。" +
+            "\n\n**区分 `queryLogs` 工具**：" +
+            "\n- 本工具用于查询特定 CloudBase 云函数的执行日志" +
+            "\n- `queryLogs` 工具用于搜索 CLS 日志服务（跨服务日志聚合）",
+        inputSchema: {
+            action: zod_1.z
+                .enum(exports.QUERY_FUNCTION_ACTIONS)
+                .describe("只读操作类型：" +
+                "\n- `listFunctions`: 列出所有 CloudBase 云函数" +
+                "\n- `getFunctionDetail`: 获取 CloudBase 云函数详情（需要 functionName）" +
+                "\n- `listFunctionLogs`: 查询 CloudBase 云函数执行日志（需要 functionName）" +
+                "\n- `getFunctionLogDetail`: 获取日志详情（需要 requestId）" +
+                "\n- `listFunctionLayers`: 列出函数绑定的层" +
+                "\n- `listLayers`: 列出所有层" +
+                "\n- `listLayerVersions`: 列出层的版本（注意：是 Versions 不是 Version）" +
+                "\n- `getLayerVersionDetail`: 获取层版本详情" +
+                "\n- `listFunctionTriggers`: 列出函数触发器（用于查看定时任务 / cron / timer 配置）" +
+                "\n- `getFunctionDownloadUrl`: 获取函数代码下载地址"),
+            functionName: zod_1.z
+                .string()
+                .optional()
+                .describe("CloudBase 云函数名称。`getFunctionDetail`、`listFunctionLogs`、`listFunctionLayers`、`listFunctionTriggers`、`getFunctionDownloadUrl` 时必填"),
+            limit: zod_1.z.number().optional().describe("分页数量（limit）。列表类 action 可选，默认值由后端决定"),
+            offset: zod_1.z.number().optional().describe("分页偏移（offset）。列表类 action 可选，默认 0"),
+            codeSecret: zod_1.z.string().optional().describe("代码保护密钥，用于解密函数代码"),
+            startTime: zod_1.z
+                .string()
+                .optional()
+                .describe("日志查询开始时间，格式必须为 YYYY-MM-DD HH:mm:ss（如 2024-01-01 00:00:00）。" +
+                "与 endTime 间隔不能超过一天。不传时默认查询最近一天"),
+            endTime: zod_1.z
+                .string()
+                .optional()
+                .describe("日志查询结束时间，格式必须为 YYYY-MM-DD HH:mm:ss（如 2024-01-01 23:59:59）。" +
+                "与 startTime 间隔不能超过一天。不传时默认为当前时间"),
+            requestId: zod_1.z
+                .string()
+                .optional()
+                .describe("日志请求 ID。`getFunctionLogDetail` 操作必填，可从 `listFunctionLogs` 结果中获取"),
+            qualifier: zod_1.z.string().optional().describe("函数版本别名，如 $LATEST、$DEFAULT。日志查询时可选"),
+            runtime: zod_1.z.string().optional().describe("层查询的运行时筛选，如 Nodejs18.15"),
+            searchKey: zod_1.z.string().optional().describe("层名称搜索关键字"),
+            layerName: zod_1.z.string().optional().describe("层名称。`listLayerVersions`、`getLayerVersionDetail` 操作必填"),
+            layerVersion: zod_1.z.number().optional().describe("层版本号。`getLayerVersionDetail` 操作必填"),
+        },
+        annotations: {
+            readOnlyHint: true,
+            openWorldHint: true,
+            category: "functions",
+        },
+    }, async (input) => withEnvelope(() => handleQueryFunctions(input)));
+    server.registerTool?.("manageFunctions", {
+        title: "管理 CloudBase 云函数",
+        description: "CloudBase 云函数统一写入口。支持创建函数、更新代码、更新配置、调用函数、管理定时跑 / 定时任务 / scheduled job 的 timer 触发器和层绑定。" +
+            "如果要创建 cron 定时任务，先用 createFunction 创建函数，再用 createFunctionTrigger 创建 timer 触发器（支持7段cron表达式），deleteFunctionTrigger 删除触发器。" +
+            "危险操作需要显式 confirm=true。",
+        inputSchema: {
+            action: zod_1.z
+                .enum(exports.MANAGE_FUNCTION_ACTIONS)
+                .describe("写操作类型，例如 createFunction、updateFunctionCode、incrementalDeployFunction、invokeFunction、deleteFunction、" +
+                "createFunctionTrigger（定时任务 / cron / timer）、deleteFunctionTrigger、attachLayer、detachLayer"),
+            func: CREATE_FUNCTION_SCHEMA.optional().describe("createFunction 操作的函数配置"),
+            functionRootPath: zod_1.z.string().optional().describe("创建或更新函数代码时默认推荐的本地目录方式。" +
+                "必须是直接包含函数文件夹的目录绝对路径（如 /abs/path/cloudfunctions 或 /abs/path/functions），" +
+                "不要传项目根目录（如 /abs/path），也不要传到函数名子目录（如 /abs/path/cloudfunctions/hello）。" +
+                "本地应按 cloudfunctions/<functionName>/index.js 或 functions/<functionName>/index.js 布局，" +
+                "此参数传 cloudfunctions 或 functions 目录的绝对路径。" +
+                "SDK 会自动拼接函数名子目录，无需预先压缩 zip 或 base64 编码。"),
+            force: zod_1.z.boolean().optional().describe("createFunction 时是否覆盖"),
+            functionName: zod_1.z.string().optional().describe("函数名称。大多数 action 使用该字段作为统一目标"),
+            zipFile: zod_1.z.string().optional().describe("仅兼容特殊场景：预先准备好的代码包 base64 编码。普通 createFunction/updateFunctionCode 默认不要先压缩 zip，优先使用 functionRootPath。"),
+            handler: zod_1.z.string().optional().describe("函数入口"),
+            timeout: zod_1.z.number().optional().describe("配置更新时的超时时间"),
+            envVariables: zod_1.z.record(zod_1.z.string()).optional().describe("配置更新时要合并的环境变量"),
+            vpc: VPC_SCHEMA.optional().describe("配置更新时的 VPC 信息"),
+            params: zod_1.z.record(zod_1.z.any()).optional().describe("invokeFunction 的调用参数"),
+            triggers: zod_1.z
+                .array(TRIGGER_SCHEMA)
+                .optional()
+                .describe("createFunctionTrigger 的触发器列表，用于定时跑 / 定时任务 / scheduled job。timer 触发器使用7段 cron 表达式（秒 分 时 日 月 星期 年），" +
+                '如 "0 */5 * * * * *" 表示每5分钟执行一次'),
+            triggerName: zod_1.z.string().optional().describe("deleteFunctionTrigger 的目标触发器名称"),
+            layerName: zod_1.z.string().optional().describe("层名称"),
+            layerVersion: zod_1.z.number().optional().describe("层版本号"),
+            contentPath: zod_1.z.string().optional().describe("层内容路径，可为目录或 ZIP 文件"),
+            base64Content: zod_1.z.string().optional().describe("层内容的 base64 编码"),
+            runtimes: zod_1.z.array(zod_1.z.string()).optional().describe("层适用的运行时列表"),
+            description: zod_1.z.string().optional().describe("层版本描述"),
+            licenseInfo: zod_1.z.string().optional().describe("层许可证信息"),
+            layers: zod_1.z
+                .array(MANAGE_LAYER_SCHEMA)
+                .optional()
+                .describe("updateFunctionLayers 的目标层列表，顺序即最终顺序"),
+            codeSecret: zod_1.z.string().optional().describe("层绑定时的代码保护密钥"),
+            confirm: zod_1.z.boolean().optional().describe("危险操作确认开关。deleteFunction、deleteFunctionTrigger、deleteLayerVersion、detachLayer 等删除类操作需要显式传入 confirm=true"),
+            incrementalFile: zod_1.z.string().optional().describe("incrementalDeployFunction 增量部署时的变更文件路径"),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: false,
+            openWorldHint: true,
+            category: "functions",
+        },
+    }, async (input) => withEnvelope(() => handleManageFunctions(input)));
+}
+
+
+/***/ }),
+
+/***/ 6220:
+/***/ ((module) => {
+
+module.exports = __WEBPACK_EXTERNAL_MODULE_ws__;
+
+/***/ }),
+
+/***/ 6473:
+/***/ (function(__unused_webpack_module, exports, __webpack_require__) {
+
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.registerPGDatabaseTools = registerPGDatabaseTools;
+const node_fs_1 = __webpack_require__(9627);
+const node_path_1 = __importDefault(__webpack_require__(5663));
+const zod_1 = __webpack_require__(2971);
+const cloudbase_manager_js_1 = __webpack_require__(3431);
+const tool_result_js_1 = __webpack_require__(9835);
+const CATEGORY = "PostgreSQL database";
+const QUERY_PG_DATABASE = "queryPgDatabase";
+const MANAGE_PG_DATABASE = "managePgDatabase";
+const QUERY_ACTIONS = [
+    "context",
+    "objects",
+    "metadata",
+    "schema",
+    "sql",
+];
+const MANAGE_ACTIONS = [
+    "init",
+    "execute",
+    "dryRun",
+    "planMigration",
+    "applyMigration",
+    "listMigrations",
+    "migrationDetail",
+    "rollbackMigration",
+];
+function buildPgToolResult(payload) {
+    return (0, tool_result_js_1.buildJsonToolResult)(payload);
+}
+function buildNextAction(tool, action, reason, suggestedArgs) {
+    return {
+        tool,
+        action,
+        suggested_args: suggestedArgs,
+        required_params: undefined,
+        reason,
+    };
+}
+function getPgContextStorePath() {
+    return (process.env.CLOUDBASE_PG_CONTEXT_PATH ??
+        node_path_1.default.join(process.env.HOME ?? ".", ".cloudbase-mcp", "pg-context.json"));
+}
+async function loadStoredPgContext() {
+    if (!process.env.CLOUDBASE_PG_CONTEXT_PATH) {
+        return undefined;
+    }
+    try {
+        const raw = await node_fs_1.promises.readFile(getPgContextStorePath(), "utf8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+}
+async function savePgContext(server, context) {
+    server.pgRuntimeContext = context;
+    if (!process.env.CLOUDBASE_PG_CONTEXT_PATH) {
+        return;
+    }
+    const storePath = getPgContextStorePath();
+    await node_fs_1.promises.mkdir(node_path_1.default.dirname(storePath), { recursive: true });
+    await node_fs_1.promises.writeFile(storePath, JSON.stringify(context, null, 2), {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+    await node_fs_1.promises.chmod(storePath, 0o600).catch(() => undefined);
+}
+async function getPgContext(server) {
+    if (server.pgRuntimeContext) {
+        return server.pgRuntimeContext;
+    }
+    const stored = await loadStoredPgContext();
+    if (stored) {
+        server.pgRuntimeContext = stored;
+    }
+    return stored;
+}
+function buildMissingContextResult() {
+    return buildPgToolResult({
+        success: false,
+        errorCode: "PG_CONTEXT_NOT_INITIALIZED",
+        message: "PostgreSQL context is not initialized yet. Call managePgDatabase(action=init) to bind the current CloudBase environment's built-in PostgreSQL runtime.",
+        nextActions: [
+            buildNextAction(MANAGE_PG_DATABASE, "init", "初始化 CloudBase PG 云端执行上下文，然后再查询 schema 或执行 SQL。", { action: "init" }),
+        ],
+    });
+}
+function sanitizePgContext(context) {
+    return {
+        envId: context.envId,
+        instanceId: context.instanceId,
+        defaultSchema: context.defaultSchema,
+        runtimeMode: context.runtimeMode,
+        bootstrapMode: context.bootstrapMode,
+        role: context.role,
+    };
+}
+function normalizeLimit(limit, fallback = 20, max = 200) {
+    if (!Number.isFinite(limit)) {
+        return fallback;
+    }
+    return Math.max(1, Math.min(max, Math.floor(limit)));
+}
+function stripLeadingSqlComments(sql) {
+    let normalized = sql.trim();
+    while (normalized.length > 0) {
+        if (normalized.startsWith("--")) {
+            normalized = normalized.replace(/^--.*(?:\r?\n|$)/, "").trimStart();
+            continue;
+        }
+        if (normalized.startsWith("#")) {
+            normalized = normalized.replace(/^#.*(?:\r?\n|$)/, "").trimStart();
+            continue;
+        }
+        if (normalized.startsWith("/*")) {
+            normalized = normalized.replace(/^\/\*[\s\S]*?\*\//, "").trimStart();
+            continue;
+        }
+        break;
+    }
+    return normalized;
+}
+function getSqlVerb(sql) {
+    const normalized = stripLeadingSqlComments(sql);
+    const match = normalized.match(/^([a-zA-Z]+)/);
+    return match ? match[1].toUpperCase() : "";
+}
+function isReadOnlySql(sql) {
+    const normalized = stripLeadingSqlComments(sql);
+    const verb = getSqlVerb(normalized);
+    const readOnlyVerbs = new Set([
+        "SELECT",
+        "SHOW",
+        "EXPLAIN",
+        "WITH",
+        "VALUES",
+    ]);
+    if (!readOnlyVerbs.has(verb)) {
+        return false;
+    }
+    return !/\b(INSERT|UPDATE|DELETE|CREATE|ALTER|DROP|TRUNCATE|REPLACE|RENAME|GRANT|REVOKE|COMMENT|VACUUM|ANALYZE|FOR\s+UPDATE|FOR\s+SHARE)\b/i.test(normalized);
+}
+function buildLimitedReadOnlySql(sql, limit) {
+    const normalized = stripLeadingSqlComments(sql).replace(/;\s*$/, "");
+    const verb = getSqlVerb(normalized);
+    if (!["SELECT", "WITH", "VALUES"].includes(verb)) {
+        return sql;
+    }
+    return `SELECT * FROM (${normalized}) AS cloudbase_mcp_readonly_limit LIMIT ${limit}`;
+}
+function isDestructiveSql(sql) {
+    const normalized = stripLeadingSqlComments(sql);
+    const verb = getSqlVerb(normalized);
+    if (["DROP", "TRUNCATE", "DELETE"].includes(verb)) {
+        return true;
+    }
+    if (verb === "ALTER") {
+        return /\b(DROP|RENAME)\b/i.test(normalized);
+    }
+    return false;
+}
+function classifySqlRisk(sql) {
+    const normalized = stripLeadingSqlComments(sql);
+    const verb = getSqlVerb(normalized);
+    if (!verb) {
+        return {
+            risk: "unknown_risk",
+            readOnly: false,
+            requiresConfirm: true,
+        };
+    }
+    if (isReadOnlySql(normalized)) {
+        return {
+            risk: "read_only",
+            readOnly: true,
+            requiresConfirm: false,
+        };
+    }
+    if (isDestructiveSql(normalized)) {
+        return {
+            risk: "destructive",
+            readOnly: false,
+            requiresConfirm: true,
+        };
+    }
+    if (/\b(GRANT|REVOKE|CREATE\s+POLICY|ALTER\s+POLICY|DROP\s+POLICY|ENABLE\s+ROW\s+LEVEL\s+SECURITY|DISABLE\s+ROW\s+LEVEL\s+SECURITY)\b/i.test(normalized)) {
+        return {
+            risk: "security_change",
+            readOnly: false,
+            requiresConfirm: true,
+        };
+    }
+    if (["CREATE", "ALTER", "COMMENT"].includes(verb)) {
+        return {
+            risk: "schema_change",
+            readOnly: false,
+            requiresConfirm: true,
+        };
+    }
+    if (["INSERT", "UPDATE", "DELETE", "MERGE"].includes(verb)) {
+        return {
+            risk: "normal_write",
+            readOnly: false,
+            requiresConfirm: true,
+        };
+    }
+    return {
+        risk: "unknown_risk",
+        readOnly: false,
+        requiresConfirm: true,
+    };
+}
+function quoteIdentifier(identifier) {
+    return `"${identifier.replace(/"/g, '""')}"`;
+}
+function buildSchemaNextAction(reason, objectName) {
+    return buildNextAction(QUERY_PG_DATABASE, "schema", reason, {
+        action: "schema",
+        objectName,
+    });
+}
+function parseSchemaQualifiedName(objectName) {
+    const match = objectName
+        .trim()
+        .match(/^([A-Za-z_][A-Za-z0-9_$]*)\.([A-Za-z_][A-Za-z0-9_$]*)$/);
+    if (!match) {
+        return null;
+    }
+    return {
+        schema: match[1],
+        name: match[2],
+    };
+}
+function serializeValue(value) {
+    if (value instanceof Date) {
+        return value.toISOString();
+    }
+    if (typeof value === "bigint") {
+        return value.toString();
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => serializeValue(item));
+    }
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([key, nestedValue]) => [
+            key,
+            serializeValue(nestedValue),
+        ]));
+    }
+    return value;
+}
+function truncateText(value, maxLength = 180) {
+    if (value === null || value === undefined) {
+        return null;
+    }
+    const text = String(value);
+    return text.length > maxLength ? `${text.slice(0, maxLength)}...` : text;
+}
+function buildSchemaTable(schema, name) {
+    return `${schema}.${name}`;
+}
+function parseTargetTableFromSql(sql, defaultSchema) {
+    const normalized = stripLeadingSqlComments(sql);
+    const identifier = String.raw `((?:[A-Za-z_][A-Za-z0-9_$]*\.)?[A-Za-z_][A-Za-z0-9_$]*)`;
+    const patterns = [
+        new RegExp(String.raw `\bcreate\s+(?:temporary\s+|temp\s+|unlogged\s+)?table\s+(?:if\s+not\s+exists\s+)?${identifier}`, "i"),
+        new RegExp(String.raw `\b(?:alter|drop|truncate)\s+table\s+(?:if\s+exists\s+)?${identifier}`, "i"),
+        new RegExp(String.raw `\binsert\s+into\s+${identifier}`, "i"),
+        new RegExp(String.raw `\bupdate\s+${identifier}`, "i"),
+        new RegExp(String.raw `\b(?:delete\s+from|from)\s+${identifier}`, "i"),
+    ];
+    const match = patterns
+        .map((pattern) => normalized.match(pattern))
+        .find(Boolean);
+    if (!match?.[1]) {
+        return undefined;
+    }
+    if (match[1].includes(".")) {
+        return match[1];
+    }
+    return `${defaultSchema}.${match[1]}`;
+}
+function summarizeQueryResult(result, limit) {
+    const rows = result.rows.map((row) => serializeValue(row));
+    const trimmedRows = rows.slice(0, limit);
+    return {
+        columns: result.fields?.map((field) => field.name) ??
+            (trimmedRows[0] ? Object.keys(trimmedRows[0]) : []),
+        rows: trimmedRows,
+        returnedRows: rows.length,
+        truncated: rows.length > trimmedRows.length,
+        truncatedCount: Math.max(rows.length - trimmedRows.length, 0),
+    };
+}
+async function withPgClient(context, deps, callback) {
+    const client = await deps.createClient(context);
+    await client.connect();
+    try {
+        return await callback(client);
+    }
+    finally {
+        await client.end();
+    }
+}
+async function getTableRowCount(client, schema, table) {
+    const qualifiedName = `${quoteIdentifier(schema)}.${quoteIdentifier(table)}`;
+    const result = await client.query(`SELECT COUNT(*)::bigint AS row_count FROM ${qualifiedName}`);
+    const rawValue = result.rows[0]?.row_count;
+    const parsed = Number(rawValue);
+    return Number.isFinite(parsed) ? parsed : null;
+}
+async function listObjects(client, schema, limit) {
+    const result = await client.query(`
+      SELECT
+        n.nspname AS schema,
+        c.relname AS name,
+        CASE c.relkind
+          WHEN 'r' THEN 'table'
+          WHEN 'p' THEN 'partitioned_table'
+          WHEN 'v' THEN 'view'
+          WHEN 'm' THEN 'materialized_view'
+          WHEN 'f' THEN 'foreign_table'
+          ELSE c.relkind::text
+        END AS kind,
+        CASE
+          WHEN c.reltuples >= 0 THEN c.reltuples::bigint
+          ELSE NULL
+        END AS estimated_rows
+      FROM pg_class c
+      INNER JOIN pg_namespace n ON n.oid = c.relnamespace
+      WHERE c.relkind IN ('r', 'p', 'v', 'm', 'f')
+        AND n.nspname NOT IN ('pg_catalog', 'information_schema')
+        AND n.nspname NOT LIKE 'pg_toast%'
+        AND ($1::text IS NULL OR n.nspname = $1)
+      ORDER BY n.nspname, c.relname
+      LIMIT $2
+    `, [schema ?? null, limit]);
+    return result.rows.map((row) => ({
+        schema: String(row.schema),
+        name: String(row.name),
+        schemaTable: buildSchemaTable(String(row.schema), String(row.name)),
+        kind: String(row.kind),
+        estimatedRows: row.estimated_rows === null || row.estimated_rows === undefined
+            ? null
+            : Number(row.estimated_rows),
+    }));
+}
+async function summarizeMetadata(client, schema, limit) {
+    const result = await client.query(`
+      SELECT
+        n.nspname AS schema,
+        c.relname AS name,
+        CASE c.relkind
+          WHEN 'r' THEN 'table'
+          WHEN 'p' THEN 'partitioned_table'
+          WHEN 'v' THEN 'view'
+          WHEN 'm' THEN 'materialized_view'
+          ELSE c.relkind::text
+        END AS kind,
+        CASE
+          WHEN c.reltuples >= 0 THEN c.reltuples::bigint
+          ELSE NULL
+        END AS estimated_rows,
+        c.relrowsecurity AS rls_enabled,
+        COALESCE(col_counts.column_count, 0)::int AS column_count
+      FROM pg_class c
+      INNER JOIN pg_namespace n ON n.oid = c.relnamespace
+      LEFT JOIN LATERAL (
+        SELECT COUNT(*) AS column_count
+        FROM information_schema.columns cols
+        WHERE cols.table_schema = n.nspname
+          AND cols.table_name = c.relname
+      ) AS col_counts ON TRUE
+      WHERE c.relkind IN ('r', 'p', 'v', 'm')
+        AND n.nspname NOT IN ('pg_catalog', 'information_schema')
+        AND n.nspname NOT LIKE 'pg_toast%'
+        AND ($1::text IS NULL OR n.nspname = $1)
+      ORDER BY n.nspname, c.relname
+      LIMIT $2
+    `, [schema ?? null, limit]);
+    const summaries = [];
+    for (const row of result.rows) {
+        const summary = {
+            schema: String(row.schema),
+            name: String(row.name),
+            schemaTable: buildSchemaTable(String(row.schema), String(row.name)),
+            kind: String(row.kind),
+            estimatedRows: row.estimated_rows === null || row.estimated_rows === undefined
+                ? null
+                : Number(row.estimated_rows),
+            columnCount: Number(row.column_count ?? 0),
+            rlsEnabled: Boolean(row.rls_enabled),
+        };
+        if (summary.kind === "table" || summary.kind === "partitioned_table") {
+            summary.rowCount = summary.estimatedRows ?? null;
+            summary.rowCountSource = "estimated";
+        }
+        else {
+            summary.rowCount = null;
+            summary.rowCountSource = "not_applicable";
+        }
+        summaries.push(summary);
+    }
+    return summaries;
+}
+async function readSchemaInfo(client, schema, table) {
+    const objectCheck = await client.query(`
+      SELECT
+        CASE c.relkind
+          WHEN 'r' THEN 'table'
+          WHEN 'p' THEN 'partitioned_table'
+          WHEN 'v' THEN 'view'
+          WHEN 'm' THEN 'materialized_view'
+          WHEN 'f' THEN 'foreign_table'
+          ELSE c.relkind::text
+        END AS kind,
+        c.relrowsecurity AS row_security_enabled,
+        c.relforcerowsecurity AS force_row_security
+      FROM pg_class c
+      INNER JOIN pg_namespace n ON n.oid = c.relnamespace
+      WHERE n.nspname = $1 AND c.relname = $2
+      LIMIT 1
+    `, [schema, table]);
+    if (!objectCheck.rows[0]) {
+        return null;
+    }
+    const columnsResult = await client.query(`
+      SELECT
+        column_name,
+        data_type,
+        udt_name,
+        is_nullable,
+        column_default,
+        character_maximum_length,
+        numeric_precision,
+        numeric_scale
+      FROM information_schema.columns
+      WHERE table_schema = $1 AND table_name = $2
+      ORDER BY ordinal_position
+    `, [schema, table]);
+    const primaryKeyResult = await client.query(`
+      SELECT kcu.column_name
+      FROM information_schema.table_constraints tc
+      INNER JOIN information_schema.key_column_usage kcu
+        ON tc.constraint_name = kcu.constraint_name
+       AND tc.table_schema = kcu.table_schema
+       AND tc.table_name = kcu.table_name
+      WHERE tc.constraint_type = 'PRIMARY KEY'
+        AND tc.table_schema = $1
+        AND tc.table_name = $2
+      ORDER BY kcu.ordinal_position
+    `, [schema, table]);
+    const foreignKeyResult = await client.query(`
+      SELECT
+        tc.constraint_name,
+        kcu.column_name,
+        ccu.table_schema AS foreign_table_schema,
+        ccu.table_name AS foreign_table_name,
+        ccu.column_name AS foreign_column_name
+      FROM information_schema.table_constraints tc
+      INNER JOIN information_schema.key_column_usage kcu
+        ON tc.constraint_name = kcu.constraint_name
+       AND tc.table_schema = kcu.table_schema
+       AND tc.table_name = kcu.table_name
+      INNER JOIN information_schema.constraint_column_usage ccu
+        ON tc.constraint_name = ccu.constraint_name
+       AND tc.table_schema = ccu.table_schema
+      WHERE tc.constraint_type = 'FOREIGN KEY'
+        AND tc.table_schema = $1
+        AND tc.table_name = $2
+      ORDER BY tc.constraint_name, kcu.ordinal_position
+    `, [schema, table]);
+    const indexesResult = await client.query(`
+      SELECT indexname, indexdef
+      FROM pg_indexes
+      WHERE schemaname = $1 AND tablename = $2
+      ORDER BY indexname
+    `, [schema, table]);
+    const policiesResult = await client.query(`
+      SELECT policyname, permissive, roles, cmd, qual, with_check
+      FROM pg_policies
+      WHERE schemaname = $1 AND tablename = $2
+      ORDER BY policyname
+    `, [schema, table]);
+    let rowCount = null;
+    try {
+        rowCount = await getTableRowCount(client, schema, table);
+    }
+    catch {
+        rowCount = null;
+    }
+    const columns = columnsResult.rows.map((row) => ({
+        name: String(row.column_name),
+        dataType: String(row.data_type),
+        isNullable: String(row.is_nullable).toUpperCase() === "YES",
+        defaultValue: row.column_default === undefined
+            ? null
+            : truncateText(row.column_default, 120),
+    }));
+    return {
+        schemaTable: buildSchemaTable(schema, table),
+        kind: String(objectCheck.rows[0].kind),
+        rowCount,
+        columns,
+        primaryKey: primaryKeyResult.rows.map((row) => String(row.column_name)),
+        foreignKeys: foreignKeyResult.rows.map((row) => ({
+            constraintName: String(row.constraint_name),
+            columnName: String(row.column_name),
+            references: buildSchemaTable(String(row.foreign_table_schema), String(row.foreign_table_name)),
+            referencedColumn: String(row.foreign_column_name),
+        })),
+        indexes: indexesResult.rows.map((row) => ({
+            name: String(row.indexname),
+            definition: truncateText(row.indexdef, 180),
+        })),
+        security: {
+            rowLevelSecurityEnabled: Boolean(objectCheck.rows[0].row_security_enabled),
+            forceRowLevelSecurity: Boolean(objectCheck.rows[0].force_row_security),
+            policies: policiesResult.rows.map((row) => ({
+                name: String(row.policyname),
+                permissive: String(row.permissive),
+                roles: Array.isArray(row.roles)
+                    ? row.roles.map((role) => String(role))
+                    : [],
+                command: String(row.cmd),
+                using: truncateText(row.qual, 180),
+                withCheck: truncateText(row.with_check, 180),
+            })),
+        },
+    };
+}
+function createDefaultDependencies(server) {
+    return {
+        createClient: async (context) => createManagerPgClient(context, server?.cloudBaseOptions),
+    };
+}
+function isExecutePGSqlDatabase(value) {
+    return Boolean(value &&
+        typeof value === "object" &&
+        "executePGSql" in value &&
+        typeof value.executePGSql === "function");
+}
+function isCloudBaseWithCommonService(value) {
+    return Boolean(value &&
+        typeof value === "object" &&
+        "commonService" in value &&
+        typeof value.commonService === "function");
+}
+async function executeManagerPGSql(context, sql, cloudBaseOptions) {
+    const manager = await (0, cloudbase_manager_js_1.getCloudBaseManager)({
+        cloudBaseOptions: cloudBaseOptions
+            ? {
+                ...cloudBaseOptions,
+                envId: context.envId,
+            }
+            : {
+                envId: context.envId,
+            },
+    });
+    const options = {
+        Sql: sql,
+        Role: context.role,
+        EnvId: context.envId,
+    };
+    if (isExecutePGSqlDatabase(manager.database)) {
+        return manager.database.executePGSql(options);
+    }
+    if (isCloudBaseWithCommonService(manager)) {
+        const result = await manager.commonService("tcb", "2018-06-08").call({
+            Action: "ExecutePGSql",
+            Param: options,
+        });
+        return "Response" in result && result.Response ? result.Response : result;
+    }
+    throw new Error("Current @cloudbase/manager-node runtime does not expose database.executePGSql or commonService fallback. Upgrade to @cloudbase/manager-node >= 5.4.0.");
+}
+/** Call a CloudBase PG migration API via commonService fallback */
+async function callPgMigrationApi(context, action, params, cloudBaseOptions) {
+    const manager = await (0, cloudbase_manager_js_1.getCloudBaseManager)({
+        cloudBaseOptions: cloudBaseOptions
+            ? { ...cloudBaseOptions, envId: context.envId }
+            : { envId: context.envId },
+    });
+    if (!isCloudBaseWithCommonService(manager)) {
+        throw new Error("Current @cloudbase/manager-node runtime does not support migration APIs. Upgrade to @cloudbase/manager-node >= 5.4.0.");
+    }
+    const result = await manager.commonService("tcb", "2018-06-08").call({
+        Action: action,
+        Param: { EnvId: context.envId, ...params },
+    });
+    return "Response" in result && result.Response
+        ? result.Response
+        : result;
+}
+function parseManagerRows(result) {
+    const columns = result.Columns ?? [];
+    return (result.Rows ?? []).map((rowText) => {
+        let values;
+        try {
+            values = JSON.parse(rowText);
+        }
+        catch {
+            values = [];
+        }
+        const arrayValues = Array.isArray(values) ? values : [];
+        return Object.fromEntries(columns.map((column, index) => [column, arrayValues[index] ?? null]));
+    });
+}
+function renderPgLiteral(value) {
+    if (value === null || value === undefined) {
+        return "NULL";
+    }
+    if (typeof value === "number") {
+        return Number.isFinite(value) ? String(value) : "NULL";
+    }
+    if (typeof value === "boolean") {
+        return value ? "TRUE" : "FALSE";
+    }
+    if (value instanceof Date) {
+        return `'${value.toISOString().replace(/'/g, "''")}'`;
+    }
+    return `'${String(value).replace(/'/g, "''")}'`;
+}
+function renderParameterizedSql(sql, values) {
+    if (!values || values.length === 0) {
+        return sql;
+    }
+    return sql.replace(/\$(\d+)/g, (placeholder, indexText) => {
+        const index = Number(indexText);
+        if (!Number.isInteger(index) || index < 1 || index > values.length) {
+            return placeholder;
+        }
+        return renderPgLiteral(values[index - 1]);
+    });
+}
+function inferCommand(sql) {
+    return getSqlVerb(sql) || undefined;
+}
+function createManagerPgClient(context, cloudBaseOptions) {
+    return {
+        async connect() {
+            return undefined;
+        },
+        async query(sql, values) {
+            const renderedSql = renderParameterizedSql(sql, values);
+            const result = await executeManagerPGSql(context, renderedSql, cloudBaseOptions);
+            const rows = parseManagerRows(result);
+            return {
+                rows,
+                rowCount: result.AffectedRows ?? rows.length,
+                command: inferCommand(renderedSql),
+                fields: result.Columns?.map((name) => ({ name })) ?? [],
+            };
+        },
+        async end() {
+            return undefined;
+        },
+    };
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function ensurePgReady(context, deps, options) {
+    const maxAttempts = options?.maxAttempts ?? 20;
+    const retryDelayMs = options?.retryDelayMs ?? 1000;
+    let lastError;
+    for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+        try {
+            await withPgClient(context, deps, async (client) => {
+                await client.query("SELECT 1");
+            });
+            return;
+        }
+        catch (error) {
+            lastError = error;
+            if (attempt === maxAttempts) {
+                break;
+            }
+            await sleep(retryDelayMs);
+        }
+    }
+    const reason = lastError instanceof Error ? lastError.message : String(lastError);
+    throw new Error(`PostgreSQL is not ready after ${maxAttempts} attempts. Last error: ${reason}`);
+}
+async function handleInit(args, server, deps) {
+    const existing = await getPgContext(server);
+    const resolvedEnvId = args.envId ??
+        server.cloudBaseOptions?.envId ??
+        process.env.CLOUDBASE_ENV_ID ??
+        existing?.envId;
+    if (!resolvedEnvId) {
+        return buildPgToolResult({
+            success: false,
+            errorCode: "ENV_ID_REQUIRED",
+            message: "CloudBase PostgreSQL only supports the built-in cloud runtime. Provide envId or bind a CloudBase environment before calling managePgDatabase(action=init).",
+        });
+    }
+    const bootstrapResult = {
+        instanceId: args.instanceId ?? "cloudbase-pg",
+        defaultSchema: args.defaultSchema ?? "public",
+        status: "ready",
+        runtimeMode: "cloudbase-manager",
+        role: args.role ?? "cloudbase_admin",
+    };
+    const now = new Date().toISOString();
+    const context = {
+        envId: resolvedEnvId,
+        instanceId: bootstrapResult.instanceId,
+        defaultSchema: bootstrapResult.defaultSchema,
+        runtimeMode: "cloudbase-manager",
+        bootstrapMode: "cloud",
+        role: bootstrapResult.role,
+        createdAt: existing?.createdAt ?? now,
+        updatedAt: now,
+    };
+    await ensurePgReady(context, deps, deps.readyCheckOptions);
+    await savePgContext(server, context);
+    return buildPgToolResult({
+        success: true,
+        data: {
+            context: {
+                ...sanitizePgContext(context),
+            },
+            status: bootstrapResult.status,
+        },
+        message: "CloudBase PG 云端执行上下文已就绪。先查询对象或 schema，再执行写入 SQL。",
+        nextActions: [
+            buildNextAction(QUERY_PG_DATABASE, "objects", "List schema-qualified database objects before drilling into a specific table.", { action: "objects", limit: 20 }),
+            buildSchemaNextAction("Inspect a concrete schema-qualified table after you know which object matters.", `${context.defaultSchema}.your_table`),
+        ],
+    });
+}
+async function handleQueryContext(server) {
+    const context = await getPgContext(server);
+    if (!context) {
+        return buildMissingContextResult();
+    }
+    return buildPgToolResult({
+        success: true,
+        data: {
+            context: {
+                ...sanitizePgContext(context),
+            },
+        },
+        message: "Resolved current CloudBase PostgreSQL context.",
+        nextActions: [
+            buildNextAction(QUERY_PG_DATABASE, "objects", "List schema-qualified objects before inspecting an individual table.", { action: "objects", limit: 20 }),
+        ],
+    });
+}
+async function handleListObjects(args, context, deps) {
+    const limit = normalizeLimit(args.limit);
+    const objects = await withPgClient(context, deps, (client) => listObjects(client, args.schema, limit));
+    return buildPgToolResult({
+        success: true,
+        data: {
+            objects,
+            schemaFilter: args.schema ?? null,
+            limit,
+        },
+        message: objects.length > 0
+            ? `Listed ${objects.length} schema-qualified PostgreSQL objects. Inspect one object schema before writing SQL.`
+            : "No PostgreSQL objects matched the current filter.",
+        nextActions: objects.length > 0
+            ? [
+                buildSchemaNextAction("Inspect the most relevant object schema before querying data.", objects[0].schemaTable),
+            ]
+            : [
+                buildNextAction(QUERY_PG_DATABASE, "context", "Re-check the current PG context if no objects were expectedly returned.", { action: "context" }),
+            ],
+    });
+}
+async function handleMetadata(args, context, deps) {
+    const limit = normalizeLimit(args.limit);
+    const tables = await withPgClient(context, deps, (client) => summarizeMetadata(client, args.schema, limit));
+    return buildPgToolResult({
+        success: true,
+        data: {
+            tables,
+            schemaFilter: args.schema ?? null,
+            limit,
+        },
+        message: tables.length > 0
+            ? `Summarized ${tables.length} PostgreSQL objects with row-count and RLS hints. Use schema inspection before composing joins or mutations.`
+            : "No PostgreSQL objects matched the current metadata filter.",
+        nextActions: tables.length > 0
+            ? [
+                buildSchemaNextAction("Inspect the relevant table schema to confirm columns, keys, and policies.", tables[0].schemaTable),
+            ]
+            : [
+                buildNextAction(QUERY_PG_DATABASE, "objects", "List objects first if metadata is empty or too restrictive.", { action: "objects", schema: args.schema, limit }),
+            ],
+    });
+}
+async function handleReadOnlySql(args, context, deps) {
+    if (!args.sql?.trim()) {
+        return buildPgToolResult({
+            success: false,
+            errorCode: "SQL_REQUIRED",
+            message: "Provide a read-only SQL statement when action=sql.",
+        });
+    }
+    if (!isReadOnlySql(args.sql)) {
+        return buildPgToolResult({
+            success: false,
+            errorCode: "READ_ONLY_SQL_REQUIRED",
+            message: "queryPgDatabase(action=sql) only accepts read-only SQL. For DDL/DML (CREATE/ALTER/INSERT/UPDATE/DELETE/...), call managePgDatabase(action=execute) with confirm=true and the same SQL.",
+            nextActions: [
+                buildNextAction(MANAGE_PG_DATABASE, "execute", "Re-issue this statement via managePgDatabase(action=execute) with confirm=true.", { action: "execute", sql: args.sql, confirm: true }),
+                buildSchemaNextAction("Inspect schema first if you are deciding which write operation is needed.", `${context.defaultSchema}.your_table`),
+            ],
+        });
+    }
+    const limit = normalizeLimit(args.limit);
+    const limitedSql = buildLimitedReadOnlySql(args.sql, limit);
+    const result = await withPgClient(context, deps, (client) => client.query(limitedSql));
+    const summary = summarizeQueryResult(result, limit);
+    return buildPgToolResult({
+        success: true,
+        data: {
+            ...summary,
+            command: result.command ?? "SELECT",
+            rowCount: result.rowCount ?? summary.returnedRows,
+        },
+        message: summary.truncated
+            ? `Read-only SQL executed successfully. Showing ${summary.rows.length} of ${summary.returnedRows} rows to control token usage.`
+            : "Read-only SQL executed successfully.",
+        nextActions: [
+            buildSchemaNextAction("Inspect the table schema if you need to refine joins, filters, or mutations.", parseTargetTableFromSql(args.sql, context.defaultSchema) ??
+                `${context.defaultSchema}.your_table`),
+        ],
+    });
+}
+async function handleExecuteSql(args, context, deps) {
+    if (!args.sql?.trim()) {
+        return buildPgToolResult({
+            success: false,
+            errorCode: "SQL_REQUIRED",
+            message: "Provide a SQL statement when action=execute.",
+        });
+    }
+    const classification = classifySqlRisk(args.sql);
+    if (!classification.readOnly && !args.confirm) {
+        return buildPgToolResult({
+            success: false,
+            errorCode: "CONFIRM_REQUIRED",
+            message: `This SQL is classified as ${classification.risk}. Re-run managePgDatabase(action=execute) with the same sql and confirm=true to proceed.`,
+            data: {
+                classification,
+            },
+            nextActions: [
+                buildNextAction(MANAGE_PG_DATABASE, "execute", "Re-issue with confirm=true to actually run the SQL.", { action: "execute", sql: args.sql, confirm: true }),
+                buildNextAction(QUERY_PG_DATABASE, "metadata", "Inspect table size and shape before destructive changes.", { action: "metadata", limit: 20 }),
+            ],
+        });
+    }
+    const result = await withPgClient(context, deps, (client) => client.query(args.sql));
+    const targetTable = parseTargetTableFromSql(args.sql, context.defaultSchema);
+    return buildPgToolResult({
+        success: true,
+        data: {
+            classification,
+            command: result.command ?? getSqlVerb(args.sql),
+            rowCount: result.rowCount ?? null,
+            previewRows: result.rows
+                .slice(0, 5)
+                .map((row) => serializeValue(row)),
+            targetTable: targetTable ?? null,
+        },
+        message: "Write SQL executed successfully.",
+        nextActions: classification.risk === "schema_change" && targetTable
+            ? [
+                buildNextAction(QUERY_PG_DATABASE, "schema", "Inspect the table schema, columns, indexes, and RLS policies after schema changes.", {
+                    action: "schema",
+                    objectName: targetTable,
+                }),
+            ]
+            : [
+                buildNextAction(QUERY_PG_DATABASE, "sql", "Verify the mutation with a focused read-only SQL query.", {
+                    action: "sql",
+                    sql: targetTable
+                        ? `SELECT * FROM ${targetTable} LIMIT 20`
+                        : "SELECT 1",
+                    limit: 20,
+                }),
+            ],
+    });
+}
+async function handleDryRun(args) {
+    if (!args.sql?.trim()) {
+        return buildPgToolResult({
+            success: false,
+            errorCode: "SQL_REQUIRED",
+            message: "Provide a SQL statement when action=dryRun.",
+        });
+    }
+    const classification = classifySqlRisk(args.sql);
+    return buildPgToolResult({
+        success: true,
+        data: {
+            classification,
+            wouldExecute: false,
+            sqlPreview: args.sql.trim().slice(0, 500),
+        },
+        message: classification.readOnly
+            ? "SQL dry run completed. This statement is read-only; use queryPgDatabase(action=sql) to execute it."
+            : "SQL dry run completed. Write SQL requires managePgDatabase(action=execute, confirm=true).",
+        nextActions: [
+            buildNextAction(classification.readOnly ? QUERY_PG_DATABASE : MANAGE_PG_DATABASE, classification.readOnly ? "sql" : "execute", classification.readOnly
+                ? "Execute the read-only SQL through queryPgDatabase."
+                : "Execute the write SQL only after explicit confirmation.", classification.readOnly
+                ? { action: "sql", sql: args.sql, limit: 20 }
+                : { action: "execute", sql: args.sql, confirm: true }),
+        ],
+    });
+}
+async function handlePlanMigration(args, context, deps, cloudBaseOptions) {
+    if (!args.sql?.trim()) {
+        return buildPgToolResult({
+            success: false,
+            errorCode: "SQL_REQUIRED",
+            message: "Provide migration SQL when action=planMigration.",
+        });
+    }
+    try {
+        const result = await callPgMigrationApi(context, "PreviewPGUserMigrations", {
+            Sql: args.sql,
+        }, cloudBaseOptions);
+        return buildPgToolResult({
+            success: true,
+            data: result,
+            message: "Migration plan generated via PreviewPGUserMigrations.",
+            nextActions: [
+                buildNextAction(MANAGE_PG_DATABASE, "applyMigration", "Review the plan above. If it looks correct, call applyMigration to execute.", { action: "applyMigration", sql: args.sql, confirm: true }),
+            ],
+        });
+    }
+    catch (error) {
+        return buildPgToolResult({
+            success: false,
+            errorCode: "MIGRATION_API_ERROR",
+            message: `PreviewPGUserMigrations failed: ${error instanceof Error ? error.message : String(error)}`,
+        });
+    }
+}
+async function handleApplyMigration(args, context, deps, cloudBaseOptions) {
+    if (!args.sql?.trim()) {
+        return buildPgToolResult({
+            success: false,
+            errorCode: "SQL_REQUIRED",
+            message: "Provide migration SQL when action=applyMigration.",
+        });
+    }
+    if (args.confirm !== true) {
+        return buildPgToolResult({
+            success: false,
+            errorCode: "CONFIRM_REQUIRED",
+            message: "PushPGUserMigrations requires confirm=true. Run with confirm=true to proceed.",
+        });
+    }
+    try {
+        const result = await callPgMigrationApi(context, "PushPGUserMigrations", {
+            Sql: args.sql,
+        }, cloudBaseOptions);
+        return buildPgToolResult({
+            success: true,
+            data: result,
+            message: "Migrations applied via PushPGUserMigrations.",
+        });
+    }
+    catch (error) {
+        return buildPgToolResult({
+            success: false,
+            errorCode: "MIGRATION_API_ERROR",
+            message: `PushPGUserMigrations failed: ${error instanceof Error ? error.message : String(error)}`,
+        });
+    }
+}
+async function handleListMigrations(args, context, deps, cloudBaseOptions) {
+    try {
+        const result = await callPgMigrationApi(context, "ListPGUserMigrations", {}, cloudBaseOptions);
+        return buildPgToolResult({
+            success: true,
+            data: result,
+            message: "Migration list retrieved via ListPGUserMigrations.",
+        });
+    }
+    catch (error) {
+        return buildPgToolResult({
+            success: false,
+            errorCode: "MIGRATION_API_ERROR",
+            message: `ListPGUserMigrations failed: ${error instanceof Error ? error.message : String(error)}`,
+        });
+    }
+}
+async function handleMigrationDetail(args, context, deps, cloudBaseOptions) {
+    if (!args.objectName?.trim()) {
+        return buildPgToolResult({
+            success: false,
+            errorCode: "OBJECT_NAME_REQUIRED",
+            message: "Provide objectName (migration ID) when action=migrationDetail.",
+        });
+    }
+    try {
+        const result = await callPgMigrationApi(context, "DescribePGUserMigration", {
+            ObjectId: args.objectName,
+        }, cloudBaseOptions);
+        return buildPgToolResult({
+            success: true,
+            data: result,
+            message: "Migration detail retrieved via DescribePGUserMigration.",
+        });
+    }
+    catch (error) {
+        return buildPgToolResult({
+            success: false,
+            errorCode: "MIGRATION_API_ERROR",
+            message: `DescribePGUserMigration failed: ${error instanceof Error ? error.message : String(error)}`,
+        });
+    }
+}
+async function handleRollbackMigration(args, context, deps, cloudBaseOptions) {
+    if (!args.objectName?.trim()) {
+        return buildPgToolResult({
+            success: false,
+            errorCode: "OBJECT_NAME_REQUIRED",
+            message: "Provide objectName (migration ID) when action=rollbackMigration.",
+        });
+    }
+    if (args.confirm !== true) {
+        return buildPgToolResult({
+            success: false,
+            errorCode: "CONFIRM_REQUIRED",
+            message: "RollbackPGUserMigrations requires confirm=true. Run with confirm=true to proceed.",
+        });
+    }
+    try {
+        const result = await callPgMigrationApi(context, "RollbackPGUserMigrations", {
+            ObjectId: args.objectName,
+        }, cloudBaseOptions);
+        return buildPgToolResult({
+            success: true,
+            data: result,
+            message: "Migration rolled back via RollbackPGUserMigrations.",
+        });
+    }
+    catch (error) {
+        return buildPgToolResult({
+            success: false,
+            errorCode: "MIGRATION_API_ERROR",
+            message: `RollbackPGUserMigrations failed: ${error instanceof Error ? error.message : String(error)}`,
+        });
+    }
+}
+async function handleGetPgSchema(args, context, deps) {
+    const objectName = args.objectName ?? "";
+    const parsed = parseSchemaQualifiedName(objectName);
+    if (!parsed) {
+        return buildPgToolResult({
+            success: false,
+            errorCode: "SCHEMA_QUALIFIED_NAME_REQUIRED",
+            message: "queryPgDatabase(action=schema) requires a schema-qualified object name like public.users.",
+        });
+    }
+    const schemaInfo = await withPgClient(context, deps, (client) => readSchemaInfo(client, parsed.schema, parsed.name));
+    if (!schemaInfo) {
+        return buildPgToolResult({
+            success: false,
+            errorCode: "OBJECT_NOT_FOUND",
+            message: `PostgreSQL object ${objectName} was not found in the current CloudBase PG context.`,
+            nextActions: [
+                buildNextAction(QUERY_PG_DATABASE, "objects", "List schema-qualified objects to find the correct table or view name.", { action: "objects", schema: parsed.schema, limit: 20 }),
+            ],
+        });
+    }
+    const security = schemaInfo.security;
+    const rlsWithoutPolicies = security.rowLevelSecurityEnabled && security.policies.length === 0;
+    return buildPgToolResult({
+        success: true,
+        data: schemaInfo,
+        message: rlsWithoutPolicies
+            ? "Resolved PostgreSQL schema, key, index, and security details. WARNING: RLS is enabled but no policies were found; browser/client reads and writes will be denied until policies are created or RLS is disabled."
+            : "Resolved PostgreSQL schema, key, index, and security details. Use this structure before composing multi-table SQL.",
+        nextActions: [
+            ...(rlsWithoutPolicies
+                ? [
+                    buildNextAction(MANAGE_PG_DATABASE, "execute", "Create SELECT/INSERT/UPDATE/DELETE RLS policies or disable RLS before browser-side app.rdb() CRUD.", {
+                        action: "execute",
+                        sql: `-- Example: CREATE POLICY ... ON ${objectName} FOR SELECT USING (true);`,
+                        confirm: true,
+                    }),
+                ]
+                : []),
+            buildNextAction(QUERY_PG_DATABASE, "metadata", "Check row-count and RLS hints for nearby tables before more complex queries.", { action: "metadata", schema: parsed.schema, limit: 20 }),
+            buildNextAction(QUERY_PG_DATABASE, "sql", "Run a focused read-only query now that the schema is known.", {
+                action: "sql",
+                sql: `SELECT * FROM ${objectName} LIMIT 20`,
+                limit: 20,
+            }),
+        ],
+    });
+}
+function registerPGDatabaseTools(server, providedDeps) {
+    const deps = {
+        ...createDefaultDependencies(server),
+        ...providedDeps,
+    };
+    server.registerTool?.(QUERY_PG_DATABASE, {
+        title: "查询 PostgreSQL 上下文、对象、元数据或执行只读 SQL",
+        description: "查询 CloudBase PostgreSQL 数据库。支持获取当前 PG 上下文、列出带 schema 的数据库对象、读取轻量元数据、检查单个对象结构，以及执行只读 SQL。",
         inputSchema: {
             action: zod_1.z
-                .enum(exports.QUERY_FUNCTION_ACTIONS)
-                .describe("只读操作类型：" +
-                "\n- `listFunctions`: 列出所有 CloudBase 云函数" +
-                "\n- `getFunctionDetail`: 获取 CloudBase 云函数详情（需要 functionName）" +
-                "\n- `listFunctionLogs`: 查询 CloudBase 云函数执行日志（需要 functionName）" +
-                "\n- `getFunctionLogDetail`: 获取日志详情（需要 requestId）" +
-                "\n- `listFunctionLayers`: 列出函数绑定的层" +
-                "\n- `listLayers`: 列出所有层" +
-                "\n- `listLayerVersions`: 列出层的版本（注意：是 Versions 不是 Version）" +
-                "\n- `getLayerVersionDetail`: 获取层版本详情" +
-                "\n- `listFunctionTriggers`: 列出函数触发器（用于查看定时任务 / cron / timer 配置）" +
-                "\n- `getFunctionDownloadUrl`: 获取函数代码下载地址"),
-            functionName: zod_1.z
-                .string()
-                .optional()
-                .describe("CloudBase 云函数名称。`getFunctionDetail`、`listFunctionLogs`、`listFunctionLayers`、`listFunctionTriggers`、`getFunctionDownloadUrl` 时必填"),
-            limit: zod_1.z.number().optional().describe("分页数量（limit）。列表类 action 可选，默认值由后端决定"),
-            offset: zod_1.z.number().optional().describe("分页偏移（offset）。列表类 action 可选，默认 0"),
-            codeSecret: zod_1.z.string().optional().describe("代码保护密钥，用于解密函数代码"),
-            startTime: zod_1.z
+                .enum(QUERY_ACTIONS)
+                .describe("操作类型：context=获取当前 PostgreSQL 上下文；objects=列出带 schema 的数据库对象；metadata=获取轻量表元数据；schema=检查单个带 schema 的对象结构；sql=执行只读 SQL"),
+            sql: zod_1.z.string().optional().describe("action=sql 时使用的只读 SQL"),
+            objectName: zod_1.z
                 .string()
                 .optional()
-                .describe("日志查询开始时间，格式必须为 YYYY-MM-DD HH:mm:ss（如 2024-01-01 00:00:00）。" +
-                "与 endTime 间隔不能超过一天。不传时默认查询最近一天"),
-            endTime: zod_1.z
+                .describe("action=schema 时使用的带 schema 的 PostgreSQL 对象名，例如 public.users"),
+            schema: zod_1.z
                 .string()
                 .optional()
-                .describe("日志查询结束时间，格式必须为 YYYY-MM-DD HH:mm:ss（如 2024-01-01 23:59:59）。" +
-                "与 startTime 间隔不能超过一天。不传时默认为当前时间"),
-            requestId: zod_1.z
-                .string()
+                .describe("可选的 schema 过滤条件，用于 action=objects 或 action=metadata"),
+            limit: zod_1.z
+                .number()
+                .int()
+                .min(1)
+                .max(200)
                 .optional()
-                .describe("日志请求 ID。`getFunctionLogDetail` 操作必填，可从 `listFunctionLogs` 结果中获取"),
-            qualifier: zod_1.z.string().optional().describe("函数版本别名，如 $LATEST、$DEFAULT。日志查询时可选"),
-            runtime: zod_1.z.string().optional().describe("层查询的运行时筛选，如 Nodejs18.15"),
-            searchKey: zod_1.z.string().optional().describe("层名称搜索关键字"),
-            layerName: zod_1.z.string().optional().describe("层名称。`listLayerVersions`、`getLayerVersionDetail` 操作必填"),
-            layerVersion: zod_1.z.number().optional().describe("层版本号。`getLayerVersionDetail` 操作必填"),
+                .describe("可选的摘要数量上限，用于对象、元数据或 SQL 返回行数，默认 20，最大 200。"),
         },
         annotations: {
             readOnlyHint: true,
             openWorldHint: true,
-            category: "functions",
+            category: CATEGORY,
         },
-    }, async (input) => withEnvelope(() => handleQueryFunctions(input)));
-    server.registerTool?.("manageFunctions", {
-        title: "管理 CloudBase 云函数",
-        description: "CloudBase 云函数统一写入口。支持创建函数、更新代码、更新配置、调用函数、管理定时跑 / 定时任务 / scheduled job 的 timer 触发器和层绑定。" +
-            "如果要创建 cron 定时任务，先用 createFunction 创建函数，再用 createFunctionTrigger 创建 timer 触发器（支持7段cron表达式），deleteFunctionTrigger 删除触发器。" +
-            "危险操作需要显式 confirm=true。",
+    }, async (args) => {
+        if (args.action === "context") {
+            return handleQueryContext(server);
+        }
+        const context = await getPgContext(server);
+        if (!context) {
+            return buildMissingContextResult();
+        }
+        switch (args.action) {
+            case "objects":
+                return handleListObjects(args, context, deps);
+            case "metadata":
+                return handleMetadata(args, context, deps);
+            case "schema":
+                return handleGetPgSchema(args, context, deps);
+            case "sql":
+                return handleReadOnlySql(args, context, deps);
+            default:
+                return buildPgToolResult({
+                    success: false,
+                    errorCode: "UNSUPPORTED_ACTION",
+                    message: `Unsupported PostgreSQL query action: ${args.action}`,
+                });
+        }
+    });
+    server.registerTool?.(MANAGE_PG_DATABASE, {
+        title: "管理 PostgreSQL 上下文或执行写入 SQL",
+        description: "管理 CloudBase PostgreSQL MCP 上下文。仅支持 CloudBase 内置 PostgreSQL 云端 Manager SDK 执行路径、SQL 风险预检、迁移规划，以及在显式确认后执行写入 SQL。",
         inputSchema: {
             action: zod_1.z
-                .enum(exports.MANAGE_FUNCTION_ACTIONS)
-                .describe("写操作类型，例如 createFunction、updateFunctionCode、invokeFunction、deleteFunction、" +
-                "createFunctionTrigger（定时任务 / cron / timer）、deleteFunctionTrigger、attachLayer、detachLayer"),
-            func: CREATE_FUNCTION_SCHEMA.optional().describe("createFunction 操作的函数配置"),
-            functionRootPath: zod_1.z.string().optional().describe("创建或更新函数代码时默认推荐的本地目录方式。" +
-                "必须是直接包含函数文件夹的目录绝对路径（如 /abs/path/cloudfunctions 或 /abs/path/functions），" +
-                "不要传项目根目录（如 /abs/path），也不要传到函数名子目录（如 /abs/path/cloudfunctions/hello）。" +
-                "本地应按 cloudfunctions/<functionName>/index.js 或 functions/<functionName>/index.js 布局，" +
-                "此参数传 cloudfunctions 或 functions 目录的绝对路径。" +
-                "SDK 会自动拼接函数名子目录，无需预先压缩 zip 或 base64 编码。"),
-            force: zod_1.z.boolean().optional().describe("createFunction 时是否覆盖"),
-            functionName: zod_1.z.string().optional().describe("函数名称。大多数 action 使用该字段作为统一目标"),
-            zipFile: zod_1.z.string().optional().describe("仅兼容特殊场景：预先准备好的代码包 base64 编码。普通 createFunction/updateFunctionCode 默认不要先压缩 zip，优先使用 functionRootPath。"),
-            handler: zod_1.z.string().optional().describe("函数入口"),
-            timeout: zod_1.z.number().optional().describe("配置更新时的超时时间"),
-            envVariables: zod_1.z.record(zod_1.z.string()).optional().describe("配置更新时要合并的环境变量"),
-            vpc: VPC_SCHEMA.optional().describe("配置更新时的 VPC 信息"),
-            params: zod_1.z.record(zod_1.z.any()).optional().describe("invokeFunction 的调用参数"),
-            triggers: zod_1.z
-                .array(TRIGGER_SCHEMA)
+                .enum(MANAGE_ACTIONS)
+                .describe("操作类型：init=初始化或绑定 PostgreSQL 上下文；execute=执行已确认的写入 SQL 或 DDL；dryRun=只分析 SQL 风险不执行；planMigration=通过 PreviewPGUserMigrations 预览迁移计划；applyMigration=通过 PushPGUserMigrations 应用迁移；listMigrations=查询已应用的 Migration 列表；migrationDetail=查看单条 Migration 详情；rollbackMigration=回滚指定 Migration"),
+            sql: zod_1.z
+                .string()
                 .optional()
-                .describe("createFunctionTrigger 的触发器列表，用于定时跑 / 定时任务 / scheduled job。timer 触发器使用7段 cron 表达式（秒 分 时 日 月 星期 年），" +
-                '如 "0 */5 * * * * *" 表示每5分钟执行一次'),
-            triggerName: zod_1.z.string().optional().describe("deleteFunctionTrigger 的目标触发器名称"),
-            layerName: zod_1.z.string().optional().describe("层名称"),
-            layerVersion: zod_1.z.number().optional().describe("层版本号"),
-            contentPath: zod_1.z.string().optional().describe("层内容路径，可为目录或 ZIP 文件"),
-            base64Content: zod_1.z.string().optional().describe("层内容的 base64 编码"),
-            runtimes: zod_1.z.array(zod_1.z.string()).optional().describe("层适用的运行时列表"),
-            description: zod_1.z.string().optional().describe("层版本描述"),
-            licenseInfo: zod_1.z.string().optional().describe("层许可证信息"),
-            layers: zod_1.z
-                .array(MANAGE_LAYER_SCHEMA)
+                .describe("action=execute、dryRun、planMigration 或 applyMigration 使用的 SQL 语句"),
+            confirm: zod_1.z
+                .boolean()
                 .optional()
-                .describe("updateFunctionLayers 的目标层列表，顺序即最终顺序"),
-            codeSecret: zod_1.z.string().optional().describe("层绑定时的代码保护密钥"),
-            confirm: zod_1.z.boolean().optional().describe("危险操作确认开关。deleteFunction、deleteFunctionTrigger、deleteLayerVersion、detachLayer 等删除类操作需要显式传入 confirm=true"),
+                .describe("执行任何写入 SQL 前都需要显式设置为 true。"),
+            envId: zod_1.z
+                .string()
+                .optional()
+                .describe("可选的 CloudBase 环境 ID，不传时使用当前 MCP 环境。"),
+            instanceId: zod_1.z
+                .string()
+                .optional()
+                .describe("可选的 PostgreSQL 逻辑实例标识。"),
+            defaultSchema: zod_1.z
+                .string()
+                .optional()
+                .describe("默认 schema，会保存到 PG 上下文中，默认 public。"),
+            role: zod_1.z
+                .string()
+                .optional()
+                .describe("可选的 PostgreSQL role，会传给 Manager SDK executePGSql；例如需要管理策略时可传 postgres。"),
+            objectName: zod_1.z
+                .string()
+                .optional()
+                .describe("action=migrationDetail 或 rollbackMigration 时使用的 migration ID。"),
         },
         annotations: {
             readOnlyHint: false,
             destructiveHint: true,
             idempotentHint: false,
             openWorldHint: true,
-            category: "functions",
+            category: CATEGORY,
         },
-    }, async (input) => withEnvelope(() => handleManageFunctions(input)));
+    }, async (args) => {
+        switch (args.action) {
+            case "init":
+                return handleInit(args, server, deps);
+            case "execute": {
+                const context = await getPgContext(server);
+                if (!context) {
+                    return buildMissingContextResult();
+                }
+                return handleExecuteSql(args, context, deps);
+            }
+            case "dryRun":
+                return handleDryRun(args);
+            case "planMigration":
+            case "applyMigration":
+            case "listMigrations":
+            case "migrationDetail":
+            case "rollbackMigration": {
+                const migrationCtx = await getPgContext(server);
+                if (!migrationCtx) {
+                    return buildMissingContextResult();
+                }
+                const cbOpts = server.cloudBaseOptions;
+                switch (args.action) {
+                    case "planMigration": return handlePlanMigration(args, migrationCtx, deps, cbOpts);
+                    case "applyMigration": return handleApplyMigration(args, migrationCtx, deps, cbOpts);
+                    case "listMigrations": return handleListMigrations(args, migrationCtx, deps, cbOpts);
+                    case "migrationDetail": return handleMigrationDetail(args, migrationCtx, deps, cbOpts);
+                    case "rollbackMigration": return handleRollbackMigration(args, migrationCtx, deps, cbOpts);
+                    default: return buildPgToolResult({ success: false, errorCode: "UNSUPPORTED_ACTION", message: `Unsupported action: ${args.action}` });
+                }
+            }
+            default:
+                return buildPgToolResult({
+                    success: false,
+                    errorCode: "UNSUPPORTED_ACTION",
+                    message: `Unsupported PostgreSQL manage action: ${args.action}`,
+                });
+        }
+    });
 }
 
 
-/***/ }),
-
-/***/ 6220:
-/***/ ((module) => {
-
-module.exports = __WEBPACK_EXTERNAL_MODULE_ws__;
-
 /***/ }),
 
 /***/ 6485:
@@ -10901,7 +12495,7 @@ function registerPermissionTools(server) {
     };
     server.registerTool?.("queryPermissions", {
         title: "查询 CloudBase 权限与用户配置",
-        description: "查询 CloudBase 权限与用户配置，支持查询资源权限（数据库/云函数/存储桶等）、角色列表/详情、应用用户列表/详情。\n\n示例：\n- 查询存储桶权限：`action=\"getResourcePermission\", resourceType=\"storage\", resourceId=\"bucket-name\"`",
+        description: "查询 CloudBase 权限与用户配置，支持查询资源权限（数据库/云函数/存储桶等）、角色列表/详情、应用用户列表/详情。\n\n示例：\n- 查询存储桶权限：`action=\"getResourcePermission\", resourceType=\"storage\", resourceId=\"bucket-name\"`\n\n📌 跨后端边界提示：调用前先用 `envQuery(action=\"info\", envId=...)` 看 `EnvInfo.RuntimeBackends`。`resourceType=\"noSqlDatabase\"` 查询的是 CloudBase NoSQL 集合规则，与 CloudBase PostgreSQL（PG）表的行级安全（RLS）是两套独立机制——同一个 PG 环境里 NoSQL 集合若仍在使用，对那些集合查询本工具结果**仍然有效**。要查 PG 表 RLS，请改用 `queryPgDatabase(action=\"sql\", sql=\"SELECT * FROM pg_policies WHERE tablename=...\")`。本工具不涉及 MySQL 权限。",
         inputSchema: {
             action: zod_1.z.enum(QUERY_PERMISSION_ACTIONS),
             resourceType: zod_1.z
@@ -11062,7 +12656,7 @@ function registerPermissionTools(server) {
     }));
     server.registerTool?.("managePermissions", {
         title: "管理 CloudBase 权限与用户配置",
-        description: "管理 CloudBase 权限与用户配置，支持修改资源权限（数据库/云函数/存储桶等）、角色管理、成员与策略增删、应用用户 CRUD。\n\n示例：\n- 设置存储桶为私有：`action=\"updateResourcePermission\", resourceType=\"storage\", resourceId=\"bucket-name\", permission=\"PRIVATE\"`\n- 创建角色：`action=\"createRole\", roleName=\"admin\", roleIdentity=\"admin\"`\n\n注意：`createUser` / `updateUser` 是环境侧应用用户管理能力，适合测试账号、管理员或预置用户，不应替代浏览器里的 Web SDK 注册表单。前端用户名密码注册应使用 `auth.signUp({ username, password })`，登录应使用 `auth.signInWithPassword({ username, password })`。`securityRule` 的详细语义取决于 `resourceType`，请参考对应官方文档。",
+        description: "管理 CloudBase 权限与用户配置，支持修改资源权限（数据库/云函数/存储桶等）、角色管理、成员与策略增删、应用用户 CRUD。\n\n示例：\n- 设置存储桶为私有：`action=\"updateResourcePermission\", resourceType=\"storage\", resourceId=\"bucket-name\", permission=\"PRIVATE\"`\n- 创建角色：`action=\"createRole\", roleName=\"admin\", roleIdentity=\"admin\"`\n\n注意：`createUser` / `updateUser` 是环境侧应用用户管理能力，适合测试账号、管理员或预置用户，不应替代浏览器里的 Web SDK 注册表单；前端用户名密码注册应使用 `auth.signUp({ username, password })`，登录应使用 `auth.signInWithPassword({ username, password })`。直接在浏览器里用 `auth.signUp` 创建用户名密码用户取决于 SDK/provider 支持，使用前必须验证；不支持时应走后端或管理端边界，不能在浏览器暴露密钥。`securityRule` 的详细语义取决于 `resourceType`：`doc._openid`、`auth.openid`、查询条件子集校验，以及 `create` / `update` / `delete` JSON 模板仅适用于 `resourceType=\"noSqlDatabase\"` 的文档数据库安全规则；配置 `function` 或 `storage` 时，请参考各自官方安全规则文档，而不是复用 NoSQL 模板。\n\n📌 跨后端边界提示：调用前先用 `envQuery(action=\"info\", envId=...)` 看 `EnvInfo.RuntimeBackends`：\n- `resourceType=\"noSqlDatabase\"` 仅作用于 CloudBase NoSQL 文档数据库的集合；CloudBase PostgreSQL（PG）表的行级权限**不**受它控制——PG 表请改用 RLS：`managePgDatabase(action=\"execute\", confirm=true)` 跑 `ALTER TABLE ... ENABLE ROW LEVEL SECURITY` 与 `CREATE POLICY ...`。同一个 PG 环境里如果还有 NoSQL 集合在用，对那些**集合**继续使用 `noSqlDatabase` 规则是正确的——不是\"PG 环境就禁用本工具\"。\n- `resourceType=\"storage\"` 控制的是 NoSQL/COS 存储桶 ACL；PG 的 `pgstore` bucket 不在此 `resourceType` 覆盖范围内。\n- 本工具不涉及 MySQL；MySQL 数据库权限请走 MySQL 自身的 GRANT/REVOKE 语句（通过 `manageSqlDatabase`）。",
         inputSchema: {
             action: zod_1.z.enum(MANAGE_PERMISSION_ACTIONS),
             resourceType: zod_1.z
@@ -11752,7 +13346,7 @@ function registerSetupTools(server) {
     server.registerTool("downloadTemplate", {
         title: "下载项目模板",
         description: `自动下载并部署CloudBase项目模板。
-**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.21.1" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
+**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.22.0-beta.0" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
         inputSchema: {
             template: zod_1.z
                 .enum(["react", "vue", "miniprogram", "uniapp", "rules"])
@@ -14488,6 +16082,201 @@ function registerDownloadTools(server) {
 }
 
 
+/***/ }),
+
+/***/ 9189:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.registerPGStorageTools = registerPGStorageTools;
+const zod_1 = __webpack_require__(2971);
+const tool_result_js_1 = __webpack_require__(9835);
+const CATEGORY = "PostgreSQL storage";
+const QUERY_PG_STORAGE = "queryPgStorage";
+const STORAGE_ACTIONS = [
+    "buckets",
+    "config",
+    "uploadPlan",
+    "objectInfo",
+    "signUpload",
+    "signDownload",
+];
+function buildPgStorageResult(payload) {
+    return (0, tool_result_js_1.buildJsonToolResult)(payload);
+}
+function requireBucket(args) {
+    if (!args.bucket?.trim()) {
+        return buildPgStorageResult({
+            success: false,
+            errorCode: "BUCKET_REQUIRED",
+            message: "Provide bucket when querying PostgreSQL storage.",
+        });
+    }
+    return undefined;
+}
+function normalizeObjects(args) {
+    if (args.objects?.length) {
+        return args.objects.map((object) => ({
+            objectKey: object.objectKey,
+            contentType: object.contentType ?? "application/octet-stream",
+            sizeBytes: object.sizeBytes ?? null,
+        }));
+    }
+    const objectKeys = args.objectKeys?.length
+        ? args.objectKeys
+        : args.objectKey
+            ? [args.objectKey]
+            : [];
+    return objectKeys.map((objectKey) => ({
+        objectKey,
+        contentType: "application/octet-stream",
+        sizeBytes: null,
+    }));
+}
+function buildHttpApiPlan(server, bucket) {
+    const envId = server.cloudBaseOptions?.envId ?? "${envId}";
+    const region = server.cloudBaseOptions?.region ?? "${region}";
+    return {
+        envId,
+        region,
+        bucket,
+        auth: "accessToken",
+        transport: "CloudBase HTTP API",
+        endpointTemplate: "https://api.weixin.qq.com/tcb/{storageAction}?access_token={accessToken}",
+        headersTemplate: {
+            "content-type": "application/json",
+        },
+        bodyTemplate: {
+            env: envId,
+            bucket,
+        },
+    };
+}
+async function handleBuckets(server) {
+    return buildPgStorageResult({
+        success: true,
+        data: {
+            capability: "storageManagerSdkOrHttpApi",
+            envId: server.cloudBaseOptions?.envId ?? null,
+            supportedActions: ["buckets", "config", "uploadPlan", "objectInfo"],
+            note: "PG environment storage is exposed as metadata and implementation plans in MCP. Application data-plane upload/download should use SDK or HTTP API code.",
+        },
+        message: "Resolved PostgreSQL storage capability summary. Use uploadPlan for application-side upload implementation.",
+    });
+}
+async function handleUploadPlan(args, server) {
+    const missingBucket = requireBucket(args);
+    if (missingBucket)
+        return missingBucket;
+    const objects = normalizeObjects(args);
+    const bucket = args.bucket;
+    return buildPgStorageResult({
+        success: true,
+        data: {
+            action: "uploadPlan",
+            uploadMode: "directHttpApi",
+            implementation: "use_sdk_or_http_api_in_app_code",
+            ...buildHttpApiPlan(server, bucket),
+            objectCount: objects.length,
+            objects,
+            constraints: {
+                mcpDoesNotReadLocalFiles: true,
+                mcpDoesNotStreamFileContent: true,
+                noSignedUrlByDefault: true,
+                multiFileOutputIsMetadataOnly: true,
+            },
+            steps: [
+                "Get an application-side or service-side access token.",
+                "Call the CloudBase storage HTTP API or Manager SDK from application code.",
+                "Upload file bytes outside MCP, then call objectInfo if metadata verification is needed.",
+            ],
+        },
+        message: "Generated an HTTP API upload plan without signed URLs or file content. This keeps MCP token usage stable for multi-file uploads.",
+    });
+}
+async function handleObjectInfo(args, server) {
+    const missingBucket = requireBucket(args);
+    if (missingBucket)
+        return missingBucket;
+    const objectKeys = normalizeObjects(args).map((object) => object.objectKey);
+    return buildPgStorageResult({
+        success: true,
+        data: {
+            action: "objectInfo",
+            ...buildHttpApiPlan(server, args.bucket),
+            objectKeys,
+            implementation: "use_sdk_or_http_api_in_app_code",
+            mcpFileIo: false,
+        },
+        message: "Generated an object metadata query plan. Use application code or service code for actual storage data-plane calls.",
+    });
+}
+async function handleSignedUrl(args) {
+    const missingBucket = requireBucket(args);
+    if (missingBucket)
+        return missingBucket;
+    return buildPgStorageResult({
+        success: false,
+        errorCode: "SIGNED_URL_NOT_DEFAULT",
+        data: {
+            action: args.action,
+            bucket: args.bucket,
+            expiresIn: args.expiresIn ?? 900,
+            recommendation: "Use queryPgStorage(action=uploadPlan) and HTTP API/SDK application code for multi-file flows.",
+        },
+        message: "Signed URL generation is intentionally not the default PG storage path because multi-file signed outputs waste tokens. Use uploadPlan unless a delegated one-off upload/download is explicitly required.",
+    });
+}
+function registerPGStorageTools(server) {
+    server.registerTool?.(QUERY_PG_STORAGE, {
+        title: "查询 PostgreSQL 环境云存储能力和上传方案",
+        description: "查询 CloudBase PostgreSQL 环境下的云存储能力。返回 bucket/config 能力摘要、对象信息查询方案，以及基于 HTTP API 或 SDK 的上传实现方案；不会读取本地文件，也不会默认输出大量签名 URL。",
+        inputSchema: {
+            action: zod_1.z
+                .enum(STORAGE_ACTIONS)
+                .describe("操作类型：buckets/config=查询存储能力摘要；uploadPlan=生成 HTTP API/SDK 上传方案；objectInfo=生成对象元信息查询方案；signUpload/signDownload=显式的一次性签名 URL 请求占位"),
+            bucket: zod_1.z.string().optional().describe("云存储 bucket 名称"),
+            objectKey: zod_1.z.string().optional().describe("单个对象 key"),
+            objectKeys: zod_1.z.array(zod_1.z.string()).optional().describe("多个对象 key，用于对象元信息查询规划"),
+            objects: zod_1.z
+                .array(zod_1.z.object({
+                objectKey: zod_1.z.string(),
+                contentType: zod_1.z.string().optional(),
+                sizeBytes: zod_1.z.number().int().nonnegative().optional(),
+            }))
+                .optional()
+                .describe("待上传对象的元信息。文件字节内容不会通过 MCP 传递。"),
+            expiresIn: zod_1.z.number().int().min(60).max(86400).optional().describe("签名 URL 有效期，单位秒，范围 60 到 86400。"),
+        },
+        annotations: {
+            readOnlyHint: true,
+            openWorldHint: true,
+            category: CATEGORY,
+        },
+    }, async (args) => {
+        switch (args.action) {
+            case "buckets":
+            case "config":
+                return handleBuckets(server);
+            case "uploadPlan":
+                return handleUploadPlan(args, server);
+            case "objectInfo":
+                return handleObjectInfo(args, server);
+            case "signUpload":
+            case "signDownload":
+                return handleSignedUrl(args);
+            default:
+                return buildPgStorageResult({
+                    success: false,
+                    errorCode: "UNSUPPORTED_ACTION",
+                    message: `Unsupported PostgreSQL storage action: ${args.action}`,
+                });
+        }
+    });
+}
+
+
 /***/ }),
 
 /***/ 9192:
@@ -14902,6 +16691,13 @@ function registerAgentTools(server) {
 }
 
 
+/***/ }),
+
+/***/ 9627:
+/***/ ((module) => {
+
+module.exports = __WEBPACK_EXTERNAL_MODULE_node_fs_75ed2103__;
+
 /***/ }),
 
 /***/ 9684:
@@ -15009,6 +16805,44 @@ const zod_1 = __webpack_require__(2971);
 const cloudbase_manager_js_1 = __webpack_require__(3431);
 const tool_result_js_1 = __webpack_require__(9835);
 const CATEGORY = "SQL database";
+const MYSQL_GATE_CACHE = new Map();
+/**
+ * Check whether MySQL tools should be blocked because the env is in PG-only mode.
+ * Returns an error result if blocked, or null if MySQL is available/can't be determined.
+ */
+async function checkMysqlGate(server) {
+    const { envId } = server.cloudBaseOptions ?? {};
+    if (!envId)
+        return null;
+    if (MYSQL_GATE_CACHE.has(envId)) {
+        if (MYSQL_GATE_CACHE.get(envId))
+            return null; // cached as available
+        // cached as blocked — return the gate error
+        return (0, tool_result_js_1.buildJsonToolResult)({
+            success: false,
+            errorCode: "MYSQL_NOT_AVAILABLE",
+            message: `This environment (${envId}) does not have MySQL. Use managePgDatabase / queryPgDatabase instead.`,
+            nextActions: [{ tool: "managePgDatabase", params: { action: "execute" }, description: "Use managePgDatabase" }],
+        });
+    }
+    try {
+        const manager = await (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions: { envId } });
+        const envInfo = await manager.env.getEnvInfo?.();
+        const backends = envInfo?.EnvInfo?.RuntimeBackends;
+        if (backends?.postgresql === true && backends?.mysql !== true) {
+            MYSQL_GATE_CACHE.set(envId, false);
+            return (0, tool_result_js_1.buildJsonToolResult)({
+                success: false,
+                errorCode: "MYSQL_NOT_AVAILABLE",
+                message: `This environment (${envId}) has PostgreSQL enabled but MySQL is NOT available. Use managePgDatabase / queryPgDatabase instead of manageSqlDatabase / querySqlDatabase.`,
+                nextActions: [{ tool: "managePgDatabase", params: { action: "execute" }, description: "Use managePgDatabase for PostgreSQL operations" }],
+            });
+        }
+    }
+    catch { /* probe failure — allow through */ }
+    MYSQL_GATE_CACHE.set(envId, true);
+    return null;
+}
 const QUERY_SQL_DATABASE = "querySqlDatabase";
 const MANAGE_SQL_DATABASE = "manageSqlDatabase";
 const QUERY_PERMISSIONS = "queryPermissions";
@@ -15836,8 +17670,8 @@ function registerSQLDatabaseTools(server) {
         server,
     };
     server.registerTool?.(QUERY_SQL_DATABASE, {
-        title: "Query SQL database state or execute read-only SQL",
-        description: "Query SQL database information. Supports read-only SQL execution, MySQL provisioning result lookup, MySQL task status lookup, and current instance context discovery.",
+        title: "查询 CloudBase MySQL 数据库状态或执行只读 SQL",
+        description: "查询 CloudBase MySQL 数据库信息。支持执行只读 SQL、查询 MySQL 开通结果、查询 MySQL 任务状态，以及获取当前实例上下文信息。",
         inputSchema: {
             action: zod_1.z
                 .enum(QUERY_ACTIONS)
@@ -15864,6 +17698,9 @@ function registerSQLDatabaseTools(server) {
             category: CATEGORY,
         },
     }, async (args) => {
+        const gate = await checkMysqlGate(server);
+        if (gate)
+            return gate;
         switch (args.action) {
             case "runQuery":
                 return handleRunQuery(args, context);
@@ -15879,8 +17716,8 @@ function registerSQLDatabaseTools(server) {
         }
     });
     server.registerTool?.(MANAGE_SQL_DATABASE, {
-        title: "Manage SQL database lifecycle or execute write SQL",
-        description: "Manage SQL database resources. Supports MySQL provisioning, MySQL destruction, write SQL/DDL execution, and schema initialization. IMPORTANT: MySQL must be provisioned first (action=provisionMySQL with confirm=true) before any runStatement or initializeSchema call. If MySQL is not yet provisioned, the tool will return MYSQL_NOT_CREATED with a nextAction to provision first.",
+        title: "管理 CloudBase MySQL 数据库生命周期或执行写入 SQL",
+        description: "管理 CloudBase MySQL 数据库资源。支持开通 MySQL、销毁 MySQL、执行写入 SQL/DDL，以及初始化数据库 Schema。注意：必须先开通 MySQL（action=provisionMySQL，confirm=true）才能执行 runStatement 或 initializeSchema。若 MySQL 尚未开通，工具会返回 MYSQL_NOT_CREATED 并给出开通的 nextAction 提示。",
         inputSchema: {
             action: zod_1.z
                 .enum(MANAGE_ACTIONS)
@@ -15928,6 +17765,9 @@ function registerSQLDatabaseTools(server) {
             category: CATEGORY,
         },
     }, async (args) => {
+        const gate = await checkMysqlGate(server);
+        if (gate)
+            return gate;
         switch (args.action) {
             case "provisionMySQL":
                 return handleProvisionMySQL(args, context);