@cloudbase/cloudbase-mcp 2.24.1 → 2.25.0

package/dist/index.cjs

@@ -340,7 +340,7 @@ class CloudRunService {
      */
     async deploy(params) {
         var _a;
-        const { serverName, targetPath = process.cwd(), serverConfig } = params;
+        const { serverName, targetPath = process.cwd(), serverConfig, vpcInfo, imageUrl } = params;
         /**
          * 参数校验和默认值设置
          */
@@ -350,30 +350,41 @@ class CloudRunService {
         // 获取当前环境配置(包含EnvId)
         const envConfig = this.environment.lazyEnvironmentConfig;
         /**
-         * 获取部署包上传信息
+         * 根据部署类型构建 deployInfo
          */
-        const { UploadUrl: uploadUrl, UploadHeaders: uploadHeaders, PackageName: packageName, PackageVersion: packageVersion } = await this.tcbService.request('DescribeCloudBaseBuildService', {
-            EnvId: envConfig.EnvId,
-            ServiceName: serverName
-        });
-        const deployInfo = {
-            DeployType: 'package',
-            PackageName: packageName,
-            PackageVersion: packageVersion
-        };
-        /**
-         * 上传部署包
-         */
-        const zipFile = await codeToZip(targetPath, { installDependency: (serverConfig === null || serverConfig === void 0 ? void 0 : serverConfig.InstallDependency) !== undefined ? serverConfig.InstallDependency : true });
-        await (0, utils_1.upload)({
-            url: uploadUrl,
-            file: zipFile,
-            headers: (uploadHeaders || []).reduce((map, item) => {
-                map[item.Key] = item.Value;
-                return map;
-            }, {}) || {},
-            method: 'PUT'
-        });
+        let deployInfo;
+        if (imageUrl) {
+            // 镜像部署模式：直接使用镜像地址，无需上传代码包
+            deployInfo = {
+                DeployType: 'image',
+                ImageUrl: imageUrl
+            };
+        }
+        else {
+            // 代码包部署模式：获取上传信息 → 打包 → 上传
+            const { UploadUrl: uploadUrl, UploadHeaders: uploadHeaders, PackageName: packageName, PackageVersion: packageVersion } = await this.tcbService.request('DescribeCloudBaseBuildService', {
+                EnvId: envConfig.EnvId,
+                ServiceName: serverName
+            });
+            deployInfo = {
+                DeployType: 'package',
+                PackageName: packageName,
+                PackageVersion: packageVersion
+            };
+            /**
+             * 上传部署包
+             */
+            const zipFile = await codeToZip(targetPath, { installDependency: (serverConfig === null || serverConfig === void 0 ? void 0 : serverConfig.InstallDependency) !== undefined ? serverConfig.InstallDependency : true });
+            await (0, utils_1.upload)({
+                url: uploadUrl,
+                file: zipFile,
+                headers: (uploadHeaders || []).reduce((map, item) => {
+                    map[item.Key] = item.Value;
+                    return map;
+                }, {}) || {},
+                method: 'PUT'
+            });
+        }
         /**
          * 执行部署
          */
@@ -398,18 +409,18 @@ class CloudRunService {
         else {
             // 创建
             /**
-             * 判断是容器器还是函数型
+             * 判断是容器还是函数型（镜像部署固定为 container）
              */
-            let type = 'function';
-            if (serverConfig === null || serverConfig === void 0 ? void 0 : serverConfig.Dockerfile) {
+            let type = imageUrl ? 'container' : 'function';
+            if (!imageUrl && (serverConfig === null || serverConfig === void 0 ? void 0 : serverConfig.Dockerfile)) {
                 type = 'container';
             }
-            else {
+            else if (!imageUrl) {
                 if (await (0, fs_extra_1.pathExists)(path_1.default.join(targetPath, 'Dockerfile'))) {
                     type = 'container';
                 }
             }
-            if (type === 'function') {
+            if (type === 'function' && !imageUrl) {
                 deployInfo.BuildPacks = {
                     LanguageVersion: '20.18',
                     RepoLanguage: 'Node.js'
@@ -425,7 +436,8 @@ class CloudRunService {
             return this._upsertFunction(true, {
                 name: serverName,
                 deployInfo,
-                serverConfig: _serverConfig
+                serverConfig: _serverConfig,
+                vpcInfo
             });
         }
     }
@@ -488,15 +500,20 @@ class CloudRunService {
         }
     }
     _upsertFunction(isNew, data) {
-        const { name, deployInfo, serverConfig } = data;
+        const { name, deployInfo, serverConfig, vpcInfo } = data;
         const envConfig = this.environment.lazyEnvironmentConfig;
         const Items = parseObjectToDiffConfigItem(serverConfig);
-        return this.tcbrService.request(isNew ? 'CreateCloudRunServer' : 'UpdateCloudRunServer', {
+        const basePayload = {
             EnvId: envConfig.EnvId,
             ServerName: name,
             DeployInfo: deployInfo,
             Items,
-        });
+        };
+        // CreateCloudRunServer 支持传入 VpcInfo（仅创建时有效）
+        if (isNew && vpcInfo) {
+            basePayload.VpcInfo = vpcInfo;
+        }
+        return this.tcbrService.request(isNew ? 'CreateCloudRunServer' : 'UpdateCloudRunServer', basePayload);
     }
 }
 exports.CloudRunService = CloudRunService;
@@ -640,6 +657,15 @@ function parseObjectToDiffConfigItem(data) {
         else if (['TimerScale'].includes(k)) {
             Items.push({ Key, TimerScale: v });
         }
+        else if (['VpcConf'].includes(k)) {
+            Items.push({ Key, VpcConf: v });
+        }
+        else if (['VolumesConf'].includes(k)) {
+            Items.push({ Key, VolumesConf: v });
+        }
+        else if (['PublicNetConf'].includes(k)) {
+            Items.push({ Key, PublicNetConf: v });
+        }
     });
     return Items;
 }
@@ -2415,8 +2441,8 @@ async function enrichEnvInfoWithRuntimeMode(result, manager) {
                 : "No legacy NoSQL Database/Storage observed in this env.",
             MysqlNotAvailable: hasMysql
                 ? "MySQL instance(s) detected — see EnvInfo.MysqlInstances."
-                : "No MySQL instance is provisioned for this env. Do NOT use `manageMysqlDatabase` / `queryMysqlDatabase` (those are MySQL-specific) and do NOT read the `relational-database-tool` skill — that family targets MySQL, not CloudBase PG.",
-            RecommendedSkills: "Read `postgresql-development` first for new PG code. `no-sql-web-sdk` is still applicable for existing NoSQL collections in this env. Skip `relational-database-tool` (MySQL-only) entirely.",
+                : "No MySQL instance is provisioned for this env. Do NOT use `manageMysqlDatabase` / `queryMysqlDatabase` (those are MySQL-specific) and do NOT read the `relational-database-mcp-cloudbase` skill — that family targets MySQL, not CloudBase PG.",
+            RecommendedSkills: "Read `postgresql-development-cloudbase` first for new PG code. `cloudbase-document-database-web-sdk` is still applicable for existing NoSQL collections in this env. Skip `relational-database-mcp-cloudbase` (MySQL-only) entirely.",
         }
         : {
             PrimaryBackend: "PostgreSQL is NOT provisioned in this env — this is a legacy NoSQL CloudBase backend.",
@@ -2425,8 +2451,8 @@ async function enrichEnvInfoWithRuntimeMode(result, manager) {
             Storage: "Browser uploads use `app.uploadFile()` against the bucket exposed in `EnvInfo.Storages[].Bucket`.",
             MysqlNotAvailable: hasMysql
                 ? "MySQL instance(s) detected — see EnvInfo.MysqlInstances."
-                : "No MySQL instance in this env. `manageMysqlDatabase` / `queryMysqlDatabase` and the `relational-database-tool` skill are not applicable.",
-            RecommendedSkills: "Read `no-sql-web-sdk` (and `cloud-storage-web` for uploads). `postgresql-development` and `relational-database-tool` are not applicable to this env.",
+                : "No MySQL instance in this env. `manageMysqlDatabase` / `queryMysqlDatabase` and the `relational-database-mcp-cloudbase` skill are not applicable.",
+            RecommendedSkills: "Read `cloudbase-document-database-web-sdk` (and `cloud-storage-web` for uploads). `postgresql-development-cloudbase` and `relational-database-mcp-cloudbase` are not applicable to this env.",
         };
     return {
         ...result,
@@ -3347,7 +3373,7 @@ function registerEnvTools(server) {
     // Register primary tool name (queryEnv)
     const queryEnvToolSchema = {
         title: "CloudBase 环境查询",
-        description: "查询 CloudBase 环境相关信息，支持查询环境列表、指定环境详情和安全域名。（曾用名：envQuery、listEnvs、getEnvInfo、getEnvAuthDomains）当 action=list 时，会按 DescribeEnvs 语义做列表/筛选，标准返回字段为 EnvId、Alias、Status、EnvType、Region、PackageId、PackageName、IsDefault，并支持通过 fields 白名单裁剪这些字段；aliasExact=true 时会按别名精确筛选，避免把前缀相近的环境误当作候选；即使传入 envId，action=list 也只返回摘要，不会返回完整资源明细或 expiry。如需查询某个已知 EnvId 对应环境的详细信息（包括资源字段和计费信息），必须使用 action=info 并传入目标环境的 envId 参数。action=info 会在可用时补充 BillingInfo（如 ExpireTime、PayMode、IsAutoRenew 等计费字段）。\n\n🔍 action=info 还会派生三个用于后端选型的字段：\n- `EnvInfo.RuntimeMode`：'postgresql' 或 'nosql'，表示新业务建议默认使用的后端（PG 已开通时为 postgresql，否则为 nosql）。\n- `EnvInfo.RuntimeBackends`：`{postgresql, nosql, mysql}` 三个布尔值，描述当前环境实际并存的后端。\n- `EnvInfo.RuntimeModeHints`：每个后端对应的 API/工具/skill 提示。\n\nAI 在写业务/权限/存储代码前必须先看这三项：PG 模式下新业务推荐 `app.rdb()` + RLS（`managePgDatabase action=execute` 跑 `CREATE POLICY`）+ pgstore；已存在的 NoSQL 集合 / 旧 storage / `managePermissions(resourceType=\"noSqlDatabase\")` 在 PG 环境下仍然有效。真正不适用的是 MySQL：当 `RuntimeBackends.mysql === false` 时，`manageMysqlDatabase` / `queryMysqlDatabase` / `relational-database-tool` skill 都不该使用。",
+        description: "查询 CloudBase 环境相关信息，支持查询环境列表、指定环境详情和安全域名。（曾用名：envQuery、listEnvs、getEnvInfo、getEnvAuthDomains）当 action=list 时，会按 DescribeEnvs 语义做列表/筛选，标准返回字段为 EnvId、Alias、Status、EnvType、Region、PackageId、PackageName、IsDefault，并支持通过 fields 白名单裁剪这些字段；aliasExact=true 时会按别名精确筛选，避免把前缀相近的环境误当作候选；即使传入 envId，action=list 也只返回摘要，不会返回完整资源明细或 expiry。如需查询某个已知 EnvId 对应环境的详细信息（包括资源字段和计费信息），必须使用 action=info 并传入目标环境的 envId 参数。action=info 会在可用时补充 BillingInfo（如 ExpireTime、PayMode、IsAutoRenew 等计费字段）。\n\n🔍 action=info 还会派生三个用于后端选型的字段：\n- `EnvInfo.RuntimeMode`：'postgresql' 或 'nosql'，表示新业务建议默认使用的后端（PG 已开通时为 postgresql，否则为 nosql）。\n- `EnvInfo.RuntimeBackends`：`{postgresql, nosql, mysql}` 三个布尔值，描述当前环境实际并存的后端。\n- `EnvInfo.RuntimeModeHints`：每个后端对应的 API/工具/skill 提示。\n\nAI 在写业务/权限/存储代码前必须先看这三项：PG 模式下新业务推荐 `app.rdb()` + RLS（`managePgDatabase action=execute` 跑 `CREATE POLICY`）+ pgstore；已存在的 NoSQL 集合 / 旧 storage / `managePermissions(resourceType=\"noSqlDatabase\")` 在 PG 环境下仍然有效。真正不适用的是 MySQL：当 `RuntimeBackends.mysql === false` 时，`manageMysqlDatabase` / `queryMysqlDatabase` / `relational-database-mcp-cloudbase` skill 都不该使用。",
         inputSchema: {
             action: zod_1.z
                 .enum(["list", "info", "domains"])
@@ -80012,6 +80038,32 @@ function parallel(list, iterator, callback)
 }
 
 
+/***/ }),
+
+/***/ 18944:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+/**
+ * 集成中心（UserKey）类型定义
+ *
+ * 字段与 dev-platform（weda-alternative/apps/dev-platform）对齐：
+ * - 云 API 出入参为 PascalCase（EnvId / KeyID / AuthTypeCode / Ext / NeedPwd 等）
+ * - Ext 为 JSON 字符串，承载动态配置字段（含加密后的敏感值）
+ */
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.UserKeyBindServiceType = void 0;
+/** 密钥对绑定的服务类型 */
+var UserKeyBindServiceType;
+(function (UserKeyBindServiceType) {
+    UserKeyBindServiceType["MCP"] = "Mcp";
+    UserKeyBindServiceType["APIS"] = "Apis";
+    UserKeyBindServiceType["OTHER"] = "Other";
+    UserKeyBindServiceType["CLOUD_FUNCTION"] = "CloudFunction";
+})(UserKeyBindServiceType || (exports.UserKeyBindServiceType = UserKeyBindServiceType = {}));
+
+
 /***/ }),
 
 /***/ 18959:
@@ -84596,6 +84648,102 @@ exports.colors = {
 })));
 
 
+/***/ }),
+
+/***/ 22573:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getAesKey = getAesKey;
+exports.__clearAesKeyCache = __clearAesKeyCache;
+/**
+ * 集成中心 AES key 获取（七彩石）
+ *
+ * 通过 QueryRainbowConfig 拉取 group=tcb-config（国内）/
+ * frontend.tcb-config（国际）下字段 dev-platform-apis 的值作为 AES-256-CBC 密钥。
+ *
+ * 安全约束：
+ * - key 仅在进程内存使用，按 group 维度缓存；
+ * - 绝不写入任何本地文件、绝不打印日志。
+ */
+const http_request_1 = __webpack_require__(72088);
+const error_1 = __webpack_require__(40430);
+/** 七彩石配置 */
+const RAINBOW_CONFIG = {
+    ENV_TYPE: 'Default',
+    GROUP_CN: 'tcb-config',
+    GROUP_INTL: 'frontend.tcb-config',
+    /** AES key 在 kvs 中的字段名 */
+    CRYPTO_KEY_FIELD: 'dev-platform-apis'
+};
+const RAINBOW_HOST_CN = 'wedaapi.tcbautomation.cn';
+const RAINBOW_HOST_INTL = 'gray.decisiontcb.tencentcloud.com';
+/** 无 EnvId 时的占位 Uin */
+const FALLBACK_UIN = '3309033';
+/** 进程内缓存（按 group 维度），key 不落盘、不打印 */
+const keyCache = {};
+/**
+ * 获取集成中心 AES key（进程内缓存）
+ * @throws CloudBaseError 拉取或解析失败
+ */
+async function getAesKey(params = {}) {
+    var _a, _b;
+    const { envId, isIntl = false } = params;
+    const group = isIntl ? RAINBOW_CONFIG.GROUP_INTL : RAINBOW_CONFIG.GROUP_CN;
+    if (keyCache[group]) {
+        return keyCache[group];
+    }
+    const host = isIntl ? RAINBOW_HOST_INTL : RAINBOW_HOST_CN;
+    const url = `https://${host}/Graydecision/V1/QueryRainbowConfig?group=${group}`;
+    const payload = {
+        EnvType: RAINBOW_CONFIG.ENV_TYPE,
+        Group: group
+    };
+    if (envId) {
+        payload.EnvId = envId;
+    }
+    else {
+        payload.Uin = FALLBACK_UIN;
+    }
+    let resJson;
+    try {
+        resJson = await (0, http_request_1.fetch)(url, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(payload)
+        });
+    }
+    catch (e) {
+        throw new error_1.CloudBaseError('获取集成加解密密钥失败：七彩石配置拉取请求异常');
+    }
+    const data = (_a = resJson === null || resJson === void 0 ? void 0 : resJson.Response) === null || _a === void 0 ? void 0 : _a.Data;
+    if (!data || data.ErrorCode !== '0') {
+        throw new error_1.CloudBaseError(`获取集成加解密密钥失败：七彩石返回异常（ErrorCode=${data === null || data === void 0 ? void 0 : data.ErrorCode}）`);
+    }
+    let config;
+    try {
+        config = JSON.parse(data.ConfigValue)[0];
+    }
+    catch (e) {
+        throw new error_1.CloudBaseError('获取集成加解密密钥失败：七彩石配置内容解析失败');
+    }
+    const kvs = ((_b = config === null || config === void 0 ? void 0 : config.kvs) === null || _b === void 0 ? void 0 : _b.kvs) || [];
+    const target = kvs.find(kv => kv.key === RAINBOW_CONFIG.CRYPTO_KEY_FIELD);
+    const key = target === null || target === void 0 ? void 0 : target.value;
+    if (!key) {
+        throw new error_1.CloudBaseError(`获取集成加解密密钥失败：七彩石配置中缺少 ${RAINBOW_CONFIG.CRYPTO_KEY_FIELD} 字段`);
+    }
+    keyCache[group] = key;
+    return key;
+}
+/** 清空进程内缓存（仅供测试使用） */
+function __clearAesKeyCache() {
+    Object.keys(keyCache).forEach(k => delete keyCache[k]);
+}
+
+
 /***/ }),
 
 /***/ 22738:
@@ -87688,6 +87836,116 @@ __decorate([
 ], PermissionService.prototype, "modifyEnvAuthzConfig", null);
 
 
+/***/ }),
+
+/***/ 25068:
+/***/ (function(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.AESCrypto = void 0;
+exports.aesEncryptWithIv = aesEncryptWithIv;
+/**
+ * 集成中心 AES 加解密
+ *
+ * 与 dev-platform 控制台的 AESCrypto（crypto-js）完全对齐，保证密文可互相解出：
+ * - 算法：AES-256-CBC
+ * - key：32 字节（按 UTF-8 解析）
+ * - IV：每次随机 16 字节
+ * - padding：PKCS7
+ * - 密文格式：base64(IV) + base64(ciphertext)
+ *   （IV 固定 16 字节 → base64 长度恒为 24，前 24 字符即 IV）
+ *
+ * 使用 Node 内置 crypto 复刻，无需引入额外依赖。
+ */
+const crypto = __importStar(__webpack_require__(55511));
+const ALGORITHM = 'aes-256-cbc';
+const KEY_BYTE_LENGTH = 32;
+const IV_BYTE_LENGTH = 16;
+/** base64(16 字节) 的固定长度 */
+const IV_BASE64_LENGTH = 24;
+function assertKey(key) {
+    if (Buffer.byteLength(key, 'utf8') !== KEY_BYTE_LENGTH) {
+        throw new Error('AES key 必须是 32 字节长度');
+    }
+}
+/**
+ * 使用指定 IV 加密（供测试与内部使用，保证可重现）
+ */
+function aesEncryptWithIv(plaintext, key, iv) {
+    assertKey(key);
+    if (iv.length !== IV_BYTE_LENGTH) {
+        throw new Error('IV 必须是 16 字节长度');
+    }
+    const cipher = crypto.createCipheriv(ALGORITHM, Buffer.from(key, 'utf8'), iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    return iv.toString('base64') + encrypted.toString('base64');
+}
+class AESCryptoImpl {
+    /**
+     * AES-256-CBC 加密，返回 base64(IV)+base64(密文)
+     */
+    encrypt(plaintext, key) {
+        assertKey(key);
+        const iv = crypto.randomBytes(IV_BYTE_LENGTH);
+        return aesEncryptWithIv(plaintext, key, iv);
+    }
+    /**
+     * 解密 base64(IV)+base64(密文) 格式的密文
+     */
+    decrypt(encryptedData, key) {
+        assertKey(key);
+        const ivBase64 = encryptedData.slice(0, IV_BASE64_LENGTH);
+        const ciphertextBase64 = encryptedData.slice(IV_BASE64_LENGTH);
+        const iv = Buffer.from(ivBase64, 'base64');
+        if (iv.length !== IV_BYTE_LENGTH) {
+            throw new Error('密文格式错误：IV 长度非法');
+        }
+        const decipher = crypto.createDecipheriv(ALGORITHM, Buffer.from(key, 'utf8'), iv);
+        const decrypted = Buffer.concat([
+            decipher.update(Buffer.from(ciphertextBase64, 'base64')),
+            decipher.final()
+        ]);
+        return decrypted.toString('utf8');
+    }
+}
+exports.AESCrypto = new AESCryptoImpl();
+
+
 /***/ }),
 
 /***/ 25177:
@@ -89896,8 +90154,12 @@ exports.MANAGE_FUNCTION_ACTIONS = [
     "incrementalDeployFunction", // 增量部署，需通过 pluginOptions.functions 注入实现
 ];
 const VPC_SCHEMA = zod_1.z.object({
-    vpcId: zod_1.z.string(),
-    subnetId: zod_1.z.string(),
+    vpcId: zod_1.z
+        .string()
+        .describe("VPC ID from the real database/network console (e.g. vpc-xxxxxxxx). Required for non-native TCP DB access. Do NOT invent or use placeholders."),
+    subnetId: zod_1.z
+        .string()
+        .describe("Subnet ID in the same VPC as the private DB endpoint (e.g. subnet-xxxxxxxx). Do NOT invent or use placeholders."),
 });
 // 镜像部署值，对应 SCF Runtime=CustomImage
 exports.CUSTOM_IMAGE_RUNTIME = "CustomImage";
@@ -89981,8 +90243,11 @@ const CREATE_FUNCTION_SCHEMA = zod_1.z.object({
     })
         .optional(),
     timeout: zod_1.z.number().optional().describe("函数超时时间"),
-    envVariables: zod_1.z.record(zod_1.z.string()).optional().describe("环境变量"),
-    vpc: VPC_SCHEMA.optional().describe("私有网络配置"),
+    envVariables: zod_1.z
+        .record(zod_1.z.string())
+        .optional()
+        .describe("环境变量。若包含 DATABASE_URL / MYSQL_* / POSTGRES_* / REDIS_* 等传统 TCP 连库变量，必须同时配置 vpc（vpcId+subnetId），且 ID 必须来自真实库/网络信息，禁止猜测。原生 app.rdb()/app.database() 不需要 VPC。"),
+    vpc: VPC_SCHEMA.optional().describe("私有网络配置（出网）。非原生 SDK、用 TCP 访问 VPC 内 MySQL/PostgreSQL/Redis 时必填。vpcId/subnetId 必须与数据库内网 VPC 一致；未知时先查控制台或询问用户，禁止填占位符。"),
     runtime: zod_1.z
         .string()
         .optional()
@@ -90236,7 +90501,7 @@ function registerFunctionTools(server) {
                     },
                     {
                         tool: "queryGateway",
-                        action: "getAccess",
+                        action: "getRoute",
                         reason: "查看该函数是否已暴露网关访问入口",
                     },
                 ]);
@@ -90546,7 +90811,7 @@ function registerFunctionTools(server) {
                         raw: imageResult,
                     }, `已基于镜像 ${createImageConfig.imageUri} 创建 HTTP 函数 ${functionName}。` +
                         `请确认 TCR、SCF 与构建管道处于同一地域；如需通过 URL 访问，请显式调用 ` +
-                        `manageGateway(action="createAccess", type="HTTP") 并按需调整函数安全规则。` +
+                        `manageGateway(action="createRoute", type="HTTP") 并按需调整函数安全规则。` +
                         `部署后可用 queryFunctions(action="getFunctionDetail") 确认函数已就绪。`, [
                         {
                             tool: "queryFunctions",
@@ -90560,8 +90825,8 @@ function registerFunctionTools(server) {
                         },
                         {
                             tool: "manageGateway",
-                            action: "createAccess",
-                            reason: "如需通过 URL 访问镜像 HTTP 函数，显式创建网关访问入口并传 type=\"HTTP\"",
+                            action: "createRoute",
+                            reason: "如需通过 URL 访问镜像 HTTP 函数，显式创建 Domain/Route 访问入口并传 type=\"HTTP\"（映射 WEB_SCF）",
                         },
                     ]);
                 }
@@ -90616,12 +90881,12 @@ function registerFunctionTools(server) {
                 if (func.type === "HTTP") {
                     nextActions.push({
                         tool: "manageGateway",
-                        action: "createAccess",
-                        reason: "如果需要通过 URL 访问 HTTP 函数，请调用 manageGateway(action=\"createAccess\") 并显式传 type=\"HTTP\"，再按实际路径和鉴权需求创建访问入口，不要默认假设 /函数名 已存在",
+                        action: "createRoute",
+                        reason: "如果需要通过 URL 访问 HTTP 函数，请调用 manageGateway(action=\"createRoute\") 并显式传 type=\"HTTP\"（映射 WEB_SCF），再按实际路径和鉴权需求创建访问入口，不要默认假设 /函数名 已存在",
                     });
                     nextActions.push({
                         tool: "queryGateway",
-                        action: "getAccess",
+                        action: "getRoute",
                         reason: "交付前确认 HTTP 访问路径是否已存在并已生效",
                     });
                     nextActions.push({
@@ -90636,7 +90901,7 @@ function registerFunctionTools(server) {
                     });
                 }
                 const message = func.type === "HTTP"
-                    ? `已创建 HTTP 函数 ${functionName}。如果后续需要通过 URL 访问，请显式调用 manageGateway(action="createAccess")，并把 type="HTTP" 一起传入，再按实际路径和鉴权需求创建访问入口。评测或其他外部调用方可能会以匿名身份访问，而且失败后不一定会把 EXCEED_AUTHORITY 再反馈给 AI；交付前请主动确认访问路径和函数安全规则，若已出现 EXCEED_AUTHORITY，请先调用 queryPermissions(action="getResourcePermission", resourceType="function", resourceId="${functionName}") 查看当前规则，再按需要使用 managePermissions(action="updateResourcePermission") 调整权限。`
+                    ? `已创建 HTTP 函数 ${functionName}。如果后续需要通过 URL 访问，请显式调用 manageGateway(action="createRoute")，并把 type="HTTP" 一起传入（映射 UpstreamResourceType=WEB_SCF），再按实际路径和鉴权需求创建访问入口。评测或其他外部调用方可能会以匿名身份访问，而且失败后不一定会把 EXCEED_AUTHORITY 再反馈给 AI；交付前请主动确认访问路径和函数安全规则，若已出现 EXCEED_AUTHORITY，请先调用 queryPermissions(action="getResourcePermission", resourceType="function", resourceId="${functionName}") 查看当前规则，再按需要使用 managePermissions(action="updateResourcePermission") 调整权限。`
                     : `已创建函数 ${functionName}`;
                 return buildEnvelope({
                     action: input.action,
@@ -91124,8 +91389,11 @@ function registerFunctionTools(server) {
             zipFile: zod_1.z.string().optional().describe("仅兼容特殊场景：预先准备好的代码包 base64 编码。普通 createFunction/updateFunctionCode 默认不要先压缩 zip，优先使用 functionRootPath。"),
             handler: zod_1.z.string().optional().describe("函数入口"),
             timeout: zod_1.z.number().optional().describe("配置更新时的超时时间"),
-            envVariables: zod_1.z.record(zod_1.z.string()).optional().describe("配置更新时要合并的环境变量"),
-            vpc: VPC_SCHEMA.optional().describe("配置更新时的 VPC 信息"),
+            envVariables: zod_1.z
+                .record(zod_1.z.string())
+                .optional()
+                .describe("配置更新时要合并的环境变量。若含 DATABASE_URL / MYSQL_* / POSTGRES_* / REDIS_* 等 TCP 连库变量，必须同时提供真实 vpc（或函数已绑定完整 VPC）。禁止猜测 vpcId/subnetId。"),
+            vpc: VPC_SCHEMA.optional().describe("配置更新时的 VPC 信息。非原生 TCP 连库场景必填真实 vpcId+subnetId；不要用占位符。"),
             params: zod_1.z.record(zod_1.z.any()).optional().describe("invokeFunction 的调用参数"),
             triggers: zod_1.z
                 .array(TRIGGER_SCHEMA)
@@ -93397,7 +93665,7 @@ class EnvService {
      * @returns {Promise<IEnvInfoRes>}
      */
     async getEnvInfo() {
-        var _a;
+        var _a, _b;
         // 使用 DescribeEnvInfo 进行单环境查询
         const params = {
             EnvId: this.envId
@@ -93405,6 +93673,7 @@ class EnvService {
         const response = await this.describeEnvInfo(params);
         const envBaseInfo = (_a = response === null || response === void 0 ? void 0 : response.EnvInfo) === null || _a === void 0 ? void 0 : _a.EnvBaseInfo;
         // 将 EnvBaseInfo 完整映射到 EnvInfo 类型，避免新增字段被丢弃
+        // UserInfo 位于 response.EnvInfo 顶层（非 EnvBaseInfo），单独映射
         const envInfo = {
             EnvId: envBaseInfo.EnvId,
             Alias: envBaseInfo.Alias,
@@ -93434,7 +93703,8 @@ class EnvService {
             EnvPreferences: envBaseInfo.EnvPreferences,
             Meta: envBaseInfo.Meta,
             PostgreSQL: envBaseInfo.PostgreSQL,
-            EnvStatus: envBaseInfo.EnvStatus
+            EnvStatus: envBaseInfo.EnvStatus,
+            UserInfo: (_b = response === null || response === void 0 ? void 0 : response.EnvInfo) === null || _b === void 0 ? void 0 : _b.UserInfo
         };
         return {
             EnvInfo: envInfo,
@@ -113963,6 +114233,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.CLOUDRUN_ACCESS_TYPES = exports.CLOUDRUN_SERVICE_TYPES = void 0;
+exports.detectCloudRunDbNetworkRisk = detectCloudRunDbNetworkRisk;
 exports.registerCloudRunTools = registerCloudRunTools;
 const child_process_1 = __webpack_require__(79646);
 const fs_1 = __importDefault(__webpack_require__(29021));
@@ -114005,7 +114276,7 @@ const ManageCloudRunInputSchema = {
         })).optional().describe('扩缩容配置数组，用于配置服务的自动扩缩容策略。可配置多个扩缩容策略'),
         CustomLogs: zod_1.z.string().optional().describe('自定义日志配置，用于配置服务的日志收集和存储策略'),
         Port: zod_1.z.number().min(1).max(65535).optional().describe('服务监听端口配置。函数型服务固定为3000，容器型服务可自定义。服务代码必须监听此端口才能正常接收请求'),
-        EnvParams: zod_1.z.string().optional().describe('环境变量配置，JSON字符串格式。用于传递配置信息给服务代码，如\'{"DATABASE_URL":"mysql://...","NODE_ENV":"production"}\'。SDK v5.6.1+ 会自动对传入的环境变量进行 AES-256-CBC 加密传输'),
+        EnvParams: zod_1.z.string().optional().describe('环境变量配置，JSON字符串格式。用于传递配置信息给服务代码，如\'{"DATABASE_URL":"postgres://user:pass@10.x.x.x:5432/db","NODE_ENV":"production"}\'。SDK v5.6.1+ 会自动对传入的环境变量进行 AES-256-CBC 加密传输。⚠️ 若 EnvParams 含 DATABASE_URL / MYSQL_* / POSTGRES_* / REDIS_* 等传统 TCP 连库变量，必须同时配置 VpcConf，否则实例通常无法访问 VPC 内数据库'),
         Dockerfile: zod_1.z.string().optional().describe('Dockerfile文件名配置，仅容器型服务需要。指定用于构建容器镜像的Dockerfile文件路径，默认为项目根目录下的Dockerfile'),
         BuildDir: zod_1.z.string().optional().describe('构建目录配置，指定代码构建的目录路径。当代码结构与标准不同时使用，默认为项目根目录'),
         InternalAccess: zod_1.z.string().optional().describe('内网访问开关配置，控制是否启用内网访问。true=启用内网访问（可通过云开发SDK直接调用），false=关闭内网访问（仅公网访问）'),
@@ -114029,9 +114300,9 @@ const ManageCloudRunInputSchema = {
             ReplicaNum: zod_1.z.number().min(0).describe('定时扩缩容的目标副本数，最小值0（缩容到0）')
         })).optional().describe('定时扩缩容配置数组，用于配置服务的定时自动扩缩容策略。可配置多个时间段的扩缩容计划，支持每日/每周/每月循环'),
         VpcConf: zod_1.z.object({
-            VpcId: zod_1.z.string().describe('VPC网络ID，指定服务所在的私有网络'),
-            SubnetId: zod_1.z.string().describe('子网ID，指定服务所在的子网'),
-        }).optional().describe('VPC网络配置，用于将云托管服务部署到指定的私有网络中。需要提前创建好VPC和子网'),
+            VpcId: zod_1.z.string().describe('VPC网络ID，格式如 vpc-xxxxxxxx。必须与目标数据库/Redis 处于同一地域，并优先选择同一 VPC。禁止猜测或使用占位符；须来自数据库控制台、已有资源详情、callCloudApi 或用户确认。建议首次创建即配置；已存在服务也可在 deploy 时传入，部署后必须用 queryCloudRun detail 复核是否生效'),
+            SubnetId: zod_1.z.string().describe('子网ID，格式如 subnet-xxxxxxxx。云托管实例将占用该子网 IP，需确保有足够可用 IP'),
+        }).optional().describe('VPC网络配置（实例出网/私有网络）。用于让云托管实例接入指定 VPC，从而内网访问 MySQL/PostgreSQL/Redis/CVM 等资源。与 OpenAccessTypes（外部如何访问本服务）是不同概念。TCP 连库场景必须配置。禁止猜测 VpcId/SubnetId，须来自数据库控制台、已有资源详情、callCloudApi 或用户确认。MCP 在创建时会将 VpcConf 映射为 SDK vpcInfo(CreateType=2)；更新后必须用 queryCloudRun detail 复核 ServerConfig.VpcConf，未生效再走控制台网络设置或删建兜底'),
         VolumesConf: zod_1.z.array(zod_1.z.object({
             VolumeName: zod_1.z.string().describe('存储卷名称'),
             VolumeType: zod_1.z.string().describe('存储卷类型，如CFS表示云文件存储'),
@@ -114135,6 +114406,74 @@ function buildManageCloudRunErrorMessage(action, serverName, error) {
     }
     return `[manageCloudRun/${action}] ${baseMessage}\n建议：${suggestions.join(" ")}`;
 }
+const CLOUDRUN_DB_ENV_KEY_PATTERN = /^(DATABASE_URL|DB_HOST|DB_PORT|DB_USER|DB_PASSWORD|DB_NAME|MYSQL_|POSTGRES_|PGHOST|PGPORT|PGUSER|PGPASSWORD|PGDATABASE|PG_|REDIS_|MONGO_|MONGODB_|SQLALCHEMY_DATABASE_URI|SPRING_DATASOURCE_)/i;
+const CLOUDRUN_DB_URL_PATTERN = /(mysql|mariadb|postgres|postgresql|mongodb(\+srv)?|redis|rediss):\/\//i;
+/**
+ * Detect likely TCP database/cache env usage without VpcConf.
+ * Soft signal for AI agents — does not block deploy.
+ */
+function detectCloudRunDbNetworkRisk(options) {
+    const vpcId = options.vpcConf?.VpcId?.trim();
+    const subnetId = options.vpcConf?.SubnetId?.trim();
+    if (vpcId && subnetId) {
+        return null;
+    }
+    const rawEnv = options.envParams?.trim();
+    if (!rawEnv) {
+        return null;
+    }
+    let parsed;
+    try {
+        const value = JSON.parse(rawEnv);
+        if (!value || typeof value !== "object" || Array.isArray(value)) {
+            return null;
+        }
+        parsed = value;
+    }
+    catch {
+        // Non-JSON EnvParams still may embed connection URLs as plain text.
+        if (!CLOUDRUN_DB_URL_PATTERN.test(rawEnv)) {
+            return null;
+        }
+        return {
+            code: "MISSING_VPC_FOR_DB_ENV",
+            message: "EnvParams appears to include a database/cache connection URL, but serverConfig.VpcConf is missing. CloudRun instances usually cannot reach VPC-private MySQL/PostgreSQL/Redis without VpcConf.",
+            matchedKeys: ["<non-json-envParams>"],
+            remediation: [
+                "Set serverConfig.VpcConf to the same region/VPC (and a subnet with free IPs) as the database.",
+                "Do NOT invent VpcId/SubnetId. Resolve real IDs from the DB console, resource detail, callCloudApi, or the user.",
+                "Use the database private/intranet hostname in EnvParams, not localhost or docker-compose service names.",
+                "Ensure the DB security group allows the CloudRun subnet on the DB port.",
+                "Re-deploy after VpcConf is set. OpenAccessTypes alone does not provide VPC egress to databases.",
+            ],
+        };
+    }
+    const matchedKeys = [];
+    for (const [key, value] of Object.entries(parsed)) {
+        if (CLOUDRUN_DB_ENV_KEY_PATTERN.test(key)) {
+            matchedKeys.push(key);
+            continue;
+        }
+        if (typeof value === "string" && CLOUDRUN_DB_URL_PATTERN.test(value)) {
+            matchedKeys.push(key);
+        }
+    }
+    if (matchedKeys.length === 0) {
+        return null;
+    }
+    return {
+        code: "MISSING_VPC_FOR_DB_ENV",
+        message: "EnvParams includes database/cache connection settings, but serverConfig.VpcConf is missing. Deploy may succeed while runtime DB connections fail.",
+        matchedKeys,
+        remediation: [
+            "Set serverConfig.VpcConf.VpcId and SubnetId to the database VPC/subnet (same region).",
+            "Do NOT invent VpcId/SubnetId. Resolve real IDs from the DB console, resource detail, callCloudApi, or the user.",
+            "Use the private DB endpoint in EnvParams.",
+            "Confirm security group / allowlist permits CloudRun subnet access to the DB port.",
+            "Do not confuse OpenAccessTypes (ingress) with VpcConf (egress to VPC resources).",
+        ],
+    };
+}
 function getCloudRunQueryServerName(input) {
     return input.detailServerName || input.serverName;
 }
@@ -114632,6 +114971,17 @@ for await (let x of res.textStream) {
                 if (input.serverConfig) {
                     deployParams.serverConfig = input.serverConfig;
                 }
+                // Manager SDK create path prefers top-level vpcInfo (CreateCloudRunServer.VpcInfo).
+                // Map serverConfig.VpcConf → vpcInfo so first-time create actually binds VPC.
+                // Update path still sends Items.VpcConf; platform may ignore VPC changes on existing services.
+                const vpcConf = input.serverConfig?.VpcConf;
+                if (vpcConf?.VpcId?.trim() && vpcConf?.SubnetId?.trim()) {
+                    deployParams.vpcInfo = {
+                        VpcId: vpcConf.VpcId.trim(),
+                        CreateType: 2,
+                        SubnetIds: [vpcConf.SubnetId.trim()],
+                    };
+                }
                 let result;
                 try {
                     result = await cloudrunService.deploy(deployParams);
@@ -114705,6 +115055,14 @@ for await (let x of res.textStream) {
                     // Notification failure should not affect deployment flow
                     // Error is already logged in sendDeployNotification
                 }
+                const dbNetworkRisk = detectCloudRunDbNetworkRisk({
+                    envParams: input.serverConfig?.EnvParams,
+                    vpcConf: input.serverConfig?.VpcConf,
+                });
+                const warnings = dbNetworkRisk ? [dbNetworkRisk] : [];
+                const warningSuffix = dbNetworkRisk
+                    ? ` Warning: ${dbNetworkRisk.message} Set serverConfig.VpcConf before relying on DB connectivity.`
+                    : "";
                 return {
                     content: [
                         {
@@ -114717,9 +115075,10 @@ for await (let x of res.textStream) {
                                     deployPath: targetPath,
                                     serverType: serverType,
                                     cloudbasercGenerated: true,
-                                    consoleUrl
+                                    consoleUrl,
+                                    ...(warnings.length > 0 ? { warnings } : {}),
                                 },
-                                message: `Triggered deployment for ${serverType} service '${input.serverName}' from ${targetPath}. You can follow the progress in ${consoleUrl}`
+                                message: `Triggered deployment for ${serverType} service '${input.serverName}' from ${targetPath}. You can follow the progress in ${consoleUrl}.${warningSuffix}`
                             }, null, 2)
                         }
                     ]
@@ -136914,7 +137273,7 @@ class TelemetryReporter {
         const nodeVersion = process.version; // Node.js版本
         const arch = os_1.default.arch(); // 系统架构
         // 从构建时注入的版本号获取MCP版本信息
-        const mcpVersion = process.env.npm_package_version || "2.24.1" || 0;
+        const mcpVersion = process.env.npm_package_version || "2.25.0" || 0;
         return {
             userAgent: `${osType} ${osRelease} ${arch} ${nodeVersion} CloudBase-MCP/${mcpVersion}`,
             deviceId: this.deviceId,
@@ -172843,6 +173202,7 @@ const permission_1 = __webpack_require__(24786);
 const sandbox_1 = __webpack_require__(48488);
 const aiModel_1 = __webpack_require__(34800);
 const monitor_1 = __webpack_require__(8901);
+const integration_1 = __webpack_require__(72785);
 class Environment {
     constructor(context, envId) {
         this.inited = false;
@@ -172869,6 +173229,7 @@ class Environment {
         this.sandboxService = new sandbox_1.SandboxService(this);
         this.aiModelService = new aiModel_1.AiModelService(this);
         this.monitorService = new monitor_1.MonitorService(this);
+        this.integrationService = new integration_1.IntegrationService(this);
     }
     async lazyInit() {
         if (!this.inited) {
@@ -172946,6 +173307,9 @@ class Environment {
     getMonitorService() {
         return this.monitorService;
     }
+    getIntegrationService() {
+        return this.integrationService;
+    }
     getCommonService(serviceType = 'tcb', serviceVersion) {
         return new common_1.CommonService(this, serviceType, serviceVersion);
     }
@@ -197005,7 +197369,7 @@ ${envIdSection}
 ## 环境信息
 - 操作系统: ${os_1.default.type()} ${os_1.default.release()}
 - Node.js版本: ${process.version}
-- MCP 版本：${process.env.npm_package_version || "2.24.1" || 0}
+- MCP 版本：${process.env.npm_package_version || "2.25.0" || 0}
 - 系统架构: ${os_1.default.arch()}
 - 时间: ${new Date().toISOString()}
 - 请求ID: ${requestId}
@@ -197086,7 +197450,7 @@ function createWrappedHandler(name, handler, server) {
                 requestId: (typeof error === 'object' && error && 'requestId' in error) ? error.requestId : '',
                 ide: server.ide || process.env.INTEGRATION_IDE || ''
             });
-            const mcpVersion =  true ? "2.24.1" : 0;
+            const mcpVersion =  true ? "2.25.0" : 0;
             const requestIdSuffix = requestId ? `\n🆔 RequestId: ${requestId}` : '';
             const enhancedErrorMessage = `${errorMessage}${requestIdSuffix}\n\n📦 CloudBase MCP v${mcpVersion}\n🔗 遇到问题？请复制以下链接到浏览器打开\n即可自动携带错误详情快速创建 GitHub Issue：\n${issueLink}`;
             // 创建新的错误对象，保持原有的错误类型但更新消息
@@ -199117,6 +199481,7 @@ module.exports = cmp
 
 "use strict";
 
+/* eslint-disable @typescript-eslint/member-ordering */
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -199359,27 +199724,30 @@ class StorageService {
         getMetadataController.loadTasks(tasks);
         const files = await getMetadataController.run();
         // 对文件上传进行处理
-        const cos = this.getCos(parallel);
-        const uploadFiles = util_1.default.promisify(cos.uploadFiles).bind(cos);
-        const params = {
-            files,
-            SliceSize: BIG_FILE_SIZE,
+        // 构造 files 数组（格式：{ localPath, cloudPath }），传给 uploadFilesCustom
+        const filesForUpload = fileStatsList
+            .filter(stats => !stats.isDir)
+            .map(stats => ({
+            localPath: stats.filePath,
+            cloudPath: stats.cloudFileKey
+        }));
+        // 调用 uploadFilesCustom（智能混合模式：并行→串行）
+        // 不再直接调用 uploadFilesWithRetry（纯并行重试，容易 socket hang up）
+        return this.uploadFilesCustom({
+            files: filesForUpload,
+            bucket,
+            region,
+            ignore: [],
             onProgress,
-            onFileFinish
-        };
-        return this.uploadFilesWithRetry({
-            uploadFiles,
-            options: params,
-            times: retryCount,
-            interval: retryInterval,
-            failedFiles: []
+            onFileFinish,
+            fileId,
+            parallel,
+            retryCount,
+            retryInterval
         });
     }
-    /**
-     * 批量上传文件
-     * @param options
-     */
     async uploadFilesCustom(options) {
+        var _a;
         const { files, bucket, region, ignore, onProgress, onFileFinish, fileId = true, parallel = 20, retryCount = 0, retryInterval = 500 } = options;
         if (!files || !files.length) {
             return;
@@ -199393,6 +199761,146 @@ class StorageService {
             };
         })
             .filter(item => ((ignore === null || ignore === void 0 ? void 0 : ignore.length) ? !micromatch_1.default.isMatch(item.filePath, ignore) : true));
+        const totalFiles = fileList.length;
+        console.log(`[uploadFiles] 准备上传 ${totalFiles} 个文件`);
+        // 模式 1：完全串行模式（最稳定）
+        if (process.env.COS_UPLOAD_SERIAL === 'true') {
+            console.log(`[uploadFiles] 串行安全模式已启用`);
+            const serialResult = await this.uploadFilesSerial({
+                fileList,
+                bucket,
+                region,
+                fileId,
+                retryCount,
+                retryInterval,
+                onFileFinish
+            });
+            if (serialResult.failedFiles.length > 0) {
+                throw new error_1.CloudBaseError(`[uploadFiles] 串行上传仍失败 (${serialResult.failedFiles.length} 个):\n` +
+                    serialResult.failedFiles.map(f => `- ${f.cloudFileKey}: ${f.error}`).join('\n'), { code: 'HOSTING_DEPLOY_FAILED' });
+            }
+            return {
+                successCount: serialResult.successCount,
+                totalFiles,
+                failedFiles: []
+            };
+        }
+        // 模式 2：智能混合模式（默认）
+        // - 先并行快速上传
+        // - 失败的文件自动走串行重试
+        console.log(`[uploadFiles] 智能混合模式：先并行快速上传，失败文件自动串行重试`);
+        // 第一步：并行上传（分批）
+        const parallelFailedFiles = await this.uploadFilesParallel({
+            fileList,
+            bucket,
+            region,
+            fileId,
+            parallel,
+            retryCount: 0, // 并行阶段不重试，失败后交给串行阶段
+            retryInterval,
+            onFileFinish
+        });
+        // 第二步：串行重试失败的文件
+        if (parallelFailedFiles && parallelFailedFiles.length > 0) {
+            console.warn(`[uploadFiles] 并行阶段 ${parallelFailedFiles.length} 个文件失败，自动切换串行重试...`);
+            const serialResult = await this.uploadFilesSerial({
+                fileList: parallelFailedFiles,
+                bucket,
+                region,
+                fileId: false, // 串行重试不需要再获取 fileId
+                retryCount,
+                retryInterval,
+                onFileFinish
+            });
+            // 检查是否还有失败
+            if (((_a = serialResult === null || serialResult === void 0 ? void 0 : serialResult.failedFiles) === null || _a === void 0 ? void 0 : _a.length) > 0) {
+                throw new error_1.CloudBaseError(`[uploadFiles] 串行重试后仍失败 (${serialResult.failedFiles.length} 个):\n` +
+                    serialResult.failedFiles.map(f => `- ${f.cloudFileKey}: ${f.error}`).join('\n'), { code: 'HOSTING_DEPLOY_FAILED' });
+            }
+        }
+        console.log(`[uploadFiles] 全部完成！共处理 ${totalFiles} 个文件`);
+        return {
+            successCount: totalFiles,
+            totalFiles,
+            failedFiles: []
+        };
+    }
+    /**
+     * 串行安全模式：逐文件上传（类似自定义脚本 deploy.js 的方式）
+     * 特点：
+     * - 每个文件独立 HTTP 连接，不会出现 socket hang up
+     * - 单线程串行，稳定性最高
+     * - 适合大规模目录（>1000 文件）或有网络问题的场景
+     */
+    // eslint-disable-next-line @typescript-eslint/member-ordering
+    async uploadFilesSerial(options) {
+        const { fileList, bucket, region, fileId, retryCount, retryInterval, onFileFinish } = options;
+        let uploadedCount = 0;
+        let failedFiles = [];
+        for (let i = 0; i < fileList.length; i++) {
+            const file = fileList[i];
+            let success = false;
+            // 重试机制
+            for (let attempt = 0; attempt <= retryCount; attempt++) {
+                try {
+                    // 每个文件创建新的 COS 实例（确保连接隔离）
+                    const cos = this.getCos(1); // 严格单并发
+                    const putObject = util_1.default.promisify(cos.putObject).bind(cos);
+                    await putObject({
+                        Bucket: bucket,
+                        Region: region,
+                        Key: file.cloudFileKey,
+                        Body: fs_1.default.createReadStream(file.filePath),
+                        ContentLength: fs_1.default.statSync(file.filePath).size,
+                    });
+                    uploadedCount++;
+                    // 显示进度（每 100 个文件或最后 5 个）
+                    if (uploadedCount % 100 === 0 || fileList.length - i <= 5) {
+                        console.log(`[serial-upload] [${uploadedCount}/${fileList.length}] ${file.cloudFileKey}`);
+                    }
+                    success = true;
+                    // 回调成功
+                    if (onFileFinish) {
+                        onFileFinish(null, {}, file);
+                    }
+                    break;
+                }
+                catch (error) {
+                    const isLastAttempt = attempt === retryCount;
+                    if (isLastAttempt) {
+                        console.error(`[serial-upload] [${i + 1}/${fileList.length}] ${file.cloudFileKey}: ${error.message || error.code}`);
+                        // 记录失败的文件
+                        failedFiles.push(Object.assign(Object.assign({}, file), { error: error.message || String(error) }));
+                        // 回调失败
+                        if (onFileFinish) {
+                            onFileFinish(error, null, file);
+                        }
+                    }
+                    else {
+                        // 等待后重试
+                        await new Promise(resolve => { setTimeout(resolve, retryInterval); });
+                    }
+                }
+            }
+        }
+        console.log(`[serial-upload] 完成：成功 ${uploadedCount}/${fileList.length}，失败 ${failedFiles.length}`);
+        return {
+            successCount: uploadedCount,
+            failedFiles
+        };
+    }
+    /**
+     * 并发模式：使用 cos.uploadFiles() 批量上传
+     * 特点：
+     * - 速度快，利用 SDK 内部并行能力
+     * - 分批上传 + 自动刷新凭证
+     * - 适合小规模目录或网络良好的场景
+     *
+     * @returns 失败的文件列表（空的表示全部成功）
+     */
+    // eslint-disable-next-line @typescript-eslint/member-ordering
+    async uploadFilesParallel(options) {
+        const { fileList, bucket, region, fileId, parallel, retryCount, retryInterval, onProgress, onFileFinish } = options;
         // 生成上传文件属性
         const tasks = fileList.map(stats => async () => {
             let cosFileId;
@@ -199408,31 +199916,89 @@ class StorageService {
                 'x-cos-meta-fileid': cosFileId
             };
         });
-        // 控制请求并发
+        // 控制请求并发（获取 metadata 阶段）
         const asyncTaskController = new parallel_1.AsyncTaskParallelController(parallel, 50);
         asyncTaskController.loadTasks(tasks);
-        fileList = await asyncTaskController.run();
-        const cos = this.getCos(parallel);
-        const uploadFiles = util_1.default.promisify(cos.uploadFiles).bind(cos);
-        const params = {
-            files: fileList,
-            SliceSize: BIG_FILE_SIZE,
-            onProgress,
-            onFileFinish
-        };
-        // return uploadFiles({
-        //     onProgress,
-        //     onFileFinish,
-        //     files: fileList,
-        //     SliceSize: BIG_FILE_SIZE
-        // })
-        return this.uploadFilesWithRetry({
-            uploadFiles,
-            options: params,
-            times: retryCount,
-            interval: retryInterval,
-            failedFiles: []
-        });
+        const processedFileList = await asyncTaskController.run();
+        // 分批上传，避免单次上传时间过长导致 STS 临时凭证过期
+        // 默认每批 500 个文件，可通过环境变量 COS_UPLOAD_BATCH_SIZE 自定义
+        const BATCH_SIZE = process.env.COS_UPLOAD_BATCH_SIZE
+            ? parseInt(process.env.COS_UPLOAD_BATCH_SIZE, 10)
+            : 500;
+        // 收集所有批次失败的文件
+        let allFailedFiles = [];
+        for (let batchStart = 0; batchStart < processedFileList.length; batchStart += BATCH_SIZE) {
+            const batchEnd = Math.min(batchStart + BATCH_SIZE, processedFileList.length);
+            const batchFiles = processedFileList.slice(batchStart, batchEnd);
+            console.log(`[parallel-upload] 正在上传第 ${Math.floor(batchStart / BATCH_SIZE) + 1} 批次 (文件 ${batchStart + 1}-${batchEnd}/${processedFileList.length})`);
+            // 每批次重新获取 COS 实例（刷新 STS 临时凭证）
+            const cos = this.getCos(parallel);
+            const uploadFiles = util_1.default.promisify(cos.uploadFiles).bind(cos);
+            // 跟踪本批次中真正失败的文件（通过 onFileFinish 回调）
+            const batchFailedFiles = [];
+            const batchSuccessFiles = new Set();
+            const params = {
+                files: batchFiles,
+                SliceSize: BIG_FILE_SIZE,
+                onProgress,
+                onFileFinish: (error, result, file) => {
+                    // 空值检查：防止 file 为 null/undefined
+                    if (!file) {
+                        console.warn('[parallel-upload] onFileFinish received null/undefined file');
+                        return;
+                    }
+                    const fileKey = file.Key || file.cloudFileKey;
+                    if (error) {
+                        batchFailedFiles.push({
+                            filePath: file.FilePath || file.filePath,
+                            cloudFileKey: fileKey,
+                            error: error.message || String(error)
+                        });
+                    }
+                    else {
+                        batchSuccessFiles.add(fileKey);
+                    }
+                    // 继续调用用户传入的回调（转换参数格式）
+                    // 注意：cloudFileKey 和 filePath 是 CLI 期望的格式
+                    onFileFinish === null || onFileFinish === void 0 ? void 0 : onFileFinish(error, result, Object.assign(Object.assign({}, file), { cloudFileKey: fileKey, filePath: file.FilePath || file.filePath }));
+                }
+            };
+            try {
+                await this.uploadFilesWithRetry({
+                    uploadFiles,
+                    options: params,
+                    times: retryCount,
+                    interval: retryInterval,
+                    failedFiles: []
+                });
+                console.log(`[parallel-upload] 第 ${Math.floor(batchStart / BATCH_SIZE) + 1} 批次上传成功`);
+            }
+            catch (error) {
+                console.error(`[parallel-upload] 第 ${Math.floor(batchStart / BATCH_SIZE) + 1} 批次上传失败:`, error.message || error.code || error);
+                // 只记录真正失败的文件（通过 onFileFinish 回调跟踪）
+                // 如果 onFileFinish 没有被调用（如 socket hang up），则标记整个批次为失败
+                if (batchFailedFiles.length === 0 && batchSuccessFiles.size === 0) {
+                    // onFileFinish 未被调用，整个批次失败
+                    allFailedFiles.push(...batchFiles.map(f => ({
+                        filePath: f.FilePath || f.filePath,
+                        cloudFileKey: f.Key || f.cloudFileKey,
+                        error: error.message || String(error)
+                    })));
+                }
+                else {
+                    // onFileFinish 已被调用，只记录失败的文件
+                    allFailedFiles.push(...batchFailedFiles);
+                }
+            }
+        }
+        // 返回失败文件列表（不抛异常，让调用方决定是否走串行重试）
+        if (allFailedFiles.length > 0) {
+            console.warn(`[parallel-upload] 共 ${allFailedFiles.length}/${processedFileList.length} 个文件并行上传失败，等待串行重试...`);
+        }
+        else {
+            console.log(`[parallel-upload] 全部 ${processedFileList.length} 个文件并行上传成功`);
+        }
+        return allFailedFiles;
     }
     /**
      * 创建一个空的文件夹
@@ -201624,6 +202190,7 @@ class StorageService {
     }
     /**
      * 获取 COS 配置
+     * @param parallel 并发数量
      */
     getCos(parallel = 20) {
         const internalEndpoint = this.environment.cloudBaseContext.isInternalEndpoint();
@@ -201869,6 +202436,16 @@ __decorate([
 ], StorageService.prototype, "uploadDirectoryCustom", null);
 __decorate([
     (0, utils_1.preLazy)()
+    /**
+     * 上传文件（支持精准重试失败文件）
+     *
+     * 智能混合模式（默认）：
+     * 1. 先并行快速上传（速度快）
+     * 2. 失败的文件自动走串行重试（稳定性高）
+     *
+     * 可选模式：
+     * - COS_UPLOAD_SERIAL=true：完全串行模式（最稳定但慢）
+     */
 ], StorageService.prototype, "uploadFilesCustom", null);
 __decorate([
     (0, utils_1.preLazy)()
@@ -202679,6 +203256,367 @@ Promise.filter = function (promises, fn, options) {
 };
 
 
+/***/ }),
+
+/***/ 72785:
+/***/ (function(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.IntegrationService = void 0;
+const error_1 = __webpack_require__(40430);
+const utils_1 = __webpack_require__(62358);
+const constants_1 = __webpack_require__(79640);
+const crypto_1 = __webpack_require__(25068);
+const secretKey_1 = __webpack_require__(22573);
+__exportStar(__webpack_require__(18944), exports);
+/**
+ * 集成中心（UserKey）服务
+ *
+ * 复用现有 tcb 云 API（version 2018-06-08），统一携带 Business='integration'。
+ *
+ * 提供两种使用模式：
+ * 1. 透传模式：直接传 `ext`（JSON 字符串），SDK 原样传递给云 API（向后兼容）
+ * 2. 自动加解密模式：传 `envVariables`（明文键值对），SDK 自动识别模板中的
+ *    password 字段、拉取七彩石密钥完成加密后拼装 ext
+ */
+class IntegrationService {
+    constructor(environment) {
+        this.environment = environment;
+        this.tcbService = new utils_1.CloudService(environment.cloudBaseContext, 'tcb', '2018-06-08');
+    }
+    // =========== 只读 API ===========
+    /** 列出集成模板（密钥对模版列表） */
+    async listTemplates(params = {}) {
+        var _a, _b, _c;
+        const { envId } = this.getEnvInfo();
+        return this.tcbService.request('GetUserKeyTemplateList', {
+            EnvId: envId,
+            Offset: (_a = params.offset) !== null && _a !== void 0 ? _a : 0,
+            Limit: (_b = params.limit) !== null && _b !== void 0 ? _b : 100,
+            AuthTypeCode: params.authTypeCode,
+            AuthTypeName: params.authTypeName,
+            Business: (_c = params.business) !== null && _c !== void 0 ? _c : constants_1.USER_KEY_BUSINESS // 默认 integration
+        });
+    }
+    /** 列出集成实例（密钥对列表） */
+    async listUserKeys(params = {}) {
+        var _a, _b, _c;
+        const { envId } = this.getEnvInfo();
+        return this.tcbService.request('GetUserKeyList', {
+            EnvId: envId,
+            Offset: (_a = params.offset) !== null && _a !== void 0 ? _a : 0,
+            Limit: (_b = params.limit) !== null && _b !== void 0 ? _b : 100,
+            Name: params.name,
+            AuthTypeCode: params.authTypeCode,
+            Business: (_c = params.business) !== null && _c !== void 0 ? _c : constants_1.USER_KEY_BUSINESS // 默认 integration
+        });
+    }
+    /**
+     * 查询单个集成实例详情。
+     *
+     * 当 `decryptPwd=true` 时，SDK 自动拉取模板识别 password 字段并从七彩石
+     * 获取 AES 密钥解密，Ext 中 password 字段返回明文。解密失败时保留密文原值，
+     * 不中断流程。
+     */
+    async getUserKey(params) {
+        var _a, _b, _c;
+        this.validateRequiredParams(params, ['keyId']);
+        const { envId } = this.getEnvInfo();
+        const result = await this.tcbService.request('GetOneUserKey', {
+            EnvId: envId,
+            KeyID: params.keyId,
+            NeedPwd: (_a = params.needPwd) !== null && _a !== void 0 ? _a : false,
+            Business: (_b = params.business) !== null && _b !== void 0 ? _b : constants_1.USER_KEY_BUSINESS // 默认 integration
+        });
+        // 自动解密 password 字段
+        if (params.decryptPwd && ((_c = result.UserKeyInfo) === null || _c === void 0 ? void 0 : _c.Ext)) {
+            result.UserKeyInfo = await this.decryptExtIfNeeded(result.UserKeyInfo, envId);
+        }
+        return result;
+    }
+    // =========== 写 API ===========
+    /**
+     * 创建集成实例。
+     *
+     * 支持两种传参方式：
+     * - 传 `ext`：透传模式，原样传递给云 API（向后兼容，调用方自行加密）
+     * - 传 `envVariables`：自动加密模式，SDK 识别模板 password 字段并加密后拼装 ext
+     * - 两者都传时以 `ext` 优先
+     */
+    async createUserKey(params) {
+        var _a;
+        this.validateRequiredParams(params, ['name', 'authTypeCode']);
+        const { envId } = this.getEnvInfo();
+        const ext = await this.buildExtFromParams(envId, params.authTypeCode, { ext: params.ext, envVariables: params.envVariables });
+        return this.tcbService.request('CreateUserKey', {
+            EnvId: envId,
+            Name: params.name,
+            KeyID: params.keyId,
+            AuthTypeCode: params.authTypeCode,
+            Description: params.description,
+            Ext: ext,
+            TicketID: params.ticketId,
+            Business: (_a = params.business) !== null && _a !== void 0 ? _a : constants_1.USER_KEY_BUSINESS, // 默认 integration
+            DemoCodeFunctionName: params.demoCodeFunctionName,
+            RuntimeConfig: params.runtimeConfig
+        });
+    }
+    /**
+     * 更新集成实例。
+     *
+     * 支持两种传参方式：
+     * - 传 `ext`：透传模式，原样传递给云 API（向后兼容）
+     * - 传 `envVariables`：自动加密模式，与现有 Ext 合并后加密写入
+     * - 两者都传时以 `ext` 优先
+     * - 都未传时后端保留原有 Ext 不变
+     */
+    async updateUserKey(params) {
+        var _a;
+        this.validateRequiredParams(params, ['keyId']);
+        const { envId } = this.getEnvInfo();
+        let ext = params.ext;
+        // 传了 envVariables 且未传 ext：需要合并现有 Ext 后加密
+        if (params.envVariables && !params.ext) {
+            ext = await this.buildMergedExtForUpdate(envId, params.keyId, { authTypeCode: params.authTypeCode, envVariables: params.envVariables });
+        }
+        return this.tcbService.request('UpdateUserKey', {
+            EnvId: envId,
+            KeyID: params.keyId,
+            Name: params.name,
+            AuthTypeCode: params.authTypeCode,
+            Description: params.description,
+            Ext: ext,
+            DemoCodeFunctionName: params.demoCodeFunctionName,
+            Business: (_a = params.business) !== null && _a !== void 0 ? _a : constants_1.USER_KEY_BUSINESS, // 默认 integration
+            RuntimeConfig: params.runtimeConfig
+        });
+    }
+    /** 删除集成实例 */
+    async deleteUserKey(params) {
+        this.validateRequiredParams(params, ['keyId']);
+        const { envId } = this.getEnvInfo();
+        return this.tcbService.request('DeleteUserKey', {
+            EnvId: envId,
+            KeyID: params.keyId
+        });
+    }
+    // =========== 辅助方法 ===========
+    /** 获取环境信息 */
+    getEnvInfo() {
+        const envConfig = this.environment.lazyEnvironmentConfig;
+        return {
+            envId: envConfig.EnvId
+        };
+    }
+    /** 校验必填参数 */
+    validateRequiredParams(params, fields) {
+        for (const field of fields) {
+            if (!params[field]) {
+                throw new error_1.CloudBaseError(`${field} 是必填参数`);
+            }
+        }
+    }
+    /**
+     * 根据 ext / envVariables 参数构造最终的 Ext JSON 字符串。
+     * ext 优先；envVariables 由 SDK 自动加密 password 字段。
+     */
+    async buildExtFromParams(envId, authTypeCode, opts) {
+        // ext 优先（透传模式）
+        if (opts.ext !== undefined) {
+            return opts.ext;
+        }
+        // 自动加密模式
+        if (opts.envVariables && Object.keys(opts.envVariables).length > 0) {
+            return this.encryptAndStringify(envId, authTypeCode, opts.envVariables);
+        }
+        return undefined;
+    }
+    /**
+     * 更新场景：将 envVariables 与现有实例的 Ext 合并后加密。
+     * 需要先查询现有实例获取当前的 authTypeCode 和 Ext。
+     */
+    async buildMergedExtForUpdate(envId, keyId, opts) {
+        var _a, _b;
+        const { envVariables, authTypeCode } = opts;
+        if (!envVariables || Object.keys(envVariables).length === 0) {
+            return undefined;
+        }
+        // 查询现有实例以合并 Ext
+        let existingExtObj = {};
+        let resolvedAuthTypeCode = authTypeCode;
+        try {
+            const existing = await this.getUserKey({
+                keyId,
+                needPwd: true,
+                decryptPwd: true, // 解密后方便合并
+                business: constants_1.USER_KEY_BUSINESS
+            });
+            const extObj = this.parseExt((_a = existing.UserKeyInfo) === null || _a === void 0 ? void 0 : _a.Ext);
+            existingExtObj = Object.assign({}, extObj);
+            resolvedAuthTypeCode = resolvedAuthTypeCode || ((_b = existing.UserKeyInfo) === null || _b === void 0 ? void 0 : _b.AuthTypeCode);
+        }
+        catch (_c) {
+            // 查询失败时仅使用传入的 envVariables
+        }
+        if (!resolvedAuthTypeCode) {
+            // 无法获取 authTypeCode，无法识别 password 字段，直接 JSON 序列化
+            return JSON.stringify(Object.assign(Object.assign({}, existingExtObj), envVariables));
+        }
+        // 合并：现有 Ext 为基础，envVariables 覆盖
+        const merged = Object.assign(Object.assign({}, existingExtObj), envVariables);
+        return this.encryptAndStringify(envId, resolvedAuthTypeCode, merged);
+    }
+    /**
+     * 加密 envVariables 中的 password 字段并返回 JSON 字符串。
+     * 无 password 字段时直接 JSON.stringify，不请求七彩石。
+     */
+    async encryptAndStringify(envId, authTypeCode, envVariables) {
+        // 1. 拉取模板，识别 password 字段
+        const passwordFieldNames = await this.getPasswordFieldNames(authTypeCode);
+        // 2. 判断是否有 password 字段需要加密
+        const hasPasswordValue = passwordFieldNames.some(name => envVariables[name]);
+        if (!hasPasswordValue) {
+            return JSON.stringify(envVariables);
+        }
+        // 3. 拉取 AES key 并加密
+        try {
+            const aesKey = await (0, secretKey_1.getAesKey)({ envId });
+            const encrypted = this.encryptPasswordFields(envVariables, passwordFieldNames, aesKey);
+            return JSON.stringify(encrypted);
+        }
+        catch (_a) {
+            // 获取密钥失败时以明文写入（与 CLI 行为一致）
+            return JSON.stringify(envVariables);
+        }
+    }
+    /**
+     * 解密 Ext 中的 password 字段并返回新的 IUserKeyInfo。
+     * 解密失败时保留原值，不中断流程。
+     */
+    async decryptExtIfNeeded(userKeyInfo, envId) {
+        if (!userKeyInfo.Ext || !userKeyInfo.AuthTypeCode)
+            return userKeyInfo;
+        try {
+            const passwordFieldNames = await this.getPasswordFieldNames(userKeyInfo.AuthTypeCode);
+            if (passwordFieldNames.length === 0)
+                return userKeyInfo;
+            const extObj = this.parseExt(userKeyInfo.Ext);
+            if (!Object.keys(extObj).length)
+                return userKeyInfo;
+            const hasPasswordValue = passwordFieldNames.some(name => extObj[name]);
+            if (!hasPasswordValue)
+                return userKeyInfo;
+            const aesKey = await (0, secretKey_1.getAesKey)({ envId });
+            const decrypted = this.decryptPasswordFields(extObj, passwordFieldNames, aesKey);
+            return Object.assign(Object.assign({}, userKeyInfo), { Ext: JSON.stringify(decrypted) });
+        }
+        catch (_a) {
+            return userKeyInfo;
+        }
+    }
+    /** 从模板中获取 password 类型字段名列表 */
+    async getPasswordFieldNames(authTypeCode) {
+        var _a, _b;
+        try {
+            const res = await this.listTemplates({ authTypeCode, limit: 1 });
+            const templateExt = (_b = (_a = res.KeyTemplateList) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.Ext;
+            if (!templateExt)
+                return [];
+            const parsed = JSON.parse(templateExt);
+            const fields = Array.isArray(parsed === null || parsed === void 0 ? void 0 : parsed.fields) ? parsed.fields : [];
+            return fields
+                .filter((f) => f && f.type === 'password' && typeof f.name === 'string')
+                .map((f) => f.name);
+        }
+        catch (_c) {
+            return [];
+        }
+    }
+    /** 解析 Ext JSON 字符串为对象，失败返回空对象 */
+    parseExt(ext) {
+        if (!ext)
+            return {};
+        try {
+            const parsed = JSON.parse(ext);
+            return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+        }
+        catch (_a) {
+            return {};
+        }
+    }
+    /** 加密 ext 对象中的 password 字段（仅加密有值的字段），返回新对象 */
+    encryptPasswordFields(extObj, passwordFieldNames, aesKey) {
+        const result = Object.assign({}, extObj);
+        passwordFieldNames.forEach(name => {
+            const value = result[name];
+            if (name && value) {
+                result[name] = crypto_1.AESCrypto.encrypt(value, aesKey);
+            }
+        });
+        return result;
+    }
+    /** 解密 ext 对象中的 password 字段，解密失败保留原值，返回新对象 */
+    decryptPasswordFields(extObj, passwordFieldNames, aesKey) {
+        const result = Object.assign({}, extObj);
+        const MIN_CIPHERTEXT_LEN = 24; // base64(16 字节 IV) = 24 字符
+        passwordFieldNames.forEach(name => {
+            const encrypted = result[name];
+            if (typeof encrypted !== 'string' || encrypted.length <= MIN_CIPHERTEXT_LEN) {
+                return;
+            }
+            try {
+                result[name] = crypto_1.AESCrypto.decrypt(encrypted, aesKey);
+            }
+            catch (_a) {
+                // 解密失败保留原值，不中断流程
+            }
+        });
+        return result;
+    }
+}
+exports.IntegrationService = IntegrationService;
+__decorate([
+    (0, utils_1.preLazy)()
+], IntegrationService.prototype, "listTemplates", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], IntegrationService.prototype, "listUserKeys", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], IntegrationService.prototype, "getUserKey", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], IntegrationService.prototype, "createUserKey", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], IntegrationService.prototype, "updateUserKey", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], IntegrationService.prototype, "deleteUserKey", null);
+
+
 /***/ }),
 
 /***/ 72923:
@@ -213100,7 +214038,7 @@ function registerSetupTools(server) {
     server.registerTool("downloadTemplate", {
         title: "下载项目模板",
         description: `自动下载并部署CloudBase项目模板。
-**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.24.1" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
+**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.25.0" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
         inputSchema: {
             template: zod_1.z
                 .enum(["react", "vue", "miniprogram", "uniapp", "rules"])
@@ -221481,6 +222419,22 @@ module.exports = typeof queueMicrotask === 'function'
     .catch(err => setTimeout(() => { throw err }, 0))
 
 
+/***/ }),
+
+/***/ 79640:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+/**
+ * 集成中心常量定义（与 dev-platform 对齐）
+ */
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.USER_KEY_BUSINESS = void 0;
+/** 业务类型标识：集成中心来源的密钥对 */
+exports.USER_KEY_BUSINESS = 'integration';
+
+
 /***/ }),
 
 /***/ 79646:
@@ -230184,21 +231138,23 @@ const zod_1 = __webpack_require__(21614);
 const cloudbase_manager_js_1 = __webpack_require__(3431);
 const json_content_js_1 = __webpack_require__(4365);
 const QUERY_GATEWAY_ACTIONS = [
-    "getAccess",
-    "listDomains",
     "listRoutes",
     "getRoute",
     "listCustomDomains",
 ];
 const MANAGE_GATEWAY_ACTIONS = [
-    "createAccess",
     "createRoute",
     "updateRoute",
     "deleteRoute",
     "bindCustomDomain",
     "deleteCustomDomain",
-    "deleteAccess",
-    "updatePathAuth",
+];
+const UPSTREAM_RESOURCE_TYPES = [
+    "SCF",
+    "WEB_SCF",
+    "CBR",
+    "STATIC_STORE",
+    "LH",
 ];
 function normalizeAccessPath(path) {
     if (!path) {
@@ -230229,24 +231185,11 @@ function registerGatewayTools(server) {
             return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(error));
         }
     };
-    const listGatewayDomains = async () => {
-        const cloudbase = await getManager();
-        const result = await cloudbase.access.getDomainList();
-        (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-        const domains = [
-            result.DefaultDomain,
-            ...(result.ServiceSet || []).map((item) => item.Domain),
-        ].filter(Boolean);
-        return {
-            domains,
-            enableService: result.EnableService,
-            raw: result,
-        };
-    };
     const listHttpServiceRoutes = async (domain) => {
         const cloudbase = await getManager();
         const result = await cloudbase.env.describeHttpServiceRoute({
             EnvId: await resolveEnvId(),
+            Limit: 1000,
             ...(domain
                 ? {
                     Filters: [
@@ -230262,123 +231205,180 @@ function registerGatewayTools(server) {
         return result;
     };
     const flattenRoutes = (result) => (result.Domains ?? []).flatMap((domainItem) => (domainItem.Routes ?? []).map((route) => ({
-        Domain: domainItem.Domain,
+        Domain: domainItem.Domain ?? "",
         DomainType: domainItem.DomainType,
         AccessType: domainItem.AccessType,
+        IsDefault: domainItem.IsDefault,
         ...route,
     })));
+    const buildRouteUrls = (routes) => Array.from(new Set(routes
+        .filter((route) => route.Domain && route.Path)
+        .map((route) => `https://${route.Domain}${normalizeAccessPath(String(route.Path))}`)));
+    const resolveDefaultHttpDomain = async () => {
+        const routeInfo = await listHttpServiceRoutes();
+        const domains = routeInfo.Domains ?? [];
+        const defaultCandidates = domains.filter((item) => item.IsDefault === true && item.Domain);
+        const preferred = defaultCandidates.find((item) => item.Enable !== false && item.Status === "SUCCESS") ??
+            defaultCandidates.find((item) => item.Enable !== false) ??
+            defaultCandidates[0];
+        if (!preferred?.Domain) {
+            throw new Error("环境默认 HTTP 访问域名未就绪或未开通。请先在控制台开通 HTTP 访问服务，或用 queryGateway(action=\"listRoutes\") 确认 Domains 中是否存在 IsDefault=true 的域名；也可以显式传入 domain 后重试 createRoute/updateRoute/deleteRoute。");
+        }
+        return preferred.Domain;
+    };
     const resolveRouteDomain = async (preferredDomain) => {
         if (preferredDomain) {
             return preferredDomain;
         }
-        const routeInfo = await listHttpServiceRoutes();
-        return routeInfo.OriginDomain;
+        return resolveDefaultHttpDomain();
     };
-    const normalizeRoutePayload = async (route, fallback, domain) => {
-        const path = normalizeAccessPath(route?.path ?? fallback.path);
-        const serviceType = route?.serviceType ?? fallback.targetType;
-        const serviceName = route?.serviceName ?? fallback.targetName;
-        if (!serviceType || !serviceName) {
-            throw new Error("route.serviceType 和 route.serviceName 为必填项");
+    const mapUpstreamResourceType = (input) => {
+        if (input.upstreamResourceType) {
+            return input.upstreamResourceType;
+        }
+        if (input.type === "HTTP") {
+            return "WEB_SCF";
+        }
+        if (input.type === "Event") {
+            return "SCF";
         }
+        if (input.requiresFunctionType || input.targetType === "function") {
+            throw new Error("为云函数创建/更新路由时必须显式提供 type（HTTP→WEB_SCF，Event→SCF）或 route.upstreamResourceType。省略会导致 HTTP 与 Event 函数互相误标，访问时可能返回 FUNCTION_PARAM_INVALID 或网关内部错误。");
+        }
+        throw new Error("必须提供 route.upstreamResourceType（SCF / WEB_SCF / CBR / STATIC_STORE / LH），或在函数场景提供 type=\"HTTP\"|\"Event\"。");
+    };
+    const normalizeRoutePayload = async (input) => {
+        const upstreamResourceName = input.route?.serviceName ?? input.targetName;
+        if (!upstreamResourceName) {
+            throw new Error("必须提供 targetName 或 route.serviceName 作为上游资源名称（例如云函数名）");
+        }
+        const isFunctionRoute = input.targetType === "function" ||
+            input.type !== undefined ||
+            input.route?.upstreamResourceType === "SCF" ||
+            input.route?.upstreamResourceType === "WEB_SCF" ||
+            (!input.route?.upstreamResourceType && Boolean(input.targetName));
+        const upstreamResourceType = mapUpstreamResourceType({
+            type: input.type,
+            targetType: input.targetType,
+            upstreamResourceType: input.route?.upstreamResourceType,
+            requiresFunctionType: isFunctionRoute,
+        });
+        const path = normalizeAccessPath(input.route?.path ?? input.path ?? `/${upstreamResourceName}`);
+        const domain = await resolveRouteDomain(input.domain);
+        const enableAuth = input.route?.auth !== undefined
+            ? input.route.auth
+            : input.auth !== undefined
+                ? input.auth
+                : undefined;
         return {
             EnvId: await resolveEnvId(),
             Domain: {
-                Domain: await resolveRouteDomain(domain),
+                Domain: domain,
                 Routes: [
                     {
                         Path: path,
-                        UpstreamResourceType: serviceType === "function" ? "SCF" : "CBR",
-                        UpstreamResourceName: serviceName,
-                        EnableAuth: route?.auth !== undefined
-                            ? route.auth
-                            : fallback.auth !== undefined
-                                ? fallback.auth
-                                : undefined,
+                        UpstreamResourceType: upstreamResourceType,
+                        UpstreamResourceName: upstreamResourceName,
+                        EnableAuth: enableAuth,
                     },
                 ],
             },
+            resolved: {
+                domain,
+                path,
+                upstreamResourceType,
+                upstreamResourceName,
+                enableAuth,
+            },
         };
     };
+    const routeMutationNextActions = (targetName) => [
+        {
+            tool: "queryGateway",
+            action: "getRoute",
+            reason: "等待 30 秒到 3 分钟后再确认访问入口是否已生效",
+        },
+        {
+            tool: "queryPermissions",
+            action: "getResourcePermission",
+            reason: "确认函数安全规则是否允许预期访问方；网关 EnableAuth/auth=false 不等于函数已允许匿名访问",
+        },
+        {
+            tool: "managePermissions",
+            action: "updateResourcePermission",
+            reason: "只有在确认需要匿名或浏览器直连访问时，才按实际安全要求更新函数权限",
+        },
+    ];
     const handleQueryGateway = async (input) => {
         switch (input.action) {
-            case "listDomains": {
-                const result = await listGatewayDomains();
-                return buildEnvelope({
-                    action: input.action,
-                    domains: result.domains,
-                    enableService: result.enableService,
-                    raw: result.raw,
-                }, `已获取 ${result.domains.length} 个网关域名`, [
-                    {
-                        tool: "queryGateway",
-                        action: "getAccess",
-                        reason: "查看某个目标当前的访问入口",
-                    },
-                ]);
-            }
             case "listCustomDomains": {
-                const result = await listGatewayDomains();
+                const result = await listHttpServiceRoutes();
+                const customDomains = (result.Domains ?? []).filter((item) => item.IsDefault !== true);
                 return buildEnvelope({
                     action: input.action,
-                    domains: result.raw.ServiceSet ?? [],
-                    total: (result.raw.ServiceSet ?? []).length,
-                    raw: result.raw,
-                }, `已获取 ${(result.raw.ServiceSet ?? []).length} 个自定义域名`);
+                    domains: customDomains,
+                    total: customDomains.length,
+                    raw: result,
+                }, `已获取 ${customDomains.length} 个自定义域名`);
             }
             case "listRoutes": {
-                const result = await listHttpServiceRoutes();
+                const result = await listHttpServiceRoutes(input.domain);
                 const routes = flattenRoutes(result);
                 return buildEnvelope({
                     action: input.action,
                     routes,
+                    urls: buildRouteUrls(routes),
                     total: result.TotalCount ?? routes.length,
                     raw: result,
                 }, `已获取 ${result.TotalCount ?? routes.length} 条 HTTP 路由`);
             }
             case "getRoute": {
-                const result = await listHttpServiceRoutes();
-                const route = flattenRoutes(result).find((item) => (input.routeId && item.RouteId === input.routeId) ||
-                    (input.targetName && item.UpstreamResourceName === input.targetName)) ?? null;
+                if (!input.routeId && !input.targetName && !input.path) {
+                    throw new Error("action=getRoute 时至少需要提供 routeId、targetName 或 path");
+                }
+                const result = await listHttpServiceRoutes(input.domain);
+                const normalizedPath = input.path
+                    ? normalizeAccessPath(input.path)
+                    : undefined;
+                const matches = flattenRoutes(result).filter((item) => {
+                    if (input.routeId && item.RouteId !== input.routeId) {
+                        return false;
+                    }
+                    if (input.domain && item.Domain !== input.domain) {
+                        return false;
+                    }
+                    if (normalizedPath &&
+                        normalizeAccessPath(String(item.Path ?? "")) !== normalizedPath) {
+                        return false;
+                    }
+                    if (input.targetName &&
+                        item.UpstreamResourceName !== input.targetName) {
+                        return false;
+                    }
+                    return Boolean(input.routeId || input.targetName || normalizedPath);
+                });
+                const route = matches.length === 1 ? matches[0] : null;
+                const urls = buildRouteUrls(matches);
                 return buildEnvelope({
                     action: input.action,
                     routeId: input.routeId ?? null,
+                    targetName: input.targetName ?? null,
+                    path: normalizedPath ?? null,
+                    domain: input.domain ?? null,
                     route,
-                    raw: result,
-                }, route ? "已获取路由详情" : "未找到对应路由");
-            }
-            case "getAccess": {
-                if (!input.targetName) {
-                    throw new Error("getAccess 操作时，targetName 参数是必需的");
-                }
-                const cloudbase = await getManager();
-                const [accessList, domainInfo] = await Promise.all([
-                    cloudbase.access.getAccessList({ name: input.targetName }),
-                    listGatewayDomains(),
-                ]);
-                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, accessList);
-                const urls = Array.from(new Set((accessList.APISet || []).flatMap((api) => domainInfo.domains.map((domain) => {
-                    const normalizedPath = normalizeAccessPath(api.Path);
-                    return `https://${domain}${normalizedPath}`;
-                }))));
-                return buildEnvelope({
-                    action: input.action,
-                    targetType: input.targetType ?? "function",
-                    targetName: input.targetName,
-                    apis: accessList.APISet || [],
-                    total: accessList.Total || 0,
-                    domains: domainInfo.domains,
+                    routes: matches,
+                    total: matches.length,
                     urls,
-                    enableService: accessList.EnableService ?? domainInfo.enableService ?? false,
-                    raw: {
-                        accessList,
-                        domainList: domainInfo.raw,
-                    },
-                }, `已获取目标 ${input.targetName} 的网关访问配置`, [
+                    raw: result,
+                }, matches.length === 0
+                    ? "未找到对应路由"
+                    : matches.length === 1
+                        ? "已获取路由详情"
+                        : `匹配到 ${matches.length} 条路由，请补充 path 或 domain 精确定位`, [
                     {
                         tool: "manageGateway",
-                        action: "createAccess",
-                        reason: "为该目标新增访问路径",
+                        action: "createRoute",
+                        reason: "为该目标新增 Domain/Route 访问路径",
                     },
                 ]);
             }
@@ -230388,78 +231388,60 @@ function registerGatewayTools(server) {
     };
     const handleManageGateway = async (input) => {
         switch (input.action) {
-            case "createAccess": {
-                if (!input.targetName || !input.targetType) {
-                    throw new Error("action=createAccess 时必须提供 targetType 和 targetName");
-                }
-                if (!input.type) {
-                    throw new Error("action=createAccess 且 targetType=function 时必须显式提供 type。HTTP 云函数传 HTTP；Event 函数传 Event。省略会默认按 Event 路由处理，可能让 HTTP 云函数访问后返回 FUNCTION_PARAM_INVALID。");
-                }
+            case "createRoute": {
                 const cloudbase = await getManager();
-                const accessPath = normalizeAccessPath(input.path || `/${input.targetName}`);
+                const payload = await normalizeRoutePayload(input);
                 let result;
                 try {
-                    result = await cloudbase.access.createAccess({
-                        name: input.targetName,
-                        path: accessPath,
-                        type: (input.type === "HTTP" ? 6 : 1),
-                        auth: input.auth,
+                    result = await cloudbase.env.createHttpServiceRoute({
+                        EnvId: payload.EnvId,
+                        Domain: payload.Domain,
                     });
                 }
                 catch (err) {
-                    if (err.message && err.message.includes("An error has occurred")) {
-                        let hint = "为目标资源配置访问路由失败（后端内部错误）。请确保：1) 目标云函数已成功创建并处于 Active 状态；2) 环境默认 HTTP 域名已完成初始化；3) 该访问路径未被占用。";
+                    const message = err instanceof Error ? err.message : String(err);
+                    if (message.includes("An error has occurred")) {
+                        let hint = "为目标资源配置访问路由失败（后端内部错误）。请确保：1) 目标云函数已成功创建并处于 Active 状态；2) 环境默认 HTTP 域名已完成初始化（IsDefault）；3) 该访问路径未被占用。";
                         if (input.type === "HTTP") {
-                            hint += "此外注意：如果目标函数最初是作为 Event 函数创建的，这里 type 仍必须传 Event；误传 HTTP 会导致此错误。";
+                            hint +=
+                                "此外注意：如果目标函数最初是作为 Event 函数创建的，这里 type 仍必须传 Event（UpstreamResourceType=SCF）；误传 HTTP/WEB_SCF 会导致此错误。";
                         }
-                        throw new Error(`${hint} 原始错误：${err.message}`);
+                        throw new Error(`${hint} 原始错误：${message}`);
                     }
                     throw err;
                 }
                 (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
                 return buildEnvelope({
                     action: input.action,
-                    targetType: input.targetType,
-                    targetName: input.targetName,
-                    path: accessPath,
+                    model: "httpServiceRoute",
+                    targetType: input.targetType ?? null,
+                    targetName: payload.resolved.upstreamResourceName,
+                    domain: payload.resolved.domain,
+                    path: payload.resolved.path,
+                    upstreamResourceType: payload.resolved.upstreamResourceType,
+                    upstreamResourceName: payload.resolved.upstreamResourceName,
+                    auth: payload.resolved.enableAuth ?? null,
                     raw: result,
-                }, `已为目标 ${input.targetName} 创建网关访问路径。注意：路由配置传播通常需要等待 30 秒到 3 分钟，请勿立即访问。该操作只创建网关入口，不会自动放开函数安全规则；若需要匿名或浏览器直接访问，请继续检查函数资源权限。`, [
-                    {
-                        tool: "queryGateway",
-                        action: "getAccess",
-                        reason: "等待 30 秒到 3 分钟后再确认访问入口是否已生效",
-                    },
-                    {
-                        tool: "queryPermissions",
-                        action: "getResourcePermission",
-                        reason: "确认函数安全规则是否允许预期访问方；网关 auth=false 不等于函数已允许匿名访问",
-                    },
-                    {
-                        tool: "managePermissions",
-                        action: "updateResourcePermission",
-                        reason: "只有在确认需要匿名或浏览器直连访问时，才按实际安全要求更新函数权限",
-                    },
-                ]);
-            }
-            case "createRoute": {
-                const cloudbase = await getManager();
-                const result = await cloudbase.env.createHttpServiceRoute((await normalizeRoutePayload(input.route, input, input.domain)));
-                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-                return buildEnvelope({
-                    action: input.action,
-                    route: input.route ?? null,
-                    raw: result,
-                }, "HTTP 路由创建成功");
+                }, `已为目标 ${payload.resolved.upstreamResourceName} 在域名 ${payload.resolved.domain} 创建路由 ${payload.resolved.path}（${payload.resolved.upstreamResourceType}）。注意：路由配置传播通常需要等待 30 秒到 3 分钟，请勿立即访问。该操作只创建网关入口，不会自动放开函数安全规则；若需要匿名或浏览器直接访问，请继续检查函数资源权限。`, routeMutationNextActions(payload.resolved.upstreamResourceName));
             }
             case "updateRoute": {
                 const cloudbase = await getManager();
-                const result = await cloudbase.env.modifyHttpServiceRoute((await normalizeRoutePayload(input.route, input, input.domain)));
+                const payload = await normalizeRoutePayload(input);
+                const result = await cloudbase.env.modifyHttpServiceRoute({
+                    EnvId: payload.EnvId,
+                    Domain: payload.Domain,
+                });
                 (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
                 return buildEnvelope({
                     action: input.action,
-                    route: input.route ?? null,
+                    model: "httpServiceRoute",
+                    domain: payload.resolved.domain,
+                    path: payload.resolved.path,
+                    upstreamResourceType: payload.resolved.upstreamResourceType,
+                    upstreamResourceName: payload.resolved.upstreamResourceName,
+                    auth: payload.resolved.enableAuth ?? null,
                     raw: result,
-                }, "HTTP 路由更新成功");
+                }, `HTTP 路由更新成功（${payload.resolved.domain}${payload.resolved.path}）`, routeMutationNextActions(payload.resolved.upstreamResourceName));
             }
             case "deleteRoute": {
                 const routePath = input.route?.path ?? input.path;
@@ -230468,16 +231450,18 @@ function registerGatewayTools(server) {
                 }
                 const cloudbase = await getManager();
                 const domain = await resolveRouteDomain(input.domain);
+                const normalizedPath = normalizeAccessPath(routePath);
                 const result = await cloudbase.env.deleteHttpServiceRoute({
                     EnvId: await resolveEnvId(),
                     Domain: domain,
-                    Paths: [normalizeAccessPath(routePath)],
+                    Paths: [normalizedPath],
                 });
                 (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
                 return buildEnvelope({
                     action: input.action,
+                    model: "httpServiceRoute",
                     domain,
-                    path: normalizeAccessPath(routePath),
+                    path: normalizedPath,
                     raw: result,
                 }, "HTTP 路由删除成功");
             }
@@ -230517,114 +231501,34 @@ function registerGatewayTools(server) {
                     raw: result,
                 }, "自定义域名删除成功");
             }
-            case "deleteAccess": {
-                const cloudbase = await getManager();
-                const accessPath = input.path ? normalizeAccessPath(input.path) : undefined;
-                let resolvedAccessId = input.accessId;
-                let resolvedName;
-                if (!resolvedAccessId) {
-                    if (!input.targetName && !accessPath) {
-                        throw new Error("action=deleteAccess 时至少需要提供 accessId，或提供 targetName/path 用于定位入口");
-                    }
-                    const accessList = await cloudbase.access.getAccessList({
-                        ...(input.targetName ? { name: input.targetName } : {}),
-                        ...(accessPath ? { path: accessPath } : {}),
-                    });
-                    const candidates = (accessList.APISet ?? []).filter((item) => {
-                        if (!accessPath) {
-                            return true;
-                        }
-                        return normalizeAccessPath(item.Path) === accessPath;
-                    });
-                    if (candidates.length === 0) {
-                        throw new Error("未找到可删除的访问入口，请确认 targetName/path 或直接传 accessId");
-                    }
-                    if (candidates.length > 1 && !accessPath) {
-                        throw new Error("匹配到多个访问入口，请补充 path 或直接传 accessId");
-                    }
-                    resolvedAccessId = candidates[0]?.APIId;
-                    resolvedName = candidates[0]?.Name;
-                }
-                else {
-                    // 仅传入 accessId 时，先查询获取 name 等信息，确保删除参数完整
-                    try {
-                        const accessList = await cloudbase.access.getAccessList({});
-                        const match = (accessList.APISet ?? []).find((item) => item.APIId === resolvedAccessId);
-                        if (match) {
-                            resolvedName = match.Name;
-                        }
-                    }
-                    catch {
-                        // 查询失败不影响主流程，继续用 accessId 删除
-                    }
-                }
-                if (!resolvedAccessId) {
-                    throw new Error("无法解析访问入口 accessId，请改为显式传入 accessId");
-                }
-                const result = await cloudbase.access.deleteAccess({
-                    ...(resolvedName ? { name: resolvedName } : {}),
-                    apiId: resolvedAccessId,
-                });
-                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-                return buildEnvelope({
-                    action: input.action,
-                    targetName: resolvedName ?? input.targetName ?? null,
-                    path: accessPath ?? null,
-                    accessId: resolvedAccessId,
-                    raw: result,
-                }, "网关访问入口删除成功");
-            }
-            case "updatePathAuth": {
-                if (!input.targetName && !input.path) {
-                    throw new Error("action=updatePathAuth 时至少需要提供 targetName 或 path");
-                }
-                if (input.auth === undefined) {
-                    throw new Error("action=updatePathAuth 时必须提供 auth");
-                }
-                const cloudbase = await getManager();
-                const accessPath = input.path ? normalizeAccessPath(input.path) : undefined;
-                const accessList = await cloudbase.access.getAccessList({
-                    ...(input.targetName ? { name: input.targetName } : {}),
-                    ...(accessPath ? { path: accessPath } : {}),
-                });
-                const apiIds = (accessList.APISet ?? []).map((item) => item.APIId).filter(Boolean);
-                if (apiIds.length === 0) {
-                    throw new Error("未找到可更新鉴权状态的访问入口");
-                }
-                const result = await cloudbase.access.switchPathAuth({
-                    apiIds,
-                    auth: input.auth,
-                });
-                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-                return buildEnvelope({
-                    action: input.action,
-                    targetName: input.targetName ?? null,
-                    path: accessPath ?? null,
-                    auth: input.auth,
-                    apiIds,
-                    raw: result,
-                }, "网关路径鉴权更新成功");
-            }
             default:
                 throw new Error(`不支持的操作类型: ${input.action}`);
         }
     };
     server.registerTool?.("queryGateway", {
         title: "查询 CloudBase 网关",
-        description: "CloudBase 网关统一只读入口。通过 action 查询网关域名、访问入口和目标暴露情况。",
+        description: "CloudBase 网关统一只读入口（Domain/Route 模型）。通过 listRoutes / getRoute / listCustomDomains 查询域名与路由；主键为 Domain + Path，上游类型为 SCF / WEB_SCF / CBR / STATIC_STORE / LH。",
         inputSchema: {
             action: zod_1.z
                 .enum(QUERY_GATEWAY_ACTIONS)
-                .describe("只读操作类型，例如 getAccess、listDomains"),
+                .describe("只读操作类型：listRoutes、getRoute、listCustomDomains"),
             targetType: zod_1.z
                 .enum(["function"])
                 .optional()
-                .describe("目标资源类型。当前支持 function，后续可扩展"),
+                .describe("目标资源类型。当前支持 function"),
             targetName: zod_1.z
                 .string()
                 .optional()
-                .describe("目标资源名称。getAccess 时必填"),
+                .describe("上游资源名称。getRoute 时可按云函数名过滤"),
             routeId: zod_1.z.string().optional().describe("路由 ID。getRoute 时可选"),
+            path: zod_1.z
+                .string()
+                .optional()
+                .describe("路由路径。getRoute / listRoutes 过滤时可选"),
+            domain: zod_1.z
+                .string()
+                .optional()
+                .describe("域名。getRoute / listRoutes 过滤时可选"),
         },
         annotations: {
             readOnlyHint: true,
@@ -230634,19 +231538,19 @@ function registerGatewayTools(server) {
     }, async (input) => withEnvelope(() => handleQueryGateway(input)));
     server.registerTool?.("manageGateway", {
         title: "管理 CloudBase 网关",
-        description: "CloudBase 网关统一写入口。通过 action 创建目标访问入口，后续承接更通用的网关配置能力。为已存在的 HTTP 云函数补默认域名访问时，通常使用 createAccess 并提供 targetType=\"function\"、targetName、type=\"HTTP\" 与期望 path。注意 createAccess 只创建网关入口，不会自动修改函数资源权限。⚠️ 如需绑定带 SSL 证书的自定义域名供公网 HTTPS 访问，使用 action=\"bindCustomDomain\"（需要 domain 和 certificateId 参数）；如需配置 CORS/安全域名（无证书），请使用 envDomainManagement 工具。",
+        description: "CloudBase 网关统一写入口（Domain/Route 模型）。为已存在的 HTTP 云函数补默认域名访问时，使用 createRoute，并提供 targetType=\"function\"、targetName、type=\"HTTP\"（映射 WEB_SCF）与期望 path；Event 函数传 type=\"Event\"（映射 SCF）。未传 domain 时自动解析 IsDefault 默认域名。注意 createRoute 只创建网关入口，不会自动修改函数资源权限。更新鉴权用 updateRoute；删除用 deleteRoute（Domain+Path）。⚠️ 绑定带 SSL 证书的自定义域名用 bindCustomDomain；CORS/安全域名请使用 envDomainManagement。",
         inputSchema: {
             action: zod_1.z
                 .enum(MANAGE_GATEWAY_ACTIONS)
-                .describe('写操作类型，例如 createAccess。为已有函数补默认域名访问入口时使用 createAccess；若 action=createAccess 且 targetType=function，必须显式提供 type。'),
+                .describe("写操作类型。为已有函数补默认域名访问入口时使用 createRoute；函数场景必须显式提供 type（HTTP→WEB_SCF，Event→SCF）或 route.upstreamResourceType。"),
             targetType: zod_1.z
                 .enum(["function"])
                 .optional()
-                .describe("目标资源类型。当前支持 function，后续可扩展"),
+                .describe("目标资源类型。当前支持 function"),
             targetName: zod_1.z
                 .string()
                 .optional()
-                .describe("目标资源名称。createAccess 到云函数时填写函数名"),
+                .describe("目标资源名称。createRoute 到云函数时填写函数名"),
             path: zod_1.z
                 .string()
                 .optional()
@@ -230654,25 +231558,28 @@ function registerGatewayTools(server) {
             type: zod_1.z
                 .enum(["Event", "HTTP"])
                 .optional()
-                .describe("目标函数的运行时类型，不是接入协议。createAccess 到已创建的 HTTP 云函数时传 HTTP；给 Event 函数补网关访问时传 Event 或省略。省略会默认按 Event 路由处理，可能让 HTTP 云函数访问后返回 FUNCTION_PARAM_INVALID。"),
+                .describe("目标函数运行时类型，不是接入协议。HTTP 云函数传 HTTP（UpstreamResourceType=WEB_SCF）；Event 函数传 Event（SCF）。误标会导致 FUNCTION_PARAM_INVALID 或网关错误。函数路由场景必须显式提供 type 或 route.upstreamResourceType。"),
             auth: zod_1.z
                 .boolean()
                 .optional()
-                .describe("是否开启网关路径鉴权。若要走默认域名做匿名或浏览器访问，通常设为 false；该开关仅控制网关入口本身，不会修改函数资源权限，仍需检查并按需调整函数安全规则。"),
+                .describe("是否开启网关路径鉴权（EnableAuth）。若要走默认域名做匿名或浏览器访问，通常设为 false；该开关仅控制网关入口本身，不会修改函数资源权限。"),
             route: zod_1.z
                 .object({
-                routeId: zod_1.z.string().optional(),
                 path: zod_1.z.string().optional(),
-                serviceType: zod_1.z.string().optional(),
                 serviceName: zod_1.z.string().optional(),
+                upstreamResourceType: zod_1.z.enum(UPSTREAM_RESOURCE_TYPES).optional(),
                 auth: zod_1.z.boolean().optional(),
             })
                 .optional()
-                .describe("HTTP 路由配置对象"),
-            domain: zod_1.z.string().optional().describe("自定义域名"),
-            certificateId: zod_1.z.string().optional().describe("证书 ID"),
-            accessName: zod_1.z.string().optional().describe("访问入口名称，保留字段"),
-            accessId: zod_1.z.string().optional().describe("访问入口 ID。deleteAccess 时可直接传入，避免参数歧义"),
+                .describe("HTTP 路由配置。upstreamResourceType 可选 SCF / WEB_SCF / CBR / STATIC_STORE / LH"),
+            domain: zod_1.z
+                .string()
+                .optional()
+                .describe("域名。省略时自动使用环境 IsDefault 默认 HTTP 域名；自定义域名场景请显式传入"),
+            certificateId: zod_1.z
+                .string()
+                .optional()
+                .describe("证书 ID。bindCustomDomain 时必填"),
         },
         annotations: {
             readOnlyHint: false,
@@ -262997,6 +263904,17 @@ class CloudBase {
     get aiModel() {
         return this.currentEnvironment().getAiModelService();
     }
+    /**
+     * 集成中心服务（UserKey）
+     * 提供集成模板/实例的增删改查与绑定云函数能力
+     */
+    get integration() {
+        return this.currentEnvironment().getIntegrationService();
+    }
+    /**
+     * 监控服务
+     * 提供指标查询能力
+     */
     get monitor() {
         return this.currentEnvironment().getMonitorService();
     }
@@ -264609,7 +265527,9 @@ function configToParams(options) {
     if ((_c = func === null || func === void 0 ? void 0 : func.layers) === null || _c === void 0 ? void 0 : _c.length) {
         params.Layers = func.layers.map(item => ({
             LayerName: item.name,
-            LayerVersion: item.version
+            // item.version 可能是字符串（如 JSON 配置文件中的 "1" 或模板变量替换结果），
+            // SCF API 要求 LayerVersion 为 int64，需显式转为 number
+            LayerVersion: Number(item.version)
         }));
     }
     // 7. 代码保护
@@ -264648,8 +265568,8 @@ function configToParams(options) {
         params.Code.ImageConfig = buildImageConfig(imageConfig);
     }
     // 第三阶段：统一应用默认值
-    const runtime = params.Runtime || 'Nodejs18.15';
-    return Object.assign({ Handler: func.handler || 'index.main', Timeout: 10, Runtime: 'Nodejs18.15', MemorySize: 256, InstallDependency: isNodeFunction(runtime) ? 'TRUE' : 'FALSE' }, params);
+    const runtime = params.Runtime || 'Nodejs20.19';
+    return Object.assign({ Handler: func.handler || 'index.main', Runtime: 'Nodejs20.19', MemorySize: 256, InstallDependency: isNodeFunction(runtime) ? 'TRUE' : 'FALSE' }, params);
 }
 class FunctionService {
     constructor(environment) {
@@ -264705,7 +265625,7 @@ class FunctionService {
     async createFunction(funcParam) {
         var _a, _b, _c;
         const { namespace } = this.getFunctionConfig();
-        const { func, functionRootPath, force = false, base64Code, codeSecret, functionPath, deployMode } = funcParam;
+        const { func, functionRootPath, force = false, base64Code, codeSecret, functionPath, deployMode, code } = funcParam;
         const funcName = func.name;
         const { TopicId, LogsetId } = this.getClsServiceConfig();
         const params = configToParams({
@@ -264719,20 +265639,30 @@ class FunctionService {
                 ClsLogsetId: LogsetId
             }
         });
+        const customCode = code;
+        const customImageCode = customCode === null || customCode === void 0 ? void 0 : customCode.ImageConfig;
+        const funcImageCode = (_a = params.Code) === null || _a === void 0 ? void 0 : _a.ImageConfig;
         // 根据部署方式处理 Code 参数
-        // 优先使用显式指定的 deployMode，如果未指定但存在 imageConfig 则认为是镜像部署
-        const isImageDeploy = deployMode === 'image' || (!deployMode && ((_a = params.Code) === null || _a === void 0 ? void 0 : _a.ImageConfig));
+        // 优先级：deployMode=image > 显式传入 code > 原有自动打包逻辑（base64Code/functionPath/functionRootPath）
+        const isImageDeploy = deployMode === 'image' || Boolean(customImageCode) || (!deployMode && Boolean(funcImageCode));
         if (isImageDeploy) {
-            // 镜像部署：Code 参数已在 configToParams 中通过 imageConfig 设置
+            // 镜像部署优先使用显式 code.ImageConfig；未传时回退到 func.imageConfig（configToParams 生成）
+            if (customImageCode) {
+                params.Code = customCode;
+            }
             if (!((_c = (_b = params.Code) === null || _b === void 0 ? void 0 : _b.ImageConfig) === null || _c === void 0 ? void 0 : _c.ImageUri)) {
                 throw new error_1.CloudBaseError('镜像部署需要配置 imageConfig.imageUri');
             }
-            // 镜像部署的特殊配置
-            // 镜像函数不需要 Handler
+            // 镜像函数不需要 Handler / InstallDependency
             delete params.Handler;
-            // 镜像函数不需要安装依赖
             delete params.InstallDependency;
         }
+        else if (customCode) {
+            if (base64Code || functionPath || functionRootPath) {
+                console.warn(`[${funcName}] 检测到同时传入 code 与本地打包参数，已优先使用 code 参数`);
+            }
+            params.Code = customCode;
+        }
         else {
             // 代码部署：通过 getCodeParams 获取代码参数
             params.Code = await this.getCodeParams({
@@ -264787,7 +265717,8 @@ class FunctionService {
                         functionPath,
                         functionRootPath,
                         codeSecret: codeSecret,
-                        deployMode: isImageDeploy ? 'image' : undefined
+                        deployMode: isImageDeploy ? 'image' : deployMode,
+                        code
                     });
                     // 等待函数状态正常
                     await this.waitFunctionActive(funcName, codeSecret);
@@ -265235,7 +266166,9 @@ class FunctionService {
         if ((_c = func === null || func === void 0 ? void 0 : func.layers) === null || _c === void 0 ? void 0 : _c.length) {
             params.Layers = func.layers.map(item => ({
                 LayerName: item.name,
-                LayerVersion: item.version
+                // item.version 可能是字符串（如 JSON 配置文件中的 "1" 或模板变量替换结果），
+                // SCF API 要求 LayerVersion 为 int64，需显式转为 number
+                LayerVersion: Number(item.version)
             }));
         }
         // 特殊处理：HTTP 函数多并发配置（大小写不敏感）
@@ -265290,7 +266223,7 @@ class FunctionService {
      * @memberof FunctionService
      */
     async updateFunctionCode(funcParam) {
-        const { func, functionRootPath, base64Code, codeSecret, functionPath, deployMode } = funcParam;
+        const { func, functionRootPath, base64Code, codeSecret, functionPath, deployMode, code } = funcParam;
         const funcName = func.name;
         const { namespace } = this.getFunctionConfig();
         // 镜像部署：使用镜像配置更新函数代码
@@ -265317,6 +266250,10 @@ class FunctionService {
                 });
             }
         }
+        const customCode = code;
+        if (customCode && (base64Code || functionPath || functionRootPath)) {
+            console.warn(`[${funcName}] 检测到同时传入 code 与本地打包参数，已优先使用 code 参数`);
+        }
         // 代码部署：原有逻辑
         let installDependency;
         // Node 函数默认安装依赖
@@ -265325,7 +266262,7 @@ class FunctionService {
         if (func.installDependency !== undefined) {
             installDependency = toBooleanString(func.installDependency);
         }
-        const codeParams = await this.getCodeParams({
+        const codeParams = customCode || await this.getCodeParams({
             func,
             functionPath,
             functionRootPath,
@@ -265919,7 +266856,7 @@ class FunctionService {
         const { func, functionPath, functionRootPath } = options;
         const { env, appId } = this.getFunctionConfig();
         if (!appId) {
-            throw new error_1.CloudBaseError('无法获取 AppId，请确认环境已开通存储服务');
+            throw new error_1.CloudBaseError('无法获取 AppId，请确认环境初始化完成或已开通存储服务');
         }
         const objectPath = `${appId}/${env}/${func.name}.zip`;
         // 1. 生成存放函数包的临时 Cos 目录
@@ -266155,14 +267092,18 @@ class FunctionService {
      * @memberof FunctionService
      */
     getFunctionConfig() {
-        var _a, _b, _c, _d, _e;
+        var _a, _b, _c, _d, _e, _f;
         const envConfig = this.environment.lazyEnvironmentConfig;
         // Functions 可能为空
         const namespace = ((_b = (_a = envConfig.Functions) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.Namespace) || '';
-        // AppId 可能为空字符串，从 Bucket 名称中提取
+        // AppId 优先从 DescribeEnvInfo 的 UserInfo 获取（账号级标识，不依赖存储服务）
+        // 兜底从 Storages[0] 的 AppId 或 Bucket 名提取
         // COS Bucket 格式: {BucketName}-{APPID}，APPID 为纯数字
         const storage = (_c = envConfig.Storages) === null || _c === void 0 ? void 0 : _c[0];
-        const appId = (storage === null || storage === void 0 ? void 0 : storage.AppId) || ((_e = (_d = storage === null || storage === void 0 ? void 0 : storage.Bucket) === null || _d === void 0 ? void 0 : _d.match(/-(\d+)$/)) === null || _e === void 0 ? void 0 : _e[1]) || '';
+        const appId = ((_d = envConfig.UserInfo) === null || _d === void 0 ? void 0 : _d.AppId)
+            || (storage === null || storage === void 0 ? void 0 : storage.AppId)
+            || ((_f = (_e = storage === null || storage === void 0 ? void 0 : storage.Bucket) === null || _e === void 0 ? void 0 : _e.match(/-(\d+)$/)) === null || _f === void 0 ? void 0 : _f[1])
+            || '';
         const { proxy } = this.environment.cloudBaseContext;
         return {
             proxy,