@cloudbase/cloudbase-mcp 2.31.0 → 2.32.0

package/dist/index.js

@@ -3474,7 +3474,7 @@ ${envIdSection}
 ## 环境信息
 - 操作系统: ${os_1.default.type()} ${os_1.default.release()}
 - Node.js版本: ${process.version}
-- MCP 版本：${process.env.npm_package_version || ( true ? "2.31.0" : 0)}
+- MCP 版本：${process.env.npm_package_version || ( true ? "2.32.0" : 0)}
 - 系统架构: ${os_1.default.arch()}
 - 时间: ${new Date().toISOString()}
 - 请求ID: ${requestId}
@@ -3555,7 +3555,7 @@ function createWrappedHandler(name, handler, server) {
                 requestId: (typeof error === 'object' && error && 'requestId' in error) ? error.requestId : '',
                 ide: server.ide || process.env.INTEGRATION_IDE || ''
             });
-            const mcpVersion =  true ? "2.31.0" : 0;
+            const mcpVersion =  true ? "2.32.0" : 0;
             const requestIdSuffix = requestId ? `\n🆔 RequestId: ${requestId}` : '';
             const enhancedErrorMessage = `${errorMessage}${requestIdSuffix}\n\n📦 CloudBase MCP v${mcpVersion}\n🔗 遇到问题？请复制以下链接到浏览器打开\n即可自动携带错误详情快速创建 GitHub Issue：\n${issueLink}`;
             // 创建新的错误对象，保持原有的错误类型但更新消息
@@ -3728,6 +3728,7 @@ const app_auth_js_1 = __webpack_require__(5313);
 const apps_js_1 = __webpack_require__(6817);
 const logs_js_1 = __webpack_require__(2322);
 const permissions_js_1 = __webpack_require__(6485);
+const msg_push_js_1 = __webpack_require__(7561);
 const cloud_mode_js_1 = __webpack_require__(9684);
 const logger_js_1 = __webpack_require__(3039);
 const site_map_js_1 = __webpack_require__(8107);
@@ -3800,6 +3801,7 @@ const AVAILABLE_PLUGINS = {
     apps: { name: "apps", register: apps_js_1.registerAppTools },
     cloudrun: { name: "cloudrun", register: cloudrun_js_1.registerCloudRunTools },
     capi: { name: "capi", register: capi_js_1.registerCapiTools },
+    "msg-push": { name: "msg-push", register: msg_push_js_1.registerMsgPushTools },
 };
 const PLUGIN_ALIASES = {
     "access-control": "permissions",
@@ -9001,6 +9003,42 @@ function normalizeAccessPath(path) {
     }
     return path.startsWith("/") ? path : `/${path}`;
 }
+/**
+ * Collect FAIL items from VerifyHTTPServiceRoute, mapping DNS records to
+ * lowercase field names for MCP structured output (aligned with CLI 3.8.1).
+ */
+function collectFailedVerifyChecks(result) {
+    const checkItems = {
+        ownership: result.Ownership,
+        cert: result.Cert,
+        quota: result.Quota,
+        routeConflict: result.RouteConflict,
+        domainConflict: result.DomainConflict,
+        internalAccount: result.InternalAccount,
+        blacklist: result.Blacklist,
+        cdnResource: result.CDNResource,
+        eo: result.EO,
+    };
+    return Object.entries(checkItems)
+        .filter(([, item]) => item?.Status === "FAIL")
+        .map(([name, item]) => {
+        const dnsRecords = item?.OwnershipVerification?.DnsVerification?.map(({ Subdomain, RecordType, RecordValue }) => ({
+            subdomain: Subdomain,
+            recordType: RecordType,
+            recordValue: RecordValue,
+        }));
+        return {
+            name,
+            status: item.Status,
+            ...(item?.Code ? { code: item.Code } : {}),
+            ...(item?.Message ? { message: item.Message } : {}),
+            ...(dnsRecords?.length ? { dnsRecords } : {}),
+        };
+    });
+}
+function isDefaultHttpServiceDomain(domain) {
+    return /(^|\.)app\.tcloudbase\.com$/i.test(domain);
+}
 function registerGatewayTools(server) {
     const cloudBaseOptions = server.cloudBaseOptions;
     const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
@@ -9016,6 +9054,129 @@ function registerGatewayTools(server) {
         data: {},
         message: error instanceof Error ? error.message : String(error),
     });
+    const verifyHttpServiceRouteOrFail = async (params) => {
+        const cloudbase = await getManager();
+        let result;
+        try {
+            result = await cloudbase.env.verifyHttpServiceRoute({
+                EnvId: params.envId,
+                Domain: params.domainParam,
+            });
+        }
+        catch (err) {
+            const domain = params.domainParam.Domain;
+            if (params.allowDefaultDomainApiFallback &&
+                domain &&
+                isDefaultHttpServiceDomain(domain)) {
+                const message = err instanceof Error ? err.message : String(err);
+                server.logger?.({
+                    type: "errorToolCall",
+                    toolName: "manageGateway",
+                    message: `verifyHttpServiceRoute skipped for default domain ${domain}: ${message}`,
+                });
+                return null;
+            }
+            throw err;
+        }
+        (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+        if (result.Passed !== false) {
+            return null;
+        }
+        const checks = collectFailedVerifyChecks(result);
+        const ownershipDns = checks.find((c) => c.name === "ownership")?.dnsRecords;
+        const hasDns = Boolean(ownershipDns?.length);
+        return {
+            success: false,
+            data: {
+                action: params.action,
+                domain: params.domainParam.Domain,
+                checks,
+                ...(result.RequestId ? { requestId: result.RequestId } : {}),
+            },
+            message: hasDns
+                ? "HTTP 服务域名配置预检未通过：域名归属权校验失败。请按 data.checks 中 ownership.dnsRecords 配置 DNS TXT 记录后重试。"
+                : "HTTP 服务域名配置预检未通过。请根据 data.checks 修复问题后重试。",
+            nextActions: [
+                {
+                    tool: "manageGateway",
+                    action: params.action,
+                    reason: hasDns
+                        ? "配置 DNS TXT（主机记录/记录类型/记录值见 data.checks[].dnsRecords）后重新调用本 action"
+                        : "根据 data.checks 修复预检失败项后重新调用本 action",
+                },
+            ],
+        };
+    };
+    /**
+     * Resolve SSL certificate ID for bindCustomDomain.
+     * Explicit certificateId wins; otherwise search by domain (single → auto, multi → guidance).
+     */
+    const resolveCertificateIdForBind = async (domain, certificateId) => {
+        if (certificateId) {
+            return { ok: true, certificateId };
+        }
+        const cloudbase = await getManager();
+        let certificates = [];
+        try {
+            const res = await cloudbase.env.describeCertificates({
+                SearchKey: domain,
+            });
+            certificates = res?.Certificates ?? [];
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new Error(`获取 SSL 证书列表失败：${message}。请传入 certificateId，或确认账号有 SSL 证书服务权限。`);
+        }
+        if (certificates.length === 0) {
+            return {
+                ok: false,
+                envelope: {
+                    success: false,
+                    data: { action: "bindCustomDomain", domain, certificates: [] },
+                    message: `未找到域名 [${domain}] 相关的可用 SSL 证书。请在腾讯云 SSL 证书控制台上传/申请后传入 certificateId 重试。`,
+                    nextActions: [
+                        {
+                            tool: "manageGateway",
+                            action: "bindCustomDomain",
+                            reason: "上传或申请匹配该域名的证书后，传入 certificateId 再调用 bindCustomDomain",
+                        },
+                    ],
+                },
+            };
+        }
+        if (certificates.length === 1) {
+            const only = certificates[0]?.CertificateId;
+            if (!only) {
+                throw new Error(`域名 [${domain}] 匹配到证书但缺少 CertificateId，请显式传入 certificateId。`);
+            }
+            return { ok: true, certificateId: only };
+        }
+        const options = certificates.map((cert) => ({
+            certificateId: cert.CertificateId,
+            domain: cert.Domain,
+            alias: cert.Alias,
+            certEndTime: cert.CertEndTime,
+        }));
+        return {
+            ok: false,
+            envelope: {
+                success: false,
+                data: {
+                    action: "bindCustomDomain",
+                    domain,
+                    certificates: options,
+                },
+                message: `找到 ${certificates.length} 个匹配证书，请选择其中一个 certificateId 后重试 bindCustomDomain（MCP 非交互，不会自动选择）。`,
+                nextActions: options
+                    .filter((c) => c.certificateId)
+                    .map((c) => ({
+                    tool: "manageGateway",
+                    action: "bindCustomDomain",
+                    reason: `使用 certificateId=${c.certificateId}（domain=${c.domain ?? "-"}, 到期=${c.certEndTime ?? "-"}）重试`,
+                })),
+            },
+        };
+    };
     const withEnvelope = async (handler) => {
         try {
             return (0, json_content_js_1.jsonContent)(await handler());
@@ -9373,6 +9534,16 @@ function registerGatewayTools(server) {
             case "createRoute": {
                 const cloudbase = await getManager();
                 const payload = await normalizeRoutePayload(input);
+                // Probe → create: ownership / cert / quota / conflict checks before create.
+                const verifyFailure = await verifyHttpServiceRouteOrFail({
+                    envId: payload.EnvId,
+                    domainParam: payload.Domain,
+                    action: "createRoute",
+                    allowDefaultDomainApiFallback: true,
+                });
+                if (verifyFailure) {
+                    return verifyFailure;
+                }
                 let result;
                 try {
                     result = await cloudbase.env.createHttpServiceRoute({
@@ -9617,8 +9788,8 @@ function registerGatewayTools(server) {
                 }, "HTTP 路由删除成功");
             }
             case "bindCustomDomain": {
-                if (!input.domain || !input.certificateId) {
-                    throw new Error("action=bindCustomDomain 时必须提供 domain 和 certificateId");
+                if (!input.domain) {
+                    throw new Error("action=bindCustomDomain 时必须提供 domain");
                 }
                 const accessType = input.accessType ?? "DIRECT";
                 if (accessType === "CUSTOM" && !input.customCname) {
@@ -9629,12 +9800,34 @@ function registerGatewayTools(server) {
                     throw new Error("customCname 仅在 accessType=CUSTOM 时可用；普通绑定用默认 DIRECT，不要传 customCname。" +
                         "说明：https://docs.cloudbase.net/service/custom-domain");
                 }
+                const envId = await resolveEnvId();
                 const cloudbase = await getManager();
+                // Align CLI 3.8.1: verify before certificate resolution / bind.
+                const verifyDomainParam = {
+                    Domain: input.domain,
+                    CertId: input.certificateId || "",
+                    AccessType: accessType,
+                    Enable: input.enable !== undefined ? input.enable : true,
+                    ...(input.customCname ? { CustomCname: input.customCname } : {}),
+                };
+                const verifyFailure = await verifyHttpServiceRouteOrFail({
+                    envId,
+                    domainParam: verifyDomainParam,
+                    action: "bindCustomDomain",
+                });
+                if (verifyFailure) {
+                    return verifyFailure;
+                }
+                const certResolved = await resolveCertificateIdForBind(input.domain, input.certificateId);
+                if (!certResolved.ok) {
+                    return certResolved.envelope;
+                }
+                const certificateId = certResolved.certificateId;
                 const result = await cloudbase.env.bindCustomDomain({
-                    EnvId: await resolveEnvId(),
+                    EnvId: envId,
                     Domain: {
                         Domain: input.domain,
-                        CertId: input.certificateId,
+                        CertId: certificateId,
                         AccessType: accessType,
                         ...(input.enable !== undefined
                             ? { Enable: input.enable }
@@ -9648,7 +9841,7 @@ function registerGatewayTools(server) {
                 return buildEnvelope({
                     action: input.action,
                     domain: input.domain,
-                    certificateId: input.certificateId,
+                    certificateId,
                     accessType,
                     ...(input.customCname
                         ? { customCname: input.customCname }
@@ -9813,7 +10006,8 @@ function registerGatewayTools(server) {
             "createRoute 只建网关入口，不改上游权限。" +
             "enablePathTransmission：默认 false 剥触发路径前缀；true 透传完整路径（CBR 多路由、WEB_SCF 自管子路径常需 true；STATIC_STORE 自定义触发路径映射站点根通常 false）。" +
             "⚠️ 自定义域名访问：若环境已有自定义域名（先 queryGateway listCustomDomains），优先 createRoute 并显式传入该 domain，无需 certificateId；" +
-            "仅首次绑定全新自定义域名时用 bindCustomDomain（需 certificateId）。CORS/安全域名用 envDomainManagement。" +
+            "仅首次绑定全新自定义域名时用 bindCustomDomain（certificateId 可选：未传时按域名自动检索证书，单证书自动选用、多证书返回选择指引）。" +
+            "createRoute / bindCustomDomain 创建前会调用 VerifyHTTPServiceRoute 做归属权等预检（探测→创建）；失败时返回 data.checks 与 DNS TXT 指引，配置后重试。CORS/安全域名用 envDomainManagement。" +
             "enableService/authSwitch：HTTP 网关总开关与访问鉴权开关；createRoute 后若访问报 HTTPSERVICE_NONACTIVATED，通常是总开关未开启（用 queryGateway getPrivilege 查询、enableService 开启）。",
         inputSchema: {
             action: zod_1.z
@@ -9825,7 +10019,8 @@ function registerGatewayTools(server) {
                 "updateRoute 也可传 enable/route.enable 直接改 Routes[].Enable。" +
                 "关闭 *.tcloudbaseapp.com 默认静态托管域：disableRoute + domain=该 STATIC_STORE IsDefault 域名 + path=\"/\"。" +
                 "已有自定义域名时优先 createRoute(domain=已有域名) 实现访问，不必再次 bindCustomDomain / 传入 certificateId；" +
-                "bindCustomDomain 仅用于首次绑定新域名（需 certificateId；可选 accessType=DIRECT|CDN|CUSTOM，CUSTOM 需 customCname；普通场景用默认 DIRECT）。" +
+                "bindCustomDomain 仅用于首次绑定新域名（certificateId 可选，未传则按域名自动检索；可选 accessType=DIRECT|CDN|CUSTOM，CUSTOM 需 customCname；普通场景用默认 DIRECT）。" +
+                "createRoute/bindCustomDomain 创建前会 VerifyHTTPServiceRoute 预检；失败时按返回的 DNS TXT 指引配置后重试。" +
                 "接入说明：https://docs.cloudbase.net/service/custom-domain"),
             targetName: zod_1.z
                 .string()
@@ -9896,7 +10091,9 @@ function registerGatewayTools(server) {
             certificateId: zod_1.z
                 .string()
                 .optional()
-                .describe("证书 ID。仅首次 bindCustomDomain 必填。" +
+                .describe("证书 ID。仅 bindCustomDomain 使用：显式传入时跳过自动检索；" +
+                "省略时按 domain 调用 describeCertificates(SearchKey=domain)——" +
+                "单证书自动选用，无证书报错，多证书返回结构化选择指引（MCP 非交互）。" +
                 "在已有自定义域名上 createRoute / updateRoute / deleteRoute 不需要 certificateId。"),
             accessType: zod_1.z
                 .enum(["DIRECT", "CDN", "CUSTOM"])
@@ -13555,7 +13752,7 @@ class TelemetryReporter {
         const arch = os_1.default.arch(); // 系统架构
         // Build-time injected version; guard for vitest / non-webpack runtimes.
         const mcpVersion = process.env.npm_package_version ||
-            ( true ? "2.31.0" : 0);
+            ( true ? "2.32.0" : 0);
         return {
             userAgent: `${osType} ${osRelease} ${arch} ${nodeVersion} CloudBase-MCP/${mcpVersion}`,
             deviceId: this.deviceId,
@@ -19462,7 +19659,7 @@ function registerSetupTools(server) {
     server.registerTool("downloadTemplate", {
         title: "下载项目模板",
         description: `自动下载并部署CloudBase项目模板。
-**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.31.0" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
+**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.32.0" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
         inputSchema: {
             template: zod_1.z
                 .enum(["react", "vue", "miniprogram", "uniapp", "rules"])
@@ -22071,6 +22268,750 @@ async function logout(options) {
 }
 
 
+/***/ }),
+
+/***/ 7561:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.QbaseError = exports.MSG_TYPES = exports.XPAY_EVENT_TYPES = void 0;
+exports.mergeSubscribeList = mergeSubscribeList;
+exports.mergeUnsubscribeList = mergeUnsubscribeList;
+exports.mergeSetEnableList = mergeSetEnableList;
+exports.registerMsgPushTools = registerMsgPushTools;
+const zod_1 = __webpack_require__(2971);
+const tool_result_js_1 = __webpack_require__(9835);
+const CATEGORY = "消息推送";
+/** 消息推送 qbase CGI 对应的 Cloud API service 名（宿主按后端契约确认） */
+const MSG_PUSH_SERVICE = "qbase";
+/** 消息推送 Cloud API version（宿主按后端契约确认） */
+const MSG_PUSH_VERSION = "2018-06-08";
+/**
+ * 虚拟支付默认事件集合。
+ * manageMessagePush(action=subscribe) 未传 event_types 时默认订阅这 7 个事件。
+ */
+exports.XPAY_EVENT_TYPES = [
+    "xpay_goods_deliver_notify",
+    "xpay_coin_pay_notify",
+    "xpay_complaint_notify",
+    "xpay_subscribe_signing_result_notify",
+    "xpay_subscribe_pay_fail_notify",
+    "xpay_subscribe_ios_refund_query_notify",
+    "xpay_refund_notify",
+];
+/** 配置不存在的业务码（getappconfig 返回该码时视为空配置） */
+const RET_CONFIG_NOT_EXISTS = 80209;
+/**
+ * uploadappconfig version 乐观锁冲突业务码（实测：用旧 version 覆盖写返回 ret=80208）。
+ * Prefer structured ret over errmsg regex; regex remains a fallback.
+ */
+const RET_VERSION_CONFLICT = 80208;
+/** 消息推送条目类型（虚拟支付回调等事件均为 event） */
+const MSG_TYPE_EVENT = "event";
+/**
+ * manageMessagePush 可操作的消息类型。
+ * - event：事件类（需 event_types；event 字段为具体事件名）
+ * - text/image/voice/video/miniprogrampage：消息类型条目（event 固定空串 ""）
+ */
+exports.MSG_TYPES = [
+    "event",
+    "text",
+    "image",
+    "voice",
+    "video",
+    "miniprogrampage",
+];
+/** Empty event field for non-event message-type callback entries */
+const EMPTY_EVENT = "";
+/** qbase CGI 业务错误（code 为 ret 或内部错误码） */
+class QbaseError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "QbaseError";
+        this.code = code;
+    }
+}
+exports.QbaseError = QbaseError;
+function canonicalEntry(entry) {
+    return JSON.stringify([
+        entry.msgType,
+        entry.event,
+        entry.env,
+        entry.functionName,
+        entry.enable ?? false,
+    ]);
+}
+function sameCallbackList(a, b) {
+    if (a.length !== b.length)
+        return false;
+    const sortedA = a.map(canonicalEntry).sort();
+    const sortedB = b.map(canonicalEntry).sort();
+    return sortedA.every((v, i) => v === sortedB[i]);
+}
+/**
+ * subscribe 幂等 merge：对每个目标事件，
+ * - 已存在完全相同 (msgType, event, env, functionName) 的条目 → 保留原条目（含 enable，幂等）
+ * - 该事件已绑定到其他云函数 → 移除旧条目并重绑到目标函数（一事一函数）；重绑保留原 enable
+ * - 全新事件条目 → 默认 enable=true
+ * 未变化时 changed=false，调用方跳过 POST。
+ */
+function mergeSubscribeList(current, targets, envId, functionName, msgType = MSG_TYPE_EVENT) {
+    const uniqueTargets = [...new Set(targets)];
+    const kept = [];
+    const keptEvents = new Set();
+    const rebound = [];
+    /** enable to preserve when rebinding an existing event onto a different function */
+    const reboundEnableByEvent = new Map();
+    for (const entry of current) {
+        if (entry.msgType === msgType && uniqueTargets.includes(entry.event)) {
+            if (entry.env === envId && entry.functionName === functionName) {
+                if (keptEvents.has(entry.event)) {
+                    continue; // 防御：同事件重复条目只保留一条
+                }
+                keptEvents.add(entry.event);
+                kept.push(entry);
+            }
+            else {
+                rebound.push(entry.event);
+                if (!reboundEnableByEvent.has(entry.event)) {
+                    reboundEnableByEvent.set(entry.event, entry.enable ?? false);
+                }
+            }
+        }
+        else {
+            kept.push(entry);
+        }
+    }
+    const added = [];
+    for (const target of uniqueTargets) {
+        const exists = kept.some((e) => e.msgType === msgType &&
+            e.event === target &&
+            e.env === envId &&
+            e.functionName === functionName);
+        if (!exists) {
+            // Rebound keeps prior enable; brand-new events default to enabled
+            const enable = reboundEnableByEvent.has(target)
+                ? reboundEnableByEvent.get(target)
+                : true;
+            kept.push({ msgType, event: target, env: envId, functionName, enable });
+            added.push(target);
+        }
+    }
+    return {
+        list: kept,
+        changed: !sameCallbackList(current, kept),
+        added,
+        rebound: [...new Set(rebound)],
+        removed: [],
+        matched: [],
+    };
+}
+/**
+ * unsubscribe merge：仅移除匹配 (msgType, event, env, functionName) 的条目，
+ * 其他配置全部保留；无匹配条目时 changed=false（幂等 no-op）。
+ */
+function mergeUnsubscribeList(current, targets, envId, functionName, msgType = MSG_TYPE_EVENT) {
+    const uniqueTargets = new Set(targets);
+    const removed = [];
+    const list = current.filter((entry) => {
+        if (entry.msgType === msgType &&
+            uniqueTargets.has(entry.event) &&
+            entry.env === envId &&
+            entry.functionName === functionName) {
+            removed.push(entry.event);
+            return false;
+        }
+        return true;
+    });
+    return {
+        list,
+        changed: !sameCallbackList(current, list),
+        added: [],
+        rebound: [],
+        removed: [...new Set(removed)],
+        matched: [],
+    };
+}
+/**
+ * setEnable merge：翻转匹配条目的 enable 字段；无匹配条目或值未变化时 changed=false。
+ */
+function mergeSetEnableList(current, targets, envId, functionName, enable, msgType = MSG_TYPE_EVENT) {
+    const uniqueTargets = new Set(targets);
+    const matched = [];
+    const list = current.map((entry) => {
+        if (entry.msgType === msgType &&
+            uniqueTargets.has(entry.event) &&
+            entry.env === envId &&
+            entry.functionName === functionName) {
+            matched.push(entry.event);
+            if ((entry.enable ?? false) === enable)
+                return entry;
+            return { ...entry, enable };
+        }
+        return entry;
+    });
+    return {
+        list,
+        changed: !sameCallbackList(current, list),
+        added: [],
+        rebound: [],
+        removed: [],
+        matched: [...new Set(matched)],
+    };
+}
+function getTransport(server) {
+    return server.cloudBaseOptions?.requestFn;
+}
+function parseConfigString(config) {
+    if (typeof config !== "string" || !config) {
+        throw new QbaseError("PARSE_ERROR", "getappconfig 返回的 config 为空或非 JSON 字符串");
+    }
+    try {
+        const parsed = JSON.parse(config);
+        return {
+            enable: parsed?.enable !== false,
+            callbacks: Array.isArray(parsed?.callbacks) ? parsed.callbacks : [],
+        };
+    }
+    catch (e) {
+        throw new QbaseError("PARSE_ERROR", `getappconfig 返回的 config 解析失败: ${e instanceof Error ? e.message : String(e)}`);
+    }
+}
+/**
+ * 经现有 CloudApiRequestFn（cloudBaseOptions.requestFn）领域语义调用 qbase CGI。
+ * 与 databaseNoSQL/functions 完全一致：包内只表达 service/action/payload，不感知 URL；
+ * 由宿主（微信 IDE）注入的 requestFn 负责路由到 wxa-dev-qbase/apihttpagent 并附加登录态。
+ */
+async function callQbase(server, appid, action, payload) {
+    const requestFn = getTransport(server);
+    if (!requestFn) {
+        throw new QbaseError("TRANSPORT_UNAVAILABLE", "未注入 Cloud API 请求通道（cloudBaseOptions.requestFn）");
+    }
+    const service = server.pluginOptions?.msgPush?.service ?? MSG_PUSH_SERVICE;
+    try {
+        // Pass appid as a top-level optional field so hosts can select the correct
+        // WeChat login session in multi-appid scenarios (additive, non-breaking).
+        const result = await requestFn({
+            service,
+            action,
+            version: MSG_PUSH_VERSION,
+            region: "",
+            payload,
+            appid,
+        });
+        return (result ?? {});
+    }
+    catch (e) {
+        throw new QbaseError("TRANSPORT_ERROR", `qbase 请求失败(${service}/${action}): ${e instanceof Error ? e.message : String(e)}`);
+    }
+}
+/** 读取当前消息推送配置（乐观锁：version + 全量列表） */
+async function readCallbackConfig(server, appid) {
+    const resp = await callQbase(server, appid, "getAppConfig", { type: 1 });
+    const ret = resp.base_resp?.ret;
+    if (ret !== undefined && ret !== 0) {
+        if (ret === RET_CONFIG_NOT_EXISTS) {
+            return { version: 0, enable: false, list: [] };
+        }
+        throw new QbaseError(ret, `getappconfig 失败(ret=${ret}): ${resp.base_resp?.errmsg ?? "未知错误"}`);
+    }
+    const config = parseConfigString(resp.config);
+    return {
+        version: Number(resp.version ?? 0),
+        enable: config.enable,
+        list: config.callbacks,
+    };
+}
+/** 读取合法事件约束列表 */
+async function fetchSupportedEvents(server, appid) {
+    const resp = await callQbase(server, appid, "getCallbackSupportList", {});
+    const ret = resp.base_resp?.ret;
+    if (ret !== undefined && ret !== 0) {
+        throw new QbaseError(ret, `getcallbacksupportlist 失败(ret=${ret}): ${resp.base_resp?.errmsg ?? "未知错误"}`);
+    }
+    const raw = resp.data;
+    if (typeof raw === "string") {
+        try {
+            const parsed = JSON.parse(raw);
+            return Array.isArray(parsed?.list) ? parsed.list : [];
+        }
+        catch {
+            return [];
+        }
+    }
+    if (typeof raw === "object" && raw !== null && Array.isArray(raw.list)) {
+        return raw.list;
+    }
+    return [];
+}
+/** 全量覆盖写入配置（带 version 乐观锁；冲突时抛 VERSION_CONFLICT） */
+async function uploadCallbackConfig(server, appid, state) {
+    const resp = await callQbase(server, appid, "uploadAppConfig", {
+        type: 1,
+        version: state.version,
+        config: JSON.stringify({ enable: state.enable, callbacks: state.list }),
+    });
+    const ret = resp.base_resp?.ret;
+    if (ret !== undefined && ret !== 0) {
+        const errmsg = resp.base_resp?.errmsg ?? "";
+        // Prefer structured ret (80208); fall back to errmsg regex for older/unknown backends
+        const isVersionConflict = ret === RET_VERSION_CONFLICT || /version|版本|conflict|冲突/i.test(errmsg);
+        if (isVersionConflict) {
+            throw new QbaseError("VERSION_CONFLICT", `uploadappconfig version 冲突（ret=${ret}，本地 version=${state.version}，服务端已被其他操作修改）: ${errmsg || "system error"}。` +
+                `请重新调用 queryMessagePush(action=list) 获取最新配置后重试（RFC 7232 If-Match 语义：重读 → merge → 重试）。`);
+        }
+        throw new QbaseError(ret, `uploadappconfig 失败(ret=${ret}): ${errmsg || "未知错误"}。请重新查询最新配置后重试。`);
+    }
+}
+/** 读取云托管消息推送配置；无配置（云函数模式）返回 null */
+async function readContainerConfig(server, appid) {
+    const resp = await callQbase(server, appid, "getContainerCallbackConfig", {});
+    const ret = resp.base_resp?.ret;
+    if (ret !== undefined && ret !== 0) {
+        if (ret === RET_CONFIG_NOT_EXISTS) {
+            return null;
+        }
+        throw new QbaseError(ret, `getcontainercallbackconfig 失败(ret=${ret}): ${resp.base_resp?.errmsg ?? "未知错误"}`);
+    }
+    const { base_resp: _base, ...config } = resp;
+    return config;
+}
+async function setContainerConfig(server, appid, cfg) {
+    const resp = await callQbase(server, appid, "setContainerCallbackConfig", cfg);
+    const ret = resp.base_resp?.ret;
+    if (ret !== undefined && ret !== 0) {
+        throw new QbaseError(ret, `setcontainercallbackconfig 失败(ret=${ret}): ${resp.base_resp?.errmsg ?? "未知错误"}`);
+    }
+}
+function buildTransportUnavailablePayload(toolName, action) {
+    return (0, tool_result_js_1.buildJsonToolResult)({
+        ok: false,
+        code: "MSG_PUSH_TRANSPORT_UNAVAILABLE",
+        message: "消息推送配置依赖微信小程序云开发 qbase 管理接口（需要微信 IDE 登录态），" +
+            "当前 CloudBase MCP 进程未注入 Cloud API 请求通道（cloudBaseOptions.requestFn），无法直连 qbase" +
+            "（安全边界：腾讯云身份不可调用微信登录态 CGI）。\n" +
+            "可用方案：\n" +
+            "- 在微信开发者工具 MCP 中使用 cloud_msg_push_query / cloud_msg_push_manage（微信 IDE 已注入 qbase 通道）\n" +
+            "- 或由宿主（微信 IDE）在 createCloudBaseMcpServer 时注入 cloudBaseOptions.requestFn，并在 pluginsEnabled 中启用 msg-push 插件",
+        next_step: {
+            tool: toolName,
+            action,
+            hint: "需在微信 IDE 登录态通道中调用",
+        },
+    });
+}
+function buildConfirmPayload({ toolName, action, message, requiredParams, }) {
+    return (0, tool_result_js_1.buildJsonToolResult)({
+        ok: false,
+        code: "CONFIRM_REQUIRED",
+        message: `${message}\n\n请核对后传入 confirm="yes" 确认执行；如需取消或修改，请勿传 confirm="yes"，改传其他参数重试。`,
+        confirmation_acknowledgement: {
+            text: "我已知晓并确认执行上述消息推送配置变更",
+            required: true,
+        },
+        next_step: { tool: toolName, action, requiredParams },
+    });
+}
+function buildInvalidEventPayload(action, invalid) {
+    return (0, tool_result_js_1.buildJsonToolResult)({
+        ok: false,
+        code: "INVALID_EVENT_TYPE",
+        message: `${action} 包含不在合法约束内的事件：${invalid.join(", ")}。` +
+            `请先调用 queryMessagePush(action=listSupportedEvents) 查询该小程序全部合法事件（含虚拟支付 7 个 xpay_* 事件），` +
+            `确认事件名称后重试。`,
+        invalid_events: invalid,
+        next_step: {
+            tool: "queryMessagePush",
+            action: "listSupportedEvents",
+            required_params: ["appid"],
+        },
+    });
+}
+function buildMergeDiffText(action, result, envId, functionName) {
+    const lines = [];
+    if (action === "subscribe") {
+        if (result.added.length) {
+            lines.push(`- 新增订阅（${envId}/${functionName}）: ${result.added.join(", ")}`);
+        }
+        if (result.rebound.length) {
+            lines.push(`- 重绑事件（原绑定其他云函数，按"一事一函数"约束改绑到 ${envId}/${functionName}）: ${result.rebound.join(", ")}`);
+        }
+    }
+    else if (action === "unsubscribe") {
+        lines.push(`- 移除订阅（${envId}/${functionName}）: ${result.removed.join(", ")}`);
+    }
+    else if (action === "setEnable") {
+        lines.push(`- ${result.matched.length ? "" : "未匹配到条目"}订阅状态变更（${envId}/${functionName}）: ${result.matched.join(", ")}`);
+    }
+    return lines.join("\n");
+}
+function registerMsgPushTools(server) {
+    const logger = server.logger;
+    // ─── queryMessagePush（只读）───────────────────────────────────────────────
+    server.registerTool?.("queryMessagePush", {
+        title: "查询小程序消息推送配置",
+        description: "查询小程序云开发消息推送配置（qbase getappconfig）或全部合法消息推送事件约束（getcallbacksupportlist）。" +
+            "消息推送把小程序事件/消息（含虚拟支付回调、text/image 等消息类型）送到云函数，无需自建服务器。" +
+            "action=list 返回当前配置列表（msgType/event/env/functionName/enable）与 version（乐观锁版本号）；" +
+            "action=listSupportedEvents 返回全部合法约束（按消息类型分组：event 组含事件名列表；text/image/voice/video/miniprogrampage 组 events 为空数组），" +
+            "事件类用 manageMessagePush(event_types=...)，消息类型用 manageMessagePush(msg_type=...)。" +
+            "需要微信 IDE 登录态通道（宿主注入 cloudBaseOptions.requestFn），独立 CloudBase MCP 运行会返回指引错误。",
+        inputSchema: {
+            appid: zod_1.z
+                .string()
+                .describe("小程序 AppID（必填，与微信开发者工具一致；用于选择微信登录态会话）"),
+            env: zod_1.z.string().optional().describe("可选：环境 ID；传入时 list 仅返回该环境的订阅条目"),
+            action: zod_1.z
+                .enum(["list", "listSupportedEvents"])
+                .describe("list: 查询当前消息推送配置列表\nlistSupportedEvents: 查询全部合法消息推送事件约束（按 msgType 分组）"),
+        },
+        annotations: {
+            readOnlyHint: true,
+            openWorldHint: true,
+            category: CATEGORY,
+        },
+    }, async ({ appid, env, action }) => {
+        if (!getTransport(server)) {
+            return buildTransportUnavailablePayload("queryMessagePush", action);
+        }
+        if (action === "list") {
+            const state = await readCallbackConfig(server, appid);
+            const callbacks = env
+                ? state.list.filter((c) => c.env === env)
+                : state.list;
+            return (0, tool_result_js_1.buildJsonToolResult)({
+                ok: true,
+                success: true,
+                message: "查询消息推送配置成功",
+                version: state.version,
+                enable: state.enable,
+                callbacks,
+                filteredByEnv: env ?? undefined,
+                next_steps: [
+                    "manageMessagePush(action=subscribe) 订阅事件（缺省 event_types 时默认订阅虚拟支付 7 事件）",
+                    "queryMessagePush(action=listSupportedEvents) 查看全部合法事件",
+                ],
+            });
+        }
+        if (action === "listSupportedEvents") {
+            const constraints = await fetchSupportedEvents(server, appid);
+            const grouped = [];
+            const byMsgType = new Map();
+            for (const c of constraints) {
+                // Ensure every msgType appears (message types like text have empty event)
+                if (!byMsgType.has(c.msgType)) {
+                    byMsgType.set(c.msgType, []);
+                }
+                if (c.event) {
+                    byMsgType.get(c.msgType).push(c.event);
+                }
+            }
+            for (const [msgType, events] of byMsgType) {
+                grouped.push({ msgType, events });
+            }
+            const supportedSet = new Set(constraints.filter((c) => c.event).map((c) => c.event));
+            const xpaySupported = exports.XPAY_EVENT_TYPES.filter((e) => supportedSet.has(e));
+            const xpayMissing = exports.XPAY_EVENT_TYPES.filter((e) => !supportedSet.has(e));
+            return (0, tool_result_js_1.buildJsonToolResult)({
+                ok: true,
+                success: true,
+                message: "获取合法消息推送事件约束成功",
+                msgTypes: grouped,
+                totalEvents: supportedSet.size,
+                xpay_default_events: {
+                    supported: xpaySupported,
+                    missing: xpayMissing,
+                    hint: xpayMissing.length
+                        ? "以下默认事件不在当前小程序合法约束中（可能未开通虚拟支付），订阅时服务端可能拒绝"
+                        : undefined,
+                },
+                hint: "manageMessagePush 的 event_types 仅接受上述合法事件；subscribe 缺省 event_types 时默认订阅虚拟支付 7 事件。" +
+                    "消息类型条目（text/image/voice/video/miniprogrampage，events 为空数组）请用 manageMessagePush(msg_type=...) 管理，无需 event_types。",
+            });
+        }
+        throw new Error(`不支持的操作类型: ${action}`);
+    });
+    // ─── manageMessagePush（写，需确认）────────────────────────────────────────
+    server.registerTool?.("manageMessagePush", {
+        title: "管理小程序消息推送配置",
+        description: "管理小程序云开发消息推送配置（写操作，需 confirm=\"yes\" 确认）。" +
+            "基于「读全量 → merge → 全量覆盖（带 version 乐观锁）」实现声明式幂等（对齐 kubectl apply：event_types 是期望集合，重复执行收敛到同一状态；" +
+            "version 冲突即 RFC 7232 If-Match 412，返回可重试错误：重读 → merge → 重试）。" +
+            "msg_type 区分两类条目（缺省 \"event\"，向后兼容）：" +
+            "msg_type=\"event\" 操作事件类（需 event_types；subscribe 缺省时默认虚拟支付 7 个 xpay_* 事件）；" +
+            "msg_type=\"text\"|\"image\"|\"voice\"|\"video\"|\"miniprogrampage\" 操作消息类型条目（event 固定空串，勿传 event_types）。" +
+            "action=subscribe 订阅到指定云函数；同一 (msgType,event) 只能推到一个云函数（一事一函数），已绑定其他函数会自动重绑并说明。" +
+            "action=unsubscribe 移除匹配订阅（msg_type=event 时 event_types 必填；消息类型时按 msg_type 移除）。" +
+            "action=setEnable 启用/停用匹配订阅（msg_type=event 时 event_types + enable 必填；消息类型时 msg_type + enable）。" +
+            "action=ensureCloudFunctionMode 确保推送模式为云函数（若为云托管整包接收则切换 qbase_open=false，需确认）。" +
+            "集合无变化时不发起写请求（幂等 no-op，无需确认）。" +
+            "需要微信 IDE 登录态通道（宿主注入 cloudBaseOptions.requestFn）。",
+        inputSchema: {
+            appid: zod_1.z
+                .string()
+                .describe("小程序 AppID（必填，与微信开发者工具一致；用于选择微信登录态会话）"),
+            env_id: zod_1.z.string().describe("环境 ID（订阅条目绑定的云开发环境）"),
+            function_name: zod_1.z.string().describe("接收消息推送的云函数名"),
+            action: zod_1.z
+                .enum(["subscribe", "unsubscribe", "setEnable", "ensureCloudFunctionMode"])
+                .describe("subscribe: 订阅到指定云函数（msg_type=event 时 event_types 缺省=虚拟支付 7 事件；消息类型时按 msg_type 订阅）\n" +
+                "unsubscribe: 移除匹配订阅（msg_type=event 时 event_types 必填）\n" +
+                "setEnable: 启用/停用匹配订阅（msg_type=event 时 event_types + enable 必填）\n" +
+                "ensureCloudFunctionMode: 确保为云函数推送模式（云托管整包接收时切换，需确认）"),
+            msg_type: zod_1.z
+                .enum(exports.MSG_TYPES)
+                .optional()
+                .describe('消息类型（缺省 "event"）。' +
+                '"event"：事件类条目，需配合 event_types（subscribe 可缺省=虚拟支付 7 事件）。' +
+                '"text"|"image"|"voice"|"video"|"miniprogrampage"：消息类型条目（event 固定空串），勿传 event_types。'),
+            event_types: zod_1.z
+                .array(zod_1.z.string())
+                .optional()
+                .describe("要操作的事件列表（仅 msg_type=\"event\" 时使用；可先 queryMessagePush(action=listSupportedEvents) 查询全量约束）。" +
+                "subscribe 缺省时默认订阅虚拟支付 7 个事件：xpay_goods_deliver_notify、xpay_coin_pay_notify、xpay_complaint_notify、" +
+                "xpay_subscribe_signing_result_notify、xpay_subscribe_pay_fail_notify、xpay_subscribe_ios_refund_query_notify、xpay_refund_notify；" +
+                "unsubscribe / setEnable 且 msg_type=event 时必填。消息类型操作请勿传本参数。"),
+            enable: zod_1.z.boolean().optional().describe("setEnable 时必填：true 启用订阅 / false 停用订阅"),
+            confirm: zod_1.z
+                .string()
+                .optional()
+                .describe('写操作确认：确认执行请传 confirm="yes"；不传或传其他值将返回待确认的配置摘要（CONFIRM_REQUIRED），核对后再重试。集合无变化时无需确认。'),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: true,
+            openWorldHint: true,
+            category: CATEGORY,
+        },
+    }, async ({ appid, env_id, function_name, action, msg_type, event_types, enable, confirm, }) => {
+        if (!getTransport(server)) {
+            return buildTransportUnavailablePayload("manageMessagePush", action);
+        }
+        const confirmed = confirm === "yes";
+        const resolvedMsgType = msg_type ?? MSG_TYPE_EVENT;
+        const isEventMsgType = resolvedMsgType === MSG_TYPE_EVENT;
+        if (action === "ensureCloudFunctionMode") {
+            const current = await readContainerConfig(server, appid);
+            if (!current || current.qbase_open === false) {
+                return (0, tool_result_js_1.buildJsonToolResult)({
+                    ok: true,
+                    success: true,
+                    code: "NO_CHANGE",
+                    message: "当前已是云函数推送模式（云托管整包接收未开启），无需变更",
+                    containerConfig: current ?? undefined,
+                });
+            }
+            if (!confirmed) {
+                return buildConfirmPayload({
+                    toolName: "manageMessagePush",
+                    action,
+                    message: `当前推送模式为云托管整包接收（qbase_open=true，环境 ${current.qbase_env ?? "-"}，路径 ${current.qbase_container_path ?? "-"}），` +
+                        `事件会整包进入云托管而非云函数。\n即将执行 setcontainercallbackconfig 关闭云托管整包接收（qbase_open=false），` +
+                        `使消息推送按事件进入云函数 ${env_id}/${function_name}。`,
+                    requiredParams: ["appid", "env_id", "function_name", "confirm"],
+                });
+            }
+            await setContainerConfig(server, appid, {
+                ...current,
+                qbase_open: false,
+            });
+            logger?.({
+                type: "toolInfo",
+                toolName: "manageMessagePush",
+                message: "已切换到云函数推送模式",
+                appid,
+                envId: env_id,
+            });
+            return (0, tool_result_js_1.buildJsonToolResult)({
+                ok: true,
+                success: true,
+                message: "已切换到云函数推送模式（setcontainercallbackconfig qbase_open=false 成功）",
+                action,
+            });
+        }
+        // Message-type entries use a fixed empty event; event_types must not be supplied
+        if (!isEventMsgType && event_types && event_types.length > 0) {
+            throw new Error(`msg_type="${resolvedMsgType}" 时不应传 event_types（消息类型条目的 event 固定为空串 ""）；` +
+                `请去掉 event_types，仅传 msg_type / function_name / enable（setEnable 时）`);
+        }
+        // subscribe / unsubscribe / setEnable 共用流程：读 → 校验 → merge → 确认 → 覆盖写
+        let eventList;
+        if (!isEventMsgType) {
+            // Non-event message types: single entry keyed by (msgType, event="")
+            eventList = [EMPTY_EVENT];
+        }
+        else {
+            const targets = event_types ? [...new Set(event_types)] : undefined;
+            if (action === "subscribe" && !targets) {
+                // 缺省 = 虚拟支付默认事件集合
+            }
+            else if (!targets || targets.length === 0) {
+                throw new Error(`${action} 必须提供 event_types（要操作的事件列表，可先 queryMessagePush(action=listSupportedEvents) 查询）；` +
+                    `若操作消息类型条目请传 msg_type（如 "text"），勿传 event_types`);
+            }
+            eventList = targets ?? [...exports.XPAY_EVENT_TYPES];
+        }
+        // 1. 读当前配置（乐观锁基础：必须读全量再 merge，禁止用本地列表直接覆盖）
+        const state = await readCallbackConfig(server, appid);
+        // 2. 合法性校验
+        let warnings = [];
+        if (!isEventMsgType) {
+            // Validate msg_type exists in support list (message types have empty/missing event)
+            try {
+                const constraints = await fetchSupportedEvents(server, appid);
+                const supportedMsgTypes = new Set(constraints.map((c) => c.msgType));
+                if (!supportedMsgTypes.has(resolvedMsgType)) {
+                    return (0, tool_result_js_1.buildJsonToolResult)({
+                        ok: false,
+                        code: "INVALID_MSG_TYPE",
+                        message: `msg_type="${resolvedMsgType}" 不在 getcallbacksupportlist 合法消息类型内。` +
+                            `请先 queryMessagePush(action=listSupportedEvents) 查看可用 msgTypes。`,
+                        next_step: { tool: "queryMessagePush", action: "listSupportedEvents" },
+                    });
+                }
+            }
+            catch {
+                // Constraint fetch failure does not block; server still validates on write
+            }
+        }
+        else if (action === "subscribe" && event_types && event_types.length > 0) {
+            // 显式 event_types 时严格校验合法性（默认集合仅警告，服务端为准）
+            const constraints = await fetchSupportedEvents(server, appid);
+            const supported = new Set(constraints.filter((c) => c.event).map((c) => c.event));
+            const invalid = eventList.filter((e) => !supported.has(e));
+            if (invalid.length > 0) {
+                return buildInvalidEventPayload(action, invalid);
+            }
+        }
+        else if (action === "subscribe") {
+            try {
+                const constraints = await fetchSupportedEvents(server, appid);
+                const supported = new Set(constraints.filter((c) => c.event).map((c) => c.event));
+                warnings = eventList.filter((e) => !supported.has(e));
+            }
+            catch {
+                // 约束获取失败不阻塞默认订阅（服务端仍会校验）
+            }
+        }
+        // 3. merge（纯函数，幂等；透传 resolvedMsgType）
+        let result;
+        if (action === "subscribe") {
+            result = mergeSubscribeList(state.list, eventList, env_id, function_name, resolvedMsgType);
+        }
+        else if (action === "unsubscribe") {
+            result = mergeUnsubscribeList(state.list, eventList, env_id, function_name, resolvedMsgType);
+        }
+        else if (action === "setEnable") {
+            if (enable === undefined) {
+                throw new Error("setEnable 必须提供 enable（true=启用 / false=停用）");
+            }
+            result = mergeSetEnableList(state.list, eventList, env_id, function_name, enable, resolvedMsgType);
+        }
+        else {
+            throw new Error(`不支持的操作类型: ${action}`);
+        }
+        const targetLabel = isEventMsgType
+            ? eventList.join(", ")
+            : `msg_type=${resolvedMsgType}`;
+        // 4. 集合无变化 → 幂等成功，不 POST（无需确认）
+        if (!result.changed) {
+            return (0, tool_result_js_1.buildJsonToolResult)({
+                ok: true,
+                success: true,
+                code: "NO_CHANGE",
+                message: action === "subscribe"
+                    ? `订阅已处于期望状态，无变更（幂等，未发起写请求）：${targetLabel} 均已绑定 ${env_id}/${function_name}`
+                    : action === "unsubscribe"
+                        ? `未找到可移除的匹配订阅，无变更（幂等，未发起写请求）`
+                        : `目标订阅状态已一致，无变更（幂等，未发起写请求）`,
+                action,
+                msg_type: resolvedMsgType,
+                warnings: warnings.length ? warnings : undefined,
+            });
+        }
+        // 5. 有变更 → 需确认
+        const diffText = buildMergeDiffText(action, result, env_id, function_name);
+        if (!confirmed) {
+            return buildConfirmPayload({
+                toolName: "manageMessagePush",
+                action,
+                message: `即将执行消息推送配置变更（${env_id}/${function_name}，msg_type=${resolvedMsgType}，version=${state.version}）：\n${diffText}`,
+                requiredParams: ["appid", "env_id", "function_name", "confirm"],
+            });
+        }
+        // 6. 全量覆盖写（带 version 乐观锁）
+        try {
+            await uploadCallbackConfig(server, appid, {
+                version: state.version,
+                enable: action === "subscribe" ? true : state.enable,
+                list: result.list,
+            });
+        }
+        catch (e) {
+            if (e instanceof QbaseError && e.code === "VERSION_CONFLICT") {
+                return (0, tool_result_js_1.buildJsonToolResult)({
+                    ok: false,
+                    code: "VERSION_CONFLICT",
+                    retryable: true,
+                    message: e.message,
+                    next_step: { tool: "queryMessagePush", action: "list" },
+                });
+            }
+            if (e instanceof QbaseError) {
+                return (0, tool_result_js_1.buildJsonToolResult)({
+                    ok: false,
+                    code: "QBASE_ERROR",
+                    retryable: true,
+                    message: e.message,
+                    next_step: {
+                        tool: "queryMessagePush",
+                        action: "list",
+                        hint: "重新读取最新配置后重试",
+                    },
+                });
+            }
+            throw e;
+        }
+        logger?.({
+            type: "toolInfo",
+            toolName: "manageMessagePush",
+            message: `${action} 成功`,
+            appid,
+            envId: env_id,
+            functionName: function_name,
+            msgType: resolvedMsgType,
+            events: eventList,
+        });
+        const changedText = action === "subscribe"
+            ? [
+                result.added.length ? `新增 ${result.added.length} 个` : null,
+                result.rebound.length ? `重绑 ${result.rebound.length} 个` : null,
+            ]
+                .filter(Boolean)
+                .join("、")
+            : action === "unsubscribe"
+                ? `移除 ${result.removed.length} 个`
+                : `更新 ${result.matched.length} 个`;
+        return (0, tool_result_js_1.buildJsonToolResult)({
+            ok: true,
+            success: true,
+            message: `${action} 成功（${changedText}），version=${state.version} → 服务端已更新`,
+            action,
+            msg_type: resolvedMsgType,
+            added: result.added,
+            rebound: result.rebound,
+            removed: result.removed,
+            matched: result.matched,
+            warnings: warnings.length ? warnings : undefined,
+            callbacks: result.list,
+        });
+    });
+}
+
+
 /***/ }),
 
 /***/ 7793: