@cloudbase/cloudbase-mcp 2.33.0 → 2.33.2

package/dist/index.cjs

@@ -2680,7 +2680,7 @@ function getHeaders(options) {
 
 /***/ },
 
-/***/ 38680
+/***/ 58405
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -2693,7 +2693,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.AccessService = void 0;
-const utils_1 = __webpack_require__(24263);
+const utils_1 = __webpack_require__(88208);
 /**
  * HTTP Service（CloudBaseGW）访问服务。
  * 注意：HTTP Service 模块自 v5.0.0 起已废弃，建议迁移到 EnvService 的域名与路由能力
@@ -2834,7 +2834,7 @@ __decorate([
 
 /***/ },
 
-/***/ 33215
+/***/ 94540
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -2850,9 +2850,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.AgentService = void 0;
-const cloudrun_1 = __webpack_require__(8044);
-const type_1 = __webpack_require__(18490);
-const utils_1 = __webpack_require__(24263);
+const cloudrun_1 = __webpack_require__(17569);
+const type_1 = __webpack_require__(94917);
+const utils_1 = __webpack_require__(88208);
 const path_1 = __importDefault(__webpack_require__(33873));
 /**
  * Agent 管理类
@@ -3499,7 +3499,7 @@ __decorate([
 
 /***/ },
 
-/***/ 9537
+/***/ 1058
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -3512,7 +3512,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.AiModelService = void 0;
-const utils_1 = __webpack_require__(24263);
+const utils_1 = __webpack_require__(88208);
 class AiModelService {
     constructor(environment) {
         this.environment = environment;
@@ -3608,14 +3608,14 @@ __decorate([
 
 /***/ },
 
-/***/ 54913
+/***/ 44210
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.BillingService = void 0;
-const utils_1 = __webpack_require__(24263);
+const utils_1 = __webpack_require__(88208);
 class BillingService {
     constructor(context) {
         this.billService = new utils_1.CloudService(context, BillingService.billServiceVersion.service, BillingService.billServiceVersion.version);
@@ -3658,7 +3658,7 @@ BillingService.billServiceVersion = {
 
 /***/ },
 
-/***/ 97538
+/***/ 42403
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -3691,10 +3691,10 @@ exports.CloudAppService = void 0;
 const fs_1 = __importDefault(__webpack_require__(29021));
 const os_1 = __importDefault(__webpack_require__(21820));
 const path_1 = __importDefault(__webpack_require__(33873));
-const error_1 = __webpack_require__(18143);
-const utils_1 = __webpack_require__(24263);
-const http_request_1 = __webpack_require__(7355);
-__exportStar(__webpack_require__(47167), exports);
+const error_1 = __webpack_require__(54884);
+const utils_1 = __webpack_require__(88208);
+const http_request_1 = __webpack_require__(2922);
+__exportStar(__webpack_require__(15746), exports);
 /**
  * CloudApp 统一部署服务
  * 提供 Web 应用的创建、查询、删除、版本管理等功能
@@ -3927,7 +3927,7 @@ __decorate([
 
 /***/ },
 
-/***/ 47167
+/***/ 15746
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -3945,7 +3945,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 
 /***/ },
 
-/***/ 27851
+/***/ 56242
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -3958,7 +3958,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.CloudBaseRunService = void 0;
-const utils_1 = __webpack_require__(24263);
+const utils_1 = __webpack_require__(88208);
 class CloudBaseRunService {
     constructor(environment) {
         this.environment = environment;
@@ -3989,7 +3989,7 @@ __decorate([
 
 /***/ },
 
-/***/ 8044
+/***/ 17569
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -4010,8 +4010,8 @@ exports.parseObjectToDiffConfigItem = parseObjectToDiffConfigItem;
 const archiver_1 = __importDefault(__webpack_require__(7716));
 const fs_extra_1 = __webpack_require__(22732);
 const path_1 = __importDefault(__webpack_require__(33873));
-const utils_1 = __webpack_require__(24263);
-const type_1 = __webpack_require__(18490);
+const utils_1 = __webpack_require__(88208);
+const type_1 = __webpack_require__(94917);
 /**
  * 云托管服务管理类
  * 提供云托管服务的初始化、下载、列表查询和删除等功能
@@ -4693,7 +4693,7 @@ function parseObjectToDiffConfigItem(data) {
 
 /***/ },
 
-/***/ 18490
+/***/ 94917
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -4726,15 +4726,15 @@ var ReleaseTypeEnum;
 
 /***/ },
 
-/***/ 10443
+/***/ 73906
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.CommonService = void 0;
-const utils_1 = __webpack_require__(24263);
-const error_1 = __webpack_require__(18143);
+const utils_1 = __webpack_require__(88208);
+const error_1 = __webpack_require__(54884);
 /**
  * 公共的云api调用方法 透传用户参数 无业务逻辑处理
  * @export
@@ -4773,7 +4773,7 @@ exports.CommonService = CommonService;
 
 /***/ },
 
-/***/ 3017
+/***/ 41976
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -4855,14 +4855,14 @@ exports.SCF_TEMP_COS = {
 
 /***/ },
 
-/***/ 91522
+/***/ 81073
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.CloudBaseContext = void 0;
-const constant_1 = __webpack_require__(3017);
+const constant_1 = __webpack_require__(41976);
 class CloudBaseContext {
     constructor({ secretId = '', secretKey = '', token = '', proxy = '', region = '', envType = '', useInternalEndpoint = undefined, internalEndpointRegion = undefined, requestFn = undefined }) {
         this.secretId = secretId;
@@ -4887,7 +4887,7 @@ exports.CloudBaseContext = CloudBaseContext;
 
 /***/ },
 
-/***/ 71863
+/***/ 44206
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -4904,8 +4904,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.DatabaseService = void 0;
 const path_1 = __importDefault(__webpack_require__(33873));
-const error_1 = __webpack_require__(18143);
-const utils_1 = __webpack_require__(24263);
+const error_1 = __webpack_require__(54884);
+const utils_1 = __webpack_require__(88208);
 function preLazy() {
     return function (target, propertyKey, descriptor) {
         let oldFunc = descriptor.value;
@@ -5466,7 +5466,7 @@ __decorate([
 
 /***/ },
 
-/***/ 5636
+/***/ 9979
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -5478,7 +5478,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.DatabaseDeployer = void 0;
 const fs_1 = __importDefault(__webpack_require__(29021));
 const path_1 = __importDefault(__webpack_require__(33873));
-const error_1 = __webpack_require__(18143);
+const error_1 = __webpack_require__(54884);
 /** migration 文件名正则：14位数字 + 下划线 + 小写字母下划线名称 + .sql */
 const MIGRATION_FILE_PATTERN = /^(\d{14})_([a-z_]+)\.sql$/;
 /** 轮询间隔（毫秒） */
@@ -5712,7 +5712,7 @@ exports.DatabaseDeployer = DatabaseDeployer;
 
 /***/ },
 
-/***/ 83962
+/***/ 28385
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -5723,14 +5723,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.DeployOrchestrator = void 0;
 const path_1 = __importDefault(__webpack_require__(33873));
-const error_1 = __webpack_require__(18143);
-const DatabaseDeployer_1 = __webpack_require__(5636);
-const FunctionDeployer_1 = __webpack_require__(21773);
-const StaticDeployer_1 = __webpack_require__(1227);
-const GatewayDeployer_1 = __webpack_require__(83463);
-const StateStore_1 = __webpack_require__(13483);
-const framework_1 = __webpack_require__(20789);
-const parallel_1 = __webpack_require__(31504);
+const error_1 = __webpack_require__(54884);
+const DatabaseDeployer_1 = __webpack_require__(9979);
+const FunctionDeployer_1 = __webpack_require__(93210);
+const StaticDeployer_1 = __webpack_require__(19672);
+const GatewayDeployer_1 = __webpack_require__(6378);
+const config_guard_1 = __webpack_require__(74931);
+const parallel_1 = __webpack_require__(86693);
 /** 部署顺序（按依赖：database 最先，函数依赖新 Schema；gateway 最后，依赖函数/hosting） */
 const DEPLOY_ORDER = ['database', 'functions', 'app', 'hosting', 'gateway'];
 /**
@@ -5750,7 +5749,8 @@ class DeployOrchestrator {
      * 计算部署计划（dry-run 输出）
      */
     async deployPlan(options) {
-        return this.buildPlan(options.config, options);
+        const config = this.normalizeFunctionConfigs(options.config, options.envId, options.cwd);
+        return this.buildPlan(config, options);
     }
     /**
      * 执行部署
@@ -5763,7 +5763,8 @@ class DeployOrchestrator {
      */
     async deploy(options) {
         var _a, _b, _c, _d, _e, _f, _g, _h;
-        const { config, envId, dryRun, cwd = process.cwd(), log, concurrency = 5, continueOnError = false } = options;
+        const { config: inputConfig, envId, dryRun, cwd = process.cwd(), log, concurrency = 5, continueOnError = false } = options;
+        const config = this.normalizeFunctionConfigs(inputConfig, envId, cwd);
         // 1. 轻量 inline 守卫（validateProject 未接入时的兜底）
         this.guardConfig(config);
         const plan = await this.buildPlan(config, options);
@@ -5777,132 +5778,157 @@ class DeployOrchestrator {
         // gateway 段强制串行：executeStep 的 gateway 分支部署 config.gateway.routes 全部路由
         // （逐路由 plan item 仅用于展示 diff），并发执行会对同一批路由发起重复全量部署（竞态 create/modify 路由、bindCustomDomain）
         const globalLimit = Math.max(1, Math.min(Number(concurrency) || 1, 20));
-        try {
-            for (const segment of segments) {
-                // 段内并行度：gateway 段固定 1（全量部署语义）；其余段用全局 concurrency
-                const limit = ((_b = segment[0]) === null || _b === void 0 ? void 0 : _b.type) === 'gateway' ? 1 : globalLimit;
-                // 段内预判定（顺序执行，保留交互/冲突中断语义）
-                const toExecute = [];
-                let segmentFailed = false;
-                let segmentDbFailed = false;
-                for (const item of segment) {
-                    // skip：产物/配置未变更，静默跳过（不执行、不询问）
-                    if (item.status === 'skip') {
-                        (_c = log === null || log === void 0 ? void 0 : log.info) === null || _c === void 0 ? void 0 : _c.call(log, `[${item.type}] ${item.name}: ${item.action}`);
-                        results.push({ type: item.type, name: item.name, ok: true, reason: 'skip' });
-                        continue;
-                    }
-                    (_d = log === null || log === void 0 ? void 0 : log.info) === null || _d === void 0 ? void 0 : _d.call(log, `[${item.type}] ${item.name}: ${item.action}`);
-                    // conflict：数据库迁移冲突 → 中断整个部署（后续资源可能依赖新 Schema）
-                    if (item.status === 'conflict') {
-                        const message = '检测到冲突，已中断部署';
-                        (_e = log === null || log === void 0 ? void 0 : log.error) === null || _e === void 0 ? void 0 : _e.call(log, `[${item.type}] ${item.name} ${message}`);
-                        results.push({ type: item.type, name: item.name, ok: false, error: message });
-                        if (item.type === 'database') {
-                            return { plan, results };
-                        }
-                        segmentFailed = true;
-                        continue;
-                    }
-                    // 覆盖确认：仅函数已存在（update）时触发，对齐 tcb fn deploy 的 FunctionConflictChecker 语义
-                    // yes=true 直接放行；注入 confirmUpdate 按回调决定；两者都无 → 保守跳过（no-confirm）
-                    if (item.type === 'functions' && item.status === 'update') {
-                        let confirmed = false;
-                        if (options.yes) {
-                            confirmed = true;
-                        }
-                        else if (options.confirmUpdate) {
-                            confirmed = await options.confirmUpdate(item);
-                        }
-                        if (!confirmed) {
-                            const reason = options.confirmUpdate
-                                ? 'skipped-by-user'
-                                : 'no-confirm';
-                            (_f = log === null || log === void 0 ? void 0 : log.warn) === null || _f === void 0 ? void 0 : _f.call(log, `[${item.type}] ${item.name} 跳过覆盖更新（${reason}）`);
-                            results.push({ type: item.type, name: item.name, ok: false, reason });
-                            continue;
-                        }
-                    }
-                    toExecute.push(item);
+        for (const segment of segments) {
+            // 段内并行度：gateway 段固定 1（全量部署语义）；其余段用全局 concurrency
+            const limit = ((_b = segment[0]) === null || _b === void 0 ? void 0 : _b.type) === 'gateway' ? 1 : globalLimit;
+            // 段内预判定（顺序执行，保留交互/冲突中断语义）
+            const toExecute = [];
+            let segmentFailed = false;
+            let segmentDbFailed = false;
+            for (const item of segment) {
+                // skip：产物/配置未变更，静默跳过（不执行、不询问）
+                if (item.status === 'skip') {
+                    (_c = log === null || log === void 0 ? void 0 : log.info) === null || _c === void 0 ? void 0 : _c.call(log, `[${item.type}] ${item.name}: ${item.action}`);
+                    results.push({ type: item.type, name: item.name, ok: true, reason: 'skip' });
+                    continue;
                 }
-                if (toExecute.length === 0) {
-                    // 段内无实际执行项：若本段已因 conflict 标记失败且 fail-fast，则中断
-                    if (segmentFailed && !continueOnError) {
+                (_d = log === null || log === void 0 ? void 0 : log.info) === null || _d === void 0 ? void 0 : _d.call(log, `[${item.type}] ${item.name}: ${item.action}`);
+                // conflict：数据库迁移冲突 → 中断整个部署（后续资源可能依赖新 Schema）
+                if (item.status === 'conflict') {
+                    const message = '检测到冲突，已中断部署';
+                    (_e = log === null || log === void 0 ? void 0 : log.error) === null || _e === void 0 ? void 0 : _e.call(log, `[${item.type}] ${item.name} ${message}`);
+                    results.push({ type: item.type, name: item.name, ok: false, error: message });
+                    if (item.type === 'database') {
                         return { plan, results };
                     }
+                    segmentFailed = true;
                     continue;
                 }
-                // 段内并行执行
-                const controller = new parallel_1.AsyncTaskParallelController(limit);
-                const tasks = toExecute.map((item) => async () => {
-                    var _a, _b, _c, _d, _e;
-                    try {
-                        const stepResult = await this.executeStep({
-                            item,
-                            config,
-                            envId,
-                            cwd,
-                            onProgress: options.onProgress
-                        });
-                        if (item.type === 'functions') {
-                            results.push({
-                                type: item.type,
-                                name: item.name,
-                                ok: true,
-                                url: stepResult === null || stepResult === void 0 ? void 0 : stepResult.url,
-                                detail: stepResult
-                            });
-                        }
-                        else {
-                            results.push({ type: item.type, name: item.name, ok: true, url: stepResult });
-                        }
-                    }
-                    catch (e) {
-                        const message = (e === null || e === void 0 ? void 0 : e.message) || String(e);
-                        const requestId = (e === null || e === void 0 ? void 0 : e.requestId) ||
-                            (e === null || e === void 0 ? void 0 : e.RequestId) ||
-                            ((_a = e === null || e === void 0 ? void 0 : e.original) === null || _a === void 0 ? void 0 : _a.requestId) ||
-                            ((_b = e === null || e === void 0 ? void 0 : e.original) === null || _b === void 0 ? void 0 : _b.RequestId) ||
-                            ((_c = e === null || e === void 0 ? void 0 : e.response) === null || _c === void 0 ? void 0 : _c.requestId) ||
-                            ((_d = e === null || e === void 0 ? void 0 : e.response) === null || _d === void 0 ? void 0 : _d.RequestId);
-                        if (!(item.type === 'functions' && options.onProgress)) {
-                            (_e = log === null || log === void 0 ? void 0 : log.error) === null || _e === void 0 ? void 0 : _e.call(log, `[${item.type}] ${item.name} 部署失败: ${message}`);
-                        }
-                        results.push(Object.assign(Object.assign(Object.assign({ type: item.type, name: item.name, ok: false, error: message }, ((e === null || e === void 0 ? void 0 : e.code) ? { errorCode: e.code } : {})), ((e === null || e === void 0 ? void 0 : e.failedStage) ? { failedStage: e.failedStage } : {})), (requestId ? { requestId } : {})));
-                        segmentFailed = true;
-                        if (item.type === 'database') {
-                            segmentDbFailed = true;
-                        }
+                // 覆盖确认：仅函数已存在（update）时触发，对齐 tcb fn deploy 的 FunctionConflictChecker 语义
+                // yes=true 直接放行；注入 confirmUpdate 按回调决定；两者都无 → 保守跳过（no-confirm）
+                if (item.type === 'functions' && item.status === 'update') {
+                    let confirmed = false;
+                    if (options.yes) {
+                        confirmed = true;
                     }
-                });
-                controller.loadTasks(tasks);
-                await controller.run();
-                // 段内失败中断决策
-                if (segmentFailed) {
-                    if (segmentDbFailed) {
-                        (_g = log === null || log === void 0 ? void 0 : log.error) === null || _g === void 0 ? void 0 : _g.call(log, '数据库迁移失败，中断部署');
-                        return { plan, results };
+                    else if (options.confirmUpdate) {
+                        confirmed = await options.confirmUpdate(item);
                     }
-                    if (!continueOnError) {
-                        return { plan, results };
+                    if (!confirmed) {
+                        const reason = options.confirmUpdate
+                            ? 'skipped-by-user'
+                            : 'no-confirm';
+                        (_f = log === null || log === void 0 ? void 0 : log.warn) === null || _f === void 0 ? void 0 : _f.call(log, `[${item.type}] ${item.name} 跳过覆盖更新（${reason}）`);
+                        results.push({ type: item.type, name: item.name, ok: false, reason });
+                        continue;
                     }
                 }
+                toExecute.push(item);
             }
-        }
-        finally {
-            // 无论部署全部成功还是 fail-fast 中断，都将已成功资源的状态快照落盘
-            // （失败资源保留旧快照，下次 diff 仍会检测到差异）；快照写入失败不影响部署结果
-            if (!dryRun) {
+            if (toExecute.length === 0) {
+                // 段内无实际执行项：若本段已因 conflict 标记失败且 fail-fast，则中断
+                if (segmentFailed && !continueOnError) {
+                    return { plan, results };
+                }
+                continue;
+            }
+            // 段内并行执行
+            const controller = new parallel_1.AsyncTaskParallelController(limit);
+            const tasks = toExecute.map((item) => async () => {
+                var _a, _b, _c, _d, _e;
                 try {
-                    await this.persistState({ config, plan, results, cwd, envId: options.envId });
+                    const stepResult = await this.executeStep({
+                        item,
+                        config,
+                        envId,
+                        cwd,
+                        onProgress: options.onProgress
+                    });
+                    if (item.type === 'functions') {
+                        results.push({
+                            type: item.type,
+                            name: item.name,
+                            ok: true,
+                            url: stepResult === null || stepResult === void 0 ? void 0 : stepResult.url,
+                            detail: stepResult
+                        });
+                    }
+                    else {
+                        results.push({ type: item.type, name: item.name, ok: true, url: stepResult });
+                    }
                 }
                 catch (e) {
-                    (_h = log === null || log === void 0 ? void 0 : log.warn) === null || _h === void 0 ? void 0 : _h.call(log, `状态快照写入失败：${(e === null || e === void 0 ? void 0 : e.message) || String(e)}`);
+                    const message = (e === null || e === void 0 ? void 0 : e.message) || String(e);
+                    const requestId = (e === null || e === void 0 ? void 0 : e.requestId) ||
+                        (e === null || e === void 0 ? void 0 : e.RequestId) ||
+                        ((_a = e === null || e === void 0 ? void 0 : e.original) === null || _a === void 0 ? void 0 : _a.requestId) ||
+                        ((_b = e === null || e === void 0 ? void 0 : e.original) === null || _b === void 0 ? void 0 : _b.RequestId) ||
+                        ((_c = e === null || e === void 0 ? void 0 : e.response) === null || _c === void 0 ? void 0 : _c.requestId) ||
+                        ((_d = e === null || e === void 0 ? void 0 : e.response) === null || _d === void 0 ? void 0 : _d.RequestId);
+                    if (!(item.type === 'functions' && options.onProgress)) {
+                        (_e = log === null || log === void 0 ? void 0 : log.error) === null || _e === void 0 ? void 0 : _e.call(log, `[${item.type}] ${item.name} 部署失败: ${message}`);
+                    }
+                    results.push(Object.assign(Object.assign(Object.assign({ type: item.type, name: item.name, ok: false, error: message }, ((e === null || e === void 0 ? void 0 : e.code) ? { errorCode: e.code } : {})), ((e === null || e === void 0 ? void 0 : e.failedStage) ? { failedStage: e.failedStage } : {})), (requestId ? { requestId } : {})));
+                    segmentFailed = true;
+                    if (item.type === 'database') {
+                        segmentDbFailed = true;
+                    }
+                }
+            });
+            controller.loadTasks(tasks);
+            await controller.run();
+            // 段内失败中断决策
+            if (segmentFailed) {
+                if (segmentDbFailed) {
+                    (_g = log === null || log === void 0 ? void 0 : log.error) === null || _g === void 0 ? void 0 : _g.call(log, '数据库迁移失败，中断部署');
+                    return { plan, results };
+                }
+                if (!continueOnError) {
+                    (_h = log === null || log === void 0 ? void 0 : log.error) === null || _h === void 0 ? void 0 : _h.call(log, '存在资源部署失败，中断部署');
+                    return { plan, results };
                 }
             }
         }
         return { plan, results };
     }
+    /**
+     * 归一化声明式函数配置：直接消费 cloudbaserc 的嵌套形状（imageConfig.build），
+     * 不做字段平铺映射；非 HTTP 函数原样返回。
+     */
+    normalizeFunctionConfigs(config, envId, cwd = process.cwd()) {
+        if (!Array.isArray(config === null || config === void 0 ? void 0 : config.functions)) {
+            return config;
+        }
+        const functionRootPath = path_1.default.resolve(cwd, config.functionRoot || 'functions');
+        return Object.assign(Object.assign({}, config), { functions: config.functions.map((func) => {
+                var _a, _b;
+                // 直接消费 cloudbaserc 的嵌套形状（imageConfig.build），不再做字段平铺映射。
+                // 非镜像/构建策略由 prepareMinimalDeployConfig 内部识别并原样返回。
+                if ((func === null || func === void 0 ? void 0 : func.type) !== 'HTTP') {
+                    return func;
+                }
+                const funcAny = func;
+                const explicitCwd = (_b = (_a = funcAny.imageConfig) === null || _a === void 0 ? void 0 : _a.build) === null || _b === void 0 ? void 0 : _b.cwd;
+                const dir = funcAny.dir;
+                // 构建上下文根解析优先级：显式 build.cwd > dir > functionRoot/name。
+                // 相对路径一律以部署传入的项目 cwd 为基准解析为绝对路径，避免 preflight
+                // 与云端构建（builders/cloud.ts）以进程 CWD 兜底导致目录错位。
+                const resolvedContextRoot = typeof explicitCwd === 'string' && explicitCwd.trim()
+                    ? path_1.default.resolve(cwd, explicitCwd)
+                    : typeof dir === 'string' && dir.trim()
+                        ? path_1.default.resolve(cwd, dir)
+                        : undefined;
+                // 显式 build.cwd 归一为绝对路径写回，避免 applyMinimalDeployConfigDefaults
+                // 因 build.cwd 已存在而保留原始相对值。
+                const normalizedFunc = resolvedContextRoot && typeof explicitCwd === 'string' && explicitCwd.trim()
+                    ? Object.assign(Object.assign({}, funcAny), { imageConfig: Object.assign(Object.assign({}, funcAny.imageConfig), { build: Object.assign(Object.assign({}, funcAny.imageConfig.build), { cwd: resolvedContextRoot }) }) }) : func;
+                return (0, config_guard_1.prepareMinimalDeployConfig)(normalizedFunc, {
+                    envId,
+                    functionPath: resolvedContextRoot,
+                    functionRootPath
+                }).config;
+            }) });
+    }
     /**
      * 将扁平 plan 按「连续相同资源类型」切成有序 segments
      *
@@ -5930,91 +5956,19 @@ class DeployOrchestrator {
         }
         return segments;
     }
-    /**
-     * 部署成功后写回本地 state 快照
-     *
-     * - hosting：成功部署/未变更（skip）的项重算产物指纹；失败项保留旧快照
-     * - app：成功部署写 buildAppConfig 快照；skip 复用旧快照
-     * - gateway：保留旧快照（本轮不做路由级实时快照）
-     */
-    async persistState(options) {
-        var _a, _b, _c, _d, _e, _f;
-        const { config, plan, results, cwd, envId } = options;
-        const stateStore = new StateStore_1.StateStore({ cwd });
-        const prev = stateStore.read();
-        // hosting
-        const hostingEntries = [];
-        for (const h of config.hosting || []) {
-            const name = h.name || 'default';
-            const planItem = plan.find(p => p.type === 'hosting' && p.name === name);
-            const result = results.find(r => r.type === 'hosting' && r.name === name);
-            if (!result || !result.ok) {
-                // 未执行（fail-fast 中断，results 中无对应条目）或部署失败：
-                // 保留旧快照（下次 diff 仍会检测到差异）
-                const prevEntry = (_b = (_a = prev === null || prev === void 0 ? void 0 : prev.resources) === null || _a === void 0 ? void 0 : _a.hosting) === null || _b === void 0 ? void 0 : _b.find(s => s.name === name);
-                if (prevEntry) {
-                    hostingEntries.push(prevEntry);
-                }
-                continue;
-            }
-            if ((planItem === null || planItem === void 0 ? void 0 : planItem.status) === 'skip') {
-                const prevEntry = (_d = (_c = prev === null || prev === void 0 ? void 0 : prev.resources) === null || _c === void 0 ? void 0 : _c.hosting) === null || _d === void 0 ? void 0 : _d.find(s => s.name === name);
-                if (prevEntry) {
-                    hostingEntries.push(prevEntry);
-                    continue;
-                }
-            }
-            // 成功部署：重算当前指纹（含 size，供下次 diff 做 size 预判）
-            // 注意：deployHosting 可能执行本地构建，产物已更新，必须独立重算而非复用 plan 指纹
-            const root = path_1.default.resolve(cwd, h.root || '.');
-            // outputDir 与 StaticDeployer.deployHosting 完全复用同一解析逻辑
-            const outputDir = (0, framework_1.resolveHostingOutputDir)(h, root);
-            try {
-                const files = await stateStore.computeHostingFingerprints(outputDir, h.ignore || []);
-                hostingEntries.push({ name, deployPath: h.deployPath, files });
-            }
-            catch (_g) {
-                // 目录缺失 / 文件数超限：不写入（下次 diff 走云端兜底或全量部署）
-            }
-        }
-        // app
-        let appEntry;
-        if (config.app) {
-            const appResult = results.find(r => r.type === 'app');
-            if (appResult === null || appResult === void 0 ? void 0 : appResult.ok) {
-                appEntry = stateStore.buildAppConfig(config.app);
-            }
-            else {
-                appEntry = (_e = prev === null || prev === void 0 ? void 0 : prev.resources) === null || _e === void 0 ? void 0 : _e.app;
-            }
-        }
-        const resources = {};
-        if (hostingEntries.length) {
-            resources.hosting = hostingEntries;
-        }
-        if (appEntry) {
-            resources.app = appEntry;
-        }
-        if ((_f = prev === null || prev === void 0 ? void 0 : prev.resources) === null || _f === void 0 ? void 0 : _f.gateway) {
-            resources.gateway = prev.resources.gateway;
-        }
-        if (Object.keys(resources).length) {
-            stateStore.write({ resources, envId });
-        }
-    }
     /**
      * 构建完整部署计划（按依赖顺序 + only/skip 过滤）
      *
      * 通过查询云端状态判定每个资源的动作：
      * - database：先按迁移文件做 preview，再聚合成单条资源级计划项（pending→create，存在 conflict→conflict，全部 applied→不出现在 plan）
      * - functions：ListFunctions 判断是否已存在 → create / update（不做本地 hash / 字段 diff）
-     * - app：describeAppInfo 判断是否已存在 → create / update；本地 state 配置一致 → skip
-     * - hosting：本地 state 指纹 diff → 一致 skip（不重新上传）/ 有差异 deploy（带文件级明细）
+     * - app：describeAppInfo 判断是否已存在 → create / update
+     * - hosting：直传覆盖（无存在性概念）
      * - gateway：planRoutes 对比云端路由 → create / update / skip（含变更字段明细）
      * 云端查询失败时降级为保守判定（全 create），不影响 dry-run 展示。
      */
     async buildPlan(config, options) {
-        const { only, skip, refresh } = options;
+        const { only, skip } = options;
         const cwd = options.cwd || process.cwd();
         const envId = options.envId;
         const plan = [];
@@ -6025,14 +5979,7 @@ class DeployOrchestrator {
                 return false;
             return true;
         };
-        // 本地 state 快照（diff 基准）：--refresh 时忽略本地 skip 判定
-        const stateStore = new StateStore_1.StateStore({ cwd });
-        const rawState = refresh ? null : stateStore.read();
-        // 跨环境保护：快照记录的 envId 与目标环境不一致（或旧格式快照无 envId）时，
-        // 快照是其他环境部署后的指纹，不可作为 skip 依据 → 视为无快照，强制走全量部署，
-        // 避免切换环境后误判「产物未变更」导致新环境 COS 404
-        const state = rawState && rawState.envId === envId ? rawState : null;
-        const planCtx = { config, envId, stateStore, state, refresh, cwd };
+        const planCtx = { config, envId, cwd };
         for (const type of DEPLOY_ORDER) {
             if (!isEnabled(type))
                 continue;
@@ -6045,7 +5992,7 @@ class DeployOrchestrator {
      * 按资源类型构建计划（拆分自 buildPlan，控制圈复杂度）
      */
     async buildPlanForType(type, ctx) {
-        const { config, envId, stateStore, state, refresh, cwd } = ctx;
+        const { config, envId, cwd } = ctx;
         if (type === 'database') {
             return this.buildDatabasePlan(config, cwd, envId);
         }
@@ -6083,10 +6030,10 @@ class DeployOrchestrator {
             });
         }
         if (type === 'app') {
-            return this.buildAppPlan({ config, envId, stateStore, state, refresh });
+            return this.buildAppPlan({ config, envId });
         }
         if (type === 'hosting') {
-            return this.buildHostingPlans(config, ctx);
+            return this.buildHostingPlans(config);
         }
         return this.buildGatewayPlans(config, envId);
     }
@@ -6143,100 +6090,51 @@ class DeployOrchestrator {
         return [];
     }
     /**
-     * app 计划：本地 state 配置一致 → skip；否则按云端存在性 → create / update
+     * app 计划：按云端存在性 → create / update
      */
     async buildAppPlan(options) {
-        var _a;
-        const { config, envId, stateStore, state, refresh } = options;
+        const { config, envId } = options;
         if (!config.app)
             return [];
         const name = config.app.serviceName || 'app';
-        // 本地 state 配置一致 → skip（真增量，不重复构建版本）
-        const appEntry = stateStore.buildAppConfig(config.app);
-        const stateApp = (_a = state === null || state === void 0 ? void 0 : state.resources) === null || _a === void 0 ? void 0 : _a.app;
-        const appUnchanged = !refresh &&
-            stateApp !== undefined &&
-            appEntry !== undefined &&
-            this.deepEqual(stateApp, appEntry);
-        if (appUnchanged) {
-            return [
-                {
-                    type: 'app',
-                    name,
-                    status: 'skip',
-                    action: `云应用 ${name} 配置未变更，跳过`
-                }
-            ];
-        }
         const appExists = await this.appExists(name);
-        const changes = this.appConfigChanges(stateApp, appEntry);
         return [
-            Object.assign({ type: 'app', name, status: appExists ? 'update' : 'create', action: appExists
+            {
+                type: 'app',
+                name,
+                status: appExists ? 'update' : 'create',
+                action: appExists
                     ? `覆盖更新云应用 ${name}`
-                    : `新建云应用 ${name}` }, (changes.length ? { changes } : {}))
+                    : `新建云应用 ${name}`
+            }
         ];
     }
     /**
-     * hosting 计划：本地 state 指纹 diff → 一致 skip / 有差异 deploy（带文件级明细）
+     * hosting 计划：每次直传覆盖（无本地指纹 skip）
      */
-    async buildHostingPlans(config, ctx) {
-        var _a, _b;
-        const { stateStore, state, refresh, cwd } = ctx;
+    buildHostingPlans(config) {
         const plans = [];
         for (const h of config.hosting || []) {
             const name = h.name || 'default';
-            const root = path_1.default.resolve(cwd, h.root || '.');
-            const buildCommand = (0, framework_1.resolveBuildCommand)(h, root);
-            // outputDir 与 StaticDeployer.deployHosting 完全复用同一解析逻辑
-            const outputDir = (0, framework_1.resolveHostingOutputDir)(h, root);
-            const stateHosting = (_b = (_a = state === null || state === void 0 ? void 0 : state.resources) === null || _a === void 0 ? void 0 : _a.hosting) === null || _b === void 0 ? void 0 : _b.find(s => s.name === name);
-            // 懒加载 diff：size 预判 + 按需 hash（目录缺失 / 文件数超限 → 保守部署）
-            let fileDiff = null;
-            try {
-                fileDiff = await stateStore.diffHostingFiles(outputDir, stateHosting === null || stateHosting === void 0 ? void 0 : stateHosting.files, {
-                    ignore: h.ignore || []
-                });
-            }
-            catch (_c) {
-                fileDiff = null;
-            }
-            const unchanged = !refresh && fileDiff !== null && fileDiff.unchanged;
-            if (unchanged) {
-                plans.push({
-                    type: 'hosting',
-                    name,
-                    status: 'skip',
-                    action: `静态托管 ${name} 产物未变更，跳过`
-                });
-                continue;
-            }
             const hasBuild = !!h.buildCommand ||
                 (!!h.framework && h.framework !== 'static' && h.framework !== 'custom');
             const details = [
                 { label: '框架', value: h.framework || 'static' },
                 {
                     label: '构建',
-                    value: hasBuild
-                        ? `本地构建（${buildCommand || 'npm run build'}）→ 上传 ${outputDir}`
-                        : '无构建，直接上传'
+                    value: hasBuild ? '本地构建后上传' : '无构建，直接上传'
                 },
                 { label: '部署路径', value: h.deployPath || '/' }
             ];
-            if (fileDiff === null || fileDiff === void 0 ? void 0 : fileDiff.overLimit) {
-                details.push({ label: '指纹', value: '文件数超上限，降级为全量部署' });
-            }
-            plans.push(Object.assign({ type: 'hosting', name, status: 'deploy', action: hasBuild
+            plans.push({
+                type: 'hosting',
+                name,
+                status: 'deploy',
+                action: hasBuild
                     ? `本地构建后直传静态托管 ${name}`
-                    : `直传覆盖静态托管 ${name}`, details }, (fileDiff && !fileDiff.overLimit
-                ? {
-                    fileDiff: {
-                        added: fileDiff.added,
-                        modified: fileDiff.modified,
-                        deleted: fileDiff.deleted,
-                        totalChanged: fileDiff.totalChanged
-                    }
-                }
-                : {})));
+                    : `直传覆盖静态托管 ${name}`,
+                details
+            });
         }
         return plans;
     }
@@ -6346,26 +6244,6 @@ class DeployOrchestrator {
             }
         }
     }
-    /** 深比较（JSON 快照语义）：仅用于 app 配置快照等简单对象 */
-    deepEqual(a, b) {
-        return JSON.stringify(a) === JSON.stringify(b);
-    }
-    /** app 配置差异明细（from → to） */
-    appConfigChanges(prev, curr) {
-        const changes = [];
-        const keys = new Set([
-            ...Object.keys(prev || {}),
-            ...Object.keys(curr || {})
-        ]);
-        for (const key of keys) {
-            const from = prev === null || prev === void 0 ? void 0 : prev[key];
-            const to = curr === null || curr === void 0 ? void 0 : curr[key];
-            if (from !== to) {
-                changes.push({ field: String(key), from, to });
-            }
-        }
-        return changes;
-    }
     /**
      * 轻量 inline 守卫：配置合法 + 目录存在（validateProject 接线点）
      */
@@ -6383,7 +6261,7 @@ exports.DeployOrchestrator = DeployOrchestrator;
 
 /***/ },
 
-/***/ 21773
+/***/ 93210
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -6403,23 +6281,23 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.IMAGE_PULL_GRANT_URL = exports.REQUIRED_IMAGE_PULL_POLICY = exports.SCF_PULL_IMAGE_ROLE = exports.isCamPermissionError = exports.runImagePullAuthPreflight = exports.runImageRemotePreflight = exports.runLocalPreflight = exports.createCloudBuildService = exports.buildImageOnCloud = exports.toCloudFunction = exports.createImageArtifactFromConfig = exports.createCodeArtifact = exports.toCurrentState = exports.createDeployPlan = exports.parseImageReference = exports.normalizeGatewayPath = exports.normalizeDeployConfig = exports.isCustomImageRuntime = exports.checkDeployConfig = exports.assertDeployConfig = exports.FunctionDeployer = void 0;
-const error_1 = __webpack_require__(18143);
-const artifact_1 = __webpack_require__(78146);
-const config_guard_1 = __webpack_require__(69238);
-const cam_preflight_1 = __webpack_require__(11903);
-const cloud_1 = __webpack_require__(36114);
-const cloud_build_service_1 = __webpack_require__(52244);
-const docker_preflight_1 = __webpack_require__(30710);
-const GatewayDeployer_1 = __webpack_require__(83463);
-const domain_1 = __webpack_require__(83597);
-const image_preflight_1 = __webpack_require__(56749);
-const local_builder_1 = __webpack_require__(49515);
-const enterprise_tcr_1 = __webpack_require__(26719);
-const personal_tcr_1 = __webpack_require__(5380);
-const planner_1 = __webpack_require__(28750);
-const preflight_1 = __webpack_require__(61081);
-const types_1 = __webpack_require__(22724);
+exports.IMAGE_PULL_GRANT_URL = exports.REQUIRED_IMAGE_PULL_POLICY = exports.SCF_PULL_IMAGE_ROLE = exports.isCamPermissionError = exports.runImagePullAuthPreflight = exports.runImageRemotePreflight = exports.runLocalPreflight = exports.createCloudBuildService = exports.buildImageOnCloud = exports.toCloudFunction = exports.createImageArtifactFromConfig = exports.createCodeArtifact = exports.toCurrentState = exports.createDeployPlan = exports.parseImageReference = exports.normalizeGatewayPath = exports.normalizeDeployConfig = exports.isCustomImageRuntime = exports.prepareMinimalDeployConfig = exports.getMissingDeployInputs = exports.applyMinimalDeployConfigDefaults = exports.checkDeployConfig = exports.assertDeployConfig = exports.FunctionDeployer = void 0;
+const error_1 = __webpack_require__(54884);
+const artifact_1 = __webpack_require__(84187);
+const config_guard_1 = __webpack_require__(74931);
+const cam_preflight_1 = __webpack_require__(68388);
+const cloud_1 = __webpack_require__(4295);
+const cloud_build_service_1 = __webpack_require__(43587);
+const docker_preflight_1 = __webpack_require__(48947);
+const GatewayDeployer_1 = __webpack_require__(6378);
+const domain_1 = __webpack_require__(43294);
+const image_preflight_1 = __webpack_require__(67650);
+const local_builder_1 = __webpack_require__(52948);
+const enterprise_tcr_1 = __webpack_require__(84638);
+const personal_tcr_1 = __webpack_require__(28541);
+const planner_1 = __webpack_require__(72325);
+const preflight_1 = __webpack_require__(69230);
+const types_1 = __webpack_require__(79345);
 /** OPA 用户策略 key */
 const AUTHZ_USER_REGO_KEY = 'authz.user.rego';
 /**
@@ -6484,7 +6362,12 @@ class FunctionDeployer {
             return;
         }
         const rule = this.buildPublicAccessRego(functionName);
-        const mergedRego = currentRego.trim() ? `${currentRego.trim()}\n\n${rule}` : rule;
+        // 云端 Rego 校验器要求首条有效语句（注释不计）必须是 package 声明。
+        // currentRego 非空时已含 package authz.user，直接追加规则体即可；
+        // 为空（新环境首次配置）时需补齐 package 声明，否则触发 2:1: package expected。
+        const mergedRego = currentRego.trim()
+            ? `${currentRego.trim()}\n\n${rule}`
+            : `package authz.user\n\n${rule}`;
         await permissionService.modifyEnvAuthzConfig({
             key: AUTHZ_USER_REGO_KEY,
             value: mergedRego
@@ -6565,6 +6448,24 @@ class FunctionDeployer {
     checkConfig(config) {
         return (0, config_guard_1.checkDeployConfig)(config);
     }
+    /**
+     * 计算最小化部署配置的默认值，不执行网络或云端变更。
+     */
+    applyMinimalConfigDefaults(config, context = {}) {
+        return (0, config_guard_1.applyMinimalDeployConfigDefaults)(config, context);
+    }
+    /**
+     * 返回最小化配置仍缺失的字段，不执行网络或云端变更。
+     */
+    getMissingConfigInputs(config, context = {}) {
+        return (0, config_guard_1.getMissingDeployInputs)(config, context);
+    }
+    /**
+     * 应用安全默认值并返回缺失字段，供 CLI/MCP 逐步收集用户输入。
+     */
+    prepareMinimalConfig(config, context = {}) {
+        return (0, config_guard_1.prepareMinimalDeployConfig)(config, context);
+    }
     /**
      * 生成部署计划
      *
@@ -6591,13 +6492,14 @@ class FunctionDeployer {
      * @param options 部署选项，dryRun 时只生成计划不做任何变更
      */
     async deployFunction(config, options = {}) {
+        const deployConfig = config;
         const startTime = Date.now();
         const ctx = { steps: [], options };
         const warnings = [];
-        const report = (0, config_guard_1.checkDeployConfig)(config);
+        const report = (0, config_guard_1.checkDeployConfig)(deployConfig);
         this.appendWarnings(warnings, report);
         const normalized = await this.runStep(ctx, 'validate', async () => {
-            return (0, config_guard_1.assertDeployConfig)(config);
+            return (0, config_guard_1.assertDeployConfig)(deployConfig);
         });
         const plan = await this.runStep(ctx, 'plan', async () => {
             const current = await this.getCurrentFunction(normalized.name, normalized.codeSecret);
@@ -6687,7 +6589,7 @@ class FunctionDeployer {
      * 将既有声明式调用补齐为完整部署配置
      */
     withLegacyDeployContext(func, functionRootPath, functionPath) {
-        var _a, _b;
+        var _a, _b, _c, _d, _e;
         const config = Object.assign({}, func);
         const strategy = this.resolveStrategy(config);
         if (functionPath) {
@@ -6705,16 +6607,14 @@ class FunctionDeployer {
                 (effectiveFunctionRootPath
                     ? `${effectiveFunctionRootPath}/${config.name}`
                     : undefined);
-            if (buildCwd || ((_a = config.build) === null || _a === void 0 ? void 0 : _a.cwd)) {
-                config.build = Object.assign(Object.assign({}, (config.build || {})), { cwd: ((_b = config.build) === null || _b === void 0 ? void 0 : _b.cwd) || buildCwd });
+            const existingCwd = (_b = (_a = config.imageConfig) === null || _a === void 0 ? void 0 : _a.build) === null || _b === void 0 ? void 0 : _b.cwd;
+            if (buildCwd || existingCwd) {
+                config.imageConfig = Object.assign(Object.assign({}, (config.imageConfig || {})), { build: Object.assign(Object.assign({}, (((_c = config.imageConfig) === null || _c === void 0 ? void 0 : _c.build) || {})), { cwd: existingCwd || buildCwd }) });
             }
         }
-        // 兼容旧声明式 imageUri 字段，统一转换到运行时 imageConfig 契约
-        if (strategy === 'image' && config.imageUri && !config.imageConfig) {
-            config.imageType = config.imageType || 'personal';
-            config.imageConfig = {
-                imageUri: config.imageUri
-            };
+        // 兼容旧声明式顶层 imageUri 字段，统一收敛到 imageConfig 契约
+        if (strategy === 'image' && config.imageUri && !((_d = config.imageConfig) === null || _d === void 0 ? void 0 : _d.imageUri)) {
+            config.imageConfig = Object.assign(Object.assign({ imageType: ((_e = config.imageConfig) === null || _e === void 0 ? void 0 : _e.imageType) || 'personal' }, (config.imageConfig || {})), { imageUri: config.imageUri });
             delete config.imageUri;
         }
         return config;
@@ -6837,9 +6737,10 @@ class FunctionDeployer {
         }
     }
     async prepareEnterpriseBuildConfig(ctx, config) {
-        const repository = config.build.repository || '';
-        const hasPreparedTarget = Boolean((config.registryId || config.build.registryId) && repository.split('/').length >= 3);
-        if (config.imageType !== 'enterprise' || hasPreparedTarget) {
+        const build = config.imageConfig.build;
+        const repository = build.repository || '';
+        const hasPreparedTarget = Boolean((config.imageConfig.registryId || build.registryId) && repository.split('/').length >= 3);
+        if (config.imageConfig.imageType !== 'enterprise' || hasPreparedTarget) {
             return { config };
         }
         const prepared = await this.runLabeledStep(ctx, {
@@ -6855,13 +6756,14 @@ class FunctionDeployer {
     }
     async preparePersonalBuildConfig(ctx, config) {
         var _a, _b, _c;
-        if (config.imageType !== 'personal') {
+        if (config.imageConfig.imageType !== 'personal') {
             return config;
         }
         const envId = this.resolveEnvironmentId();
-        const configuredNamespace = (_a = config.build.namespace) === null || _a === void 0 ? void 0 : _a.trim();
-        const hasConfiguredRepository = Boolean((_b = config.build.repository) === null || _b === void 0 ? void 0 : _b.trim());
-        const configuredRepository = ((_c = config.build.repository) === null || _c === void 0 ? void 0 : _c.trim()) || config.name;
+        const build = config.imageConfig.build;
+        const configuredNamespace = (_a = build.namespace) === null || _a === void 0 ? void 0 : _a.trim();
+        const hasConfiguredRepository = Boolean((_b = build.repository) === null || _b === void 0 ? void 0 : _b.trim());
+        const configuredRepository = ((_c = build.repository) === null || _c === void 0 ? void 0 : _c.trim()) || config.name;
         const parsedRepository = (0, config_guard_1.parseImageReference)(configuredRepository);
         if (!parsedRepository || parsedRepository.tag || parsedRepository.digest) {
             throw new error_1.CloudBaseError('个人版 TCR repository 不合法。', {
@@ -6874,7 +6776,7 @@ class FunctionDeployer {
         const namespace = configuredNamespace || repositoryNamespace || envId;
         const hasConfiguredNamespace = Boolean(configuredNamespace || repositoryNamespace);
         const registry = parsedRepository.registry || personal_tcr_1.DEFAULT_PERSONAL_TCR_REGISTRY;
-        const credential = config.build.registryCredential;
+        const credential = build.registryCredential;
         if (!(credential === null || credential === void 0 ? void 0 : credential.username) || !credential.password) {
             throw new error_1.CloudBaseError('个人版 TCR 构建缺少推送凭证。', {
                 code: types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_MISSING
@@ -6891,7 +6793,7 @@ class FunctionDeployer {
             })
         });
         const targetRepository = `${registry}/${namespace}/${repository}`;
-        const preparedConfig = Object.assign(Object.assign({}, config), { build: Object.assign(Object.assign({}, config.build), { namespace, repository: targetRepository, registryCredential: credential }) });
+        const preparedConfig = Object.assign(Object.assign({}, config), { imageConfig: Object.assign(Object.assign({}, config.imageConfig), { build: Object.assign(Object.assign({}, build), { namespace, repository: targetRepository, registryCredential: credential }) }) });
         return preparedConfig;
     }
     /**
@@ -6909,9 +6811,9 @@ class FunctionDeployer {
             // 企业版登录凭证在触发 CloudApp 构建前换取，构建容器只消费 Secrets，
             // 不再自行签名调用 TCR API。
             const cloudRegistryId = ((_a = prepared.target) === null || _a === void 0 ? void 0 : _a.registryId) ||
-                cloudConfig.build.registryId ||
-                cloudConfig.registryId;
-            const enterpriseCredential = cloudConfig.imageType === 'enterprise' && cloudRegistryId
+                cloudConfig.imageConfig.build.registryId ||
+                cloudConfig.imageConfig.registryId;
+            const enterpriseCredential = cloudConfig.imageConfig.imageType === 'enterprise' && cloudRegistryId
                 ? await this.runLabeledStep(ctx, {
                     stage: 'preflight',
                     label: '获取企业版 TCR 临时登录凭证',
@@ -6949,7 +6851,7 @@ class FunctionDeployer {
             try {
                 if (credential) {
                     await this.runStep(ctx, 'login', async () => {
-                        await (0, local_builder_1.loginDockerRegistry)(this.resolveRegistryFromRepository(localConfig.build.repository), credential, { deps: this.localBuilderDeps, commandOptions });
+                        await (0, local_builder_1.loginDockerRegistry)(this.resolveRegistryFromRepository(localConfig.imageConfig.build.repository), credential, { deps: this.localBuilderDeps, commandOptions });
                     });
                 }
                 const buildResult = await this.runStep(ctx, 'build', async () => {
@@ -6966,14 +6868,14 @@ class FunctionDeployer {
                         message: line
                     }), { deps: this.localBuilderDeps, commandOptions });
                 });
-                if (localConfig.imageType === 'personal') {
+                if (localConfig.imageConfig.imageType === 'personal') {
                     await this.runLabeledStep(ctx, {
                         stage: 'push',
                         label: '清理历史镜像标签',
                         handler: () => this.personalTcrServiceFactory().cleanupTags({
-                            namespace: localConfig.build.namespace,
-                            repository: localConfig.build.repository,
-                            retain: localConfig.build.retainedTags
+                            namespace: localConfig.imageConfig.build.namespace,
+                            repository: localConfig.imageConfig.build.repository,
+                            retain: localConfig.imageConfig.build.retainedTags
                         })
                     });
                 }
@@ -6992,9 +6894,10 @@ class FunctionDeployer {
     }
     async resolveLocalRegistryCredential(config) {
         var _a, _b, _c;
-        const imageType = (_a = config.imageType) !== null && _a !== void 0 ? _a : (((_b = config.registryId) !== null && _b !== void 0 ? _b : config.build.registryId) ? 'enterprise' : 'personal');
+        const build = config.imageConfig.build;
+        const imageType = (_a = config.imageConfig.imageType) !== null && _a !== void 0 ? _a : (((_b = config.imageConfig.registryId) !== null && _b !== void 0 ? _b : build.registryId) ? 'enterprise' : 'personal');
         if (imageType === 'enterprise') {
-            const registryId = (_c = config.registryId) !== null && _c !== void 0 ? _c : config.build.registryId;
+            const registryId = (_c = config.imageConfig.registryId) !== null && _c !== void 0 ? _c : build.registryId;
             if (!registryId) {
                 throw new error_1.CloudBaseError('企业版 TCR local 构建缺少 registryId。', {
                     code: types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_MISSING
@@ -7003,7 +6906,7 @@ class FunctionDeployer {
             const credential = await (0, enterprise_tcr_1.createEnterpriseTcrCredential)(this.tcrServiceFactory(), registryId);
             return { username: credential.username, secret: credential.token };
         }
-        const credential = config.build.registryCredential;
+        const credential = build.registryCredential;
         if (!credential) {
             return undefined;
         }
@@ -7194,30 +7097,33 @@ class FunctionDeployer {
     }
 }
 exports.FunctionDeployer = FunctionDeployer;
-__exportStar(__webpack_require__(22724), exports);
-var config_guard_2 = __webpack_require__(69238);
+__exportStar(__webpack_require__(79345), exports);
+var config_guard_2 = __webpack_require__(74931);
 Object.defineProperty(exports, "assertDeployConfig", ({ enumerable: true, get: function () { return config_guard_2.assertDeployConfig; } }));
 Object.defineProperty(exports, "checkDeployConfig", ({ enumerable: true, get: function () { return config_guard_2.checkDeployConfig; } }));
+Object.defineProperty(exports, "applyMinimalDeployConfigDefaults", ({ enumerable: true, get: function () { return config_guard_2.applyMinimalDeployConfigDefaults; } }));
+Object.defineProperty(exports, "getMissingDeployInputs", ({ enumerable: true, get: function () { return config_guard_2.getMissingDeployInputs; } }));
+Object.defineProperty(exports, "prepareMinimalDeployConfig", ({ enumerable: true, get: function () { return config_guard_2.prepareMinimalDeployConfig; } }));
 Object.defineProperty(exports, "isCustomImageRuntime", ({ enumerable: true, get: function () { return config_guard_2.isCustomImageRuntime; } }));
 Object.defineProperty(exports, "normalizeDeployConfig", ({ enumerable: true, get: function () { return config_guard_2.normalizeDeployConfig; } }));
 Object.defineProperty(exports, "normalizeGatewayPath", ({ enumerable: true, get: function () { return config_guard_2.normalizeGatewayPath; } }));
 Object.defineProperty(exports, "parseImageReference", ({ enumerable: true, get: function () { return config_guard_2.parseImageReference; } }));
-var planner_2 = __webpack_require__(28750);
+var planner_2 = __webpack_require__(72325);
 Object.defineProperty(exports, "createDeployPlan", ({ enumerable: true, get: function () { return planner_2.createDeployPlan; } }));
 Object.defineProperty(exports, "toCurrentState", ({ enumerable: true, get: function () { return planner_2.toCurrentState; } }));
-var artifact_2 = __webpack_require__(78146);
+var artifact_2 = __webpack_require__(84187);
 Object.defineProperty(exports, "createCodeArtifact", ({ enumerable: true, get: function () { return artifact_2.createCodeArtifact; } }));
 Object.defineProperty(exports, "createImageArtifactFromConfig", ({ enumerable: true, get: function () { return artifact_2.createImageArtifactFromConfig; } }));
 Object.defineProperty(exports, "toCloudFunction", ({ enumerable: true, get: function () { return artifact_2.toCloudFunction; } }));
-var cloud_2 = __webpack_require__(36114);
+var cloud_2 = __webpack_require__(4295);
 Object.defineProperty(exports, "buildImageOnCloud", ({ enumerable: true, get: function () { return cloud_2.buildImageOnCloud; } }));
-var cloud_build_service_2 = __webpack_require__(52244);
+var cloud_build_service_2 = __webpack_require__(43587);
 Object.defineProperty(exports, "createCloudBuildService", ({ enumerable: true, get: function () { return cloud_build_service_2.createCloudBuildService; } }));
-var preflight_2 = __webpack_require__(61081);
+var preflight_2 = __webpack_require__(69230);
 Object.defineProperty(exports, "runLocalPreflight", ({ enumerable: true, get: function () { return preflight_2.runLocalPreflight; } }));
-var image_preflight_2 = __webpack_require__(56749);
+var image_preflight_2 = __webpack_require__(67650);
 Object.defineProperty(exports, "runImageRemotePreflight", ({ enumerable: true, get: function () { return image_preflight_2.runImageRemotePreflight; } }));
-var cam_preflight_2 = __webpack_require__(11903);
+var cam_preflight_2 = __webpack_require__(68388);
 Object.defineProperty(exports, "runImagePullAuthPreflight", ({ enumerable: true, get: function () { return cam_preflight_2.runImagePullAuthPreflight; } }));
 Object.defineProperty(exports, "isCamPermissionError", ({ enumerable: true, get: function () { return cam_preflight_2.isCamPermissionError; } }));
 Object.defineProperty(exports, "SCF_PULL_IMAGE_ROLE", ({ enumerable: true, get: function () { return cam_preflight_2.SCF_PULL_IMAGE_ROLE; } }));
@@ -7227,16 +7133,16 @@ Object.defineProperty(exports, "IMAGE_PULL_GRANT_URL", ({ enumerable: true, get:
 
 /***/ },
 
-/***/ 83463
+/***/ 6378
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.GatewayDeployer = void 0;
-const domain_1 = __webpack_require__(83597);
-const error_1 = __webpack_require__(18143);
-const utils_1 = __webpack_require__(24263);
+const domain_1 = __webpack_require__(43294);
+const error_1 = __webpack_require__(54884);
+const utils_1 = __webpack_require__(88208);
 /**
  * 网关声明式部署器
  * 支持 function:<name>（SCF 云函数）与 hosting:<name>（STATIC_STORE 静态托管）两种目标
@@ -7847,343 +7753,7 @@ exports.GatewayDeployer = GatewayDeployer;
 
 /***/ },
 
-/***/ 13483
-(__unused_webpack_module, exports, __webpack_require__) {
-
-"use strict";
-
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.StateStore = exports.DEFAULT_HASH_LENGTH = exports.DEFAULT_MAX_HOSTING_FILES = exports.HostingFilesOverLimitError = void 0;
-const fs_1 = __importDefault(__webpack_require__(29021));
-const path_1 = __importDefault(__webpack_require__(33873));
-const crypto_1 = __importDefault(__webpack_require__(55511));
-const child_process_1 = __webpack_require__(79646);
-const error_1 = __webpack_require__(18143);
-/** hosting 指纹文件数超过上限时抛出（触发降级为全量部署） */
-class HostingFilesOverLimitError extends Error {
-    constructor(fileCount, limit) {
-        super(`hosting 文件数 ${fileCount} 超过指纹上限 ${limit}，跳过逐文件 diff，降级为全量部署`);
-        this.name = 'HostingFilesOverLimitError';
-        this.fileCount = fileCount;
-        this.limit = limit;
-    }
-}
-exports.HostingFilesOverLimitError = HostingFilesOverLimitError;
-/** 默认强制忽略的目录/文件（不可被调用方关闭） */
-const DEFAULT_IGNORE = ['.DS_Store', 'node_modules/'];
-/** 默认指纹文件数上限（防快照膨胀与 I/O 失控） */
-exports.DEFAULT_MAX_HOSTING_FILES = 50000;
-/** 默认 hash 截断长度（16 位 hex = 64bit，碰撞概率可忽略；快照体积减半） */
-exports.DEFAULT_HASH_LENGTH = 16;
-/**
- * 部署状态快照（StateStore）
- *
- * 职责：读写 `.cloudbase/state.json`（默认），为 dry-run 的 hosting/app diff 提供本地基准，
- * 避免每次 diff 都拉取云端。
- *
- * 指纹算法：hosting = 产物目录逐文件内容 sha256（相对路径为 key）。
- * 只存 hash 不存内容，体积 = O(文件数)；app 快照不写入 envVariables（敏感过滤）。
- */
-class StateStore {
-    constructor(options = {}) {
-        this.cwd = options.cwd || process.cwd();
-        this.env = options.env;
-        this.stateFile = options.stateFile;
-    }
-    /**
-     * 计算 state 文件路径：
-     * - 自定义 stateFile 优先
-     * - 否则 {cwd}/.cloudbase/state.json（无 env）或 state.{env}.json（多环境隔离）
-     */
-    getFilePath() {
-        if (this.stateFile) {
-            return this.stateFile;
-        }
-        const base = this.env ? `state.${this.env}.json` : 'state.json';
-        return path_1.default.join(this.cwd, '.cloudbase', base);
-    }
-    /**
-     * 读取状态快照；文件不存在或 JSON 损坏返回 null（缺失降级，由调用方走云端兜底）
-     */
-    read() {
-        const filePath = this.getFilePath();
-        if (!fs_1.default.existsSync(filePath)) {
-            return null;
-        }
-        try {
-            return JSON.parse(fs_1.default.readFileSync(filePath, 'utf8'));
-        }
-        catch (_a) {
-            return null;
-        }
-    }
-    /**
-     * 写入状态快照（自动补 version/updatedAt/gitCommit，自动创建 .cloudbase 目录）
-     */
-    write(state) {
-        var _a;
-        const filePath = this.getFilePath();
-        fs_1.default.mkdirSync(path_1.default.dirname(filePath), { recursive: true });
-        const full = {
-            version: 1,
-            updatedAt: new Date().toISOString(),
-            gitCommit: (_a = state.gitCommit) !== null && _a !== void 0 ? _a : this.resolveGitCommit(),
-            envId: state.envId,
-            resources: state.resources
-        };
-        fs_1.default.writeFileSync(filePath, JSON.stringify(full, null, 2), 'utf8');
-    }
-    /**
-     * 计算产物目录逐文件 sha256 指纹（仅 hash，兼容旧调用）
-     *
-     * @param projectPath 产物目录（hosting 的 outputDir / root）
-     * @param ignore 自定义忽略规则（追加到默认 node_modules / .DS_Store 之后）
-     * @param options 扫描选项（maxFiles / hashLength）
-     * @returns 相对路径（/ 分隔）→ 文件内容 sha256（默认截断 16 位）
-     */
-    async computeHostingFiles(projectPath, ignore = [], options = {}) {
-        const fingerprints = await this.computeHostingFingerprints(projectPath, ignore, options);
-        const result = {};
-        for (const [relPath, fp] of Object.entries(fingerprints)) {
-            result[relPath] = fp.hash;
-        }
-        return result;
-    }
-    /**
-     * 计算产物目录逐文件指纹（hash + size）
-     *
-     * - 强制忽略 node_modules / .DS_Store（与传入 ignore 合并，不可关闭）
-     * - hash 默认截断为 16 位 hex（hashLength 可调，64 = 完整 sha256）
-     * - 文件数超过 maxFiles 抛 HostingFilesOverLimitError（防快照膨胀与 I/O 失控）
-     *
-     * @param projectPath 产物目录（hosting 的 outputDir / root）
-     * @param ignore 自定义忽略规则
-     * @param options 扫描选项（maxFiles / hashLength）
-     * @returns 相对路径（/ 分隔）→ { hash, size }
-     */
-    async computeHostingFingerprints(projectPath, ignore = [], options = {}) {
-        if (!fs_1.default.existsSync(projectPath) || !fs_1.default.statSync(projectPath).isDirectory()) {
-            throw new error_1.CloudBaseError(`产物目录不存在或不是目录：${projectPath}`);
-        }
-        const { maxFiles = exports.DEFAULT_MAX_HOSTING_FILES, hashLength = exports.DEFAULT_HASH_LENGTH } = options;
-        const effectiveIgnore = this.mergeIgnore(ignore);
-        const files = {};
-        let count = 0;
-        const walk = (dir, rel) => {
-            for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
-                const entryPath = path_1.default.join(dir, entry.name);
-                const relPath = rel ? path_1.default.join(rel, entry.name) : entry.name;
-                if (entry.isDirectory()) {
-                    if (this.isIgnored(relPath, effectiveIgnore)) {
-                        continue;
-                    }
-                    walk(entryPath, relPath);
-                }
-                else if (entry.isFile() && !this.isIgnored(relPath, effectiveIgnore)) {
-                    count++;
-                    if (maxFiles > 0 && count > maxFiles) {
-                        throw new HostingFilesOverLimitError(count, maxFiles);
-                    }
-                    const normalized = relPath.split(path_1.default.sep).join('/');
-                    files[normalized] = {
-                        hash: this.hashFile(entryPath, hashLength),
-                        size: fs_1.default.statSync(entryPath).size
-                    };
-                }
-            }
-        };
-        walk(projectPath, '');
-        return files;
-    }
-    /**
-     * 计算产物目录与快照的变更集（懒加载）
-     *
-     * 优化：先 stat 拿 size，size 与快照不同的文件直接判定变更（不读文件内容），
-     * 只有 size 相同（或旧快照 size 未知）的文件才读内容 hash 对比，
-     * 避免为未变文件做无谓的 I/O 与 hash。
-     * 文件数超过 maxFiles 时放弃 diff，返回 overLimit=true（调用方应降级为全量部署）。
-     *
-     * @param projectPath 产物目录（hosting 的 outputDir / root）
-     * @param previous 上次快照指纹（undefined = 首次部署，全部视为新增）
-     * @param options 选项（ignore / maxFiles / hashLength）
-     */
-    async diffHostingFiles(projectPath, previous, options = {}) {
-        if (!fs_1.default.existsSync(projectPath) || !fs_1.default.statSync(projectPath).isDirectory()) {
-            throw new error_1.CloudBaseError(`产物目录不存在或不是目录：${projectPath}`);
-        }
-        const { ignore = [], maxFiles = exports.DEFAULT_MAX_HOSTING_FILES, hashLength = exports.DEFAULT_HASH_LENGTH } = options;
-        const effectiveIgnore = this.mergeIgnore(ignore);
-        // 归一化快照：旧格式（string）size 未知 → -1，走 hash 对比而非 size 预判
-        let prev;
-        if (previous) {
-            prev = {};
-            for (const [k, v] of Object.entries(previous)) {
-                prev[k] = this.normalizeFileValue(v);
-            }
-        }
-        const localFiles = new Set();
-        const added = [];
-        const modified = [];
-        let count = 0;
-        let overLimit = false;
-        const walk = (dir, rel) => {
-            if (overLimit) {
-                return;
-            }
-            for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
-                const entryPath = path_1.default.join(dir, entry.name);
-                const relPath = rel ? path_1.default.join(rel, entry.name) : entry.name;
-                if (entry.isDirectory()) {
-                    if (this.isIgnored(relPath, effectiveIgnore)) {
-                        continue;
-                    }
-                    walk(entryPath, relPath);
-                }
-                else if (entry.isFile() && !this.isIgnored(relPath, effectiveIgnore)) {
-                    count++;
-                    if (maxFiles > 0 && count > maxFiles) {
-                        overLimit = true;
-                        return;
-                    }
-                    const normalized = relPath.split(path_1.default.sep).join('/');
-                    localFiles.add(normalized);
-                    const prevEntry = prev === null || prev === void 0 ? void 0 : prev[normalized];
-                    if (!prevEntry) {
-                        added.push(normalized);
-                    }
-                    else if (prevEntry.size !== -1 && prevEntry.size !== fs_1.default.statSync(entryPath).size) {
-                        // size 变化 → 内容必变，无需读文件（懒加载核心）
-                        modified.push(normalized);
-                    }
-                    else {
-                        // size 相同或旧快照 size 未知 → 读内容 hash 确认
-                        const hash = this.hashFile(entryPath, hashLength);
-                        if (prevEntry.hash !== hash) {
-                            modified.push(normalized);
-                        }
-                    }
-                }
-            }
-        };
-        walk(projectPath, '');
-        if (overLimit) {
-            return {
-                added: [],
-                modified: [],
-                deleted: [],
-                totalChanged: 0,
-                unchanged: false,
-                overLimit: true
-            };
-        }
-        const deleted = prev
-            ? Object.keys(prev).filter(k => !localFiles.has(k) && !this.isIgnored(k, effectiveIgnore))
-            : [];
-        const totalChanged = added.length + modified.length + deleted.length;
-        return { added, modified, deleted, totalChanged, unchanged: totalChanged === 0 };
-    }
-    /**
-     * 提取 app 配置快照（仅 diff 白名单字段）
-     * envVariables / ignore 等非 diff 字段与敏感信息不进入快照
-     */
-    buildAppConfig(config) {
-        if (!config || typeof config !== 'object') {
-            return undefined;
-        }
-        const entry = {};
-        if (config.serviceName !== undefined) {
-            entry.serviceName = config.serviceName;
-        }
-        if (config.installCommand !== undefined) {
-            entry.installCommand = config.installCommand;
-        }
-        if (config.buildCommand !== undefined) {
-            entry.buildCommand = config.buildCommand;
-        }
-        if (config.outputDir !== undefined) {
-            entry.outputDir = config.outputDir;
-        }
-        if (config.deployPath !== undefined) {
-            entry.deployPath = config.deployPath;
-        }
-        return entry;
-    }
-    hashFile(filePath, hashLength = exports.DEFAULT_HASH_LENGTH) {
-        const content = fs_1.default.readFileSync(filePath);
-        return crypto_1.default.createHash('sha256').update(content).digest('hex').slice(0, hashLength);
-    }
-    /** 合并默认忽略规则（node_modules / .DS_Store 不可被调用方关闭） */
-    mergeIgnore(ignore) {
-        return Array.from(new Set([...DEFAULT_IGNORE, ...(ignore || [])]));
-    }
-    /** 归一化快照指纹值：旧格式（纯 string = 仅 hash，size 未知用 -1 表示） */
-    normalizeFileValue(value) {
-        if (typeof value === 'string') {
-            return { hash: value, size: -1 };
-        }
-        return value;
-    }
-    /**
-     * 是否命中忽略规则：
-     * - 目录模式（结尾 /）：匹配该目录及其下所有
-     * - glob（含 **）：转换为正则匹配相对路径
-     * - 其余：精确/前缀匹配
-     */
-    isIgnored(relPath, ignore) {
-        const normalized = relPath.split(path_1.default.sep).join('/');
-        for (const pattern of ignore) {
-            if (this.matchPattern(normalized, pattern)) {
-                return true;
-            }
-        }
-        return false;
-    }
-    matchPattern(relPath, pattern) {
-        const p = pattern.trim();
-        if (!p) {
-            return false;
-        }
-        // 目录模式（结尾 /）：匹配目录本身及下所有内容
-        if (p.endsWith('/')) {
-            const prefix = p.slice(0, -1);
-            return relPath === prefix || relPath.startsWith(prefix + '/');
-        }
-        // glob（含 **）：把 ** 转成 .*，其余转义后整体匹配
-        if (p.includes('**')) {
-            const regexStr = '^' +
-                p.split('**').map(part => this.escapeRegExp(part)).join('.*') +
-                '$';
-            return new RegExp(regexStr).test(relPath);
-        }
-        // 精确匹配或前缀匹配（目录下的文件）
-        return relPath === p || relPath.startsWith(p + '/');
-    }
-    escapeRegExp(s) {
-        return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-    }
-    /** 解析当前 git commit（非 git 仓库或失败返回 undefined，不阻断） */
-    resolveGitCommit() {
-        try {
-            const out = (0, child_process_1.execSync)('git rev-parse HEAD', {
-                cwd: this.cwd,
-                stdio: 'pipe'
-            });
-            return out.toString().trim() || undefined;
-        }
-        catch (_a) {
-            return undefined;
-        }
-    }
-}
-exports.StateStore = StateStore;
-
-
-/***/ },
-
-/***/ 1227
+/***/ 19672
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -8195,8 +7765,8 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.StaticDeployer = void 0;
 const path_1 = __importDefault(__webpack_require__(33873));
 const child_process_1 = __webpack_require__(79646);
-const error_1 = __webpack_require__(18143);
-const framework_1 = __webpack_require__(20789);
+const error_1 = __webpack_require__(54884);
+const framework_1 = __webpack_require__(72980);
 /** 环境变量值统一转字符串（execSync env 要求 string） */
 function stringifyEnvValues(envVariables) {
     const result = {};
@@ -8433,7 +8003,7 @@ exports.StaticDeployer = StaticDeployer;
 
 /***/ },
 
-/***/ 83597
+/***/ 43294
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -8482,7 +8052,7 @@ function getGatewayBaseUrl(environment, envId) {
 
 /***/ },
 
-/***/ 20789
+/***/ 72980
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -8720,7 +8290,7 @@ function resolveHostingOutputDir(config, root, readPkgFile = defaultReadPkgFile)
 
 /***/ },
 
-/***/ 78146
+/***/ 84187
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -8731,12 +8301,30 @@ exports.createImageArtifactFromConfig = createImageArtifactFromConfig;
 exports.createImageArtifactFromBuild = createImageArtifactFromBuild;
 exports.createImageArtifactFromCloudBuild = createImageArtifactFromCloudBuild;
 exports.toCloudFunction = toCloudFunction;
-const types_1 = __webpack_require__(22724);
+const error_1 = __webpack_require__(54884);
+const types_1 = __webpack_require__(79345);
 /**
- * 部署物构造与 SCF 参数映射
+ * 解析构建类镜像部署物的 SCF RegistryId
  *
- * 四种构建策略最终都产出统一的部署物，之后走同一条 SCF 创建或更新流程
+ * 个人版镜像（personal，如个人版 CCR）不携带 registryId；企业版优先取
+ * imageConfig.registryId，回退到构建配置 imageConfig.build.registryId。
+ * 正常流程下企业版 registryId 已由 prepareEnterpriseTcrTarget 在构建前解析补齐，
+ * 此处对缺失场景 fail-fast 并给出明确错误：避免产出缺少 RegistryId 的部署物，
+ * 导致后续 SCF 拉取企业版镜像时失败且难以排查。
  */
+function resolveBuildRegistryId(imageConfig) {
+    var _a, _b;
+    if (imageConfig.imageType !== 'enterprise') {
+        return undefined;
+    }
+    const registryId = (_a = imageConfig.registryId) !== null && _a !== void 0 ? _a : (_b = imageConfig.build) === null || _b === void 0 ? void 0 : _b.registryId;
+    if (!registryId) {
+        throw new error_1.CloudBaseError('企业版镜像缺少 TCR 实例 ID（registryId），无法生成镜像部署物。', {
+            code: types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_MISSING
+        });
+    }
+    return registryId;
+}
 /** 由本地代码来源构造代码类部署物 */
 function createCodeArtifact(config) {
     const functionRootPath = 'functionRootPath' in config ? config.functionRootPath : undefined;
@@ -8754,28 +8342,26 @@ function createCodeArtifact(config) {
 }
 /** 由已有镜像配置构造镜像类部署物 */
 function createImageArtifactFromConfig(config) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+    var _a;
     const { imageConfig } = config;
-    // imageType/registryId 的契约位置在配置顶层（IHttpImageRuntimeCommon），
-    // 与 local/cloud 策略一致；imageConfig 内的同名字段仅作向后兼容兜底。
+    // 直接读取 cloudbaserc 嵌套形状：镜像字段全部位于 imageConfig。
     // 个人版镜像（personal，如个人版 CCR）不应携带 registryId。
-    const configuredRegistryId = (_a = config.registryId) !== null && _a !== void 0 ? _a : imageConfig.registryId;
-    const imageType = (_c = (_b = config.imageType) !== null && _b !== void 0 ? _b : imageConfig.imageType) !== null && _c !== void 0 ? _c : (configuredRegistryId ? 'enterprise' : 'personal');
-    const registryId = imageType === 'enterprise' ? configuredRegistryId : undefined;
+    const imageType = imageConfig.imageType;
+    const registryId = imageType === 'enterprise' ? imageConfig.registryId : undefined;
     return {
         kind: 'image',
         deployMode: 'image',
         imageUri: imageConfig.imageUri,
         imageType,
         registryId,
-        imagePort: types_1.IMAGE_FUNCTION_PORT,
+        imagePort: (_a = imageConfig.imagePort) !== null && _a !== void 0 ? _a : types_1.IMAGE_FUNCTION_PORT,
         effectiveStrategy: 'image',
-        entryPoint: (_d = imageConfig.entryPoint) !== null && _d !== void 0 ? _d : config.entryPoint,
-        command: (_e = imageConfig.command) !== null && _e !== void 0 ? _e : config.command,
-        args: (_f = imageConfig.args) !== null && _f !== void 0 ? _f : config.args,
-        commandList: (_g = imageConfig.commandList) !== null && _g !== void 0 ? _g : config.commandList,
-        argsList: (_h = imageConfig.argsList) !== null && _h !== void 0 ? _h : config.argsList,
-        containerImageAccelerate: (_j = imageConfig.containerImageAccelerate) !== null && _j !== void 0 ? _j : config.containerImageAccelerate
+        entryPoint: imageConfig.entryPoint,
+        command: imageConfig.command,
+        args: imageConfig.args,
+        commandList: imageConfig.commandList,
+        argsList: imageConfig.argsList,
+        containerImageAccelerate: imageConfig.containerImageAccelerate
     };
 }
 /**
@@ -8785,11 +8371,10 @@ function createImageArtifactFromConfig(config) {
  * 此处仅承载最终 imageUri/digest 与容器启动配置，之后复用镜像部署链。
  */
 function createImageArtifactFromBuild(config, build) {
-    var _a, _b, _c;
-    const imageType = (_a = config.imageType) !== null && _a !== void 0 ? _a : (((_b = config.registryId) !== null && _b !== void 0 ? _b : config.build.registryId) ? 'enterprise' : 'personal');
-    const registryId = imageType === 'enterprise'
-        ? (_c = config.registryId) !== null && _c !== void 0 ? _c : config.build.registryId
-        : undefined;
+    var _a;
+    const { imageConfig } = config;
+    const imageType = imageConfig.imageType;
+    const registryId = resolveBuildRegistryId(imageConfig);
     return {
         kind: 'image',
         deployMode: 'image',
@@ -8797,14 +8382,14 @@ function createImageArtifactFromBuild(config, build) {
         imageDigest: build.imageDigest,
         imageType,
         registryId,
-        imagePort: types_1.IMAGE_FUNCTION_PORT,
+        imagePort: (_a = imageConfig.imagePort) !== null && _a !== void 0 ? _a : types_1.IMAGE_FUNCTION_PORT,
         effectiveStrategy: 'local',
-        entryPoint: config.entryPoint,
-        command: config.command,
-        args: config.args,
-        commandList: config.commandList,
-        argsList: config.argsList,
-        containerImageAccelerate: config.containerImageAccelerate
+        entryPoint: imageConfig.entryPoint,
+        command: imageConfig.command,
+        args: imageConfig.args,
+        commandList: imageConfig.commandList,
+        argsList: imageConfig.argsList,
+        containerImageAccelerate: imageConfig.containerImageAccelerate
     };
 }
 /**
@@ -8815,30 +8400,29 @@ function createImageArtifactFromBuild(config, build) {
  * effectiveStrategy 标记为 cloud，便于结果层如实回传实际生效的策略。
  */
 function createImageArtifactFromCloudBuild(config, build) {
-    var _a, _b;
-    const imageType = (_a = config.imageType) !== null && _a !== void 0 ? _a : (config.build.registryId ? 'enterprise' : 'personal');
-    const registryId = imageType === 'enterprise'
-        ? (_b = config.registryId) !== null && _b !== void 0 ? _b : config.build.registryId
-        : undefined;
+    var _a;
+    const { imageConfig } = config;
+    const imageType = imageConfig.imageType;
+    // 云端构建默认推送到个人版 TCR（CCR）；企业版实例 ID 位于 imageConfig.build.registryId，
+    // 需继续透传到 Stage B 的 SCF ImageConfig，避免构建成功后拉取镜像时丢失 RegistryId。
+    const registryId = resolveBuildRegistryId(imageConfig);
     return {
         kind: 'image',
         deployMode: 'image',
         imageUri: build.imageUri,
         imageDigest: build.imageDigest,
-        // 云端构建默认推送到个人版 TCR（CCR）；企业版实例 ID 位于 build.registryId，
-        // 需继续透传到 Stage B 的 SCF ImageConfig，避免构建成功后拉取镜像时丢失 RegistryId。
         imageType,
         registryId,
-        imagePort: types_1.IMAGE_FUNCTION_PORT,
+        imagePort: (_a = imageConfig.imagePort) !== null && _a !== void 0 ? _a : types_1.IMAGE_FUNCTION_PORT,
         effectiveStrategy: 'cloud',
         buildId: build.buildId,
         logsUrl: build.logsUrl,
-        entryPoint: config.entryPoint,
-        command: config.command,
-        args: config.args,
-        commandList: config.commandList,
-        argsList: config.argsList,
-        containerImageAccelerate: config.containerImageAccelerate
+        entryPoint: imageConfig.entryPoint,
+        command: imageConfig.command,
+        args: imageConfig.args,
+        commandList: imageConfig.commandList,
+        argsList: imageConfig.argsList,
+        containerImageAccelerate: imageConfig.containerImageAccelerate
     };
 }
 /** 将构建产出的 tag 地址与 digest 合成为 SCF 支持的不可变镜像引用 */
@@ -8960,7 +8544,7 @@ function toCloudFunction(config, artifact) {
 
 /***/ },
 
-/***/ 36114
+/***/ 4295
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -8972,8 +8556,8 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.buildImageOnCloud = buildImageOnCloud;
 const fs_1 = __importDefault(__webpack_require__(29021));
 const path_1 = __importDefault(__webpack_require__(33873));
-const error_1 = __webpack_require__(18143);
-const types_1 = __webpack_require__(22724);
+const error_1 = __webpack_require__(54884);
+const types_1 = __webpack_require__(79345);
 /**
  * 云端镜像构建（cloud 策略）
  *
@@ -9075,11 +8659,12 @@ function assertSafeBuildArgs(buildArgs) {
 /** 个人版 CCR 默认域名 */
 const DEFAULT_PERSONAL_REGISTRY = 'ccr.ccs.tencentyun.com';
 function resolveTarget(config) {
-    const build = config.build;
+    const build = config.imageConfig.build;
+    const imageType = config.imageConfig.imageType;
     const repository = (build.repository || config.name).trim();
     const rawRegistryId = build.registryId;
     const registryId = typeof rawRegistryId === 'string' ? rawRegistryId.trim() : rawRegistryId;
-    const isEnterprise = config.imageType === 'enterprise' || Boolean(registryId);
+    const isEnterprise = imageType === 'enterprise' || Boolean(registryId);
     // CloudApp custom 构建与推送必须使用同一个平台版本 tag。
     // 若允许自定义 tag，build-image 会构建自定义 tag，而固定推送脚本会推
     // $CLOUDBASE_VERSION_NAME，最终必然找不到本地镜像。
@@ -9121,10 +8706,10 @@ function resolveTarget(config) {
         throw new error_1.CloudBaseError('cloud 策略缺少 TCR 命名空间，请配置 build.namespace 或在完整 repository 中声明', { code: types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID });
     }
     assertSafeRegistryToken(namespace, 'TCR namespace');
-    if (config.imageType === 'personal' && registryId) {
+    if (imageType === 'personal' && registryId) {
         throw new error_1.CloudBaseError('cloud 策略的 personal 镜像不能配置 build.registryId；请移除该字段或改用 enterprise', { code: types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID });
     }
-    if (config.imageType === 'enterprise') {
+    if (imageType === 'enterprise') {
         if (rawRegistryId === undefined || rawRegistryId === null) {
             throw new error_1.CloudBaseError('cloud 策略的企业版 TCR 未配置 build.registryId；如果当前没有企业版实例，请改用 imageType=personal', { code: types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_MISSING });
         }
@@ -9149,9 +8734,10 @@ function resolveTarget(config) {
  * CustomSteps 只包含 SDK 固定命令和经过白名单校验的 build arg key。
  */
 function resolveCloudBuildOptions(config) {
-    const dockerfile = config.build.dockerfile || types_1.DEFAULT_DOCKERFILE;
-    const platform = config.build.platform || types_1.DEFAULT_IMAGE_PLATFORM;
-    const buildArgs = config.build.buildArgs || {};
+    const build = config.imageConfig.build;
+    const dockerfile = build.dockerfile || types_1.DEFAULT_DOCKERFILE;
+    const platform = build.platform || types_1.DEFAULT_IMAGE_PLATFORM;
+    const buildArgs = build.buildArgs || {};
     assertSafeDockerfile(dockerfile);
     if (platform !== types_1.DEFAULT_IMAGE_PLATFORM) {
         throw new error_1.CloudBaseError(`当前仅支持构建 ${types_1.DEFAULT_IMAGE_PLATFORM} 镜像`, {
@@ -9163,7 +8749,7 @@ function resolveCloudBuildOptions(config) {
         dockerfile,
         platform,
         buildArgs,
-        forceBuild: config.build.forceBuild === true
+        forceBuild: build.forceBuild === true
     };
 }
 /**
@@ -9236,9 +8822,9 @@ function buildRegistryCredentials(config, target, enterpriseCredential) {
             ]
         };
     }
-    const credential = config.build.registryCredential;
+    const credential = config.imageConfig.build.registryCredential;
     if (!credential) {
-        throw new error_1.CloudBaseError('个人版 TCR 云端构建缺少 build.registryCredential；请在 cloudbaserc 中显式声明 ' +
+        throw new error_1.CloudBaseError('个人版 TCR 云端构建缺少 imageConfig.build.registryCredential；请在 cloudbaserc 中显式声明 ' +
             'username/password，推荐分别使用 "{{env.TCB_TCR_USERNAME}}" 和 ' +
             '"{{env.TCB_TCR_PASSWORD}}"', { code: types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_MISSING });
     }
@@ -9262,7 +8848,7 @@ function buildRegistryCredentials(config, target, enterpriseCredential) {
     };
 }
 function resolveCloudBuildContext(config, dockerfile) {
-    const cwd = path_1.default.resolve(config.build.cwd || config.functionPath || process.cwd());
+    const cwd = path_1.default.resolve(config.imageConfig.build.cwd || config.functionPath || process.cwd());
     const dockerfilePath = path_1.default.resolve(cwd, dockerfile);
     let stat = null;
     try {
@@ -9444,7 +9030,7 @@ async function pollUntilTerminal(params) {
 
 /***/ },
 
-/***/ 11903
+/***/ 68388
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -9453,7 +9039,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.TCR_PUSH_GRANT_URL = exports.IMAGE_PULL_GRANT_URL = exports.REQUIRED_TCR_PUSH_POLICY = exports.TCB_PUSH_ENTERPRISE_IMAGE_ROLE = exports.REQUIRED_IMAGE_PULL_POLICY = exports.SCF_PULL_IMAGE_ROLE = void 0;
 exports.isCamPermissionError = isCamPermissionError;
 exports.runImagePullAuthPreflight = runImagePullAuthPreflight;
-const types_1 = __webpack_require__(22724);
+const types_1 = __webpack_require__(79345);
 /**
  * 镜像仓库授权 Preflight（涉及 CAM，scope: cloud）
  *
@@ -9524,9 +9110,10 @@ function needsImagePullAuth(config) {
 }
 /** 只有企业版 cloud 策略需要 CloudApp 向企业版 TCR 推送镜像 */
 function needsEnterpriseTcrPushAuth(config) {
+    var _a;
     return (config.type === 'HTTP' &&
         config.buildStrategy === 'cloud' &&
-        config.imageType === 'enterprise');
+        ((_a = config.imageConfig) === null || _a === void 0 ? void 0 : _a.imageType) === 'enterprise');
 }
 function resolveRequirements(config) {
     const requirements = [];
@@ -9625,7 +9212,7 @@ async function runImagePullAuthPreflight(service, config, autoGrant = true) {
 
 /***/ },
 
-/***/ 52244
+/***/ 43587
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -9638,10 +9225,10 @@ exports.createCloudBuildService = createCloudBuildService;
 const fs_1 = __importDefault(__webpack_require__(29021));
 const os_1 = __importDefault(__webpack_require__(21820));
 const path_1 = __importDefault(__webpack_require__(33873));
-const error_1 = __webpack_require__(18143);
-const utils_1 = __webpack_require__(24263);
-const http_request_1 = __webpack_require__(7355);
-const types_1 = __webpack_require__(22724);
+const error_1 = __webpack_require__(54884);
+const utils_1 = __webpack_require__(88208);
+const http_request_1 = __webpack_require__(2922);
+const types_1 = __webpack_require__(79345);
 /**
  * 基于 CloudAppService 的云端构建能力适配器
  *
@@ -9810,7 +9397,7 @@ function createCloudBuildService(cloudApp, options = {}) {
 
 /***/ },
 
-/***/ 69238
+/***/ 74931
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -9822,12 +9409,15 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.parseImageReference = parseImageReference;
 exports.normalizeGatewayPath = normalizeGatewayPath;
 exports.isCustomImageRuntime = isCustomImageRuntime;
+exports.applyMinimalDeployConfigDefaults = applyMinimalDeployConfigDefaults;
+exports.getMissingDeployInputs = getMissingDeployInputs;
+exports.prepareMinimalDeployConfig = prepareMinimalDeployConfig;
 exports.normalizeDeployConfig = normalizeDeployConfig;
 exports.checkDeployConfig = checkDeployConfig;
 exports.assertDeployConfig = assertDeployConfig;
 const lodash_1 = __importDefault(__webpack_require__(35558));
-const error_1 = __webpack_require__(18143);
-const types_1 = __webpack_require__(22724);
+const error_1 = __webpack_require__(54884);
+const types_1 = __webpack_require__(79345);
 /**
  * 配置契约守卫
  *
@@ -9979,18 +9569,151 @@ function inferHttpBuildStrategy(config) {
     if (config === null || config === void 0 ? void 0 : config.buildStrategy) {
         return config.buildStrategy;
     }
-    if (config === null || config === void 0 ? void 0 : config.imageConfig) {
-        return 'image';
-    }
-    if (config === null || config === void 0 ? void 0 : config.build) {
+    const imageConfig = config === null || config === void 0 ? void 0 : config.imageConfig;
+    if (imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.build) {
         // 有构建上下文但未声明策略时，默认使用无需本地 Docker 的云端构建
         return 'cloud';
     }
+    if (imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.imageUri) {
+        return 'image';
+    }
     if (isCustomImageRuntime(config === null || config === void 0 ? void 0 : config.runtime)) {
         return 'image';
     }
     return 'zip';
 }
+/**
+ * 应用最小化镜像配置的可安全默认值，不执行 IO，不生成凭证。
+ * 仅填充构建上下文、仓库名、namespace 和运行时固定值；用户凭证必须显式传入。
+ *
+ * 直接在 cloudbaserc 的嵌套形状上操作：镜像字段位于 imageConfig，构建目标位于
+ * imageConfig.build，不再做字段平铺映射。
+ */
+function applyMinimalDeployConfigDefaults(config, context = {}) {
+    var _a, _b, _c, _d, _e, _f, _g;
+    const result = lodash_1.default.cloneDeep(config);
+    if ((result === null || result === void 0 ? void 0 : result.type) !== 'HTTP') {
+        return result;
+    }
+    const strategy = inferHttpBuildStrategy(result);
+    if (!['image', 'local', 'cloud'].includes(strategy)) {
+        return result;
+    }
+    result.buildStrategy = strategy;
+    const imageConfig = Object.assign({}, (result.imageConfig || {}));
+    result.imageConfig = imageConfig;
+    if (strategy === 'image') {
+        if (imageConfig.imageUri === undefined && ((_a = context.defaults) === null || _a === void 0 ? void 0 : _a.imageUri) !== undefined) {
+            imageConfig.imageUri = context.defaults.imageUri;
+        }
+        return result;
+    }
+    if (result.runtime === undefined) {
+        result.runtime = types_1.CUSTOM_IMAGE_RUNTIME;
+    }
+    if (imageConfig.imagePort === undefined) {
+        imageConfig.imagePort = types_1.IMAGE_FUNCTION_PORT;
+    }
+    const build = Object.assign({}, (imageConfig.build || {}));
+    imageConfig.build = build;
+    const functionPath = context.functionPath ||
+        (context.functionRootPath && result.name ? `${context.functionRootPath}/${result.name}` : undefined);
+    if (build.cwd === undefined && functionPath) {
+        build.cwd = functionPath;
+    }
+    if (build.dockerfile === undefined) {
+        build.dockerfile = types_1.DEFAULT_DOCKERFILE;
+    }
+    if (build.platform === undefined) {
+        build.platform = types_1.DEFAULT_IMAGE_PLATFORM;
+    }
+    const defaultRepository = (_c = (_b = context.defaults) === null || _b === void 0 ? void 0 : _b.repository) !== null && _c !== void 0 ? _c : result.name;
+    const defaultNamespace = (_e = (_d = context.defaults) === null || _d === void 0 ? void 0 : _d.namespace) !== null && _e !== void 0 ? _e : context.envId;
+    if (build.repository === undefined && defaultRepository !== undefined) {
+        build.repository = defaultRepository;
+    }
+    if (build.namespace === undefined && defaultNamespace !== undefined) {
+        build.namespace = defaultNamespace;
+    }
+    if (imageConfig.registryId === undefined && ((_f = context.defaults) === null || _f === void 0 ? void 0 : _f.registryId) !== undefined) {
+        imageConfig.registryId = context.defaults.registryId;
+    }
+    if (build.registryCredential === undefined && ((_g = context.defaults) === null || _g === void 0 ? void 0 : _g.registryCredential) !== undefined) {
+        build.registryCredential = lodash_1.default.cloneDeep(context.defaults.registryCredential);
+    }
+    return result;
+}
+/**
+ * 返回最小化部署在当前配置下仍缺失的输入字段；不执行网络、文件或凭证操作。
+ */
+function getMissingDeployInputs(config, context = {}) {
+    var _a, _b, _c;
+    const normalized = lodash_1.default.cloneDeep(config);
+    const missing = [];
+    if ((normalized === null || normalized === void 0 ? void 0 : normalized.type) !== 'HTTP') {
+        return missing;
+    }
+    const strategy = (_a = normalized.buildStrategy) !== null && _a !== void 0 ? _a : inferHttpBuildStrategy(normalized);
+    if (!['image', 'local', 'cloud'].includes(strategy)) {
+        return missing;
+    }
+    const imageConfig = normalized.imageConfig || {};
+    if (strategy === 'image') {
+        if (!imageConfig.imageUri) {
+            missing.push({ name: 'imageUri', path: 'imageConfig.imageUri', required: true, reason: '已有镜像部署需要固定 tag 或 digest 的 imageUri' });
+        }
+        return missing;
+    }
+    const build = imageConfig.build || {};
+    const imageType = imageConfig.imageType || (imageConfig.registryId || build.registryId ? 'enterprise' : 'personal');
+    if (imageType === 'enterprise') {
+        if (!imageConfig.registryId && !build.registryId) {
+            missing.push({ name: 'registryId', path: 'imageConfig.registryId', required: true, reason: '企业版镜像构建需要指定 TCR 实例 ID' });
+        }
+        if (!build.repository) {
+            missing.push({ name: 'repository', path: 'imageConfig.build.repository', required: true, reason: '企业版镜像构建需要目标仓库' });
+        }
+        return missing;
+    }
+    const namespace = build.namespace || context.envId;
+    if (!namespace) {
+        missing.push({ name: 'namespace', path: 'imageConfig.build.namespace', required: true, reason: '个人版镜像构建需要 namespace，且无法从 envId 推导' });
+    }
+    if (!((_b = build.registryCredential) === null || _b === void 0 ? void 0 : _b.username)) {
+        missing.push({ name: 'registryCredential.username', path: 'imageConfig.build.registryCredential.username', required: true, reason: '个人版 TCR 构建需要推送用户名' });
+    }
+    if (!((_c = build.registryCredential) === null || _c === void 0 ? void 0 : _c.password)) {
+        missing.push({ name: 'registryCredential.password', path: 'imageConfig.build.registryCredential.password', required: true, reason: '个人版 TCR 构建需要推送密码' });
+    }
+    return missing;
+}
+/**
+ * 生成最小化配置准备结果：先应用安全默认值，再返回剩余缺失字段和默认值路径。
+ */
+function prepareMinimalDeployConfig(config, context = {}) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3;
+    const prepared = applyMinimalDeployConfigDefaults(config, context);
+    const missing = getMissingDeployInputs(prepared, { envId: context.envId });
+    const original = lodash_1.default.cloneDeep(config);
+    const preparedAny = prepared;
+    const appliedDefaults = [];
+    const candidates = [
+        ['imageConfig.imageUri', (_a = original.imageConfig) === null || _a === void 0 ? void 0 : _a.imageUri, (_b = preparedAny.imageConfig) === null || _b === void 0 ? void 0 : _b.imageUri],
+        ['imageConfig.build.cwd', (_d = (_c = original.imageConfig) === null || _c === void 0 ? void 0 : _c.build) === null || _d === void 0 ? void 0 : _d.cwd, (_f = (_e = preparedAny.imageConfig) === null || _e === void 0 ? void 0 : _e.build) === null || _f === void 0 ? void 0 : _f.cwd],
+        ['imageConfig.build.dockerfile', (_h = (_g = original.imageConfig) === null || _g === void 0 ? void 0 : _g.build) === null || _h === void 0 ? void 0 : _h.dockerfile, (_k = (_j = preparedAny.imageConfig) === null || _j === void 0 ? void 0 : _j.build) === null || _k === void 0 ? void 0 : _k.dockerfile],
+        ['imageConfig.build.platform', (_m = (_l = original.imageConfig) === null || _l === void 0 ? void 0 : _l.build) === null || _m === void 0 ? void 0 : _m.platform, (_p = (_o = preparedAny.imageConfig) === null || _o === void 0 ? void 0 : _o.build) === null || _p === void 0 ? void 0 : _p.platform],
+        ['imageConfig.build.repository', (_r = (_q = original.imageConfig) === null || _q === void 0 ? void 0 : _q.build) === null || _r === void 0 ? void 0 : _r.repository, (_t = (_s = preparedAny.imageConfig) === null || _s === void 0 ? void 0 : _s.build) === null || _t === void 0 ? void 0 : _t.repository],
+        ['imageConfig.build.namespace', (_v = (_u = original.imageConfig) === null || _u === void 0 ? void 0 : _u.build) === null || _v === void 0 ? void 0 : _v.namespace, (_x = (_w = preparedAny.imageConfig) === null || _w === void 0 ? void 0 : _w.build) === null || _x === void 0 ? void 0 : _x.namespace],
+        ['imageConfig.registryId', (_y = original.imageConfig) === null || _y === void 0 ? void 0 : _y.registryId, (_z = preparedAny.imageConfig) === null || _z === void 0 ? void 0 : _z.registryId],
+        ['imageConfig.build.registryCredential', (_1 = (_0 = original.imageConfig) === null || _0 === void 0 ? void 0 : _0.build) === null || _1 === void 0 ? void 0 : _1.registryCredential, (_3 = (_2 = preparedAny.imageConfig) === null || _2 === void 0 ? void 0 : _2.build) === null || _3 === void 0 ? void 0 : _3.registryCredential]
+    ];
+    candidates.forEach(([fieldPath, before, after]) => {
+        if (before === undefined && after !== undefined) {
+            appliedDefaults.push(fieldPath);
+        }
+    });
+    return { config: prepared, missing, appliedDefaults };
+}
 /**
  * 规范化部署配置
  *
@@ -9998,7 +9721,7 @@ function inferHttpBuildStrategy(config) {
  * 以便 checkDeployConfig 汇总全部问题
  */
 function normalizeDeployConfig(config) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
     if (!config || typeof config !== 'object') {
         throw new error_1.CloudBaseError('部署配置必须是对象', {
             code: types_1.FUNCTION_DEPLOY_ERROR.CONFIG_INVALID
@@ -10026,20 +9749,20 @@ function normalizeDeployConfig(config) {
             // node_modules 必须随代码包上传，不能被 ignore 排除
             ignore: ignoreList.filter((item) => !/node_modules/.test(item)) });
     }
-    const normalizedImage = Object.assign(Object.assign({}, cloned), { type: 'HTTP', buildStrategy, runtime: types_1.CUSTOM_IMAGE_RUNTIME, imagePort: (_a = cloned.imagePort) !== null && _a !== void 0 ? _a : types_1.IMAGE_FUNCTION_PORT });
-    normalizedImage.imageType =
-        (_d = (_b = cloned.imageType) !== null && _b !== void 0 ? _b : (_c = cloned.imageConfig) === null || _c === void 0 ? void 0 : _c.imageType) !== null && _d !== void 0 ? _d : (((_g = (_e = cloned.registryId) !== null && _e !== void 0 ? _e : (_f = cloned.imageConfig) === null || _f === void 0 ? void 0 : _f.registryId) !== null && _g !== void 0 ? _g : (_h = cloned.build) === null || _h === void 0 ? void 0 : _h.registryId)
-            ? 'enterprise'
-            : 'personal');
+    const imageConfig = Object.assign({}, (cloned.imageConfig || {}));
+    const normalizedImage = Object.assign(Object.assign({}, cloned), { type: 'HTTP', buildStrategy, runtime: types_1.CUSTOM_IMAGE_RUNTIME, imageConfig });
+    imageConfig.imagePort = (_a = imageConfig.imagePort) !== null && _a !== void 0 ? _a : types_1.IMAGE_FUNCTION_PORT;
+    imageConfig.imageType =
+        (_b = imageConfig.imageType) !== null && _b !== void 0 ? _b : (((_c = imageConfig.registryId) !== null && _c !== void 0 ? _c : (_d = imageConfig.build) === null || _d === void 0 ? void 0 : _d.registryId) ? 'enterprise' : 'personal');
     // 镜像函数由容器启动命令决定入口，不使用 handler 与云端装依赖
     delete normalizedImage.handler;
     delete normalizedImage.installDependency;
     if (buildStrategy === 'cloud' || buildStrategy === 'local') {
-        normalizedImage.build = Object.assign(Object.assign({}, (cloned.build || {})), { dockerfile: (_k = (_j = cloned.build) === null || _j === void 0 ? void 0 : _j.dockerfile) !== null && _k !== void 0 ? _k : types_1.DEFAULT_DOCKERFILE, platform: (_m = (_l = cloned.build) === null || _l === void 0 ? void 0 : _l.platform) !== null && _m !== void 0 ? _m : types_1.DEFAULT_IMAGE_PLATFORM });
+        imageConfig.build = Object.assign(Object.assign({}, (imageConfig.build || {})), { dockerfile: (_f = (_e = imageConfig.build) === null || _e === void 0 ? void 0 : _e.dockerfile) !== null && _f !== void 0 ? _f : types_1.DEFAULT_DOCKERFILE, platform: (_h = (_g = imageConfig.build) === null || _g === void 0 ? void 0 : _g.platform) !== null && _h !== void 0 ? _h : types_1.DEFAULT_IMAGE_PLATFORM });
     }
     if (buildStrategy === 'local') {
         // 默认不静默改变构建环境
-        normalizedImage.localFallback = (_o = cloned.localFallback) !== null && _o !== void 0 ? _o : 'error';
+        imageConfig.localFallback = (_j = imageConfig.localFallback) !== null && _j !== void 0 ? _j : 'error';
     }
     return normalizedImage;
 }
@@ -10150,10 +9873,11 @@ function checkHttpCommon(raw, checks) {
 }
 /** 校验镜像函数公共约束 */
 function checkImageRuntimeCommon(raw, checks) {
+    var _a;
     if (raw.runtime !== undefined && !isCustomImageRuntime(raw.runtime)) {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_RUNTIME_INVALID, `镜像部署要求 runtime 为 ${types_1.CUSTOM_IMAGE_RUNTIME}`, `当前为 ${raw.runtime}，请移除 runtime 或设置为 ${types_1.CUSTOM_IMAGE_RUNTIME}`));
     }
-    if (raw.imagePort !== undefined && raw.imagePort !== types_1.IMAGE_FUNCTION_PORT) {
+    if (((_a = raw.imageConfig) === null || _a === void 0 ? void 0 : _a.imagePort) !== undefined && raw.imageConfig.imagePort !== types_1.IMAGE_FUNCTION_PORT) {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_PORT_INVALID, `镜像监听端口必须为 ${types_1.IMAGE_FUNCTION_PORT}`, `请让容器监听 ${types_1.IMAGE_FUNCTION_PORT} 端口`));
     }
     if (raw.handler !== undefined) {
@@ -10185,17 +9909,17 @@ function checkImageReference(imageConfig, checks) {
 }
 /**
  * 校验镜像类型与仓库 ID
- * image 策略从 imageConfig.registryId（兼容顶层 registryId）读取；
- * local/cloud 策略从 build.registryId 读取，imageType 仍位于镜像运行时公共配置顶层。
+ * 直接读取 cloudbaserc 嵌套形状：imageType 位于 imageConfig.imageType；
+ * registryId 位于 imageConfig.registryId（cloud/local 兼容 imageConfig.build.registryId）。
  */
 function checkImageIdentity(raw, checks) {
-    var _a, _b, _c, _d, _e;
+    var _a;
     const imageConfig = raw === null || raw === void 0 ? void 0 : raw.imageConfig;
-    const buildRegistryId = (_a = raw === null || raw === void 0 ? void 0 : raw.build) === null || _a === void 0 ? void 0 : _a.registryId;
+    const build = imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.build;
+    const buildRegistryId = build === null || build === void 0 ? void 0 : build.registryId;
     const buildStrategy = raw === null || raw === void 0 ? void 0 : raw.buildStrategy;
-    const registryId = (_c = (_b = raw === null || raw === void 0 ? void 0 : raw.registryId) !== null && _b !== void 0 ? _b : imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.registryId) !== null && _c !== void 0 ? _c : buildRegistryId;
-    const explicitImageType = (_d = raw === null || raw === void 0 ? void 0 : raw.imageType) !== null && _d !== void 0 ? _d : imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.imageType;
-    const imageType = resolveBuildImageType(raw, (_e = raw === null || raw === void 0 ? void 0 : raw.build) !== null && _e !== void 0 ? _e : {});
+    const registryId = (_a = imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.registryId) !== null && _a !== void 0 ? _a : buildRegistryId;
+    const imageType = resolveBuildImageType(raw, build !== null && build !== void 0 ? build : {});
     if (imageType !== 'enterprise' && imageType !== 'personal') {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID, buildStrategy === 'cloud' || buildStrategy === 'local'
             ? `${buildStrategy} 策略必须显式声明镜像类型`
@@ -10204,25 +9928,25 @@ function checkImageIdentity(raw, checks) {
     }
     if (imageType === 'enterprise') {
         if (buildStrategy === 'image' && (registryId === undefined || registryId === null)) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_MISSING, '企业版镜像未配置仓库实例 ID', '请配置 imageConfig.registryId 或顶层 registryId'));
+            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_MISSING, '企业版镜像未配置仓库实例 ID', '请配置 imageConfig.registryId'));
         }
         else if (registryId !== undefined && (typeof registryId !== 'string' || !registryId.trim())) {
             const registryField = buildStrategy === 'cloud' || buildStrategy === 'local'
-                ? 'build.registryId'
-                : 'registryId';
+                ? 'imageConfig.build.registryId'
+                : 'imageConfig.registryId';
             checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_INVALID, '企业版镜像仓库实例 ID 无效', `${registryField} 已声明但解析结果为空；若使用 {{env.*}}，请检查对应环境变量已赋值为实际企业版 TCR 实例 ID`));
         }
     }
     else if (registryId !== undefined) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID, '个人版镜像不能配置企业版仓库实例 ID', '请移除 build.registryId，或将 imageType 设置为 enterprise'));
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID, '个人版镜像不能配置企业版仓库实例 ID', '请移除 imageConfig.build.registryId，或将 imageConfig.imageType 设置为 enterprise'));
     }
 }
 /** 解析构建策略使用的镜像类型 */
 function resolveBuildImageType(raw, build) {
-    var _a, _b, _c, _d, _e, _f;
-    return (_c = (_a = raw.imageType) !== null && _a !== void 0 ? _a : (_b = raw.imageConfig) === null || _b === void 0 ? void 0 : _b.imageType) !== null && _c !== void 0 ? _c : (raw.buildStrategy === 'local' || raw.buildStrategy === 'cloud'
+    var _a, _b, _c, _d;
+    return (_b = (_a = raw.imageConfig) === null || _a === void 0 ? void 0 : _a.imageType) !== null && _b !== void 0 ? _b : (raw.buildStrategy === 'local' || raw.buildStrategy === 'cloud'
         ? 'enterprise'
-        : ((_f = (_d = raw.registryId) !== null && _d !== void 0 ? _d : (_e = raw.imageConfig) === null || _e === void 0 ? void 0 : _e.registryId) !== null && _f !== void 0 ? _f : build.registryId)
+        : ((_d = (_c = raw.imageConfig) === null || _c === void 0 ? void 0 : _c.registryId) !== null && _d !== void 0 ? _d : build.registryId)
             ? 'enterprise'
             : 'personal');
 }
@@ -10263,9 +9987,9 @@ function checkBuildSource(build, checks) {
 }
 /** 判断当前构建策略是否要求完整仓库地址 */
 function requiresFullBuildRepository(raw, imageType) {
-    var _a;
+    var _a, _b;
     return raw.buildStrategy === 'local' && imageType === 'personal' &&
-        ((_a = raw.build) === null || _a === void 0 ? void 0 : _a.repository) !== undefined;
+        ((_b = (_a = raw.imageConfig) === null || _a === void 0 ? void 0 : _a.build) === null || _b === void 0 ? void 0 : _b.repository) !== undefined;
 }
 /** 添加仓库地址缺失或不完整的错误 */
 function addFullRepositoryError(raw, checks, missing) {
@@ -10362,6 +10086,12 @@ function checkBuildRegistry(raw, build, checks) {
     const imageType = resolveBuildImageType(raw, build);
     const registryCredential = build.registryCredential;
     if (imageType === 'personal') {
+        if (build.namespace !== undefined &&
+            (typeof build.namespace !== 'string' ||
+                !build.namespace.trim() ||
+                !IMAGE_REPOSITORY_PATTERN.test(build.namespace.trim()))) {
+            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID, '个人版 TCR 命名空间未配置或不合法', 'build.namespace 必须为合法的个人版 TCR 命名空间；未声明时可由 envId 默认补齐'));
+        }
         checkPersonalRegistryCredential(registryCredential, checks);
         return;
     }
@@ -10371,9 +10101,10 @@ function checkBuildRegistry(raw, build, checks) {
 }
 /** 校验镜像构建目标配置 */
 function checkBuildTarget(raw, checks) {
-    const build = raw.build;
+    var _a, _b;
+    const build = (_a = raw.imageConfig) === null || _a === void 0 ? void 0 : _a.build;
     if (!lodash_1.default.isPlainObject(build)) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONFIG_MISSING, '缺少镜像构建配置', '请配置 build，至少包含构建上下文与 Dockerfile 信息'));
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONFIG_MISSING, '缺少镜像构建配置', '请配置 imageConfig.build，至少包含构建上下文与 Dockerfile 信息'));
         return;
     }
     checks.push(...checkBuildTag(raw, build));
@@ -10381,8 +10112,8 @@ function checkBuildTarget(raw, checks) {
     checkBuildRepository(raw, build, checks);
     checkBuildArgs(raw, build, checks);
     checkBuildRegistry(raw, build, checks);
-    if (raw.imageConfig !== undefined) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_CONFIG_NOT_ALLOWED, `buildStrategy 为 ${raw.buildStrategy} 时不能指定 imageConfig`, '镜像地址将由构建结果决定，如需直接部署已有镜像请使用 buildStrategy: image'));
+    if (((_b = raw.imageConfig) === null || _b === void 0 ? void 0 : _b.imageUri) !== undefined) {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_CONFIG_NOT_ALLOWED, `buildStrategy 为 ${raw.buildStrategy} 时不能指定 imageConfig.imageUri`, '镜像地址将由构建结果决定，如需直接部署已有镜像请使用 buildStrategy: image'));
     }
 }
 /**
@@ -10390,6 +10121,7 @@ function checkBuildTarget(raw, checks) {
  * @returns 检查报告，包含全部问题而非仅第一个
  */
 function checkDeployConfig(config) {
+    var _a;
     const checks = [];
     if (!config || typeof config !== 'object') {
         return {
@@ -10439,16 +10171,16 @@ function checkDeployConfig(config) {
                 }
                 else {
                     checkImageReference(raw.imageConfig, checks);
-                    // imageType 在顶层，registryId 允许顶层或 imageConfig，统一传 raw
+                    // imageType 与 registryId 位于 imageConfig，统一传 raw 由 checkImageIdentity 读取
                     checkImageIdentity(raw, checks);
-                    // 注：imagePort 定义在顶层，已由 checkImageRuntimeCommon 校验，此处不重复
+                    // 注：imagePort 位于 imageConfig，已由 checkImageRuntimeCommon 校验，此处不重复
                 }
             }
             else {
                 checkImageIdentity(raw, checks);
                 checkBuildTarget(raw, checks);
                 if (strategy === 'local') {
-                    const fallback = raw.localFallback;
+                    const fallback = (_a = raw.imageConfig) === null || _a === void 0 ? void 0 : _a.localFallback;
                     if (fallback !== undefined && fallback !== 'cloud' && fallback !== 'error') {
                         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.LOCAL_FALLBACK_INVALID, 'localFallback 取值不合法', "只能是 'cloud' 或 'error'"));
                     }
@@ -10491,7 +10223,7 @@ function assertDeployConfig(config) {
 
 /***/ },
 
-/***/ 30710
+/***/ 48947
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -10499,7 +10231,7 @@ function assertDeployConfig(config) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.runDockerPreflight = runDockerPreflight;
 const child_process_1 = __webpack_require__(79646);
-const types_1 = __webpack_require__(22724);
+const types_1 = __webpack_require__(79345);
 /**
  * Docker 本地能力 Preflight（local 策略，scope: local）
  *
@@ -10586,7 +10318,7 @@ async function runDockerPreflight(runner = defaultRunner) {
 
 /***/ },
 
-/***/ 26719
+/***/ 84638
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -10595,9 +10327,9 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.prepareEnterpriseTcrTarget = prepareEnterpriseTcrTarget;
 exports.createEnterpriseTcrCredential = createEnterpriseTcrCredential;
 exports.createTcrApiService = createTcrApiService;
-const error_1 = __webpack_require__(18143);
-const types_1 = __webpack_require__(22724);
-const config_guard_1 = __webpack_require__(69238);
+const error_1 = __webpack_require__(54884);
+const types_1 = __webpack_require__(79345);
+const config_guard_1 = __webpack_require__(74931);
 const TCR_API_VERSION = '2019-09-24';
 const NAMESPACE_PATTERN = /^[a-z0-9](?:[a-z0-9]|[._-](?![._-])){0,28}[a-z0-9]$/;
 function responseOf(result) {
@@ -10734,22 +10466,23 @@ async function ensureNamespace(service, registryId, namespace) {
 }
 async function prepareEnterpriseTcrTarget(config, options) {
     var _a;
-    const configuredRegistryId = (_a = config.registryId) !== null && _a !== void 0 ? _a : config.build.registryId;
+    const build = config.imageConfig.build;
+    const configuredRegistryId = (_a = config.imageConfig.registryId) !== null && _a !== void 0 ? _a : build.registryId;
     const explicitRegistryId = typeof configuredRegistryId === 'string' && configuredRegistryId.trim()
         ? configuredRegistryId.trim()
         : undefined;
     const resolvedRegistry = await resolveRegistry(options.service, options.region, explicitRegistryId);
-    const repositoryTarget = parseRepositoryTarget(config.build.repository || config.name);
-    const namespace = (config.build.namespace || repositoryTarget.namespace || options.envId).trim();
+    const repositoryTarget = parseRepositoryTarget(build.repository || config.name);
+    const namespace = (build.namespace || repositoryTarget.namespace || options.envId).trim();
     assertNamespace(namespace);
-    if (config.build.namespace && repositoryTarget.namespace && config.build.namespace !== repositoryTarget.namespace) {
-        throwTcrError('build.namespace 与 build.repository 中的命名空间不一致。', types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID);
+    if (build.namespace && repositoryTarget.namespace && build.namespace !== repositoryTarget.namespace) {
+        throwTcrError('imageConfig.build.namespace 与 imageConfig.build.repository 中的命名空间不一致。', types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID);
     }
     await ensureNamespace(options.service, resolvedRegistry.registryId, namespace);
     const registry = repositoryTarget.registry || resolvedRegistry.registry;
     const repository = repositoryTarget.repository || config.name;
     const imageRepository = `${registry}/${namespace}/${repository}`;
-    const preparedConfig = Object.assign(Object.assign({}, config), { imageType: 'enterprise', registryId: resolvedRegistry.registryId, build: Object.assign(Object.assign({}, config.build), { registryId: resolvedRegistry.registryId, namespace, repository: imageRepository }) });
+    const preparedConfig = Object.assign(Object.assign({}, config), { imageConfig: Object.assign(Object.assign({}, config.imageConfig), { imageType: 'enterprise', registryId: resolvedRegistry.registryId, build: Object.assign(Object.assign({}, build), { registryId: resolvedRegistry.registryId, namespace, repository: imageRepository }) }) });
     return {
         config: preparedConfig,
         target: {
@@ -10788,7 +10521,7 @@ function createTcrApiService(environment) {
 
 /***/ },
 
-/***/ 56749
+/***/ 67650
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -10796,8 +10529,8 @@ function createTcrApiService(environment) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.runImageRemotePreflight = runImageRemotePreflight;
 const child_process_1 = __webpack_require__(79646);
-const config_guard_1 = __webpack_require__(69238);
-const types_1 = __webpack_require__(22724);
+const config_guard_1 = __webpack_require__(74931);
+const types_1 = __webpack_require__(79345);
 /**
  * 镜像远端校验 Preflight（有 IO，scope: cloud）
  *
@@ -10960,7 +10693,7 @@ async function runImageRemotePreflight(config, deployRegion, deps = defaultDeps)
 
 /***/ },
 
-/***/ 32378
+/***/ 94285
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -10999,7 +10732,7 @@ async function resolveImageTag(options) {
 
 /***/ },
 
-/***/ 49515
+/***/ 52948
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -11017,9 +10750,9 @@ const child_process_1 = __webpack_require__(79646);
 const fs_1 = __importDefault(__webpack_require__(29021));
 const os_1 = __importDefault(__webpack_require__(21820));
 const path_1 = __importDefault(__webpack_require__(33873));
-const error_1 = __webpack_require__(18143);
-const types_1 = __webpack_require__(22724);
-const image_tag_1 = __webpack_require__(32378);
+const error_1 = __webpack_require__(54884);
+const types_1 = __webpack_require__(79345);
+const image_tag_1 = __webpack_require__(94285);
 /**
  * 本地镜像构建与推送（local 策略，个人版先行版）
  *
@@ -11066,18 +10799,19 @@ const defaultDeps = {
 };
 /** 解析构建上下文目录（绝对路径） */
 function resolveContext(config) {
-    const cwd = config.build.cwd || config.functionPath || process.cwd();
+    const cwd = config.imageConfig.build.cwd || config.functionPath || process.cwd();
     return path_1.default.resolve(cwd);
 }
 /** 解析目标镜像完整引用 imageUri（repository 需为含域名与命名空间的完整仓库地址，个人版/企业版通用） */
 async function resolveImageUri(config, context) {
-    const repository = config.build.repository;
+    const build = config.imageConfig.build;
+    const repository = build.repository;
     if (typeof repository !== 'string' || !repository.trim()) {
-        throw new error_1.CloudBaseError('local 策略缺少目标镜像仓库地址 build.repository', {
+        throw new error_1.CloudBaseError('local 策略缺少目标镜像仓库地址 imageConfig.build.repository', {
             code: types_1.FUNCTION_DEPLOY_ERROR.LOCAL_BUILD_REPOSITORY_MISSING
         });
     }
-    const tag = await (0, image_tag_1.resolveImageTag)({ explicitTag: config.build.tag, cwd: context });
+    const tag = await (0, image_tag_1.resolveImageTag)({ explicitTag: build.tag, cwd: context });
     return `${repository.trim()}:${tag}`;
 }
 /** 从 buildx imagetools inspect 输出解析 digest */
@@ -11111,7 +10845,7 @@ async function buildLocalImage(config, onLog, options = {}) {
             code: types_1.FUNCTION_DEPLOY_ERROR.LOCAL_BUILD_CONTEXT_MISSING
         });
     }
-    const dockerfile = config.build.dockerfile || types_1.DEFAULT_DOCKERFILE;
+    const dockerfile = config.imageConfig.build.dockerfile || types_1.DEFAULT_DOCKERFILE;
     const dockerfilePath = path_1.default.resolve(context, dockerfile);
     if (!deps.existsSync(dockerfilePath) || !deps.isFile(dockerfilePath)) {
         throw new error_1.CloudBaseError(`Dockerfile 不存在：${dockerfilePath}`, {
@@ -11119,7 +10853,7 @@ async function buildLocalImage(config, onLog, options = {}) {
         });
     }
     const imageUri = await resolveImageUri(config, context);
-    const platform = config.build.platform || types_1.DEFAULT_IMAGE_PLATFORM;
+    const platform = config.imageConfig.build.platform || types_1.DEFAULT_IMAGE_PLATFORM;
     const args = [
         'buildx',
         'build',
@@ -11131,10 +10865,10 @@ async function buildLocalImage(config, onLog, options = {}) {
         imageUri,
         '--load'
     ];
-    if (config.build.forceBuild) {
+    if (config.imageConfig.build.forceBuild) {
         args.push('--no-cache');
     }
-    const buildArgs = config.build.buildArgs || {};
+    const buildArgs = config.imageConfig.build.buildArgs || {};
     for (const key of Object.keys(buildArgs)) {
         args.push('--build-arg', `${key}=${buildArgs[key]}`);
     }
@@ -11249,7 +10983,7 @@ function createTemporaryDockerConfig() {
  */
 async function buildAndPushImage(config, onLog, deps = defaultDeps) {
     const startedAt = Date.now();
-    const credential = config.build.registryCredential;
+    const credential = config.imageConfig.build.registryCredential;
     const dockerConfig = credential ? createTemporaryDockerConfig() : undefined;
     const commandOptions = dockerConfig ? { env: dockerConfig.env } : undefined;
     try {
@@ -11281,7 +11015,7 @@ async function buildAndPushImage(config, onLog, deps = defaultDeps) {
 
 /***/ },
 
-/***/ 5380
+/***/ 28541
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -11289,7 +11023,7 @@ async function buildAndPushImage(config, onLog, deps = defaultDeps) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.PersonalTcrService = exports.DEFAULT_PERSONAL_TCR_REGISTRY = void 0;
 exports.createPersonalTcrService = createPersonalTcrService;
-const config_guard_1 = __webpack_require__(69238);
+const config_guard_1 = __webpack_require__(74931);
 const PERSONAL_TCR_VERSION = '2019-09-24';
 exports.DEFAULT_PERSONAL_TCR_REGISTRY = 'ccr.ccs.tencentyun.com';
 const DEFAULT_RETAINED_TAGS = 30;
@@ -11442,7 +11176,7 @@ function createPersonalTcrService(environment) {
 
 /***/ },
 
-/***/ 28750
+/***/ 72325
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -11450,8 +11184,8 @@ function createPersonalTcrService(environment) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.toCurrentState = toCurrentState;
 exports.createDeployPlan = createDeployPlan;
-const constant_1 = __webpack_require__(3017);
-const config_guard_1 = __webpack_require__(69238);
+const constant_1 = __webpack_require__(41976);
+const config_guard_1 = __webpack_require__(74931);
 /**
  * 部署计划生成
  *
@@ -11728,7 +11462,7 @@ function createDeployPlan(config, current) {
 
 /***/ },
 
-/***/ 61081
+/***/ 69230
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -11740,8 +11474,8 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.runLocalPreflight = runLocalPreflight;
 const fs_1 = __importDefault(__webpack_require__(29021));
 const path_1 = __importDefault(__webpack_require__(33873));
-const packer_1 = __webpack_require__(62446);
-const types_1 = __webpack_require__(22724);
+const packer_1 = __webpack_require__(36245);
+const types_1 = __webpack_require__(79345);
 /**
  * 部署前环境检查（Preflight）
  *
@@ -11805,7 +11539,8 @@ function safeStat(target) {
 }
 /** 检查 cloud 构建上下文与 Dockerfile，确保任何云端操作前即可失败 */
 function checkCloudBuildSource(config, checks) {
-    const cwd = path_1.default.resolve(config.build.cwd || config.functionPath || process.cwd());
+    const build = config.imageConfig.build;
+    const cwd = path_1.default.resolve(build.cwd || config.functionPath || process.cwd());
     const contextStat = safeStat(cwd);
     if (contextStat === null) {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONTEXT_INVALID, '云端镜像构建上下文目录不存在', {
@@ -11821,7 +11556,7 @@ function checkCloudBuildSource(config, checks) {
         }));
         return;
     }
-    const dockerfile = config.build.dockerfile || types_1.DEFAULT_DOCKERFILE;
+    const dockerfile = build.dockerfile || types_1.DEFAULT_DOCKERFILE;
     const dockerfilePath = path_1.default.resolve(cwd, dockerfile);
     const dockerfileStat = safeStat(dockerfilePath);
     if (dockerfileStat === null || !dockerfileStat.isFile()) {
@@ -12065,7 +11800,7 @@ function runLocalPreflight(config) {
 
 /***/ },
 
-/***/ 22724
+/***/ 79345
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -12191,14 +11926,14 @@ exports.FUNCTION_DEPLOY_ERROR = {
 
 /***/ },
 
-/***/ 13265
+/***/ 54640
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.DocsService = void 0;
-const http_request_1 = __webpack_require__(7355);
+const http_request_1 = __webpack_require__(2922);
 const DOCS_BASE_URL = 'https://docs.cloudbase.net';
 const CATEGORY_URL = `${DOCS_BASE_URL}/category.json`;
 const ALGOLIA_SEARCH_URL = 'https://70wjvl90pg-dsn.algolia.net/1/indexes/*/queries' +
@@ -12487,7 +12222,7 @@ exports.DocsService = DocsService;
 
 /***/ },
 
-/***/ 51865
+/***/ 20382
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -12505,12 +12240,12 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.EnvService = void 0;
 const cos_nodejs_sdk_v5_1 = __importDefault(__webpack_require__(531));
 const util_1 = __importDefault(__webpack_require__(28354));
-const http_request_1 = __webpack_require__(7355);
+const http_request_1 = __webpack_require__(2922);
 const signature_nodejs_1 = __webpack_require__(38567);
-const error_1 = __webpack_require__(18143);
-const utils_1 = __webpack_require__(24263);
-const constant_1 = __webpack_require__(3017);
-const billing_1 = __webpack_require__(54913);
+const error_1 = __webpack_require__(54884);
+const utils_1 = __webpack_require__(88208);
+const constant_1 = __webpack_require__(41976);
+const billing_1 = __webpack_require__(44210);
 const uuid_1 = __webpack_require__(79893);
 class EnvService {
     constructor(environment) {
@@ -13473,37 +13208,37 @@ __decorate([
 
 /***/ },
 
-/***/ 27296
+/***/ 53463
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.Environment = void 0;
-const database_1 = __webpack_require__(71863);
-const function_1 = __webpack_require__(56318);
-const FunctionDeployer_1 = __webpack_require__(21773);
-const cloudrun_1 = __webpack_require__(8044);
-const agent_1 = __webpack_require__(33215);
-const storage_1 = __webpack_require__(29903);
-const env_1 = __webpack_require__(51865);
-const common_1 = __webpack_require__(10443);
-const log_1 = __webpack_require__(18916);
-const error_1 = __webpack_require__(18143);
-const constant_1 = __webpack_require__(3017);
-const utils_1 = __webpack_require__(24263);
-const hosting_1 = __webpack_require__(6064);
-const third_1 = __webpack_require__(1155);
-const access_1 = __webpack_require__(38680);
-const user_1 = __webpack_require__(68569);
-const cloudBaseRun_1 = __webpack_require__(27851);
-const mysql_1 = __webpack_require__(22772);
-const cloudApp_1 = __webpack_require__(97538);
-const permission_1 = __webpack_require__(81881);
-const sandbox_1 = __webpack_require__(64593);
-const aiModel_1 = __webpack_require__(9537);
-const monitor_1 = __webpack_require__(56088);
-const integration_1 = __webpack_require__(5480);
+const database_1 = __webpack_require__(44206);
+const function_1 = __webpack_require__(99699);
+const FunctionDeployer_1 = __webpack_require__(93210);
+const cloudrun_1 = __webpack_require__(17569);
+const agent_1 = __webpack_require__(94540);
+const storage_1 = __webpack_require__(61132);
+const env_1 = __webpack_require__(20382);
+const common_1 = __webpack_require__(73906);
+const log_1 = __webpack_require__(73795);
+const error_1 = __webpack_require__(54884);
+const constant_1 = __webpack_require__(41976);
+const utils_1 = __webpack_require__(88208);
+const hosting_1 = __webpack_require__(11763);
+const third_1 = __webpack_require__(23800);
+const access_1 = __webpack_require__(58405);
+const user_1 = __webpack_require__(41180);
+const cloudBaseRun_1 = __webpack_require__(56242);
+const mysql_1 = __webpack_require__(47779);
+const cloudApp_1 = __webpack_require__(42403);
+const permission_1 = __webpack_require__(59512);
+const sandbox_1 = __webpack_require__(53854);
+const aiModel_1 = __webpack_require__(1058);
+const monitor_1 = __webpack_require__(3219);
+const integration_1 = __webpack_require__(80547);
 class Environment {
     constructor(context, envId) {
         this.inited = false;
@@ -13667,15 +13402,15 @@ exports.Environment = Environment;
 
 /***/ },
 
-/***/ 70101
+/***/ 41596
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.EnvironmentManager = void 0;
-const environment_1 = __webpack_require__(27296);
-const constant_1 = __webpack_require__(3017);
+const environment_1 = __webpack_require__(53463);
+const constant_1 = __webpack_require__(41976);
 class EnvironmentManager {
     constructor(context) {
         this.envs = {};
@@ -13719,7 +13454,7 @@ exports.EnvironmentManager = EnvironmentManager;
 
 /***/ },
 
-/***/ 18143
+/***/ 54884
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -13743,7 +13478,7 @@ exports.CloudBaseError = CloudBaseError;
 
 /***/ },
 
-/***/ 56318
+/***/ 99699
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -13763,10 +13498,10 @@ const fs_1 = __importDefault(__webpack_require__(29021));
 const path_1 = __importDefault(__webpack_require__(33873));
 const lodash_1 = __importDefault(__webpack_require__(35558));
 const cos_nodejs_sdk_v5_1 = __importDefault(__webpack_require__(531));
-const packer_1 = __webpack_require__(62446);
-const error_1 = __webpack_require__(18143);
-const utils_1 = __webpack_require__(24263);
-const constant_1 = __webpack_require__(3017);
+const packer_1 = __webpack_require__(36245);
+const error_1 = __webpack_require__(54884);
+const utils_1 = __webpack_require__(88208);
+const constant_1 = __webpack_require__(41976);
 /**
  * 解析环境变量为布尔值
  * 视 'true'/'1'/'yes'/'on'（大小写不敏感）为 true，
@@ -15708,7 +15443,7 @@ __decorate([
 
 /***/ },
 
-/***/ 62446
+/***/ 36245
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -15756,8 +15491,8 @@ const del_1 = __importDefault(__webpack_require__(56931));
 const path_1 = __importDefault(__webpack_require__(33873));
 const make_dir_1 = __importDefault(__webpack_require__(82823));
 const util_1 = __importDefault(__webpack_require__(28354));
-const utils_1 = __webpack_require__(24263);
-const error_1 = __webpack_require__(18143);
+const utils_1 = __webpack_require__(88208);
+const error_1 = __webpack_require__(54884);
 const os = __importStar(__webpack_require__(21820));
 // 10 MB
 exports.BIG_FILE_SIZE = 10485760;
@@ -15880,7 +15615,7 @@ exports.FunctionPacker = FunctionPacker;
 
 /***/ },
 
-/***/ 6064
+/***/ 11763
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -15899,9 +15634,9 @@ exports.HostingService = void 0;
 const fs_1 = __importDefault(__webpack_require__(29021));
 const path_1 = __importDefault(__webpack_require__(33873));
 const make_dir_1 = __importDefault(__webpack_require__(82823));
-const error_1 = __webpack_require__(18143);
-const utils_1 = __webpack_require__(24263);
-const parallel_1 = __webpack_require__(31504);
+const error_1 = __webpack_require__(54884);
+const utils_1 = __webpack_require__(88208);
+const parallel_1 = __webpack_require__(86693);
 const envDomainCache = new Map();
 const HostingStatusMap = {
     init: '初始化中',
@@ -16400,16 +16135,16 @@ __decorate([
 
 /***/ },
 
-/***/ 20277
+/***/ 87798
 (module, __unused_webpack_exports, __webpack_require__) {
 
 "use strict";
 
-const context_1 = __webpack_require__(91522);
-const environmentManager_1 = __webpack_require__(70101);
-const docs_1 = __webpack_require__(13265);
-const projectValidator_1 = __webpack_require__(64047);
-const DeployOrchestrator_1 = __webpack_require__(83962);
+const context_1 = __webpack_require__(81073);
+const environmentManager_1 = __webpack_require__(41596);
+const docs_1 = __webpack_require__(54640);
+const projectValidator_1 = __webpack_require__(69622);
+const DeployOrchestrator_1 = __webpack_require__(28385);
 class CloudBase {
     /**
      * init 初始化 为单例
@@ -16599,7 +16334,7 @@ module.exports = CloudBase;
 
 /***/ },
 
-/***/ 36541
+/***/ 5798
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -16615,7 +16350,7 @@ exports.USER_KEY_BUSINESS = 'integration';
 
 /***/ },
 
-/***/ 86823
+/***/ 90346
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -16725,7 +16460,7 @@ exports.AESCrypto = new AESCryptoImpl();
 
 /***/ },
 
-/***/ 5480
+/***/ 80547
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -16752,12 +16487,12 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.IntegrationService = void 0;
-const error_1 = __webpack_require__(18143);
-const utils_1 = __webpack_require__(24263);
-const constants_1 = __webpack_require__(36541);
-const crypto_1 = __webpack_require__(86823);
-const secretKey_1 = __webpack_require__(32503);
-__exportStar(__webpack_require__(89869), exports);
+const error_1 = __webpack_require__(54884);
+const utils_1 = __webpack_require__(88208);
+const constants_1 = __webpack_require__(5798);
+const crypto_1 = __webpack_require__(90346);
+const secretKey_1 = __webpack_require__(98584);
+__exportStar(__webpack_require__(53890), exports);
 /**
  * 集成中心（UserKey）服务
  *
@@ -17086,7 +16821,7 @@ __decorate([
 
 /***/ },
 
-/***/ 32503
+/***/ 98584
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -17104,8 +16839,8 @@ exports.__clearAesKeyCache = __clearAesKeyCache;
  * - key 仅在进程内存使用，按 group 维度缓存；
  * - 绝不写入任何本地文件、绝不打印日志。
  */
-const http_request_1 = __webpack_require__(7355);
-const error_1 = __webpack_require__(18143);
+const http_request_1 = __webpack_require__(2922);
+const error_1 = __webpack_require__(54884);
 /** 七彩石配置 */
 const RAINBOW_CONFIG = {
     ENV_TYPE: 'Default',
@@ -17182,7 +16917,7 @@ function __clearAesKeyCache() {
 
 /***/ },
 
-/***/ 89869
+/***/ 53890
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -17208,7 +16943,7 @@ var UserKeyBindServiceType;
 
 /***/ },
 
-/***/ 18916
+/***/ 73795
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -17230,8 +16965,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.LogService = void 0;
 exports.isLogServiceEnabled = isLogServiceEnabled;
-const utils_1 = __webpack_require__(24263);
-__exportStar(__webpack_require__(54081), exports);
+const utils_1 = __webpack_require__(88208);
+__exportStar(__webpack_require__(8290), exports);
 /**
  * 纯函数：根据 DescribeEnvInfo 返回的 LogServices 列表判断日志服务是否已开通。
  * 已开通条件：至少一个条目有有效的 TopicId。
@@ -17317,7 +17052,7 @@ exports.LogService = LogService;
 
 /***/ },
 
-/***/ 54081
+/***/ 8290
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -17349,7 +17084,7 @@ exports.CLS_MODULE_SCHEMA = {
 
 /***/ },
 
-/***/ 56088
+/***/ 3219
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -17370,9 +17105,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.MonitorService = void 0;
-const error_1 = __webpack_require__(18143);
-const utils_1 = __webpack_require__(24263);
-__exportStar(__webpack_require__(35197), exports);
+const error_1 = __webpack_require__(54884);
+const utils_1 = __webpack_require__(88208);
+__exportStar(__webpack_require__(2290), exports);
 // Period 与时间范围的约束规则
 const ONE_DAY_MS = 24 * 60 * 60 * 1000;
 const THREE_DAYS_MS = 3 * ONE_DAY_MS;
@@ -17462,7 +17197,7 @@ exports.MonitorService = MonitorService;
 
 /***/ },
 
-/***/ 35197
+/***/ 2290
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -17472,7 +17207,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 
 /***/ },
 
-/***/ 22772
+/***/ 47779
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -17499,8 +17234,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.MysqlService = void 0;
-const utils_1 = __webpack_require__(24263);
-__exportStar(__webpack_require__(39434), exports);
+const utils_1 = __webpack_require__(88208);
+__exportStar(__webpack_require__(54113), exports);
 class MysqlService {
     constructor(environment) {
         this.environment = environment;
@@ -18031,7 +17766,7 @@ __decorate([
 
 /***/ },
 
-/***/ 28065
+/***/ 79702
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -18041,7 +17776,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 
 /***/ },
 
-/***/ 35642
+/***/ 51715
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -18051,7 +17786,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 
 /***/ },
 
-/***/ 18505
+/***/ 34452
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -18061,7 +17796,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 
 /***/ },
 
-/***/ 39434
+/***/ 54113
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -18081,14 +17816,14 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-__exportStar(__webpack_require__(18505), exports);
-__exportStar(__webpack_require__(28065), exports);
-__exportStar(__webpack_require__(35642), exports);
+__exportStar(__webpack_require__(34452), exports);
+__exportStar(__webpack_require__(79702), exports);
+__exportStar(__webpack_require__(51715), exports);
 
 
 /***/ },
 
-/***/ 81881
+/***/ 59512
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -18101,7 +17836,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.PermissionService = void 0;
-const utils_1 = __webpack_require__(24263);
+const utils_1 = __webpack_require__(88208);
 const PERMISSION_BY_RESOURCE = {
     function: ['CUSTOM'],
     storage: ['READONLY', 'PRIVATE', 'ADMINWRITE', 'ADMINONLY', 'CUSTOM'],
@@ -18518,7 +18253,7 @@ __decorate([
 
 /***/ },
 
-/***/ 64047
+/***/ 69622
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -18547,7 +18282,6 @@ const path_1 = __importDefault(__webpack_require__(33873));
 const toolbox_1 = __webpack_require__(23233);
 class ProjectValidator {
     async validate(options = {}) {
-        var _a;
         const cwd = path_1.default.resolve(options.cwd || process.cwd());
         const errors = [];
         const warnings = [];
@@ -18556,7 +18290,6 @@ class ProjectValidator {
             mode: options.mode,
             errors,
         });
-        const version = String(((_a = loaded.rawConfig) === null || _a === void 0 ? void 0 : _a.version) || '2.1');
         if (loaded.rawConfig) {
             this.validateSchema(loaded.rawConfig, errors);
         }
@@ -18571,7 +18304,6 @@ class ProjectValidator {
         const summary = this.getSummary(loaded.config);
         return {
             valid: errors.length === 0,
-            version,
             errors,
             warnings,
             summary,
@@ -18977,12 +18709,12 @@ class ProjectValidator {
     }
 }
 exports.ProjectValidator = ProjectValidator;
-__exportStar(__webpack_require__(20006), exports);
+__exportStar(__webpack_require__(40171), exports);
 
 
 /***/ },
 
-/***/ 20006
+/***/ 40171
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -18992,14 +18724,14 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 
 /***/ },
 
-/***/ 64593
+/***/ 53854
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.SandboxService = void 0;
-const utils_1 = __webpack_require__(24263);
+const utils_1 = __webpack_require__(88208);
 class SandboxService {
     constructor(environment) {
         this.environment = environment;
@@ -19562,7 +19294,7 @@ exports.SandboxService = SandboxService;
 
 /***/ },
 
-/***/ 94507
+/***/ 85914
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -19622,7 +19354,7 @@ function splitEntryUploadFiles(files, entryFiles) {
 
 /***/ },
 
-/***/ 29903
+/***/ 61132
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -19647,19 +19379,19 @@ const walkdir_1 = __importDefault(__webpack_require__(43204));
 const micromatch_1 = __importDefault(__webpack_require__(40821));
 const mime_types_1 = __importDefault(__webpack_require__(96662));
 const cos_nodejs_sdk_v5_1 = __importDefault(__webpack_require__(531));
-const utils_1 = __webpack_require__(24263);
-const error_1 = __webpack_require__(18143);
-const parallel_1 = __webpack_require__(31504);
-const runenv_1 = __webpack_require__(46767);
-const constant_1 = __webpack_require__(3017);
-const helper_1 = __webpack_require__(94507);
+const utils_1 = __webpack_require__(88208);
+const error_1 = __webpack_require__(54884);
+const parallel_1 = __webpack_require__(86693);
+const runenv_1 = __webpack_require__(94774);
+const constant_1 = __webpack_require__(41976);
+const helper_1 = __webpack_require__(85914);
 const BIG_FILE_SIZE = 5242880; // 5MB 1024*1024*5
 // ===== hosting deploy consistency 相关能力 =====
 /** 默认 MD5 计算并发数 */
 const DEFAULT_MD5_PARALLEL = 20;
 /** 一致性发布备份前缀（用于 diff.removed 排除备份文件） */
 const CONSISTENT_DEPLOY_BACKUP_PREFIX = '.cloudbase-backup/';
-var helper_2 = __webpack_require__(94507);
+var helper_2 = __webpack_require__(85914);
 Object.defineProperty(exports, "md5File", ({ enumerable: true, get: function () { return helper_2.md5File; } }));
 class StorageService {
     constructor(environment) {
@@ -23157,14 +22889,14 @@ __decorate([
 
 /***/ },
 
-/***/ 1155
+/***/ 23800
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.ThirdService = void 0;
-const utils_1 = __webpack_require__(24263);
+const utils_1 = __webpack_require__(88208);
 class ThirdService {
     constructor(environment) {
         this.cloudService = new utils_1.CloudService(environment.cloudBaseContext, 'tcb', '2018-06-08');
@@ -23183,7 +22915,7 @@ exports.ThirdService = ThirdService;
 
 /***/ },
 
-/***/ 68569
+/***/ 41180
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -23196,7 +22928,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.UserService = void 0;
-const utils_1 = __webpack_require__(24263);
+const utils_1 = __webpack_require__(88208);
 class UserService {
     constructor(environment) {
         this.environment = environment;
@@ -23532,7 +23264,7 @@ __decorate([
 
 /***/ },
 
-/***/ 77357
+/***/ 764
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -23636,7 +23368,7 @@ function getAuth(options) {
 
 /***/ },
 
-/***/ 78263
+/***/ 29980
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -23649,10 +23381,10 @@ exports.CloudService = void 0;
 const crypto_1 = __importDefault(__webpack_require__(55511));
 const url_1 = __webpack_require__(79551);
 const query_string_1 = __importDefault(__webpack_require__(71547));
-const error_1 = __webpack_require__(18143);
-const http_request_1 = __webpack_require__(7355);
-const constant_1 = __webpack_require__(3017);
-const utils_1 = __webpack_require__(24263);
+const error_1 = __webpack_require__(54884);
+const http_request_1 = __webpack_require__(2922);
+const constant_1 = __webpack_require__(41976);
+const utils_1 = __webpack_require__(88208);
 function isObject(x) {
     return typeof x === 'object' && !Array.isArray(x) && x !== null;
 }
@@ -23885,15 +23617,15 @@ exports.CloudService = CloudService;
 
 /***/ },
 
-/***/ 46439
+/***/ 16860
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.cloudBaseRequest = cloudBaseRequest;
-const auth_1 = __webpack_require__(77357);
-const http_request_1 = __webpack_require__(7355);
+const auth_1 = __webpack_require__(764);
+const http_request_1 = __webpack_require__(2922);
 const SUPPORT_REGIONS = ['ap-shanghai', 'ap-guangzhou', 'ap-singapore'];
 async function cloudBaseRequest(options) {
     // const url = 'https://tcb-admin.tencentcloudapi.com/admin'
@@ -23961,7 +23693,7 @@ async function cloudBaseRequest(options) {
 
 /***/ },
 
-/***/ 16594
+/***/ 21889
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -23986,7 +23718,7 @@ function preLazy() {
 
 /***/ },
 
-/***/ 56812
+/***/ 62625
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -24001,7 +23733,7 @@ exports.isDirectory = isDirectory;
 exports.formateFileSize = formateFileSize;
 exports.delSync = delSync;
 const fs_1 = __importDefault(__webpack_require__(29021));
-const error_1 = __webpack_require__(18143);
+const error_1 = __webpack_require__(54884);
 const del_1 = __importDefault(__webpack_require__(56931));
 // 检查路径是否可以访问（读、写）
 function checkFullAccess(dest, throwError = false) {
@@ -24064,7 +23796,7 @@ function delSync(patterns) {
 
 /***/ },
 
-/***/ 7355
+/***/ 2922
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -24078,7 +23810,7 @@ exports.fetchStream = fetchStream;
 const url_1 = __webpack_require__(79551);
 const node_fetch_1 = __importDefault(__webpack_require__(30188));
 const https_proxy_agent_1 = __webpack_require__(11710);
-const error_1 = __webpack_require__(18143);
+const error_1 = __webpack_require__(54884);
 // 使用 fetch + 代理
 async function fetch(url, config = {}, proxy = null) {
     if (proxy || process.env.http_proxy) {
@@ -24119,7 +23851,7 @@ async function fetchStream(url, config = {}, proxy = null) {
 
 /***/ },
 
-/***/ 24263
+/***/ 88208
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -24162,15 +23894,15 @@ const lodash_1 = __importDefault(__webpack_require__(35558));
 const os_1 = __importDefault(__webpack_require__(21820));
 const path_1 = __importDefault(__webpack_require__(33873));
 const unzipper_1 = __importDefault(__webpack_require__(44233));
-const constant_1 = __webpack_require__(3017);
-const http_request_1 = __webpack_require__(7355);
-__exportStar(__webpack_require__(77357), exports);
-__exportStar(__webpack_require__(78263), exports);
-__exportStar(__webpack_require__(46439), exports);
-__exportStar(__webpack_require__(16594), exports);
-__exportStar(__webpack_require__(56812), exports);
-__exportStar(__webpack_require__(7355), exports);
-var uuid_1 = __webpack_require__(22684);
+const constant_1 = __webpack_require__(41976);
+const http_request_1 = __webpack_require__(2922);
+__exportStar(__webpack_require__(764), exports);
+__exportStar(__webpack_require__(29980), exports);
+__exportStar(__webpack_require__(16860), exports);
+__exportStar(__webpack_require__(21889), exports);
+__exportStar(__webpack_require__(62625), exports);
+__exportStar(__webpack_require__(2922), exports);
+var uuid_1 = __webpack_require__(10829);
 Object.defineProperty(exports, "guid6", ({ enumerable: true, get: function () { return uuid_1.guid6; } }));
 async function compressToZip(option) {
     const { dirPath, outputPath, ignore, pattern = '**/*', extraEntries } = option;
@@ -24498,7 +24230,7 @@ function successLog(msg) {
 
 /***/ },
 
-/***/ 31504
+/***/ 86693
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -24575,7 +24307,7 @@ exports.AsyncTaskParallelController = AsyncTaskParallelController;
 
 /***/ },
 
-/***/ 46767
+/***/ 94774
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -24590,7 +24322,7 @@ function checkIsInScf() {
 
 /***/ },
 
-/***/ 22684
+/***/ 10829
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -149842,7 +149574,7 @@ minimatch.Minimatch = Minimatch
 
 /***/ },
 
-/***/ 6378
+/***/ 51140
 (__unused_webpack_module, __unused_webpack_exports, __webpack_require__) {
 
 //! moment.js locale configuration
@@ -155167,8 +154899,8 @@ var map = {
 	"./mt.js": 95451,
 	"./my": 76160,
 	"./my.js": 76160,
-	"./nb": 6378,
-	"./nb.js": 6378,
+	"./nb": 51140,
+	"./nb.js": 51140,
 	"./ne": 10067,
 	"./ne.js": 10067,
 	"./nl": 73108,
@@ -199258,6 +198990,7 @@ exports.getAuthProgressState = getAuthProgressState;
 exports.resolveAuthOptions = resolveAuthOptions;
 exports.getAuthConfigValidationError = getAuthConfigValidationError;
 exports.buildAuthConfigSummary = buildAuthConfigSummary;
+exports.buildDeviceLoginOptions = buildDeviceLoginOptions;
 exports.setPendingAuthProgressState = setPendingAuthProgressState;
 exports.resolveAuthProgressState = resolveAuthProgressState;
 exports.rejectAuthProgressState = rejectAuthProgressState;
@@ -199476,9 +199209,10 @@ function getAuthConfigValidationError(options) {
     if (options.oauthCustom && !options.oauthEndpoint) {
         return "oauthCustom=true 时必须同时提供 oauthEndpoint。";
     }
-    if (options.oauthEndpoint && !options.oauthCustom) {
-        return "配置自定义 oauthEndpoint 时必须启用 oauthCustom=true。";
-    }
+    // oauthEndpoint + 显式 oauthCustom=false 放行：resolveAuthOptions 对"只配 endpoint
+    // 未配 custom"已默认 custom=true，走到这里的 endpoint+false 只可能是用户显式指定——
+    // 即标准 {code,result} 包装格式的自定义端点（如国际站 tcb-api.tencentcloud.com），
+    // 拦截会导致标准格式端点在工具层永远不可用。
     return null;
 }
 function buildAuthConfigSummary(options) {
@@ -199490,6 +199224,40 @@ function buildAuthConfigSummary(options) {
         uses_toolbox_defaults: options.usesToolboxDefaults,
     };
 }
+/**
+ * 构造 device flow 的 loginByWebAuth 基础参数（onDeviceCode 由调用方按需注入）。
+ *
+ * 所有 device 登录路径（ensureLogin 与 auth 工具 start_auth 的 device 分支）必须
+ * 共享本函数：TCB_SITE=intl 时的 getOAuthEndpoint 覆写与 getAuthUrl 授权页改写
+ * 只在 ensureLogin 生效，会导致工具层直连路径仍打国内站端点/授权页，国际站账号
+ * 无法完成授权（device-code 注册表国内外隔离，国内授权页对国际站账号无效）。
+ */
+function buildDeviceLoginOptions(resolvedAuthOptions, siteHints = {}) {
+    const resolvedSite = (0, site_map_js_1.resolveSite)(siteHints.region, siteHints.site ?? process.env.TCB_SITE);
+    const loginOptions = { flow: "device" };
+    if (resolvedAuthOptions.clientId) {
+        loginOptions.client_id = resolvedAuthOptions.clientId;
+    }
+    if (resolvedAuthOptions.oauthEndpoint) {
+        loginOptions.getOAuthEndpoint = () => resolvedAuthOptions.oauthEndpoint;
+    }
+    else if (resolvedSite === "intl") {
+        // 国际站 OAuth 后端独立部署（2026-09-01 实测 device/code+token 可用，注册表与国内站隔离）；
+        // 不覆写时 toolbox 默认打国内站端点，国际站账号无法完成授权
+        loginOptions.getOAuthEndpoint = () => site_map_js_1.SITE_REGION_MAP.intl.oauthEndpoint;
+    }
+    if (resolvedSite === "intl") {
+        // device 模式的 verification_uri 标准模式下由客户端拼接，指向国内站授权页；
+        // 与 web 模式同款 host 改写，把授权页切到国际站
+        loginOptions.getAuthUrl = (url) => url
+            .replace(`${site_map_js_1.SITE_REGION_MAP.domestic.authHost}/dev`, `${site_map_js_1.SITE_REGION_MAP.intl.authHost}/dev`)
+            .replace(site_map_js_1.SITE_REGION_MAP.domestic.authHost, site_map_js_1.SITE_REGION_MAP.intl.authHost);
+    }
+    if (resolvedAuthOptions.oauthCustom) {
+        loginOptions.custom = true;
+    }
+    return loginOptions;
+}
 function setPendingAuthProgressState(challenge, authMode = "device") {
     return updateAuthProgressState({
         status: "PENDING",
@@ -199729,27 +199497,11 @@ async function ensureLogin(options) {
                     };
         }
         else {
-            if (resolvedAuthOptions.clientId) {
-                loginOptions.client_id = resolvedAuthOptions.clientId;
-            }
-            if (resolvedAuthOptions.oauthEndpoint) {
-                loginOptions.getOAuthEndpoint = () => resolvedAuthOptions.oauthEndpoint;
-            }
-            else if (resolvedSite === "intl") {
-                // 国际站 OAuth 后端独立部署（2026-09-01 实测 device/code+token 可用，注册表与国内站隔离）；
-                // 不覆写时 toolbox 默认打国内站端点，国际站账号无法完成授权
-                loginOptions.getOAuthEndpoint = () => site_map_js_1.SITE_REGION_MAP.intl.oauthEndpoint;
-            }
-            if (resolvedSite === "intl") {
-                // device 模式的 verification_uri 标准模式下由客户端拼接，指向国内站授权页；
-                // 与 web 模式同款 host 改写，把授权页切到国际站
-                loginOptions.getAuthUrl = (url) => url
-                    .replace(`${site_map_js_1.SITE_REGION_MAP.domestic.authHost}/dev`, `${site_map_js_1.SITE_REGION_MAP.intl.authHost}/dev`)
-                    .replace(site_map_js_1.SITE_REGION_MAP.domestic.authHost, site_map_js_1.SITE_REGION_MAP.intl.authHost);
-            }
-            if (resolvedAuthOptions.oauthCustom) {
-                loginOptions.custom = true;
-            }
+            // device 模式：与 auth 工具 start_auth device 分支共享 intl 端点覆写与授权页改写
+            Object.assign(loginOptions, buildDeviceLoginOptions(resolvedAuthOptions, {
+                region: options?.region,
+                site: options?.site,
+            }));
             if (options?.onDeviceCode) {
                 loginOptions.onDeviceCode = (info) => {
                     setPendingAuthProgressState(info, mode);
@@ -199839,7 +199591,7 @@ exports.getCloudBaseManager = getCloudBaseManager;
 exports.createCloudBaseManagerWithOptions = createCloudBaseManagerWithOptions;
 exports.extractRequestId = extractRequestId;
 exports.logCloudBaseResult = logCloudBaseResult;
-const manager_node_1 = __importDefault(__webpack_require__(20277));
+const manager_node_1 = __importDefault(__webpack_require__(87798));
 const auth_js_1 = __webpack_require__(561);
 const logger_js_1 = __webpack_require__(40781);
 const tool_result_js_1 = __webpack_require__(69645);
@@ -201353,7 +201105,7 @@ async function getInteractiveServerAsync() {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.telemetryReporter = exports.reportToolkitLifecycle = exports.reportToolCall = exports.warn = exports.info = exports.error = exports.StdioServerTransport = void 0;
+exports.normalizeClientName = exports.telemetryReporter = exports.reportToolkitLifecycle = exports.reportToolCall = exports.warn = exports.info = exports.error = exports.StdioServerTransport = void 0;
 exports.createCloudBaseMcpServer = createCloudBaseMcpServer;
 exports.getDefaultServer = getDefaultServer;
 const mcp_js_1 = __webpack_require__(55375);
@@ -201371,6 +201123,7 @@ const storage_js_1 = __webpack_require__(23138);
 const types_js_1 = __webpack_require__(79546);
 const capi_js_1 = __webpack_require__(88900);
 const cloudrun_js_1 = __webpack_require__(5658);
+const deploy_js_1 = __webpack_require__(23668);
 const dataModel_js_1 = __webpack_require__(42722);
 const gateway_js_1 = __webpack_require__(79921);
 const agents_js_1 = __webpack_require__(48409);
@@ -201384,6 +201137,7 @@ const logger_js_1 = __webpack_require__(40781);
 const site_map_js_1 = __webpack_require__(34533);
 const tool_result_js_1 = __webpack_require__(69645);
 const tool_wrapper_js_1 = __webpack_require__(93389);
+const telemetry_js_1 = __webpack_require__(5198);
 // 默认插件列表
 const DEFAULT_PLUGINS = [
     "env",
@@ -201397,6 +201151,7 @@ const DEFAULT_PLUGINS = [
     "setup",
     "rag",
     "cloudrun",
+    "deploy",
     "gateway",
     "app-auth",
     "apps",
@@ -201450,6 +201205,7 @@ const AVAILABLE_PLUGINS = {
     agents: { name: "agents", register: agents_js_1.registerAgentTools },
     apps: { name: "apps", register: apps_js_1.registerAppTools },
     cloudrun: { name: "cloudrun", register: cloudrun_js_1.registerCloudRunTools },
+    deploy: { name: "deploy", register: deploy_js_1.registerDeployTools },
     capi: { name: "capi", register: capi_js_1.registerCapiTools },
     "msg-push": { name: "msg-push", register: msg_push_js_1.registerMsgPushTools },
 };
@@ -201527,7 +201283,7 @@ function parseEnabledPlugins(pluginsEnabled, pluginsDisabled) {
  * await server.connect(transport);
  */
 async function createCloudBaseMcpServer(options) {
-    const { name = "cloudbase-mcp", version = "1.0.0", enableTelemetry = true, cloudBaseOptions, authOptions, cloudMode = false, ide, logger, pluginsEnabled, pluginsDisabled, pluginOptions, } = options ?? {};
+    const { name = "cloudbase-mcp", version = "1.0.0", enableTelemetry = true, cloudBaseOptions, authOptions, cloudMode = false, ide, client, logger, pluginsEnabled, pluginsDisabled, pluginOptions, } = options ?? {};
     // Enable cloud mode if specified
     if (cloudMode) {
         (0, cloud_mode_js_1.enableCloudMode)();
@@ -201590,6 +201346,11 @@ async function createCloudBaseMcpServer(options) {
     if (ide) {
         server.ide = ide;
     }
+    // Store client in server instance for telemetry (normalized, invalid values dropped)
+    const normalizedClient = (0, telemetry_js_1.normalizeClientName)(client);
+    if (normalizedClient) {
+        server.client = normalizedClient;
+    }
     // Store logger in server instance for tools to access
     if (logger) {
         server.logger = logger;
@@ -201624,10 +201385,11 @@ var logger_js_2 = __webpack_require__(40781);
 Object.defineProperty(exports, "error", ({ enumerable: true, get: function () { return logger_js_2.error; } }));
 Object.defineProperty(exports, "info", ({ enumerable: true, get: function () { return logger_js_2.info; } }));
 Object.defineProperty(exports, "warn", ({ enumerable: true, get: function () { return logger_js_2.warn; } }));
-var telemetry_js_1 = __webpack_require__(5198);
-Object.defineProperty(exports, "reportToolCall", ({ enumerable: true, get: function () { return telemetry_js_1.reportToolCall; } }));
-Object.defineProperty(exports, "reportToolkitLifecycle", ({ enumerable: true, get: function () { return telemetry_js_1.reportToolkitLifecycle; } }));
-Object.defineProperty(exports, "telemetryReporter", ({ enumerable: true, get: function () { return telemetry_js_1.telemetryReporter; } }));
+var telemetry_js_2 = __webpack_require__(5198);
+Object.defineProperty(exports, "reportToolCall", ({ enumerable: true, get: function () { return telemetry_js_2.reportToolCall; } }));
+Object.defineProperty(exports, "reportToolkitLifecycle", ({ enumerable: true, get: function () { return telemetry_js_2.reportToolkitLifecycle; } }));
+Object.defineProperty(exports, "telemetryReporter", ({ enumerable: true, get: function () { return telemetry_js_2.telemetryReporter; } }));
+Object.defineProperty(exports, "normalizeClientName", ({ enumerable: true, get: function () { return telemetry_js_2.normalizeClientName; } }));
 
 
 /***/ },
@@ -203187,7 +202949,7 @@ function registerAppTools(server) {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.CAM_AUTH_ERROR_PATTERN = void 0;
+exports.CAM_AUTH_ERROR_PATTERN = exports.ALLOWED_SERVICES = void 0;
 exports.assertTcbCloudRunActionAllowed = assertTcbCloudRunActionAllowed;
 exports.resolveCloudApiRegionAndParams = resolveCloudApiRegionAndParams;
 exports.removeEmptyStringParams = removeEmptyStringParams;
@@ -203201,7 +202963,7 @@ const tcb_action_index_js_1 = __webpack_require__(72550);
 const CATEGORY = "cloud-api";
 const CLOUDBASE_CONTROL_PLANE_DOC_URL = "https://cloud.tencent.com/document/product/876/34809";
 const CLOUDBASE_DEPENDENCY_API_DOC_URL = "https://cloud.tencent.com/document/product/876/34808";
-const ALLOWED_SERVICES = [
+exports.ALLOWED_SERVICES = [
     "tcb",
     "tcbr",
     "scf",
@@ -203210,6 +202972,8 @@ const ALLOWED_SERVICES = [
     "lowcode",
     "cdn",
     "vpc",
+    "monitor",
+    "postgres",
 ];
 /**
  * Legacy tcb small-tenant CloudRun (CloudBase Run) API family — blocked.
@@ -203331,6 +203095,9 @@ function buildCapiDocGuidance(service) {
     if (service === "tcb" || service === "tcbr" || service === "lowcode" || service === "scf") {
         return `优先查阅 CloudBase API 概览 ${CLOUDBASE_CONTROL_PLANE_DOC_URL} 与云开发依赖资源接口指引 ${CLOUDBASE_DEPENDENCY_API_DOC_URL}。`;
     }
+    if (service === "monitor") {
+        return `请优先核对云监控（腾讯云可观测平台）官方 API 文档：API 概览 https://cloud.tencent.com/document/product/649/30343 ，单 Action 详细文档在 https://cloud.tencent.com/document/api/248/ 产品线下。`;
+    }
     return `请优先核对对应官方云 API 文档；若你的场景其实是通过 HTTP 协议直接集成 auth/functions/cloudrun/storage/mysqldb 等 CloudBase 业务 API，请优先使用 OpenAPI / Swagger 或 searchKnowledgeBase(mode="openapi")，不要继续猜测管控面 Action。`;
 }
 /** Match CAM / authorization failures from Tencent Cloud control-plane APIs. */
@@ -203436,7 +203203,7 @@ function registerCapiTools(server) {
     const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions, requireEnvId: false });
     server.registerTool?.("callCloudApi", {
         title: "调用云API",
-        description: `通用的云 API 调用工具，主要用于 CloudBase / 腾讯云管控面与依赖资源相关 API 调用。调用前请先确认 service、Action 与 Param，避免猜测 Action 名称。如果你的目标是通过 HTTP 协议直接集成 auth/functions/cloudrun/storage/mysqldb 等 CloudBase 业务 API，请不要优先使用 callCloudApi，而应优先查看对应 OpenAPI / Swagger。现有 OpenAPI / Swagger 能力不是通用的管控面 Action 集合；管控面 API 请优先参考 CloudBase API 概览 ${CLOUDBASE_CONTROL_PLANE_DOC_URL} 与云开发依赖资源接口指引 ${CLOUDBASE_DEPENDENCY_API_DOC_URL}。对于 tcb service，常用 Action 分类如下：
+        description: `通用的云 API 调用工具，主要用于 CloudBase / 腾讯云管控面与依赖资源相关 API 调用。**调用前必读接口索引** https://docs.cloudbase.net/ai/cloudbase-ai-toolkit/api-reference.md （每日自动同步的 Action 级索引，含 rate limit；先查此索引确认 service/Action/参数，避免猜测 Action 名称；索引未覆盖的产品再去该产品官方 API 文档核对）。如果你的目标是通过 HTTP 协议直接集成 auth/functions/cloudrun/storage/mysqldb 等 CloudBase 业务 API，请不要优先使用 callCloudApi，而应优先查看对应 OpenAPI / Swagger。现有 OpenAPI / Swagger 能力不是通用的管控面 Action 集合；管控面 API 请优先参考 CloudBase API 概览 ${CLOUDBASE_CONTROL_PLANE_DOC_URL} 与云开发依赖资源接口指引 ${CLOUDBASE_DEPENDENCY_API_DOC_URL}。对于 tcb service，常用 Action 分类如下：
 
 **环境管理**: \`CreateEnv\`、\`ModifyEnv\`、\`DescribeEnvs\`、\`DestroyEnv\`
 **用户管理**: \`CreateUser\`、\`ModifyUser\`、\`DescribeUserList\`、\`DeleteUsers\`
@@ -203451,8 +203218,8 @@ function registerCapiTools(server) {
 销毁环境时，常见做法是至少带上 \`EnvId\` 和 \`BypassCheck: true\`，如果环境已经处于隔离期再按文档补 \`IsForce: true\`。`,
         inputSchema: {
             service: zod_1.z
-                .enum(ALLOWED_SERVICES)
-                .describe("选择要访问的服务。可选：tcb、tcbr、scf、sts、cam、lowcode、cdn、vpc。对于 tcb / scf / lowcode 等 CloudBase 管控面 Action，请优先查官方文档，不要直接猜测 Action。云托管统一走 tcbr（version 需传 2022-02-17）。"),
+                .enum(exports.ALLOWED_SERVICES)
+                .describe("选择要访问的服务。可选：tcb、tcbr、scf、sts、cam、lowcode、cdn、vpc、monitor（云监控/告警，version 需传 2018-07-24）、postgres（云数据库 PostgreSQL，version 需传 2017-03-12）。对于 tcb / scf / lowcode 等 CloudBase 管控面 Action，请优先查官方文档，不要直接猜测 Action。云托管统一走 tcbr（version 需传 2022-02-17）。"),
             action: zod_1.z
                 .string()
                 .min(1)
@@ -203460,7 +203227,7 @@ function registerCapiTools(server) {
             version: zod_1.z
                 .string()
                 .optional()
-                .describe("API 版本（可选）。缺省时按 service 使用 SDK 内置默认版本；tcbr 必须传 \"2022-02-17\"（否则请求缺少 X-TC-Version 会失败）。示例：service=\"tcbr\", version=\"2022-02-17\", action=\"CreateCloudRunEnv\", params={EnvId:\"env-xxx\",PackageType:\"Standard\"}。"),
+                .describe("API 版本（可选）。缺省时按 service 使用 SDK 内置默认版本；tcbr 必须传 \"2022-02-17\"（否则请求缺少 X-TC-Version 会失败），monitor 必须传 \"2018-07-24\"、postgres 必须传 \"2017-03-12\"（这两个 service 无内置默认版本，不传会失败）。示例：service=\"tcbr\", version=\"2022-02-17\", action=\"CreateCloudRunEnv\", params={EnvId:\"env-xxx\",PackageType:\"Standard\"}。"),
             params: zod_1.z
                 .record(zod_1.z.any())
                 .optional()
@@ -203478,8 +203245,8 @@ function registerCapiTools(server) {
             category: CATEGORY,
         },
     }, async ({ service, action, params, version, region, }) => {
-        if (!ALLOWED_SERVICES.includes(service)) {
-            throw new Error(`Service ${service} is not allowed. Allowed services: ${ALLOWED_SERVICES.join(", ")}`);
+        if (!exports.ALLOWED_SERVICES.includes(service)) {
+            throw new Error(`Service ${service} is not allowed. Allowed services: ${exports.ALLOWED_SERVICES.join(", ")}`);
         }
         assertTcbCloudRunActionAllowed(service, action);
         const { region: resolvedRegion, params: bodyParams } = resolveCloudApiRegionAndParams({ region, params });
@@ -208221,6 +207988,7 @@ const path = __importStar(__webpack_require__(33873));
 const zod_1 = __webpack_require__(21504);
 const cloudbase_manager_js_1 = __webpack_require__(33109);
 const tool_result_js_1 = __webpack_require__(69645);
+const sql_risk_js_1 = __webpack_require__(29885);
 const CATEGORY = "PostgreSQL database";
 const QUERY_PG_DATABASE = "queryPgDatabase";
 const MANAGE_PG_DATABASE = "managePgDatabase";
@@ -208380,33 +208148,9 @@ function normalizeLimit(limit, fallback = 20, max = 200) {
     }
     return Math.max(1, Math.min(max, Math.floor(limit)));
 }
-function stripLeadingSqlComments(sql) {
-    let normalized = sql.trim();
-    while (normalized.length > 0) {
-        if (normalized.startsWith("--")) {
-            normalized = normalized.replace(/^--.*(?:\r?\n|$)/, "").trimStart();
-            continue;
-        }
-        if (normalized.startsWith("#")) {
-            normalized = normalized.replace(/^#.*(?:\r?\n|$)/, "").trimStart();
-            continue;
-        }
-        if (normalized.startsWith("/*")) {
-            normalized = normalized.replace(/^\/\*[\s\S]*?\*\//, "").trimStart();
-            continue;
-        }
-        break;
-    }
-    return normalized;
-}
-function getSqlVerb(sql) {
-    const normalized = stripLeadingSqlComments(sql);
-    const match = normalized.match(/^([a-zA-Z]+)/);
-    return match ? match[1].toUpperCase() : "";
-}
 function isReadOnlySql(sql) {
-    const normalized = stripLeadingSqlComments(sql);
-    const verb = getSqlVerb(normalized);
+    const normalized = (0, sql_risk_js_1.stripLeadingSqlComments)(sql);
+    const verb = (0, sql_risk_js_1.getSqlVerb)(normalized);
     const readOnlyVerbs = new Set([
         "SELECT",
         "SHOW",
@@ -208420,27 +208164,16 @@ function isReadOnlySql(sql) {
     return !/\b(INSERT|UPDATE|DELETE|CREATE|ALTER|DROP|TRUNCATE|REPLACE|RENAME|GRANT|REVOKE|COMMENT|VACUUM|ANALYZE|FOR\s+UPDATE|FOR\s+SHARE)\b/i.test(normalized);
 }
 function buildLimitedReadOnlySql(sql, limit) {
-    const normalized = stripLeadingSqlComments(sql).replace(/;\s*$/, "");
-    const verb = getSqlVerb(normalized);
+    const normalized = (0, sql_risk_js_1.stripLeadingSqlComments)(sql).replace(/;\s*$/, "");
+    const verb = (0, sql_risk_js_1.getSqlVerb)(normalized);
     if (!["SELECT", "WITH", "VALUES"].includes(verb)) {
         return sql;
     }
     return `SELECT * FROM (${normalized}) AS cloudbase_mcp_readonly_limit LIMIT ${limit}`;
 }
-function isDestructiveSql(sql) {
-    const normalized = stripLeadingSqlComments(sql);
-    const verb = getSqlVerb(normalized);
-    if (["DROP", "TRUNCATE", "DELETE"].includes(verb)) {
-        return true;
-    }
-    if (verb === "ALTER") {
-        return /\b(DROP|RENAME)\b/i.test(normalized);
-    }
-    return false;
-}
 function classifySqlRisk(sql) {
-    const normalized = stripLeadingSqlComments(sql);
-    const verb = getSqlVerb(normalized);
+    const normalized = (0, sql_risk_js_1.stripLeadingSqlComments)(sql);
+    const verb = (0, sql_risk_js_1.getSqlVerb)(normalized);
     if (!verb) {
         return {
             risk: "unknown_risk",
@@ -208455,7 +208188,7 @@ function classifySqlRisk(sql) {
             requiresConfirm: false,
         };
     }
-    if (isDestructiveSql(normalized)) {
+    if ((0, sql_risk_js_1.isDestructiveSql)(normalized)) {
         return {
             risk: "destructive",
             readOnly: false,
@@ -208501,7 +208234,7 @@ function isSchemaDdlRisk(risk, sql) {
     if (risk !== "destructive") {
         return false;
     }
-    const verb = getSqlVerb(stripLeadingSqlComments(sql));
+    const verb = (0, sql_risk_js_1.getSqlVerb)((0, sql_risk_js_1.stripLeadingSqlComments)(sql));
     return ["DROP", "TRUNCATE", "ALTER"].includes(verb);
 }
 /**
@@ -209054,7 +208787,7 @@ function buildSchemaTable(schema, name) {
     return `${schema}.${name}`;
 }
 function parseTargetTableFromSql(sql, defaultSchema) {
-    const normalized = stripLeadingSqlComments(sql);
+    const normalized = (0, sql_risk_js_1.stripLeadingSqlComments)(sql);
     const identifier = String.raw `((?:[A-Za-z_][A-Za-z0-9_$]*\.)?[A-Za-z_][A-Za-z0-9_$]*)`;
     const patterns = [
         new RegExp(String.raw `\bcreate\s+(?:temporary\s+|temp\s+|unlogged\s+)?table\s+(?:if\s+not\s+exists\s+)?${identifier}`, "i"),
@@ -209461,7 +209194,7 @@ function renderParameterizedSql(sql, values) {
     });
 }
 function inferCommand(sql) {
-    return getSqlVerb(sql) || undefined;
+    return (0, sql_risk_js_1.getSqlVerb)(sql) || undefined;
 }
 function createManagerPgClient(context, cloudBaseOptions) {
     return {
@@ -209737,7 +209470,7 @@ async function handleExecuteSql(args, context, deps) {
         success: true,
         data: {
             classification,
-            command: result.command ?? getSqlVerb(args.sql),
+            command: result.command ?? (0, sql_risk_js_1.getSqlVerb)(args.sql),
             rowCount: result.rowCount ?? null,
             previewRows: result.rows
                 .slice(0, 5)
@@ -211833,6 +211566,475 @@ function registerSQLDatabaseTools(server) {
 }
 
 
+/***/ },
+
+/***/ 23668
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.DEPLOY_ERROR_CODES = void 0;
+exports.registerDeployTools = registerDeployTools;
+const toolbox_1 = __webpack_require__(23233);
+const node_fs_1 = __importDefault(__webpack_require__(89971));
+const node_path_1 = __importDefault(__webpack_require__(26743));
+const zod_1 = __webpack_require__(21504);
+const cloudbase_manager_js_1 = __webpack_require__(33109);
+const json_content_js_1 = __webpack_require__(18027);
+const sql_risk_js_1 = __webpack_require__(29885);
+// 声明式部署可编排的资源类型，与 DeployOrchestrator 的部署顺序一致：
+// database → functions → app → hosting → gateway
+const RESOURCE_TYPES = ["database", "functions", "app", "hosting", "gateway"];
+/**
+ * 声明式部署工具的稳定错误码。供 agent 程序化分支处理，不随文案调整而变化。
+ * - CONFIG_NOT_FOUND：cwd 下未找到 cloudbaserc 配置文件
+ * - CONFIG_INVALID：配置未通过 cloudbaserc schema 校验
+ * - ENV_UNRESOLVED：无法确定目标环境 ID（配置/入参/登录态均缺失）
+ * - INVALID_CONCURRENCY：并发数入参非法
+ * - CONFIRM_REQUIRED：写操作未显式传 confirm=true
+ * - DESTRUCTIVE_CONFIRM_REQUIRED：待执行的数据库迁移含破坏性语句，需额外传 confirmDestructive=true
+ * - DEPLOY_FAILED：编排器执行失败或其它未分类错误（可能透传引擎 errorCode）
+ */
+exports.DEPLOY_ERROR_CODES = {
+    CONFIG_NOT_FOUND: "CONFIG_NOT_FOUND",
+    CONFIG_INVALID: "CONFIG_INVALID",
+    ENV_UNRESOLVED: "ENV_UNRESOLVED",
+    INVALID_CONCURRENCY: "INVALID_CONCURRENCY",
+    CONFIRM_REQUIRED: "CONFIRM_REQUIRED",
+    DESTRUCTIVE_CONFIRM_REQUIRED: "DESTRUCTIVE_CONFIRM_REQUIRED",
+    DEPLOY_FAILED: "DEPLOY_FAILED",
+};
+/**
+ * 携带稳定错误码的部署错误。抛出后由 buildErrorEnvelope 归一为信封的 errorCode 字段。
+ */
+class DeployError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "DeployError";
+        this.code = code;
+    }
+}
+function buildEnvelope(data, message) {
+    return { success: true, data, message };
+}
+function buildErrorEnvelope(error) {
+    // DeployError 带显式错误码；引擎/SDK 抛出的错误若带 code 也透传；其余归为 DEPLOY_FAILED。
+    let errorCode = exports.DEPLOY_ERROR_CODES.DEPLOY_FAILED;
+    if (error instanceof DeployError) {
+        errorCode = error.code;
+    }
+    else if (error &&
+        typeof error === "object" &&
+        "code" in error &&
+        typeof error.code === "string" &&
+        error.code.length > 0) {
+        errorCode = error.code;
+    }
+    return {
+        success: false,
+        data: {},
+        message: error instanceof Error ? error.message : String(error),
+        errorCode,
+    };
+}
+/**
+ * 解析 cloudbaserc 声明式部署配置。
+ *
+ * 分两步完成：
+ * 1. 定位并读取配置文件：searchConfig 从 cwd 探测 cloudbaserc.*（json/yaml/yml/js），
+ *    loadConfig 读取原始内容。读取阶段不强制 envId，
+ *    envId 由调用方按优先级单独确定，以支持用登录态环境部署未写死 envId 的配置。
+ * 2. ConfigParser.parseRawConfig：按 mode 合并 envOverrides、下发 functionDefaultConfig
+ *    到各函数、加载 .env / .env.local / .env.<mode> 并渲染 {{env.*}} / {{tcb.*}} 模板变量。
+ */
+async function resolveDeployConfig(options) {
+    const found = await (0, toolbox_1.searchConfig)(options.cwd);
+    if (!found?.filepath) {
+        throw new DeployError(exports.DEPLOY_ERROR_CODES.CONFIG_NOT_FOUND, `未在 ${options.cwd} 找到 cloudbaserc 配置文件（支持 json/yaml/yml/js）`);
+    }
+    const rawConfig = await (0, toolbox_1.loadConfig)({ configPath: found.filepath });
+    return toolbox_1.ConfigParser.parseRawConfig(rawConfig ?? {}, options.cwd, {
+        mode: options.mode,
+    });
+}
+/**
+ * 确定部署使用的环境 ID。
+ *
+ * 优先级：显式传入的 envId > 解析后配置中的 envId > MCP 登录态 / 绑定环境。
+ * 显式入参优先于配置文件，配置未写死 envId 时回退到当前会话绑定的环境。
+ * 三者都无则抛出错误。
+ */
+async function resolveDeployEnvId(options) {
+    if (options.envId && options.envId.length > 0) {
+        return options.envId;
+    }
+    const configEnvId = options.config.envId;
+    if (typeof configEnvId === "string" && configEnvId.length > 0) {
+        return configEnvId;
+    }
+    const resolved = await (0, cloudbase_manager_js_1.getEnvId)(options.cloudBaseOptions);
+    if (!resolved) {
+        throw new DeployError(exports.DEPLOY_ERROR_CODES.ENV_UNRESOLVED, "未能确定部署环境 ID：请在 cloudbaserc 配置 envId、通过 envId 参数指定，或先登录并绑定环境。");
+    }
+    return resolved;
+}
+/**
+ * 按 cloudbaserc schema 校验解析后的配置。
+ *
+ * 校验不通过时抛出错误，错误消息包含各字段的具体校验失败原因，供调用方定位问题。
+ */
+function assertConfigValid(config) {
+    const result = (0, toolbox_1.validateCloudBaseConfigBySchema)(config);
+    if (result.valid) {
+        return;
+    }
+    const detail = result.errors
+        .map((item) => `${item.dataPath || "<root>"} ${item.message}`)
+        .join("; ");
+    throw new DeployError(exports.DEPLOY_ERROR_CODES.CONFIG_INVALID, `cloudbaserc 配置校验未通过：${detail}`);
+}
+/**
+ * 校验并发数取值，非法时抛出错误。
+ *
+ * 未指定时返回 undefined（由编排器使用默认串行）；指定时必须为不小于 1 的整数。
+ */
+function normalizeConcurrency(concurrency) {
+    if (concurrency === undefined) {
+        return undefined;
+    }
+    if (!Number.isInteger(concurrency) || concurrency < 1) {
+        throw new DeployError(exports.DEPLOY_ERROR_CODES.INVALID_CONCURRENCY, `无效的并发数 ${concurrency}，应为不小于 1 的整数`);
+    }
+    return concurrency;
+}
+/**
+ * 让 deployPlan 的预演结论与 deployApply 的实际执行语义对齐。
+ *
+ * 背景：编排器把「云端已存在的函数」标为 status='update'，但 deployApply 在 yes!==true
+ * 且无交互确认回调时，会对 functions+update 保守跳过（reason='no-confirm'）。
+ * 若 plan 原样返回 update，agent 预演看到「会更新」，实际执行却「跳过」——结论相反。
+ *
+ * 此函数按传入的 yes 复算 functions+update 的「有效动作」：
+ * - yes===true：维持 update（执行时确实会覆盖）
+ * - 否则：改标为 skip，并保留原始判定到 declaredStatus，action 说明为何跳过。
+ * 其它资源类型与状态原样透传（database/app/hosting/gateway 的分类不受 yes 影响）。
+ */
+function reconcilePlanWithExecution(plan, yes) {
+    if (!Array.isArray(plan)) {
+        return [];
+    }
+    return plan.map((item) => {
+        if (!item || typeof item !== "object") {
+            return item;
+        }
+        if (item.type === "functions" && item.status === "update" && !yes) {
+            return {
+                ...item,
+                status: "skip",
+                declaredStatus: "update",
+                action: `已存在函数 ${item.name}：未传 yes=true，执行时将保守跳过（不覆盖）。传 yes=true 才会覆盖更新。`,
+            };
+        }
+        return item;
+    });
+}
+/**
+ * 解析 migrations 目录（与引擎 DatabaseDeployer.resolveMigrationsDir 同规则）：
+ * 未配置默认 ./cloudbase/migrations；仅允许相对路径（禁止绝对路径 / 开头）。
+ * 非法时返回 undefined（交由引擎在真正执行时抛出一致的错误，这里不抢报错）。
+ */
+function resolveMigrationsDir(cwd, migrations) {
+    const raw = typeof migrations === "string" && migrations ? migrations : "./cloudbase/migrations";
+    if (node_path_1.default.isAbsolute(raw) || raw.startsWith("/")) {
+        return undefined;
+    }
+    return node_path_1.default.resolve(cwd, raw);
+}
+/**
+ * 从 dry-run plan 中提取「待执行（pending）的数据库迁移标识」。
+ *
+ * 编排器把 database 计划聚合为单条 create 项，pending 迁移写在
+ * changes[].to（field==='migration'），形如 "{version}_{name}"。
+ * 只关注 pending：已 applied 的迁移不会被重复执行，不应触发破坏性确认门。
+ */
+function extractPendingMigrations(plan) {
+    const result = [];
+    for (const item of plan) {
+        if (!item || item.type !== "database" || item.status !== "create") {
+            continue;
+        }
+        const changes = item.changes;
+        if (!Array.isArray(changes)) {
+            continue;
+        }
+        for (const change of changes) {
+            if (change?.field === "migration" && typeof change.to === "string" && change.to) {
+                result.push(change.to);
+            }
+        }
+    }
+    return result;
+}
+/**
+ * 检测「本次将要执行的数据库迁移」中是否含破坏性语句（DROP/TRUNCATE/DELETE、
+ * ALTER ... DROP/RENAME）。
+ *
+ * 仅扫描 pending 迁移对应的本地 .sql 文件；已 applied 的不扫描，避免误拦。
+ * 读文件失败（缺文件/目录非法）视为无法确认破坏性，返回空——真正的存在性/
+ * 格式校验交由引擎执行时处理，这里只在能确证破坏性时加门，避免与引擎报错重复。
+ */
+function detectDestructiveMigrations(options) {
+    const pending = extractPendingMigrations(options.plan);
+    if (pending.length === 0) {
+        return [];
+    }
+    const dbConfig = options.databaseConfig && typeof options.databaseConfig === "object"
+        ? options.databaseConfig
+        : undefined;
+    const migrationsDir = resolveMigrationsDir(options.cwd, dbConfig?.migrations);
+    if (!migrationsDir) {
+        return [];
+    }
+    const hits = [];
+    for (const migration of pending) {
+        const file = node_path_1.default.join(migrationsDir, `${migration}.sql`);
+        let sqlText;
+        try {
+            sqlText = node_fs_1.default.readFileSync(file, "utf-8");
+        }
+        catch {
+            // 文件读不到：不在此处报错，交给引擎执行时给出一致错误
+            continue;
+        }
+        const statements = (0, sql_risk_js_1.findDestructiveStatements)(sqlText);
+        if (statements.length > 0) {
+            hits.push({ migration, file, statements });
+        }
+    }
+    return hits;
+}
+function registerDeployTools(server) {
+    const cloudBaseOptions = server.cloudBaseOptions;
+    const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
+    // 工具一：deployPlan —— 只读，预演部署计划（dry-run）
+    server.registerTool?.("deployPlan", {
+        title: "预演 CloudBase 声明式部署计划",
+        description: "解析 cloudbaserc 并计算声明式部署计划（dry-run，不产生任何变更）。" +
+            "这是 deployApply 的预演对仗工具：plan 计算、deployApply 执行同一份 cloudbaserc。" +
+            "返回每个资源的动作分类：create=新建，update=覆盖更新，skip=无变更/不会执行，" +
+            "conflict=检测到冲突需中断，deploy=直传覆盖。" +
+            "计划已按 yes 复算为「实际会发生的动作」：不传 yes=true 时，云端已存在的函数会标为 skip" +
+            "（并在 declaredStatus 保留 update），与 deployApply 的实际执行结果一致，避免预演与执行相反。" +
+            "\n适用边界：本工具用于项目级声明式编排（一份 cloudbaserc 统一 plan/apply）；" +
+            "单资源临时直传请用 manageFunctions/manageHosting/manageApps。" +
+            "\n- cwd：项目根目录，默认当前工作目录" +
+            "\n- mode：环境名，命中 envOverrides.<mode> 时合并对应的多环境覆盖配置" +
+            "\n- envId：目标环境 ID，优先级高于 cloudbaserc 中的 envId；不传则用配置值或当前绑定环境" +
+            "\n- only：仅计算指定资源类型的计划" +
+            "\n- skip：跳过指定资源类型" +
+            "\n- yes：与 deployApply 的 yes 对齐，用于复算已存在函数的有效动作。" +
+            "true=预演为覆盖更新(update)；false（默认）=预演为保守跳过(skip)",
+        inputSchema: {
+            cwd: zod_1.z
+                .string()
+                .optional()
+                .describe("项目根目录，从此目录向下搜索 cloudbaserc；默认当前工作目录"),
+            mode: zod_1.z
+                .string()
+                .optional()
+                .describe("环境名（如 production/staging），命中 envOverrides.<mode> 时合并覆盖"),
+            envId: zod_1.z
+                .string()
+                .optional()
+                .describe("目标环境 ID，优先级高于 cloudbaserc 中的 envId；不传则用配置值或当前绑定环境"),
+            only: zod_1.z
+                .array(zod_1.z.enum(RESOURCE_TYPES))
+                .optional()
+                .describe("仅计算指定资源类型的计划，可选值：database/functions/app/hosting/gateway"),
+            skip: zod_1.z
+                .array(zod_1.z.enum(RESOURCE_TYPES))
+                .optional()
+                .describe("跳过指定资源类型，可选值：database/functions/app/hosting/gateway"),
+            yes: zod_1.z
+                .boolean()
+                .optional()
+                .describe("与 deployApply 的 yes 对齐，用于复算已存在函数的有效动作。" +
+                "true=预演为覆盖更新；false（默认）=预演为保守跳过"),
+        },
+        annotations: {
+            readOnlyHint: true,
+            openWorldHint: true,
+            category: "deploy",
+        },
+    }, async ({ cwd, mode, envId: envIdInput, only, skip, yes, }) => {
+        try {
+            const projectRoot = cwd ?? process.cwd();
+            const config = await resolveDeployConfig({ cwd: projectRoot, mode });
+            assertConfigValid(config);
+            const envId = await resolveDeployEnvId({
+                envId: envIdInput,
+                config,
+                cloudBaseOptions,
+            });
+            const manager = await getManager();
+            const rawPlan = await manager.getDeployOrchestrator().deployPlan({
+                config,
+                envId,
+                cwd: projectRoot,
+                only,
+                skip,
+                dryRun: true,
+            });
+            // 按 yes 复算为「实际会发生的动作」，使预演与 deployApply 的执行结果一致
+            const plan = reconcilePlanWithExecution(rawPlan, yes === true);
+            return (0, json_content_js_1.jsonContent)(buildEnvelope({ cwd: projectRoot, mode: mode ?? null, envId, yes: yes === true, plan }, "已生成声明式部署计划"));
+        }
+        catch (error) {
+            return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(error));
+        }
+    });
+    // 工具二：deployApply —— 写操作，执行声明式部署（本地形态的 apply，与 deployPlan 对仗）
+    server.registerTool?.("deployApply", {
+        title: "执行 CloudBase 声明式部署（本地 apply）",
+        description: "解析 cloudbaserc 并按 database→functions→app→hosting→gateway 顺序执行声明式部署。" +
+            "这是 deployPlan 的执行对仗工具（plan 预演 / deployApply 执行同一份 cloudbaserc），" +
+            "属于本地形态的 apply（读本地 cloudbaserc 并在本地构建上传），" +
+            "是会变更云端资源的写操作，必须显式传 confirm=true 才会执行。" +
+            "建议先用 deployPlan 预演，确认计划无误后再执行。" +
+            "\n适用边界：本工具用于项目级声明式编排（一份 cloudbaserc 统一 plan/apply）；" +
+            "单资源临时直传请用 manageFunctions/manageHosting/manageApps。" +
+            "\n- confirm：必须显式传 true 才执行部署，否则直接拒绝" +
+            "\n- confirmDestructive：当本次待执行的数据库迁移含破坏性语句（DROP/TRUNCATE/DELETE、" +
+            "ALTER…DROP/RENAME）时，除 confirm 外还必须显式传 confirmDestructive=true 才会执行；" +
+            "否则拒绝并列出命中的迁移与语句。无破坏性迁移时该参数不生效" +
+            "\n- cwd：项目根目录，默认当前工作目录" +
+            "\n- mode：环境名，命中 envOverrides.<mode> 时合并对应的多环境覆盖配置" +
+            "\n- envId：目标环境 ID，优先级高于 cloudbaserc 中的 envId；不传则用配置值或当前绑定环境" +
+            "\n- only：仅部署指定资源类型" +
+            "\n- skip：跳过指定资源类型" +
+            "\n- yes：遇到已存在资源时的处理方式。true=直接覆盖更新；false（默认）=保守跳过，" +
+            "在无法交互确认的场景下已存在资源不会被覆盖（与 deployPlan 的 yes 语义一致）" +
+            "\n- concurrency：同类型资源最大并行数，默认 1（串行）" +
+            "\n- continueOnError：某个资源失败后继续部署其余资源（database 失败仍强制中断）",
+        inputSchema: {
+            confirm: zod_1.z
+                .boolean()
+                .optional()
+                .describe("危险操作确认开关。部署会变更云端资源，必须显式传 confirm=true 才会执行"),
+            confirmDestructive: zod_1.z
+                .boolean()
+                .optional()
+                .describe("破坏性数据库变更确认开关。当待执行迁移含 DROP/TRUNCATE/DELETE 或 ALTER…DROP/RENAME 时，" +
+                "必须在 confirm=true 之外额外显式传 confirmDestructive=true；无破坏性迁移时不生效"),
+            cwd: zod_1.z
+                .string()
+                .optional()
+                .describe("项目根目录，从此目录向下搜索 cloudbaserc；默认当前工作目录"),
+            mode: zod_1.z
+                .string()
+                .optional()
+                .describe("环境名（如 production/staging），命中 envOverrides.<mode> 时合并覆盖"),
+            envId: zod_1.z
+                .string()
+                .optional()
+                .describe("目标环境 ID，优先级高于 cloudbaserc 中的 envId；不传则用配置值或当前绑定环境"),
+            only: zod_1.z
+                .array(zod_1.z.enum(RESOURCE_TYPES))
+                .optional()
+                .describe("仅部署指定资源类型，可选值：database/functions/app/hosting/gateway"),
+            skip: zod_1.z
+                .array(zod_1.z.enum(RESOURCE_TYPES))
+                .optional()
+                .describe("跳过指定资源类型，可选值：database/functions/app/hosting/gateway"),
+            yes: zod_1.z
+                .boolean()
+                .optional()
+                .describe("遇到已存在资源时是否直接覆盖更新。true=覆盖；false（默认）=保守跳过已存在资源"),
+            concurrency: zod_1.z
+                .number()
+                .int()
+                .min(1)
+                .optional()
+                .describe("同类型资源最大并行数，默认 1（串行）；仅作用于同类型资源，跨类型依赖顺序不变"),
+            continueOnError: zod_1.z
+                .boolean()
+                .optional()
+                .describe("某个资源失败后是否继续部署其余资源；database 失败始终强制中断"),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            openWorldHint: true,
+            category: "deploy",
+        },
+    }, async ({ confirm, confirmDestructive, cwd, mode, envId: envIdInput, only, skip, yes, concurrency, continueOnError, }) => {
+        try {
+            if (confirm !== true) {
+                throw new DeployError(exports.DEPLOY_ERROR_CODES.CONFIRM_REQUIRED, "部署会变更云端资源，必须显式传 confirm=true 才会执行。" +
+                    "建议先用 deployPlan 预演部署计划，确认无误后再执行。");
+            }
+            const projectRoot = cwd ?? process.cwd();
+            const config = await resolveDeployConfig({ cwd: projectRoot, mode });
+            assertConfigValid(config);
+            const envId = await resolveDeployEnvId({
+                envId: envIdInput,
+                config,
+                cloudBaseOptions,
+            });
+            const manager = await getManager();
+            const orchestrator = manager.getDeployOrchestrator();
+            // 破坏性数据库变更门：仅当 database 参与本次部署时，先 dry-run 取 pending 迁移，
+            // 检测破坏性语句；命中且未额外确认则拒绝，独立于总 confirm 之外多一道门。
+            const databaseParticipates = !!config.database &&
+                (!only || only.includes("database")) &&
+                !(skip ?? []).includes("database");
+            if (databaseParticipates && confirmDestructive !== true) {
+                const dryRunPlan = await orchestrator.deployPlan({
+                    config,
+                    envId,
+                    cwd: projectRoot,
+                    only,
+                    skip,
+                    dryRun: true,
+                });
+                const destructive = detectDestructiveMigrations({
+                    plan: Array.isArray(dryRunPlan) ? dryRunPlan : [],
+                    cwd: projectRoot,
+                    databaseConfig: config.database,
+                });
+                if (destructive.length > 0) {
+                    throw new DeployError(exports.DEPLOY_ERROR_CODES.DESTRUCTIVE_CONFIRM_REQUIRED, "本次待执行的数据库迁移包含破坏性语句（DROP/TRUNCATE/DELETE 或 ALTER…DROP/RENAME），" +
+                        "可能造成数据/结构不可逆丢失。请先备份或复核，确认后额外传 confirmDestructive=true 再执行。" +
+                        "命中迁移：" +
+                        destructive
+                            .map((d) => `${d.migration}（${d.statements.length} 条破坏性语句）`)
+                            .join("；"));
+                }
+            }
+            const result = await orchestrator.deploy({
+                config,
+                envId,
+                cwd: projectRoot,
+                only,
+                skip,
+                yes: yes === true,
+                concurrency: normalizeConcurrency(concurrency),
+                continueOnError,
+            });
+            return (0, json_content_js_1.jsonContent)(buildEnvelope({ cwd: projectRoot, mode: mode ?? null, envId, result }, "声明式部署已执行"));
+        }
+        catch (error) {
+            return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(error));
+        }
+    });
+}
+
+
 /***/ },
 
 /***/ 27528
@@ -213937,7 +214139,7 @@ function registerEnvTools(server) {
                         oauthCustom: zod_1.z
                             .boolean()
                             .optional()
-                            .describe("高级可选：自定义 endpoint 返回格式开关。未配置 endpoint 时默认 false；配置 endpoint 后默认 true，且不能设为 false"),
+                            .describe("高级可选：自定义 endpoint 返回格式开关。未配置 endpoint 时默认 false；配置 endpoint 后默认 true。标准 {code,result} 包装格式的端点（如国际站 tcb-api.tencentcloud.com）应显式传 false"),
                     }
                     : {}),
                 envId: zod_1.z
@@ -214182,19 +214384,15 @@ function registerEnvTools(server) {
                             }
                         };
                         try {
-                            // 启动 Device Flow，全流程由 toolbox 负责轮询和写入 credential，这里不等待完成
+                            // 启动 Device Flow，全流程由 toolbox 负责轮询和写入 credential，这里不等待完成。
+                            // 登录参数（含 TCB_SITE=intl 端点覆写与授权页改写）与 ensureLogin 共享同一 helper，
+                            // 避免此直连路径绕过国际站改写导致国际站账号拿到的仍是国内站链接
                             auth
                                 .loginByWebAuth({
-                                flow: "device",
-                                ...(resolvedAuthOptions.clientId
-                                    ? { client_id: resolvedAuthOptions.clientId }
-                                    : {}),
-                                ...(resolvedAuthOptions.oauthEndpoint
-                                    ? { getOAuthEndpoint: () => resolvedAuthOptions.oauthEndpoint }
-                                    : {}),
-                                ...(resolvedAuthOptions.oauthCustom
-                                    ? { custom: true }
-                                    : {}),
+                                ...(0, auth_js_1.buildDeviceLoginOptions)(resolvedAuthOptions, {
+                                    region,
+                                    site: server.cloudBaseOptions?.site,
+                                }),
                                 onDeviceCode: deviceOnCode,
                             })
                                 .then(async () => {
@@ -224094,7 +224292,7 @@ function registerSetupTools(server) {
     server.registerTool("downloadTemplate", {
         title: "下载项目模板",
         description: `自动下载并部署CloudBase项目模板。
-**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.33.0" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
+**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.33.2" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
         inputSchema: {
             template: zod_1.z
                 .enum(["react", "vue", "miniprogram", "uniapp", "rules"])
@@ -225072,6 +225270,7 @@ function registerPGStorageTools(server) {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.CLOUD_INCOMPATIBLE_ACTION_LEVEL_EXCEPTIONS = exports.CLOUD_INCOMPATIBLE_TOOLS = void 0;
 exports.isCloudMode = isCloudMode;
 exports.enableCloudMode = enableCloudMode;
 exports.getCloudModeStatus = getCloudModeStatus;
@@ -225117,6 +225316,65 @@ function getCloudModeStatus() {
     }
     return { enabled: false, source: null };
 }
+/**
+ * Tools that are incompatible with cloud mode because they read from or write to
+ * the local filesystem (uploads, downloads, config files, or building an upload
+ * artifact from `process.cwd()`). In cloud mode these top-level tools are not
+ * registered at all; where a tool has both cloud-safe and local-only actions,
+ * gating happens at the action level inside the tool instead (see
+ * `ensureActionAllowedInCloudMode` in functions.ts / hosting.ts).
+ *
+ * IMPORTANT: keep this list in sync with the tools actually registered. Entries
+ * that no longer match a registered tool name are dead (they silently gate
+ * nothing). `CLOUD_INCOMPATIBLE_TOOLS.test.ts` asserts every entry here maps to
+ * a known tool or a documented action-level exception to prevent silent rot.
+ */
+exports.CLOUD_INCOMPATIBLE_TOOLS = [
+    // Auth tools - local file uploads
+    'auth',
+    // Storage tools - local file uploads / downloads.
+    // NOTE: `uploadFile` is not a top-level tool name (storage upload is exposed
+    // via `manageStorage`); kept here as a documented action-level exception.
+    'uploadFile',
+    'manageStorage',
+    // Function tools - local code uploads.
+    // NOTE: createFunction / updateFunctionCode are now actions of `manageFunctions`,
+    // not top-level tools, so gating them here is a no-op kept for documentation.
+    // The real cloud-mode guard for those actions lives in
+    // functions.ts#ensureActionAllowedInCloudMode. Left here intentionally so the
+    // sync test flags them as "action-level exceptions" rather than removing the
+    // record of why they are not top-level tools.
+    'updateFunctionCode',
+    'createFunction',
+    // Declarative deploy tools - read local cloudbaserc and build the upload
+    // artifact from cwd (process.cwd() when no cwd is passed). Same class as the
+    // function/upload tools above: they have no meaning without a local project.
+    'deployApply',
+    'deployPlan',
+    // Download tools - local file downloads
+    'downloadTemplate',
+    // Setup tools - local config file operations.
+    // NOTE: `setupEnvironmentId` is not a top-level tool name; kept as a documented
+    // action-level exception (env binding is handled via `auth`/setup flows).
+    'setupEnvironmentId',
+    // CloudRun tools - local file operations
+    'manageCloudRun',
+    // manageApps is intentionally NOT listed: deployApp with localPath/filePath is
+    // blocked per-action in apps.ts (CLOUD_MODE_UNSUPPORTED_ACTION) so cloud mode
+    // can still use getUploadUrl + cosTimestamp, deleteApp, and deleteAppVersion.
+];
+/**
+ * Tool names that appear in CLOUD_INCOMPATIBLE_TOOLS for documentation but are no
+ * longer registered as top-level tools (their cloud gating is enforced at the
+ * action level instead). The sync test treats these as expected, everything else
+ * must resolve to a registered tool.
+ */
+exports.CLOUD_INCOMPATIBLE_ACTION_LEVEL_EXCEPTIONS = [
+    'createFunction',
+    'updateFunctionCode',
+    'uploadFile',
+    'setupEnvironmentId',
+];
 /**
  * Check if a tool should be registered in cloud mode
  * @param toolName - The name of the tool
@@ -225127,29 +225385,7 @@ function shouldRegisterTool(toolName) {
     if (!isCloudMode()) {
         return true;
     }
-    // Cloud-incompatible tools that involve local file operations
-    const cloudIncompatibleTools = [
-        // Auth tools - local file uploads
-        'auth',
-        // Storage tools - local file uploads
-        'uploadFile',
-        // Hosting tools - action-level cloud gating is handled inside manageHosting
-        // Function tools - local code uploads
-        'updateFunctionCode',
-        'createFunction', // also involves local files
-        // Download tools - local file downloads
-        'downloadTemplate',
-        // Setup tools - local config file operations
-        'setupEnvironmentId',
-        // CloudRun tools - local file operations
-        'manageCloudRun',
-        // Download tools - local file downloads
-        'manageStorage',
-        // manageApps is intentionally NOT listed: deployApp with localPath/filePath is
-        // blocked per-action in apps.ts (CLOUD_MODE_UNSUPPORTED_ACTION) so cloud mode
-        // can still use getUploadUrl + cosTimestamp, deleteApp, and deleteAppVersion.
-    ];
-    return !cloudIncompatibleTools.includes(toolName);
+    return !exports.CLOUD_INCOMPATIBLE_TOOLS.includes(toolName);
 }
 
 
@@ -226309,6 +226545,163 @@ function resolveSiteAndRegion(opts = {}) {
 }
 
 
+/***/ },
+
+/***/ 29885
+(__unused_webpack_module, exports) {
+
+"use strict";
+
+/**
+ * Shared SQL risk heuristics.
+ *
+ * Extracted from databasePG.ts so both the interactive PG execute path and the
+ * declarative deploy path classify destructive SQL with the *same* rules,
+ * avoiding drift between two independent detectors.
+ *
+ * These are conservative lexical heuristics, not a full SQL parser: they strip
+ * leading comments, read the leading verb, and match destructive keywords. They
+ * are meant to decide whether an *extra* human confirmation is warranted, not to
+ * be a security boundary.
+ */
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.stripLeadingSqlComments = stripLeadingSqlComments;
+exports.getSqlVerb = getSqlVerb;
+exports.isDestructiveSql = isDestructiveSql;
+exports.splitSqlStatements = splitSqlStatements;
+exports.findDestructiveStatements = findDestructiveStatements;
+/** Strip leading line (`--`, `#`) and block (`/* *​/`) comments and whitespace. */
+function stripLeadingSqlComments(sql) {
+    let normalized = sql.trim();
+    while (normalized.length > 0) {
+        if (normalized.startsWith("--")) {
+            normalized = normalized.replace(/^--.*(?:\r?\n|$)/, "").trimStart();
+            continue;
+        }
+        if (normalized.startsWith("#")) {
+            normalized = normalized.replace(/^#.*(?:\r?\n|$)/, "").trimStart();
+            continue;
+        }
+        if (normalized.startsWith("/*")) {
+            normalized = normalized.replace(/^\/\*[\s\S]*?\*\//, "").trimStart();
+            continue;
+        }
+        break;
+    }
+    return normalized;
+}
+/** Return the leading SQL verb (uppercased), ignoring leading comments. */
+function getSqlVerb(sql) {
+    const normalized = stripLeadingSqlComments(sql);
+    const match = normalized.match(/^([a-zA-Z]+)/);
+    return match ? match[1].toUpperCase() : "";
+}
+/**
+ * Whether a *single* SQL statement is destructive (drops/truncates data or
+ * removes/renames schema objects).
+ */
+function isDestructiveSql(sql) {
+    const normalized = stripLeadingSqlComments(sql);
+    const verb = getSqlVerb(normalized);
+    if (["DROP", "TRUNCATE", "DELETE"].includes(verb)) {
+        return true;
+    }
+    if (verb === "ALTER") {
+        return /\b(DROP|RENAME)\b/i.test(normalized);
+    }
+    return false;
+}
+/**
+ * Split a possibly multi-statement SQL script into individual statements.
+ *
+ * Naive split on `;` at statement boundaries, but aware of single/double quotes,
+ * line/block comments, and PostgreSQL dollar-quoted strings ($$ ... $$ or
+ * $tag$ ... $tag$) so semicolons inside string bodies / function definitions do
+ * not split a statement. Good enough for the conservative destructive scan; not
+ * a full parser.
+ */
+function splitSqlStatements(sqlText) {
+    const statements = [];
+    let current = "";
+    let i = 0;
+    const n = sqlText.length;
+    while (i < n) {
+        const ch = sqlText[i];
+        const next = sqlText[i + 1];
+        // line comment -- ... (to end of line)
+        if (ch === "-" && next === "-") {
+            const end = sqlText.indexOf("\n", i);
+            const stop = end === -1 ? n : end + 1;
+            current += sqlText.slice(i, stop);
+            i = stop;
+            continue;
+        }
+        // block comment /* ... */
+        if (ch === "/" && next === "*") {
+            const end = sqlText.indexOf("*/", i + 2);
+            const stop = end === -1 ? n : end + 2;
+            current += sqlText.slice(i, stop);
+            i = stop;
+            continue;
+        }
+        // single- or double-quoted string
+        if (ch === "'" || ch === '"') {
+            const quote = ch;
+            current += ch;
+            i += 1;
+            while (i < n) {
+                current += sqlText[i];
+                // handle escaped quote by doubling ('' or "")
+                if (sqlText[i] === quote) {
+                    if (sqlText[i + 1] === quote) {
+                        current += sqlText[i + 1];
+                        i += 2;
+                        continue;
+                    }
+                    i += 1;
+                    break;
+                }
+                i += 1;
+            }
+            continue;
+        }
+        // dollar-quoted string: $$ ... $$ or $tag$ ... $tag$
+        if (ch === "$") {
+            const tagMatch = sqlText.slice(i).match(/^\$([a-zA-Z_][a-zA-Z0-9_]*)?\$/);
+            if (tagMatch) {
+                const tag = tagMatch[0];
+                const end = sqlText.indexOf(tag, i + tag.length);
+                const stop = end === -1 ? n : end + tag.length;
+                current += sqlText.slice(i, stop);
+                i = stop;
+                continue;
+            }
+        }
+        if (ch === ";") {
+            if (current.trim().length > 0) {
+                statements.push(current.trim());
+            }
+            current = "";
+            i += 1;
+            continue;
+        }
+        current += ch;
+        i += 1;
+    }
+    if (current.trim().length > 0) {
+        statements.push(current.trim());
+    }
+    return statements;
+}
+/**
+ * Scan a (possibly multi-statement) SQL script and return the destructive
+ * statements found. Empty array means no destructive statement detected.
+ */
+function findDestructiveStatements(sqlText) {
+    return splitSqlStatements(sqlText).filter((stmt) => isDestructiveSql(stmt));
+}
+
+
 /***/ },
 
 /***/ 5198
@@ -226323,12 +226716,14 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.reportToolkitLifecycle = exports.reportToolCall = exports.telemetryReporter = void 0;
 exports.extractMcpClientInfo = extractMcpClientInfo;
 exports.readMcpClientInfoFromServer = readMcpClientInfoFromServer;
+exports.normalizeClientName = normalizeClientName;
 const crypto_1 = __importDefault(__webpack_require__(55511));
 const http_1 = __importDefault(__webpack_require__(81630));
 const https_1 = __importDefault(__webpack_require__(55591));
 const os_1 = __importDefault(__webpack_require__(21820));
 const cloudbase_manager_js_1 = __webpack_require__(33109);
 const logger_js_1 = __webpack_require__(40781);
+const site_map_js_1 = __webpack_require__(34533);
 /**
  * 数据上报类
  * 用于收集 MCP 工具使用情况和错误信息，帮助改进产品
@@ -226358,6 +226753,12 @@ class TelemetryReporter {
             this.addAdditionalParams({ ide: process.env.INTEGRATION_IDE });
             (0, logger_js_1.debug)('检测到 IDE 集成环境', { ide: process.env.INTEGRATION_IDE });
         }
+        // 检查 CLOUDBASE_MCP_CLIENT 环境变量（hosted 场景由上游解析真实 MCP client 后注入）
+        const envClient = normalizeClientName(process.env.CLOUDBASE_MCP_CLIENT);
+        if (envClient) {
+            this.addAdditionalParams({ client: envClient });
+            (0, logger_js_1.debug)('检测到 MCP client 标识', { client: envClient });
+        }
         (0, logger_js_1.debug)('report_init', {
             enabled: this.enabled,
             deviceId: this.deviceId.substring(0, 8) + '...',
@@ -226375,7 +226776,7 @@ class TelemetryReporter {
         const arch = os_1.default.arch(); // 系统架构
         // Build-time injected version; guard for vitest / non-webpack runtimes.
         const mcpVersion = process.env.npm_package_version ||
-            ( true ? "2.33.0" : 0);
+            ( true ? "2.33.2" : 0);
         return {
             userAgent: `${osType} ${osRelease} ${arch} ${nodeVersion} CloudBase-MCP/${mcpVersion}`,
             deviceId: this.deviceId,
@@ -226586,6 +226987,58 @@ function readMcpClientInfoFromServer(server) {
         return {};
     }
 }
+/**
+ * Normalize upstream-provided client identifier into a telemetry-safe token:
+ * trim + lowercase + keep [a-z0-9-_] only + cap at 64 chars.
+ * Canonical mapping (cursor-vscode -> cursor etc.) is the upstream's responsibility;
+ * we only sanitize. Returns undefined when nothing usable remains.
+ */
+function normalizeClientName(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const cleaned = value
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9_-]/g, "")
+        .slice(0, 64);
+    return cleaned || undefined;
+}
+// 进程内缓存 site/region 解析结果（resolveSiteAndRegion 会读项目配置文件，避免每次工具调用都走 IO）
+let cachedSiteRegion = null;
+/**
+ * Resolve region/site for telemetry.
+ * Priority: cloudBaseOptions（会话实际使用值）> resolveSiteAndRegion（env/项目配置解析，进程内缓存）。
+ * 失败时降级 unknown，绝不影响工具调用主链路。
+ */
+function resolveTelemetrySiteRegion(cloudBaseOptions) {
+    const explicitRegion = cloudBaseOptions?.region;
+    const explicitSite = (0, site_map_js_1.normalizeSite)(cloudBaseOptions?.site);
+    try {
+        if (!cachedSiteRegion) {
+            const resolved = (0, site_map_js_1.resolveSiteAndRegion)();
+            cachedSiteRegion = { site: resolved.site, region: resolved.region };
+        }
+        return {
+            region: explicitRegion || cachedSiteRegion.region,
+            site: explicitSite || cachedSiteRegion.site,
+        };
+    }
+    catch (err) {
+        (0, logger_js_1.debug)('解析 site/region 失败，遥测使用 unknown', err instanceof Error ? err : new Error(String(err)));
+        return {
+            region: explicitRegion || 'unknown',
+            site: explicitSite || 'unknown',
+        };
+    }
+}
+/**
+ * Resolve MCP client identifier for a single report:
+ * explicit param (server.client) > CLOUDBASE_MCP_CLIENT env (hosted upstream injection).
+ */
+function resolveClientName(explicit) {
+    return normalizeClientName(explicit || process.env.CLOUDBASE_MCP_CLIENT);
+}
 function appendMcpClientInfoFields(eventData, clientInfo) {
     if (!clientInfo) {
         return;
@@ -226605,6 +227058,7 @@ const reportToolCall = async (params) => {
     const { nodeVersion, osType, osRelease, arch, mcpVersion } = exports.telemetryReporter.getUserAgent();
     // 安全获取环境ID，优先使用传入的配置
     const { envId, envIdSource } = resolveEnvId(params.cloudBaseOptions);
+    const siteRegion = resolveTelemetrySiteRegion(params.cloudBaseOptions);
     (0, logger_js_1.debug)('[telemetry] 工具调用 envId 获取结果', {
         toolName: params.toolName,
         envId,
@@ -226620,6 +227074,8 @@ const reportToolCall = async (params) => {
         duration: params.duration !== undefined ? String(params.duration) : undefined,
         error: params.error ? params.error.substring(0, 200) : undefined, // 限制错误信息长度
         envId: envId || 'unknown',
+        region: siteRegion.region,
+        site: siteRegion.site,
         nodeVersion,
         osType,
         osRelease,
@@ -226644,6 +227100,11 @@ const reportToolCall = async (params) => {
     if (params.ide) {
         eventData.ide = params.ide;
     }
+    // 添加 MCP client 标识（如果提供）
+    const client = resolveClientName(params.client);
+    if (client) {
+        eventData.client = client;
+    }
     appendMcpClientInfoFields(eventData, params.mcpClientInfo);
     // Debug: 打印最终上报参数
     (0, logger_js_1.debug)('[telemetry] 工具调用上报参数', {
@@ -226663,6 +227124,7 @@ const reportToolkitLifecycle = async (params) => {
     const { nodeVersion, osType, osRelease, arch, mcpVersion } = exports.telemetryReporter.getUserAgent();
     // 安全获取环境ID，优先使用传入的配置
     const { envId, envIdSource } = resolveEnvId(params.cloudBaseOptions);
+    const siteRegion = resolveTelemetrySiteRegion(params.cloudBaseOptions);
     (0, logger_js_1.debug)('[telemetry] 生命周期事件 envId 获取结果', {
         event: params.event,
         envId,
@@ -226677,6 +227139,8 @@ const reportToolkitLifecycle = async (params) => {
         exitCode: params.exitCode !== undefined ? String(params.exitCode) : undefined,
         error: params.error ? params.error.substring(0, 200) : undefined, // 限制错误信息长度
         envId: envId || 'unknown',
+        region: siteRegion.region,
+        site: siteRegion.site,
         nodeVersion,
         osType,
         osRelease,
@@ -226687,6 +227151,11 @@ const reportToolkitLifecycle = async (params) => {
     if (params.ide) {
         eventData.ide = params.ide;
     }
+    // 添加 MCP client 标识（如果提供）
+    const lifecycleClient = resolveClientName(params.client);
+    if (lifecycleClient) {
+        eventData.client = lifecycleClient;
+    }
     appendMcpClientInfoFields(eventData, params.mcpClientInfo);
     // Debug: 打印最终上报参数
     (0, logger_js_1.debug)('[telemetry] 生命周期事件上报参数', {
@@ -226900,7 +227369,7 @@ ${envIdSection}
 ## 环境信息
 - 操作系统: ${os_1.default.type()} ${os_1.default.release()}
 - Node.js版本: ${process.version}
-- MCP 版本：${process.env.npm_package_version || ( true ? "2.33.0" : 0)}
+- MCP 版本：${process.env.npm_package_version || ( true ? "2.33.2" : 0)}
 - 系统架构: ${os_1.default.arch()}
 - 时间: ${new Date().toISOString()}
 - 请求ID: ${requestId}
@@ -226989,7 +227458,7 @@ function createWrappedHandler(name, handler, server) {
                 requestId,
                 ide: server.ide || process.env.INTEGRATION_IDE || ''
             });
-            const mcpVersion =  true ? "2.33.0" : 0;
+            const mcpVersion =  true ? "2.33.2" : 0;
             const requestIdSuffix = requestId ? `\n🆔 RequestId: ${requestId}` : '';
             const enhancedErrorMessage = `${errorMessage}${requestIdSuffix}\n\n📦 CloudBase MCP v${mcpVersion}\n🔗 遇到问题？请复制以下链接到浏览器打开\n即可自动携带错误详情快速创建 GitHub Issue：\n${issueLink}`;
             // 创建新的错误对象，保持原有的错误类型但更新消息
@@ -227027,6 +227496,7 @@ function createWrappedHandler(name, handler, server) {
                     inputParams: sanitizeArgs(args), // 添加入参上报
                     cloudBaseOptions: cloudBaseOptions, // 传递 CloudBase 配置（可能已更新）
                     ide: server.ide || process.env.INTEGRATION_IDE, // 传递集成IDE信息
+                    client: server.client || process.env.CLOUDBASE_MCP_CLIENT, // 传递 MCP client 来源标识
                     mcpClientInfo: (0, telemetry_js_1.readMcpClientInfoFromServer)(server),
                 }).catch(err => {
                     // 静默处理上报错误，不影响主要功能