@cloudbase/cloudbase-mcp 2.33.0 → 2.33.2

package/dist/index.js

@@ -38,6 +38,7 @@ exports.getAuthProgressState = getAuthProgressState;
 exports.resolveAuthOptions = resolveAuthOptions;
 exports.getAuthConfigValidationError = getAuthConfigValidationError;
 exports.buildAuthConfigSummary = buildAuthConfigSummary;
+exports.buildDeviceLoginOptions = buildDeviceLoginOptions;
 exports.setPendingAuthProgressState = setPendingAuthProgressState;
 exports.resolveAuthProgressState = resolveAuthProgressState;
 exports.rejectAuthProgressState = rejectAuthProgressState;
@@ -256,9 +257,10 @@ function getAuthConfigValidationError(options) {
     if (options.oauthCustom && !options.oauthEndpoint) {
         return "oauthCustom=true 时必须同时提供 oauthEndpoint。";
     }
-    if (options.oauthEndpoint && !options.oauthCustom) {
-        return "配置自定义 oauthEndpoint 时必须启用 oauthCustom=true。";
-    }
+    // oauthEndpoint + 显式 oauthCustom=false 放行：resolveAuthOptions 对"只配 endpoint
+    // 未配 custom"已默认 custom=true，走到这里的 endpoint+false 只可能是用户显式指定——
+    // 即标准 {code,result} 包装格式的自定义端点（如国际站 tcb-api.tencentcloud.com），
+    // 拦截会导致标准格式端点在工具层永远不可用。
     return null;
 }
 function buildAuthConfigSummary(options) {
@@ -270,6 +272,40 @@ function buildAuthConfigSummary(options) {
         uses_toolbox_defaults: options.usesToolboxDefaults,
     };
 }
+/**
+ * 构造 device flow 的 loginByWebAuth 基础参数（onDeviceCode 由调用方按需注入）。
+ *
+ * 所有 device 登录路径（ensureLogin 与 auth 工具 start_auth 的 device 分支）必须
+ * 共享本函数：TCB_SITE=intl 时的 getOAuthEndpoint 覆写与 getAuthUrl 授权页改写
+ * 只在 ensureLogin 生效，会导致工具层直连路径仍打国内站端点/授权页，国际站账号
+ * 无法完成授权（device-code 注册表国内外隔离，国内授权页对国际站账号无效）。
+ */
+function buildDeviceLoginOptions(resolvedAuthOptions, siteHints = {}) {
+    const resolvedSite = (0, site_map_js_1.resolveSite)(siteHints.region, siteHints.site ?? process.env.TCB_SITE);
+    const loginOptions = { flow: "device" };
+    if (resolvedAuthOptions.clientId) {
+        loginOptions.client_id = resolvedAuthOptions.clientId;
+    }
+    if (resolvedAuthOptions.oauthEndpoint) {
+        loginOptions.getOAuthEndpoint = () => resolvedAuthOptions.oauthEndpoint;
+    }
+    else if (resolvedSite === "intl") {
+        // 国际站 OAuth 后端独立部署（2026-09-01 实测 device/code+token 可用，注册表与国内站隔离）；
+        // 不覆写时 toolbox 默认打国内站端点，国际站账号无法完成授权
+        loginOptions.getOAuthEndpoint = () => site_map_js_1.SITE_REGION_MAP.intl.oauthEndpoint;
+    }
+    if (resolvedSite === "intl") {
+        // device 模式的 verification_uri 标准模式下由客户端拼接，指向国内站授权页；
+        // 与 web 模式同款 host 改写，把授权页切到国际站
+        loginOptions.getAuthUrl = (url) => url
+            .replace(`${site_map_js_1.SITE_REGION_MAP.domestic.authHost}/dev`, `${site_map_js_1.SITE_REGION_MAP.intl.authHost}/dev`)
+            .replace(site_map_js_1.SITE_REGION_MAP.domestic.authHost, site_map_js_1.SITE_REGION_MAP.intl.authHost);
+    }
+    if (resolvedAuthOptions.oauthCustom) {
+        loginOptions.custom = true;
+    }
+    return loginOptions;
+}
 function setPendingAuthProgressState(challenge, authMode = "device") {
     return updateAuthProgressState({
         status: "PENDING",
@@ -509,27 +545,11 @@ async function ensureLogin(options) {
                     };
         }
         else {
-            if (resolvedAuthOptions.clientId) {
-                loginOptions.client_id = resolvedAuthOptions.clientId;
-            }
-            if (resolvedAuthOptions.oauthEndpoint) {
-                loginOptions.getOAuthEndpoint = () => resolvedAuthOptions.oauthEndpoint;
-            }
-            else if (resolvedSite === "intl") {
-                // 国际站 OAuth 后端独立部署（2026-09-01 实测 device/code+token 可用，注册表与国内站隔离）；
-                // 不覆写时 toolbox 默认打国内站端点，国际站账号无法完成授权
-                loginOptions.getOAuthEndpoint = () => site_map_js_1.SITE_REGION_MAP.intl.oauthEndpoint;
-            }
-            if (resolvedSite === "intl") {
-                // device 模式的 verification_uri 标准模式下由客户端拼接，指向国内站授权页；
-                // 与 web 模式同款 host 改写，把授权页切到国际站
-                loginOptions.getAuthUrl = (url) => url
-                    .replace(`${site_map_js_1.SITE_REGION_MAP.domestic.authHost}/dev`, `${site_map_js_1.SITE_REGION_MAP.intl.authHost}/dev`)
-                    .replace(site_map_js_1.SITE_REGION_MAP.domestic.authHost, site_map_js_1.SITE_REGION_MAP.intl.authHost);
-            }
-            if (resolvedAuthOptions.oauthCustom) {
-                loginOptions.custom = true;
-            }
+            // device 模式：与 auth 工具 start_auth device 分支共享 intl 端点覆写与授权页改写
+            Object.assign(loginOptions, buildDeviceLoginOptions(resolvedAuthOptions, {
+                region: options?.region,
+                site: options?.site,
+            }));
             if (options?.onDeviceCode) {
                 loginOptions.onDeviceCode = (info) => {
                     setPendingAuthProgressState(info, mode);
@@ -2071,7 +2091,7 @@ __webpack_unused_export__ = Object.values(exports.TCB_ACTION_INDEX_MAP);
 
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.telemetryReporter = exports.reportToolkitLifecycle = exports.reportToolCall = exports.warn = exports.info = exports.error = exports.StdioServerTransport = void 0;
+exports.normalizeClientName = exports.telemetryReporter = exports.reportToolkitLifecycle = exports.reportToolCall = exports.warn = exports.info = exports.error = exports.StdioServerTransport = void 0;
 exports.createCloudBaseMcpServer = createCloudBaseMcpServer;
 exports.getDefaultServer = getDefaultServer;
 const mcp_js_1 = __webpack_require__(4619);
@@ -2089,6 +2109,7 @@ const storage_js_1 = __webpack_require__(3138);
 const types_js_1 = __webpack_require__(2344);
 const capi_js_1 = __webpack_require__(8900);
 const cloudrun_js_1 = __webpack_require__(3277);
+const deploy_js_1 = __webpack_require__(3668);
 const dataModel_js_1 = __webpack_require__(2722);
 const gateway_js_1 = __webpack_require__(9921);
 const agents_js_1 = __webpack_require__(8409);
@@ -2102,6 +2123,7 @@ const logger_js_1 = __webpack_require__(781);
 const site_map_js_1 = __webpack_require__(4533);
 const tool_result_js_1 = __webpack_require__(9645);
 const tool_wrapper_js_1 = __webpack_require__(3389);
+const telemetry_js_1 = __webpack_require__(5198);
 // 默认插件列表
 const DEFAULT_PLUGINS = [
     "env",
@@ -2115,6 +2137,7 @@ const DEFAULT_PLUGINS = [
     "setup",
     "rag",
     "cloudrun",
+    "deploy",
     "gateway",
     "app-auth",
     "apps",
@@ -2168,6 +2191,7 @@ const AVAILABLE_PLUGINS = {
     agents: { name: "agents", register: agents_js_1.registerAgentTools },
     apps: { name: "apps", register: apps_js_1.registerAppTools },
     cloudrun: { name: "cloudrun", register: cloudrun_js_1.registerCloudRunTools },
+    deploy: { name: "deploy", register: deploy_js_1.registerDeployTools },
     capi: { name: "capi", register: capi_js_1.registerCapiTools },
     "msg-push": { name: "msg-push", register: msg_push_js_1.registerMsgPushTools },
 };
@@ -2245,7 +2269,7 @@ function parseEnabledPlugins(pluginsEnabled, pluginsDisabled) {
  * await server.connect(transport);
  */
 async function createCloudBaseMcpServer(options) {
-    const { name = "cloudbase-mcp", version = "1.0.0", enableTelemetry = true, cloudBaseOptions, authOptions, cloudMode = false, ide, logger, pluginsEnabled, pluginsDisabled, pluginOptions, } = options ?? {};
+    const { name = "cloudbase-mcp", version = "1.0.0", enableTelemetry = true, cloudBaseOptions, authOptions, cloudMode = false, ide, client, logger, pluginsEnabled, pluginsDisabled, pluginOptions, } = options ?? {};
     // Enable cloud mode if specified
     if (cloudMode) {
         (0, cloud_mode_js_1.enableCloudMode)();
@@ -2308,6 +2332,11 @@ async function createCloudBaseMcpServer(options) {
     if (ide) {
         server.ide = ide;
     }
+    // Store client in server instance for telemetry (normalized, invalid values dropped)
+    const normalizedClient = (0, telemetry_js_1.normalizeClientName)(client);
+    if (normalizedClient) {
+        server.client = normalizedClient;
+    }
     // Store logger in server instance for tools to access
     if (logger) {
         server.logger = logger;
@@ -2342,10 +2371,11 @@ var logger_js_2 = __webpack_require__(781);
 Object.defineProperty(exports, "error", ({ enumerable: true, get: function () { return logger_js_2.error; } }));
 Object.defineProperty(exports, "info", ({ enumerable: true, get: function () { return logger_js_2.info; } }));
 Object.defineProperty(exports, "warn", ({ enumerable: true, get: function () { return logger_js_2.warn; } }));
-var telemetry_js_1 = __webpack_require__(5198);
-Object.defineProperty(exports, "reportToolCall", ({ enumerable: true, get: function () { return telemetry_js_1.reportToolCall; } }));
-Object.defineProperty(exports, "reportToolkitLifecycle", ({ enumerable: true, get: function () { return telemetry_js_1.reportToolkitLifecycle; } }));
-Object.defineProperty(exports, "telemetryReporter", ({ enumerable: true, get: function () { return telemetry_js_1.telemetryReporter; } }));
+var telemetry_js_2 = __webpack_require__(5198);
+Object.defineProperty(exports, "reportToolCall", ({ enumerable: true, get: function () { return telemetry_js_2.reportToolCall; } }));
+Object.defineProperty(exports, "reportToolkitLifecycle", ({ enumerable: true, get: function () { return telemetry_js_2.reportToolkitLifecycle; } }));
+Object.defineProperty(exports, "telemetryReporter", ({ enumerable: true, get: function () { return telemetry_js_2.telemetryReporter; } }));
+Object.defineProperty(exports, "normalizeClientName", ({ enumerable: true, get: function () { return telemetry_js_2.normalizeClientName; } }));
 
 
 /***/ },
@@ -3905,7 +3935,7 @@ function registerAppTools(server) {
 var __webpack_unused_export__;
 
 __webpack_unused_export__ = ({ value: true });
-exports.rg = void 0;
+exports.rg = exports.AV = void 0;
 __webpack_unused_export__ = assertTcbCloudRunActionAllowed;
 __webpack_unused_export__ = resolveCloudApiRegionAndParams;
 __webpack_unused_export__ = removeEmptyStringParams;
@@ -3919,7 +3949,7 @@ const tcb_action_index_js_1 = __webpack_require__(2550);
 const CATEGORY = "cloud-api";
 const CLOUDBASE_CONTROL_PLANE_DOC_URL = "https://cloud.tencent.com/document/product/876/34809";
 const CLOUDBASE_DEPENDENCY_API_DOC_URL = "https://cloud.tencent.com/document/product/876/34808";
-const ALLOWED_SERVICES = [
+exports.AV = [
     "tcb",
     "tcbr",
     "scf",
@@ -3928,6 +3958,8 @@ const ALLOWED_SERVICES = [
     "lowcode",
     "cdn",
     "vpc",
+    "monitor",
+    "postgres",
 ];
 /**
  * Legacy tcb small-tenant CloudRun (CloudBase Run) API family — blocked.
@@ -4049,6 +4081,9 @@ function buildCapiDocGuidance(service) {
     if (service === "tcb" || service === "tcbr" || service === "lowcode" || service === "scf") {
         return `优先查阅 CloudBase API 概览 ${CLOUDBASE_CONTROL_PLANE_DOC_URL} 与云开发依赖资源接口指引 ${CLOUDBASE_DEPENDENCY_API_DOC_URL}。`;
     }
+    if (service === "monitor") {
+        return `请优先核对云监控（腾讯云可观测平台）官方 API 文档：API 概览 https://cloud.tencent.com/document/product/649/30343 ，单 Action 详细文档在 https://cloud.tencent.com/document/api/248/ 产品线下。`;
+    }
     return `请优先核对对应官方云 API 文档；若你的场景其实是通过 HTTP 协议直接集成 auth/functions/cloudrun/storage/mysqldb 等 CloudBase 业务 API，请优先使用 OpenAPI / Swagger 或 searchKnowledgeBase(mode="openapi")，不要继续猜测管控面 Action。`;
 }
 /** Match CAM / authorization failures from Tencent Cloud control-plane APIs. */
@@ -4154,7 +4189,7 @@ function registerCapiTools(server) {
     const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions, requireEnvId: false });
     server.registerTool?.("callCloudApi", {
         title: "调用云API",
-        description: `通用的云 API 调用工具，主要用于 CloudBase / 腾讯云管控面与依赖资源相关 API 调用。调用前请先确认 service、Action 与 Param，避免猜测 Action 名称。如果你的目标是通过 HTTP 协议直接集成 auth/functions/cloudrun/storage/mysqldb 等 CloudBase 业务 API，请不要优先使用 callCloudApi，而应优先查看对应 OpenAPI / Swagger。现有 OpenAPI / Swagger 能力不是通用的管控面 Action 集合；管控面 API 请优先参考 CloudBase API 概览 ${CLOUDBASE_CONTROL_PLANE_DOC_URL} 与云开发依赖资源接口指引 ${CLOUDBASE_DEPENDENCY_API_DOC_URL}。对于 tcb service，常用 Action 分类如下：
+        description: `通用的云 API 调用工具，主要用于 CloudBase / 腾讯云管控面与依赖资源相关 API 调用。**调用前必读接口索引** https://docs.cloudbase.net/ai/cloudbase-ai-toolkit/api-reference.md （每日自动同步的 Action 级索引，含 rate limit；先查此索引确认 service/Action/参数，避免猜测 Action 名称；索引未覆盖的产品再去该产品官方 API 文档核对）。如果你的目标是通过 HTTP 协议直接集成 auth/functions/cloudrun/storage/mysqldb 等 CloudBase 业务 API，请不要优先使用 callCloudApi，而应优先查看对应 OpenAPI / Swagger。现有 OpenAPI / Swagger 能力不是通用的管控面 Action 集合；管控面 API 请优先参考 CloudBase API 概览 ${CLOUDBASE_CONTROL_PLANE_DOC_URL} 与云开发依赖资源接口指引 ${CLOUDBASE_DEPENDENCY_API_DOC_URL}。对于 tcb service，常用 Action 分类如下：
 
 **环境管理**: \`CreateEnv\`、\`ModifyEnv\`、\`DescribeEnvs\`、\`DestroyEnv\`
 **用户管理**: \`CreateUser\`、\`ModifyUser\`、\`DescribeUserList\`、\`DeleteUsers\`
@@ -4169,8 +4204,8 @@ function registerCapiTools(server) {
 销毁环境时，常见做法是至少带上 \`EnvId\` 和 \`BypassCheck: true\`，如果环境已经处于隔离期再按文档补 \`IsForce: true\`。`,
         inputSchema: {
             service: zod_1.z
-                .enum(ALLOWED_SERVICES)
-                .describe("选择要访问的服务。可选：tcb、tcbr、scf、sts、cam、lowcode、cdn、vpc。对于 tcb / scf / lowcode 等 CloudBase 管控面 Action，请优先查官方文档，不要直接猜测 Action。云托管统一走 tcbr（version 需传 2022-02-17）。"),
+                .enum(exports.AV)
+                .describe("选择要访问的服务。可选：tcb、tcbr、scf、sts、cam、lowcode、cdn、vpc、monitor（云监控/告警，version 需传 2018-07-24）、postgres（云数据库 PostgreSQL，version 需传 2017-03-12）。对于 tcb / scf / lowcode 等 CloudBase 管控面 Action，请优先查官方文档，不要直接猜测 Action。云托管统一走 tcbr（version 需传 2022-02-17）。"),
             action: zod_1.z
                 .string()
                 .min(1)
@@ -4178,7 +4213,7 @@ function registerCapiTools(server) {
             version: zod_1.z
                 .string()
                 .optional()
-                .describe("API 版本（可选）。缺省时按 service 使用 SDK 内置默认版本；tcbr 必须传 \"2022-02-17\"（否则请求缺少 X-TC-Version 会失败）。示例：service=\"tcbr\", version=\"2022-02-17\", action=\"CreateCloudRunEnv\", params={EnvId:\"env-xxx\",PackageType:\"Standard\"}。"),
+                .describe("API 版本（可选）。缺省时按 service 使用 SDK 内置默认版本；tcbr 必须传 \"2022-02-17\"（否则请求缺少 X-TC-Version 会失败），monitor 必须传 \"2018-07-24\"、postgres 必须传 \"2017-03-12\"（这两个 service 无内置默认版本，不传会失败）。示例：service=\"tcbr\", version=\"2022-02-17\", action=\"CreateCloudRunEnv\", params={EnvId:\"env-xxx\",PackageType:\"Standard\"}。"),
             params: zod_1.z
                 .record(zod_1.z.any())
                 .optional()
@@ -4196,8 +4231,8 @@ function registerCapiTools(server) {
             category: CATEGORY,
         },
     }, async ({ service, action, params, version, region, }) => {
-        if (!ALLOWED_SERVICES.includes(service)) {
-            throw new Error(`Service ${service} is not allowed. Allowed services: ${ALLOWED_SERVICES.join(", ")}`);
+        if (!exports.AV.includes(service)) {
+            throw new Error(`Service ${service} is not allowed. Allowed services: ${exports.AV.join(", ")}`);
         }
         assertTcbCloudRunActionAllowed(service, action);
         const { region: resolvedRegion, params: bodyParams } = resolveCloudApiRegionAndParams({ region, params });
@@ -8937,6 +8972,7 @@ const path = __importStar(__webpack_require__(2521));
 const zod_1 = __webpack_require__(2971);
 const cloudbase_manager_js_1 = __webpack_require__(3109);
 const tool_result_js_1 = __webpack_require__(9645);
+const sql_risk_js_1 = __webpack_require__(9885);
 const CATEGORY = "PostgreSQL database";
 const QUERY_PG_DATABASE = "queryPgDatabase";
 const MANAGE_PG_DATABASE = "managePgDatabase";
@@ -9096,33 +9132,9 @@ function normalizeLimit(limit, fallback = 20, max = 200) {
     }
     return Math.max(1, Math.min(max, Math.floor(limit)));
 }
-function stripLeadingSqlComments(sql) {
-    let normalized = sql.trim();
-    while (normalized.length > 0) {
-        if (normalized.startsWith("--")) {
-            normalized = normalized.replace(/^--.*(?:\r?\n|$)/, "").trimStart();
-            continue;
-        }
-        if (normalized.startsWith("#")) {
-            normalized = normalized.replace(/^#.*(?:\r?\n|$)/, "").trimStart();
-            continue;
-        }
-        if (normalized.startsWith("/*")) {
-            normalized = normalized.replace(/^\/\*[\s\S]*?\*\//, "").trimStart();
-            continue;
-        }
-        break;
-    }
-    return normalized;
-}
-function getSqlVerb(sql) {
-    const normalized = stripLeadingSqlComments(sql);
-    const match = normalized.match(/^([a-zA-Z]+)/);
-    return match ? match[1].toUpperCase() : "";
-}
 function isReadOnlySql(sql) {
-    const normalized = stripLeadingSqlComments(sql);
-    const verb = getSqlVerb(normalized);
+    const normalized = (0, sql_risk_js_1.stripLeadingSqlComments)(sql);
+    const verb = (0, sql_risk_js_1.getSqlVerb)(normalized);
     const readOnlyVerbs = new Set([
         "SELECT",
         "SHOW",
@@ -9136,27 +9148,16 @@ function isReadOnlySql(sql) {
     return !/\b(INSERT|UPDATE|DELETE|CREATE|ALTER|DROP|TRUNCATE|REPLACE|RENAME|GRANT|REVOKE|COMMENT|VACUUM|ANALYZE|FOR\s+UPDATE|FOR\s+SHARE)\b/i.test(normalized);
 }
 function buildLimitedReadOnlySql(sql, limit) {
-    const normalized = stripLeadingSqlComments(sql).replace(/;\s*$/, "");
-    const verb = getSqlVerb(normalized);
+    const normalized = (0, sql_risk_js_1.stripLeadingSqlComments)(sql).replace(/;\s*$/, "");
+    const verb = (0, sql_risk_js_1.getSqlVerb)(normalized);
     if (!["SELECT", "WITH", "VALUES"].includes(verb)) {
         return sql;
     }
     return `SELECT * FROM (${normalized}) AS cloudbase_mcp_readonly_limit LIMIT ${limit}`;
 }
-function isDestructiveSql(sql) {
-    const normalized = stripLeadingSqlComments(sql);
-    const verb = getSqlVerb(normalized);
-    if (["DROP", "TRUNCATE", "DELETE"].includes(verb)) {
-        return true;
-    }
-    if (verb === "ALTER") {
-        return /\b(DROP|RENAME)\b/i.test(normalized);
-    }
-    return false;
-}
 function classifySqlRisk(sql) {
-    const normalized = stripLeadingSqlComments(sql);
-    const verb = getSqlVerb(normalized);
+    const normalized = (0, sql_risk_js_1.stripLeadingSqlComments)(sql);
+    const verb = (0, sql_risk_js_1.getSqlVerb)(normalized);
     if (!verb) {
         return {
             risk: "unknown_risk",
@@ -9171,7 +9172,7 @@ function classifySqlRisk(sql) {
             requiresConfirm: false,
         };
     }
-    if (isDestructiveSql(normalized)) {
+    if ((0, sql_risk_js_1.isDestructiveSql)(normalized)) {
         return {
             risk: "destructive",
             readOnly: false,
@@ -9217,7 +9218,7 @@ function isSchemaDdlRisk(risk, sql) {
     if (risk !== "destructive") {
         return false;
     }
-    const verb = getSqlVerb(stripLeadingSqlComments(sql));
+    const verb = (0, sql_risk_js_1.getSqlVerb)((0, sql_risk_js_1.stripLeadingSqlComments)(sql));
     return ["DROP", "TRUNCATE", "ALTER"].includes(verb);
 }
 /**
@@ -9770,7 +9771,7 @@ function buildSchemaTable(schema, name) {
     return `${schema}.${name}`;
 }
 function parseTargetTableFromSql(sql, defaultSchema) {
-    const normalized = stripLeadingSqlComments(sql);
+    const normalized = (0, sql_risk_js_1.stripLeadingSqlComments)(sql);
     const identifier = String.raw `((?:[A-Za-z_][A-Za-z0-9_$]*\.)?[A-Za-z_][A-Za-z0-9_$]*)`;
     const patterns = [
         new RegExp(String.raw `\bcreate\s+(?:temporary\s+|temp\s+|unlogged\s+)?table\s+(?:if\s+not\s+exists\s+)?${identifier}`, "i"),
@@ -10177,7 +10178,7 @@ function renderParameterizedSql(sql, values) {
     });
 }
 function inferCommand(sql) {
-    return getSqlVerb(sql) || undefined;
+    return (0, sql_risk_js_1.getSqlVerb)(sql) || undefined;
 }
 function createManagerPgClient(context, cloudBaseOptions) {
     return {
@@ -10453,7 +10454,7 @@ async function handleExecuteSql(args, context, deps) {
         success: true,
         data: {
             classification,
-            command: result.command ?? getSqlVerb(args.sql),
+            command: result.command ?? (0, sql_risk_js_1.getSqlVerb)(args.sql),
             rowCount: result.rowCount ?? null,
             previewRows: result.rows
                 .slice(0, 5)
@@ -12549,6 +12550,474 @@ function registerSQLDatabaseTools(server) {
 }
 
 
+/***/ },
+
+/***/ 3668
+(__unused_webpack_module, exports, __webpack_require__) {
+
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.DEPLOY_ERROR_CODES = void 0;
+exports.registerDeployTools = registerDeployTools;
+const toolbox_1 = __webpack_require__(2090);
+const node_fs_1 = __importDefault(__webpack_require__(9627));
+const node_path_1 = __importDefault(__webpack_require__(5663));
+const zod_1 = __webpack_require__(2971);
+const cloudbase_manager_js_1 = __webpack_require__(3109);
+const json_content_js_1 = __webpack_require__(8027);
+const sql_risk_js_1 = __webpack_require__(9885);
+// 声明式部署可编排的资源类型，与 DeployOrchestrator 的部署顺序一致：
+// database → functions → app → hosting → gateway
+const RESOURCE_TYPES = ["database", "functions", "app", "hosting", "gateway"];
+/**
+ * 声明式部署工具的稳定错误码。供 agent 程序化分支处理，不随文案调整而变化。
+ * - CONFIG_NOT_FOUND：cwd 下未找到 cloudbaserc 配置文件
+ * - CONFIG_INVALID：配置未通过 cloudbaserc schema 校验
+ * - ENV_UNRESOLVED：无法确定目标环境 ID（配置/入参/登录态均缺失）
+ * - INVALID_CONCURRENCY：并发数入参非法
+ * - CONFIRM_REQUIRED：写操作未显式传 confirm=true
+ * - DESTRUCTIVE_CONFIRM_REQUIRED：待执行的数据库迁移含破坏性语句，需额外传 confirmDestructive=true
+ * - DEPLOY_FAILED：编排器执行失败或其它未分类错误（可能透传引擎 errorCode）
+ */
+exports.DEPLOY_ERROR_CODES = {
+    CONFIG_NOT_FOUND: "CONFIG_NOT_FOUND",
+    CONFIG_INVALID: "CONFIG_INVALID",
+    ENV_UNRESOLVED: "ENV_UNRESOLVED",
+    INVALID_CONCURRENCY: "INVALID_CONCURRENCY",
+    CONFIRM_REQUIRED: "CONFIRM_REQUIRED",
+    DESTRUCTIVE_CONFIRM_REQUIRED: "DESTRUCTIVE_CONFIRM_REQUIRED",
+    DEPLOY_FAILED: "DEPLOY_FAILED",
+};
+/**
+ * 携带稳定错误码的部署错误。抛出后由 buildErrorEnvelope 归一为信封的 errorCode 字段。
+ */
+class DeployError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "DeployError";
+        this.code = code;
+    }
+}
+function buildEnvelope(data, message) {
+    return { success: true, data, message };
+}
+function buildErrorEnvelope(error) {
+    // DeployError 带显式错误码；引擎/SDK 抛出的错误若带 code 也透传；其余归为 DEPLOY_FAILED。
+    let errorCode = exports.DEPLOY_ERROR_CODES.DEPLOY_FAILED;
+    if (error instanceof DeployError) {
+        errorCode = error.code;
+    }
+    else if (error &&
+        typeof error === "object" &&
+        "code" in error &&
+        typeof error.code === "string" &&
+        error.code.length > 0) {
+        errorCode = error.code;
+    }
+    return {
+        success: false,
+        data: {},
+        message: error instanceof Error ? error.message : String(error),
+        errorCode,
+    };
+}
+/**
+ * 解析 cloudbaserc 声明式部署配置。
+ *
+ * 分两步完成：
+ * 1. 定位并读取配置文件：searchConfig 从 cwd 探测 cloudbaserc.*（json/yaml/yml/js），
+ *    loadConfig 读取原始内容。读取阶段不强制 envId，
+ *    envId 由调用方按优先级单独确定，以支持用登录态环境部署未写死 envId 的配置。
+ * 2. ConfigParser.parseRawConfig：按 mode 合并 envOverrides、下发 functionDefaultConfig
+ *    到各函数、加载 .env / .env.local / .env.<mode> 并渲染 {{env.*}} / {{tcb.*}} 模板变量。
+ */
+async function resolveDeployConfig(options) {
+    const found = await (0, toolbox_1.searchConfig)(options.cwd);
+    if (!found?.filepath) {
+        throw new DeployError(exports.DEPLOY_ERROR_CODES.CONFIG_NOT_FOUND, `未在 ${options.cwd} 找到 cloudbaserc 配置文件（支持 json/yaml/yml/js）`);
+    }
+    const rawConfig = await (0, toolbox_1.loadConfig)({ configPath: found.filepath });
+    return toolbox_1.ConfigParser.parseRawConfig(rawConfig ?? {}, options.cwd, {
+        mode: options.mode,
+    });
+}
+/**
+ * 确定部署使用的环境 ID。
+ *
+ * 优先级：显式传入的 envId > 解析后配置中的 envId > MCP 登录态 / 绑定环境。
+ * 显式入参优先于配置文件，配置未写死 envId 时回退到当前会话绑定的环境。
+ * 三者都无则抛出错误。
+ */
+async function resolveDeployEnvId(options) {
+    if (options.envId && options.envId.length > 0) {
+        return options.envId;
+    }
+    const configEnvId = options.config.envId;
+    if (typeof configEnvId === "string" && configEnvId.length > 0) {
+        return configEnvId;
+    }
+    const resolved = await (0, cloudbase_manager_js_1.getEnvId)(options.cloudBaseOptions);
+    if (!resolved) {
+        throw new DeployError(exports.DEPLOY_ERROR_CODES.ENV_UNRESOLVED, "未能确定部署环境 ID：请在 cloudbaserc 配置 envId、通过 envId 参数指定，或先登录并绑定环境。");
+    }
+    return resolved;
+}
+/**
+ * 按 cloudbaserc schema 校验解析后的配置。
+ *
+ * 校验不通过时抛出错误，错误消息包含各字段的具体校验失败原因，供调用方定位问题。
+ */
+function assertConfigValid(config) {
+    const result = (0, toolbox_1.validateCloudBaseConfigBySchema)(config);
+    if (result.valid) {
+        return;
+    }
+    const detail = result.errors
+        .map((item) => `${item.dataPath || "<root>"} ${item.message}`)
+        .join("; ");
+    throw new DeployError(exports.DEPLOY_ERROR_CODES.CONFIG_INVALID, `cloudbaserc 配置校验未通过：${detail}`);
+}
+/**
+ * 校验并发数取值，非法时抛出错误。
+ *
+ * 未指定时返回 undefined（由编排器使用默认串行）；指定时必须为不小于 1 的整数。
+ */
+function normalizeConcurrency(concurrency) {
+    if (concurrency === undefined) {
+        return undefined;
+    }
+    if (!Number.isInteger(concurrency) || concurrency < 1) {
+        throw new DeployError(exports.DEPLOY_ERROR_CODES.INVALID_CONCURRENCY, `无效的并发数 ${concurrency}，应为不小于 1 的整数`);
+    }
+    return concurrency;
+}
+/**
+ * 让 deployPlan 的预演结论与 deployApply 的实际执行语义对齐。
+ *
+ * 背景：编排器把「云端已存在的函数」标为 status='update'，但 deployApply 在 yes!==true
+ * 且无交互确认回调时，会对 functions+update 保守跳过（reason='no-confirm'）。
+ * 若 plan 原样返回 update，agent 预演看到「会更新」，实际执行却「跳过」——结论相反。
+ *
+ * 此函数按传入的 yes 复算 functions+update 的「有效动作」：
+ * - yes===true：维持 update（执行时确实会覆盖）
+ * - 否则：改标为 skip，并保留原始判定到 declaredStatus，action 说明为何跳过。
+ * 其它资源类型与状态原样透传（database/app/hosting/gateway 的分类不受 yes 影响）。
+ */
+function reconcilePlanWithExecution(plan, yes) {
+    if (!Array.isArray(plan)) {
+        return [];
+    }
+    return plan.map((item) => {
+        if (!item || typeof item !== "object") {
+            return item;
+        }
+        if (item.type === "functions" && item.status === "update" && !yes) {
+            return {
+                ...item,
+                status: "skip",
+                declaredStatus: "update",
+                action: `已存在函数 ${item.name}：未传 yes=true，执行时将保守跳过（不覆盖）。传 yes=true 才会覆盖更新。`,
+            };
+        }
+        return item;
+    });
+}
+/**
+ * 解析 migrations 目录（与引擎 DatabaseDeployer.resolveMigrationsDir 同规则）：
+ * 未配置默认 ./cloudbase/migrations；仅允许相对路径（禁止绝对路径 / 开头）。
+ * 非法时返回 undefined（交由引擎在真正执行时抛出一致的错误，这里不抢报错）。
+ */
+function resolveMigrationsDir(cwd, migrations) {
+    const raw = typeof migrations === "string" && migrations ? migrations : "./cloudbase/migrations";
+    if (node_path_1.default.isAbsolute(raw) || raw.startsWith("/")) {
+        return undefined;
+    }
+    return node_path_1.default.resolve(cwd, raw);
+}
+/**
+ * 从 dry-run plan 中提取「待执行（pending）的数据库迁移标识」。
+ *
+ * 编排器把 database 计划聚合为单条 create 项，pending 迁移写在
+ * changes[].to（field==='migration'），形如 "{version}_{name}"。
+ * 只关注 pending：已 applied 的迁移不会被重复执行，不应触发破坏性确认门。
+ */
+function extractPendingMigrations(plan) {
+    const result = [];
+    for (const item of plan) {
+        if (!item || item.type !== "database" || item.status !== "create") {
+            continue;
+        }
+        const changes = item.changes;
+        if (!Array.isArray(changes)) {
+            continue;
+        }
+        for (const change of changes) {
+            if (change?.field === "migration" && typeof change.to === "string" && change.to) {
+                result.push(change.to);
+            }
+        }
+    }
+    return result;
+}
+/**
+ * 检测「本次将要执行的数据库迁移」中是否含破坏性语句（DROP/TRUNCATE/DELETE、
+ * ALTER ... DROP/RENAME）。
+ *
+ * 仅扫描 pending 迁移对应的本地 .sql 文件；已 applied 的不扫描，避免误拦。
+ * 读文件失败（缺文件/目录非法）视为无法确认破坏性，返回空——真正的存在性/
+ * 格式校验交由引擎执行时处理，这里只在能确证破坏性时加门，避免与引擎报错重复。
+ */
+function detectDestructiveMigrations(options) {
+    const pending = extractPendingMigrations(options.plan);
+    if (pending.length === 0) {
+        return [];
+    }
+    const dbConfig = options.databaseConfig && typeof options.databaseConfig === "object"
+        ? options.databaseConfig
+        : undefined;
+    const migrationsDir = resolveMigrationsDir(options.cwd, dbConfig?.migrations);
+    if (!migrationsDir) {
+        return [];
+    }
+    const hits = [];
+    for (const migration of pending) {
+        const file = node_path_1.default.join(migrationsDir, `${migration}.sql`);
+        let sqlText;
+        try {
+            sqlText = node_fs_1.default.readFileSync(file, "utf-8");
+        }
+        catch {
+            // 文件读不到：不在此处报错，交给引擎执行时给出一致错误
+            continue;
+        }
+        const statements = (0, sql_risk_js_1.findDestructiveStatements)(sqlText);
+        if (statements.length > 0) {
+            hits.push({ migration, file, statements });
+        }
+    }
+    return hits;
+}
+function registerDeployTools(server) {
+    const cloudBaseOptions = server.cloudBaseOptions;
+    const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
+    // 工具一：deployPlan —— 只读，预演部署计划（dry-run）
+    server.registerTool?.("deployPlan", {
+        title: "预演 CloudBase 声明式部署计划",
+        description: "解析 cloudbaserc 并计算声明式部署计划（dry-run，不产生任何变更）。" +
+            "这是 deployApply 的预演对仗工具：plan 计算、deployApply 执行同一份 cloudbaserc。" +
+            "返回每个资源的动作分类：create=新建，update=覆盖更新，skip=无变更/不会执行，" +
+            "conflict=检测到冲突需中断，deploy=直传覆盖。" +
+            "计划已按 yes 复算为「实际会发生的动作」：不传 yes=true 时，云端已存在的函数会标为 skip" +
+            "（并在 declaredStatus 保留 update），与 deployApply 的实际执行结果一致，避免预演与执行相反。" +
+            "\n适用边界：本工具用于项目级声明式编排（一份 cloudbaserc 统一 plan/apply）；" +
+            "单资源临时直传请用 manageFunctions/manageHosting/manageApps。" +
+            "\n- cwd：项目根目录，默认当前工作目录" +
+            "\n- mode：环境名，命中 envOverrides.<mode> 时合并对应的多环境覆盖配置" +
+            "\n- envId：目标环境 ID，优先级高于 cloudbaserc 中的 envId；不传则用配置值或当前绑定环境" +
+            "\n- only：仅计算指定资源类型的计划" +
+            "\n- skip：跳过指定资源类型" +
+            "\n- yes：与 deployApply 的 yes 对齐，用于复算已存在函数的有效动作。" +
+            "true=预演为覆盖更新(update)；false（默认）=预演为保守跳过(skip)",
+        inputSchema: {
+            cwd: zod_1.z
+                .string()
+                .optional()
+                .describe("项目根目录，从此目录向下搜索 cloudbaserc；默认当前工作目录"),
+            mode: zod_1.z
+                .string()
+                .optional()
+                .describe("环境名（如 production/staging），命中 envOverrides.<mode> 时合并覆盖"),
+            envId: zod_1.z
+                .string()
+                .optional()
+                .describe("目标环境 ID，优先级高于 cloudbaserc 中的 envId；不传则用配置值或当前绑定环境"),
+            only: zod_1.z
+                .array(zod_1.z.enum(RESOURCE_TYPES))
+                .optional()
+                .describe("仅计算指定资源类型的计划，可选值：database/functions/app/hosting/gateway"),
+            skip: zod_1.z
+                .array(zod_1.z.enum(RESOURCE_TYPES))
+                .optional()
+                .describe("跳过指定资源类型，可选值：database/functions/app/hosting/gateway"),
+            yes: zod_1.z
+                .boolean()
+                .optional()
+                .describe("与 deployApply 的 yes 对齐，用于复算已存在函数的有效动作。" +
+                "true=预演为覆盖更新；false（默认）=预演为保守跳过"),
+        },
+        annotations: {
+            readOnlyHint: true,
+            openWorldHint: true,
+            category: "deploy",
+        },
+    }, async ({ cwd, mode, envId: envIdInput, only, skip, yes, }) => {
+        try {
+            const projectRoot = cwd ?? process.cwd();
+            const config = await resolveDeployConfig({ cwd: projectRoot, mode });
+            assertConfigValid(config);
+            const envId = await resolveDeployEnvId({
+                envId: envIdInput,
+                config,
+                cloudBaseOptions,
+            });
+            const manager = await getManager();
+            const rawPlan = await manager.getDeployOrchestrator().deployPlan({
+                config,
+                envId,
+                cwd: projectRoot,
+                only,
+                skip,
+                dryRun: true,
+            });
+            // 按 yes 复算为「实际会发生的动作」，使预演与 deployApply 的执行结果一致
+            const plan = reconcilePlanWithExecution(rawPlan, yes === true);
+            return (0, json_content_js_1.jsonContent)(buildEnvelope({ cwd: projectRoot, mode: mode ?? null, envId, yes: yes === true, plan }, "已生成声明式部署计划"));
+        }
+        catch (error) {
+            return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(error));
+        }
+    });
+    // 工具二：deployApply —— 写操作，执行声明式部署（本地形态的 apply，与 deployPlan 对仗）
+    server.registerTool?.("deployApply", {
+        title: "执行 CloudBase 声明式部署（本地 apply）",
+        description: "解析 cloudbaserc 并按 database→functions→app→hosting→gateway 顺序执行声明式部署。" +
+            "这是 deployPlan 的执行对仗工具（plan 预演 / deployApply 执行同一份 cloudbaserc），" +
+            "属于本地形态的 apply（读本地 cloudbaserc 并在本地构建上传），" +
+            "是会变更云端资源的写操作，必须显式传 confirm=true 才会执行。" +
+            "建议先用 deployPlan 预演，确认计划无误后再执行。" +
+            "\n适用边界：本工具用于项目级声明式编排（一份 cloudbaserc 统一 plan/apply）；" +
+            "单资源临时直传请用 manageFunctions/manageHosting/manageApps。" +
+            "\n- confirm：必须显式传 true 才执行部署，否则直接拒绝" +
+            "\n- confirmDestructive：当本次待执行的数据库迁移含破坏性语句（DROP/TRUNCATE/DELETE、" +
+            "ALTER…DROP/RENAME）时，除 confirm 外还必须显式传 confirmDestructive=true 才会执行；" +
+            "否则拒绝并列出命中的迁移与语句。无破坏性迁移时该参数不生效" +
+            "\n- cwd：项目根目录，默认当前工作目录" +
+            "\n- mode：环境名，命中 envOverrides.<mode> 时合并对应的多环境覆盖配置" +
+            "\n- envId：目标环境 ID，优先级高于 cloudbaserc 中的 envId；不传则用配置值或当前绑定环境" +
+            "\n- only：仅部署指定资源类型" +
+            "\n- skip：跳过指定资源类型" +
+            "\n- yes：遇到已存在资源时的处理方式。true=直接覆盖更新；false（默认）=保守跳过，" +
+            "在无法交互确认的场景下已存在资源不会被覆盖（与 deployPlan 的 yes 语义一致）" +
+            "\n- concurrency：同类型资源最大并行数，默认 1（串行）" +
+            "\n- continueOnError：某个资源失败后继续部署其余资源（database 失败仍强制中断）",
+        inputSchema: {
+            confirm: zod_1.z
+                .boolean()
+                .optional()
+                .describe("危险操作确认开关。部署会变更云端资源，必须显式传 confirm=true 才会执行"),
+            confirmDestructive: zod_1.z
+                .boolean()
+                .optional()
+                .describe("破坏性数据库变更确认开关。当待执行迁移含 DROP/TRUNCATE/DELETE 或 ALTER…DROP/RENAME 时，" +
+                "必须在 confirm=true 之外额外显式传 confirmDestructive=true；无破坏性迁移时不生效"),
+            cwd: zod_1.z
+                .string()
+                .optional()
+                .describe("项目根目录，从此目录向下搜索 cloudbaserc；默认当前工作目录"),
+            mode: zod_1.z
+                .string()
+                .optional()
+                .describe("环境名（如 production/staging），命中 envOverrides.<mode> 时合并覆盖"),
+            envId: zod_1.z
+                .string()
+                .optional()
+                .describe("目标环境 ID，优先级高于 cloudbaserc 中的 envId；不传则用配置值或当前绑定环境"),
+            only: zod_1.z
+                .array(zod_1.z.enum(RESOURCE_TYPES))
+                .optional()
+                .describe("仅部署指定资源类型，可选值：database/functions/app/hosting/gateway"),
+            skip: zod_1.z
+                .array(zod_1.z.enum(RESOURCE_TYPES))
+                .optional()
+                .describe("跳过指定资源类型，可选值：database/functions/app/hosting/gateway"),
+            yes: zod_1.z
+                .boolean()
+                .optional()
+                .describe("遇到已存在资源时是否直接覆盖更新。true=覆盖；false（默认）=保守跳过已存在资源"),
+            concurrency: zod_1.z
+                .number()
+                .int()
+                .min(1)
+                .optional()
+                .describe("同类型资源最大并行数，默认 1（串行）；仅作用于同类型资源，跨类型依赖顺序不变"),
+            continueOnError: zod_1.z
+                .boolean()
+                .optional()
+                .describe("某个资源失败后是否继续部署其余资源；database 失败始终强制中断"),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            openWorldHint: true,
+            category: "deploy",
+        },
+    }, async ({ confirm, confirmDestructive, cwd, mode, envId: envIdInput, only, skip, yes, concurrency, continueOnError, }) => {
+        try {
+            if (confirm !== true) {
+                throw new DeployError(exports.DEPLOY_ERROR_CODES.CONFIRM_REQUIRED, "部署会变更云端资源，必须显式传 confirm=true 才会执行。" +
+                    "建议先用 deployPlan 预演部署计划，确认无误后再执行。");
+            }
+            const projectRoot = cwd ?? process.cwd();
+            const config = await resolveDeployConfig({ cwd: projectRoot, mode });
+            assertConfigValid(config);
+            const envId = await resolveDeployEnvId({
+                envId: envIdInput,
+                config,
+                cloudBaseOptions,
+            });
+            const manager = await getManager();
+            const orchestrator = manager.getDeployOrchestrator();
+            // 破坏性数据库变更门：仅当 database 参与本次部署时，先 dry-run 取 pending 迁移，
+            // 检测破坏性语句；命中且未额外确认则拒绝，独立于总 confirm 之外多一道门。
+            const databaseParticipates = !!config.database &&
+                (!only || only.includes("database")) &&
+                !(skip ?? []).includes("database");
+            if (databaseParticipates && confirmDestructive !== true) {
+                const dryRunPlan = await orchestrator.deployPlan({
+                    config,
+                    envId,
+                    cwd: projectRoot,
+                    only,
+                    skip,
+                    dryRun: true,
+                });
+                const destructive = detectDestructiveMigrations({
+                    plan: Array.isArray(dryRunPlan) ? dryRunPlan : [],
+                    cwd: projectRoot,
+                    databaseConfig: config.database,
+                });
+                if (destructive.length > 0) {
+                    throw new DeployError(exports.DEPLOY_ERROR_CODES.DESTRUCTIVE_CONFIRM_REQUIRED, "本次待执行的数据库迁移包含破坏性语句（DROP/TRUNCATE/DELETE 或 ALTER…DROP/RENAME），" +
+                        "可能造成数据/结构不可逆丢失。请先备份或复核，确认后额外传 confirmDestructive=true 再执行。" +
+                        "命中迁移：" +
+                        destructive
+                            .map((d) => `${d.migration}（${d.statements.length} 条破坏性语句）`)
+                            .join("；"));
+                }
+            }
+            const result = await orchestrator.deploy({
+                config,
+                envId,
+                cwd: projectRoot,
+                only,
+                skip,
+                yes: yes === true,
+                concurrency: normalizeConcurrency(concurrency),
+                continueOnError,
+            });
+            return (0, json_content_js_1.jsonContent)(buildEnvelope({ cwd: projectRoot, mode: mode ?? null, envId, result }, "声明式部署已执行"));
+        }
+        catch (error) {
+            return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(error));
+        }
+    });
+}
+
+
 /***/ },
 
 /***/ 7528
@@ -14652,7 +15121,7 @@ function registerEnvTools(server) {
                         oauthCustom: zod_1.z
                             .boolean()
                             .optional()
-                            .describe("高级可选：自定义 endpoint 返回格式开关。未配置 endpoint 时默认 false；配置 endpoint 后默认 true，且不能设为 false"),
+                            .describe("高级可选：自定义 endpoint 返回格式开关。未配置 endpoint 时默认 false；配置 endpoint 后默认 true。标准 {code,result} 包装格式的端点（如国际站 tcb-api.tencentcloud.com）应显式传 false"),
                     }
                     : {}),
                 envId: zod_1.z
@@ -14897,19 +15366,15 @@ function registerEnvTools(server) {
                             }
                         };
                         try {
-                            // 启动 Device Flow，全流程由 toolbox 负责轮询和写入 credential，这里不等待完成
+                            // 启动 Device Flow，全流程由 toolbox 负责轮询和写入 credential，这里不等待完成。
+                            // 登录参数（含 TCB_SITE=intl 端点覆写与授权页改写）与 ensureLogin 共享同一 helper，
+                            // 避免此直连路径绕过国际站改写导致国际站账号拿到的仍是国内站链接
                             auth
                                 .loginByWebAuth({
-                                flow: "device",
-                                ...(resolvedAuthOptions.clientId
-                                    ? { client_id: resolvedAuthOptions.clientId }
-                                    : {}),
-                                ...(resolvedAuthOptions.oauthEndpoint
-                                    ? { getOAuthEndpoint: () => resolvedAuthOptions.oauthEndpoint }
-                                    : {}),
-                                ...(resolvedAuthOptions.oauthCustom
-                                    ? { custom: true }
-                                    : {}),
+                                ...(0, auth_js_1.buildDeviceLoginOptions)(resolvedAuthOptions, {
+                                    region,
+                                    site: server.cloudBaseOptions?.site,
+                                }),
                                 onDeviceCode: deviceOnCode,
                             })
                                 .then(async () => {
@@ -24802,7 +25267,7 @@ function registerSetupTools(server) {
     server.registerTool("downloadTemplate", {
         title: "下载项目模板",
         description: `自动下载并部署CloudBase项目模板。
-**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.33.0" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
+**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.33.2" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
         inputSchema: {
             template: zod_1.z
                 .enum(["react", "vue", "miniprogram", "uniapp", "rules"])
@@ -25778,6 +26243,7 @@ function registerPGStorageTools(server) {
 
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.CLOUD_INCOMPATIBLE_ACTION_LEVEL_EXCEPTIONS = exports.CLOUD_INCOMPATIBLE_TOOLS = void 0;
 exports.isCloudMode = isCloudMode;
 exports.enableCloudMode = enableCloudMode;
 exports.getCloudModeStatus = getCloudModeStatus;
@@ -25823,6 +26289,65 @@ function getCloudModeStatus() {
     }
     return { enabled: false, source: null };
 }
+/**
+ * Tools that are incompatible with cloud mode because they read from or write to
+ * the local filesystem (uploads, downloads, config files, or building an upload
+ * artifact from `process.cwd()`). In cloud mode these top-level tools are not
+ * registered at all; where a tool has both cloud-safe and local-only actions,
+ * gating happens at the action level inside the tool instead (see
+ * `ensureActionAllowedInCloudMode` in functions.ts / hosting.ts).
+ *
+ * IMPORTANT: keep this list in sync with the tools actually registered. Entries
+ * that no longer match a registered tool name are dead (they silently gate
+ * nothing). `CLOUD_INCOMPATIBLE_TOOLS.test.ts` asserts every entry here maps to
+ * a known tool or a documented action-level exception to prevent silent rot.
+ */
+exports.CLOUD_INCOMPATIBLE_TOOLS = [
+    // Auth tools - local file uploads
+    'auth',
+    // Storage tools - local file uploads / downloads.
+    // NOTE: `uploadFile` is not a top-level tool name (storage upload is exposed
+    // via `manageStorage`); kept here as a documented action-level exception.
+    'uploadFile',
+    'manageStorage',
+    // Function tools - local code uploads.
+    // NOTE: createFunction / updateFunctionCode are now actions of `manageFunctions`,
+    // not top-level tools, so gating them here is a no-op kept for documentation.
+    // The real cloud-mode guard for those actions lives in
+    // functions.ts#ensureActionAllowedInCloudMode. Left here intentionally so the
+    // sync test flags them as "action-level exceptions" rather than removing the
+    // record of why they are not top-level tools.
+    'updateFunctionCode',
+    'createFunction',
+    // Declarative deploy tools - read local cloudbaserc and build the upload
+    // artifact from cwd (process.cwd() when no cwd is passed). Same class as the
+    // function/upload tools above: they have no meaning without a local project.
+    'deployApply',
+    'deployPlan',
+    // Download tools - local file downloads
+    'downloadTemplate',
+    // Setup tools - local config file operations.
+    // NOTE: `setupEnvironmentId` is not a top-level tool name; kept as a documented
+    // action-level exception (env binding is handled via `auth`/setup flows).
+    'setupEnvironmentId',
+    // CloudRun tools - local file operations
+    'manageCloudRun',
+    // manageApps is intentionally NOT listed: deployApp with localPath/filePath is
+    // blocked per-action in apps.ts (CLOUD_MODE_UNSUPPORTED_ACTION) so cloud mode
+    // can still use getUploadUrl + cosTimestamp, deleteApp, and deleteAppVersion.
+];
+/**
+ * Tool names that appear in CLOUD_INCOMPATIBLE_TOOLS for documentation but are no
+ * longer registered as top-level tools (their cloud gating is enforced at the
+ * action level instead). The sync test treats these as expected, everything else
+ * must resolve to a registered tool.
+ */
+exports.CLOUD_INCOMPATIBLE_ACTION_LEVEL_EXCEPTIONS = [
+    'createFunction',
+    'updateFunctionCode',
+    'uploadFile',
+    'setupEnvironmentId',
+];
 /**
  * Check if a tool should be registered in cloud mode
  * @param toolName - The name of the tool
@@ -25833,29 +26358,7 @@ function shouldRegisterTool(toolName) {
     if (!isCloudMode()) {
         return true;
     }
-    // Cloud-incompatible tools that involve local file operations
-    const cloudIncompatibleTools = [
-        // Auth tools - local file uploads
-        'auth',
-        // Storage tools - local file uploads
-        'uploadFile',
-        // Hosting tools - action-level cloud gating is handled inside manageHosting
-        // Function tools - local code uploads
-        'updateFunctionCode',
-        'createFunction', // also involves local files
-        // Download tools - local file downloads
-        'downloadTemplate',
-        // Setup tools - local config file operations
-        'setupEnvironmentId',
-        // CloudRun tools - local file operations
-        'manageCloudRun',
-        // Download tools - local file downloads
-        'manageStorage',
-        // manageApps is intentionally NOT listed: deployApp with localPath/filePath is
-        // blocked per-action in apps.ts (CLOUD_MODE_UNSUPPORTED_ACTION) so cloud mode
-        // can still use getUploadUrl + cosTimestamp, deleteApp, and deleteAppVersion.
-    ];
-    return !cloudIncompatibleTools.includes(toolName);
+    return !exports.CLOUD_INCOMPATIBLE_TOOLS.includes(toolName);
 }
 
 
@@ -27013,6 +27516,163 @@ function resolveSiteAndRegion(opts = {}) {
 }
 
 
+/***/ },
+
+/***/ 9885
+(__unused_webpack_module, exports) {
+
+var __webpack_unused_export__;
+
+/**
+ * Shared SQL risk heuristics.
+ *
+ * Extracted from databasePG.ts so both the interactive PG execute path and the
+ * declarative deploy path classify destructive SQL with the *same* rules,
+ * avoiding drift between two independent detectors.
+ *
+ * These are conservative lexical heuristics, not a full SQL parser: they strip
+ * leading comments, read the leading verb, and match destructive keywords. They
+ * are meant to decide whether an *extra* human confirmation is warranted, not to
+ * be a security boundary.
+ */
+__webpack_unused_export__ = ({ value: true });
+exports.stripLeadingSqlComments = stripLeadingSqlComments;
+exports.getSqlVerb = getSqlVerb;
+exports.isDestructiveSql = isDestructiveSql;
+__webpack_unused_export__ = splitSqlStatements;
+exports.findDestructiveStatements = findDestructiveStatements;
+/** Strip leading line (`--`, `#`) and block (`/* *​/`) comments and whitespace. */
+function stripLeadingSqlComments(sql) {
+    let normalized = sql.trim();
+    while (normalized.length > 0) {
+        if (normalized.startsWith("--")) {
+            normalized = normalized.replace(/^--.*(?:\r?\n|$)/, "").trimStart();
+            continue;
+        }
+        if (normalized.startsWith("#")) {
+            normalized = normalized.replace(/^#.*(?:\r?\n|$)/, "").trimStart();
+            continue;
+        }
+        if (normalized.startsWith("/*")) {
+            normalized = normalized.replace(/^\/\*[\s\S]*?\*\//, "").trimStart();
+            continue;
+        }
+        break;
+    }
+    return normalized;
+}
+/** Return the leading SQL verb (uppercased), ignoring leading comments. */
+function getSqlVerb(sql) {
+    const normalized = stripLeadingSqlComments(sql);
+    const match = normalized.match(/^([a-zA-Z]+)/);
+    return match ? match[1].toUpperCase() : "";
+}
+/**
+ * Whether a *single* SQL statement is destructive (drops/truncates data or
+ * removes/renames schema objects).
+ */
+function isDestructiveSql(sql) {
+    const normalized = stripLeadingSqlComments(sql);
+    const verb = getSqlVerb(normalized);
+    if (["DROP", "TRUNCATE", "DELETE"].includes(verb)) {
+        return true;
+    }
+    if (verb === "ALTER") {
+        return /\b(DROP|RENAME)\b/i.test(normalized);
+    }
+    return false;
+}
+/**
+ * Split a possibly multi-statement SQL script into individual statements.
+ *
+ * Naive split on `;` at statement boundaries, but aware of single/double quotes,
+ * line/block comments, and PostgreSQL dollar-quoted strings ($$ ... $$ or
+ * $tag$ ... $tag$) so semicolons inside string bodies / function definitions do
+ * not split a statement. Good enough for the conservative destructive scan; not
+ * a full parser.
+ */
+function splitSqlStatements(sqlText) {
+    const statements = [];
+    let current = "";
+    let i = 0;
+    const n = sqlText.length;
+    while (i < n) {
+        const ch = sqlText[i];
+        const next = sqlText[i + 1];
+        // line comment -- ... (to end of line)
+        if (ch === "-" && next === "-") {
+            const end = sqlText.indexOf("\n", i);
+            const stop = end === -1 ? n : end + 1;
+            current += sqlText.slice(i, stop);
+            i = stop;
+            continue;
+        }
+        // block comment /* ... */
+        if (ch === "/" && next === "*") {
+            const end = sqlText.indexOf("*/", i + 2);
+            const stop = end === -1 ? n : end + 2;
+            current += sqlText.slice(i, stop);
+            i = stop;
+            continue;
+        }
+        // single- or double-quoted string
+        if (ch === "'" || ch === '"') {
+            const quote = ch;
+            current += ch;
+            i += 1;
+            while (i < n) {
+                current += sqlText[i];
+                // handle escaped quote by doubling ('' or "")
+                if (sqlText[i] === quote) {
+                    if (sqlText[i + 1] === quote) {
+                        current += sqlText[i + 1];
+                        i += 2;
+                        continue;
+                    }
+                    i += 1;
+                    break;
+                }
+                i += 1;
+            }
+            continue;
+        }
+        // dollar-quoted string: $$ ... $$ or $tag$ ... $tag$
+        if (ch === "$") {
+            const tagMatch = sqlText.slice(i).match(/^\$([a-zA-Z_][a-zA-Z0-9_]*)?\$/);
+            if (tagMatch) {
+                const tag = tagMatch[0];
+                const end = sqlText.indexOf(tag, i + tag.length);
+                const stop = end === -1 ? n : end + tag.length;
+                current += sqlText.slice(i, stop);
+                i = stop;
+                continue;
+            }
+        }
+        if (ch === ";") {
+            if (current.trim().length > 0) {
+                statements.push(current.trim());
+            }
+            current = "";
+            i += 1;
+            continue;
+        }
+        current += ch;
+        i += 1;
+    }
+    if (current.trim().length > 0) {
+        statements.push(current.trim());
+    }
+    return statements;
+}
+/**
+ * Scan a (possibly multi-statement) SQL script and return the destructive
+ * statements found. Empty array means no destructive statement detected.
+ */
+function findDestructiveStatements(sqlText) {
+    return splitSqlStatements(sqlText).filter((stmt) => isDestructiveSql(stmt));
+}
+
+
 /***/ },
 
 /***/ 5198
@@ -27026,12 +27686,14 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.reportToolkitLifecycle = exports.reportToolCall = exports.telemetryReporter = void 0;
 exports.extractMcpClientInfo = extractMcpClientInfo;
 exports.readMcpClientInfoFromServer = readMcpClientInfoFromServer;
+exports.normalizeClientName = normalizeClientName;
 const crypto_1 = __importDefault(__webpack_require__(7823));
 const http_1 = __importDefault(__webpack_require__(3782));
 const https_1 = __importDefault(__webpack_require__(3871));
 const os_1 = __importDefault(__webpack_require__(8116));
 const cloudbase_manager_js_1 = __webpack_require__(3109);
 const logger_js_1 = __webpack_require__(781);
+const site_map_js_1 = __webpack_require__(4533);
 /**
  * 数据上报类
  * 用于收集 MCP 工具使用情况和错误信息，帮助改进产品
@@ -27061,6 +27723,12 @@ class TelemetryReporter {
             this.addAdditionalParams({ ide: process.env.INTEGRATION_IDE });
             (0, logger_js_1.debug)('检测到 IDE 集成环境', { ide: process.env.INTEGRATION_IDE });
         }
+        // 检查 CLOUDBASE_MCP_CLIENT 环境变量（hosted 场景由上游解析真实 MCP client 后注入）
+        const envClient = normalizeClientName(process.env.CLOUDBASE_MCP_CLIENT);
+        if (envClient) {
+            this.addAdditionalParams({ client: envClient });
+            (0, logger_js_1.debug)('检测到 MCP client 标识', { client: envClient });
+        }
         (0, logger_js_1.debug)('report_init', {
             enabled: this.enabled,
             deviceId: this.deviceId.substring(0, 8) + '...',
@@ -27078,7 +27746,7 @@ class TelemetryReporter {
         const arch = os_1.default.arch(); // 系统架构
         // Build-time injected version; guard for vitest / non-webpack runtimes.
         const mcpVersion = process.env.npm_package_version ||
-            ( true ? "2.33.0" : 0);
+            ( true ? "2.33.2" : 0);
         return {
             userAgent: `${osType} ${osRelease} ${arch} ${nodeVersion} CloudBase-MCP/${mcpVersion}`,
             deviceId: this.deviceId,
@@ -27289,6 +27957,58 @@ function readMcpClientInfoFromServer(server) {
         return {};
     }
 }
+/**
+ * Normalize upstream-provided client identifier into a telemetry-safe token:
+ * trim + lowercase + keep [a-z0-9-_] only + cap at 64 chars.
+ * Canonical mapping (cursor-vscode -> cursor etc.) is the upstream's responsibility;
+ * we only sanitize. Returns undefined when nothing usable remains.
+ */
+function normalizeClientName(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const cleaned = value
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9_-]/g, "")
+        .slice(0, 64);
+    return cleaned || undefined;
+}
+// 进程内缓存 site/region 解析结果（resolveSiteAndRegion 会读项目配置文件，避免每次工具调用都走 IO）
+let cachedSiteRegion = null;
+/**
+ * Resolve region/site for telemetry.
+ * Priority: cloudBaseOptions（会话实际使用值）> resolveSiteAndRegion（env/项目配置解析，进程内缓存）。
+ * 失败时降级 unknown，绝不影响工具调用主链路。
+ */
+function resolveTelemetrySiteRegion(cloudBaseOptions) {
+    const explicitRegion = cloudBaseOptions?.region;
+    const explicitSite = (0, site_map_js_1.normalizeSite)(cloudBaseOptions?.site);
+    try {
+        if (!cachedSiteRegion) {
+            const resolved = (0, site_map_js_1.resolveSiteAndRegion)();
+            cachedSiteRegion = { site: resolved.site, region: resolved.region };
+        }
+        return {
+            region: explicitRegion || cachedSiteRegion.region,
+            site: explicitSite || cachedSiteRegion.site,
+        };
+    }
+    catch (err) {
+        (0, logger_js_1.debug)('解析 site/region 失败，遥测使用 unknown', err instanceof Error ? err : new Error(String(err)));
+        return {
+            region: explicitRegion || 'unknown',
+            site: explicitSite || 'unknown',
+        };
+    }
+}
+/**
+ * Resolve MCP client identifier for a single report:
+ * explicit param (server.client) > CLOUDBASE_MCP_CLIENT env (hosted upstream injection).
+ */
+function resolveClientName(explicit) {
+    return normalizeClientName(explicit || process.env.CLOUDBASE_MCP_CLIENT);
+}
 function appendMcpClientInfoFields(eventData, clientInfo) {
     if (!clientInfo) {
         return;
@@ -27308,6 +28028,7 @@ const reportToolCall = async (params) => {
     const { nodeVersion, osType, osRelease, arch, mcpVersion } = exports.telemetryReporter.getUserAgent();
     // 安全获取环境ID，优先使用传入的配置
     const { envId, envIdSource } = resolveEnvId(params.cloudBaseOptions);
+    const siteRegion = resolveTelemetrySiteRegion(params.cloudBaseOptions);
     (0, logger_js_1.debug)('[telemetry] 工具调用 envId 获取结果', {
         toolName: params.toolName,
         envId,
@@ -27323,6 +28044,8 @@ const reportToolCall = async (params) => {
         duration: params.duration !== undefined ? String(params.duration) : undefined,
         error: params.error ? params.error.substring(0, 200) : undefined, // 限制错误信息长度
         envId: envId || 'unknown',
+        region: siteRegion.region,
+        site: siteRegion.site,
         nodeVersion,
         osType,
         osRelease,
@@ -27347,6 +28070,11 @@ const reportToolCall = async (params) => {
     if (params.ide) {
         eventData.ide = params.ide;
     }
+    // 添加 MCP client 标识（如果提供）
+    const client = resolveClientName(params.client);
+    if (client) {
+        eventData.client = client;
+    }
     appendMcpClientInfoFields(eventData, params.mcpClientInfo);
     // Debug: 打印最终上报参数
     (0, logger_js_1.debug)('[telemetry] 工具调用上报参数', {
@@ -27366,6 +28094,7 @@ const reportToolkitLifecycle = async (params) => {
     const { nodeVersion, osType, osRelease, arch, mcpVersion } = exports.telemetryReporter.getUserAgent();
     // 安全获取环境ID，优先使用传入的配置
     const { envId, envIdSource } = resolveEnvId(params.cloudBaseOptions);
+    const siteRegion = resolveTelemetrySiteRegion(params.cloudBaseOptions);
     (0, logger_js_1.debug)('[telemetry] 生命周期事件 envId 获取结果', {
         event: params.event,
         envId,
@@ -27380,6 +28109,8 @@ const reportToolkitLifecycle = async (params) => {
         exitCode: params.exitCode !== undefined ? String(params.exitCode) : undefined,
         error: params.error ? params.error.substring(0, 200) : undefined, // 限制错误信息长度
         envId: envId || 'unknown',
+        region: siteRegion.region,
+        site: siteRegion.site,
         nodeVersion,
         osType,
         osRelease,
@@ -27390,6 +28121,11 @@ const reportToolkitLifecycle = async (params) => {
     if (params.ide) {
         eventData.ide = params.ide;
     }
+    // 添加 MCP client 标识（如果提供）
+    const lifecycleClient = resolveClientName(params.client);
+    if (lifecycleClient) {
+        eventData.client = lifecycleClient;
+    }
     appendMcpClientInfoFields(eventData, params.mcpClientInfo);
     // Debug: 打印最终上报参数
     (0, logger_js_1.debug)('[telemetry] 生命周期事件上报参数', {
@@ -27602,7 +28338,7 @@ ${envIdSection}
 ## 环境信息
 - 操作系统: ${os_1.default.type()} ${os_1.default.release()}
 - Node.js版本: ${process.version}
-- MCP 版本：${process.env.npm_package_version || ( true ? "2.33.0" : 0)}
+- MCP 版本：${process.env.npm_package_version || ( true ? "2.33.2" : 0)}
 - 系统架构: ${os_1.default.arch()}
 - 时间: ${new Date().toISOString()}
 - 请求ID: ${requestId}
@@ -27691,7 +28427,7 @@ function createWrappedHandler(name, handler, server) {
                 requestId,
                 ide: server.ide || process.env.INTEGRATION_IDE || ''
             });
-            const mcpVersion =  true ? "2.33.0" : 0;
+            const mcpVersion =  true ? "2.33.2" : 0;
             const requestIdSuffix = requestId ? `\n🆔 RequestId: ${requestId}` : '';
             const enhancedErrorMessage = `${errorMessage}${requestIdSuffix}\n\n📦 CloudBase MCP v${mcpVersion}\n🔗 遇到问题？请复制以下链接到浏览器打开\n即可自动携带错误详情快速创建 GitHub Issue：\n${issueLink}`;
             // 创建新的错误对象，保持原有的错误类型但更新消息
@@ -27729,6 +28465,7 @@ function createWrappedHandler(name, handler, server) {
                     inputParams: sanitizeArgs(args), // 添加入参上报
                     cloudBaseOptions: cloudBaseOptions, // 传递 CloudBase 配置（可能已更新）
                     ide: server.ide || process.env.INTEGRATION_IDE, // 传递集成IDE信息
+                    client: server.client || process.env.CLOUDBASE_MCP_CLIENT, // 传递 MCP client 来源标识
                     mcpClientInfo: (0, telemetry_js_1.readMcpClientInfoFromServer)(server),
                 }).catch(err => {
                     // 静默处理上报错误，不影响主要功能
@@ -27859,7 +28596,7 @@ var x = (y) => {
 	var x = {}; __webpack_require__.d(x, y); return x
 } 
 var y = (x) => (() => (x))
-module.exports = x({ ["AuthSupervisor"]: () => (__WEBPACK_EXTERNAL_MODULE__cloudbase_toolbox_034e5bd0__.AuthSupervisor), ["authStore"]: () => (__WEBPACK_EXTERNAL_MODULE__cloudbase_toolbox_034e5bd0__.authStore), ["loadEnvVariables"]: () => (__WEBPACK_EXTERNAL_MODULE__cloudbase_toolbox_034e5bd0__.loadEnvVariables), ["refreshTmpToken"]: () => (__WEBPACK_EXTERNAL_MODULE__cloudbase_toolbox_034e5bd0__.refreshTmpToken), ["resolveCredential"]: () => (__WEBPACK_EXTERNAL_MODULE__cloudbase_toolbox_034e5bd0__.resolveCredential) });
+module.exports = x({ ["AuthSupervisor"]: () => (__WEBPACK_EXTERNAL_MODULE__cloudbase_toolbox_034e5bd0__.AuthSupervisor), ["ConfigParser"]: () => (__WEBPACK_EXTERNAL_MODULE__cloudbase_toolbox_034e5bd0__.ConfigParser), ["authStore"]: () => (__WEBPACK_EXTERNAL_MODULE__cloudbase_toolbox_034e5bd0__.authStore), ["loadConfig"]: () => (__WEBPACK_EXTERNAL_MODULE__cloudbase_toolbox_034e5bd0__.loadConfig), ["loadEnvVariables"]: () => (__WEBPACK_EXTERNAL_MODULE__cloudbase_toolbox_034e5bd0__.loadEnvVariables), ["refreshTmpToken"]: () => (__WEBPACK_EXTERNAL_MODULE__cloudbase_toolbox_034e5bd0__.refreshTmpToken), ["resolveCredential"]: () => (__WEBPACK_EXTERNAL_MODULE__cloudbase_toolbox_034e5bd0__.resolveCredential), ["searchConfig"]: () => (__WEBPACK_EXTERNAL_MODULE__cloudbase_toolbox_034e5bd0__.searchConfig), ["validateCloudBaseConfigBySchema"]: () => (__WEBPACK_EXTERNAL_MODULE__cloudbase_toolbox_034e5bd0__.validateCloudBaseConfigBySchema) });
 
 /***/ },
 
@@ -27978,13 +28715,9 @@ module.exports = x({ ["randomUUID"]: () => (__WEBPACK_EXTERNAL_MODULE_node_crypt
 /***/ },
 
 /***/ 9627
-(module, __unused_webpack_exports, __webpack_require__) {
+(module) {
 
-var x = (y) => {
-	var x = {}; __webpack_require__.d(x, y); return x
-} 
-var y = (x) => (() => (x))
-module.exports = x({ ["existsSync"]: () => (__WEBPACK_EXTERNAL_MODULE_node_fs_75ed2103__.existsSync), ["readFileSync"]: () => (__WEBPACK_EXTERNAL_MODULE_node_fs_75ed2103__.readFileSync) });
+module.exports = __WEBPACK_EXTERNAL_MODULE_node_fs_75ed2103__;
 
 /***/ },