@cloudbase/cloudbase-mcp 2.33.1 → 2.33.2

package/dist/index.cjs

@@ -2680,7 +2680,7 @@ function getHeaders(options) {
 
 /***/ },
 
-/***/ 38680
+/***/ 58405
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -2693,7 +2693,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.AccessService = void 0;
-const utils_1 = __webpack_require__(24263);
+const utils_1 = __webpack_require__(88208);
 /**
  * HTTP Service（CloudBaseGW）访问服务。
  * 注意：HTTP Service 模块自 v5.0.0 起已废弃，建议迁移到 EnvService 的域名与路由能力
@@ -2834,7 +2834,7 @@ __decorate([
 
 /***/ },
 
-/***/ 33215
+/***/ 94540
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -2850,9 +2850,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.AgentService = void 0;
-const cloudrun_1 = __webpack_require__(8044);
-const type_1 = __webpack_require__(18490);
-const utils_1 = __webpack_require__(24263);
+const cloudrun_1 = __webpack_require__(17569);
+const type_1 = __webpack_require__(94917);
+const utils_1 = __webpack_require__(88208);
 const path_1 = __importDefault(__webpack_require__(33873));
 /**
  * Agent 管理类
@@ -3499,7 +3499,7 @@ __decorate([
 
 /***/ },
 
-/***/ 9537
+/***/ 1058
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -3512,7 +3512,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.AiModelService = void 0;
-const utils_1 = __webpack_require__(24263);
+const utils_1 = __webpack_require__(88208);
 class AiModelService {
     constructor(environment) {
         this.environment = environment;
@@ -3608,14 +3608,14 @@ __decorate([
 
 /***/ },
 
-/***/ 54913
+/***/ 44210
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.BillingService = void 0;
-const utils_1 = __webpack_require__(24263);
+const utils_1 = __webpack_require__(88208);
 class BillingService {
     constructor(context) {
         this.billService = new utils_1.CloudService(context, BillingService.billServiceVersion.service, BillingService.billServiceVersion.version);
@@ -3658,7 +3658,7 @@ BillingService.billServiceVersion = {
 
 /***/ },
 
-/***/ 97538
+/***/ 42403
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -3691,10 +3691,10 @@ exports.CloudAppService = void 0;
 const fs_1 = __importDefault(__webpack_require__(29021));
 const os_1 = __importDefault(__webpack_require__(21820));
 const path_1 = __importDefault(__webpack_require__(33873));
-const error_1 = __webpack_require__(18143);
-const utils_1 = __webpack_require__(24263);
-const http_request_1 = __webpack_require__(7355);
-__exportStar(__webpack_require__(47167), exports);
+const error_1 = __webpack_require__(54884);
+const utils_1 = __webpack_require__(88208);
+const http_request_1 = __webpack_require__(2922);
+__exportStar(__webpack_require__(15746), exports);
 /**
  * CloudApp 统一部署服务
  * 提供 Web 应用的创建、查询、删除、版本管理等功能
@@ -3927,7 +3927,7 @@ __decorate([
 
 /***/ },
 
-/***/ 47167
+/***/ 15746
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -3945,7 +3945,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 
 /***/ },
 
-/***/ 27851
+/***/ 56242
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -3958,7 +3958,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.CloudBaseRunService = void 0;
-const utils_1 = __webpack_require__(24263);
+const utils_1 = __webpack_require__(88208);
 class CloudBaseRunService {
     constructor(environment) {
         this.environment = environment;
@@ -3989,7 +3989,7 @@ __decorate([
 
 /***/ },
 
-/***/ 8044
+/***/ 17569
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -4010,8 +4010,8 @@ exports.parseObjectToDiffConfigItem = parseObjectToDiffConfigItem;
 const archiver_1 = __importDefault(__webpack_require__(7716));
 const fs_extra_1 = __webpack_require__(22732);
 const path_1 = __importDefault(__webpack_require__(33873));
-const utils_1 = __webpack_require__(24263);
-const type_1 = __webpack_require__(18490);
+const utils_1 = __webpack_require__(88208);
+const type_1 = __webpack_require__(94917);
 /**
  * 云托管服务管理类
  * 提供云托管服务的初始化、下载、列表查询和删除等功能
@@ -4693,7 +4693,7 @@ function parseObjectToDiffConfigItem(data) {
 
 /***/ },
 
-/***/ 18490
+/***/ 94917
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -4726,15 +4726,15 @@ var ReleaseTypeEnum;
 
 /***/ },
 
-/***/ 10443
+/***/ 73906
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.CommonService = void 0;
-const utils_1 = __webpack_require__(24263);
-const error_1 = __webpack_require__(18143);
+const utils_1 = __webpack_require__(88208);
+const error_1 = __webpack_require__(54884);
 /**
  * 公共的云api调用方法 透传用户参数 无业务逻辑处理
  * @export
@@ -4773,7 +4773,7 @@ exports.CommonService = CommonService;
 
 /***/ },
 
-/***/ 3017
+/***/ 41976
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -4855,14 +4855,14 @@ exports.SCF_TEMP_COS = {
 
 /***/ },
 
-/***/ 91522
+/***/ 81073
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.CloudBaseContext = void 0;
-const constant_1 = __webpack_require__(3017);
+const constant_1 = __webpack_require__(41976);
 class CloudBaseContext {
     constructor({ secretId = '', secretKey = '', token = '', proxy = '', region = '', envType = '', useInternalEndpoint = undefined, internalEndpointRegion = undefined, requestFn = undefined }) {
         this.secretId = secretId;
@@ -4887,7 +4887,7 @@ exports.CloudBaseContext = CloudBaseContext;
 
 /***/ },
 
-/***/ 71863
+/***/ 44206
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -4904,8 +4904,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.DatabaseService = void 0;
 const path_1 = __importDefault(__webpack_require__(33873));
-const error_1 = __webpack_require__(18143);
-const utils_1 = __webpack_require__(24263);
+const error_1 = __webpack_require__(54884);
+const utils_1 = __webpack_require__(88208);
 function preLazy() {
     return function (target, propertyKey, descriptor) {
         let oldFunc = descriptor.value;
@@ -5466,7 +5466,7 @@ __decorate([
 
 /***/ },
 
-/***/ 5636
+/***/ 9979
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -5478,7 +5478,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.DatabaseDeployer = void 0;
 const fs_1 = __importDefault(__webpack_require__(29021));
 const path_1 = __importDefault(__webpack_require__(33873));
-const error_1 = __webpack_require__(18143);
+const error_1 = __webpack_require__(54884);
 /** migration 文件名正则：14位数字 + 下划线 + 小写字母下划线名称 + .sql */
 const MIGRATION_FILE_PATTERN = /^(\d{14})_([a-z_]+)\.sql$/;
 /** 轮询间隔（毫秒） */
@@ -5712,7 +5712,7 @@ exports.DatabaseDeployer = DatabaseDeployer;
 
 /***/ },
 
-/***/ 83962
+/***/ 28385
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -5723,14 +5723,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.DeployOrchestrator = void 0;
 const path_1 = __importDefault(__webpack_require__(33873));
-const error_1 = __webpack_require__(18143);
-const DatabaseDeployer_1 = __webpack_require__(5636);
-const FunctionDeployer_1 = __webpack_require__(21773);
-const StaticDeployer_1 = __webpack_require__(1227);
-const GatewayDeployer_1 = __webpack_require__(83463);
-const StateStore_1 = __webpack_require__(13483);
-const framework_1 = __webpack_require__(20789);
-const parallel_1 = __webpack_require__(31504);
+const error_1 = __webpack_require__(54884);
+const DatabaseDeployer_1 = __webpack_require__(9979);
+const FunctionDeployer_1 = __webpack_require__(93210);
+const StaticDeployer_1 = __webpack_require__(19672);
+const GatewayDeployer_1 = __webpack_require__(6378);
+const config_guard_1 = __webpack_require__(74931);
+const parallel_1 = __webpack_require__(86693);
 /** 部署顺序（按依赖：database 最先，函数依赖新 Schema；gateway 最后，依赖函数/hosting） */
 const DEPLOY_ORDER = ['database', 'functions', 'app', 'hosting', 'gateway'];
 /**
@@ -5750,7 +5749,8 @@ class DeployOrchestrator {
      * 计算部署计划（dry-run 输出）
      */
     async deployPlan(options) {
-        return this.buildPlan(options.config, options);
+        const config = this.normalizeFunctionConfigs(options.config, options.envId, options.cwd);
+        return this.buildPlan(config, options);
     }
     /**
      * 执行部署
@@ -5763,7 +5763,8 @@ class DeployOrchestrator {
      */
     async deploy(options) {
         var _a, _b, _c, _d, _e, _f, _g, _h;
-        const { config, envId, dryRun, cwd = process.cwd(), log, concurrency = 5, continueOnError = false } = options;
+        const { config: inputConfig, envId, dryRun, cwd = process.cwd(), log, concurrency = 5, continueOnError = false } = options;
+        const config = this.normalizeFunctionConfigs(inputConfig, envId, cwd);
         // 1. 轻量 inline 守卫（validateProject 未接入时的兜底）
         this.guardConfig(config);
         const plan = await this.buildPlan(config, options);
@@ -5777,132 +5778,157 @@ class DeployOrchestrator {
         // gateway 段强制串行：executeStep 的 gateway 分支部署 config.gateway.routes 全部路由
         // （逐路由 plan item 仅用于展示 diff），并发执行会对同一批路由发起重复全量部署（竞态 create/modify 路由、bindCustomDomain）
         const globalLimit = Math.max(1, Math.min(Number(concurrency) || 1, 20));
-        try {
-            for (const segment of segments) {
-                // 段内并行度：gateway 段固定 1（全量部署语义）；其余段用全局 concurrency
-                const limit = ((_b = segment[0]) === null || _b === void 0 ? void 0 : _b.type) === 'gateway' ? 1 : globalLimit;
-                // 段内预判定（顺序执行，保留交互/冲突中断语义）
-                const toExecute = [];
-                let segmentFailed = false;
-                let segmentDbFailed = false;
-                for (const item of segment) {
-                    // skip：产物/配置未变更，静默跳过（不执行、不询问）
-                    if (item.status === 'skip') {
-                        (_c = log === null || log === void 0 ? void 0 : log.info) === null || _c === void 0 ? void 0 : _c.call(log, `[${item.type}] ${item.name}: ${item.action}`);
-                        results.push({ type: item.type, name: item.name, ok: true, reason: 'skip' });
-                        continue;
-                    }
-                    (_d = log === null || log === void 0 ? void 0 : log.info) === null || _d === void 0 ? void 0 : _d.call(log, `[${item.type}] ${item.name}: ${item.action}`);
-                    // conflict：数据库迁移冲突 → 中断整个部署（后续资源可能依赖新 Schema）
-                    if (item.status === 'conflict') {
-                        const message = '检测到冲突，已中断部署';
-                        (_e = log === null || log === void 0 ? void 0 : log.error) === null || _e === void 0 ? void 0 : _e.call(log, `[${item.type}] ${item.name} ${message}`);
-                        results.push({ type: item.type, name: item.name, ok: false, error: message });
-                        if (item.type === 'database') {
-                            return { plan, results };
-                        }
-                        segmentFailed = true;
-                        continue;
-                    }
-                    // 覆盖确认：仅函数已存在（update）时触发，对齐 tcb fn deploy 的 FunctionConflictChecker 语义
-                    // yes=true 直接放行；注入 confirmUpdate 按回调决定；两者都无 → 保守跳过（no-confirm）
-                    if (item.type === 'functions' && item.status === 'update') {
-                        let confirmed = false;
-                        if (options.yes) {
-                            confirmed = true;
-                        }
-                        else if (options.confirmUpdate) {
-                            confirmed = await options.confirmUpdate(item);
-                        }
-                        if (!confirmed) {
-                            const reason = options.confirmUpdate
-                                ? 'skipped-by-user'
-                                : 'no-confirm';
-                            (_f = log === null || log === void 0 ? void 0 : log.warn) === null || _f === void 0 ? void 0 : _f.call(log, `[${item.type}] ${item.name} 跳过覆盖更新（${reason}）`);
-                            results.push({ type: item.type, name: item.name, ok: false, reason });
-                            continue;
-                        }
-                    }
-                    toExecute.push(item);
+        for (const segment of segments) {
+            // 段内并行度：gateway 段固定 1（全量部署语义）；其余段用全局 concurrency
+            const limit = ((_b = segment[0]) === null || _b === void 0 ? void 0 : _b.type) === 'gateway' ? 1 : globalLimit;
+            // 段内预判定（顺序执行，保留交互/冲突中断语义）
+            const toExecute = [];
+            let segmentFailed = false;
+            let segmentDbFailed = false;
+            for (const item of segment) {
+                // skip：产物/配置未变更，静默跳过（不执行、不询问）
+                if (item.status === 'skip') {
+                    (_c = log === null || log === void 0 ? void 0 : log.info) === null || _c === void 0 ? void 0 : _c.call(log, `[${item.type}] ${item.name}: ${item.action}`);
+                    results.push({ type: item.type, name: item.name, ok: true, reason: 'skip' });
+                    continue;
                 }
-                if (toExecute.length === 0) {
-                    // 段内无实际执行项：若本段已因 conflict 标记失败且 fail-fast，则中断
-                    if (segmentFailed && !continueOnError) {
+                (_d = log === null || log === void 0 ? void 0 : log.info) === null || _d === void 0 ? void 0 : _d.call(log, `[${item.type}] ${item.name}: ${item.action}`);
+                // conflict：数据库迁移冲突 → 中断整个部署（后续资源可能依赖新 Schema）
+                if (item.status === 'conflict') {
+                    const message = '检测到冲突，已中断部署';
+                    (_e = log === null || log === void 0 ? void 0 : log.error) === null || _e === void 0 ? void 0 : _e.call(log, `[${item.type}] ${item.name} ${message}`);
+                    results.push({ type: item.type, name: item.name, ok: false, error: message });
+                    if (item.type === 'database') {
                         return { plan, results };
                     }
+                    segmentFailed = true;
                     continue;
                 }
-                // 段内并行执行
-                const controller = new parallel_1.AsyncTaskParallelController(limit);
-                const tasks = toExecute.map((item) => async () => {
-                    var _a, _b, _c, _d, _e;
-                    try {
-                        const stepResult = await this.executeStep({
-                            item,
-                            config,
-                            envId,
-                            cwd,
-                            onProgress: options.onProgress
-                        });
-                        if (item.type === 'functions') {
-                            results.push({
-                                type: item.type,
-                                name: item.name,
-                                ok: true,
-                                url: stepResult === null || stepResult === void 0 ? void 0 : stepResult.url,
-                                detail: stepResult
-                            });
-                        }
-                        else {
-                            results.push({ type: item.type, name: item.name, ok: true, url: stepResult });
-                        }
-                    }
-                    catch (e) {
-                        const message = (e === null || e === void 0 ? void 0 : e.message) || String(e);
-                        const requestId = (e === null || e === void 0 ? void 0 : e.requestId) ||
-                            (e === null || e === void 0 ? void 0 : e.RequestId) ||
-                            ((_a = e === null || e === void 0 ? void 0 : e.original) === null || _a === void 0 ? void 0 : _a.requestId) ||
-                            ((_b = e === null || e === void 0 ? void 0 : e.original) === null || _b === void 0 ? void 0 : _b.RequestId) ||
-                            ((_c = e === null || e === void 0 ? void 0 : e.response) === null || _c === void 0 ? void 0 : _c.requestId) ||
-                            ((_d = e === null || e === void 0 ? void 0 : e.response) === null || _d === void 0 ? void 0 : _d.RequestId);
-                        if (!(item.type === 'functions' && options.onProgress)) {
-                            (_e = log === null || log === void 0 ? void 0 : log.error) === null || _e === void 0 ? void 0 : _e.call(log, `[${item.type}] ${item.name} 部署失败: ${message}`);
-                        }
-                        results.push(Object.assign(Object.assign(Object.assign({ type: item.type, name: item.name, ok: false, error: message }, ((e === null || e === void 0 ? void 0 : e.code) ? { errorCode: e.code } : {})), ((e === null || e === void 0 ? void 0 : e.failedStage) ? { failedStage: e.failedStage } : {})), (requestId ? { requestId } : {})));
-                        segmentFailed = true;
-                        if (item.type === 'database') {
-                            segmentDbFailed = true;
-                        }
+                // 覆盖确认：仅函数已存在（update）时触发，对齐 tcb fn deploy 的 FunctionConflictChecker 语义
+                // yes=true 直接放行；注入 confirmUpdate 按回调决定；两者都无 → 保守跳过（no-confirm）
+                if (item.type === 'functions' && item.status === 'update') {
+                    let confirmed = false;
+                    if (options.yes) {
+                        confirmed = true;
                     }
-                });
-                controller.loadTasks(tasks);
-                await controller.run();
-                // 段内失败中断决策
-                if (segmentFailed) {
-                    if (segmentDbFailed) {
-                        (_g = log === null || log === void 0 ? void 0 : log.error) === null || _g === void 0 ? void 0 : _g.call(log, '数据库迁移失败，中断部署');
-                        return { plan, results };
+                    else if (options.confirmUpdate) {
+                        confirmed = await options.confirmUpdate(item);
                     }
-                    if (!continueOnError) {
-                        return { plan, results };
+                    if (!confirmed) {
+                        const reason = options.confirmUpdate
+                            ? 'skipped-by-user'
+                            : 'no-confirm';
+                        (_f = log === null || log === void 0 ? void 0 : log.warn) === null || _f === void 0 ? void 0 : _f.call(log, `[${item.type}] ${item.name} 跳过覆盖更新（${reason}）`);
+                        results.push({ type: item.type, name: item.name, ok: false, reason });
+                        continue;
                     }
                 }
+                toExecute.push(item);
             }
-        }
-        finally {
-            // 无论部署全部成功还是 fail-fast 中断，都将已成功资源的状态快照落盘
-            // （失败资源保留旧快照，下次 diff 仍会检测到差异）；快照写入失败不影响部署结果
-            if (!dryRun) {
+            if (toExecute.length === 0) {
+                // 段内无实际执行项：若本段已因 conflict 标记失败且 fail-fast，则中断
+                if (segmentFailed && !continueOnError) {
+                    return { plan, results };
+                }
+                continue;
+            }
+            // 段内并行执行
+            const controller = new parallel_1.AsyncTaskParallelController(limit);
+            const tasks = toExecute.map((item) => async () => {
+                var _a, _b, _c, _d, _e;
                 try {
-                    await this.persistState({ config, plan, results, cwd, envId: options.envId });
+                    const stepResult = await this.executeStep({
+                        item,
+                        config,
+                        envId,
+                        cwd,
+                        onProgress: options.onProgress
+                    });
+                    if (item.type === 'functions') {
+                        results.push({
+                            type: item.type,
+                            name: item.name,
+                            ok: true,
+                            url: stepResult === null || stepResult === void 0 ? void 0 : stepResult.url,
+                            detail: stepResult
+                        });
+                    }
+                    else {
+                        results.push({ type: item.type, name: item.name, ok: true, url: stepResult });
+                    }
                 }
                 catch (e) {
-                    (_h = log === null || log === void 0 ? void 0 : log.warn) === null || _h === void 0 ? void 0 : _h.call(log, `状态快照写入失败：${(e === null || e === void 0 ? void 0 : e.message) || String(e)}`);
+                    const message = (e === null || e === void 0 ? void 0 : e.message) || String(e);
+                    const requestId = (e === null || e === void 0 ? void 0 : e.requestId) ||
+                        (e === null || e === void 0 ? void 0 : e.RequestId) ||
+                        ((_a = e === null || e === void 0 ? void 0 : e.original) === null || _a === void 0 ? void 0 : _a.requestId) ||
+                        ((_b = e === null || e === void 0 ? void 0 : e.original) === null || _b === void 0 ? void 0 : _b.RequestId) ||
+                        ((_c = e === null || e === void 0 ? void 0 : e.response) === null || _c === void 0 ? void 0 : _c.requestId) ||
+                        ((_d = e === null || e === void 0 ? void 0 : e.response) === null || _d === void 0 ? void 0 : _d.RequestId);
+                    if (!(item.type === 'functions' && options.onProgress)) {
+                        (_e = log === null || log === void 0 ? void 0 : log.error) === null || _e === void 0 ? void 0 : _e.call(log, `[${item.type}] ${item.name} 部署失败: ${message}`);
+                    }
+                    results.push(Object.assign(Object.assign(Object.assign({ type: item.type, name: item.name, ok: false, error: message }, ((e === null || e === void 0 ? void 0 : e.code) ? { errorCode: e.code } : {})), ((e === null || e === void 0 ? void 0 : e.failedStage) ? { failedStage: e.failedStage } : {})), (requestId ? { requestId } : {})));
+                    segmentFailed = true;
+                    if (item.type === 'database') {
+                        segmentDbFailed = true;
+                    }
+                }
+            });
+            controller.loadTasks(tasks);
+            await controller.run();
+            // 段内失败中断决策
+            if (segmentFailed) {
+                if (segmentDbFailed) {
+                    (_g = log === null || log === void 0 ? void 0 : log.error) === null || _g === void 0 ? void 0 : _g.call(log, '数据库迁移失败，中断部署');
+                    return { plan, results };
+                }
+                if (!continueOnError) {
+                    (_h = log === null || log === void 0 ? void 0 : log.error) === null || _h === void 0 ? void 0 : _h.call(log, '存在资源部署失败，中断部署');
+                    return { plan, results };
                 }
             }
         }
         return { plan, results };
     }
+    /**
+     * 归一化声明式函数配置：直接消费 cloudbaserc 的嵌套形状（imageConfig.build），
+     * 不做字段平铺映射；非 HTTP 函数原样返回。
+     */
+    normalizeFunctionConfigs(config, envId, cwd = process.cwd()) {
+        if (!Array.isArray(config === null || config === void 0 ? void 0 : config.functions)) {
+            return config;
+        }
+        const functionRootPath = path_1.default.resolve(cwd, config.functionRoot || 'functions');
+        return Object.assign(Object.assign({}, config), { functions: config.functions.map((func) => {
+                var _a, _b;
+                // 直接消费 cloudbaserc 的嵌套形状（imageConfig.build），不再做字段平铺映射。
+                // 非镜像/构建策略由 prepareMinimalDeployConfig 内部识别并原样返回。
+                if ((func === null || func === void 0 ? void 0 : func.type) !== 'HTTP') {
+                    return func;
+                }
+                const funcAny = func;
+                const explicitCwd = (_b = (_a = funcAny.imageConfig) === null || _a === void 0 ? void 0 : _a.build) === null || _b === void 0 ? void 0 : _b.cwd;
+                const dir = funcAny.dir;
+                // 构建上下文根解析优先级：显式 build.cwd > dir > functionRoot/name。
+                // 相对路径一律以部署传入的项目 cwd 为基准解析为绝对路径，避免 preflight
+                // 与云端构建（builders/cloud.ts）以进程 CWD 兜底导致目录错位。
+                const resolvedContextRoot = typeof explicitCwd === 'string' && explicitCwd.trim()
+                    ? path_1.default.resolve(cwd, explicitCwd)
+                    : typeof dir === 'string' && dir.trim()
+                        ? path_1.default.resolve(cwd, dir)
+                        : undefined;
+                // 显式 build.cwd 归一为绝对路径写回，避免 applyMinimalDeployConfigDefaults
+                // 因 build.cwd 已存在而保留原始相对值。
+                const normalizedFunc = resolvedContextRoot && typeof explicitCwd === 'string' && explicitCwd.trim()
+                    ? Object.assign(Object.assign({}, funcAny), { imageConfig: Object.assign(Object.assign({}, funcAny.imageConfig), { build: Object.assign(Object.assign({}, funcAny.imageConfig.build), { cwd: resolvedContextRoot }) }) }) : func;
+                return (0, config_guard_1.prepareMinimalDeployConfig)(normalizedFunc, {
+                    envId,
+                    functionPath: resolvedContextRoot,
+                    functionRootPath
+                }).config;
+            }) });
+    }
     /**
      * 将扁平 plan 按「连续相同资源类型」切成有序 segments
      *
@@ -5930,91 +5956,19 @@ class DeployOrchestrator {
         }
         return segments;
     }
-    /**
-     * 部署成功后写回本地 state 快照
-     *
-     * - hosting：成功部署/未变更（skip）的项重算产物指纹；失败项保留旧快照
-     * - app：成功部署写 buildAppConfig 快照；skip 复用旧快照
-     * - gateway：保留旧快照（本轮不做路由级实时快照）
-     */
-    async persistState(options) {
-        var _a, _b, _c, _d, _e, _f;
-        const { config, plan, results, cwd, envId } = options;
-        const stateStore = new StateStore_1.StateStore({ cwd });
-        const prev = stateStore.read();
-        // hosting
-        const hostingEntries = [];
-        for (const h of config.hosting || []) {
-            const name = h.name || 'default';
-            const planItem = plan.find(p => p.type === 'hosting' && p.name === name);
-            const result = results.find(r => r.type === 'hosting' && r.name === name);
-            if (!result || !result.ok) {
-                // 未执行（fail-fast 中断，results 中无对应条目）或部署失败：
-                // 保留旧快照（下次 diff 仍会检测到差异）
-                const prevEntry = (_b = (_a = prev === null || prev === void 0 ? void 0 : prev.resources) === null || _a === void 0 ? void 0 : _a.hosting) === null || _b === void 0 ? void 0 : _b.find(s => s.name === name);
-                if (prevEntry) {
-                    hostingEntries.push(prevEntry);
-                }
-                continue;
-            }
-            if ((planItem === null || planItem === void 0 ? void 0 : planItem.status) === 'skip') {
-                const prevEntry = (_d = (_c = prev === null || prev === void 0 ? void 0 : prev.resources) === null || _c === void 0 ? void 0 : _c.hosting) === null || _d === void 0 ? void 0 : _d.find(s => s.name === name);
-                if (prevEntry) {
-                    hostingEntries.push(prevEntry);
-                    continue;
-                }
-            }
-            // 成功部署：重算当前指纹（含 size，供下次 diff 做 size 预判）
-            // 注意：deployHosting 可能执行本地构建，产物已更新，必须独立重算而非复用 plan 指纹
-            const root = path_1.default.resolve(cwd, h.root || '.');
-            // outputDir 与 StaticDeployer.deployHosting 完全复用同一解析逻辑
-            const outputDir = (0, framework_1.resolveHostingOutputDir)(h, root);
-            try {
-                const files = await stateStore.computeHostingFingerprints(outputDir, h.ignore || []);
-                hostingEntries.push({ name, deployPath: h.deployPath, files });
-            }
-            catch (_g) {
-                // 目录缺失 / 文件数超限：不写入（下次 diff 走云端兜底或全量部署）
-            }
-        }
-        // app
-        let appEntry;
-        if (config.app) {
-            const appResult = results.find(r => r.type === 'app');
-            if (appResult === null || appResult === void 0 ? void 0 : appResult.ok) {
-                appEntry = stateStore.buildAppConfig(config.app);
-            }
-            else {
-                appEntry = (_e = prev === null || prev === void 0 ? void 0 : prev.resources) === null || _e === void 0 ? void 0 : _e.app;
-            }
-        }
-        const resources = {};
-        if (hostingEntries.length) {
-            resources.hosting = hostingEntries;
-        }
-        if (appEntry) {
-            resources.app = appEntry;
-        }
-        if ((_f = prev === null || prev === void 0 ? void 0 : prev.resources) === null || _f === void 0 ? void 0 : _f.gateway) {
-            resources.gateway = prev.resources.gateway;
-        }
-        if (Object.keys(resources).length) {
-            stateStore.write({ resources, envId });
-        }
-    }
     /**
      * 构建完整部署计划（按依赖顺序 + only/skip 过滤）
      *
      * 通过查询云端状态判定每个资源的动作：
      * - database：先按迁移文件做 preview，再聚合成单条资源级计划项（pending→create，存在 conflict→conflict，全部 applied→不出现在 plan）
      * - functions：ListFunctions 判断是否已存在 → create / update（不做本地 hash / 字段 diff）
-     * - app：describeAppInfo 判断是否已存在 → create / update；本地 state 配置一致 → skip
-     * - hosting：本地 state 指纹 diff → 一致 skip（不重新上传）/ 有差异 deploy（带文件级明细）
+     * - app：describeAppInfo 判断是否已存在 → create / update
+     * - hosting：直传覆盖（无存在性概念）
      * - gateway：planRoutes 对比云端路由 → create / update / skip（含变更字段明细）
      * 云端查询失败时降级为保守判定（全 create），不影响 dry-run 展示。
      */
     async buildPlan(config, options) {
-        const { only, skip, refresh } = options;
+        const { only, skip } = options;
         const cwd = options.cwd || process.cwd();
         const envId = options.envId;
         const plan = [];
@@ -6025,14 +5979,7 @@ class DeployOrchestrator {
                 return false;
             return true;
         };
-        // 本地 state 快照（diff 基准）：--refresh 时忽略本地 skip 判定
-        const stateStore = new StateStore_1.StateStore({ cwd });
-        const rawState = refresh ? null : stateStore.read();
-        // 跨环境保护：快照记录的 envId 与目标环境不一致（或旧格式快照无 envId）时，
-        // 快照是其他环境部署后的指纹，不可作为 skip 依据 → 视为无快照，强制走全量部署，
-        // 避免切换环境后误判「产物未变更」导致新环境 COS 404
-        const state = rawState && rawState.envId === envId ? rawState : null;
-        const planCtx = { config, envId, stateStore, state, refresh, cwd };
+        const planCtx = { config, envId, cwd };
         for (const type of DEPLOY_ORDER) {
             if (!isEnabled(type))
                 continue;
@@ -6045,7 +5992,7 @@ class DeployOrchestrator {
      * 按资源类型构建计划（拆分自 buildPlan，控制圈复杂度）
      */
     async buildPlanForType(type, ctx) {
-        const { config, envId, stateStore, state, refresh, cwd } = ctx;
+        const { config, envId, cwd } = ctx;
         if (type === 'database') {
             return this.buildDatabasePlan(config, cwd, envId);
         }
@@ -6083,10 +6030,10 @@ class DeployOrchestrator {
             });
         }
         if (type === 'app') {
-            return this.buildAppPlan({ config, envId, stateStore, state, refresh });
+            return this.buildAppPlan({ config, envId });
         }
         if (type === 'hosting') {
-            return this.buildHostingPlans(config, ctx);
+            return this.buildHostingPlans(config);
         }
         return this.buildGatewayPlans(config, envId);
     }
@@ -6143,100 +6090,51 @@ class DeployOrchestrator {
         return [];
     }
     /**
-     * app 计划：本地 state 配置一致 → skip；否则按云端存在性 → create / update
+     * app 计划：按云端存在性 → create / update
      */
     async buildAppPlan(options) {
-        var _a;
-        const { config, envId, stateStore, state, refresh } = options;
+        const { config, envId } = options;
         if (!config.app)
             return [];
         const name = config.app.serviceName || 'app';
-        // 本地 state 配置一致 → skip（真增量，不重复构建版本）
-        const appEntry = stateStore.buildAppConfig(config.app);
-        const stateApp = (_a = state === null || state === void 0 ? void 0 : state.resources) === null || _a === void 0 ? void 0 : _a.app;
-        const appUnchanged = !refresh &&
-            stateApp !== undefined &&
-            appEntry !== undefined &&
-            this.deepEqual(stateApp, appEntry);
-        if (appUnchanged) {
-            return [
-                {
-                    type: 'app',
-                    name,
-                    status: 'skip',
-                    action: `云应用 ${name} 配置未变更，跳过`
-                }
-            ];
-        }
         const appExists = await this.appExists(name);
-        const changes = this.appConfigChanges(stateApp, appEntry);
         return [
-            Object.assign({ type: 'app', name, status: appExists ? 'update' : 'create', action: appExists
+            {
+                type: 'app',
+                name,
+                status: appExists ? 'update' : 'create',
+                action: appExists
                     ? `覆盖更新云应用 ${name}`
-                    : `新建云应用 ${name}` }, (changes.length ? { changes } : {}))
+                    : `新建云应用 ${name}`
+            }
         ];
     }
     /**
-     * hosting 计划：本地 state 指纹 diff → 一致 skip / 有差异 deploy（带文件级明细）
+     * hosting 计划：每次直传覆盖（无本地指纹 skip）
      */
-    async buildHostingPlans(config, ctx) {
-        var _a, _b;
-        const { stateStore, state, refresh, cwd } = ctx;
+    buildHostingPlans(config) {
         const plans = [];
         for (const h of config.hosting || []) {
             const name = h.name || 'default';
-            const root = path_1.default.resolve(cwd, h.root || '.');
-            const buildCommand = (0, framework_1.resolveBuildCommand)(h, root);
-            // outputDir 与 StaticDeployer.deployHosting 完全复用同一解析逻辑
-            const outputDir = (0, framework_1.resolveHostingOutputDir)(h, root);
-            const stateHosting = (_b = (_a = state === null || state === void 0 ? void 0 : state.resources) === null || _a === void 0 ? void 0 : _a.hosting) === null || _b === void 0 ? void 0 : _b.find(s => s.name === name);
-            // 懒加载 diff：size 预判 + 按需 hash（目录缺失 / 文件数超限 → 保守部署）
-            let fileDiff = null;
-            try {
-                fileDiff = await stateStore.diffHostingFiles(outputDir, stateHosting === null || stateHosting === void 0 ? void 0 : stateHosting.files, {
-                    ignore: h.ignore || []
-                });
-            }
-            catch (_c) {
-                fileDiff = null;
-            }
-            const unchanged = !refresh && fileDiff !== null && fileDiff.unchanged;
-            if (unchanged) {
-                plans.push({
-                    type: 'hosting',
-                    name,
-                    status: 'skip',
-                    action: `静态托管 ${name} 产物未变更，跳过`
-                });
-                continue;
-            }
             const hasBuild = !!h.buildCommand ||
                 (!!h.framework && h.framework !== 'static' && h.framework !== 'custom');
             const details = [
                 { label: '框架', value: h.framework || 'static' },
                 {
                     label: '构建',
-                    value: hasBuild
-                        ? `本地构建（${buildCommand || 'npm run build'}）→ 上传 ${outputDir}`
-                        : '无构建，直接上传'
+                    value: hasBuild ? '本地构建后上传' : '无构建，直接上传'
                 },
                 { label: '部署路径', value: h.deployPath || '/' }
             ];
-            if (fileDiff === null || fileDiff === void 0 ? void 0 : fileDiff.overLimit) {
-                details.push({ label: '指纹', value: '文件数超上限，降级为全量部署' });
-            }
-            plans.push(Object.assign({ type: 'hosting', name, status: 'deploy', action: hasBuild
+            plans.push({
+                type: 'hosting',
+                name,
+                status: 'deploy',
+                action: hasBuild
                     ? `本地构建后直传静态托管 ${name}`
-                    : `直传覆盖静态托管 ${name}`, details }, (fileDiff && !fileDiff.overLimit
-                ? {
-                    fileDiff: {
-                        added: fileDiff.added,
-                        modified: fileDiff.modified,
-                        deleted: fileDiff.deleted,
-                        totalChanged: fileDiff.totalChanged
-                    }
-                }
-                : {})));
+                    : `直传覆盖静态托管 ${name}`,
+                details
+            });
         }
         return plans;
     }
@@ -6346,26 +6244,6 @@ class DeployOrchestrator {
             }
         }
     }
-    /** 深比较（JSON 快照语义）：仅用于 app 配置快照等简单对象 */
-    deepEqual(a, b) {
-        return JSON.stringify(a) === JSON.stringify(b);
-    }
-    /** app 配置差异明细（from → to） */
-    appConfigChanges(prev, curr) {
-        const changes = [];
-        const keys = new Set([
-            ...Object.keys(prev || {}),
-            ...Object.keys(curr || {})
-        ]);
-        for (const key of keys) {
-            const from = prev === null || prev === void 0 ? void 0 : prev[key];
-            const to = curr === null || curr === void 0 ? void 0 : curr[key];
-            if (from !== to) {
-                changes.push({ field: String(key), from, to });
-            }
-        }
-        return changes;
-    }
     /**
      * 轻量 inline 守卫：配置合法 + 目录存在（validateProject 接线点）
      */
@@ -6383,7 +6261,7 @@ exports.DeployOrchestrator = DeployOrchestrator;
 
 /***/ },
 
-/***/ 21773
+/***/ 93210
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -6403,23 +6281,23 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.IMAGE_PULL_GRANT_URL = exports.REQUIRED_IMAGE_PULL_POLICY = exports.SCF_PULL_IMAGE_ROLE = exports.isCamPermissionError = exports.runImagePullAuthPreflight = exports.runImageRemotePreflight = exports.runLocalPreflight = exports.createCloudBuildService = exports.buildImageOnCloud = exports.toCloudFunction = exports.createImageArtifactFromConfig = exports.createCodeArtifact = exports.toCurrentState = exports.createDeployPlan = exports.parseImageReference = exports.normalizeGatewayPath = exports.normalizeDeployConfig = exports.isCustomImageRuntime = exports.checkDeployConfig = exports.assertDeployConfig = exports.FunctionDeployer = void 0;
-const error_1 = __webpack_require__(18143);
-const artifact_1 = __webpack_require__(78146);
-const config_guard_1 = __webpack_require__(69238);
-const cam_preflight_1 = __webpack_require__(11903);
-const cloud_1 = __webpack_require__(36114);
-const cloud_build_service_1 = __webpack_require__(52244);
-const docker_preflight_1 = __webpack_require__(30710);
-const GatewayDeployer_1 = __webpack_require__(83463);
-const domain_1 = __webpack_require__(83597);
-const image_preflight_1 = __webpack_require__(56749);
-const local_builder_1 = __webpack_require__(49515);
-const enterprise_tcr_1 = __webpack_require__(26719);
-const personal_tcr_1 = __webpack_require__(5380);
-const planner_1 = __webpack_require__(28750);
-const preflight_1 = __webpack_require__(61081);
-const types_1 = __webpack_require__(22724);
+exports.IMAGE_PULL_GRANT_URL = exports.REQUIRED_IMAGE_PULL_POLICY = exports.SCF_PULL_IMAGE_ROLE = exports.isCamPermissionError = exports.runImagePullAuthPreflight = exports.runImageRemotePreflight = exports.runLocalPreflight = exports.createCloudBuildService = exports.buildImageOnCloud = exports.toCloudFunction = exports.createImageArtifactFromConfig = exports.createCodeArtifact = exports.toCurrentState = exports.createDeployPlan = exports.parseImageReference = exports.normalizeGatewayPath = exports.normalizeDeployConfig = exports.isCustomImageRuntime = exports.prepareMinimalDeployConfig = exports.getMissingDeployInputs = exports.applyMinimalDeployConfigDefaults = exports.checkDeployConfig = exports.assertDeployConfig = exports.FunctionDeployer = void 0;
+const error_1 = __webpack_require__(54884);
+const artifact_1 = __webpack_require__(84187);
+const config_guard_1 = __webpack_require__(74931);
+const cam_preflight_1 = __webpack_require__(68388);
+const cloud_1 = __webpack_require__(4295);
+const cloud_build_service_1 = __webpack_require__(43587);
+const docker_preflight_1 = __webpack_require__(48947);
+const GatewayDeployer_1 = __webpack_require__(6378);
+const domain_1 = __webpack_require__(43294);
+const image_preflight_1 = __webpack_require__(67650);
+const local_builder_1 = __webpack_require__(52948);
+const enterprise_tcr_1 = __webpack_require__(84638);
+const personal_tcr_1 = __webpack_require__(28541);
+const planner_1 = __webpack_require__(72325);
+const preflight_1 = __webpack_require__(69230);
+const types_1 = __webpack_require__(79345);
 /** OPA 用户策略 key */
 const AUTHZ_USER_REGO_KEY = 'authz.user.rego';
 /**
@@ -6484,7 +6362,12 @@ class FunctionDeployer {
             return;
         }
         const rule = this.buildPublicAccessRego(functionName);
-        const mergedRego = currentRego.trim() ? `${currentRego.trim()}\n\n${rule}` : rule;
+        // 云端 Rego 校验器要求首条有效语句（注释不计）必须是 package 声明。
+        // currentRego 非空时已含 package authz.user，直接追加规则体即可；
+        // 为空（新环境首次配置）时需补齐 package 声明，否则触发 2:1: package expected。
+        const mergedRego = currentRego.trim()
+            ? `${currentRego.trim()}\n\n${rule}`
+            : `package authz.user\n\n${rule}`;
         await permissionService.modifyEnvAuthzConfig({
             key: AUTHZ_USER_REGO_KEY,
             value: mergedRego
@@ -6565,6 +6448,24 @@ class FunctionDeployer {
     checkConfig(config) {
         return (0, config_guard_1.checkDeployConfig)(config);
     }
+    /**
+     * 计算最小化部署配置的默认值，不执行网络或云端变更。
+     */
+    applyMinimalConfigDefaults(config, context = {}) {
+        return (0, config_guard_1.applyMinimalDeployConfigDefaults)(config, context);
+    }
+    /**
+     * 返回最小化配置仍缺失的字段，不执行网络或云端变更。
+     */
+    getMissingConfigInputs(config, context = {}) {
+        return (0, config_guard_1.getMissingDeployInputs)(config, context);
+    }
+    /**
+     * 应用安全默认值并返回缺失字段，供 CLI/MCP 逐步收集用户输入。
+     */
+    prepareMinimalConfig(config, context = {}) {
+        return (0, config_guard_1.prepareMinimalDeployConfig)(config, context);
+    }
     /**
      * 生成部署计划
      *
@@ -6591,13 +6492,14 @@ class FunctionDeployer {
      * @param options 部署选项，dryRun 时只生成计划不做任何变更
      */
     async deployFunction(config, options = {}) {
+        const deployConfig = config;
         const startTime = Date.now();
         const ctx = { steps: [], options };
         const warnings = [];
-        const report = (0, config_guard_1.checkDeployConfig)(config);
+        const report = (0, config_guard_1.checkDeployConfig)(deployConfig);
         this.appendWarnings(warnings, report);
         const normalized = await this.runStep(ctx, 'validate', async () => {
-            return (0, config_guard_1.assertDeployConfig)(config);
+            return (0, config_guard_1.assertDeployConfig)(deployConfig);
         });
         const plan = await this.runStep(ctx, 'plan', async () => {
             const current = await this.getCurrentFunction(normalized.name, normalized.codeSecret);
@@ -6687,7 +6589,7 @@ class FunctionDeployer {
      * 将既有声明式调用补齐为完整部署配置
      */
     withLegacyDeployContext(func, functionRootPath, functionPath) {
-        var _a, _b;
+        var _a, _b, _c, _d, _e;
         const config = Object.assign({}, func);
         const strategy = this.resolveStrategy(config);
         if (functionPath) {
@@ -6705,16 +6607,14 @@ class FunctionDeployer {
                 (effectiveFunctionRootPath
                     ? `${effectiveFunctionRootPath}/${config.name}`
                     : undefined);
-            if (buildCwd || ((_a = config.build) === null || _a === void 0 ? void 0 : _a.cwd)) {
-                config.build = Object.assign(Object.assign({}, (config.build || {})), { cwd: ((_b = config.build) === null || _b === void 0 ? void 0 : _b.cwd) || buildCwd });
+            const existingCwd = (_b = (_a = config.imageConfig) === null || _a === void 0 ? void 0 : _a.build) === null || _b === void 0 ? void 0 : _b.cwd;
+            if (buildCwd || existingCwd) {
+                config.imageConfig = Object.assign(Object.assign({}, (config.imageConfig || {})), { build: Object.assign(Object.assign({}, (((_c = config.imageConfig) === null || _c === void 0 ? void 0 : _c.build) || {})), { cwd: existingCwd || buildCwd }) });
             }
         }
-        // 兼容旧声明式 imageUri 字段，统一转换到运行时 imageConfig 契约
-        if (strategy === 'image' && config.imageUri && !config.imageConfig) {
-            config.imageType = config.imageType || 'personal';
-            config.imageConfig = {
-                imageUri: config.imageUri
-            };
+        // 兼容旧声明式顶层 imageUri 字段，统一收敛到 imageConfig 契约
+        if (strategy === 'image' && config.imageUri && !((_d = config.imageConfig) === null || _d === void 0 ? void 0 : _d.imageUri)) {
+            config.imageConfig = Object.assign(Object.assign({ imageType: ((_e = config.imageConfig) === null || _e === void 0 ? void 0 : _e.imageType) || 'personal' }, (config.imageConfig || {})), { imageUri: config.imageUri });
             delete config.imageUri;
         }
         return config;
@@ -6837,9 +6737,10 @@ class FunctionDeployer {
         }
     }
     async prepareEnterpriseBuildConfig(ctx, config) {
-        const repository = config.build.repository || '';
-        const hasPreparedTarget = Boolean((config.registryId || config.build.registryId) && repository.split('/').length >= 3);
-        if (config.imageType !== 'enterprise' || hasPreparedTarget) {
+        const build = config.imageConfig.build;
+        const repository = build.repository || '';
+        const hasPreparedTarget = Boolean((config.imageConfig.registryId || build.registryId) && repository.split('/').length >= 3);
+        if (config.imageConfig.imageType !== 'enterprise' || hasPreparedTarget) {
             return { config };
         }
         const prepared = await this.runLabeledStep(ctx, {
@@ -6855,13 +6756,14 @@ class FunctionDeployer {
     }
     async preparePersonalBuildConfig(ctx, config) {
         var _a, _b, _c;
-        if (config.imageType !== 'personal') {
+        if (config.imageConfig.imageType !== 'personal') {
             return config;
         }
         const envId = this.resolveEnvironmentId();
-        const configuredNamespace = (_a = config.build.namespace) === null || _a === void 0 ? void 0 : _a.trim();
-        const hasConfiguredRepository = Boolean((_b = config.build.repository) === null || _b === void 0 ? void 0 : _b.trim());
-        const configuredRepository = ((_c = config.build.repository) === null || _c === void 0 ? void 0 : _c.trim()) || config.name;
+        const build = config.imageConfig.build;
+        const configuredNamespace = (_a = build.namespace) === null || _a === void 0 ? void 0 : _a.trim();
+        const hasConfiguredRepository = Boolean((_b = build.repository) === null || _b === void 0 ? void 0 : _b.trim());
+        const configuredRepository = ((_c = build.repository) === null || _c === void 0 ? void 0 : _c.trim()) || config.name;
         const parsedRepository = (0, config_guard_1.parseImageReference)(configuredRepository);
         if (!parsedRepository || parsedRepository.tag || parsedRepository.digest) {
             throw new error_1.CloudBaseError('个人版 TCR repository 不合法。', {
@@ -6874,7 +6776,7 @@ class FunctionDeployer {
         const namespace = configuredNamespace || repositoryNamespace || envId;
         const hasConfiguredNamespace = Boolean(configuredNamespace || repositoryNamespace);
         const registry = parsedRepository.registry || personal_tcr_1.DEFAULT_PERSONAL_TCR_REGISTRY;
-        const credential = config.build.registryCredential;
+        const credential = build.registryCredential;
         if (!(credential === null || credential === void 0 ? void 0 : credential.username) || !credential.password) {
             throw new error_1.CloudBaseError('个人版 TCR 构建缺少推送凭证。', {
                 code: types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_MISSING
@@ -6891,7 +6793,7 @@ class FunctionDeployer {
             })
         });
         const targetRepository = `${registry}/${namespace}/${repository}`;
-        const preparedConfig = Object.assign(Object.assign({}, config), { build: Object.assign(Object.assign({}, config.build), { namespace, repository: targetRepository, registryCredential: credential }) });
+        const preparedConfig = Object.assign(Object.assign({}, config), { imageConfig: Object.assign(Object.assign({}, config.imageConfig), { build: Object.assign(Object.assign({}, build), { namespace, repository: targetRepository, registryCredential: credential }) }) });
         return preparedConfig;
     }
     /**
@@ -6909,9 +6811,9 @@ class FunctionDeployer {
             // 企业版登录凭证在触发 CloudApp 构建前换取，构建容器只消费 Secrets，
             // 不再自行签名调用 TCR API。
             const cloudRegistryId = ((_a = prepared.target) === null || _a === void 0 ? void 0 : _a.registryId) ||
-                cloudConfig.build.registryId ||
-                cloudConfig.registryId;
-            const enterpriseCredential = cloudConfig.imageType === 'enterprise' && cloudRegistryId
+                cloudConfig.imageConfig.build.registryId ||
+                cloudConfig.imageConfig.registryId;
+            const enterpriseCredential = cloudConfig.imageConfig.imageType === 'enterprise' && cloudRegistryId
                 ? await this.runLabeledStep(ctx, {
                     stage: 'preflight',
                     label: '获取企业版 TCR 临时登录凭证',
@@ -6949,7 +6851,7 @@ class FunctionDeployer {
             try {
                 if (credential) {
                     await this.runStep(ctx, 'login', async () => {
-                        await (0, local_builder_1.loginDockerRegistry)(this.resolveRegistryFromRepository(localConfig.build.repository), credential, { deps: this.localBuilderDeps, commandOptions });
+                        await (0, local_builder_1.loginDockerRegistry)(this.resolveRegistryFromRepository(localConfig.imageConfig.build.repository), credential, { deps: this.localBuilderDeps, commandOptions });
                     });
                 }
                 const buildResult = await this.runStep(ctx, 'build', async () => {
@@ -6966,14 +6868,14 @@ class FunctionDeployer {
                         message: line
                     }), { deps: this.localBuilderDeps, commandOptions });
                 });
-                if (localConfig.imageType === 'personal') {
+                if (localConfig.imageConfig.imageType === 'personal') {
                     await this.runLabeledStep(ctx, {
                         stage: 'push',
                         label: '清理历史镜像标签',
                         handler: () => this.personalTcrServiceFactory().cleanupTags({
-                            namespace: localConfig.build.namespace,
-                            repository: localConfig.build.repository,
-                            retain: localConfig.build.retainedTags
+                            namespace: localConfig.imageConfig.build.namespace,
+                            repository: localConfig.imageConfig.build.repository,
+                            retain: localConfig.imageConfig.build.retainedTags
                         })
                     });
                 }
@@ -6992,9 +6894,10 @@ class FunctionDeployer {
     }
     async resolveLocalRegistryCredential(config) {
         var _a, _b, _c;
-        const imageType = (_a = config.imageType) !== null && _a !== void 0 ? _a : (((_b = config.registryId) !== null && _b !== void 0 ? _b : config.build.registryId) ? 'enterprise' : 'personal');
+        const build = config.imageConfig.build;
+        const imageType = (_a = config.imageConfig.imageType) !== null && _a !== void 0 ? _a : (((_b = config.imageConfig.registryId) !== null && _b !== void 0 ? _b : build.registryId) ? 'enterprise' : 'personal');
         if (imageType === 'enterprise') {
-            const registryId = (_c = config.registryId) !== null && _c !== void 0 ? _c : config.build.registryId;
+            const registryId = (_c = config.imageConfig.registryId) !== null && _c !== void 0 ? _c : build.registryId;
             if (!registryId) {
                 throw new error_1.CloudBaseError('企业版 TCR local 构建缺少 registryId。', {
                     code: types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_MISSING
@@ -7003,7 +6906,7 @@ class FunctionDeployer {
             const credential = await (0, enterprise_tcr_1.createEnterpriseTcrCredential)(this.tcrServiceFactory(), registryId);
             return { username: credential.username, secret: credential.token };
         }
-        const credential = config.build.registryCredential;
+        const credential = build.registryCredential;
         if (!credential) {
             return undefined;
         }
@@ -7194,30 +7097,33 @@ class FunctionDeployer {
     }
 }
 exports.FunctionDeployer = FunctionDeployer;
-__exportStar(__webpack_require__(22724), exports);
-var config_guard_2 = __webpack_require__(69238);
+__exportStar(__webpack_require__(79345), exports);
+var config_guard_2 = __webpack_require__(74931);
 Object.defineProperty(exports, "assertDeployConfig", ({ enumerable: true, get: function () { return config_guard_2.assertDeployConfig; } }));
 Object.defineProperty(exports, "checkDeployConfig", ({ enumerable: true, get: function () { return config_guard_2.checkDeployConfig; } }));
+Object.defineProperty(exports, "applyMinimalDeployConfigDefaults", ({ enumerable: true, get: function () { return config_guard_2.applyMinimalDeployConfigDefaults; } }));
+Object.defineProperty(exports, "getMissingDeployInputs", ({ enumerable: true, get: function () { return config_guard_2.getMissingDeployInputs; } }));
+Object.defineProperty(exports, "prepareMinimalDeployConfig", ({ enumerable: true, get: function () { return config_guard_2.prepareMinimalDeployConfig; } }));
 Object.defineProperty(exports, "isCustomImageRuntime", ({ enumerable: true, get: function () { return config_guard_2.isCustomImageRuntime; } }));
 Object.defineProperty(exports, "normalizeDeployConfig", ({ enumerable: true, get: function () { return config_guard_2.normalizeDeployConfig; } }));
 Object.defineProperty(exports, "normalizeGatewayPath", ({ enumerable: true, get: function () { return config_guard_2.normalizeGatewayPath; } }));
 Object.defineProperty(exports, "parseImageReference", ({ enumerable: true, get: function () { return config_guard_2.parseImageReference; } }));
-var planner_2 = __webpack_require__(28750);
+var planner_2 = __webpack_require__(72325);
 Object.defineProperty(exports, "createDeployPlan", ({ enumerable: true, get: function () { return planner_2.createDeployPlan; } }));
 Object.defineProperty(exports, "toCurrentState", ({ enumerable: true, get: function () { return planner_2.toCurrentState; } }));
-var artifact_2 = __webpack_require__(78146);
+var artifact_2 = __webpack_require__(84187);
 Object.defineProperty(exports, "createCodeArtifact", ({ enumerable: true, get: function () { return artifact_2.createCodeArtifact; } }));
 Object.defineProperty(exports, "createImageArtifactFromConfig", ({ enumerable: true, get: function () { return artifact_2.createImageArtifactFromConfig; } }));
 Object.defineProperty(exports, "toCloudFunction", ({ enumerable: true, get: function () { return artifact_2.toCloudFunction; } }));
-var cloud_2 = __webpack_require__(36114);
+var cloud_2 = __webpack_require__(4295);
 Object.defineProperty(exports, "buildImageOnCloud", ({ enumerable: true, get: function () { return cloud_2.buildImageOnCloud; } }));
-var cloud_build_service_2 = __webpack_require__(52244);
+var cloud_build_service_2 = __webpack_require__(43587);
 Object.defineProperty(exports, "createCloudBuildService", ({ enumerable: true, get: function () { return cloud_build_service_2.createCloudBuildService; } }));
-var preflight_2 = __webpack_require__(61081);
+var preflight_2 = __webpack_require__(69230);
 Object.defineProperty(exports, "runLocalPreflight", ({ enumerable: true, get: function () { return preflight_2.runLocalPreflight; } }));
-var image_preflight_2 = __webpack_require__(56749);
+var image_preflight_2 = __webpack_require__(67650);
 Object.defineProperty(exports, "runImageRemotePreflight", ({ enumerable: true, get: function () { return image_preflight_2.runImageRemotePreflight; } }));
-var cam_preflight_2 = __webpack_require__(11903);
+var cam_preflight_2 = __webpack_require__(68388);
 Object.defineProperty(exports, "runImagePullAuthPreflight", ({ enumerable: true, get: function () { return cam_preflight_2.runImagePullAuthPreflight; } }));
 Object.defineProperty(exports, "isCamPermissionError", ({ enumerable: true, get: function () { return cam_preflight_2.isCamPermissionError; } }));
 Object.defineProperty(exports, "SCF_PULL_IMAGE_ROLE", ({ enumerable: true, get: function () { return cam_preflight_2.SCF_PULL_IMAGE_ROLE; } }));
@@ -7227,16 +7133,16 @@ Object.defineProperty(exports, "IMAGE_PULL_GRANT_URL", ({ enumerable: true, get:
 
 /***/ },
 
-/***/ 83463
+/***/ 6378
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.GatewayDeployer = void 0;
-const domain_1 = __webpack_require__(83597);
-const error_1 = __webpack_require__(18143);
-const utils_1 = __webpack_require__(24263);
+const domain_1 = __webpack_require__(43294);
+const error_1 = __webpack_require__(54884);
+const utils_1 = __webpack_require__(88208);
 /**
  * 网关声明式部署器
  * 支持 function:<name>（SCF 云函数）与 hosting:<name>（STATIC_STORE 静态托管）两种目标
@@ -7847,343 +7753,7 @@ exports.GatewayDeployer = GatewayDeployer;
 
 /***/ },
 
-/***/ 13483
-(__unused_webpack_module, exports, __webpack_require__) {
-
-"use strict";
-
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.StateStore = exports.DEFAULT_HASH_LENGTH = exports.DEFAULT_MAX_HOSTING_FILES = exports.HostingFilesOverLimitError = void 0;
-const fs_1 = __importDefault(__webpack_require__(29021));
-const path_1 = __importDefault(__webpack_require__(33873));
-const crypto_1 = __importDefault(__webpack_require__(55511));
-const child_process_1 = __webpack_require__(79646);
-const error_1 = __webpack_require__(18143);
-/** hosting 指纹文件数超过上限时抛出（触发降级为全量部署） */
-class HostingFilesOverLimitError extends Error {
-    constructor(fileCount, limit) {
-        super(`hosting 文件数 ${fileCount} 超过指纹上限 ${limit}，跳过逐文件 diff，降级为全量部署`);
-        this.name = 'HostingFilesOverLimitError';
-        this.fileCount = fileCount;
-        this.limit = limit;
-    }
-}
-exports.HostingFilesOverLimitError = HostingFilesOverLimitError;
-/** 默认强制忽略的目录/文件（不可被调用方关闭） */
-const DEFAULT_IGNORE = ['.DS_Store', 'node_modules/'];
-/** 默认指纹文件数上限（防快照膨胀与 I/O 失控） */
-exports.DEFAULT_MAX_HOSTING_FILES = 50000;
-/** 默认 hash 截断长度（16 位 hex = 64bit，碰撞概率可忽略；快照体积减半） */
-exports.DEFAULT_HASH_LENGTH = 16;
-/**
- * 部署状态快照（StateStore）
- *
- * 职责：读写 `.cloudbase/state.json`（默认），为 dry-run 的 hosting/app diff 提供本地基准，
- * 避免每次 diff 都拉取云端。
- *
- * 指纹算法：hosting = 产物目录逐文件内容 sha256（相对路径为 key）。
- * 只存 hash 不存内容，体积 = O(文件数)；app 快照不写入 envVariables（敏感过滤）。
- */
-class StateStore {
-    constructor(options = {}) {
-        this.cwd = options.cwd || process.cwd();
-        this.env = options.env;
-        this.stateFile = options.stateFile;
-    }
-    /**
-     * 计算 state 文件路径：
-     * - 自定义 stateFile 优先
-     * - 否则 {cwd}/.cloudbase/state.json（无 env）或 state.{env}.json（多环境隔离）
-     */
-    getFilePath() {
-        if (this.stateFile) {
-            return this.stateFile;
-        }
-        const base = this.env ? `state.${this.env}.json` : 'state.json';
-        return path_1.default.join(this.cwd, '.cloudbase', base);
-    }
-    /**
-     * 读取状态快照；文件不存在或 JSON 损坏返回 null（缺失降级，由调用方走云端兜底）
-     */
-    read() {
-        const filePath = this.getFilePath();
-        if (!fs_1.default.existsSync(filePath)) {
-            return null;
-        }
-        try {
-            return JSON.parse(fs_1.default.readFileSync(filePath, 'utf8'));
-        }
-        catch (_a) {
-            return null;
-        }
-    }
-    /**
-     * 写入状态快照（自动补 version/updatedAt/gitCommit，自动创建 .cloudbase 目录）
-     */
-    write(state) {
-        var _a;
-        const filePath = this.getFilePath();
-        fs_1.default.mkdirSync(path_1.default.dirname(filePath), { recursive: true });
-        const full = {
-            version: 1,
-            updatedAt: new Date().toISOString(),
-            gitCommit: (_a = state.gitCommit) !== null && _a !== void 0 ? _a : this.resolveGitCommit(),
-            envId: state.envId,
-            resources: state.resources
-        };
-        fs_1.default.writeFileSync(filePath, JSON.stringify(full, null, 2), 'utf8');
-    }
-    /**
-     * 计算产物目录逐文件 sha256 指纹（仅 hash，兼容旧调用）
-     *
-     * @param projectPath 产物目录（hosting 的 outputDir / root）
-     * @param ignore 自定义忽略规则（追加到默认 node_modules / .DS_Store 之后）
-     * @param options 扫描选项（maxFiles / hashLength）
-     * @returns 相对路径（/ 分隔）→ 文件内容 sha256（默认截断 16 位）
-     */
-    async computeHostingFiles(projectPath, ignore = [], options = {}) {
-        const fingerprints = await this.computeHostingFingerprints(projectPath, ignore, options);
-        const result = {};
-        for (const [relPath, fp] of Object.entries(fingerprints)) {
-            result[relPath] = fp.hash;
-        }
-        return result;
-    }
-    /**
-     * 计算产物目录逐文件指纹（hash + size）
-     *
-     * - 强制忽略 node_modules / .DS_Store（与传入 ignore 合并，不可关闭）
-     * - hash 默认截断为 16 位 hex（hashLength 可调，64 = 完整 sha256）
-     * - 文件数超过 maxFiles 抛 HostingFilesOverLimitError（防快照膨胀与 I/O 失控）
-     *
-     * @param projectPath 产物目录（hosting 的 outputDir / root）
-     * @param ignore 自定义忽略规则
-     * @param options 扫描选项（maxFiles / hashLength）
-     * @returns 相对路径（/ 分隔）→ { hash, size }
-     */
-    async computeHostingFingerprints(projectPath, ignore = [], options = {}) {
-        if (!fs_1.default.existsSync(projectPath) || !fs_1.default.statSync(projectPath).isDirectory()) {
-            throw new error_1.CloudBaseError(`产物目录不存在或不是目录：${projectPath}`);
-        }
-        const { maxFiles = exports.DEFAULT_MAX_HOSTING_FILES, hashLength = exports.DEFAULT_HASH_LENGTH } = options;
-        const effectiveIgnore = this.mergeIgnore(ignore);
-        const files = {};
-        let count = 0;
-        const walk = (dir, rel) => {
-            for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
-                const entryPath = path_1.default.join(dir, entry.name);
-                const relPath = rel ? path_1.default.join(rel, entry.name) : entry.name;
-                if (entry.isDirectory()) {
-                    if (this.isIgnored(relPath, effectiveIgnore)) {
-                        continue;
-                    }
-                    walk(entryPath, relPath);
-                }
-                else if (entry.isFile() && !this.isIgnored(relPath, effectiveIgnore)) {
-                    count++;
-                    if (maxFiles > 0 && count > maxFiles) {
-                        throw new HostingFilesOverLimitError(count, maxFiles);
-                    }
-                    const normalized = relPath.split(path_1.default.sep).join('/');
-                    files[normalized] = {
-                        hash: this.hashFile(entryPath, hashLength),
-                        size: fs_1.default.statSync(entryPath).size
-                    };
-                }
-            }
-        };
-        walk(projectPath, '');
-        return files;
-    }
-    /**
-     * 计算产物目录与快照的变更集（懒加载）
-     *
-     * 优化：先 stat 拿 size，size 与快照不同的文件直接判定变更（不读文件内容），
-     * 只有 size 相同（或旧快照 size 未知）的文件才读内容 hash 对比，
-     * 避免为未变文件做无谓的 I/O 与 hash。
-     * 文件数超过 maxFiles 时放弃 diff，返回 overLimit=true（调用方应降级为全量部署）。
-     *
-     * @param projectPath 产物目录（hosting 的 outputDir / root）
-     * @param previous 上次快照指纹（undefined = 首次部署，全部视为新增）
-     * @param options 选项（ignore / maxFiles / hashLength）
-     */
-    async diffHostingFiles(projectPath, previous, options = {}) {
-        if (!fs_1.default.existsSync(projectPath) || !fs_1.default.statSync(projectPath).isDirectory()) {
-            throw new error_1.CloudBaseError(`产物目录不存在或不是目录：${projectPath}`);
-        }
-        const { ignore = [], maxFiles = exports.DEFAULT_MAX_HOSTING_FILES, hashLength = exports.DEFAULT_HASH_LENGTH } = options;
-        const effectiveIgnore = this.mergeIgnore(ignore);
-        // 归一化快照：旧格式（string）size 未知 → -1，走 hash 对比而非 size 预判
-        let prev;
-        if (previous) {
-            prev = {};
-            for (const [k, v] of Object.entries(previous)) {
-                prev[k] = this.normalizeFileValue(v);
-            }
-        }
-        const localFiles = new Set();
-        const added = [];
-        const modified = [];
-        let count = 0;
-        let overLimit = false;
-        const walk = (dir, rel) => {
-            if (overLimit) {
-                return;
-            }
-            for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
-                const entryPath = path_1.default.join(dir, entry.name);
-                const relPath = rel ? path_1.default.join(rel, entry.name) : entry.name;
-                if (entry.isDirectory()) {
-                    if (this.isIgnored(relPath, effectiveIgnore)) {
-                        continue;
-                    }
-                    walk(entryPath, relPath);
-                }
-                else if (entry.isFile() && !this.isIgnored(relPath, effectiveIgnore)) {
-                    count++;
-                    if (maxFiles > 0 && count > maxFiles) {
-                        overLimit = true;
-                        return;
-                    }
-                    const normalized = relPath.split(path_1.default.sep).join('/');
-                    localFiles.add(normalized);
-                    const prevEntry = prev === null || prev === void 0 ? void 0 : prev[normalized];
-                    if (!prevEntry) {
-                        added.push(normalized);
-                    }
-                    else if (prevEntry.size !== -1 && prevEntry.size !== fs_1.default.statSync(entryPath).size) {
-                        // size 变化 → 内容必变，无需读文件（懒加载核心）
-                        modified.push(normalized);
-                    }
-                    else {
-                        // size 相同或旧快照 size 未知 → 读内容 hash 确认
-                        const hash = this.hashFile(entryPath, hashLength);
-                        if (prevEntry.hash !== hash) {
-                            modified.push(normalized);
-                        }
-                    }
-                }
-            }
-        };
-        walk(projectPath, '');
-        if (overLimit) {
-            return {
-                added: [],
-                modified: [],
-                deleted: [],
-                totalChanged: 0,
-                unchanged: false,
-                overLimit: true
-            };
-        }
-        const deleted = prev
-            ? Object.keys(prev).filter(k => !localFiles.has(k) && !this.isIgnored(k, effectiveIgnore))
-            : [];
-        const totalChanged = added.length + modified.length + deleted.length;
-        return { added, modified, deleted, totalChanged, unchanged: totalChanged === 0 };
-    }
-    /**
-     * 提取 app 配置快照（仅 diff 白名单字段）
-     * envVariables / ignore 等非 diff 字段与敏感信息不进入快照
-     */
-    buildAppConfig(config) {
-        if (!config || typeof config !== 'object') {
-            return undefined;
-        }
-        const entry = {};
-        if (config.serviceName !== undefined) {
-            entry.serviceName = config.serviceName;
-        }
-        if (config.installCommand !== undefined) {
-            entry.installCommand = config.installCommand;
-        }
-        if (config.buildCommand !== undefined) {
-            entry.buildCommand = config.buildCommand;
-        }
-        if (config.outputDir !== undefined) {
-            entry.outputDir = config.outputDir;
-        }
-        if (config.deployPath !== undefined) {
-            entry.deployPath = config.deployPath;
-        }
-        return entry;
-    }
-    hashFile(filePath, hashLength = exports.DEFAULT_HASH_LENGTH) {
-        const content = fs_1.default.readFileSync(filePath);
-        return crypto_1.default.createHash('sha256').update(content).digest('hex').slice(0, hashLength);
-    }
-    /** 合并默认忽略规则（node_modules / .DS_Store 不可被调用方关闭） */
-    mergeIgnore(ignore) {
-        return Array.from(new Set([...DEFAULT_IGNORE, ...(ignore || [])]));
-    }
-    /** 归一化快照指纹值：旧格式（纯 string = 仅 hash，size 未知用 -1 表示） */
-    normalizeFileValue(value) {
-        if (typeof value === 'string') {
-            return { hash: value, size: -1 };
-        }
-        return value;
-    }
-    /**
-     * 是否命中忽略规则：
-     * - 目录模式（结尾 /）：匹配该目录及其下所有
-     * - glob（含 **）：转换为正则匹配相对路径
-     * - 其余：精确/前缀匹配
-     */
-    isIgnored(relPath, ignore) {
-        const normalized = relPath.split(path_1.default.sep).join('/');
-        for (const pattern of ignore) {
-            if (this.matchPattern(normalized, pattern)) {
-                return true;
-            }
-        }
-        return false;
-    }
-    matchPattern(relPath, pattern) {
-        const p = pattern.trim();
-        if (!p) {
-            return false;
-        }
-        // 目录模式（结尾 /）：匹配目录本身及下所有内容
-        if (p.endsWith('/')) {
-            const prefix = p.slice(0, -1);
-            return relPath === prefix || relPath.startsWith(prefix + '/');
-        }
-        // glob（含 **）：把 ** 转成 .*，其余转义后整体匹配
-        if (p.includes('**')) {
-            const regexStr = '^' +
-                p.split('**').map(part => this.escapeRegExp(part)).join('.*') +
-                '$';
-            return new RegExp(regexStr).test(relPath);
-        }
-        // 精确匹配或前缀匹配（目录下的文件）
-        return relPath === p || relPath.startsWith(p + '/');
-    }
-    escapeRegExp(s) {
-        return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-    }
-    /** 解析当前 git commit（非 git 仓库或失败返回 undefined，不阻断） */
-    resolveGitCommit() {
-        try {
-            const out = (0, child_process_1.execSync)('git rev-parse HEAD', {
-                cwd: this.cwd,
-                stdio: 'pipe'
-            });
-            return out.toString().trim() || undefined;
-        }
-        catch (_a) {
-            return undefined;
-        }
-    }
-}
-exports.StateStore = StateStore;
-
-
-/***/ },
-
-/***/ 1227
+/***/ 19672
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -8195,8 +7765,8 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.StaticDeployer = void 0;
 const path_1 = __importDefault(__webpack_require__(33873));
 const child_process_1 = __webpack_require__(79646);
-const error_1 = __webpack_require__(18143);
-const framework_1 = __webpack_require__(20789);
+const error_1 = __webpack_require__(54884);
+const framework_1 = __webpack_require__(72980);
 /** 环境变量值统一转字符串（execSync env 要求 string） */
 function stringifyEnvValues(envVariables) {
     const result = {};
@@ -8433,7 +8003,7 @@ exports.StaticDeployer = StaticDeployer;
 
 /***/ },
 
-/***/ 83597
+/***/ 43294
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -8482,7 +8052,7 @@ function getGatewayBaseUrl(environment, envId) {
 
 /***/ },
 
-/***/ 20789
+/***/ 72980
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -8720,7 +8290,7 @@ function resolveHostingOutputDir(config, root, readPkgFile = defaultReadPkgFile)
 
 /***/ },
 
-/***/ 78146
+/***/ 84187
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -8731,12 +8301,30 @@ exports.createImageArtifactFromConfig = createImageArtifactFromConfig;
 exports.createImageArtifactFromBuild = createImageArtifactFromBuild;
 exports.createImageArtifactFromCloudBuild = createImageArtifactFromCloudBuild;
 exports.toCloudFunction = toCloudFunction;
-const types_1 = __webpack_require__(22724);
+const error_1 = __webpack_require__(54884);
+const types_1 = __webpack_require__(79345);
 /**
- * 部署物构造与 SCF 参数映射
+ * 解析构建类镜像部署物的 SCF RegistryId
  *
- * 四种构建策略最终都产出统一的部署物，之后走同一条 SCF 创建或更新流程
+ * 个人版镜像（personal，如个人版 CCR）不携带 registryId；企业版优先取
+ * imageConfig.registryId，回退到构建配置 imageConfig.build.registryId。
+ * 正常流程下企业版 registryId 已由 prepareEnterpriseTcrTarget 在构建前解析补齐，
+ * 此处对缺失场景 fail-fast 并给出明确错误：避免产出缺少 RegistryId 的部署物，
+ * 导致后续 SCF 拉取企业版镜像时失败且难以排查。
  */
+function resolveBuildRegistryId(imageConfig) {
+    var _a, _b;
+    if (imageConfig.imageType !== 'enterprise') {
+        return undefined;
+    }
+    const registryId = (_a = imageConfig.registryId) !== null && _a !== void 0 ? _a : (_b = imageConfig.build) === null || _b === void 0 ? void 0 : _b.registryId;
+    if (!registryId) {
+        throw new error_1.CloudBaseError('企业版镜像缺少 TCR 实例 ID（registryId），无法生成镜像部署物。', {
+            code: types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_MISSING
+        });
+    }
+    return registryId;
+}
 /** 由本地代码来源构造代码类部署物 */
 function createCodeArtifact(config) {
     const functionRootPath = 'functionRootPath' in config ? config.functionRootPath : undefined;
@@ -8754,28 +8342,26 @@ function createCodeArtifact(config) {
 }
 /** 由已有镜像配置构造镜像类部署物 */
 function createImageArtifactFromConfig(config) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+    var _a;
     const { imageConfig } = config;
-    // imageType/registryId 的契约位置在配置顶层（IHttpImageRuntimeCommon），
-    // 与 local/cloud 策略一致；imageConfig 内的同名字段仅作向后兼容兜底。
+    // 直接读取 cloudbaserc 嵌套形状：镜像字段全部位于 imageConfig。
     // 个人版镜像（personal，如个人版 CCR）不应携带 registryId。
-    const configuredRegistryId = (_a = config.registryId) !== null && _a !== void 0 ? _a : imageConfig.registryId;
-    const imageType = (_c = (_b = config.imageType) !== null && _b !== void 0 ? _b : imageConfig.imageType) !== null && _c !== void 0 ? _c : (configuredRegistryId ? 'enterprise' : 'personal');
-    const registryId = imageType === 'enterprise' ? configuredRegistryId : undefined;
+    const imageType = imageConfig.imageType;
+    const registryId = imageType === 'enterprise' ? imageConfig.registryId : undefined;
     return {
         kind: 'image',
         deployMode: 'image',
         imageUri: imageConfig.imageUri,
         imageType,
         registryId,
-        imagePort: types_1.IMAGE_FUNCTION_PORT,
+        imagePort: (_a = imageConfig.imagePort) !== null && _a !== void 0 ? _a : types_1.IMAGE_FUNCTION_PORT,
         effectiveStrategy: 'image',
-        entryPoint: (_d = imageConfig.entryPoint) !== null && _d !== void 0 ? _d : config.entryPoint,
-        command: (_e = imageConfig.command) !== null && _e !== void 0 ? _e : config.command,
-        args: (_f = imageConfig.args) !== null && _f !== void 0 ? _f : config.args,
-        commandList: (_g = imageConfig.commandList) !== null && _g !== void 0 ? _g : config.commandList,
-        argsList: (_h = imageConfig.argsList) !== null && _h !== void 0 ? _h : config.argsList,
-        containerImageAccelerate: (_j = imageConfig.containerImageAccelerate) !== null && _j !== void 0 ? _j : config.containerImageAccelerate
+        entryPoint: imageConfig.entryPoint,
+        command: imageConfig.command,
+        args: imageConfig.args,
+        commandList: imageConfig.commandList,
+        argsList: imageConfig.argsList,
+        containerImageAccelerate: imageConfig.containerImageAccelerate
     };
 }
 /**
@@ -8785,11 +8371,10 @@ function createImageArtifactFromConfig(config) {
  * 此处仅承载最终 imageUri/digest 与容器启动配置，之后复用镜像部署链。
  */
 function createImageArtifactFromBuild(config, build) {
-    var _a, _b, _c;
-    const imageType = (_a = config.imageType) !== null && _a !== void 0 ? _a : (((_b = config.registryId) !== null && _b !== void 0 ? _b : config.build.registryId) ? 'enterprise' : 'personal');
-    const registryId = imageType === 'enterprise'
-        ? (_c = config.registryId) !== null && _c !== void 0 ? _c : config.build.registryId
-        : undefined;
+    var _a;
+    const { imageConfig } = config;
+    const imageType = imageConfig.imageType;
+    const registryId = resolveBuildRegistryId(imageConfig);
     return {
         kind: 'image',
         deployMode: 'image',
@@ -8797,14 +8382,14 @@ function createImageArtifactFromBuild(config, build) {
         imageDigest: build.imageDigest,
         imageType,
         registryId,
-        imagePort: types_1.IMAGE_FUNCTION_PORT,
+        imagePort: (_a = imageConfig.imagePort) !== null && _a !== void 0 ? _a : types_1.IMAGE_FUNCTION_PORT,
         effectiveStrategy: 'local',
-        entryPoint: config.entryPoint,
-        command: config.command,
-        args: config.args,
-        commandList: config.commandList,
-        argsList: config.argsList,
-        containerImageAccelerate: config.containerImageAccelerate
+        entryPoint: imageConfig.entryPoint,
+        command: imageConfig.command,
+        args: imageConfig.args,
+        commandList: imageConfig.commandList,
+        argsList: imageConfig.argsList,
+        containerImageAccelerate: imageConfig.containerImageAccelerate
     };
 }
 /**
@@ -8815,30 +8400,29 @@ function createImageArtifactFromBuild(config, build) {
  * effectiveStrategy 标记为 cloud，便于结果层如实回传实际生效的策略。
  */
 function createImageArtifactFromCloudBuild(config, build) {
-    var _a, _b;
-    const imageType = (_a = config.imageType) !== null && _a !== void 0 ? _a : (config.build.registryId ? 'enterprise' : 'personal');
-    const registryId = imageType === 'enterprise'
-        ? (_b = config.registryId) !== null && _b !== void 0 ? _b : config.build.registryId
-        : undefined;
+    var _a;
+    const { imageConfig } = config;
+    const imageType = imageConfig.imageType;
+    // 云端构建默认推送到个人版 TCR（CCR）；企业版实例 ID 位于 imageConfig.build.registryId，
+    // 需继续透传到 Stage B 的 SCF ImageConfig，避免构建成功后拉取镜像时丢失 RegistryId。
+    const registryId = resolveBuildRegistryId(imageConfig);
     return {
         kind: 'image',
         deployMode: 'image',
         imageUri: build.imageUri,
         imageDigest: build.imageDigest,
-        // 云端构建默认推送到个人版 TCR（CCR）；企业版实例 ID 位于 build.registryId，
-        // 需继续透传到 Stage B 的 SCF ImageConfig，避免构建成功后拉取镜像时丢失 RegistryId。
         imageType,
         registryId,
-        imagePort: types_1.IMAGE_FUNCTION_PORT,
+        imagePort: (_a = imageConfig.imagePort) !== null && _a !== void 0 ? _a : types_1.IMAGE_FUNCTION_PORT,
         effectiveStrategy: 'cloud',
         buildId: build.buildId,
         logsUrl: build.logsUrl,
-        entryPoint: config.entryPoint,
-        command: config.command,
-        args: config.args,
-        commandList: config.commandList,
-        argsList: config.argsList,
-        containerImageAccelerate: config.containerImageAccelerate
+        entryPoint: imageConfig.entryPoint,
+        command: imageConfig.command,
+        args: imageConfig.args,
+        commandList: imageConfig.commandList,
+        argsList: imageConfig.argsList,
+        containerImageAccelerate: imageConfig.containerImageAccelerate
     };
 }
 /** 将构建产出的 tag 地址与 digest 合成为 SCF 支持的不可变镜像引用 */
@@ -8960,7 +8544,7 @@ function toCloudFunction(config, artifact) {
 
 /***/ },
 
-/***/ 36114
+/***/ 4295
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -8972,8 +8556,8 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.buildImageOnCloud = buildImageOnCloud;
 const fs_1 = __importDefault(__webpack_require__(29021));
 const path_1 = __importDefault(__webpack_require__(33873));
-const error_1 = __webpack_require__(18143);
-const types_1 = __webpack_require__(22724);
+const error_1 = __webpack_require__(54884);
+const types_1 = __webpack_require__(79345);
 /**
  * 云端镜像构建（cloud 策略）
  *
@@ -9075,11 +8659,12 @@ function assertSafeBuildArgs(buildArgs) {
 /** 个人版 CCR 默认域名 */
 const DEFAULT_PERSONAL_REGISTRY = 'ccr.ccs.tencentyun.com';
 function resolveTarget(config) {
-    const build = config.build;
+    const build = config.imageConfig.build;
+    const imageType = config.imageConfig.imageType;
     const repository = (build.repository || config.name).trim();
     const rawRegistryId = build.registryId;
     const registryId = typeof rawRegistryId === 'string' ? rawRegistryId.trim() : rawRegistryId;
-    const isEnterprise = config.imageType === 'enterprise' || Boolean(registryId);
+    const isEnterprise = imageType === 'enterprise' || Boolean(registryId);
     // CloudApp custom 构建与推送必须使用同一个平台版本 tag。
     // 若允许自定义 tag，build-image 会构建自定义 tag，而固定推送脚本会推
     // $CLOUDBASE_VERSION_NAME，最终必然找不到本地镜像。
@@ -9121,10 +8706,10 @@ function resolveTarget(config) {
         throw new error_1.CloudBaseError('cloud 策略缺少 TCR 命名空间，请配置 build.namespace 或在完整 repository 中声明', { code: types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID });
     }
     assertSafeRegistryToken(namespace, 'TCR namespace');
-    if (config.imageType === 'personal' && registryId) {
+    if (imageType === 'personal' && registryId) {
         throw new error_1.CloudBaseError('cloud 策略的 personal 镜像不能配置 build.registryId；请移除该字段或改用 enterprise', { code: types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID });
     }
-    if (config.imageType === 'enterprise') {
+    if (imageType === 'enterprise') {
         if (rawRegistryId === undefined || rawRegistryId === null) {
             throw new error_1.CloudBaseError('cloud 策略的企业版 TCR 未配置 build.registryId；如果当前没有企业版实例，请改用 imageType=personal', { code: types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_MISSING });
         }
@@ -9149,9 +8734,10 @@ function resolveTarget(config) {
  * CustomSteps 只包含 SDK 固定命令和经过白名单校验的 build arg key。
  */
 function resolveCloudBuildOptions(config) {
-    const dockerfile = config.build.dockerfile || types_1.DEFAULT_DOCKERFILE;
-    const platform = config.build.platform || types_1.DEFAULT_IMAGE_PLATFORM;
-    const buildArgs = config.build.buildArgs || {};
+    const build = config.imageConfig.build;
+    const dockerfile = build.dockerfile || types_1.DEFAULT_DOCKERFILE;
+    const platform = build.platform || types_1.DEFAULT_IMAGE_PLATFORM;
+    const buildArgs = build.buildArgs || {};
     assertSafeDockerfile(dockerfile);
     if (platform !== types_1.DEFAULT_IMAGE_PLATFORM) {
         throw new error_1.CloudBaseError(`当前仅支持构建 ${types_1.DEFAULT_IMAGE_PLATFORM} 镜像`, {
@@ -9163,7 +8749,7 @@ function resolveCloudBuildOptions(config) {
         dockerfile,
         platform,
         buildArgs,
-        forceBuild: config.build.forceBuild === true
+        forceBuild: build.forceBuild === true
     };
 }
 /**
@@ -9236,9 +8822,9 @@ function buildRegistryCredentials(config, target, enterpriseCredential) {
             ]
         };
     }
-    const credential = config.build.registryCredential;
+    const credential = config.imageConfig.build.registryCredential;
     if (!credential) {
-        throw new error_1.CloudBaseError('个人版 TCR 云端构建缺少 build.registryCredential；请在 cloudbaserc 中显式声明 ' +
+        throw new error_1.CloudBaseError('个人版 TCR 云端构建缺少 imageConfig.build.registryCredential；请在 cloudbaserc 中显式声明 ' +
             'username/password，推荐分别使用 "{{env.TCB_TCR_USERNAME}}" 和 ' +
             '"{{env.TCB_TCR_PASSWORD}}"', { code: types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_MISSING });
     }
@@ -9262,7 +8848,7 @@ function buildRegistryCredentials(config, target, enterpriseCredential) {
     };
 }
 function resolveCloudBuildContext(config, dockerfile) {
-    const cwd = path_1.default.resolve(config.build.cwd || config.functionPath || process.cwd());
+    const cwd = path_1.default.resolve(config.imageConfig.build.cwd || config.functionPath || process.cwd());
     const dockerfilePath = path_1.default.resolve(cwd, dockerfile);
     let stat = null;
     try {
@@ -9444,7 +9030,7 @@ async function pollUntilTerminal(params) {
 
 /***/ },
 
-/***/ 11903
+/***/ 68388
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -9453,7 +9039,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.TCR_PUSH_GRANT_URL = exports.IMAGE_PULL_GRANT_URL = exports.REQUIRED_TCR_PUSH_POLICY = exports.TCB_PUSH_ENTERPRISE_IMAGE_ROLE = exports.REQUIRED_IMAGE_PULL_POLICY = exports.SCF_PULL_IMAGE_ROLE = void 0;
 exports.isCamPermissionError = isCamPermissionError;
 exports.runImagePullAuthPreflight = runImagePullAuthPreflight;
-const types_1 = __webpack_require__(22724);
+const types_1 = __webpack_require__(79345);
 /**
  * 镜像仓库授权 Preflight（涉及 CAM，scope: cloud）
  *
@@ -9524,9 +9110,10 @@ function needsImagePullAuth(config) {
 }
 /** 只有企业版 cloud 策略需要 CloudApp 向企业版 TCR 推送镜像 */
 function needsEnterpriseTcrPushAuth(config) {
+    var _a;
     return (config.type === 'HTTP' &&
         config.buildStrategy === 'cloud' &&
-        config.imageType === 'enterprise');
+        ((_a = config.imageConfig) === null || _a === void 0 ? void 0 : _a.imageType) === 'enterprise');
 }
 function resolveRequirements(config) {
     const requirements = [];
@@ -9625,7 +9212,7 @@ async function runImagePullAuthPreflight(service, config, autoGrant = true) {
 
 /***/ },
 
-/***/ 52244
+/***/ 43587
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -9638,10 +9225,10 @@ exports.createCloudBuildService = createCloudBuildService;
 const fs_1 = __importDefault(__webpack_require__(29021));
 const os_1 = __importDefault(__webpack_require__(21820));
 const path_1 = __importDefault(__webpack_require__(33873));
-const error_1 = __webpack_require__(18143);
-const utils_1 = __webpack_require__(24263);
-const http_request_1 = __webpack_require__(7355);
-const types_1 = __webpack_require__(22724);
+const error_1 = __webpack_require__(54884);
+const utils_1 = __webpack_require__(88208);
+const http_request_1 = __webpack_require__(2922);
+const types_1 = __webpack_require__(79345);
 /**
  * 基于 CloudAppService 的云端构建能力适配器
  *
@@ -9810,7 +9397,7 @@ function createCloudBuildService(cloudApp, options = {}) {
 
 /***/ },
 
-/***/ 69238
+/***/ 74931
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -9822,12 +9409,15 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.parseImageReference = parseImageReference;
 exports.normalizeGatewayPath = normalizeGatewayPath;
 exports.isCustomImageRuntime = isCustomImageRuntime;
+exports.applyMinimalDeployConfigDefaults = applyMinimalDeployConfigDefaults;
+exports.getMissingDeployInputs = getMissingDeployInputs;
+exports.prepareMinimalDeployConfig = prepareMinimalDeployConfig;
 exports.normalizeDeployConfig = normalizeDeployConfig;
 exports.checkDeployConfig = checkDeployConfig;
 exports.assertDeployConfig = assertDeployConfig;
 const lodash_1 = __importDefault(__webpack_require__(35558));
-const error_1 = __webpack_require__(18143);
-const types_1 = __webpack_require__(22724);
+const error_1 = __webpack_require__(54884);
+const types_1 = __webpack_require__(79345);
 /**
  * 配置契约守卫
  *
@@ -9979,18 +9569,151 @@ function inferHttpBuildStrategy(config) {
     if (config === null || config === void 0 ? void 0 : config.buildStrategy) {
         return config.buildStrategy;
     }
-    if (config === null || config === void 0 ? void 0 : config.imageConfig) {
-        return 'image';
-    }
-    if (config === null || config === void 0 ? void 0 : config.build) {
+    const imageConfig = config === null || config === void 0 ? void 0 : config.imageConfig;
+    if (imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.build) {
         // 有构建上下文但未声明策略时，默认使用无需本地 Docker 的云端构建
         return 'cloud';
     }
+    if (imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.imageUri) {
+        return 'image';
+    }
     if (isCustomImageRuntime(config === null || config === void 0 ? void 0 : config.runtime)) {
         return 'image';
     }
     return 'zip';
 }
+/**
+ * 应用最小化镜像配置的可安全默认值，不执行 IO，不生成凭证。
+ * 仅填充构建上下文、仓库名、namespace 和运行时固定值；用户凭证必须显式传入。
+ *
+ * 直接在 cloudbaserc 的嵌套形状上操作：镜像字段位于 imageConfig，构建目标位于
+ * imageConfig.build，不再做字段平铺映射。
+ */
+function applyMinimalDeployConfigDefaults(config, context = {}) {
+    var _a, _b, _c, _d, _e, _f, _g;
+    const result = lodash_1.default.cloneDeep(config);
+    if ((result === null || result === void 0 ? void 0 : result.type) !== 'HTTP') {
+        return result;
+    }
+    const strategy = inferHttpBuildStrategy(result);
+    if (!['image', 'local', 'cloud'].includes(strategy)) {
+        return result;
+    }
+    result.buildStrategy = strategy;
+    const imageConfig = Object.assign({}, (result.imageConfig || {}));
+    result.imageConfig = imageConfig;
+    if (strategy === 'image') {
+        if (imageConfig.imageUri === undefined && ((_a = context.defaults) === null || _a === void 0 ? void 0 : _a.imageUri) !== undefined) {
+            imageConfig.imageUri = context.defaults.imageUri;
+        }
+        return result;
+    }
+    if (result.runtime === undefined) {
+        result.runtime = types_1.CUSTOM_IMAGE_RUNTIME;
+    }
+    if (imageConfig.imagePort === undefined) {
+        imageConfig.imagePort = types_1.IMAGE_FUNCTION_PORT;
+    }
+    const build = Object.assign({}, (imageConfig.build || {}));
+    imageConfig.build = build;
+    const functionPath = context.functionPath ||
+        (context.functionRootPath && result.name ? `${context.functionRootPath}/${result.name}` : undefined);
+    if (build.cwd === undefined && functionPath) {
+        build.cwd = functionPath;
+    }
+    if (build.dockerfile === undefined) {
+        build.dockerfile = types_1.DEFAULT_DOCKERFILE;
+    }
+    if (build.platform === undefined) {
+        build.platform = types_1.DEFAULT_IMAGE_PLATFORM;
+    }
+    const defaultRepository = (_c = (_b = context.defaults) === null || _b === void 0 ? void 0 : _b.repository) !== null && _c !== void 0 ? _c : result.name;
+    const defaultNamespace = (_e = (_d = context.defaults) === null || _d === void 0 ? void 0 : _d.namespace) !== null && _e !== void 0 ? _e : context.envId;
+    if (build.repository === undefined && defaultRepository !== undefined) {
+        build.repository = defaultRepository;
+    }
+    if (build.namespace === undefined && defaultNamespace !== undefined) {
+        build.namespace = defaultNamespace;
+    }
+    if (imageConfig.registryId === undefined && ((_f = context.defaults) === null || _f === void 0 ? void 0 : _f.registryId) !== undefined) {
+        imageConfig.registryId = context.defaults.registryId;
+    }
+    if (build.registryCredential === undefined && ((_g = context.defaults) === null || _g === void 0 ? void 0 : _g.registryCredential) !== undefined) {
+        build.registryCredential = lodash_1.default.cloneDeep(context.defaults.registryCredential);
+    }
+    return result;
+}
+/**
+ * 返回最小化部署在当前配置下仍缺失的输入字段；不执行网络、文件或凭证操作。
+ */
+function getMissingDeployInputs(config, context = {}) {
+    var _a, _b, _c;
+    const normalized = lodash_1.default.cloneDeep(config);
+    const missing = [];
+    if ((normalized === null || normalized === void 0 ? void 0 : normalized.type) !== 'HTTP') {
+        return missing;
+    }
+    const strategy = (_a = normalized.buildStrategy) !== null && _a !== void 0 ? _a : inferHttpBuildStrategy(normalized);
+    if (!['image', 'local', 'cloud'].includes(strategy)) {
+        return missing;
+    }
+    const imageConfig = normalized.imageConfig || {};
+    if (strategy === 'image') {
+        if (!imageConfig.imageUri) {
+            missing.push({ name: 'imageUri', path: 'imageConfig.imageUri', required: true, reason: '已有镜像部署需要固定 tag 或 digest 的 imageUri' });
+        }
+        return missing;
+    }
+    const build = imageConfig.build || {};
+    const imageType = imageConfig.imageType || (imageConfig.registryId || build.registryId ? 'enterprise' : 'personal');
+    if (imageType === 'enterprise') {
+        if (!imageConfig.registryId && !build.registryId) {
+            missing.push({ name: 'registryId', path: 'imageConfig.registryId', required: true, reason: '企业版镜像构建需要指定 TCR 实例 ID' });
+        }
+        if (!build.repository) {
+            missing.push({ name: 'repository', path: 'imageConfig.build.repository', required: true, reason: '企业版镜像构建需要目标仓库' });
+        }
+        return missing;
+    }
+    const namespace = build.namespace || context.envId;
+    if (!namespace) {
+        missing.push({ name: 'namespace', path: 'imageConfig.build.namespace', required: true, reason: '个人版镜像构建需要 namespace，且无法从 envId 推导' });
+    }
+    if (!((_b = build.registryCredential) === null || _b === void 0 ? void 0 : _b.username)) {
+        missing.push({ name: 'registryCredential.username', path: 'imageConfig.build.registryCredential.username', required: true, reason: '个人版 TCR 构建需要推送用户名' });
+    }
+    if (!((_c = build.registryCredential) === null || _c === void 0 ? void 0 : _c.password)) {
+        missing.push({ name: 'registryCredential.password', path: 'imageConfig.build.registryCredential.password', required: true, reason: '个人版 TCR 构建需要推送密码' });
+    }
+    return missing;
+}
+/**
+ * 生成最小化配置准备结果：先应用安全默认值，再返回剩余缺失字段和默认值路径。
+ */
+function prepareMinimalDeployConfig(config, context = {}) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3;
+    const prepared = applyMinimalDeployConfigDefaults(config, context);
+    const missing = getMissingDeployInputs(prepared, { envId: context.envId });
+    const original = lodash_1.default.cloneDeep(config);
+    const preparedAny = prepared;
+    const appliedDefaults = [];
+    const candidates = [
+        ['imageConfig.imageUri', (_a = original.imageConfig) === null || _a === void 0 ? void 0 : _a.imageUri, (_b = preparedAny.imageConfig) === null || _b === void 0 ? void 0 : _b.imageUri],
+        ['imageConfig.build.cwd', (_d = (_c = original.imageConfig) === null || _c === void 0 ? void 0 : _c.build) === null || _d === void 0 ? void 0 : _d.cwd, (_f = (_e = preparedAny.imageConfig) === null || _e === void 0 ? void 0 : _e.build) === null || _f === void 0 ? void 0 : _f.cwd],
+        ['imageConfig.build.dockerfile', (_h = (_g = original.imageConfig) === null || _g === void 0 ? void 0 : _g.build) === null || _h === void 0 ? void 0 : _h.dockerfile, (_k = (_j = preparedAny.imageConfig) === null || _j === void 0 ? void 0 : _j.build) === null || _k === void 0 ? void 0 : _k.dockerfile],
+        ['imageConfig.build.platform', (_m = (_l = original.imageConfig) === null || _l === void 0 ? void 0 : _l.build) === null || _m === void 0 ? void 0 : _m.platform, (_p = (_o = preparedAny.imageConfig) === null || _o === void 0 ? void 0 : _o.build) === null || _p === void 0 ? void 0 : _p.platform],
+        ['imageConfig.build.repository', (_r = (_q = original.imageConfig) === null || _q === void 0 ? void 0 : _q.build) === null || _r === void 0 ? void 0 : _r.repository, (_t = (_s = preparedAny.imageConfig) === null || _s === void 0 ? void 0 : _s.build) === null || _t === void 0 ? void 0 : _t.repository],
+        ['imageConfig.build.namespace', (_v = (_u = original.imageConfig) === null || _u === void 0 ? void 0 : _u.build) === null || _v === void 0 ? void 0 : _v.namespace, (_x = (_w = preparedAny.imageConfig) === null || _w === void 0 ? void 0 : _w.build) === null || _x === void 0 ? void 0 : _x.namespace],
+        ['imageConfig.registryId', (_y = original.imageConfig) === null || _y === void 0 ? void 0 : _y.registryId, (_z = preparedAny.imageConfig) === null || _z === void 0 ? void 0 : _z.registryId],
+        ['imageConfig.build.registryCredential', (_1 = (_0 = original.imageConfig) === null || _0 === void 0 ? void 0 : _0.build) === null || _1 === void 0 ? void 0 : _1.registryCredential, (_3 = (_2 = preparedAny.imageConfig) === null || _2 === void 0 ? void 0 : _2.build) === null || _3 === void 0 ? void 0 : _3.registryCredential]
+    ];
+    candidates.forEach(([fieldPath, before, after]) => {
+        if (before === undefined && after !== undefined) {
+            appliedDefaults.push(fieldPath);
+        }
+    });
+    return { config: prepared, missing, appliedDefaults };
+}
 /**
  * 规范化部署配置
  *
@@ -9998,7 +9721,7 @@ function inferHttpBuildStrategy(config) {
  * 以便 checkDeployConfig 汇总全部问题
  */
 function normalizeDeployConfig(config) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
     if (!config || typeof config !== 'object') {
         throw new error_1.CloudBaseError('部署配置必须是对象', {
             code: types_1.FUNCTION_DEPLOY_ERROR.CONFIG_INVALID
@@ -10026,20 +9749,20 @@ function normalizeDeployConfig(config) {
             // node_modules 必须随代码包上传，不能被 ignore 排除
             ignore: ignoreList.filter((item) => !/node_modules/.test(item)) });
     }
-    const normalizedImage = Object.assign(Object.assign({}, cloned), { type: 'HTTP', buildStrategy, runtime: types_1.CUSTOM_IMAGE_RUNTIME, imagePort: (_a = cloned.imagePort) !== null && _a !== void 0 ? _a : types_1.IMAGE_FUNCTION_PORT });
-    normalizedImage.imageType =
-        (_d = (_b = cloned.imageType) !== null && _b !== void 0 ? _b : (_c = cloned.imageConfig) === null || _c === void 0 ? void 0 : _c.imageType) !== null && _d !== void 0 ? _d : (((_g = (_e = cloned.registryId) !== null && _e !== void 0 ? _e : (_f = cloned.imageConfig) === null || _f === void 0 ? void 0 : _f.registryId) !== null && _g !== void 0 ? _g : (_h = cloned.build) === null || _h === void 0 ? void 0 : _h.registryId)
-            ? 'enterprise'
-            : 'personal');
+    const imageConfig = Object.assign({}, (cloned.imageConfig || {}));
+    const normalizedImage = Object.assign(Object.assign({}, cloned), { type: 'HTTP', buildStrategy, runtime: types_1.CUSTOM_IMAGE_RUNTIME, imageConfig });
+    imageConfig.imagePort = (_a = imageConfig.imagePort) !== null && _a !== void 0 ? _a : types_1.IMAGE_FUNCTION_PORT;
+    imageConfig.imageType =
+        (_b = imageConfig.imageType) !== null && _b !== void 0 ? _b : (((_c = imageConfig.registryId) !== null && _c !== void 0 ? _c : (_d = imageConfig.build) === null || _d === void 0 ? void 0 : _d.registryId) ? 'enterprise' : 'personal');
     // 镜像函数由容器启动命令决定入口，不使用 handler 与云端装依赖
     delete normalizedImage.handler;
     delete normalizedImage.installDependency;
     if (buildStrategy === 'cloud' || buildStrategy === 'local') {
-        normalizedImage.build = Object.assign(Object.assign({}, (cloned.build || {})), { dockerfile: (_k = (_j = cloned.build) === null || _j === void 0 ? void 0 : _j.dockerfile) !== null && _k !== void 0 ? _k : types_1.DEFAULT_DOCKERFILE, platform: (_m = (_l = cloned.build) === null || _l === void 0 ? void 0 : _l.platform) !== null && _m !== void 0 ? _m : types_1.DEFAULT_IMAGE_PLATFORM });
+        imageConfig.build = Object.assign(Object.assign({}, (imageConfig.build || {})), { dockerfile: (_f = (_e = imageConfig.build) === null || _e === void 0 ? void 0 : _e.dockerfile) !== null && _f !== void 0 ? _f : types_1.DEFAULT_DOCKERFILE, platform: (_h = (_g = imageConfig.build) === null || _g === void 0 ? void 0 : _g.platform) !== null && _h !== void 0 ? _h : types_1.DEFAULT_IMAGE_PLATFORM });
     }
     if (buildStrategy === 'local') {
         // 默认不静默改变构建环境
-        normalizedImage.localFallback = (_o = cloned.localFallback) !== null && _o !== void 0 ? _o : 'error';
+        imageConfig.localFallback = (_j = imageConfig.localFallback) !== null && _j !== void 0 ? _j : 'error';
     }
     return normalizedImage;
 }
@@ -10150,10 +9873,11 @@ function checkHttpCommon(raw, checks) {
 }
 /** 校验镜像函数公共约束 */
 function checkImageRuntimeCommon(raw, checks) {
+    var _a;
     if (raw.runtime !== undefined && !isCustomImageRuntime(raw.runtime)) {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_RUNTIME_INVALID, `镜像部署要求 runtime 为 ${types_1.CUSTOM_IMAGE_RUNTIME}`, `当前为 ${raw.runtime}，请移除 runtime 或设置为 ${types_1.CUSTOM_IMAGE_RUNTIME}`));
     }
-    if (raw.imagePort !== undefined && raw.imagePort !== types_1.IMAGE_FUNCTION_PORT) {
+    if (((_a = raw.imageConfig) === null || _a === void 0 ? void 0 : _a.imagePort) !== undefined && raw.imageConfig.imagePort !== types_1.IMAGE_FUNCTION_PORT) {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_PORT_INVALID, `镜像监听端口必须为 ${types_1.IMAGE_FUNCTION_PORT}`, `请让容器监听 ${types_1.IMAGE_FUNCTION_PORT} 端口`));
     }
     if (raw.handler !== undefined) {
@@ -10185,17 +9909,17 @@ function checkImageReference(imageConfig, checks) {
 }
 /**
  * 校验镜像类型与仓库 ID
- * image 策略从 imageConfig.registryId（兼容顶层 registryId）读取；
- * local/cloud 策略从 build.registryId 读取，imageType 仍位于镜像运行时公共配置顶层。
+ * 直接读取 cloudbaserc 嵌套形状：imageType 位于 imageConfig.imageType；
+ * registryId 位于 imageConfig.registryId（cloud/local 兼容 imageConfig.build.registryId）。
  */
 function checkImageIdentity(raw, checks) {
-    var _a, _b, _c, _d, _e;
+    var _a;
     const imageConfig = raw === null || raw === void 0 ? void 0 : raw.imageConfig;
-    const buildRegistryId = (_a = raw === null || raw === void 0 ? void 0 : raw.build) === null || _a === void 0 ? void 0 : _a.registryId;
+    const build = imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.build;
+    const buildRegistryId = build === null || build === void 0 ? void 0 : build.registryId;
     const buildStrategy = raw === null || raw === void 0 ? void 0 : raw.buildStrategy;
-    const registryId = (_c = (_b = raw === null || raw === void 0 ? void 0 : raw.registryId) !== null && _b !== void 0 ? _b : imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.registryId) !== null && _c !== void 0 ? _c : buildRegistryId;
-    const explicitImageType = (_d = raw === null || raw === void 0 ? void 0 : raw.imageType) !== null && _d !== void 0 ? _d : imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.imageType;
-    const imageType = resolveBuildImageType(raw, (_e = raw === null || raw === void 0 ? void 0 : raw.build) !== null && _e !== void 0 ? _e : {});
+    const registryId = (_a = imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.registryId) !== null && _a !== void 0 ? _a : buildRegistryId;
+    const imageType = resolveBuildImageType(raw, build !== null && build !== void 0 ? build : {});
     if (imageType !== 'enterprise' && imageType !== 'personal') {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID, buildStrategy === 'cloud' || buildStrategy === 'local'
             ? `${buildStrategy} 策略必须显式声明镜像类型`
@@ -10204,25 +9928,25 @@ function checkImageIdentity(raw, checks) {
     }
     if (imageType === 'enterprise') {
         if (buildStrategy === 'image' && (registryId === undefined || registryId === null)) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_MISSING, '企业版镜像未配置仓库实例 ID', '请配置 imageConfig.registryId 或顶层 registryId'));
+            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_MISSING, '企业版镜像未配置仓库实例 ID', '请配置 imageConfig.registryId'));
         }
         else if (registryId !== undefined && (typeof registryId !== 'string' || !registryId.trim())) {
             const registryField = buildStrategy === 'cloud' || buildStrategy === 'local'
-                ? 'build.registryId'
-                : 'registryId';
+                ? 'imageConfig.build.registryId'
+                : 'imageConfig.registryId';
             checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_INVALID, '企业版镜像仓库实例 ID 无效', `${registryField} 已声明但解析结果为空；若使用 {{env.*}}，请检查对应环境变量已赋值为实际企业版 TCR 实例 ID`));
         }
     }
     else if (registryId !== undefined) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID, '个人版镜像不能配置企业版仓库实例 ID', '请移除 build.registryId，或将 imageType 设置为 enterprise'));
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID, '个人版镜像不能配置企业版仓库实例 ID', '请移除 imageConfig.build.registryId，或将 imageConfig.imageType 设置为 enterprise'));
     }
 }
 /** 解析构建策略使用的镜像类型 */
 function resolveBuildImageType(raw, build) {
-    var _a, _b, _c, _d, _e, _f;
-    return (_c = (_a = raw.imageType) !== null && _a !== void 0 ? _a : (_b = raw.imageConfig) === null || _b === void 0 ? void 0 : _b.imageType) !== null && _c !== void 0 ? _c : (raw.buildStrategy === 'local' || raw.buildStrategy === 'cloud'
+    var _a, _b, _c, _d;
+    return (_b = (_a = raw.imageConfig) === null || _a === void 0 ? void 0 : _a.imageType) !== null && _b !== void 0 ? _b : (raw.buildStrategy === 'local' || raw.buildStrategy === 'cloud'
         ? 'enterprise'
-        : ((_f = (_d = raw.registryId) !== null && _d !== void 0 ? _d : (_e = raw.imageConfig) === null || _e === void 0 ? void 0 : _e.registryId) !== null && _f !== void 0 ? _f : build.registryId)
+        : ((_d = (_c = raw.imageConfig) === null || _c === void 0 ? void 0 : _c.registryId) !== null && _d !== void 0 ? _d : build.registryId)
             ? 'enterprise'
             : 'personal');
 }
@@ -10263,9 +9987,9 @@ function checkBuildSource(build, checks) {
 }
 /** 判断当前构建策略是否要求完整仓库地址 */
 function requiresFullBuildRepository(raw, imageType) {
-    var _a;
+    var _a, _b;
     return raw.buildStrategy === 'local' && imageType === 'personal' &&
-        ((_a = raw.build) === null || _a === void 0 ? void 0 : _a.repository) !== undefined;
+        ((_b = (_a = raw.imageConfig) === null || _a === void 0 ? void 0 : _a.build) === null || _b === void 0 ? void 0 : _b.repository) !== undefined;
 }
 /** 添加仓库地址缺失或不完整的错误 */
 function addFullRepositoryError(raw, checks, missing) {
@@ -10362,6 +10086,12 @@ function checkBuildRegistry(raw, build, checks) {
     const imageType = resolveBuildImageType(raw, build);
     const registryCredential = build.registryCredential;
     if (imageType === 'personal') {
+        if (build.namespace !== undefined &&
+            (typeof build.namespace !== 'string' ||
+                !build.namespace.trim() ||
+                !IMAGE_REPOSITORY_PATTERN.test(build.namespace.trim()))) {
+            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID, '个人版 TCR 命名空间未配置或不合法', 'build.namespace 必须为合法的个人版 TCR 命名空间；未声明时可由 envId 默认补齐'));
+        }
         checkPersonalRegistryCredential(registryCredential, checks);
         return;
     }
@@ -10371,9 +10101,10 @@ function checkBuildRegistry(raw, build, checks) {
 }
 /** 校验镜像构建目标配置 */
 function checkBuildTarget(raw, checks) {
-    const build = raw.build;
+    var _a, _b;
+    const build = (_a = raw.imageConfig) === null || _a === void 0 ? void 0 : _a.build;
     if (!lodash_1.default.isPlainObject(build)) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONFIG_MISSING, '缺少镜像构建配置', '请配置 build，至少包含构建上下文与 Dockerfile 信息'));
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONFIG_MISSING, '缺少镜像构建配置', '请配置 imageConfig.build，至少包含构建上下文与 Dockerfile 信息'));
         return;
     }
     checks.push(...checkBuildTag(raw, build));
@@ -10381,8 +10112,8 @@ function checkBuildTarget(raw, checks) {
     checkBuildRepository(raw, build, checks);
     checkBuildArgs(raw, build, checks);
     checkBuildRegistry(raw, build, checks);
-    if (raw.imageConfig !== undefined) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_CONFIG_NOT_ALLOWED, `buildStrategy 为 ${raw.buildStrategy} 时不能指定 imageConfig`, '镜像地址将由构建结果决定，如需直接部署已有镜像请使用 buildStrategy: image'));
+    if (((_b = raw.imageConfig) === null || _b === void 0 ? void 0 : _b.imageUri) !== undefined) {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_CONFIG_NOT_ALLOWED, `buildStrategy 为 ${raw.buildStrategy} 时不能指定 imageConfig.imageUri`, '镜像地址将由构建结果决定，如需直接部署已有镜像请使用 buildStrategy: image'));
     }
 }
 /**
@@ -10390,6 +10121,7 @@ function checkBuildTarget(raw, checks) {
  * @returns 检查报告，包含全部问题而非仅第一个
  */
 function checkDeployConfig(config) {
+    var _a;
     const checks = [];
     if (!config || typeof config !== 'object') {
         return {
@@ -10439,16 +10171,16 @@ function checkDeployConfig(config) {
                 }
                 else {
                     checkImageReference(raw.imageConfig, checks);
-                    // imageType 在顶层，registryId 允许顶层或 imageConfig，统一传 raw
+                    // imageType 与 registryId 位于 imageConfig，统一传 raw 由 checkImageIdentity 读取
                     checkImageIdentity(raw, checks);
-                    // 注：imagePort 定义在顶层，已由 checkImageRuntimeCommon 校验，此处不重复
+                    // 注：imagePort 位于 imageConfig，已由 checkImageRuntimeCommon 校验，此处不重复
                 }
             }
             else {
                 checkImageIdentity(raw, checks);
                 checkBuildTarget(raw, checks);
                 if (strategy === 'local') {
-                    const fallback = raw.localFallback;
+                    const fallback = (_a = raw.imageConfig) === null || _a === void 0 ? void 0 : _a.localFallback;
                     if (fallback !== undefined && fallback !== 'cloud' && fallback !== 'error') {
                         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.LOCAL_FALLBACK_INVALID, 'localFallback 取值不合法', "只能是 'cloud' 或 'error'"));
                     }
@@ -10491,7 +10223,7 @@ function assertDeployConfig(config) {
 
 /***/ },
 
-/***/ 30710
+/***/ 48947
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -10499,7 +10231,7 @@ function assertDeployConfig(config) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.runDockerPreflight = runDockerPreflight;
 const child_process_1 = __webpack_require__(79646);
-const types_1 = __webpack_require__(22724);
+const types_1 = __webpack_require__(79345);
 /**
  * Docker 本地能力 Preflight（local 策略，scope: local）
  *
@@ -10586,7 +10318,7 @@ async function runDockerPreflight(runner = defaultRunner) {
 
 /***/ },
 
-/***/ 26719
+/***/ 84638
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -10595,9 +10327,9 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.prepareEnterpriseTcrTarget = prepareEnterpriseTcrTarget;
 exports.createEnterpriseTcrCredential = createEnterpriseTcrCredential;
 exports.createTcrApiService = createTcrApiService;
-const error_1 = __webpack_require__(18143);
-const types_1 = __webpack_require__(22724);
-const config_guard_1 = __webpack_require__(69238);
+const error_1 = __webpack_require__(54884);
+const types_1 = __webpack_require__(79345);
+const config_guard_1 = __webpack_require__(74931);
 const TCR_API_VERSION = '2019-09-24';
 const NAMESPACE_PATTERN = /^[a-z0-9](?:[a-z0-9]|[._-](?![._-])){0,28}[a-z0-9]$/;
 function responseOf(result) {
@@ -10734,22 +10466,23 @@ async function ensureNamespace(service, registryId, namespace) {
 }
 async function prepareEnterpriseTcrTarget(config, options) {
     var _a;
-    const configuredRegistryId = (_a = config.registryId) !== null && _a !== void 0 ? _a : config.build.registryId;
+    const build = config.imageConfig.build;
+    const configuredRegistryId = (_a = config.imageConfig.registryId) !== null && _a !== void 0 ? _a : build.registryId;
     const explicitRegistryId = typeof configuredRegistryId === 'string' && configuredRegistryId.trim()
         ? configuredRegistryId.trim()
         : undefined;
     const resolvedRegistry = await resolveRegistry(options.service, options.region, explicitRegistryId);
-    const repositoryTarget = parseRepositoryTarget(config.build.repository || config.name);
-    const namespace = (config.build.namespace || repositoryTarget.namespace || options.envId).trim();
+    const repositoryTarget = parseRepositoryTarget(build.repository || config.name);
+    const namespace = (build.namespace || repositoryTarget.namespace || options.envId).trim();
     assertNamespace(namespace);
-    if (config.build.namespace && repositoryTarget.namespace && config.build.namespace !== repositoryTarget.namespace) {
-        throwTcrError('build.namespace 与 build.repository 中的命名空间不一致。', types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID);
+    if (build.namespace && repositoryTarget.namespace && build.namespace !== repositoryTarget.namespace) {
+        throwTcrError('imageConfig.build.namespace 与 imageConfig.build.repository 中的命名空间不一致。', types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID);
     }
     await ensureNamespace(options.service, resolvedRegistry.registryId, namespace);
     const registry = repositoryTarget.registry || resolvedRegistry.registry;
     const repository = repositoryTarget.repository || config.name;
     const imageRepository = `${registry}/${namespace}/${repository}`;
-    const preparedConfig = Object.assign(Object.assign({}, config), { imageType: 'enterprise', registryId: resolvedRegistry.registryId, build: Object.assign(Object.assign({}, config.build), { registryId: resolvedRegistry.registryId, namespace, repository: imageRepository }) });
+    const preparedConfig = Object.assign(Object.assign({}, config), { imageConfig: Object.assign(Object.assign({}, config.imageConfig), { imageType: 'enterprise', registryId: resolvedRegistry.registryId, build: Object.assign(Object.assign({}, build), { registryId: resolvedRegistry.registryId, namespace, repository: imageRepository }) }) });
     return {
         config: preparedConfig,
         target: {
@@ -10788,7 +10521,7 @@ function createTcrApiService(environment) {
 
 /***/ },
 
-/***/ 56749
+/***/ 67650
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -10796,8 +10529,8 @@ function createTcrApiService(environment) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.runImageRemotePreflight = runImageRemotePreflight;
 const child_process_1 = __webpack_require__(79646);
-const config_guard_1 = __webpack_require__(69238);
-const types_1 = __webpack_require__(22724);
+const config_guard_1 = __webpack_require__(74931);
+const types_1 = __webpack_require__(79345);
 /**
  * 镜像远端校验 Preflight（有 IO，scope: cloud）
  *
@@ -10960,7 +10693,7 @@ async function runImageRemotePreflight(config, deployRegion, deps = defaultDeps)
 
 /***/ },
 
-/***/ 32378
+/***/ 94285
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -10999,7 +10732,7 @@ async function resolveImageTag(options) {
 
 /***/ },
 
-/***/ 49515
+/***/ 52948
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -11017,9 +10750,9 @@ const child_process_1 = __webpack_require__(79646);
 const fs_1 = __importDefault(__webpack_require__(29021));
 const os_1 = __importDefault(__webpack_require__(21820));
 const path_1 = __importDefault(__webpack_require__(33873));
-const error_1 = __webpack_require__(18143);
-const types_1 = __webpack_require__(22724);
-const image_tag_1 = __webpack_require__(32378);
+const error_1 = __webpack_require__(54884);
+const types_1 = __webpack_require__(79345);
+const image_tag_1 = __webpack_require__(94285);
 /**
  * 本地镜像构建与推送（local 策略，个人版先行版）
  *
@@ -11066,18 +10799,19 @@ const defaultDeps = {
 };
 /** 解析构建上下文目录（绝对路径） */
 function resolveContext(config) {
-    const cwd = config.build.cwd || config.functionPath || process.cwd();
+    const cwd = config.imageConfig.build.cwd || config.functionPath || process.cwd();
     return path_1.default.resolve(cwd);
 }
 /** 解析目标镜像完整引用 imageUri（repository 需为含域名与命名空间的完整仓库地址，个人版/企业版通用） */
 async function resolveImageUri(config, context) {
-    const repository = config.build.repository;
+    const build = config.imageConfig.build;
+    const repository = build.repository;
     if (typeof repository !== 'string' || !repository.trim()) {
-        throw new error_1.CloudBaseError('local 策略缺少目标镜像仓库地址 build.repository', {
+        throw new error_1.CloudBaseError('local 策略缺少目标镜像仓库地址 imageConfig.build.repository', {
             code: types_1.FUNCTION_DEPLOY_ERROR.LOCAL_BUILD_REPOSITORY_MISSING
         });
     }
-    const tag = await (0, image_tag_1.resolveImageTag)({ explicitTag: config.build.tag, cwd: context });
+    const tag = await (0, image_tag_1.resolveImageTag)({ explicitTag: build.tag, cwd: context });
     return `${repository.trim()}:${tag}`;
 }
 /** 从 buildx imagetools inspect 输出解析 digest */
@@ -11111,7 +10845,7 @@ async function buildLocalImage(config, onLog, options = {}) {
             code: types_1.FUNCTION_DEPLOY_ERROR.LOCAL_BUILD_CONTEXT_MISSING
         });
     }
-    const dockerfile = config.build.dockerfile || types_1.DEFAULT_DOCKERFILE;
+    const dockerfile = config.imageConfig.build.dockerfile || types_1.DEFAULT_DOCKERFILE;
     const dockerfilePath = path_1.default.resolve(context, dockerfile);
     if (!deps.existsSync(dockerfilePath) || !deps.isFile(dockerfilePath)) {
         throw new error_1.CloudBaseError(`Dockerfile 不存在：${dockerfilePath}`, {
@@ -11119,7 +10853,7 @@ async function buildLocalImage(config, onLog, options = {}) {
         });
     }
     const imageUri = await resolveImageUri(config, context);
-    const platform = config.build.platform || types_1.DEFAULT_IMAGE_PLATFORM;
+    const platform = config.imageConfig.build.platform || types_1.DEFAULT_IMAGE_PLATFORM;
     const args = [
         'buildx',
         'build',
@@ -11131,10 +10865,10 @@ async function buildLocalImage(config, onLog, options = {}) {
         imageUri,
         '--load'
     ];
-    if (config.build.forceBuild) {
+    if (config.imageConfig.build.forceBuild) {
         args.push('--no-cache');
     }
-    const buildArgs = config.build.buildArgs || {};
+    const buildArgs = config.imageConfig.build.buildArgs || {};
     for (const key of Object.keys(buildArgs)) {
         args.push('--build-arg', `${key}=${buildArgs[key]}`);
     }
@@ -11249,7 +10983,7 @@ function createTemporaryDockerConfig() {
  */
 async function buildAndPushImage(config, onLog, deps = defaultDeps) {
     const startedAt = Date.now();
-    const credential = config.build.registryCredential;
+    const credential = config.imageConfig.build.registryCredential;
     const dockerConfig = credential ? createTemporaryDockerConfig() : undefined;
     const commandOptions = dockerConfig ? { env: dockerConfig.env } : undefined;
     try {
@@ -11281,7 +11015,7 @@ async function buildAndPushImage(config, onLog, deps = defaultDeps) {
 
 /***/ },
 
-/***/ 5380
+/***/ 28541
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -11289,7 +11023,7 @@ async function buildAndPushImage(config, onLog, deps = defaultDeps) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.PersonalTcrService = exports.DEFAULT_PERSONAL_TCR_REGISTRY = void 0;
 exports.createPersonalTcrService = createPersonalTcrService;
-const config_guard_1 = __webpack_require__(69238);
+const config_guard_1 = __webpack_require__(74931);
 const PERSONAL_TCR_VERSION = '2019-09-24';
 exports.DEFAULT_PERSONAL_TCR_REGISTRY = 'ccr.ccs.tencentyun.com';
 const DEFAULT_RETAINED_TAGS = 30;
@@ -11442,7 +11176,7 @@ function createPersonalTcrService(environment) {
 
 /***/ },
 
-/***/ 28750
+/***/ 72325
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -11450,8 +11184,8 @@ function createPersonalTcrService(environment) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.toCurrentState = toCurrentState;
 exports.createDeployPlan = createDeployPlan;
-const constant_1 = __webpack_require__(3017);
-const config_guard_1 = __webpack_require__(69238);
+const constant_1 = __webpack_require__(41976);
+const config_guard_1 = __webpack_require__(74931);
 /**
  * 部署计划生成
  *
@@ -11728,7 +11462,7 @@ function createDeployPlan(config, current) {
 
 /***/ },
 
-/***/ 61081
+/***/ 69230
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -11740,8 +11474,8 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.runLocalPreflight = runLocalPreflight;
 const fs_1 = __importDefault(__webpack_require__(29021));
 const path_1 = __importDefault(__webpack_require__(33873));
-const packer_1 = __webpack_require__(62446);
-const types_1 = __webpack_require__(22724);
+const packer_1 = __webpack_require__(36245);
+const types_1 = __webpack_require__(79345);
 /**
  * 部署前环境检查（Preflight）
  *
@@ -11805,7 +11539,8 @@ function safeStat(target) {
 }
 /** 检查 cloud 构建上下文与 Dockerfile，确保任何云端操作前即可失败 */
 function checkCloudBuildSource(config, checks) {
-    const cwd = path_1.default.resolve(config.build.cwd || config.functionPath || process.cwd());
+    const build = config.imageConfig.build;
+    const cwd = path_1.default.resolve(build.cwd || config.functionPath || process.cwd());
     const contextStat = safeStat(cwd);
     if (contextStat === null) {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONTEXT_INVALID, '云端镜像构建上下文目录不存在', {
@@ -11821,7 +11556,7 @@ function checkCloudBuildSource(config, checks) {
         }));
         return;
     }
-    const dockerfile = config.build.dockerfile || types_1.DEFAULT_DOCKERFILE;
+    const dockerfile = build.dockerfile || types_1.DEFAULT_DOCKERFILE;
     const dockerfilePath = path_1.default.resolve(cwd, dockerfile);
     const dockerfileStat = safeStat(dockerfilePath);
     if (dockerfileStat === null || !dockerfileStat.isFile()) {
@@ -12065,7 +11800,7 @@ function runLocalPreflight(config) {
 
 /***/ },
 
-/***/ 22724
+/***/ 79345
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -12191,14 +11926,14 @@ exports.FUNCTION_DEPLOY_ERROR = {
 
 /***/ },
 
-/***/ 13265
+/***/ 54640
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.DocsService = void 0;
-const http_request_1 = __webpack_require__(7355);
+const http_request_1 = __webpack_require__(2922);
 const DOCS_BASE_URL = 'https://docs.cloudbase.net';
 const CATEGORY_URL = `${DOCS_BASE_URL}/category.json`;
 const ALGOLIA_SEARCH_URL = 'https://70wjvl90pg-dsn.algolia.net/1/indexes/*/queries' +
@@ -12487,7 +12222,7 @@ exports.DocsService = DocsService;
 
 /***/ },
 
-/***/ 51865
+/***/ 20382
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -12505,12 +12240,12 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.EnvService = void 0;
 const cos_nodejs_sdk_v5_1 = __importDefault(__webpack_require__(531));
 const util_1 = __importDefault(__webpack_require__(28354));
-const http_request_1 = __webpack_require__(7355);
+const http_request_1 = __webpack_require__(2922);
 const signature_nodejs_1 = __webpack_require__(38567);
-const error_1 = __webpack_require__(18143);
-const utils_1 = __webpack_require__(24263);
-const constant_1 = __webpack_require__(3017);
-const billing_1 = __webpack_require__(54913);
+const error_1 = __webpack_require__(54884);
+const utils_1 = __webpack_require__(88208);
+const constant_1 = __webpack_require__(41976);
+const billing_1 = __webpack_require__(44210);
 const uuid_1 = __webpack_require__(79893);
 class EnvService {
     constructor(environment) {
@@ -13473,37 +13208,37 @@ __decorate([
 
 /***/ },
 
-/***/ 27296
+/***/ 53463
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.Environment = void 0;
-const database_1 = __webpack_require__(71863);
-const function_1 = __webpack_require__(56318);
-const FunctionDeployer_1 = __webpack_require__(21773);
-const cloudrun_1 = __webpack_require__(8044);
-const agent_1 = __webpack_require__(33215);
-const storage_1 = __webpack_require__(29903);
-const env_1 = __webpack_require__(51865);
-const common_1 = __webpack_require__(10443);
-const log_1 = __webpack_require__(18916);
-const error_1 = __webpack_require__(18143);
-const constant_1 = __webpack_require__(3017);
-const utils_1 = __webpack_require__(24263);
-const hosting_1 = __webpack_require__(6064);
-const third_1 = __webpack_require__(1155);
-const access_1 = __webpack_require__(38680);
-const user_1 = __webpack_require__(68569);
-const cloudBaseRun_1 = __webpack_require__(27851);
-const mysql_1 = __webpack_require__(22772);
-const cloudApp_1 = __webpack_require__(97538);
-const permission_1 = __webpack_require__(81881);
-const sandbox_1 = __webpack_require__(64593);
-const aiModel_1 = __webpack_require__(9537);
-const monitor_1 = __webpack_require__(56088);
-const integration_1 = __webpack_require__(5480);
+const database_1 = __webpack_require__(44206);
+const function_1 = __webpack_require__(99699);
+const FunctionDeployer_1 = __webpack_require__(93210);
+const cloudrun_1 = __webpack_require__(17569);
+const agent_1 = __webpack_require__(94540);
+const storage_1 = __webpack_require__(61132);
+const env_1 = __webpack_require__(20382);
+const common_1 = __webpack_require__(73906);
+const log_1 = __webpack_require__(73795);
+const error_1 = __webpack_require__(54884);
+const constant_1 = __webpack_require__(41976);
+const utils_1 = __webpack_require__(88208);
+const hosting_1 = __webpack_require__(11763);
+const third_1 = __webpack_require__(23800);
+const access_1 = __webpack_require__(58405);
+const user_1 = __webpack_require__(41180);
+const cloudBaseRun_1 = __webpack_require__(56242);
+const mysql_1 = __webpack_require__(47779);
+const cloudApp_1 = __webpack_require__(42403);
+const permission_1 = __webpack_require__(59512);
+const sandbox_1 = __webpack_require__(53854);
+const aiModel_1 = __webpack_require__(1058);
+const monitor_1 = __webpack_require__(3219);
+const integration_1 = __webpack_require__(80547);
 class Environment {
     constructor(context, envId) {
         this.inited = false;
@@ -13667,15 +13402,15 @@ exports.Environment = Environment;
 
 /***/ },
 
-/***/ 70101
+/***/ 41596
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.EnvironmentManager = void 0;
-const environment_1 = __webpack_require__(27296);
-const constant_1 = __webpack_require__(3017);
+const environment_1 = __webpack_require__(53463);
+const constant_1 = __webpack_require__(41976);
 class EnvironmentManager {
     constructor(context) {
         this.envs = {};
@@ -13719,7 +13454,7 @@ exports.EnvironmentManager = EnvironmentManager;
 
 /***/ },
 
-/***/ 18143
+/***/ 54884
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -13743,7 +13478,7 @@ exports.CloudBaseError = CloudBaseError;
 
 /***/ },
 
-/***/ 56318
+/***/ 99699
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -13763,10 +13498,10 @@ const fs_1 = __importDefault(__webpack_require__(29021));
 const path_1 = __importDefault(__webpack_require__(33873));
 const lodash_1 = __importDefault(__webpack_require__(35558));
 const cos_nodejs_sdk_v5_1 = __importDefault(__webpack_require__(531));
-const packer_1 = __webpack_require__(62446);
-const error_1 = __webpack_require__(18143);
-const utils_1 = __webpack_require__(24263);
-const constant_1 = __webpack_require__(3017);
+const packer_1 = __webpack_require__(36245);
+const error_1 = __webpack_require__(54884);
+const utils_1 = __webpack_require__(88208);
+const constant_1 = __webpack_require__(41976);
 /**
  * 解析环境变量为布尔值
  * 视 'true'/'1'/'yes'/'on'（大小写不敏感）为 true，
@@ -15708,7 +15443,7 @@ __decorate([
 
 /***/ },
 
-/***/ 62446
+/***/ 36245
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -15756,8 +15491,8 @@ const del_1 = __importDefault(__webpack_require__(56931));
 const path_1 = __importDefault(__webpack_require__(33873));
 const make_dir_1 = __importDefault(__webpack_require__(82823));
 const util_1 = __importDefault(__webpack_require__(28354));
-const utils_1 = __webpack_require__(24263);
-const error_1 = __webpack_require__(18143);
+const utils_1 = __webpack_require__(88208);
+const error_1 = __webpack_require__(54884);
 const os = __importStar(__webpack_require__(21820));
 // 10 MB
 exports.BIG_FILE_SIZE = 10485760;
@@ -15880,7 +15615,7 @@ exports.FunctionPacker = FunctionPacker;
 
 /***/ },
 
-/***/ 6064
+/***/ 11763
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -15899,9 +15634,9 @@ exports.HostingService = void 0;
 const fs_1 = __importDefault(__webpack_require__(29021));
 const path_1 = __importDefault(__webpack_require__(33873));
 const make_dir_1 = __importDefault(__webpack_require__(82823));
-const error_1 = __webpack_require__(18143);
-const utils_1 = __webpack_require__(24263);
-const parallel_1 = __webpack_require__(31504);
+const error_1 = __webpack_require__(54884);
+const utils_1 = __webpack_require__(88208);
+const parallel_1 = __webpack_require__(86693);
 const envDomainCache = new Map();
 const HostingStatusMap = {
     init: '初始化中',
@@ -16400,16 +16135,16 @@ __decorate([
 
 /***/ },
 
-/***/ 20277
+/***/ 87798
 (module, __unused_webpack_exports, __webpack_require__) {
 
 "use strict";
 
-const context_1 = __webpack_require__(91522);
-const environmentManager_1 = __webpack_require__(70101);
-const docs_1 = __webpack_require__(13265);
-const projectValidator_1 = __webpack_require__(64047);
-const DeployOrchestrator_1 = __webpack_require__(83962);
+const context_1 = __webpack_require__(81073);
+const environmentManager_1 = __webpack_require__(41596);
+const docs_1 = __webpack_require__(54640);
+const projectValidator_1 = __webpack_require__(69622);
+const DeployOrchestrator_1 = __webpack_require__(28385);
 class CloudBase {
     /**
      * init 初始化 为单例
@@ -16599,7 +16334,7 @@ module.exports = CloudBase;
 
 /***/ },
 
-/***/ 36541
+/***/ 5798
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -16615,7 +16350,7 @@ exports.USER_KEY_BUSINESS = 'integration';
 
 /***/ },
 
-/***/ 86823
+/***/ 90346
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -16725,7 +16460,7 @@ exports.AESCrypto = new AESCryptoImpl();
 
 /***/ },
 
-/***/ 5480
+/***/ 80547
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -16752,12 +16487,12 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.IntegrationService = void 0;
-const error_1 = __webpack_require__(18143);
-const utils_1 = __webpack_require__(24263);
-const constants_1 = __webpack_require__(36541);
-const crypto_1 = __webpack_require__(86823);
-const secretKey_1 = __webpack_require__(32503);
-__exportStar(__webpack_require__(89869), exports);
+const error_1 = __webpack_require__(54884);
+const utils_1 = __webpack_require__(88208);
+const constants_1 = __webpack_require__(5798);
+const crypto_1 = __webpack_require__(90346);
+const secretKey_1 = __webpack_require__(98584);
+__exportStar(__webpack_require__(53890), exports);
 /**
  * 集成中心（UserKey）服务
  *
@@ -17086,7 +16821,7 @@ __decorate([
 
 /***/ },
 
-/***/ 32503
+/***/ 98584
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -17104,8 +16839,8 @@ exports.__clearAesKeyCache = __clearAesKeyCache;
  * - key 仅在进程内存使用，按 group 维度缓存；
  * - 绝不写入任何本地文件、绝不打印日志。
  */
-const http_request_1 = __webpack_require__(7355);
-const error_1 = __webpack_require__(18143);
+const http_request_1 = __webpack_require__(2922);
+const error_1 = __webpack_require__(54884);
 /** 七彩石配置 */
 const RAINBOW_CONFIG = {
     ENV_TYPE: 'Default',
@@ -17182,7 +16917,7 @@ function __clearAesKeyCache() {
 
 /***/ },
 
-/***/ 89869
+/***/ 53890
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -17208,7 +16943,7 @@ var UserKeyBindServiceType;
 
 /***/ },
 
-/***/ 18916
+/***/ 73795
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -17230,8 +16965,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.LogService = void 0;
 exports.isLogServiceEnabled = isLogServiceEnabled;
-const utils_1 = __webpack_require__(24263);
-__exportStar(__webpack_require__(54081), exports);
+const utils_1 = __webpack_require__(88208);
+__exportStar(__webpack_require__(8290), exports);
 /**
  * 纯函数：根据 DescribeEnvInfo 返回的 LogServices 列表判断日志服务是否已开通。
  * 已开通条件：至少一个条目有有效的 TopicId。
@@ -17317,7 +17052,7 @@ exports.LogService = LogService;
 
 /***/ },
 
-/***/ 54081
+/***/ 8290
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -17349,7 +17084,7 @@ exports.CLS_MODULE_SCHEMA = {
 
 /***/ },
 
-/***/ 56088
+/***/ 3219
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -17370,9 +17105,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.MonitorService = void 0;
-const error_1 = __webpack_require__(18143);
-const utils_1 = __webpack_require__(24263);
-__exportStar(__webpack_require__(35197), exports);
+const error_1 = __webpack_require__(54884);
+const utils_1 = __webpack_require__(88208);
+__exportStar(__webpack_require__(2290), exports);
 // Period 与时间范围的约束规则
 const ONE_DAY_MS = 24 * 60 * 60 * 1000;
 const THREE_DAYS_MS = 3 * ONE_DAY_MS;
@@ -17462,7 +17197,7 @@ exports.MonitorService = MonitorService;
 
 /***/ },
 
-/***/ 35197
+/***/ 2290
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -17472,7 +17207,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 
 /***/ },
 
-/***/ 22772
+/***/ 47779
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -17499,8 +17234,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.MysqlService = void 0;
-const utils_1 = __webpack_require__(24263);
-__exportStar(__webpack_require__(39434), exports);
+const utils_1 = __webpack_require__(88208);
+__exportStar(__webpack_require__(54113), exports);
 class MysqlService {
     constructor(environment) {
         this.environment = environment;
@@ -18031,7 +17766,7 @@ __decorate([
 
 /***/ },
 
-/***/ 28065
+/***/ 79702
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -18041,7 +17776,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 
 /***/ },
 
-/***/ 35642
+/***/ 51715
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -18051,7 +17786,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 
 /***/ },
 
-/***/ 18505
+/***/ 34452
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -18061,7 +17796,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 
 /***/ },
 
-/***/ 39434
+/***/ 54113
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -18081,14 +17816,14 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-__exportStar(__webpack_require__(18505), exports);
-__exportStar(__webpack_require__(28065), exports);
-__exportStar(__webpack_require__(35642), exports);
+__exportStar(__webpack_require__(34452), exports);
+__exportStar(__webpack_require__(79702), exports);
+__exportStar(__webpack_require__(51715), exports);
 
 
 /***/ },
 
-/***/ 81881
+/***/ 59512
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -18101,7 +17836,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.PermissionService = void 0;
-const utils_1 = __webpack_require__(24263);
+const utils_1 = __webpack_require__(88208);
 const PERMISSION_BY_RESOURCE = {
     function: ['CUSTOM'],
     storage: ['READONLY', 'PRIVATE', 'ADMINWRITE', 'ADMINONLY', 'CUSTOM'],
@@ -18518,7 +18253,7 @@ __decorate([
 
 /***/ },
 
-/***/ 64047
+/***/ 69622
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -18547,7 +18282,6 @@ const path_1 = __importDefault(__webpack_require__(33873));
 const toolbox_1 = __webpack_require__(23233);
 class ProjectValidator {
     async validate(options = {}) {
-        var _a;
         const cwd = path_1.default.resolve(options.cwd || process.cwd());
         const errors = [];
         const warnings = [];
@@ -18556,7 +18290,6 @@ class ProjectValidator {
             mode: options.mode,
             errors,
         });
-        const version = String(((_a = loaded.rawConfig) === null || _a === void 0 ? void 0 : _a.version) || '2.1');
         if (loaded.rawConfig) {
             this.validateSchema(loaded.rawConfig, errors);
         }
@@ -18571,7 +18304,6 @@ class ProjectValidator {
         const summary = this.getSummary(loaded.config);
         return {
             valid: errors.length === 0,
-            version,
             errors,
             warnings,
             summary,
@@ -18977,12 +18709,12 @@ class ProjectValidator {
     }
 }
 exports.ProjectValidator = ProjectValidator;
-__exportStar(__webpack_require__(20006), exports);
+__exportStar(__webpack_require__(40171), exports);
 
 
 /***/ },
 
-/***/ 20006
+/***/ 40171
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -18992,14 +18724,14 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 
 /***/ },
 
-/***/ 64593
+/***/ 53854
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.SandboxService = void 0;
-const utils_1 = __webpack_require__(24263);
+const utils_1 = __webpack_require__(88208);
 class SandboxService {
     constructor(environment) {
         this.environment = environment;
@@ -19562,7 +19294,7 @@ exports.SandboxService = SandboxService;
 
 /***/ },
 
-/***/ 94507
+/***/ 85914
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -19622,7 +19354,7 @@ function splitEntryUploadFiles(files, entryFiles) {
 
 /***/ },
 
-/***/ 29903
+/***/ 61132
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -19647,19 +19379,19 @@ const walkdir_1 = __importDefault(__webpack_require__(43204));
 const micromatch_1 = __importDefault(__webpack_require__(40821));
 const mime_types_1 = __importDefault(__webpack_require__(96662));
 const cos_nodejs_sdk_v5_1 = __importDefault(__webpack_require__(531));
-const utils_1 = __webpack_require__(24263);
-const error_1 = __webpack_require__(18143);
-const parallel_1 = __webpack_require__(31504);
-const runenv_1 = __webpack_require__(46767);
-const constant_1 = __webpack_require__(3017);
-const helper_1 = __webpack_require__(94507);
+const utils_1 = __webpack_require__(88208);
+const error_1 = __webpack_require__(54884);
+const parallel_1 = __webpack_require__(86693);
+const runenv_1 = __webpack_require__(94774);
+const constant_1 = __webpack_require__(41976);
+const helper_1 = __webpack_require__(85914);
 const BIG_FILE_SIZE = 5242880; // 5MB 1024*1024*5
 // ===== hosting deploy consistency 相关能力 =====
 /** 默认 MD5 计算并发数 */
 const DEFAULT_MD5_PARALLEL = 20;
 /** 一致性发布备份前缀（用于 diff.removed 排除备份文件） */
 const CONSISTENT_DEPLOY_BACKUP_PREFIX = '.cloudbase-backup/';
-var helper_2 = __webpack_require__(94507);
+var helper_2 = __webpack_require__(85914);
 Object.defineProperty(exports, "md5File", ({ enumerable: true, get: function () { return helper_2.md5File; } }));
 class StorageService {
     constructor(environment) {
@@ -23157,14 +22889,14 @@ __decorate([
 
 /***/ },
 
-/***/ 1155
+/***/ 23800
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.ThirdService = void 0;
-const utils_1 = __webpack_require__(24263);
+const utils_1 = __webpack_require__(88208);
 class ThirdService {
     constructor(environment) {
         this.cloudService = new utils_1.CloudService(environment.cloudBaseContext, 'tcb', '2018-06-08');
@@ -23183,7 +22915,7 @@ exports.ThirdService = ThirdService;
 
 /***/ },
 
-/***/ 68569
+/***/ 41180
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -23196,7 +22928,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.UserService = void 0;
-const utils_1 = __webpack_require__(24263);
+const utils_1 = __webpack_require__(88208);
 class UserService {
     constructor(environment) {
         this.environment = environment;
@@ -23532,7 +23264,7 @@ __decorate([
 
 /***/ },
 
-/***/ 77357
+/***/ 764
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -23636,7 +23368,7 @@ function getAuth(options) {
 
 /***/ },
 
-/***/ 78263
+/***/ 29980
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -23649,10 +23381,10 @@ exports.CloudService = void 0;
 const crypto_1 = __importDefault(__webpack_require__(55511));
 const url_1 = __webpack_require__(79551);
 const query_string_1 = __importDefault(__webpack_require__(71547));
-const error_1 = __webpack_require__(18143);
-const http_request_1 = __webpack_require__(7355);
-const constant_1 = __webpack_require__(3017);
-const utils_1 = __webpack_require__(24263);
+const error_1 = __webpack_require__(54884);
+const http_request_1 = __webpack_require__(2922);
+const constant_1 = __webpack_require__(41976);
+const utils_1 = __webpack_require__(88208);
 function isObject(x) {
     return typeof x === 'object' && !Array.isArray(x) && x !== null;
 }
@@ -23885,15 +23617,15 @@ exports.CloudService = CloudService;
 
 /***/ },
 
-/***/ 46439
+/***/ 16860
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.cloudBaseRequest = cloudBaseRequest;
-const auth_1 = __webpack_require__(77357);
-const http_request_1 = __webpack_require__(7355);
+const auth_1 = __webpack_require__(764);
+const http_request_1 = __webpack_require__(2922);
 const SUPPORT_REGIONS = ['ap-shanghai', 'ap-guangzhou', 'ap-singapore'];
 async function cloudBaseRequest(options) {
     // const url = 'https://tcb-admin.tencentcloudapi.com/admin'
@@ -23961,7 +23693,7 @@ async function cloudBaseRequest(options) {
 
 /***/ },
 
-/***/ 16594
+/***/ 21889
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -23986,7 +23718,7 @@ function preLazy() {
 
 /***/ },
 
-/***/ 56812
+/***/ 62625
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -24001,7 +23733,7 @@ exports.isDirectory = isDirectory;
 exports.formateFileSize = formateFileSize;
 exports.delSync = delSync;
 const fs_1 = __importDefault(__webpack_require__(29021));
-const error_1 = __webpack_require__(18143);
+const error_1 = __webpack_require__(54884);
 const del_1 = __importDefault(__webpack_require__(56931));
 // 检查路径是否可以访问（读、写）
 function checkFullAccess(dest, throwError = false) {
@@ -24064,7 +23796,7 @@ function delSync(patterns) {
 
 /***/ },
 
-/***/ 7355
+/***/ 2922
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -24078,7 +23810,7 @@ exports.fetchStream = fetchStream;
 const url_1 = __webpack_require__(79551);
 const node_fetch_1 = __importDefault(__webpack_require__(30188));
 const https_proxy_agent_1 = __webpack_require__(11710);
-const error_1 = __webpack_require__(18143);
+const error_1 = __webpack_require__(54884);
 // 使用 fetch + 代理
 async function fetch(url, config = {}, proxy = null) {
     if (proxy || process.env.http_proxy) {
@@ -24119,7 +23851,7 @@ async function fetchStream(url, config = {}, proxy = null) {
 
 /***/ },
 
-/***/ 24263
+/***/ 88208
 (__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
@@ -24162,15 +23894,15 @@ const lodash_1 = __importDefault(__webpack_require__(35558));
 const os_1 = __importDefault(__webpack_require__(21820));
 const path_1 = __importDefault(__webpack_require__(33873));
 const unzipper_1 = __importDefault(__webpack_require__(44233));
-const constant_1 = __webpack_require__(3017);
-const http_request_1 = __webpack_require__(7355);
-__exportStar(__webpack_require__(77357), exports);
-__exportStar(__webpack_require__(78263), exports);
-__exportStar(__webpack_require__(46439), exports);
-__exportStar(__webpack_require__(16594), exports);
-__exportStar(__webpack_require__(56812), exports);
-__exportStar(__webpack_require__(7355), exports);
-var uuid_1 = __webpack_require__(22684);
+const constant_1 = __webpack_require__(41976);
+const http_request_1 = __webpack_require__(2922);
+__exportStar(__webpack_require__(764), exports);
+__exportStar(__webpack_require__(29980), exports);
+__exportStar(__webpack_require__(16860), exports);
+__exportStar(__webpack_require__(21889), exports);
+__exportStar(__webpack_require__(62625), exports);
+__exportStar(__webpack_require__(2922), exports);
+var uuid_1 = __webpack_require__(10829);
 Object.defineProperty(exports, "guid6", ({ enumerable: true, get: function () { return uuid_1.guid6; } }));
 async function compressToZip(option) {
     const { dirPath, outputPath, ignore, pattern = '**/*', extraEntries } = option;
@@ -24498,7 +24230,7 @@ function successLog(msg) {
 
 /***/ },
 
-/***/ 31504
+/***/ 86693
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -24575,7 +24307,7 @@ exports.AsyncTaskParallelController = AsyncTaskParallelController;
 
 /***/ },
 
-/***/ 46767
+/***/ 94774
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -24590,7 +24322,7 @@ function checkIsInScf() {
 
 /***/ },
 
-/***/ 22684
+/***/ 10829
 (__unused_webpack_module, exports) {
 
 "use strict";
@@ -149842,7 +149574,7 @@ minimatch.Minimatch = Minimatch
 
 /***/ },
 
-/***/ 6378
+/***/ 51140
 (__unused_webpack_module, __unused_webpack_exports, __webpack_require__) {
 
 //! moment.js locale configuration
@@ -155167,8 +154899,8 @@ var map = {
 	"./mt.js": 95451,
 	"./my": 76160,
 	"./my.js": 76160,
-	"./nb": 6378,
-	"./nb.js": 6378,
+	"./nb": 51140,
+	"./nb.js": 51140,
 	"./ne": 10067,
 	"./ne.js": 10067,
 	"./nl": 73108,
@@ -199859,7 +199591,7 @@ exports.getCloudBaseManager = getCloudBaseManager;
 exports.createCloudBaseManagerWithOptions = createCloudBaseManagerWithOptions;
 exports.extractRequestId = extractRequestId;
 exports.logCloudBaseResult = logCloudBaseResult;
-const manager_node_1 = __importDefault(__webpack_require__(20277));
+const manager_node_1 = __importDefault(__webpack_require__(87798));
 const auth_js_1 = __webpack_require__(561);
 const logger_js_1 = __webpack_require__(40781);
 const tool_result_js_1 = __webpack_require__(69645);
@@ -201391,6 +201123,7 @@ const storage_js_1 = __webpack_require__(23138);
 const types_js_1 = __webpack_require__(79546);
 const capi_js_1 = __webpack_require__(88900);
 const cloudrun_js_1 = __webpack_require__(5658);
+const deploy_js_1 = __webpack_require__(23668);
 const dataModel_js_1 = __webpack_require__(42722);
 const gateway_js_1 = __webpack_require__(79921);
 const agents_js_1 = __webpack_require__(48409);
@@ -201418,6 +201151,7 @@ const DEFAULT_PLUGINS = [
     "setup",
     "rag",
     "cloudrun",
+    "deploy",
     "gateway",
     "app-auth",
     "apps",
@@ -201471,6 +201205,7 @@ const AVAILABLE_PLUGINS = {
     agents: { name: "agents", register: agents_js_1.registerAgentTools },
     apps: { name: "apps", register: apps_js_1.registerAppTools },
     cloudrun: { name: "cloudrun", register: cloudrun_js_1.registerCloudRunTools },
+    deploy: { name: "deploy", register: deploy_js_1.registerDeployTools },
     capi: { name: "capi", register: capi_js_1.registerCapiTools },
     "msg-push": { name: "msg-push", register: msg_push_js_1.registerMsgPushTools },
 };
@@ -203214,7 +202949,7 @@ function registerAppTools(server) {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.CAM_AUTH_ERROR_PATTERN = void 0;
+exports.CAM_AUTH_ERROR_PATTERN = exports.ALLOWED_SERVICES = void 0;
 exports.assertTcbCloudRunActionAllowed = assertTcbCloudRunActionAllowed;
 exports.resolveCloudApiRegionAndParams = resolveCloudApiRegionAndParams;
 exports.removeEmptyStringParams = removeEmptyStringParams;
@@ -203228,7 +202963,7 @@ const tcb_action_index_js_1 = __webpack_require__(72550);
 const CATEGORY = "cloud-api";
 const CLOUDBASE_CONTROL_PLANE_DOC_URL = "https://cloud.tencent.com/document/product/876/34809";
 const CLOUDBASE_DEPENDENCY_API_DOC_URL = "https://cloud.tencent.com/document/product/876/34808";
-const ALLOWED_SERVICES = [
+exports.ALLOWED_SERVICES = [
     "tcb",
     "tcbr",
     "scf",
@@ -203237,6 +202972,8 @@ const ALLOWED_SERVICES = [
     "lowcode",
     "cdn",
     "vpc",
+    "monitor",
+    "postgres",
 ];
 /**
  * Legacy tcb small-tenant CloudRun (CloudBase Run) API family — blocked.
@@ -203358,6 +203095,9 @@ function buildCapiDocGuidance(service) {
     if (service === "tcb" || service === "tcbr" || service === "lowcode" || service === "scf") {
         return `优先查阅 CloudBase API 概览 ${CLOUDBASE_CONTROL_PLANE_DOC_URL} 与云开发依赖资源接口指引 ${CLOUDBASE_DEPENDENCY_API_DOC_URL}。`;
     }
+    if (service === "monitor") {
+        return `请优先核对云监控（腾讯云可观测平台）官方 API 文档：API 概览 https://cloud.tencent.com/document/product/649/30343 ，单 Action 详细文档在 https://cloud.tencent.com/document/api/248/ 产品线下。`;
+    }
     return `请优先核对对应官方云 API 文档；若你的场景其实是通过 HTTP 协议直接集成 auth/functions/cloudrun/storage/mysqldb 等 CloudBase 业务 API，请优先使用 OpenAPI / Swagger 或 searchKnowledgeBase(mode="openapi")，不要继续猜测管控面 Action。`;
 }
 /** Match CAM / authorization failures from Tencent Cloud control-plane APIs. */
@@ -203463,7 +203203,7 @@ function registerCapiTools(server) {
     const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions, requireEnvId: false });
     server.registerTool?.("callCloudApi", {
         title: "调用云API",
-        description: `通用的云 API 调用工具，主要用于 CloudBase / 腾讯云管控面与依赖资源相关 API 调用。调用前请先确认 service、Action 与 Param，避免猜测 Action 名称。如果你的目标是通过 HTTP 协议直接集成 auth/functions/cloudrun/storage/mysqldb 等 CloudBase 业务 API，请不要优先使用 callCloudApi，而应优先查看对应 OpenAPI / Swagger。现有 OpenAPI / Swagger 能力不是通用的管控面 Action 集合；管控面 API 请优先参考 CloudBase API 概览 ${CLOUDBASE_CONTROL_PLANE_DOC_URL} 与云开发依赖资源接口指引 ${CLOUDBASE_DEPENDENCY_API_DOC_URL}。对于 tcb service，常用 Action 分类如下：
+        description: `通用的云 API 调用工具，主要用于 CloudBase / 腾讯云管控面与依赖资源相关 API 调用。**调用前必读接口索引** https://docs.cloudbase.net/ai/cloudbase-ai-toolkit/api-reference.md （每日自动同步的 Action 级索引，含 rate limit；先查此索引确认 service/Action/参数，避免猜测 Action 名称；索引未覆盖的产品再去该产品官方 API 文档核对）。如果你的目标是通过 HTTP 协议直接集成 auth/functions/cloudrun/storage/mysqldb 等 CloudBase 业务 API，请不要优先使用 callCloudApi，而应优先查看对应 OpenAPI / Swagger。现有 OpenAPI / Swagger 能力不是通用的管控面 Action 集合；管控面 API 请优先参考 CloudBase API 概览 ${CLOUDBASE_CONTROL_PLANE_DOC_URL} 与云开发依赖资源接口指引 ${CLOUDBASE_DEPENDENCY_API_DOC_URL}。对于 tcb service，常用 Action 分类如下：
 
 **环境管理**: \`CreateEnv\`、\`ModifyEnv\`、\`DescribeEnvs\`、\`DestroyEnv\`
 **用户管理**: \`CreateUser\`、\`ModifyUser\`、\`DescribeUserList\`、\`DeleteUsers\`
@@ -203478,8 +203218,8 @@ function registerCapiTools(server) {
 销毁环境时，常见做法是至少带上 \`EnvId\` 和 \`BypassCheck: true\`，如果环境已经处于隔离期再按文档补 \`IsForce: true\`。`,
         inputSchema: {
             service: zod_1.z
-                .enum(ALLOWED_SERVICES)
-                .describe("选择要访问的服务。可选：tcb、tcbr、scf、sts、cam、lowcode、cdn、vpc。对于 tcb / scf / lowcode 等 CloudBase 管控面 Action，请优先查官方文档，不要直接猜测 Action。云托管统一走 tcbr（version 需传 2022-02-17）。"),
+                .enum(exports.ALLOWED_SERVICES)
+                .describe("选择要访问的服务。可选：tcb、tcbr、scf、sts、cam、lowcode、cdn、vpc、monitor（云监控/告警，version 需传 2018-07-24）、postgres（云数据库 PostgreSQL，version 需传 2017-03-12）。对于 tcb / scf / lowcode 等 CloudBase 管控面 Action，请优先查官方文档，不要直接猜测 Action。云托管统一走 tcbr（version 需传 2022-02-17）。"),
             action: zod_1.z
                 .string()
                 .min(1)
@@ -203487,7 +203227,7 @@ function registerCapiTools(server) {
             version: zod_1.z
                 .string()
                 .optional()
-                .describe("API 版本（可选）。缺省时按 service 使用 SDK 内置默认版本；tcbr 必须传 \"2022-02-17\"（否则请求缺少 X-TC-Version 会失败）。示例：service=\"tcbr\", version=\"2022-02-17\", action=\"CreateCloudRunEnv\", params={EnvId:\"env-xxx\",PackageType:\"Standard\"}。"),
+                .describe("API 版本（可选）。缺省时按 service 使用 SDK 内置默认版本；tcbr 必须传 \"2022-02-17\"（否则请求缺少 X-TC-Version 会失败），monitor 必须传 \"2018-07-24\"、postgres 必须传 \"2017-03-12\"（这两个 service 无内置默认版本，不传会失败）。示例：service=\"tcbr\", version=\"2022-02-17\", action=\"CreateCloudRunEnv\", params={EnvId:\"env-xxx\",PackageType:\"Standard\"}。"),
             params: zod_1.z
                 .record(zod_1.z.any())
                 .optional()
@@ -203505,8 +203245,8 @@ function registerCapiTools(server) {
             category: CATEGORY,
         },
     }, async ({ service, action, params, version, region, }) => {
-        if (!ALLOWED_SERVICES.includes(service)) {
-            throw new Error(`Service ${service} is not allowed. Allowed services: ${ALLOWED_SERVICES.join(", ")}`);
+        if (!exports.ALLOWED_SERVICES.includes(service)) {
+            throw new Error(`Service ${service} is not allowed. Allowed services: ${exports.ALLOWED_SERVICES.join(", ")}`);
         }
         assertTcbCloudRunActionAllowed(service, action);
         const { region: resolvedRegion, params: bodyParams } = resolveCloudApiRegionAndParams({ region, params });
@@ -208248,6 +207988,7 @@ const path = __importStar(__webpack_require__(33873));
 const zod_1 = __webpack_require__(21504);
 const cloudbase_manager_js_1 = __webpack_require__(33109);
 const tool_result_js_1 = __webpack_require__(69645);
+const sql_risk_js_1 = __webpack_require__(29885);
 const CATEGORY = "PostgreSQL database";
 const QUERY_PG_DATABASE = "queryPgDatabase";
 const MANAGE_PG_DATABASE = "managePgDatabase";
@@ -208407,33 +208148,9 @@ function normalizeLimit(limit, fallback = 20, max = 200) {
     }
     return Math.max(1, Math.min(max, Math.floor(limit)));
 }
-function stripLeadingSqlComments(sql) {
-    let normalized = sql.trim();
-    while (normalized.length > 0) {
-        if (normalized.startsWith("--")) {
-            normalized = normalized.replace(/^--.*(?:\r?\n|$)/, "").trimStart();
-            continue;
-        }
-        if (normalized.startsWith("#")) {
-            normalized = normalized.replace(/^#.*(?:\r?\n|$)/, "").trimStart();
-            continue;
-        }
-        if (normalized.startsWith("/*")) {
-            normalized = normalized.replace(/^\/\*[\s\S]*?\*\//, "").trimStart();
-            continue;
-        }
-        break;
-    }
-    return normalized;
-}
-function getSqlVerb(sql) {
-    const normalized = stripLeadingSqlComments(sql);
-    const match = normalized.match(/^([a-zA-Z]+)/);
-    return match ? match[1].toUpperCase() : "";
-}
 function isReadOnlySql(sql) {
-    const normalized = stripLeadingSqlComments(sql);
-    const verb = getSqlVerb(normalized);
+    const normalized = (0, sql_risk_js_1.stripLeadingSqlComments)(sql);
+    const verb = (0, sql_risk_js_1.getSqlVerb)(normalized);
     const readOnlyVerbs = new Set([
         "SELECT",
         "SHOW",
@@ -208447,27 +208164,16 @@ function isReadOnlySql(sql) {
     return !/\b(INSERT|UPDATE|DELETE|CREATE|ALTER|DROP|TRUNCATE|REPLACE|RENAME|GRANT|REVOKE|COMMENT|VACUUM|ANALYZE|FOR\s+UPDATE|FOR\s+SHARE)\b/i.test(normalized);
 }
 function buildLimitedReadOnlySql(sql, limit) {
-    const normalized = stripLeadingSqlComments(sql).replace(/;\s*$/, "");
-    const verb = getSqlVerb(normalized);
+    const normalized = (0, sql_risk_js_1.stripLeadingSqlComments)(sql).replace(/;\s*$/, "");
+    const verb = (0, sql_risk_js_1.getSqlVerb)(normalized);
     if (!["SELECT", "WITH", "VALUES"].includes(verb)) {
         return sql;
     }
     return `SELECT * FROM (${normalized}) AS cloudbase_mcp_readonly_limit LIMIT ${limit}`;
 }
-function isDestructiveSql(sql) {
-    const normalized = stripLeadingSqlComments(sql);
-    const verb = getSqlVerb(normalized);
-    if (["DROP", "TRUNCATE", "DELETE"].includes(verb)) {
-        return true;
-    }
-    if (verb === "ALTER") {
-        return /\b(DROP|RENAME)\b/i.test(normalized);
-    }
-    return false;
-}
 function classifySqlRisk(sql) {
-    const normalized = stripLeadingSqlComments(sql);
-    const verb = getSqlVerb(normalized);
+    const normalized = (0, sql_risk_js_1.stripLeadingSqlComments)(sql);
+    const verb = (0, sql_risk_js_1.getSqlVerb)(normalized);
     if (!verb) {
         return {
             risk: "unknown_risk",
@@ -208482,7 +208188,7 @@ function classifySqlRisk(sql) {
             requiresConfirm: false,
         };
     }
-    if (isDestructiveSql(normalized)) {
+    if ((0, sql_risk_js_1.isDestructiveSql)(normalized)) {
         return {
             risk: "destructive",
             readOnly: false,
@@ -208528,7 +208234,7 @@ function isSchemaDdlRisk(risk, sql) {
     if (risk !== "destructive") {
         return false;
     }
-    const verb = getSqlVerb(stripLeadingSqlComments(sql));
+    const verb = (0, sql_risk_js_1.getSqlVerb)((0, sql_risk_js_1.stripLeadingSqlComments)(sql));
     return ["DROP", "TRUNCATE", "ALTER"].includes(verb);
 }
 /**
@@ -209081,7 +208787,7 @@ function buildSchemaTable(schema, name) {
     return `${schema}.${name}`;
 }
 function parseTargetTableFromSql(sql, defaultSchema) {
-    const normalized = stripLeadingSqlComments(sql);
+    const normalized = (0, sql_risk_js_1.stripLeadingSqlComments)(sql);
     const identifier = String.raw `((?:[A-Za-z_][A-Za-z0-9_$]*\.)?[A-Za-z_][A-Za-z0-9_$]*)`;
     const patterns = [
         new RegExp(String.raw `\bcreate\s+(?:temporary\s+|temp\s+|unlogged\s+)?table\s+(?:if\s+not\s+exists\s+)?${identifier}`, "i"),
@@ -209488,7 +209194,7 @@ function renderParameterizedSql(sql, values) {
     });
 }
 function inferCommand(sql) {
-    return getSqlVerb(sql) || undefined;
+    return (0, sql_risk_js_1.getSqlVerb)(sql) || undefined;
 }
 function createManagerPgClient(context, cloudBaseOptions) {
     return {
@@ -209764,7 +209470,7 @@ async function handleExecuteSql(args, context, deps) {
         success: true,
         data: {
             classification,
-            command: result.command ?? getSqlVerb(args.sql),
+            command: result.command ?? (0, sql_risk_js_1.getSqlVerb)(args.sql),
             rowCount: result.rowCount ?? null,
             previewRows: result.rows
                 .slice(0, 5)
@@ -211860,6 +211566,475 @@ function registerSQLDatabaseTools(server) {
 }
 
 
+/***/ },
+
+/***/ 23668
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.DEPLOY_ERROR_CODES = void 0;
+exports.registerDeployTools = registerDeployTools;
+const toolbox_1 = __webpack_require__(23233);
+const node_fs_1 = __importDefault(__webpack_require__(89971));
+const node_path_1 = __importDefault(__webpack_require__(26743));
+const zod_1 = __webpack_require__(21504);
+const cloudbase_manager_js_1 = __webpack_require__(33109);
+const json_content_js_1 = __webpack_require__(18027);
+const sql_risk_js_1 = __webpack_require__(29885);
+// 声明式部署可编排的资源类型，与 DeployOrchestrator 的部署顺序一致：
+// database → functions → app → hosting → gateway
+const RESOURCE_TYPES = ["database", "functions", "app", "hosting", "gateway"];
+/**
+ * 声明式部署工具的稳定错误码。供 agent 程序化分支处理，不随文案调整而变化。
+ * - CONFIG_NOT_FOUND：cwd 下未找到 cloudbaserc 配置文件
+ * - CONFIG_INVALID：配置未通过 cloudbaserc schema 校验
+ * - ENV_UNRESOLVED：无法确定目标环境 ID（配置/入参/登录态均缺失）
+ * - INVALID_CONCURRENCY：并发数入参非法
+ * - CONFIRM_REQUIRED：写操作未显式传 confirm=true
+ * - DESTRUCTIVE_CONFIRM_REQUIRED：待执行的数据库迁移含破坏性语句，需额外传 confirmDestructive=true
+ * - DEPLOY_FAILED：编排器执行失败或其它未分类错误（可能透传引擎 errorCode）
+ */
+exports.DEPLOY_ERROR_CODES = {
+    CONFIG_NOT_FOUND: "CONFIG_NOT_FOUND",
+    CONFIG_INVALID: "CONFIG_INVALID",
+    ENV_UNRESOLVED: "ENV_UNRESOLVED",
+    INVALID_CONCURRENCY: "INVALID_CONCURRENCY",
+    CONFIRM_REQUIRED: "CONFIRM_REQUIRED",
+    DESTRUCTIVE_CONFIRM_REQUIRED: "DESTRUCTIVE_CONFIRM_REQUIRED",
+    DEPLOY_FAILED: "DEPLOY_FAILED",
+};
+/**
+ * 携带稳定错误码的部署错误。抛出后由 buildErrorEnvelope 归一为信封的 errorCode 字段。
+ */
+class DeployError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "DeployError";
+        this.code = code;
+    }
+}
+function buildEnvelope(data, message) {
+    return { success: true, data, message };
+}
+function buildErrorEnvelope(error) {
+    // DeployError 带显式错误码；引擎/SDK 抛出的错误若带 code 也透传；其余归为 DEPLOY_FAILED。
+    let errorCode = exports.DEPLOY_ERROR_CODES.DEPLOY_FAILED;
+    if (error instanceof DeployError) {
+        errorCode = error.code;
+    }
+    else if (error &&
+        typeof error === "object" &&
+        "code" in error &&
+        typeof error.code === "string" &&
+        error.code.length > 0) {
+        errorCode = error.code;
+    }
+    return {
+        success: false,
+        data: {},
+        message: error instanceof Error ? error.message : String(error),
+        errorCode,
+    };
+}
+/**
+ * 解析 cloudbaserc 声明式部署配置。
+ *
+ * 分两步完成：
+ * 1. 定位并读取配置文件：searchConfig 从 cwd 探测 cloudbaserc.*（json/yaml/yml/js），
+ *    loadConfig 读取原始内容。读取阶段不强制 envId，
+ *    envId 由调用方按优先级单独确定，以支持用登录态环境部署未写死 envId 的配置。
+ * 2. ConfigParser.parseRawConfig：按 mode 合并 envOverrides、下发 functionDefaultConfig
+ *    到各函数、加载 .env / .env.local / .env.<mode> 并渲染 {{env.*}} / {{tcb.*}} 模板变量。
+ */
+async function resolveDeployConfig(options) {
+    const found = await (0, toolbox_1.searchConfig)(options.cwd);
+    if (!found?.filepath) {
+        throw new DeployError(exports.DEPLOY_ERROR_CODES.CONFIG_NOT_FOUND, `未在 ${options.cwd} 找到 cloudbaserc 配置文件（支持 json/yaml/yml/js）`);
+    }
+    const rawConfig = await (0, toolbox_1.loadConfig)({ configPath: found.filepath });
+    return toolbox_1.ConfigParser.parseRawConfig(rawConfig ?? {}, options.cwd, {
+        mode: options.mode,
+    });
+}
+/**
+ * 确定部署使用的环境 ID。
+ *
+ * 优先级：显式传入的 envId > 解析后配置中的 envId > MCP 登录态 / 绑定环境。
+ * 显式入参优先于配置文件，配置未写死 envId 时回退到当前会话绑定的环境。
+ * 三者都无则抛出错误。
+ */
+async function resolveDeployEnvId(options) {
+    if (options.envId && options.envId.length > 0) {
+        return options.envId;
+    }
+    const configEnvId = options.config.envId;
+    if (typeof configEnvId === "string" && configEnvId.length > 0) {
+        return configEnvId;
+    }
+    const resolved = await (0, cloudbase_manager_js_1.getEnvId)(options.cloudBaseOptions);
+    if (!resolved) {
+        throw new DeployError(exports.DEPLOY_ERROR_CODES.ENV_UNRESOLVED, "未能确定部署环境 ID：请在 cloudbaserc 配置 envId、通过 envId 参数指定，或先登录并绑定环境。");
+    }
+    return resolved;
+}
+/**
+ * 按 cloudbaserc schema 校验解析后的配置。
+ *
+ * 校验不通过时抛出错误，错误消息包含各字段的具体校验失败原因，供调用方定位问题。
+ */
+function assertConfigValid(config) {
+    const result = (0, toolbox_1.validateCloudBaseConfigBySchema)(config);
+    if (result.valid) {
+        return;
+    }
+    const detail = result.errors
+        .map((item) => `${item.dataPath || "<root>"} ${item.message}`)
+        .join("; ");
+    throw new DeployError(exports.DEPLOY_ERROR_CODES.CONFIG_INVALID, `cloudbaserc 配置校验未通过：${detail}`);
+}
+/**
+ * 校验并发数取值，非法时抛出错误。
+ *
+ * 未指定时返回 undefined（由编排器使用默认串行）；指定时必须为不小于 1 的整数。
+ */
+function normalizeConcurrency(concurrency) {
+    if (concurrency === undefined) {
+        return undefined;
+    }
+    if (!Number.isInteger(concurrency) || concurrency < 1) {
+        throw new DeployError(exports.DEPLOY_ERROR_CODES.INVALID_CONCURRENCY, `无效的并发数 ${concurrency}，应为不小于 1 的整数`);
+    }
+    return concurrency;
+}
+/**
+ * 让 deployPlan 的预演结论与 deployApply 的实际执行语义对齐。
+ *
+ * 背景：编排器把「云端已存在的函数」标为 status='update'，但 deployApply 在 yes!==true
+ * 且无交互确认回调时，会对 functions+update 保守跳过（reason='no-confirm'）。
+ * 若 plan 原样返回 update，agent 预演看到「会更新」，实际执行却「跳过」——结论相反。
+ *
+ * 此函数按传入的 yes 复算 functions+update 的「有效动作」：
+ * - yes===true：维持 update（执行时确实会覆盖）
+ * - 否则：改标为 skip，并保留原始判定到 declaredStatus，action 说明为何跳过。
+ * 其它资源类型与状态原样透传（database/app/hosting/gateway 的分类不受 yes 影响）。
+ */
+function reconcilePlanWithExecution(plan, yes) {
+    if (!Array.isArray(plan)) {
+        return [];
+    }
+    return plan.map((item) => {
+        if (!item || typeof item !== "object") {
+            return item;
+        }
+        if (item.type === "functions" && item.status === "update" && !yes) {
+            return {
+                ...item,
+                status: "skip",
+                declaredStatus: "update",
+                action: `已存在函数 ${item.name}：未传 yes=true，执行时将保守跳过（不覆盖）。传 yes=true 才会覆盖更新。`,
+            };
+        }
+        return item;
+    });
+}
+/**
+ * 解析 migrations 目录（与引擎 DatabaseDeployer.resolveMigrationsDir 同规则）：
+ * 未配置默认 ./cloudbase/migrations；仅允许相对路径（禁止绝对路径 / 开头）。
+ * 非法时返回 undefined（交由引擎在真正执行时抛出一致的错误，这里不抢报错）。
+ */
+function resolveMigrationsDir(cwd, migrations) {
+    const raw = typeof migrations === "string" && migrations ? migrations : "./cloudbase/migrations";
+    if (node_path_1.default.isAbsolute(raw) || raw.startsWith("/")) {
+        return undefined;
+    }
+    return node_path_1.default.resolve(cwd, raw);
+}
+/**
+ * 从 dry-run plan 中提取「待执行（pending）的数据库迁移标识」。
+ *
+ * 编排器把 database 计划聚合为单条 create 项，pending 迁移写在
+ * changes[].to（field==='migration'），形如 "{version}_{name}"。
+ * 只关注 pending：已 applied 的迁移不会被重复执行，不应触发破坏性确认门。
+ */
+function extractPendingMigrations(plan) {
+    const result = [];
+    for (const item of plan) {
+        if (!item || item.type !== "database" || item.status !== "create") {
+            continue;
+        }
+        const changes = item.changes;
+        if (!Array.isArray(changes)) {
+            continue;
+        }
+        for (const change of changes) {
+            if (change?.field === "migration" && typeof change.to === "string" && change.to) {
+                result.push(change.to);
+            }
+        }
+    }
+    return result;
+}
+/**
+ * 检测「本次将要执行的数据库迁移」中是否含破坏性语句（DROP/TRUNCATE/DELETE、
+ * ALTER ... DROP/RENAME）。
+ *
+ * 仅扫描 pending 迁移对应的本地 .sql 文件；已 applied 的不扫描，避免误拦。
+ * 读文件失败（缺文件/目录非法）视为无法确认破坏性，返回空——真正的存在性/
+ * 格式校验交由引擎执行时处理，这里只在能确证破坏性时加门，避免与引擎报错重复。
+ */
+function detectDestructiveMigrations(options) {
+    const pending = extractPendingMigrations(options.plan);
+    if (pending.length === 0) {
+        return [];
+    }
+    const dbConfig = options.databaseConfig && typeof options.databaseConfig === "object"
+        ? options.databaseConfig
+        : undefined;
+    const migrationsDir = resolveMigrationsDir(options.cwd, dbConfig?.migrations);
+    if (!migrationsDir) {
+        return [];
+    }
+    const hits = [];
+    for (const migration of pending) {
+        const file = node_path_1.default.join(migrationsDir, `${migration}.sql`);
+        let sqlText;
+        try {
+            sqlText = node_fs_1.default.readFileSync(file, "utf-8");
+        }
+        catch {
+            // 文件读不到：不在此处报错，交给引擎执行时给出一致错误
+            continue;
+        }
+        const statements = (0, sql_risk_js_1.findDestructiveStatements)(sqlText);
+        if (statements.length > 0) {
+            hits.push({ migration, file, statements });
+        }
+    }
+    return hits;
+}
+function registerDeployTools(server) {
+    const cloudBaseOptions = server.cloudBaseOptions;
+    const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
+    // 工具一：deployPlan —— 只读，预演部署计划（dry-run）
+    server.registerTool?.("deployPlan", {
+        title: "预演 CloudBase 声明式部署计划",
+        description: "解析 cloudbaserc 并计算声明式部署计划（dry-run，不产生任何变更）。" +
+            "这是 deployApply 的预演对仗工具：plan 计算、deployApply 执行同一份 cloudbaserc。" +
+            "返回每个资源的动作分类：create=新建，update=覆盖更新，skip=无变更/不会执行，" +
+            "conflict=检测到冲突需中断，deploy=直传覆盖。" +
+            "计划已按 yes 复算为「实际会发生的动作」：不传 yes=true 时，云端已存在的函数会标为 skip" +
+            "（并在 declaredStatus 保留 update），与 deployApply 的实际执行结果一致，避免预演与执行相反。" +
+            "\n适用边界：本工具用于项目级声明式编排（一份 cloudbaserc 统一 plan/apply）；" +
+            "单资源临时直传请用 manageFunctions/manageHosting/manageApps。" +
+            "\n- cwd：项目根目录，默认当前工作目录" +
+            "\n- mode：环境名，命中 envOverrides.<mode> 时合并对应的多环境覆盖配置" +
+            "\n- envId：目标环境 ID，优先级高于 cloudbaserc 中的 envId；不传则用配置值或当前绑定环境" +
+            "\n- only：仅计算指定资源类型的计划" +
+            "\n- skip：跳过指定资源类型" +
+            "\n- yes：与 deployApply 的 yes 对齐，用于复算已存在函数的有效动作。" +
+            "true=预演为覆盖更新(update)；false（默认）=预演为保守跳过(skip)",
+        inputSchema: {
+            cwd: zod_1.z
+                .string()
+                .optional()
+                .describe("项目根目录，从此目录向下搜索 cloudbaserc；默认当前工作目录"),
+            mode: zod_1.z
+                .string()
+                .optional()
+                .describe("环境名（如 production/staging），命中 envOverrides.<mode> 时合并覆盖"),
+            envId: zod_1.z
+                .string()
+                .optional()
+                .describe("目标环境 ID，优先级高于 cloudbaserc 中的 envId；不传则用配置值或当前绑定环境"),
+            only: zod_1.z
+                .array(zod_1.z.enum(RESOURCE_TYPES))
+                .optional()
+                .describe("仅计算指定资源类型的计划，可选值：database/functions/app/hosting/gateway"),
+            skip: zod_1.z
+                .array(zod_1.z.enum(RESOURCE_TYPES))
+                .optional()
+                .describe("跳过指定资源类型，可选值：database/functions/app/hosting/gateway"),
+            yes: zod_1.z
+                .boolean()
+                .optional()
+                .describe("与 deployApply 的 yes 对齐，用于复算已存在函数的有效动作。" +
+                "true=预演为覆盖更新；false（默认）=预演为保守跳过"),
+        },
+        annotations: {
+            readOnlyHint: true,
+            openWorldHint: true,
+            category: "deploy",
+        },
+    }, async ({ cwd, mode, envId: envIdInput, only, skip, yes, }) => {
+        try {
+            const projectRoot = cwd ?? process.cwd();
+            const config = await resolveDeployConfig({ cwd: projectRoot, mode });
+            assertConfigValid(config);
+            const envId = await resolveDeployEnvId({
+                envId: envIdInput,
+                config,
+                cloudBaseOptions,
+            });
+            const manager = await getManager();
+            const rawPlan = await manager.getDeployOrchestrator().deployPlan({
+                config,
+                envId,
+                cwd: projectRoot,
+                only,
+                skip,
+                dryRun: true,
+            });
+            // 按 yes 复算为「实际会发生的动作」，使预演与 deployApply 的执行结果一致
+            const plan = reconcilePlanWithExecution(rawPlan, yes === true);
+            return (0, json_content_js_1.jsonContent)(buildEnvelope({ cwd: projectRoot, mode: mode ?? null, envId, yes: yes === true, plan }, "已生成声明式部署计划"));
+        }
+        catch (error) {
+            return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(error));
+        }
+    });
+    // 工具二：deployApply —— 写操作，执行声明式部署（本地形态的 apply，与 deployPlan 对仗）
+    server.registerTool?.("deployApply", {
+        title: "执行 CloudBase 声明式部署（本地 apply）",
+        description: "解析 cloudbaserc 并按 database→functions→app→hosting→gateway 顺序执行声明式部署。" +
+            "这是 deployPlan 的执行对仗工具（plan 预演 / deployApply 执行同一份 cloudbaserc），" +
+            "属于本地形态的 apply（读本地 cloudbaserc 并在本地构建上传），" +
+            "是会变更云端资源的写操作，必须显式传 confirm=true 才会执行。" +
+            "建议先用 deployPlan 预演，确认计划无误后再执行。" +
+            "\n适用边界：本工具用于项目级声明式编排（一份 cloudbaserc 统一 plan/apply）；" +
+            "单资源临时直传请用 manageFunctions/manageHosting/manageApps。" +
+            "\n- confirm：必须显式传 true 才执行部署，否则直接拒绝" +
+            "\n- confirmDestructive：当本次待执行的数据库迁移含破坏性语句（DROP/TRUNCATE/DELETE、" +
+            "ALTER…DROP/RENAME）时，除 confirm 外还必须显式传 confirmDestructive=true 才会执行；" +
+            "否则拒绝并列出命中的迁移与语句。无破坏性迁移时该参数不生效" +
+            "\n- cwd：项目根目录，默认当前工作目录" +
+            "\n- mode：环境名，命中 envOverrides.<mode> 时合并对应的多环境覆盖配置" +
+            "\n- envId：目标环境 ID，优先级高于 cloudbaserc 中的 envId；不传则用配置值或当前绑定环境" +
+            "\n- only：仅部署指定资源类型" +
+            "\n- skip：跳过指定资源类型" +
+            "\n- yes：遇到已存在资源时的处理方式。true=直接覆盖更新；false（默认）=保守跳过，" +
+            "在无法交互确认的场景下已存在资源不会被覆盖（与 deployPlan 的 yes 语义一致）" +
+            "\n- concurrency：同类型资源最大并行数，默认 1（串行）" +
+            "\n- continueOnError：某个资源失败后继续部署其余资源（database 失败仍强制中断）",
+        inputSchema: {
+            confirm: zod_1.z
+                .boolean()
+                .optional()
+                .describe("危险操作确认开关。部署会变更云端资源，必须显式传 confirm=true 才会执行"),
+            confirmDestructive: zod_1.z
+                .boolean()
+                .optional()
+                .describe("破坏性数据库变更确认开关。当待执行迁移含 DROP/TRUNCATE/DELETE 或 ALTER…DROP/RENAME 时，" +
+                "必须在 confirm=true 之外额外显式传 confirmDestructive=true；无破坏性迁移时不生效"),
+            cwd: zod_1.z
+                .string()
+                .optional()
+                .describe("项目根目录，从此目录向下搜索 cloudbaserc；默认当前工作目录"),
+            mode: zod_1.z
+                .string()
+                .optional()
+                .describe("环境名（如 production/staging），命中 envOverrides.<mode> 时合并覆盖"),
+            envId: zod_1.z
+                .string()
+                .optional()
+                .describe("目标环境 ID，优先级高于 cloudbaserc 中的 envId；不传则用配置值或当前绑定环境"),
+            only: zod_1.z
+                .array(zod_1.z.enum(RESOURCE_TYPES))
+                .optional()
+                .describe("仅部署指定资源类型，可选值：database/functions/app/hosting/gateway"),
+            skip: zod_1.z
+                .array(zod_1.z.enum(RESOURCE_TYPES))
+                .optional()
+                .describe("跳过指定资源类型，可选值：database/functions/app/hosting/gateway"),
+            yes: zod_1.z
+                .boolean()
+                .optional()
+                .describe("遇到已存在资源时是否直接覆盖更新。true=覆盖；false（默认）=保守跳过已存在资源"),
+            concurrency: zod_1.z
+                .number()
+                .int()
+                .min(1)
+                .optional()
+                .describe("同类型资源最大并行数，默认 1（串行）；仅作用于同类型资源，跨类型依赖顺序不变"),
+            continueOnError: zod_1.z
+                .boolean()
+                .optional()
+                .describe("某个资源失败后是否继续部署其余资源；database 失败始终强制中断"),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            openWorldHint: true,
+            category: "deploy",
+        },
+    }, async ({ confirm, confirmDestructive, cwd, mode, envId: envIdInput, only, skip, yes, concurrency, continueOnError, }) => {
+        try {
+            if (confirm !== true) {
+                throw new DeployError(exports.DEPLOY_ERROR_CODES.CONFIRM_REQUIRED, "部署会变更云端资源，必须显式传 confirm=true 才会执行。" +
+                    "建议先用 deployPlan 预演部署计划，确认无误后再执行。");
+            }
+            const projectRoot = cwd ?? process.cwd();
+            const config = await resolveDeployConfig({ cwd: projectRoot, mode });
+            assertConfigValid(config);
+            const envId = await resolveDeployEnvId({
+                envId: envIdInput,
+                config,
+                cloudBaseOptions,
+            });
+            const manager = await getManager();
+            const orchestrator = manager.getDeployOrchestrator();
+            // 破坏性数据库变更门：仅当 database 参与本次部署时，先 dry-run 取 pending 迁移，
+            // 检测破坏性语句；命中且未额外确认则拒绝，独立于总 confirm 之外多一道门。
+            const databaseParticipates = !!config.database &&
+                (!only || only.includes("database")) &&
+                !(skip ?? []).includes("database");
+            if (databaseParticipates && confirmDestructive !== true) {
+                const dryRunPlan = await orchestrator.deployPlan({
+                    config,
+                    envId,
+                    cwd: projectRoot,
+                    only,
+                    skip,
+                    dryRun: true,
+                });
+                const destructive = detectDestructiveMigrations({
+                    plan: Array.isArray(dryRunPlan) ? dryRunPlan : [],
+                    cwd: projectRoot,
+                    databaseConfig: config.database,
+                });
+                if (destructive.length > 0) {
+                    throw new DeployError(exports.DEPLOY_ERROR_CODES.DESTRUCTIVE_CONFIRM_REQUIRED, "本次待执行的数据库迁移包含破坏性语句（DROP/TRUNCATE/DELETE 或 ALTER…DROP/RENAME），" +
+                        "可能造成数据/结构不可逆丢失。请先备份或复核，确认后额外传 confirmDestructive=true 再执行。" +
+                        "命中迁移：" +
+                        destructive
+                            .map((d) => `${d.migration}（${d.statements.length} 条破坏性语句）`)
+                            .join("；"));
+                }
+            }
+            const result = await orchestrator.deploy({
+                config,
+                envId,
+                cwd: projectRoot,
+                only,
+                skip,
+                yes: yes === true,
+                concurrency: normalizeConcurrency(concurrency),
+                continueOnError,
+            });
+            return (0, json_content_js_1.jsonContent)(buildEnvelope({ cwd: projectRoot, mode: mode ?? null, envId, result }, "声明式部署已执行"));
+        }
+        catch (error) {
+            return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(error));
+        }
+    });
+}
+
+
 /***/ },
 
 /***/ 27528
@@ -224117,7 +224292,7 @@ function registerSetupTools(server) {
     server.registerTool("downloadTemplate", {
         title: "下载项目模板",
         description: `自动下载并部署CloudBase项目模板。
-**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.33.1" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
+**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.33.2" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
         inputSchema: {
             template: zod_1.z
                 .enum(["react", "vue", "miniprogram", "uniapp", "rules"])
@@ -225095,6 +225270,7 @@ function registerPGStorageTools(server) {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.CLOUD_INCOMPATIBLE_ACTION_LEVEL_EXCEPTIONS = exports.CLOUD_INCOMPATIBLE_TOOLS = void 0;
 exports.isCloudMode = isCloudMode;
 exports.enableCloudMode = enableCloudMode;
 exports.getCloudModeStatus = getCloudModeStatus;
@@ -225140,6 +225316,65 @@ function getCloudModeStatus() {
     }
     return { enabled: false, source: null };
 }
+/**
+ * Tools that are incompatible with cloud mode because they read from or write to
+ * the local filesystem (uploads, downloads, config files, or building an upload
+ * artifact from `process.cwd()`). In cloud mode these top-level tools are not
+ * registered at all; where a tool has both cloud-safe and local-only actions,
+ * gating happens at the action level inside the tool instead (see
+ * `ensureActionAllowedInCloudMode` in functions.ts / hosting.ts).
+ *
+ * IMPORTANT: keep this list in sync with the tools actually registered. Entries
+ * that no longer match a registered tool name are dead (they silently gate
+ * nothing). `CLOUD_INCOMPATIBLE_TOOLS.test.ts` asserts every entry here maps to
+ * a known tool or a documented action-level exception to prevent silent rot.
+ */
+exports.CLOUD_INCOMPATIBLE_TOOLS = [
+    // Auth tools - local file uploads
+    'auth',
+    // Storage tools - local file uploads / downloads.
+    // NOTE: `uploadFile` is not a top-level tool name (storage upload is exposed
+    // via `manageStorage`); kept here as a documented action-level exception.
+    'uploadFile',
+    'manageStorage',
+    // Function tools - local code uploads.
+    // NOTE: createFunction / updateFunctionCode are now actions of `manageFunctions`,
+    // not top-level tools, so gating them here is a no-op kept for documentation.
+    // The real cloud-mode guard for those actions lives in
+    // functions.ts#ensureActionAllowedInCloudMode. Left here intentionally so the
+    // sync test flags them as "action-level exceptions" rather than removing the
+    // record of why they are not top-level tools.
+    'updateFunctionCode',
+    'createFunction',
+    // Declarative deploy tools - read local cloudbaserc and build the upload
+    // artifact from cwd (process.cwd() when no cwd is passed). Same class as the
+    // function/upload tools above: they have no meaning without a local project.
+    'deployApply',
+    'deployPlan',
+    // Download tools - local file downloads
+    'downloadTemplate',
+    // Setup tools - local config file operations.
+    // NOTE: `setupEnvironmentId` is not a top-level tool name; kept as a documented
+    // action-level exception (env binding is handled via `auth`/setup flows).
+    'setupEnvironmentId',
+    // CloudRun tools - local file operations
+    'manageCloudRun',
+    // manageApps is intentionally NOT listed: deployApp with localPath/filePath is
+    // blocked per-action in apps.ts (CLOUD_MODE_UNSUPPORTED_ACTION) so cloud mode
+    // can still use getUploadUrl + cosTimestamp, deleteApp, and deleteAppVersion.
+];
+/**
+ * Tool names that appear in CLOUD_INCOMPATIBLE_TOOLS for documentation but are no
+ * longer registered as top-level tools (their cloud gating is enforced at the
+ * action level instead). The sync test treats these as expected, everything else
+ * must resolve to a registered tool.
+ */
+exports.CLOUD_INCOMPATIBLE_ACTION_LEVEL_EXCEPTIONS = [
+    'createFunction',
+    'updateFunctionCode',
+    'uploadFile',
+    'setupEnvironmentId',
+];
 /**
  * Check if a tool should be registered in cloud mode
  * @param toolName - The name of the tool
@@ -225150,29 +225385,7 @@ function shouldRegisterTool(toolName) {
     if (!isCloudMode()) {
         return true;
     }
-    // Cloud-incompatible tools that involve local file operations
-    const cloudIncompatibleTools = [
-        // Auth tools - local file uploads
-        'auth',
-        // Storage tools - local file uploads
-        'uploadFile',
-        // Hosting tools - action-level cloud gating is handled inside manageHosting
-        // Function tools - local code uploads
-        'updateFunctionCode',
-        'createFunction', // also involves local files
-        // Download tools - local file downloads
-        'downloadTemplate',
-        // Setup tools - local config file operations
-        'setupEnvironmentId',
-        // CloudRun tools - local file operations
-        'manageCloudRun',
-        // Download tools - local file downloads
-        'manageStorage',
-        // manageApps is intentionally NOT listed: deployApp with localPath/filePath is
-        // blocked per-action in apps.ts (CLOUD_MODE_UNSUPPORTED_ACTION) so cloud mode
-        // can still use getUploadUrl + cosTimestamp, deleteApp, and deleteAppVersion.
-    ];
-    return !cloudIncompatibleTools.includes(toolName);
+    return !exports.CLOUD_INCOMPATIBLE_TOOLS.includes(toolName);
 }
 
 
@@ -226332,6 +226545,163 @@ function resolveSiteAndRegion(opts = {}) {
 }
 
 
+/***/ },
+
+/***/ 29885
+(__unused_webpack_module, exports) {
+
+"use strict";
+
+/**
+ * Shared SQL risk heuristics.
+ *
+ * Extracted from databasePG.ts so both the interactive PG execute path and the
+ * declarative deploy path classify destructive SQL with the *same* rules,
+ * avoiding drift between two independent detectors.
+ *
+ * These are conservative lexical heuristics, not a full SQL parser: they strip
+ * leading comments, read the leading verb, and match destructive keywords. They
+ * are meant to decide whether an *extra* human confirmation is warranted, not to
+ * be a security boundary.
+ */
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.stripLeadingSqlComments = stripLeadingSqlComments;
+exports.getSqlVerb = getSqlVerb;
+exports.isDestructiveSql = isDestructiveSql;
+exports.splitSqlStatements = splitSqlStatements;
+exports.findDestructiveStatements = findDestructiveStatements;
+/** Strip leading line (`--`, `#`) and block (`/* *​/`) comments and whitespace. */
+function stripLeadingSqlComments(sql) {
+    let normalized = sql.trim();
+    while (normalized.length > 0) {
+        if (normalized.startsWith("--")) {
+            normalized = normalized.replace(/^--.*(?:\r?\n|$)/, "").trimStart();
+            continue;
+        }
+        if (normalized.startsWith("#")) {
+            normalized = normalized.replace(/^#.*(?:\r?\n|$)/, "").trimStart();
+            continue;
+        }
+        if (normalized.startsWith("/*")) {
+            normalized = normalized.replace(/^\/\*[\s\S]*?\*\//, "").trimStart();
+            continue;
+        }
+        break;
+    }
+    return normalized;
+}
+/** Return the leading SQL verb (uppercased), ignoring leading comments. */
+function getSqlVerb(sql) {
+    const normalized = stripLeadingSqlComments(sql);
+    const match = normalized.match(/^([a-zA-Z]+)/);
+    return match ? match[1].toUpperCase() : "";
+}
+/**
+ * Whether a *single* SQL statement is destructive (drops/truncates data or
+ * removes/renames schema objects).
+ */
+function isDestructiveSql(sql) {
+    const normalized = stripLeadingSqlComments(sql);
+    const verb = getSqlVerb(normalized);
+    if (["DROP", "TRUNCATE", "DELETE"].includes(verb)) {
+        return true;
+    }
+    if (verb === "ALTER") {
+        return /\b(DROP|RENAME)\b/i.test(normalized);
+    }
+    return false;
+}
+/**
+ * Split a possibly multi-statement SQL script into individual statements.
+ *
+ * Naive split on `;` at statement boundaries, but aware of single/double quotes,
+ * line/block comments, and PostgreSQL dollar-quoted strings ($$ ... $$ or
+ * $tag$ ... $tag$) so semicolons inside string bodies / function definitions do
+ * not split a statement. Good enough for the conservative destructive scan; not
+ * a full parser.
+ */
+function splitSqlStatements(sqlText) {
+    const statements = [];
+    let current = "";
+    let i = 0;
+    const n = sqlText.length;
+    while (i < n) {
+        const ch = sqlText[i];
+        const next = sqlText[i + 1];
+        // line comment -- ... (to end of line)
+        if (ch === "-" && next === "-") {
+            const end = sqlText.indexOf("\n", i);
+            const stop = end === -1 ? n : end + 1;
+            current += sqlText.slice(i, stop);
+            i = stop;
+            continue;
+        }
+        // block comment /* ... */
+        if (ch === "/" && next === "*") {
+            const end = sqlText.indexOf("*/", i + 2);
+            const stop = end === -1 ? n : end + 2;
+            current += sqlText.slice(i, stop);
+            i = stop;
+            continue;
+        }
+        // single- or double-quoted string
+        if (ch === "'" || ch === '"') {
+            const quote = ch;
+            current += ch;
+            i += 1;
+            while (i < n) {
+                current += sqlText[i];
+                // handle escaped quote by doubling ('' or "")
+                if (sqlText[i] === quote) {
+                    if (sqlText[i + 1] === quote) {
+                        current += sqlText[i + 1];
+                        i += 2;
+                        continue;
+                    }
+                    i += 1;
+                    break;
+                }
+                i += 1;
+            }
+            continue;
+        }
+        // dollar-quoted string: $$ ... $$ or $tag$ ... $tag$
+        if (ch === "$") {
+            const tagMatch = sqlText.slice(i).match(/^\$([a-zA-Z_][a-zA-Z0-9_]*)?\$/);
+            if (tagMatch) {
+                const tag = tagMatch[0];
+                const end = sqlText.indexOf(tag, i + tag.length);
+                const stop = end === -1 ? n : end + tag.length;
+                current += sqlText.slice(i, stop);
+                i = stop;
+                continue;
+            }
+        }
+        if (ch === ";") {
+            if (current.trim().length > 0) {
+                statements.push(current.trim());
+            }
+            current = "";
+            i += 1;
+            continue;
+        }
+        current += ch;
+        i += 1;
+    }
+    if (current.trim().length > 0) {
+        statements.push(current.trim());
+    }
+    return statements;
+}
+/**
+ * Scan a (possibly multi-statement) SQL script and return the destructive
+ * statements found. Empty array means no destructive statement detected.
+ */
+function findDestructiveStatements(sqlText) {
+    return splitSqlStatements(sqlText).filter((stmt) => isDestructiveSql(stmt));
+}
+
+
 /***/ },
 
 /***/ 5198
@@ -226406,7 +226776,7 @@ class TelemetryReporter {
         const arch = os_1.default.arch(); // 系统架构
         // Build-time injected version; guard for vitest / non-webpack runtimes.
         const mcpVersion = process.env.npm_package_version ||
-            ( true ? "2.33.1" : 0);
+            ( true ? "2.33.2" : 0);
         return {
             userAgent: `${osType} ${osRelease} ${arch} ${nodeVersion} CloudBase-MCP/${mcpVersion}`,
             deviceId: this.deviceId,
@@ -226999,7 +227369,7 @@ ${envIdSection}
 ## 环境信息
 - 操作系统: ${os_1.default.type()} ${os_1.default.release()}
 - Node.js版本: ${process.version}
-- MCP 版本：${process.env.npm_package_version || ( true ? "2.33.1" : 0)}
+- MCP 版本：${process.env.npm_package_version || ( true ? "2.33.2" : 0)}
 - 系统架构: ${os_1.default.arch()}
 - 时间: ${new Date().toISOString()}
 - 请求ID: ${requestId}
@@ -227088,7 +227458,7 @@ function createWrappedHandler(name, handler, server) {
                 requestId,
                 ide: server.ide || process.env.INTEGRATION_IDE || ''
             });
-            const mcpVersion =  true ? "2.33.1" : 0;
+            const mcpVersion =  true ? "2.33.2" : 0;
             const requestIdSuffix = requestId ? `\n🆔 RequestId: ${requestId}` : '';
             const enhancedErrorMessage = `${errorMessage}${requestIdSuffix}\n\n📦 CloudBase MCP v${mcpVersion}\n🔗 遇到问题？请复制以下链接到浏览器打开\n即可自动携带错误详情快速创建 GitHub Issue：\n${issueLink}`;
             // 创建新的错误对象，保持原有的错误类型但更新消息