@cloudbase/manager-node 5.7.0-beta.3 → 5.7.1-beta.0

package/lib/deploy/function/config-guard.js

@@ -1,592 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseImageReference = parseImageReference;
-exports.normalizeGatewayPath = normalizeGatewayPath;
-exports.isCustomImageRuntime = isCustomImageRuntime;
-exports.normalizeDeployConfig = normalizeDeployConfig;
-exports.checkDeployConfig = checkDeployConfig;
-exports.assertDeployConfig = assertDeployConfig;
-const lodash_1 = __importDefault(require("lodash"));
-const error_1 = require("../../error");
-const types_1 = require("../types");
-/**
- * 配置契约守卫
- *
- * 该文件只做纯函数、无 IO 的校验，职责是保证进入部署编排的配置组合本身合法。
- * 不负责以下检查，它们属于 Preflight：
- * - 目录、Dockerfile、scf_bootstrap 是否真实存在
- * - Docker 是否安装并可用
- * - TCR 实例、地域、角色和权限
- * - 网络连通性
- */
-/** 云函数名称规则：字母开头，允许字母数字下划线中划线，长度 2-60 */
-const FUNCTION_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9_-]{1,59}$/;
-/** 镜像 tag 规则 */
-const IMAGE_TAG_PATTERN = /^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$/;
-/** 镜像 digest 规则 */
-const IMAGE_DIGEST_PATTERN = /^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-fA-F0-9]{32,}$/;
-/** 镜像仓库路径规则 */
-const IMAGE_REPOSITORY_PATTERN = /^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*$/;
-/** 网关路径字符白名单，避免注入与歧义字符 */
-const GATEWAY_PATH_PATTERN = /^[A-Za-z0-9\-._~%/:@]+$/;
-/** 环境变量与构建参数名规则 */
-const ENV_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/** 疑似敏感字段名，用于提示不要通过构建参数传递密钥 */
-const SENSITIVE_KEY_PATTERN = /(secret|token|password|passwd|credential|private[_-]?key|access[_-]?key)/i;
-const HTTP_BUILD_STRATEGIES = ['zip', 'cloud', 'local', 'image'];
-const MAX_GATEWAY_PATH_LENGTH = 512;
-/**
- * 解析 OCI 镜像引用
- *
- * 支持 [registry[:port]/]repository[:tag][@digest]
- * 无法仅通过是否包含冒号判断 tag，因为 registry 可能带端口
- * @returns 解析结果，非法时返回 null
- */
-function parseImageReference(reference) {
-    if (typeof reference !== 'string') {
-        return null;
-    }
-    const ref = reference.trim();
-    if (!ref || /\s/.test(ref) || ref.length > 512) {
-        return null;
-    }
-    let remain = ref;
-    let digest;
-    const atIndex = remain.lastIndexOf('@');
-    if (atIndex > -1) {
-        digest = remain.slice(atIndex + 1);
-        remain = remain.slice(0, atIndex);
-        if (!IMAGE_DIGEST_PATTERN.test(digest)) {
-            return null;
-        }
-    }
-    let tag;
-    const lastSlashIndex = remain.lastIndexOf('/');
-    const colonIndex = remain.indexOf(':', lastSlashIndex + 1);
-    if (colonIndex > -1) {
-        tag = remain.slice(colonIndex + 1);
-        remain = remain.slice(0, colonIndex);
-        if (!IMAGE_TAG_PATTERN.test(tag)) {
-            return null;
-        }
-    }
-    if (!remain) {
-        return null;
-    }
-    let registry;
-    let repository = remain;
-    const firstSlashIndex = remain.indexOf('/');
-    if (firstSlashIndex > -1) {
-        const maybeRegistry = remain.slice(0, firstSlashIndex);
-        const isRegistry = maybeRegistry === 'localhost' ||
-            maybeRegistry.includes('.') ||
-            maybeRegistry.includes(':');
-        if (isRegistry) {
-            registry = maybeRegistry;
-            repository = remain.slice(firstSlashIndex + 1);
-        }
-    }
-    if (!repository || !IMAGE_REPOSITORY_PATTERN.test(repository)) {
-        return null;
-    }
-    return { registry, repository, tag, digest };
-}
-/**
- * 规范化网关路径
- *
- * 合并连续斜杠并去除尾部斜杠，根路径保持为 /
- * @returns 规范化结果，非法时返回 null
- */
-function normalizeGatewayPath(input) {
-    if (typeof input !== 'string') {
-        return null;
-    }
-    const raw = input.trim();
-    if (!raw || raw.length > MAX_GATEWAY_PATH_LENGTH) {
-        return null;
-    }
-    if (!raw.startsWith('/')) {
-        return null;
-    }
-    // 拒绝 query、fragment、反斜杠与控制字符
-    if (/[?#\\]/.test(raw) || /[\u0000-\u001f\u007f]/.test(raw)) {
-        return null;
-    }
-    if (!GATEWAY_PATH_PATTERN.test(raw)) {
-        return null;
-    }
-    const merged = raw.replace(/\/{2,}/g, '/');
-    const segments = merged.split('/');
-    // 拒绝相对路径段，避免路径穿越歧义
-    if (segments.some(segment => segment === '.' || segment === '..')) {
-        return null;
-    }
-    if (merged === '/') {
-        return '/';
-    }
-    return merged.replace(/\/+$/, '');
-}
-/** 判断是否为自定义镜像运行时 */
-function isCustomImageRuntime(runtime) {
-    return typeof runtime === 'string' && runtime.toLowerCase() === types_1.CUSTOM_IMAGE_RUNTIME.toLowerCase();
-}
-/** 判断相对路径是否安全，禁止绝对路径与向上穿越 */
-function isSafeRelativePath(input) {
-    if (typeof input !== 'string') {
-        return false;
-    }
-    const value = input.trim();
-    if (!value || value.length > 512) {
-        return false;
-    }
-    if (/[\u0000-\u001f\u007f]/.test(value)) {
-        return false;
-    }
-    // 绝对路径与 Windows 盘符
-    if (value.startsWith('/') || value.startsWith('\\') || /^[A-Za-z]:[\\/]/.test(value)) {
-        return false;
-    }
-    const segments = value.split(/[\\/]+/);
-    if (segments.some(segment => segment === '..')) {
-        return false;
-    }
-    return true;
-}
-/**
- * 推断 HTTP 函数的构建策略
- * 未显式指定时，按已有配置做保守推断，便于兼容旧配置
- */
-function inferHttpBuildStrategy(config) {
-    if (config === null || config === void 0 ? void 0 : config.buildStrategy) {
-        return config.buildStrategy;
-    }
-    if (config === null || config === void 0 ? void 0 : config.imageConfig) {
-        return 'image';
-    }
-    if (config === null || config === void 0 ? void 0 : config.build) {
-        // 有构建上下文但未声明策略时，默认使用无需本地 Docker 的云端构建
-        return 'cloud';
-    }
-    if (isCustomImageRuntime(config === null || config === void 0 ? void 0 : config.runtime)) {
-        return 'image';
-    }
-    return 'zip';
-}
-/**
- * 规范化部署配置
- *
- * 仅填充默认值与收窄类型，不做合法性判断，保证在非法输入下也能安全返回，
- * 以便 checkDeployConfig 汇总全部问题
- */
-function normalizeDeployConfig(config) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
-    if (!config || typeof config !== 'object') {
-        throw new error_1.CloudBaseError('部署配置必须是对象', {
-            code: types_1.FUNCTION_DEPLOY_ERROR.CONFIG_INVALID
-        });
-    }
-    const cloned = lodash_1.default.cloneDeep(config);
-    const type = cloned.type === 'HTTP' ? 'HTTP' : 'Event';
-    if (type === 'Event') {
-        return Object.assign(Object.assign({}, cloned), { type: 'Event', buildStrategy: 'zip' });
-    }
-    const buildStrategy = inferHttpBuildStrategy(cloned);
-    if (buildStrategy === 'zip') {
-        const isNodejsRuntime = cloned.runtime === undefined || String(cloned.runtime).startsWith('Nodejs');
-        if (isNodejsRuntime) {
-            return Object.assign(Object.assign({}, cloned), { type: 'HTTP', buildStrategy: 'zip' });
-        }
-        const ignoreList = Array.isArray(cloned.ignore)
-            ? cloned.ignore
-            : cloned.ignore
-                ? [cloned.ignore]
-                : [];
-        return Object.assign(Object.assign({}, cloned), { type: 'HTTP', buildStrategy: 'zip', 
-            // SCF Web 函数的非 Node.js 运行时不支持云端安装依赖，需随代码包携带
-            installDependency: false, 
-            // node_modules 必须随代码包上传，不能被 ignore 排除
-            ignore: ignoreList.filter((item) => !/node_modules/.test(item)) });
-    }
-    const normalizedImage = Object.assign(Object.assign({}, cloned), { type: 'HTTP', buildStrategy, runtime: types_1.CUSTOM_IMAGE_RUNTIME, imagePort: (_a = cloned.imagePort) !== null && _a !== void 0 ? _a : types_1.IMAGE_FUNCTION_PORT });
-    if (buildStrategy === 'cloud' || buildStrategy === 'local') {
-        normalizedImage.imageType =
-            (_b = cloned.imageType) !== null && _b !== void 0 ? _b : (((_c = cloned.build) === null || _c === void 0 ? void 0 : _c.registryId) ? 'enterprise' : 'personal');
-    }
-    // 镜像函数由容器启动命令决定入口，不使用 handler 与云端装依赖
-    delete normalizedImage.handler;
-    delete normalizedImage.installDependency;
-    if (buildStrategy === 'cloud' || buildStrategy === 'local') {
-        normalizedImage.build = Object.assign(Object.assign({}, (cloned.build || {})), { dockerfile: (_e = (_d = cloned.build) === null || _d === void 0 ? void 0 : _d.dockerfile) !== null && _e !== void 0 ? _e : types_1.DEFAULT_DOCKERFILE, platform: (_g = (_f = cloned.build) === null || _f === void 0 ? void 0 : _f.platform) !== null && _g !== void 0 ? _g : types_1.DEFAULT_IMAGE_PLATFORM, repository: (_j = (_h = cloned.build) === null || _h === void 0 ? void 0 : _h.repository) !== null && _j !== void 0 ? _j : cloned.name });
-    }
-    if (buildStrategy === 'local') {
-        // 默认不静默改变构建环境
-        normalizedImage.localFallback = (_k = cloned.localFallback) !== null && _k !== void 0 ? _k : 'error';
-    }
-    return normalizedImage;
-}
-function fail(id, summary, remediation) {
-    return { id, status: 'fail', summary, remediation };
-}
-function warn(id, summary, remediation) {
-    return { id, status: 'warn', summary, remediation };
-}
-/** 校验通用函数属性 */
-function checkCommonFields(config, checks) {
-    if (typeof config.name !== 'string' || !FUNCTION_NAME_PATTERN.test(config.name)) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CONFIG_NAME_INVALID, '函数名称不合法', '名称需以字母开头，只能包含字母、数字、下划线和中划线，长度 2-60'));
-    }
-    if (config.type !== undefined && config.type !== 'Event' && config.type !== 'HTTP') {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CONFIG_TYPE_INVALID, '函数类型不合法', 'type 只能是 Event 或 HTTP'));
-    }
-    if (config.timeout !== undefined) {
-        const timeout = config.timeout;
-        if (!Number.isInteger(timeout) || timeout < 1 || timeout > 900) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CONFIG_TIMEOUT_INVALID, '超时时间不合法', 'timeout 需为 1-900 之间的整数，单位秒'));
-        }
-    }
-    if (config.memorySize !== undefined) {
-        const memorySize = config.memorySize;
-        if (!Number.isInteger(memorySize) || memorySize < 64 || memorySize > 3072) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CONFIG_MEMORY_SIZE_INVALID, '内存规格不合法', 'memorySize 需为 64-3072 之间的整数，单位 MB'));
-        }
-        else if (memorySize % 64 !== 0) {
-            checks.push(warn(types_1.FUNCTION_DEPLOY_ERROR.CONFIG_MEMORY_SIZE_INVALID, '内存规格可能不被支持', '建议使用 64 的整数倍，例如 128、256、512'));
-        }
-    }
-    if (config.envVariables !== undefined) {
-        if (!lodash_1.default.isPlainObject(config.envVariables)) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CONFIG_ENV_VARIABLE_INVALID, '环境变量必须是对象', 'envVariables 需为 key-value 形式'));
-        }
-        else {
-            Object.entries(config.envVariables).forEach(([key, value]) => {
-                if (!ENV_KEY_PATTERN.test(key)) {
-                    checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CONFIG_ENV_VARIABLE_INVALID, `环境变量名不合法：${key}`, '变量名需以字母或下划线开头，仅包含字母、数字和下划线'));
-                }
-                const validValue = typeof value === 'string' ||
-                    typeof value === 'number' ||
-                    typeof value === 'boolean';
-                if (!validValue) {
-                    checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CONFIG_ENV_VARIABLE_INVALID, `环境变量 ${key} 的值类型不合法`, '值只能是字符串、数字或布尔值'));
-                }
-            });
-        }
-    }
-}
-/** 校验本地代码来源 */
-function checkCodeSource(config, checks) {
-    const sources = ['functionRootPath', 'functionPath', 'base64Code'].filter(key => config[key] !== undefined && config[key] !== null && config[key] !== '');
-    if (sources.length === 0) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CODE_SOURCE_MISSING, '缺少代码来源', '请提供 functionRootPath、functionPath 或 base64Code 之一'));
-        return;
-    }
-    if (sources.length > 1) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CODE_SOURCE_CONFLICT, '代码来源存在冲突', `functionRootPath、functionPath 和 base64Code 只能指定一个，当前指定了 ${sources.join('、')}`));
-    }
-}
-/** 校验 Event 函数专属约束 */
-function checkEventConfig(raw, checks) {
-    if (raw.buildStrategy !== undefined && raw.buildStrategy !== 'zip') {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CONFIG_STRATEGY_INVALID, `Event 函数不支持 buildStrategy: ${raw.buildStrategy}`, '镜像构建策略仅支持 HTTP 函数，Event 函数请使用代码包部署'));
-    }
-    if (raw.imageConfig || isCustomImageRuntime(raw.runtime)) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.EVENT_IMAGE_NOT_SUPPORTED, 'Event 函数不支持自定义镜像', '请将 type 设置为 HTTP，或改用托管运行时'));
-    }
-    if (raw.gatewayPath !== undefined || raw.public !== undefined) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.EVENT_GATEWAY_NOT_SUPPORTED, 'Event 函数不支持网关路径与匿名访问配置', '如需 HTTP 访问，请将 type 设置为 HTTP'));
-    }
-    if (raw.protocolType !== undefined || raw.instanceConcurrencyConfig !== undefined) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.EVENT_HTTP_FIELD_NOT_SUPPORTED, 'Event 函数不支持 HTTP 协议与实例并发配置', '请移除 protocolType 与 instanceConcurrencyConfig'));
-    }
-}
-/** 校验 HTTP 函数公共约束 */
-function checkHttpCommon(raw, checks) {
-    var _a, _b;
-    if (raw.triggers !== undefined) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.HTTP_TRIGGER_NOT_SUPPORTED, 'HTTP 函数不支持事件触发器', 'HTTP 函数通过网关路径访问，如需定时任务请使用 Event 函数'));
-    }
-    if (raw.gatewayPath !== undefined && normalizeGatewayPath(raw.gatewayPath) === null) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.GATEWAY_PATH_INVALID, '网关路径不合法', '需以 / 开头，不能包含查询串、片段、反斜杠或相对路径段'));
-    }
-    const concurrency = raw.instanceConcurrencyConfig;
-    if (concurrency !== undefined) {
-        if (!lodash_1.default.isPlainObject(concurrency)) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.HTTP_CONCURRENCY_INVALID, '实例并发配置必须是对象'));
-        }
-        else if (concurrency.maxConcurrency !== undefined) {
-            const max = concurrency.maxConcurrency;
-            if (!Number.isInteger(max) || max < 1 || max > 100) {
-                checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.HTTP_CONCURRENCY_INVALID, '单实例并发数不合法', 'maxConcurrency 需为 1-100 之间的整数'));
-            }
-        }
-    }
-    const idleTimeOut = (_b = (_a = raw.protocolParams) === null || _a === void 0 ? void 0 : _a.wsParams) === null || _b === void 0 ? void 0 : _b.idleTimeOut;
-    if (idleTimeOut !== undefined) {
-        if (!Number.isInteger(idleTimeOut) || idleTimeOut < 10 || idleTimeOut > 7200) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.HTTP_PROTOCOL_PARAMS_INVALID, 'WebSocket 空闲超时不合法', 'idleTimeOut 需为 10-7200 之间的整数，单位秒'));
-        }
-        else if (raw.protocolType !== 'WS') {
-            checks.push(warn(types_1.FUNCTION_DEPLOY_ERROR.HTTP_PROTOCOL_PARAMS_INVALID, 'WebSocket 参数在当前协议下不生效', '如需使用 WebSocket，请设置 protocolType 为 WS'));
-        }
-    }
-}
-/** 校验镜像函数公共约束 */
-function checkImageRuntimeCommon(raw, checks) {
-    if (raw.runtime !== undefined && !isCustomImageRuntime(raw.runtime)) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_RUNTIME_INVALID, `镜像部署要求 runtime 为 ${types_1.CUSTOM_IMAGE_RUNTIME}`, `当前为 ${raw.runtime}，请移除 runtime 或设置为 ${types_1.CUSTOM_IMAGE_RUNTIME}`));
-    }
-    if (raw.imagePort !== undefined && raw.imagePort !== types_1.IMAGE_FUNCTION_PORT) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_PORT_INVALID, `镜像监听端口必须为 ${types_1.IMAGE_FUNCTION_PORT}`, `请让容器监听 ${types_1.IMAGE_FUNCTION_PORT} 端口`));
-    }
-    if (raw.handler !== undefined) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_HANDLER_NOT_ALLOWED, '镜像函数不支持 handler', '镜像函数由容器启动命令决定入口，请移除 handler'));
-    }
-    if (raw.installDependency !== undefined) {
-        checks.push(warn(types_1.FUNCTION_DEPLOY_ERROR.HTTP_ZIP_INSTALL_DEPENDENCY_OVERRIDDEN, '镜像函数忽略 installDependency', '依赖应在镜像构建阶段安装，该字段已被忽略'));
-    }
-}
-/** 校验镜像引用 */
-function checkImageReference(imageConfig, checks) {
-    const imageUri = imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.imageUri;
-    if (typeof imageUri !== 'string' || !imageUri.trim()) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_URI_INVALID, '缺少镜像地址', '请配置 imageConfig.imageUri'));
-        return;
-    }
-    const parsed = parseImageReference(imageUri);
-    if (!parsed) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_URI_INVALID, '镜像地址不合法', '格式应为 registry/namespace/repository:tag 或 ...@sha256:digest'));
-        return;
-    }
-    if (!parsed.tag && !parsed.digest) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TAG_MISSING, '镜像地址缺少版本标识', '请使用固定 tag 或 digest，保证部署可重试与可回滚'));
-        return;
-    }
-    if (parsed.tag === 'latest' && !parsed.digest) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TAG_LATEST_FORBIDDEN, '镜像地址禁止使用 latest', '请使用内容可追溯的不可变 tag 或 digest'));
-    }
-}
-/**
- * 校验镜像类型与仓库 ID
- * image 策略从 imageConfig.registryId（兼容顶层 registryId）读取；
- * local/cloud 策略从 build.registryId 读取，imageType 仍位于镜像运行时公共配置顶层。
- */
-function checkImageIdentity(raw, checks) {
-    var _a, _b, _c, _d, _e;
-    const imageConfig = raw === null || raw === void 0 ? void 0 : raw.imageConfig;
-    const buildRegistryId = (_a = raw === null || raw === void 0 ? void 0 : raw.build) === null || _a === void 0 ? void 0 : _a.registryId;
-    const buildStrategy = raw === null || raw === void 0 ? void 0 : raw.buildStrategy;
-    const defaultImageType = buildStrategy === 'cloud' || buildStrategy === 'local'
-        ? buildRegistryId
-            ? 'enterprise'
-            : 'personal'
-        : 'enterprise';
-    const imageType = (_c = (_b = raw === null || raw === void 0 ? void 0 : raw.imageType) !== null && _b !== void 0 ? _b : imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.imageType) !== null && _c !== void 0 ? _c : defaultImageType;
-    const registryId = (_e = (_d = raw === null || raw === void 0 ? void 0 : raw.registryId) !== null && _d !== void 0 ? _d : imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.registryId) !== null && _e !== void 0 ? _e : buildRegistryId;
-    if (imageType !== 'enterprise' && imageType !== 'personal') {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID, '镜像类型不合法', 'imageType 只能是 enterprise 或 personal'));
-        return;
-    }
-    if (imageType === 'enterprise') {
-        if (typeof registryId !== 'string' || !registryId.trim()) {
-            const remediation = buildStrategy === 'cloud' || buildStrategy === 'local'
-                ? '请配置 build.registryId'
-                : '请配置 registryId';
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_MISSING, '企业版镜像缺少仓库实例 ID', remediation));
-        }
-    }
-    else if (registryId !== undefined) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID, '个人版镜像不能配置企业版仓库实例 ID', '请移除 build.registryId，或将 imageType 设置为 enterprise'));
-    }
-}
-/** 校验镜像构建目标配置 */
-function checkBuildTarget(raw, checks) {
-    var _a, _b, _c;
-    const build = raw.build;
-    if (!lodash_1.default.isPlainObject(build)) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONFIG_MISSING, '缺少镜像构建配置', '请配置 build，至少包含构建上下文与 Dockerfile 信息'));
-        return;
-    }
-    if (raw.buildStrategy === 'cloud' && build.tag !== undefined) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_TAG_INVALID, 'cloud 策略不支持自定义镜像 tag', '请移除 build.tag，云端构建会统一使用平台生成的 CLOUDBASE_VERSION_NAME'));
-    }
-    if (build.cwd !== undefined && (typeof build.cwd !== 'string' || !build.cwd.trim())) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONTEXT_INVALID, '构建上下文目录不合法', 'build.cwd 需为非空字符串'));
-    }
-    const dockerfile = (_a = build.dockerfile) !== null && _a !== void 0 ? _a : types_1.DEFAULT_DOCKERFILE;
-    if (!isSafeRelativePath(dockerfile)) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_DOCKERFILE_INVALID, 'Dockerfile 路径不合法', '需为构建上下文内的相对路径，且不能包含 .. 或绝对路径'));
-    }
-    const platform = (_b = build.platform) !== null && _b !== void 0 ? _b : types_1.DEFAULT_IMAGE_PLATFORM;
-    if (platform !== types_1.DEFAULT_IMAGE_PLATFORM) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_PLATFORM_INVALID, `当前仅支持构建 ${types_1.DEFAULT_IMAGE_PLATFORM} 镜像`, `请移除 build.platform 或设置为 ${types_1.DEFAULT_IMAGE_PLATFORM}`));
-    }
-    if (build.tag !== undefined && raw.buildStrategy !== 'cloud') {
-        if (typeof build.tag !== 'string' || !IMAGE_TAG_PATTERN.test(build.tag)) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_TAG_INVALID, '镜像 tag 不合法'));
-        }
-        else if (build.tag === 'latest') {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TAG_LATEST_FORBIDDEN, '镜像 tag 禁止使用 latest', '请使用不可变 tag，或不指定 tag 由构建器按内容摘要生成'));
-        }
-    }
-    if (build.repository !== undefined) {
-        if (typeof build.repository !== 'string' ||
-            !IMAGE_REPOSITORY_PATTERN.test(build.repository)) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID, '镜像仓库名不合法', '只能包含小写字母、数字与 . _ - 分隔符'));
-        }
-    }
-    if (build.buildArgs !== undefined) {
-        if (!lodash_1.default.isPlainObject(build.buildArgs)) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_ARG_INVALID, '构建参数必须是对象'));
-        }
-        else {
-            Object.entries(build.buildArgs).forEach(([key, value]) => {
-                if (!ENV_KEY_PATTERN.test(key)) {
-                    checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_ARG_INVALID, `构建参数名不合法：${key}`));
-                }
-                if (typeof value !== 'string') {
-                    checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_ARG_INVALID, `构建参数 ${key} 的值必须是字符串`));
-                }
-                if (SENSITIVE_KEY_PATTERN.test(key)) {
-                    const message = `构建参数 ${key} 可能包含敏感信息`;
-                    const remediation = '构建参数会写入镜像构建记录，请改用运行时环境变量或密钥管理';
-                    checks.push(raw.buildStrategy === 'cloud'
-                        ? fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_ARG_INVALID, message, remediation)
-                        : warn(types_1.FUNCTION_DEPLOY_ERROR.BUILD_ARG_INVALID, message, remediation));
-                }
-            });
-        }
-    }
-    const registryCredential = build.registryCredential;
-    const imageType = (_c = raw.imageType) !== null && _c !== void 0 ? _c : (build.registryId ? 'enterprise' : 'personal');
-    if (raw.buildStrategy === 'cloud' && imageType === 'personal') {
-        if (typeof build.namespace !== 'string' ||
-            !build.namespace.trim() ||
-            !IMAGE_REPOSITORY_PATTERN.test(build.namespace.trim())) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID, '个人版 TCR 命名空间未配置或不合法', '请在 build.namespace 中显式声明，推荐使用 {{env.TCB_TCR_NAMESPACE}}'));
-        }
-        if (!lodash_1.default.isPlainObject(registryCredential)) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_MISSING, '个人版 TCR 云端构建缺少推送凭证', '请在 build.registryCredential 中显式声明 username/password，' +
-                '推荐使用 {{env.TCB_TCR_USERNAME}} 与 {{env.TCB_TCR_PASSWORD}}'));
-        }
-        else {
-            const username = registryCredential.username;
-            const password = registryCredential.password;
-            if (typeof username !== 'string' || !/^\d{5,20}$/.test(username.trim())) {
-                checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_INVALID, '个人版 TCR 登录用户名不合法', 'username 需为腾讯云账号 ID（UIN），推荐使用 {{env.TCB_TCR_USERNAME}}'));
-            }
-            if (typeof password !== 'string' || !password || password.length > 16 * 1024) {
-                checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_INVALID, '个人版 TCR 固定密码未配置或长度不合法', 'password 必须显式声明且不能为空，推荐使用 {{env.TCB_TCR_PASSWORD}}'));
-            }
-        }
-    }
-    else if (registryCredential !== undefined) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_INVALID, 'registryCredential 仅支持 cloud + personal 构建', '企业版使用 STS 临时凭证换取 token；local 构建使用本机 Docker 登录态'));
-    }
-    if (raw.imageConfig !== undefined) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_CONFIG_NOT_ALLOWED, `buildStrategy 为 ${raw.buildStrategy} 时不能指定 imageConfig`, '镜像地址将由构建结果决定，如需直接部署已有镜像请使用 buildStrategy: image'));
-    }
-}
-/**
- * 校验部署配置
- * @returns 检查报告，包含全部问题而非仅第一个
- */
-function checkDeployConfig(config) {
-    const checks = [];
-    if (!config || typeof config !== 'object') {
-        return {
-            scope: 'config',
-            ready: false,
-            checks: [
-                fail(types_1.FUNCTION_DEPLOY_ERROR.CONFIG_INVALID, '部署配置必须是对象', '请传入 IFunctionDeployConfig 对象')
-            ]
-        };
-    }
-    const raw = config;
-    checkCommonFields(raw, checks);
-    const isHttp = raw.type === 'HTTP';
-    let strategy = 'zip';
-    if (!isHttp) {
-        checkEventConfig(raw, checks);
-        checkCodeSource(raw, checks);
-    }
-    else {
-        strategy = inferHttpBuildStrategy(raw);
-        if (!HTTP_BUILD_STRATEGIES.includes(strategy)) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CONFIG_STRATEGY_INVALID, `不支持的 buildStrategy: ${strategy}`, `可选值为 ${HTTP_BUILD_STRATEGIES.join('、')}`));
-            return buildReport(checks, strategy);
-        }
-        checkHttpCommon(raw, checks);
-        if (strategy === 'zip') {
-            if (isCustomImageRuntime(raw.runtime)) {
-                checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.HTTP_ZIP_RUNTIME_INVALID, `代码包部署不支持 ${types_1.CUSTOM_IMAGE_RUNTIME} 运行时`, '请改用 buildStrategy 为 cloud、local 或 image'));
-            }
-            if (raw.imageConfig !== undefined) {
-                checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.HTTP_ZIP_IMAGE_CONFIG_CONFLICT, '代码包部署不能指定 imageConfig', '如需部署镜像，请设置 buildStrategy 为 image'));
-            }
-            const isNodejsRuntime = raw.runtime === undefined || String(raw.runtime).startsWith('Nodejs');
-            if (!isNodejsRuntime &&
-                raw.installDependency !== undefined &&
-                raw.installDependency !== false &&
-                raw.installDependency !== 'FALSE') {
-                checks.push(warn(types_1.FUNCTION_DEPLOY_ERROR.HTTP_ZIP_INSTALL_DEPENDENCY_OVERRIDDEN, 'HTTP 非 Node.js 代码包部署已强制关闭云端安装依赖', '请在本地安装运行依赖并将其一并打入代码包'));
-            }
-            checkCodeSource(raw, checks);
-        }
-        else {
-            checkImageRuntimeCommon(raw, checks);
-            if (strategy === 'image') {
-                if (!lodash_1.default.isPlainObject(raw.imageConfig)) {
-                    checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_CONFIG_MISSING, '缺少镜像配置', '请配置 imageConfig.imageUri 与 registryId'));
-                }
-                else {
-                    checkImageReference(raw.imageConfig, checks);
-                    // imageType 在顶层，registryId 允许顶层或 imageConfig，统一传 raw
-                    checkImageIdentity(raw, checks);
-                    // 注：imagePort 定义在顶层，已由 checkImageRuntimeCommon 校验，此处不重复
-                }
-            }
-            else {
-                checkImageIdentity(raw, checks);
-                checkBuildTarget(raw, checks);
-                if (strategy === 'local') {
-                    const fallback = raw.localFallback;
-                    if (fallback !== undefined && fallback !== 'cloud' && fallback !== 'error') {
-                        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.LOCAL_FALLBACK_INVALID, 'localFallback 取值不合法', "只能是 'cloud' 或 'error'"));
-                    }
-                }
-            }
-        }
-    }
-    return buildReport(checks, isHttp ? strategy : 'zip');
-}
-function buildReport(checks, strategy) {
-    const hasFail = checks.some(item => item.status === 'fail');
-    return {
-        scope: 'config',
-        strategy,
-        ready: !hasFail,
-        checks
-    };
-}
-/**
- * 校验并规范化部署配置
- * @throws CloudBaseError 存在任一 fail 项时抛出，错误信息包含全部失败原因
- */
-function assertDeployConfig(config) {
-    const report = checkDeployConfig(config);
-    if (!report.ready) {
-        const failures = report.checks.filter(item => item.status === 'fail');
-        const message = failures
-            .map(item => {
-            const remediation = item.remediation ? `，${item.remediation}` : '';
-            return `- [${item.id}] ${item.summary}${remediation}`;
-        })
-            .join('\n');
-        throw new error_1.CloudBaseError(`部署配置校验未通过：\n${message}`, {
-            code: failures[0].id
-        });
-    }
-    return normalizeDeployConfig(config);
-}