@cloudbase/manager-node 5.7.1-beta.1 → 5.8.0-beta.0

package/lib/deploy/function/preflight.js

@@ -0,0 +1,329 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runLocalPreflight = runLocalPreflight;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const packer_1 = require("../../function/packer");
+const types_1 = require("../types");
+/**
+ * 部署前环境检查（Preflight）
+ *
+ * 与 config-guard 的区别：config-guard 是纯函数、无 IO 的配置契约校验；
+ * 本文件执行有 IO 的本地检查，覆盖 HTTP 代码包条件以及 cloud 镜像构建上下文。
+ *
+ * 本阶段只读文件系统，不执行命令、不访问网络，不检查 Docker、TCR 或 CAM。
+ */
+/** HTTP 代码包函数要求的启动文件 */
+const SCF_BOOTSTRAP = 'scf_bootstrap';
+/** 可执行位掩码（owner/group/other 任一可执行即可） */
+const EXECUTABLE_MASK = 0o111;
+/** 解压前代码包大小阈值，复用底层上传阈值，超过给出告警 */
+const PACKAGE_SIZE_WARN_THRESHOLD = packer_1.BIG_FILE_SIZE;
+/** 遍历目录项数量上限，超过则停止统计，避免超大目录阻塞检查 */
+const MAX_SCAN_ENTRIES = 20000;
+/** 遍历目录深度上限，避免异常深层结构阻塞检查 */
+const MAX_SCAN_DEPTH = 64;
+function fail(id, summary, options = {}) {
+    return { id, status: 'fail', summary, remediation: options.remediation, detail: options.detail };
+}
+function warn(id, summary, remediation) {
+    return { id, status: 'warn', summary, remediation };
+}
+/** 构造本地 Preflight 报告 */
+function buildReport(strategy, checks) {
+    return {
+        scope: 'local',
+        strategy,
+        ready: !checks.some(item => item.status === 'fail'),
+        checks
+    };
+}
+/**
+ * 解析 HTTP zip 部署的函数目录
+ *
+ * functionPath 直接指向函数目录；functionRootPath 是父目录，需拼接函数名；
+ * base64Code 已是内存中的 ZIP，无本地目录可检查
+ * @returns 函数目录绝对路径；base64Code 或无法定位时返回 null
+ */
+function resolveFunctionDir(config) {
+    if (typeof config.functionPath === 'string' && config.functionPath.trim()) {
+        return path_1.default.resolve(config.functionPath);
+    }
+    if (typeof config.functionRootPath === 'string' && config.functionRootPath.trim()) {
+        return path_1.default.resolve(config.functionRootPath, config.name);
+    }
+    return null;
+}
+/** 安全获取文件状态，不存在返回 null，其它 IO 错误抛出 */
+function safeStat(target) {
+    try {
+        return fs_1.default.statSync(target);
+    }
+    catch (error) {
+        if (error && error.code === 'ENOENT') {
+            return null;
+        }
+        throw error;
+    }
+}
+/** 检查 cloud 构建上下文与 Dockerfile，确保任何云端操作前即可失败 */
+function checkCloudBuildSource(config, checks) {
+    const cwd = path_1.default.resolve(config.build.cwd || config.functionPath || process.cwd());
+    const contextStat = safeStat(cwd);
+    if (contextStat === null) {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONTEXT_INVALID, '云端镜像构建上下文目录不存在', {
+            remediation: '请确认 build.cwd 或函数目录指向真实存在的构建上下文',
+            detail: `期望路径：${cwd}`
+        }));
+        return;
+    }
+    if (!contextStat.isDirectory()) {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONTEXT_INVALID, '云端镜像构建上下文不是目录', {
+            remediation: 'build.cwd 需指向包含 Dockerfile 和函数源码的目录',
+            detail: `路径：${cwd}`
+        }));
+        return;
+    }
+    const dockerfile = config.build.dockerfile || types_1.DEFAULT_DOCKERFILE;
+    const dockerfilePath = path_1.default.resolve(cwd, dockerfile);
+    const dockerfileStat = safeStat(dockerfilePath);
+    if (dockerfileStat === null || !dockerfileStat.isFile()) {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_BUILD_DOCKERFILE_MISSING, `云端镜像构建缺少有效的 Dockerfile：${dockerfilePath}`, {
+            remediation: '请在构建上下文中创建 Dockerfile，或通过 build.dockerfile 指定实际文件',
+            detail: `期望路径：${dockerfilePath}`
+        }));
+    }
+}
+/** 检查函数目录下的 scf_bootstrap 启动文件 */
+function checkBootstrap(functionDir, checks) {
+    const bootstrapPath = path_1.default.join(functionDir, SCF_BOOTSTRAP);
+    const stat = safeStat(bootstrapPath);
+    if (stat === null) {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_BOOTSTRAP_MISSING, `HTTP 代码包缺少启动文件 ${SCF_BOOTSTRAP}`, {
+            remediation: `请在函数目录下提供可执行的 ${SCF_BOOTSTRAP}，用于启动监听端口的 HTTP 服务`,
+            detail: `期望路径：${bootstrapPath}`
+        }));
+        return;
+    }
+    if (!stat.isFile()) {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_BOOTSTRAP_NOT_FILE, `${SCF_BOOTSTRAP} 不是普通文件`, {
+            remediation: `请确保 ${SCF_BOOTSTRAP} 是一个文件而非目录或链接`,
+            detail: `路径：${bootstrapPath}`
+        }));
+        return;
+    }
+    // 仅 POSIX 有可执行位，Windows 无该概念，跳过可执行位判断
+    if (process.platform !== 'win32' && (stat.mode & EXECUTABLE_MASK) === 0) {
+        checks.push(warn(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_BOOTSTRAP_NOT_EXECUTABLE, `${SCF_BOOTSTRAP} 缺少可执行权限`, `建议执行 chmod +x ${SCF_BOOTSTRAP}，否则运行环境可能无法启动服务`));
+    }
+}
+/** 判断 target 解析后是否逃逸出根目录 */
+function isPathEscaped(root, target) {
+    const relative = path_1.default.relative(root, target);
+    // 空串表示与根相同；以 .. 开头或为绝对路径表示逃逸
+    return relative === '..' || relative.startsWith(`..${path_1.default.sep}`) || path_1.default.isAbsolute(relative);
+}
+/**
+ * 遍历函数目录，统计总大小并检测逃逸软链接
+ *
+ * 使用 lstat 不跟随链接；对软链接单独解析目标，判断是否指向根目录之外。
+ * 设深度与数量上限，避免异常目录结构阻塞检查。
+ */
+function scanPackageContents(functionDir) {
+    const result = { totalSize: 0, escapedLinks: [], truncated: false };
+    let visited = 0;
+    // 根目录也解析为真实路径，避免 /var→/private/var 这类平台软链接导致内部链接被误判逃逸
+    let realRoot;
+    try {
+        realRoot = fs_1.default.realpathSync(functionDir);
+    }
+    catch (_a) {
+        realRoot = functionDir;
+    }
+    const walk = (dir, depth) => {
+        if (result.truncated || depth > MAX_SCAN_DEPTH) {
+            return;
+        }
+        const entries = fs_1.default.readdirSync(dir);
+        for (const entry of entries) {
+            if (visited >= MAX_SCAN_ENTRIES) {
+                result.truncated = true;
+                return;
+            }
+            visited += 1;
+            const fullPath = path_1.default.join(dir, entry);
+            const stat = fs_1.default.lstatSync(fullPath);
+            if (stat.isSymbolicLink()) {
+                // 解析链接目标，判断是否逃逸出函数目录
+                let realTarget;
+                try {
+                    realTarget = fs_1.default.realpathSync(fullPath);
+                }
+                catch (_a) {
+                    // 断链（指向不存在的目标）视为逃逸风险，记录相对路径
+                    result.escapedLinks.push(path_1.default.relative(functionDir, fullPath));
+                    continue;
+                }
+                if (isPathEscaped(realRoot, realTarget)) {
+                    result.escapedLinks.push(path_1.default.relative(functionDir, fullPath));
+                }
+                continue;
+            }
+            if (stat.isDirectory()) {
+                walk(fullPath, depth + 1);
+                if (result.truncated) {
+                    return;
+                }
+                continue;
+            }
+            if (stat.isFile()) {
+                result.totalSize += stat.size;
+            }
+        }
+    };
+    walk(functionDir, 0);
+    return result;
+}
+/** 检查 Node.js 依赖是否随代码包携带 */
+function checkNodeDependencyBundled(functionDir, checks) {
+    const pkgPath = path_1.default.join(functionDir, 'package.json');
+    const pkgStat = safeStat(pkgPath);
+    if (pkgStat === null || !pkgStat.isFile()) {
+        return;
+    }
+    let hasDependencies = false;
+    try {
+        const pkg = JSON.parse(fs_1.default.readFileSync(pkgPath, 'utf8'));
+        const deps = pkg && typeof pkg === 'object' ? pkg.dependencies : undefined;
+        hasDependencies = !!deps && typeof deps === 'object' && Object.keys(deps).length > 0;
+    }
+    catch (_a) {
+        // package.json 无法解析属于用户代码问题，不在本检查职责内
+        return;
+    }
+    if (!hasDependencies) {
+        return;
+    }
+    const nodeModulesStat = safeStat(path_1.default.join(functionDir, 'node_modules'));
+    if (nodeModulesStat === null || !nodeModulesStat.isDirectory()) {
+        checks.push(warn(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_DEPENDENCY_NOT_BUNDLED, 'package.json 声明了依赖但未发现 node_modules', '当前配置不会在云端安装依赖，请先安装依赖并随代码包上传'));
+    }
+}
+const PYTHON_DEPENDENCY_FILES = [
+    'requirements.txt',
+    'pyproject.toml',
+    'poetry.lock',
+    'Pipfile',
+    'Pipfile.lock',
+    'uv.lock'
+];
+/**
+ * 检查 Python 代码包是否包含依赖清单
+ *
+ * pip install -t . 不会留下统一可靠的 vendor 标记，且依赖还可能由 Layer 提供，
+ * 因此这里只做保守告警，提醒用户确认依赖已经进入最终代码目录。
+ */
+function checkPythonDependencyBundled(functionDir, checks) {
+    const manifests = PYTHON_DEPENDENCY_FILES.filter(file => {
+        const stat = safeStat(path_1.default.join(functionDir, file));
+        return (stat === null || stat === void 0 ? void 0 : stat.isFile()) === true;
+    });
+    if (manifests.length === 0) {
+        return;
+    }
+    checks.push(warn(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_DEPENDENCY_NOT_BUNDLED, `发现 Python 依赖清单（${manifests.join('、')}），请确认依赖已随代码包携带`, 'HTTP 代码包部署不会执行 pip；请在兼容的 Linux 环境中使用 pip install -r requirements.txt -t <最终代码目录>，或确认依赖由 Layer 提供'));
+}
+/** 检查包大小与软链接逃逸 */
+function checkPackageContents(functionDir, checks) {
+    const scan = scanPackageContents(functionDir);
+    for (const link of scan.escapedLinks) {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_SYMLINK_ESCAPE, '代码目录包含逃逸到目录之外的软链接', {
+            remediation: '请移除指向函数目录之外的符号链接，避免打包引入非预期或敏感文件',
+            detail: `软链接：${link}`
+        }));
+    }
+    if (!scan.truncated && scan.totalSize > PACKAGE_SIZE_WARN_THRESHOLD) {
+        const sizeMb = (scan.totalSize / 1024 / 1024).toFixed(2);
+        const limitMb = (PACKAGE_SIZE_WARN_THRESHOLD / 1024 / 1024).toFixed(0);
+        checks.push(warn(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_PACKAGE_TOO_LARGE, `代码包体积约 ${sizeMb} MB，超过 ${limitMb} MB`, '较大的代码包会拖慢上传与冷启动，建议清理无关文件或依赖'));
+    }
+}
+/**
+ * 执行部署前本地检查
+ *
+ * HTTP zip 策略检查代码包条件；HTTP cloud 策略检查构建上下文和 Dockerfile。
+ * base64Code 来源无本地目录，跳过文件检查。
+ * @returns 本地检查报告，聚合全部问题
+ */
+function runLocalPreflight(config) {
+    const strategy = config.buildStrategy;
+    if (config.type !== 'HTTP') {
+        return buildReport(strategy, []);
+    }
+    if (strategy === 'cloud') {
+        const checks = [];
+        try {
+            checkCloudBuildSource(config, checks);
+        }
+        catch (error) {
+            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IO_ERROR, '读取云端镜像构建上下文时发生 IO 错误', {
+                remediation: '请检查目录权限与磁盘状态后重试',
+                detail: error instanceof Error ? error.message : String(error)
+            }));
+        }
+        return buildReport(strategy, checks);
+    }
+    if (strategy !== 'zip') {
+        return buildReport(strategy, []);
+    }
+    // 收窄到 zip 子类型后可直接访问代码来源字段（base64Code/functionPath/functionRootPath）
+    const source = config;
+    // base64Code 已是内存 ZIP，无本地目录可查
+    if (typeof source.base64Code === 'string' && source.base64Code.trim()) {
+        return buildReport(strategy, []);
+    }
+    const checks = [];
+    try {
+        const functionDir = resolveFunctionDir(source);
+        if (functionDir === null) {
+            // 代码来源缺失属于配置契约问题，已由 config-guard 覆盖，此处不重复报错
+            return buildReport(strategy, checks);
+        }
+        const dirStat = safeStat(functionDir);
+        if (dirStat === null) {
+            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_CODE_PATH_MISSING, '代码目录不存在', {
+                remediation: '请确认 functionPath 或 functionRootPath 指向真实存在的目录',
+                detail: `期望路径：${functionDir}`
+            }));
+            return buildReport(strategy, checks);
+        }
+        if (!dirStat.isDirectory()) {
+            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_CODE_PATH_NOT_DIRECTORY, '代码路径不是目录', {
+                remediation: '代码来源需指向目录，而非文件',
+                detail: `路径：${functionDir}`
+            }));
+            return buildReport(strategy, checks);
+        }
+        checkBootstrap(functionDir, checks);
+        checkPackageContents(functionDir, checks);
+        const runtime = source.runtime === undefined ? 'Nodejs' : String(source.runtime);
+        if (runtime.startsWith('Nodejs')) {
+            if (source.installDependency === false) {
+                checkNodeDependencyBundled(functionDir, checks);
+            }
+        }
+        else if (runtime.startsWith('Python')) {
+            checkPythonDependencyBundled(functionDir, checks);
+        }
+    }
+    catch (error) {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IO_ERROR, '读取代码目录时发生 IO 错误', {
+            remediation: '请检查目录权限与磁盘状态后重试',
+            detail: error instanceof Error ? error.message : String(error)
+        }));
+    }
+    return buildReport(strategy, checks);
+}

package/lib/deploy/types.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FUNCTION_DEPLOY_ERROR = exports.CUSTOM_IMAGE_RUNTIME = exports.DEFAULT_DOCKERFILE = exports.DEFAULT_IMAGE_PLATFORM = exports.IMAGE_FUNCTION_PORT = void 0;
+/**
+ * 镜像 HTTP 函数固定监听端口
+ * SCF HTTP 自定义镜像函数要求容器监听 9000
+ */
+exports.IMAGE_FUNCTION_PORT = 9000;
+/**
+ * 镜像构建默认目标平台
+ * SCF 运行环境为 linux/amd64，Apple Silicon 也必须显式构建该平台
+ */
+exports.DEFAULT_IMAGE_PLATFORM = 'linux/amd64';
+/** 默认 Dockerfile 名称，相对于构建上下文 */
+exports.DEFAULT_DOCKERFILE = 'Dockerfile';
+/** 自定义镜像运行时标识 */
+exports.CUSTOM_IMAGE_RUNTIME = 'CustomImage';
+/** 函数部署错误码 */
+exports.FUNCTION_DEPLOY_ERROR = {
+    CONFIG_INVALID: 'CONFIG_INVALID',
+    CONFIG_NAME_INVALID: 'CONFIG_NAME_INVALID',
+    CONFIG_TYPE_INVALID: 'CONFIG_TYPE_INVALID',
+    CONFIG_STRATEGY_INVALID: 'CONFIG_STRATEGY_INVALID',
+    CONFIG_TIMEOUT_INVALID: 'CONFIG_TIMEOUT_INVALID',
+    CONFIG_MEMORY_SIZE_INVALID: 'CONFIG_MEMORY_SIZE_INVALID',
+    CONFIG_ENV_VARIABLE_INVALID: 'CONFIG_ENV_VARIABLE_INVALID',
+    EVENT_IMAGE_NOT_SUPPORTED: 'EVENT_IMAGE_NOT_SUPPORTED',
+    EVENT_GATEWAY_NOT_SUPPORTED: 'EVENT_GATEWAY_NOT_SUPPORTED',
+    EVENT_HTTP_FIELD_NOT_SUPPORTED: 'EVENT_HTTP_FIELD_NOT_SUPPORTED',
+    HTTP_ZIP_RUNTIME_INVALID: 'HTTP_ZIP_RUNTIME_INVALID',
+    HTTP_ZIP_IMAGE_CONFIG_CONFLICT: 'HTTP_ZIP_IMAGE_CONFIG_CONFLICT',
+    HTTP_ZIP_INSTALL_DEPENDENCY_OVERRIDDEN: 'HTTP_ZIP_INSTALL_DEPENDENCY_OVERRIDDEN',
+    HTTP_TRIGGER_NOT_SUPPORTED: 'HTTP_TRIGGER_NOT_SUPPORTED',
+    HTTP_CONCURRENCY_INVALID: 'HTTP_CONCURRENCY_INVALID',
+    HTTP_PROTOCOL_PARAMS_INVALID: 'HTTP_PROTOCOL_PARAMS_INVALID',
+    CODE_SOURCE_MISSING: 'CODE_SOURCE_MISSING',
+    CODE_SOURCE_CONFLICT: 'CODE_SOURCE_CONFLICT',
+    IMAGE_CONFIG_MISSING: 'IMAGE_CONFIG_MISSING',
+    IMAGE_CONFIG_NOT_ALLOWED: 'IMAGE_CONFIG_NOT_ALLOWED',
+    IMAGE_URI_INVALID: 'IMAGE_URI_INVALID',
+    IMAGE_TAG_MISSING: 'IMAGE_TAG_MISSING',
+    IMAGE_TAG_LATEST_FORBIDDEN: 'IMAGE_TAG_LATEST_FORBIDDEN',
+    IMAGE_TYPE_INVALID: 'IMAGE_TYPE_INVALID',
+    IMAGE_REGISTRY_ID_MISSING: 'IMAGE_REGISTRY_ID_MISSING',
+    IMAGE_REGISTRY_ID_INVALID: 'IMAGE_REGISTRY_ID_INVALID',
+    IMAGE_PORT_INVALID: 'IMAGE_PORT_INVALID',
+    IMAGE_RUNTIME_INVALID: 'IMAGE_RUNTIME_INVALID',
+    IMAGE_HANDLER_NOT_ALLOWED: 'IMAGE_HANDLER_NOT_ALLOWED',
+    BUILD_CONFIG_MISSING: 'BUILD_CONFIG_MISSING',
+    BUILD_DOCKERFILE_INVALID: 'BUILD_DOCKERFILE_INVALID',
+    BUILD_CONTEXT_INVALID: 'BUILD_CONTEXT_INVALID',
+    BUILD_PLATFORM_INVALID: 'BUILD_PLATFORM_INVALID',
+    BUILD_TAG_INVALID: 'BUILD_TAG_INVALID',
+    BUILD_REPOSITORY_INVALID: 'BUILD_REPOSITORY_INVALID',
+    BUILD_ARG_INVALID: 'BUILD_ARG_INVALID',
+    CLOUD_REGISTRY_CREDENTIAL_MISSING: 'CLOUD_REGISTRY_CREDENTIAL_MISSING',
+    CLOUD_REGISTRY_CREDENTIAL_INVALID: 'CLOUD_REGISTRY_CREDENTIAL_INVALID',
+    GATEWAY_PATH_INVALID: 'GATEWAY_PATH_INVALID',
+    LOCAL_FALLBACK_INVALID: 'LOCAL_FALLBACK_INVALID',
+    // Preflight（有 IO 的本地检查）
+    PREFLIGHT_CODE_PATH_MISSING: 'PREFLIGHT_CODE_PATH_MISSING',
+    PREFLIGHT_CODE_PATH_NOT_DIRECTORY: 'PREFLIGHT_CODE_PATH_NOT_DIRECTORY',
+    PREFLIGHT_BOOTSTRAP_MISSING: 'PREFLIGHT_BOOTSTRAP_MISSING',
+    PREFLIGHT_BOOTSTRAP_NOT_FILE: 'PREFLIGHT_BOOTSTRAP_NOT_FILE',
+    PREFLIGHT_BOOTSTRAP_NOT_EXECUTABLE: 'PREFLIGHT_BOOTSTRAP_NOT_EXECUTABLE',
+    PREFLIGHT_PACKAGE_TOO_LARGE: 'PREFLIGHT_PACKAGE_TOO_LARGE',
+    PREFLIGHT_SYMLINK_ESCAPE: 'PREFLIGHT_SYMLINK_ESCAPE',
+    PREFLIGHT_DEPENDENCY_NOT_BUNDLED: 'PREFLIGHT_DEPENDENCY_NOT_BUNDLED',
+    PREFLIGHT_IO_ERROR: 'PREFLIGHT_IO_ERROR',
+    // Docker 本地能力 Preflight（local 策略，scope: local）
+    PREFLIGHT_DOCKER_CLI_MISSING: 'PREFLIGHT_DOCKER_CLI_MISSING',
+    PREFLIGHT_DOCKER_DAEMON_UNAVAILABLE: 'PREFLIGHT_DOCKER_DAEMON_UNAVAILABLE',
+    PREFLIGHT_DOCKER_BUILDX_MISSING: 'PREFLIGHT_DOCKER_BUILDX_MISSING',
+    // 本地构建与推送（local 策略）
+    LOCAL_BUILD_CONTEXT_MISSING: 'LOCAL_BUILD_CONTEXT_MISSING',
+    LOCAL_BUILD_DOCKERFILE_MISSING: 'LOCAL_BUILD_DOCKERFILE_MISSING',
+    LOCAL_BUILD_REPOSITORY_MISSING: 'LOCAL_BUILD_REPOSITORY_MISSING',
+    LOCAL_BUILD_FAILED: 'LOCAL_BUILD_FAILED',
+    LOCAL_PUSH_FAILED: 'LOCAL_PUSH_FAILED',
+    LOCAL_DIGEST_QUERY_FAILED: 'LOCAL_DIGEST_QUERY_FAILED',
+    // 云端构建（cloud 策略，CloudApp custom）
+    CLOUD_BUILD_DOCKERFILE_MISSING: 'CLOUD_BUILD_DOCKERFILE_MISSING',
+    CLOUD_UPLOAD_FAILED: 'CLOUD_UPLOAD_FAILED',
+    CLOUD_BUILD_TRIGGER_FAILED: 'CLOUD_BUILD_TRIGGER_FAILED',
+    CLOUD_BUILD_FAILED: 'CLOUD_BUILD_FAILED',
+    CLOUD_REGISTRY_AUTH_FAILED: 'CLOUD_REGISTRY_AUTH_FAILED',
+    CLOUD_PERSONAL_REGISTRY_REPOSITORY_QUOTA_EXCEEDED: 'CLOUD_PERSONAL_REGISTRY_REPOSITORY_QUOTA_EXCEEDED',
+    CLOUD_BUILD_CANCELED: 'CLOUD_BUILD_CANCELED',
+    CLOUD_BUILD_TIMEOUT: 'CLOUD_BUILD_TIMEOUT',
+    // 镜像远端校验 Preflight（有 IO，scope: cloud）
+    PREFLIGHT_IMAGE_REMOTE_NOT_FOUND: 'PREFLIGHT_IMAGE_REMOTE_NOT_FOUND',
+    PREFLIGHT_IMAGE_REMOTE_UNVERIFIABLE: 'PREFLIGHT_IMAGE_REMOTE_UNVERIFIABLE',
+    PREFLIGHT_IMAGE_DIGEST_UNRESOLVED: 'PREFLIGHT_IMAGE_DIGEST_UNRESOLVED',
+    PREFLIGHT_IMAGE_REGION_MISMATCH: 'PREFLIGHT_IMAGE_REGION_MISMATCH',
+    // 镜像拉取授权 Preflight（涉及 CAM，scope: cloud）
+    PREFLIGHT_IMAGE_PULL_ROLE_MISSING: 'PREFLIGHT_IMAGE_PULL_ROLE_MISSING',
+    PREFLIGHT_IMAGE_PULL_POLICY_MISSING: 'PREFLIGHT_IMAGE_PULL_POLICY_MISSING',
+    PREFLIGHT_IMAGE_PULL_AUTH_GRANTED: 'PREFLIGHT_IMAGE_PULL_AUTH_GRANTED',
+    PREFLIGHT_IMAGE_PULL_AUTH_UNVERIFIABLE: 'PREFLIGHT_IMAGE_PULL_AUTH_UNVERIFIABLE',
+    PREFLIGHT_CAM_PERMISSION_DENIED: 'PREFLIGHT_CAM_PERMISSION_DENIED',
+    FUNCTION_RECREATE_REQUIRED: 'FUNCTION_RECREATE_REQUIRED',
+    NOT_IMPLEMENTED: 'NOT_IMPLEMENTED'
+};

package/lib/env/index.js

@@ -28,7 +28,6 @@ class EnvService {
         this.tcbService = new utils_1.CloudService(environment.cloudBaseContext, 'tcb', '2018-06-08');
         this.commonService = environment.getCommonService('lowcode', '2021-01-08');
         this.billingService = new billing_1.BillingService(environment.cloudBaseContext);
-        this.certificateCloudService = new utils_1.CloudService(environment.cloudBaseContext, 'ssl', '2019-12-05');
         this.tokenCache = new Map();
     }
     /**
@@ -770,23 +769,6 @@ class EnvService {
     async describeCreditsUsageDetail(params) {
         return this.cloudService.request('DescribeCreditsUsageDetail', Object.assign({}, params));
     }
-    /**
-     * 获取当前凭证有权限访问的 SSL 证书列表。
-     *
-     * 证书用于自定义域名 HTTPS 配置，本接口不依赖 CloudBase 环境信息。
-     * @param {DescribeCertificatesParams} params 查询参数
-     * @returns {Promise<DescribeCertificatesRes>}
-     */
-    async describeCertificates(params = {}) {
-        if (params.Offset !== undefined && (!Number.isInteger(params.Offset) || params.Offset < 0)) {
-            throw new error_1.CloudBaseError('Offset 必须是大于等于 0 的整数');
-        }
-        if (params.Limit !== undefined &&
-            (!Number.isInteger(params.Limit) || params.Limit < 1 || params.Limit > 1000)) {
-            throw new error_1.CloudBaseError('Limit 必须是 1 至 1000 的整数');
-        }
-        return this.certificateCloudService.request('DescribeCertificates', params);
-    }
     /**
      * 查询HTTP访问服务域名路由信息
      * @param {DescribeHttpServiceRouteParams} params 查询参数
@@ -795,15 +777,6 @@ class EnvService {
     async describeHttpServiceRoute(params) {
         return this.cloudService.request('DescribeHTTPServiceRoute', Object.assign({}, params));
     }
-    /**
-     * 校验HTTP访问服务域名路由
-     * 此操作为只读预检，不会创建任何资源。
-     * @param {VerifyHttpServiceRouteParams} params 校验参数
-     * @returns {Promise<VerifyHttpServiceRouteRes>}
-     */
-    async verifyHttpServiceRoute(params) {
-        return this.cloudService.request('VerifyHTTPServiceRoute', Object.assign({}, params));
-    }
     /**
      * 创建HTTP访问服务域名路由
      * @param {CreateHttpServiceRouteParams} params 创建参数

package/lib/environment.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Environment = void 0;
 const database_1 = require("./database");
 const function_1 = require("./function");
+const FunctionDeployer_1 = require("./deploy/FunctionDeployer");
 const cloudrun_1 = require("./cloudrun");
 const agent_1 = require("./agent");
 const storage_1 = require("./storage");
@@ -83,6 +84,16 @@ class Environment {
     getFunctionService() {
         return this.functionService;
     }
+    /**
+     * 获取函数部署编排器
+     * 采用懒初始化，避免模块循环引用导致的初始化顺序问题
+     */
+    getFunctionDeployer() {
+        if (!this.functionDeployer) {
+            this.functionDeployer = new FunctionDeployer_1.FunctionDeployer(this);
+        }
+        return this.functionDeployer;
+    }
     getCloudRunService() {
         return this.cloudRunService;
     }

package/lib/function/index.js

@@ -334,7 +334,7 @@ class FunctionService {
         // ENABLE_TCBF 开启时，runtime 适配 tcb 风格
         if (this.useTcbFunctionApi) {
             if (!func.runtime) {
-                params.Runtime = 'Nodejs24.14';
+                params.Runtime = 'Node.js 24.14';
             }
         }
         const customCode = code;

package/lib/hosting/index.js

@@ -364,7 +364,7 @@ class HostingService {
      * @param options
      */
     async setWebsiteDocument(options) {
-        const { indexDocument, errorDocument, routingRules } = options;
+        const { indexDocument, errorDocument, originalHttpStatus, charity404, autoAddressing, routingRules } = options;
         const hosting = await this.checkStatus();
         const { Bucket, Regoin } = hosting;
         const storageService = await this.environment.getStorageService();
@@ -373,6 +373,9 @@ class HostingService {
             region: Regoin,
             indexDocument,
             errorDocument,
+            originalHttpStatus,
+            charity404,
+            autoAddressing,
             routingRules
         });
         return res;

package/lib/index.js

@@ -2,6 +2,8 @@
 const context_1 = require("./context");
 const environmentManager_1 = require("./environmentManager");
 const docs_1 = require("./docs");
+const projectValidator_1 = require("./projectValidator");
+const DeployOrchestrator_1 = require("./deploy/DeployOrchestrator");
 class CloudBase {
     /**
      * init 初始化 为单例
@@ -49,6 +51,13 @@ class CloudBase {
     get functions() {
         return this.currentEnvironment().getFunctionService();
     }
+    /**
+     * 函数部署编排器（FunctionDeployer）
+     * 在现有 FunctionService 之上，按 buildStrategy 编排 Event/HTTP 函数的创建、更新与访问收敛
+     */
+    get functionDeployer() {
+        return this.currentEnvironment().getFunctionDeployer();
+    }
     get cloudrun() {
         return this.currentEnvironment().getCloudRunService();
     }
@@ -146,6 +155,28 @@ class CloudBase {
         }
         return this.docsService;
     }
+    get projectValidator() {
+        if (!this.projectValidatorService) {
+            this.projectValidatorService = new projectValidator_1.ProjectValidator();
+        }
+        return this.projectValidatorService;
+    }
+    getProjectValidator() {
+        return this.projectValidator;
+    }
+    /**
+     * 声明式部署编排器
+     * 顺序：database → functions → app → hosting → gateway；支持 dry-run / only / skip / 幂等重试
+     */
+    get deployOrchestrator() {
+        if (!this.deployOrchestratorService) {
+            this.deployOrchestratorService = new DeployOrchestrator_1.DeployOrchestrator(this.currentEnvironment());
+        }
+        return this.deployOrchestratorService;
+    }
+    getDeployOrchestrator() {
+        return this.deployOrchestrator;
+    }
     getEnvironmentManager() {
         return this.environmentManager;
     }