@cloudbase/manager-node 5.8.0-beta.0 → 5.8.0-beta.2

package/lib/deploy/DeployOrchestrator.js

@@ -158,7 +158,7 @@ class DeployOrchestrator {
             // （失败资源保留旧快照，下次 diff 仍会检测到差异）；快照写入失败不影响部署结果
             if (!dryRun) {
                 try {
-                    await this.persistState({ config, plan, results, cwd });
+                    await this.persistState({ config, plan, results, cwd, envId: options.envId });
                 }
                 catch (e) {
                     (_j = log === null || log === void 0 ? void 0 : log.warn) === null || _j === void 0 ? void 0 : _j.call(log, `状态快照写入失败：${(e === null || e === void 0 ? void 0 : e.message) || String(e)}`);
@@ -203,7 +203,7 @@ class DeployOrchestrator {
      */
     async persistState(options) {
         var _a, _b, _c, _d, _e, _f;
-        const { config, plan, results, cwd } = options;
+        const { config, plan, results, cwd, envId } = options;
         const stateStore = new StateStore_1.StateStore({ cwd });
         const prev = stateStore.read();
         // hosting
@@ -263,7 +263,7 @@ class DeployOrchestrator {
             resources.gateway = prev.resources.gateway;
         }
         if (Object.keys(resources).length) {
-            stateStore.write({ resources });
+            stateStore.write({ resources, envId });
         }
     }
     /**
@@ -291,7 +291,11 @@ class DeployOrchestrator {
         };
         // 本地 state 快照（diff 基准）：--refresh 时忽略本地 skip 判定
         const stateStore = new StateStore_1.StateStore({ cwd });
-        const state = refresh ? null : stateStore.read();
+        const rawState = refresh ? null : stateStore.read();
+        // 跨环境保护：快照记录的 envId 与目标环境不一致（或旧格式快照无 envId）时，
+        // 快照是其他环境部署后的指纹，不可作为 skip 依据 → 视为无快照，强制走全量部署，
+        // 避免切换环境后误判「产物未变更」导致新环境 COS 404
+        const state = rawState && rawState.envId === envId ? rawState : null;
         const planCtx = { config, envId, stateStore, state, refresh, cwd };
         for (const type of DEPLOY_ORDER) {
             if (!isEnabled(type))

package/lib/deploy/FunctionDeployer.js

@@ -199,9 +199,7 @@ class FunctionDeployer {
         const ctx = { steps: [], options };
         const warnings = [];
         const report = (0, config_guard_1.checkDeployConfig)(config);
-        report.checks
-            .filter(item => item.status === 'warn')
-            .forEach(item => warnings.push(`[${item.id}] ${item.summary}`));
+        this.appendWarnings(warnings, report);
         const normalized = await this.runStep(ctx, 'validate', async () => {
             return (0, config_guard_1.assertDeployConfig)(config);
         });
@@ -221,26 +219,20 @@ class FunctionDeployer {
         }
         // 不可原地更新的变更必须在任何可能产生副作用的 Preflight 之前中止。
         // 尤其避免镜像拉取授权自动补齐等云端写操作先发生，再提示用户手工删除函数。
-        this.assertPlanExecutable(normalized, plan);
+        this.assertPlanExecutable(plan);
         await this.runStep(ctx, 'preflight', async () => {
             const report = (0, preflight_1.runLocalPreflight)(normalized);
-            report.checks
-                .filter(item => item.status === 'warn')
-                .forEach(item => warnings.push(`[${item.id}] ${item.summary}`));
+            this.appendWarnings(warnings, report);
             this.assertPreflightReady(report);
         });
         await this.runStep(ctx, 'preflight', async () => {
             const report = await (0, cam_preflight_1.runImagePullAuthPreflight)(this.createCamPreflightAdapter(), normalized, options.autoGrant !== false);
-            report.checks
-                .filter(item => item.status === 'warn')
-                .forEach(item => warnings.push(`[${item.id}] ${item.summary}`));
+            this.appendWarnings(warnings, report);
             this.assertPreflightReady(report);
         });
         await this.runStep(ctx, 'preflight', async () => {
             const report = await (0, image_preflight_1.runImageRemotePreflight)(normalized, this.resolveDeployRegion(), this.imagePreflightDeps);
-            report.checks
-                .filter(item => item.status === 'warn')
-                .forEach(item => warnings.push(`[${item.id}] ${item.summary}`));
+            this.appendWarnings(warnings, report);
             this.assertPreflightReady(report);
         });
         // noop：函数本身无变更，但仍可能需要收敛访问配置
@@ -367,6 +359,15 @@ class FunctionDeployer {
         const code = (error === null || error === void 0 ? void 0 : error.code) || ((_b = (_a = error === null || error === void 0 ? void 0 : error.original) === null || _a === void 0 ? void 0 : _a.Error) === null || _b === void 0 ? void 0 : _b.Code) || '';
         return typeof code === 'string' && code.startsWith('ResourceNotFound');
     }
+    /** 将 warning 连同可执行修复建议汇入部署结果，避免授权链接在编排层丢失 */
+    appendWarnings(warnings, report) {
+        report.checks
+            .filter(item => item.status === 'warn')
+            .forEach(item => {
+            const remediation = item.remediation ? `，${item.remediation}` : '';
+            warnings.push(`[${item.id}] ${item.summary}${remediation}`);
+        });
+    }
     /**
      * 校验 Preflight 报告，存在 fail 项时聚合抛错
      */
@@ -390,16 +391,12 @@ class FunctionDeployer {
      *
      * 未实现的能力必须显式报错，避免用户误认为访问规则或镜像构建已经生效
      */
-    assertPlanExecutable(config, plan) {
+    assertPlanExecutable(plan) {
         if (plan.action === 'replace') {
             throw new error_1.CloudBaseError(`函数 ${plan.functionName} 存在无法原地更新的变更：\n` +
                 plan.replaceReasons.map(reason => `- ${reason}`).join('\n') +
                 '\n部署器不会自动删除已有云函数。请先在云开发控制台确认触发器、访问配置和服务中断影响，手工删除该函数后重新部署。', { code: types_1.FUNCTION_DEPLOY_ERROR.FUNCTION_RECREATE_REQUIRED });
         }
-        // local 个人版先行已支持；企业版 TCR 增强后置，暂未实现
-        if (config.buildStrategy === 'local' && config.imageType === 'enterprise') {
-            throw new error_1.CloudBaseError('local 策略的企业版 TCR 构建推送尚未实现，当前支持个人版镜像仓库（不指定 imageType 或 personal）', { code: types_1.FUNCTION_DEPLOY_ERROR.NOT_IMPLEMENTED });
-        }
     }
     /**
      * 准备部署物
@@ -427,9 +424,7 @@ class FunctionDeployer {
         if (config.buildStrategy === 'local') {
             await this.runStep(ctx, 'preflight', async () => {
                 const report = await (0, docker_preflight_1.runDockerPreflight)();
-                report.checks
-                    .filter(item => item.status === 'warn')
-                    .forEach(item => warnings.push(`[${item.id}] ${item.summary}`));
+                this.appendWarnings(warnings, report);
                 this.assertPreflightReady(report);
             });
             const localConfig = config;

package/lib/deploy/StateStore.js

@@ -78,6 +78,7 @@ class StateStore {
             version: 1,
             updatedAt: new Date().toISOString(),
             gitCommit: (_a = state.gitCommit) !== null && _a !== void 0 ? _a : this.resolveGitCommit(),
+            envId: state.envId,
             resources: state.resources
         };
         fs_1.default.writeFileSync(filePath, JSON.stringify(full, null, 2), 'utf8');

package/lib/deploy/function/artifact.js

@@ -33,10 +33,9 @@ function createImageArtifactFromConfig(config) {
     // imageType/registryId 的契约位置在配置顶层（IHttpImageRuntimeCommon），
     // 与 local/cloud 策略一致；imageConfig 内的同名字段仅作向后兼容兜底。
     // 个人版镜像（personal，如个人版 CCR）不应携带 registryId。
-    const imageType = (_b = (_a = config.imageType) !== null && _a !== void 0 ? _a : imageConfig.imageType) !== null && _b !== void 0 ? _b : 'enterprise';
-    const registryId = imageType === 'enterprise'
-        ? (_c = config.registryId) !== null && _c !== void 0 ? _c : imageConfig.registryId
-        : undefined;
+    const configuredRegistryId = (_a = config.registryId) !== null && _a !== void 0 ? _a : imageConfig.registryId;
+    const imageType = (_c = (_b = config.imageType) !== null && _b !== void 0 ? _b : imageConfig.imageType) !== null && _c !== void 0 ? _c : (configuredRegistryId ? 'enterprise' : 'personal');
+    const registryId = imageType === 'enterprise' ? configuredRegistryId : undefined;
     return {
         kind: 'image',
         deployMode: 'image',
@@ -60,14 +59,18 @@ function createImageArtifactFromConfig(config) {
  * 此处仅承载最终 imageUri/digest 与容器启动配置，之后复用镜像部署链。
  */
 function createImageArtifactFromBuild(config, build) {
-    var _a;
+    var _a, _b, _c;
+    const imageType = (_a = config.imageType) !== null && _a !== void 0 ? _a : (((_b = config.registryId) !== null && _b !== void 0 ? _b : config.build.registryId) ? 'enterprise' : 'personal');
+    const registryId = imageType === 'enterprise'
+        ? (_c = config.registryId) !== null && _c !== void 0 ? _c : config.build.registryId
+        : undefined;
     return {
         kind: 'image',
         deployMode: 'image',
         imageUri: build.imageUri,
         imageDigest: build.imageDigest,
-        // 个人版先行：local 构建统一按 personal 处理，企业版增强后置
-        imageType: (_a = config.imageType) !== null && _a !== void 0 ? _a : 'personal',
+        imageType,
+        registryId,
         imagePort: types_1.IMAGE_FUNCTION_PORT,
         effectiveStrategy: 'local',
         entryPoint: config.entryPoint,
@@ -112,11 +115,18 @@ function createImageArtifactFromCloudBuild(config, build) {
         containerImageAccelerate: config.containerImageAccelerate
     };
 }
+/** 将构建产出的 tag 地址与 digest 合成为 SCF 支持的不可变镜像引用 */
+function withImageDigest(imageUri, imageDigest) {
+    if (!imageDigest || imageUri.includes('@')) {
+        return imageUri;
+    }
+    return `${imageUri}@${imageDigest}`;
+}
 /** 将镜像部署物转换为 SCF 镜像配置 */
 function toFunctionImageConfig(artifact) {
     const imageConfig = {
         imageType: artifact.imageType,
-        imageUri: artifact.imageUri,
+        imageUri: withImageDigest(artifact.imageUri, artifact.imageDigest),
         imagePort: artifact.imagePort
     };
     if (artifact.registryId !== undefined) {
@@ -165,7 +175,22 @@ function toCloudFunction(config, artifact) {
         'role',
         'codeSecret',
         'l5',
-        'ignore'
+        'ignore',
+        // —— 高级配置：与 fn deploy 传统通道（configToParams 白名单）对齐，
+        //    字段名需与其大小写不敏感匹配规则一致，否则会被下游静默丢弃 ——
+        'tags',
+        'clsLogsetId',
+        'clsTopicId',
+        'deadLetterConfig',
+        'publicNetConfig',
+        'cfsConfig',
+        'intranetConfig',
+        'initTimeout',
+        'asyncRunEnable',
+        'traceEnable',
+        'autoDeployClsTopicIndex',
+        'autoCreateClsTopic',
+        'dnsCache'
     ];
     passthroughFields.forEach(field => {
         if (source[field] !== undefined) {

package/lib/deploy/function/builders/cloud.js

@@ -161,7 +161,8 @@ if [ -n "\${TCR_INSTANCE_ID:-}" ]; then
   TIMESTAMP=$(date +%s)
   DATE=$(date -u -d "@\${TIMESTAMP}" +"%Y-%m-%d" 2>/dev/null || date -u -r "\${TIMESTAMP}" +"%Y-%m-%d")
 
-  PAYLOAD=$(printf '{"RegistryId":"%s","TokenType":"LongTermToken"}' "\${TCR_INSTANCE_ID}")
+  # 构建阶段只需要一次 docker login/push，使用 1 小时临时凭证，避免创建长期凭证。
+  PAYLOAD=$(printf '{"RegistryId":"%s","TokenType":"temp"}' "\${TCR_INSTANCE_ID}")
   HASHED_PAYLOAD=$(printf '%s' "\${PAYLOAD}" | openssl dgst -sha256 -hex | awk '{print $NF}')
   CANONICAL_HEADERS="content-type:application/json; charset=utf-8\\nhost:\${HOST}\\nx-tc-action:$(echo "\${ACTION}" | tr '[:upper:]' '[:lower:]')\\n"
   SIGNED_HEADERS="content-type;host;x-tc-action"
@@ -189,7 +190,123 @@ if [ -n "\${TCR_INSTANCE_ID:-}" ]; then
     -H "X-TC-Token: \${API_TOKEN}" \\
     --data "\${PAYLOAD}")
 
-  ERROR_CODE=$(printf '%s' "\${RESP}" | jq -r '.Response.Error.Code // empty')
+  # CloudApp custom Runner 已提供 awk（上面的 TC3 签名也依赖它），但不保证安装 jq。
+  # 这里先限定顶层 Response 对象，再解析其中的非空 JSON 字符串字段；凭证字段
+  # 不允许 JSON 转义，避免用 sed/grep 对认证响应做宽松匹配。
+  extract_json_string() {
+    local field="$1"
+    printf '%s' "\${RESP}" | JSON_FIELD="\${field}" awk '
+      BEGIN {
+        field = ENVIRON["JSON_FIELD"]
+        quote = sprintf("%c", 34)
+        backslash = sprintf("%c", 92)
+        json = ""
+      }
+      { json = json $0 }
+      END {
+        response_needle = quote "Response" quote "[[:space:]]*:[[:space:]]*\\{"
+        if (!match(json, response_needle)) exit 1
+        response_start = RSTART + RLENGTH - 1
+        response = ""
+        depth = 0
+        in_string = 0
+        escaped = 0
+        for (i = response_start; i <= length(json); i++) {
+          ch = substr(json, i, 1)
+          response = response ch
+          if (in_string) {
+            if (escaped) escaped = 0
+            else if (ch == backslash) escaped = 1
+            else if (ch == quote) in_string = 0
+            continue
+          }
+          if (ch == quote) in_string = 1
+          else if (ch == "{") depth++
+          else if (ch == "}") {
+            depth--
+            if (depth == 0) break
+          }
+        }
+        if (depth != 0) exit 1
+
+        depth = 1
+        for (i = 2; i < length(response); i++) {
+          ch = substr(response, i, 1)
+          if (ch == "{") depth++
+          else if (ch == "}") depth--
+          else if (ch == quote) {
+            key = ""
+            escaped = 0
+            for (j = i + 1; j <= length(response); j++) {
+              current = substr(response, j, 1)
+              if (escaped) {
+                escaped = 0
+                key = key current
+              } else if (current == backslash) {
+                escaped = 1
+                key = key current
+              } else if (current == quote) break
+              else key = key current
+            }
+            if (j > length(response)) exit 1
+            k = j + 1
+            while (substr(response, k, 1) ~ /[[:space:]]/) k++
+            if (depth == 1 && substr(response, k, 1) == ":" && key == field) {
+              k++
+              while (substr(response, k, 1) ~ /[[:space:]]/) k++
+              if (substr(response, k, 1) != quote) exit 1
+              value = ""
+              for (k = k + 1; k <= length(response); k++) {
+                current = substr(response, k, 1)
+                if (current == quote) {
+                  if (length(value) == 0) exit 1
+                  printf "%s", value
+                  exit 0
+                }
+                if (current == backslash) exit 2
+                value = value current
+              }
+              exit 1
+            }
+            i = j
+          }
+        }
+        exit 1
+      }
+    '
+  }
+
+  extract_tcr_error_code() {
+    printf '%s' "\${RESP}" | awk '
+      BEGIN {
+        quote = sprintf("%c", 34)
+        json = ""
+      }
+      { json = json $0 }
+      END {
+        error_needle = quote "Error" quote "[[:space:]]*:[[:space:]]*\\{"
+        if (!match(json, error_needle)) exit 1
+        error_json = substr(json, RSTART + RLENGTH)
+        code_needle = quote "Code" quote "[[:space:]]*:[[:space:]]*" quote
+        if (!match(error_json, code_needle)) exit 1
+        rest = substr(error_json, RSTART + RLENGTH)
+        value = ""
+        for (i = 1; i <= length(rest); i++) {
+          ch = substr(rest, i, 1)
+          if (ch == quote) {
+            if (length(value) == 0) exit 1
+            printf "%s", value
+            exit 0
+          }
+          if (ch == backslash) exit 1
+          value = value ch
+        }
+        exit 1
+      }
+    '
+  }
+
+  ERROR_CODE=$(extract_tcr_error_code || true)
   if [ -n "\${ERROR_CODE}" ]; then
     case "\${ERROR_CODE}" in
       AuthFailure*|UnauthorizedOperation*|FailedOperation.NoPermission*)
@@ -207,8 +324,16 @@ if [ -n "\${TCR_INSTANCE_ID:-}" ]; then
     esac
   fi
 
-  TOKEN_USER=$(printf '%s' "\${RESP}" | jq -er '.Response.Username')
-  TOKEN_PASS=$(printf '%s' "\${RESP}" | jq -er '.Response.Token')
+  if ! TOKEN_USER=$(extract_json_string "Username"); then
+    ERROR_CODE=$(extract_tcr_error_code || true)
+    echo "CreateInstanceToken 未返回有效 Username\${ERROR_CODE:+，错误码：\${ERROR_CODE}}" >&2
+    exit ${TCR_REGISTRY_AUTH_EXIT_CODE}
+  fi
+  if ! TOKEN_PASS=$(extract_json_string "Token"); then
+    ERROR_CODE=$(extract_tcr_error_code || true)
+    echo "CreateInstanceToken 未返回有效 Token\${ERROR_CODE:+，错误码：\${ERROR_CODE}}" >&2
+    exit ${TCR_REGISTRY_AUTH_EXIT_CODE}
+  fi
 
   printf '%s' "\${TOKEN_PASS}" | docker login -u "\${TOKEN_USER}" --password-stdin "\${TCR_REGISTRY}"
 else

package/lib/deploy/function/cam-preflight.js

@@ -1,31 +1,36 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IMAGE_PULL_GRANT_URL = exports.REQUIRED_IMAGE_PULL_POLICY = exports.SCF_PULL_IMAGE_ROLE = void 0;
+exports.TCR_PUSH_GRANT_URL = exports.IMAGE_PULL_GRANT_URL = exports.REQUIRED_TCR_PUSH_POLICY = exports.TCB_PUSH_ENTERPRISE_IMAGE_ROLE = exports.REQUIRED_IMAGE_PULL_POLICY = exports.SCF_PULL_IMAGE_ROLE = void 0;
 exports.isCamPermissionError = isCamPermissionError;
 exports.runImagePullAuthPreflight = runImagePullAuthPreflight;
 const types_1 = require("../types");
 /**
- * 镜像拉取授权 Preflight（涉及 CAM，scope: cloud）
+ * 镜像仓库授权 Preflight（涉及 CAM，scope: cloud）
  *
- * SCF 拉取镜像由服务角色 SCF_QcsRole 代理，个人版镜像要求该角色绑定
- * QcloudAccessForSCFRoleInPullImage 策略。本模块在 image 策略部署前：
- *   1. 探测该角色与策略是否就绪；
- *   2. 缺失且允许时，自动绑定「唯一白名单策略」补齐（绝不放大到其它策略）；
- *   3. 当前身份无 CAM 权限时不硬失败，降级为结构化指引 + 一键授权链接兜底。
+ * 镜像部署涉及两个职责不同的服务角色：
+ * - SCF_QcsRole：SCF 从个人版或企业版 TCR 拉取镜像；
+ * - TCB_QcsRole：CloudApp 云端构建向企业版 TCR 推送镜像。
  *
- * 安全边界（对应 security_rules 的 AuthZ / 最小权限）：
- * - 自动授权只允许绑定 REQUIRED_IMAGE_PULL_POLICY 这一条部署必需的预置策略；
- * - 不代用户创建角色、不绑定任何白名单外策略；
- * - 探测/授权失败一律走降级，不阻断到无法给出可操作指引。
+ * 本模块在部署前探测所需角色与策略；缺失且允许时，只自动绑定各场景明确列入
+ * 白名单的预置策略；当前身份无 CAM 权限时，则返回结构化指引和一键授权链接。
+ * 模块不会创建角色，也不会绑定白名单之外的策略。
  */
 /** SCF 拉取镜像使用的服务角色 */
 exports.SCF_PULL_IMAGE_ROLE = 'SCF_QcsRole';
-/** 拉取个人版镜像所需的唯一预置策略（自动授权白名单，仅此一条） */
+/** SCF 拉取个人版或企业版 TCR 镜像所需的预置策略 */
 exports.REQUIRED_IMAGE_PULL_POLICY = 'QcloudAccessForSCFRoleInPullImage';
-/** 官方一键授权链接，作为无 CAM 权限时的兜底指引 */
+/** CloudApp 云端构建向企业版 TCR 推送镜像使用的服务角色 */
+exports.TCB_PUSH_ENTERPRISE_IMAGE_ROLE = 'TCB_QcsRole';
+/** CloudApp 云端构建向企业版 TCR 推送镜像所需的预置策略 */
+exports.REQUIRED_TCR_PUSH_POLICY = 'QcloudAccessForTCBRoleInTCR';
+/** SCF 拉取镜像的一键授权链接 */
 exports.IMAGE_PULL_GRANT_URL = 'https://console.cloud.tencent.com/cam/role/grant' +
     `?roleName=${exports.SCF_PULL_IMAGE_ROLE}&policyName=${exports.REQUIRED_IMAGE_PULL_POLICY}` +
     '&principal=eyJzZXJ2aWNlIjoic2NmLnFjbG91ZC5jb20ifQ%3D%3D';
+/** 企业版 TCR 云端构建推送的一键授权链接 */
+exports.TCR_PUSH_GRANT_URL = 'https://console.cloud.tencent.com/cam/role/grant' +
+    `?roleName=${exports.TCB_PUSH_ENTERPRISE_IMAGE_ROLE}&policyName=${exports.REQUIRED_TCR_PUSH_POLICY}` +
+    '&principal=eyJzZXJ2aWNlIjoidGNiLmNsb3VkLnRlbmNlbnQuY29tIn0%3D';
 /** 判断错误是否为 CAM 权限不足 */
 function isCamPermissionError(error) {
     const code = typeof (error === null || error === void 0 ? void 0 : error.code) === 'string' ? error.code : '';
@@ -60,98 +65,109 @@ function buildReport(checks) {
         checks
     };
 }
-/** 是否需要执行镜像拉取授权检查 */
+/** image/local/cloud 最终都需要 SCF 从镜像仓库拉取镜像 */
 function needsImagePullAuth(config) {
-    var _a;
-    if (config.type !== 'HTTP') {
-        return false;
-    }
-    // image：已有个人版镜像；local：本地构建推送的也是个人版镜像，SCF 拉取同样需要该授权
-    if (config.buildStrategy === 'image') {
-        // 联合类型已按 buildStrategy 收窄为 INormalizedHttpImageConfig，可直接访问顶层与 imageConfig 字段
-        const imageType = ((_a = config.imageConfig) === null || _a === void 0 ? void 0 : _a.imageType) || config.imageType;
-        return imageType === 'personal';
+    return (config.type === 'HTTP' &&
+        (config.buildStrategy === 'image' ||
+            config.buildStrategy === 'local' ||
+            config.buildStrategy === 'cloud'));
+}
+/** 只有企业版 cloud 策略需要 CloudApp 向企业版 TCR 推送镜像 */
+function needsEnterpriseTcrPushAuth(config) {
+    return (config.type === 'HTTP' &&
+        config.buildStrategy === 'cloud' &&
+        config.imageType === 'enterprise');
+}
+function resolveRequirements(config) {
+    const requirements = [];
+    if (needsImagePullAuth(config)) {
+        requirements.push({
+            roleName: exports.SCF_PULL_IMAGE_ROLE,
+            policyName: exports.REQUIRED_IMAGE_PULL_POLICY,
+            purpose: 'SCF 拉取 TCR 镜像',
+            grantUrl: exports.IMAGE_PULL_GRANT_URL,
+            roleMissingCode: types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IMAGE_PULL_ROLE_MISSING,
+            policyMissingCode: types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IMAGE_PULL_POLICY_MISSING,
+            grantedCode: types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IMAGE_PULL_AUTH_GRANTED,
+            unverifiableCode: types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IMAGE_PULL_AUTH_UNVERIFIABLE
+        });
     }
-    if (config.buildStrategy === 'local' || config.buildStrategy === 'cloud') {
-        // local/cloud 个人版先行：构建推送的默认是个人版镜像，SCF 拉取同样需要该授权；
-        // 未显式指定 imageType 时视为 personal；企业版另行处理
-        const imageType = config.imageType;
-        return imageType === undefined || imageType === 'personal';
+    if (needsEnterpriseTcrPushAuth(config)) {
+        requirements.push({
+            roleName: exports.TCB_PUSH_ENTERPRISE_IMAGE_ROLE,
+            policyName: exports.REQUIRED_TCR_PUSH_POLICY,
+            purpose: 'CloudApp 云端构建推送企业版 TCR 镜像',
+            grantUrl: exports.TCR_PUSH_GRANT_URL,
+            roleMissingCode: types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_TCR_PUSH_ROLE_MISSING,
+            policyMissingCode: types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_TCR_PUSH_POLICY_MISSING,
+            grantedCode: types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_TCR_PUSH_AUTH_GRANTED,
+            unverifiableCode: types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_TCR_PUSH_AUTH_UNVERIFIABLE
+        });
     }
-    return false;
+    return requirements;
 }
-/** 无 CAM 读权限时的降级检查项：无法自查，转手动指引 */
-function unverifiableCheck() {
-    return warn(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IMAGE_PULL_AUTH_UNVERIFIABLE, `当前身份无 CAM 权限，无法自动校验或补齐 ${exports.SCF_PULL_IMAGE_ROLE} 的拉镜像授权`, `若个人版镜像拉取失败，请用具备 CAM 权限的账号访问一键授权链接完成授权：${exports.IMAGE_PULL_GRANT_URL}`);
+function unverifiableCheck(requirement) {
+    return warn(requirement.unverifiableCode, `当前身份无 CAM 权限，无法自动校验或补齐 ${requirement.roleName} 的${requirement.purpose}授权`, `若部署失败，请用具备 CAM 权限的账号访问一键授权链接完成授权：${requirement.grantUrl}`);
 }
-/**
- * 执行镜像拉取授权 Preflight
- *
- * @param service CAM 能力适配（无则视为无法校验，直接降级为提示）
- * @param config 规范化部署配置
- * @param autoGrant 是否允许自动补齐授权（默认 true）
- * @returns scope 为 cloud 的检查报告，聚合全部结论
- */
-async function runImagePullAuthPreflight(service, config, autoGrant = true) {
-    if (!needsImagePullAuth(config)) {
-        return buildReport([]);
-    }
-    // 无 CAM 适配能力：不阻断，仅提示手动授权入口
+async function checkRequirement(service, requirement, autoGrant) {
     if (!service) {
-        return buildReport([unverifiableCheck()]);
+        return unverifiableCheck(requirement);
     }
-    const checks = [];
     let roleDetail;
     try {
-        roleDetail = await service.getRoleWithPolicies(exports.SCF_PULL_IMAGE_ROLE);
+        roleDetail = await service.getRoleWithPolicies(requirement.roleName);
     }
     catch (error) {
         if (isCamPermissionError(error)) {
-            // 无 CAM 读权限，无法自查，降级为提示（warn，不阻断部署尝试）
-            return buildReport([unverifiableCheck()]);
+            return unverifiableCheck(requirement);
         }
         if (isRoleNotFoundError(error)) {
-            // 角色不存在属于真实前置缺失，不自动创建角色，给出可操作指引
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IMAGE_PULL_ROLE_MISSING, `缺少服务角色 ${exports.SCF_PULL_IMAGE_ROLE}`, {
-                remediation: `请访问一键授权链接创建角色并授予拉镜像策略：${exports.IMAGE_PULL_GRANT_URL}`
-            }));
-            return buildReport(checks);
+            return fail(requirement.roleMissingCode, `缺少服务角色 ${requirement.roleName}`, {
+                remediation: `请访问一键授权链接创建角色并授予 ${requirement.policyName}：${requirement.grantUrl}`
+            });
         }
-        // 其它未知错误同样降级为提示，避免因 CAM 波动阻断部署
-        return buildReport([unverifiableCheck()]);
+        return unverifiableCheck(requirement);
     }
     const attached = roleDetail.attachedPolicyNames || [];
-    if (attached.includes(exports.REQUIRED_IMAGE_PULL_POLICY)) {
-        checks.push(pass(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IMAGE_PULL_POLICY_MISSING, `${exports.SCF_PULL_IMAGE_ROLE} 已具备拉镜像策略 ${exports.REQUIRED_IMAGE_PULL_POLICY}`));
-        return buildReport(checks);
+    if (attached.includes(requirement.policyName)) {
+        return pass(requirement.policyMissingCode, `${requirement.roleName} 已具备${requirement.purpose}策略 ${requirement.policyName}`);
     }
-    // 未绑定拉镜像策略
     if (!autoGrant) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IMAGE_PULL_POLICY_MISSING, `${exports.SCF_PULL_IMAGE_ROLE} 缺少拉镜像策略 ${exports.REQUIRED_IMAGE_PULL_POLICY}`, {
-            remediation: `已关闭自动授权（autoGrant=false）。请访问一键授权链接手动授予：${exports.IMAGE_PULL_GRANT_URL}`
-        }));
-        return buildReport(checks);
+        return fail(requirement.policyMissingCode, `${requirement.roleName} 缺少${requirement.purpose}策略 ${requirement.policyName}`, {
+            remediation: `已关闭自动授权（autoGrant=false）。请访问一键授权链接手动授予：${requirement.grantUrl}`
+        });
     }
-    // 自动授权：只绑定唯一白名单策略
     try {
-        await service.attachPolicyByName(exports.SCF_PULL_IMAGE_ROLE, exports.REQUIRED_IMAGE_PULL_POLICY);
-        checks.push(pass(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IMAGE_PULL_AUTH_GRANTED, `已自动为 ${exports.SCF_PULL_IMAGE_ROLE} 绑定拉镜像策略 ${exports.REQUIRED_IMAGE_PULL_POLICY}`));
-        return buildReport(checks);
+        await service.attachPolicyByName(requirement.roleName, requirement.policyName);
+        return pass(requirement.grantedCode, `已自动为 ${requirement.roleName} 绑定${requirement.purpose}策略 ${requirement.policyName}`);
     }
     catch (error) {
         if (isCamPermissionError(error)) {
-            // 无 CAM 写权限：不硬失败，降级为可操作指引 + 兜底链接
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_CAM_PERMISSION_DENIED, `当前身份无 CAM 授权权限，无法自动为 ${exports.SCF_PULL_IMAGE_ROLE} 补齐拉镜像策略`, {
-                remediation: `请用具备 CAM 权限的账号（如主账号）访问一键授权链接完成授权：${exports.IMAGE_PULL_GRANT_URL}`,
+            return fail(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_CAM_PERMISSION_DENIED, `当前身份无 CAM 授权权限，无法自动为 ${requirement.roleName} 补齐${requirement.purpose}策略`, {
+                remediation: `请用具备 CAM 权限的账号（如主账号）访问一键授权链接完成授权：${requirement.grantUrl}`,
                 detail: error === null || error === void 0 ? void 0 : error.message
-            }));
-            return buildReport(checks);
+            });
         }
-        // 其它授权错误同样给出结构化失败与指引
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.PREFLIGHT_IMAGE_PULL_POLICY_MISSING, `自动绑定拉镜像策略 ${exports.REQUIRED_IMAGE_PULL_POLICY} 失败`, {
-            remediation: `请访问一键授权链接手动授予：${exports.IMAGE_PULL_GRANT_URL}`,
+        return fail(requirement.policyMissingCode, `自动绑定策略 ${requirement.policyName} 失败`, {
+            remediation: `请访问一键授权链接手动授予：${requirement.grantUrl}`,
             detail: error === null || error === void 0 ? void 0 : error.message
-        }));
-        return buildReport(checks);
+        });
+    }
+}
+/**
+ * 执行镜像仓库授权 Preflight。
+ *
+ * 企业版 cloud 策略会同时检查 SCF 拉取权限和 TCB 云端构建推送权限；
+ * 其他镜像策略只检查与自身相关的授权，不会额外要求 TCB 推送权限。
+ */
+async function runImagePullAuthPreflight(service, config, autoGrant = true) {
+    const requirements = resolveRequirements(config);
+    if (requirements.length === 0) {
+        return buildReport([]);
+    }
+    const checks = [];
+    for (const requirement of requirements) {
+        checks.push(await checkRequirement(service, requirement, autoGrant));
     }
+    return buildReport(checks);
 }