@cloudbase/manager-node 5.8.0-beta.1 → 5.8.0-beta.2

package/lib/deploy/DeployOrchestrator.js

@@ -158,7 +158,7 @@ class DeployOrchestrator {
             // （失败资源保留旧快照，下次 diff 仍会检测到差异）；快照写入失败不影响部署结果
             if (!dryRun) {
                 try {
-                    await this.persistState({ config, plan, results, cwd });
+                    await this.persistState({ config, plan, results, cwd, envId: options.envId });
                 }
                 catch (e) {
                     (_j = log === null || log === void 0 ? void 0 : log.warn) === null || _j === void 0 ? void 0 : _j.call(log, `状态快照写入失败：${(e === null || e === void 0 ? void 0 : e.message) || String(e)}`);
@@ -203,7 +203,7 @@ class DeployOrchestrator {
      */
     async persistState(options) {
         var _a, _b, _c, _d, _e, _f;
-        const { config, plan, results, cwd } = options;
+        const { config, plan, results, cwd, envId } = options;
         const stateStore = new StateStore_1.StateStore({ cwd });
         const prev = stateStore.read();
         // hosting
@@ -263,7 +263,7 @@ class DeployOrchestrator {
             resources.gateway = prev.resources.gateway;
         }
         if (Object.keys(resources).length) {
-            stateStore.write({ resources });
+            stateStore.write({ resources, envId });
         }
     }
     /**
@@ -291,7 +291,11 @@ class DeployOrchestrator {
         };
         // 本地 state 快照（diff 基准）：--refresh 时忽略本地 skip 判定
         const stateStore = new StateStore_1.StateStore({ cwd });
-        const state = refresh ? null : stateStore.read();
+        const rawState = refresh ? null : stateStore.read();
+        // 跨环境保护：快照记录的 envId 与目标环境不一致（或旧格式快照无 envId）时，
+        // 快照是其他环境部署后的指纹，不可作为 skip 依据 → 视为无快照，强制走全量部署，
+        // 避免切换环境后误判「产物未变更」导致新环境 COS 404
+        const state = rawState && rawState.envId === envId ? rawState : null;
         const planCtx = { config, envId, stateStore, state, refresh, cwd };
         for (const type of DEPLOY_ORDER) {
             if (!isEnabled(type))

package/lib/deploy/StateStore.js

@@ -78,6 +78,7 @@ class StateStore {
             version: 1,
             updatedAt: new Date().toISOString(),
             gitCommit: (_a = state.gitCommit) !== null && _a !== void 0 ? _a : this.resolveGitCommit(),
+            envId: state.envId,
             resources: state.resources
         };
         fs_1.default.writeFileSync(filePath, JSON.stringify(full, null, 2), 'utf8');

package/lib/deploy/function/artifact.js

@@ -33,10 +33,9 @@ function createImageArtifactFromConfig(config) {
     // imageType/registryId 的契约位置在配置顶层（IHttpImageRuntimeCommon），
     // 与 local/cloud 策略一致；imageConfig 内的同名字段仅作向后兼容兜底。
     // 个人版镜像（personal，如个人版 CCR）不应携带 registryId。
-    const imageType = (_b = (_a = config.imageType) !== null && _a !== void 0 ? _a : imageConfig.imageType) !== null && _b !== void 0 ? _b : 'enterprise';
-    const registryId = imageType === 'enterprise'
-        ? (_c = config.registryId) !== null && _c !== void 0 ? _c : imageConfig.registryId
-        : undefined;
+    const configuredRegistryId = (_a = config.registryId) !== null && _a !== void 0 ? _a : imageConfig.registryId;
+    const imageType = (_c = (_b = config.imageType) !== null && _b !== void 0 ? _b : imageConfig.imageType) !== null && _c !== void 0 ? _c : (configuredRegistryId ? 'enterprise' : 'personal');
+    const registryId = imageType === 'enterprise' ? configuredRegistryId : undefined;
     return {
         kind: 'image',
         deployMode: 'image',
@@ -60,14 +59,18 @@ function createImageArtifactFromConfig(config) {
  * 此处仅承载最终 imageUri/digest 与容器启动配置，之后复用镜像部署链。
  */
 function createImageArtifactFromBuild(config, build) {
-    var _a;
+    var _a, _b, _c;
+    const imageType = (_a = config.imageType) !== null && _a !== void 0 ? _a : (((_b = config.registryId) !== null && _b !== void 0 ? _b : config.build.registryId) ? 'enterprise' : 'personal');
+    const registryId = imageType === 'enterprise'
+        ? (_c = config.registryId) !== null && _c !== void 0 ? _c : config.build.registryId
+        : undefined;
     return {
         kind: 'image',
         deployMode: 'image',
         imageUri: build.imageUri,
         imageDigest: build.imageDigest,
-        // 个人版先行：local 构建统一按 personal 处理，企业版增强后置
-        imageType: (_a = config.imageType) !== null && _a !== void 0 ? _a : 'personal',
+        imageType,
+        registryId,
         imagePort: types_1.IMAGE_FUNCTION_PORT,
         effectiveStrategy: 'local',
         entryPoint: config.entryPoint,
@@ -172,7 +175,22 @@ function toCloudFunction(config, artifact) {
         'role',
         'codeSecret',
         'l5',
-        'ignore'
+        'ignore',
+        // —— 高级配置：与 fn deploy 传统通道（configToParams 白名单）对齐，
+        //    字段名需与其大小写不敏感匹配规则一致，否则会被下游静默丢弃 ——
+        'tags',
+        'clsLogsetId',
+        'clsTopicId',
+        'deadLetterConfig',
+        'publicNetConfig',
+        'cfsConfig',
+        'intranetConfig',
+        'initTimeout',
+        'asyncRunEnable',
+        'traceEnable',
+        'autoDeployClsTopicIndex',
+        'autoCreateClsTopic',
+        'dnsCache'
     ];
     passthroughFields.forEach(field => {
         if (source[field] !== undefined) {

package/lib/deploy/function/config-guard.js

@@ -182,7 +182,7 @@ function inferHttpBuildStrategy(config) {
  * 以便 checkDeployConfig 汇总全部问题
  */
 function normalizeDeployConfig(config) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q;
     if (!config || typeof config !== 'object') {
         throw new error_1.CloudBaseError('部署配置必须是对象', {
             code: types_1.FUNCTION_DEPLOY_ERROR.CONFIG_INVALID
@@ -211,19 +211,19 @@ function normalizeDeployConfig(config) {
             ignore: ignoreList.filter((item) => !/node_modules/.test(item)) });
     }
     const normalizedImage = Object.assign(Object.assign({}, cloned), { type: 'HTTP', buildStrategy, runtime: types_1.CUSTOM_IMAGE_RUNTIME, imagePort: (_a = cloned.imagePort) !== null && _a !== void 0 ? _a : types_1.IMAGE_FUNCTION_PORT });
-    if (buildStrategy === 'cloud' || buildStrategy === 'local') {
-        normalizedImage.imageType =
-            (_b = cloned.imageType) !== null && _b !== void 0 ? _b : (((_c = cloned.build) === null || _c === void 0 ? void 0 : _c.registryId) ? 'enterprise' : 'personal');
-    }
+    normalizedImage.imageType =
+        (_d = (_b = cloned.imageType) !== null && _b !== void 0 ? _b : (_c = cloned.imageConfig) === null || _c === void 0 ? void 0 : _c.imageType) !== null && _d !== void 0 ? _d : (((_g = (_e = cloned.registryId) !== null && _e !== void 0 ? _e : (_f = cloned.imageConfig) === null || _f === void 0 ? void 0 : _f.registryId) !== null && _g !== void 0 ? _g : (_h = cloned.build) === null || _h === void 0 ? void 0 : _h.registryId)
+            ? 'enterprise'
+            : 'personal');
     // 镜像函数由容器启动命令决定入口，不使用 handler 与云端装依赖
     delete normalizedImage.handler;
     delete normalizedImage.installDependency;
     if (buildStrategy === 'cloud' || buildStrategy === 'local') {
-        normalizedImage.build = Object.assign(Object.assign({}, (cloned.build || {})), { dockerfile: (_e = (_d = cloned.build) === null || _d === void 0 ? void 0 : _d.dockerfile) !== null && _e !== void 0 ? _e : types_1.DEFAULT_DOCKERFILE, platform: (_g = (_f = cloned.build) === null || _f === void 0 ? void 0 : _f.platform) !== null && _g !== void 0 ? _g : types_1.DEFAULT_IMAGE_PLATFORM, repository: (_j = (_h = cloned.build) === null || _h === void 0 ? void 0 : _h.repository) !== null && _j !== void 0 ? _j : cloned.name });
+        normalizedImage.build = Object.assign(Object.assign({}, (cloned.build || {})), { dockerfile: (_k = (_j = cloned.build) === null || _j === void 0 ? void 0 : _j.dockerfile) !== null && _k !== void 0 ? _k : types_1.DEFAULT_DOCKERFILE, platform: (_m = (_l = cloned.build) === null || _l === void 0 ? void 0 : _l.platform) !== null && _m !== void 0 ? _m : types_1.DEFAULT_IMAGE_PLATFORM, repository: (_p = (_o = cloned.build) === null || _o === void 0 ? void 0 : _o.repository) !== null && _p !== void 0 ? _p : cloned.name });
     }
     if (buildStrategy === 'local') {
         // 默认不静默改变构建环境
-        normalizedImage.localFallback = (_k = cloned.localFallback) !== null && _k !== void 0 ? _k : 'error';
+        normalizedImage.localFallback = (_q = cloned.localFallback) !== null && _q !== void 0 ? _q : 'error';
     }
     return normalizedImage;
 }
@@ -377,13 +377,9 @@ function checkImageIdentity(raw, checks) {
     const imageConfig = raw === null || raw === void 0 ? void 0 : raw.imageConfig;
     const buildRegistryId = (_a = raw === null || raw === void 0 ? void 0 : raw.build) === null || _a === void 0 ? void 0 : _a.registryId;
     const buildStrategy = raw === null || raw === void 0 ? void 0 : raw.buildStrategy;
-    const defaultImageType = buildStrategy === 'cloud' || buildStrategy === 'local'
-        ? buildRegistryId
-            ? 'enterprise'
-            : 'personal'
-        : 'enterprise';
-    const imageType = (_c = (_b = raw === null || raw === void 0 ? void 0 : raw.imageType) !== null && _b !== void 0 ? _b : imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.imageType) !== null && _c !== void 0 ? _c : defaultImageType;
-    const registryId = (_e = (_d = raw === null || raw === void 0 ? void 0 : raw.registryId) !== null && _d !== void 0 ? _d : imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.registryId) !== null && _e !== void 0 ? _e : buildRegistryId;
+    const registryId = (_c = (_b = raw === null || raw === void 0 ? void 0 : raw.registryId) !== null && _b !== void 0 ? _b : imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.registryId) !== null && _c !== void 0 ? _c : buildRegistryId;
+    const defaultImageType = registryId ? 'enterprise' : 'personal';
+    const imageType = (_e = (_d = raw === null || raw === void 0 ? void 0 : raw.imageType) !== null && _d !== void 0 ? _d : imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.imageType) !== null && _e !== void 0 ? _e : defaultImageType;
     if (imageType !== 'enterprise' && imageType !== 'personal') {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID, '镜像类型不合法', 'imageType 只能是 enterprise 或 personal'));
         return;
@@ -403,17 +399,34 @@ function checkImageIdentity(raw, checks) {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID, '个人版镜像不能配置企业版仓库实例 ID', '请移除 build.registryId，或将 imageType 设置为 enterprise'));
     }
 }
-/** 校验镜像构建目标配置 */
-function checkBuildTarget(raw, checks) {
-    var _a, _b, _c;
-    const build = raw.build;
-    if (!lodash_1.default.isPlainObject(build)) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONFIG_MISSING, '缺少镜像构建配置', '请配置 build，至少包含构建上下文与 Dockerfile 信息'));
-        return;
+/** 解析构建策略使用的镜像类型 */
+function resolveBuildImageType(raw, build) {
+    var _a, _b, _c, _d, _e, _f;
+    return (_c = (_a = raw.imageType) !== null && _a !== void 0 ? _a : (_b = raw.imageConfig) === null || _b === void 0 ? void 0 : _b.imageType) !== null && _c !== void 0 ? _c : (((_f = (_d = raw.registryId) !== null && _d !== void 0 ? _d : (_e = raw.imageConfig) === null || _e === void 0 ? void 0 : _e.registryId) !== null && _f !== void 0 ? _f : build.registryId) ? 'enterprise' : 'personal');
+}
+/** 校验构建 tag */
+function checkBuildTag(raw, build) {
+    if (build.tag === undefined) {
+        return [];
     }
-    if (raw.buildStrategy === 'cloud' && build.tag !== undefined) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_TAG_INVALID, 'cloud 策略不支持自定义镜像 tag', '请移除 build.tag，云端构建会统一使用平台生成的 CLOUDBASE_VERSION_NAME'));
+    if (raw.buildStrategy === 'cloud') {
+        return [
+            fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_TAG_INVALID, 'cloud 策略不支持自定义镜像 tag', '请移除 build.tag，云端构建会统一使用平台生成的 CLOUDBASE_VERSION_NAME')
+        ];
     }
+    if (typeof build.tag !== 'string' || !IMAGE_TAG_PATTERN.test(build.tag)) {
+        return [fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_TAG_INVALID, '镜像 tag 不合法')];
+    }
+    if (build.tag === 'latest') {
+        return [
+            fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TAG_LATEST_FORBIDDEN, '镜像 tag 禁止使用 latest', '请使用不可变 tag，或不指定 tag 由构建器生成时间戳 tag')
+        ];
+    }
+    return [];
+}
+/** 校验构建上下文、Dockerfile 与目标平台 */
+function checkBuildSource(build, checks) {
+    var _a, _b;
     if (build.cwd !== undefined && (typeof build.cwd !== 'string' || !build.cwd.trim())) {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONTEXT_INVALID, '构建上下文目录不合法', 'build.cwd 需为非空字符串'));
     }
@@ -425,68 +438,123 @@ function checkBuildTarget(raw, checks) {
     if (platform !== types_1.DEFAULT_IMAGE_PLATFORM) {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_PLATFORM_INVALID, `当前仅支持构建 ${types_1.DEFAULT_IMAGE_PLATFORM} 镜像`, `请移除 build.platform 或设置为 ${types_1.DEFAULT_IMAGE_PLATFORM}`));
     }
-    if (build.tag !== undefined && raw.buildStrategy !== 'cloud') {
-        if (typeof build.tag !== 'string' || !IMAGE_TAG_PATTERN.test(build.tag)) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_TAG_INVALID, '镜像 tag 不合法'));
-        }
-        else if (build.tag === 'latest') {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TAG_LATEST_FORBIDDEN, '镜像 tag 禁止使用 latest', '请使用不可变 tag，或不指定 tag 由构建器按内容摘要生成'));
+}
+/** 判断当前构建策略是否要求完整仓库地址 */
+function requiresFullBuildRepository(raw, imageType) {
+    return raw.buildStrategy === 'local' ||
+        (raw.buildStrategy === 'cloud' && imageType === 'enterprise');
+}
+/** 添加仓库地址缺失或不完整的错误 */
+function addFullRepositoryError(raw, checks, missing) {
+    const isLocal = raw.buildStrategy === 'local';
+    checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID, missing
+        ? isLocal
+            ? 'local 策略缺少目标镜像仓库地址'
+            : 'enterprise cloud 策略缺少目标镜像仓库地址'
+        : isLocal
+            ? 'local 策略需要完整镜像仓库地址'
+            : 'enterprise cloud 策略需要完整镜像仓库地址', missing
+        ? '请配置 build.repository 为 registry/namespace/repository'
+        : isLocal
+            ? '请配置 registry/namespace/repository；当前 local 构建使用本机 Docker 登录态直接 push'
+            : 'P1 自动发现 TCR 实例域名完成前，请配置 registry/namespace/repository'));
+}
+/** 校验目标镜像仓库 */
+function checkBuildRepository(raw, build, checks) {
+    const imageType = resolveBuildImageType(raw, build);
+    const requiresFullRepository = requiresFullBuildRepository(raw, imageType);
+    if (build.repository === undefined) {
+        if (requiresFullRepository) {
+            addFullRepositoryError(raw, checks, true);
         }
+        return;
     }
-    if (build.repository !== undefined) {
-        if (typeof build.repository !== 'string' ||
-            !IMAGE_REPOSITORY_PATTERN.test(build.repository)) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID, '镜像仓库名不合法', '只能包含小写字母、数字与 . _ - 分隔符'));
-        }
+    const repository = typeof build.repository === 'string' ? build.repository.trim() : build.repository;
+    const parsedRepository = typeof repository === 'string' ? parseImageReference(repository) : null;
+    if (!parsedRepository || parsedRepository.tag || parsedRepository.digest) {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID, '镜像仓库地址不合法', 'repository 需为不含 tag 或 digest 的镜像仓库路径'));
+        return;
     }
-    if (build.buildArgs !== undefined) {
-        if (!lodash_1.default.isPlainObject(build.buildArgs)) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_ARG_INVALID, '构建参数必须是对象'));
-        }
-        else {
-            Object.entries(build.buildArgs).forEach(([key, value]) => {
-                if (!ENV_KEY_PATTERN.test(key)) {
-                    checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_ARG_INVALID, `构建参数名不合法：${key}`));
-                }
-                if (typeof value !== 'string') {
-                    checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_ARG_INVALID, `构建参数 ${key} 的值必须是字符串`));
-                }
-                if (SENSITIVE_KEY_PATTERN.test(key)) {
-                    const message = `构建参数 ${key} 可能包含敏感信息`;
-                    const remediation = '构建参数会写入镜像构建记录，请改用运行时环境变量或密钥管理';
-                    checks.push(raw.buildStrategy === 'cloud'
-                        ? fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_ARG_INVALID, message, remediation)
-                        : warn(types_1.FUNCTION_DEPLOY_ERROR.BUILD_ARG_INVALID, message, remediation));
-                }
-            });
-        }
+    const repositoryPath = parsedRepository.repository;
+    if (requiresFullRepository &&
+        (!parsedRepository.registry || !repositoryPath.includes('/'))) {
+        addFullRepositoryError(raw, checks, false);
+    }
+}
+/** 校验单个 Docker build arg */
+function checkBuildArg(raw, buildArg, checks) {
+    const [key, value] = buildArg;
+    if (!ENV_KEY_PATTERN.test(key)) {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_ARG_INVALID, `构建参数名不合法：${key}`));
+    }
+    if (typeof value !== 'string') {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_ARG_INVALID, `构建参数 ${key} 的值必须是字符串`));
+    }
+    if (SENSITIVE_KEY_PATTERN.test(key)) {
+        const message = `构建参数 ${key} 可能包含敏感信息`;
+        const remediation = '构建参数会写入镜像构建记录，请改用运行时环境变量或密钥管理';
+        checks.push(raw.buildStrategy === 'cloud'
+            ? fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_ARG_INVALID, message, remediation)
+            : warn(types_1.FUNCTION_DEPLOY_ERROR.BUILD_ARG_INVALID, message, remediation));
+    }
+}
+/** 校验 Docker build args */
+function checkBuildArgs(raw, build, checks) {
+    if (build.buildArgs === undefined) {
+        return;
+    }
+    if (!lodash_1.default.isPlainObject(build.buildArgs)) {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_ARG_INVALID, '构建参数必须是对象'));
+        return;
+    }
+    Object.entries(build.buildArgs).forEach(buildArg => {
+        checkBuildArg(raw, buildArg, checks);
+    });
+}
+/** 校验个人版 TCR 云端推送凭证 */
+function checkPersonalRegistryCredential(registryCredential, checks) {
+    if (!lodash_1.default.isPlainObject(registryCredential)) {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_MISSING, '个人版 TCR 云端构建缺少推送凭证', '请在 build.registryCredential 中显式声明 username/password，' +
+            '推荐使用 {{env.TCB_TCR_USERNAME}} 与 {{env.TCB_TCR_PASSWORD}}'));
+        return;
+    }
+    const username = registryCredential.username;
+    const password = registryCredential.password;
+    if (typeof username !== 'string' || !/^\d{5,20}$/.test(username.trim())) {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_INVALID, '个人版 TCR 登录用户名不合法', 'username 需为腾讯云账号 ID（UIN），推荐使用 {{env.TCB_TCR_USERNAME}}'));
+    }
+    if (typeof password !== 'string' || !password || password.length > 16 * 1024) {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_INVALID, '个人版 TCR 固定密码未配置或长度不合法', 'password 必须显式声明且不能为空，推荐使用 {{env.TCB_TCR_PASSWORD}}'));
     }
+}
+/** 校验镜像仓库命名空间与推送凭证 */
+function checkBuildRegistry(raw, build, checks) {
+    const imageType = resolveBuildImageType(raw, build);
     const registryCredential = build.registryCredential;
-    const imageType = (_c = raw.imageType) !== null && _c !== void 0 ? _c : (build.registryId ? 'enterprise' : 'personal');
     if (raw.buildStrategy === 'cloud' && imageType === 'personal') {
         if (typeof build.namespace !== 'string' ||
             !build.namespace.trim() ||
             !IMAGE_REPOSITORY_PATTERN.test(build.namespace.trim())) {
             checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID, '个人版 TCR 命名空间未配置或不合法', '请在 build.namespace 中显式声明，推荐使用 {{env.TCB_TCR_NAMESPACE}}'));
         }
-        if (!lodash_1.default.isPlainObject(registryCredential)) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_MISSING, '个人版 TCR 云端构建缺少推送凭证', '请在 build.registryCredential 中显式声明 username/password，' +
-                '推荐使用 {{env.TCB_TCR_USERNAME}} 与 {{env.TCB_TCR_PASSWORD}}'));
-        }
-        else {
-            const username = registryCredential.username;
-            const password = registryCredential.password;
-            if (typeof username !== 'string' || !/^\d{5,20}$/.test(username.trim())) {
-                checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_INVALID, '个人版 TCR 登录用户名不合法', 'username 需为腾讯云账号 ID（UIN），推荐使用 {{env.TCB_TCR_USERNAME}}'));
-            }
-            if (typeof password !== 'string' || !password || password.length > 16 * 1024) {
-                checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_INVALID, '个人版 TCR 固定密码未配置或长度不合法', 'password 必须显式声明且不能为空，推荐使用 {{env.TCB_TCR_PASSWORD}}'));
-            }
-        }
+        checkPersonalRegistryCredential(registryCredential, checks);
     }
     else if (registryCredential !== undefined) {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_INVALID, 'registryCredential 仅支持 cloud + personal 构建', '企业版使用 STS 临时凭证换取 token；local 构建使用本机 Docker 登录态'));
     }
+}
+/** 校验镜像构建目标配置 */
+function checkBuildTarget(raw, checks) {
+    const build = raw.build;
+    if (!lodash_1.default.isPlainObject(build)) {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONFIG_MISSING, '缺少镜像构建配置', '请配置 build，至少包含构建上下文与 Dockerfile 信息'));
+        return;
+    }
+    checks.push(...checkBuildTag(raw, build));
+    checkBuildSource(build, checks);
+    checkBuildRepository(raw, build, checks);
+    checkBuildArgs(raw, build, checks);
+    checkBuildRegistry(raw, build, checks);
     if (raw.imageConfig !== undefined) {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_CONFIG_NOT_ALLOWED, `buildStrategy 为 ${raw.buildStrategy} 时不能指定 imageConfig`, '镜像地址将由构建结果决定，如需直接部署已有镜像请使用 buildStrategy: image'));
     }

package/lib/function/index.js

@@ -1167,7 +1167,7 @@ class FunctionService {
      * @returns {Promise<void>}
      */
     async downloadFunctionCode(options) {
-        const { destPath, envId, functionName, codeSecret } = options;
+        const { destPath, envId, functionName, codeSecret, qualifier } = options;
         // 检验路径是否存在
         (0, utils_1.checkFullAccess)(destPath, true);
         // 获取下载链接：ENABLE_TCBF 开启走 tcb 的 DownloadFunction，否则走 scf 的 GetFunctionAddress
@@ -1176,6 +1176,10 @@ class FunctionService {
             FunctionName: functionName,
             [this.namespaceParamKey]: envId
         };
+        // 指定版本时透传 Qualifier；默认 $LATEST 与现状一致
+        if (qualifier) {
+            params.Qualifier = qualifier;
+        }
         if (codeSecret) {
             params.CodeSecret = codeSecret;
         }

package/lib/projectValidator/index.js

@@ -190,10 +190,12 @@ class ProjectValidator {
         return (config.functions || []).some((func) => this.isPersonalCloudFunction(func));
     }
     isPersonalCloudFunction(func) {
-        var _a;
+        var _a, _b, _c, _d, _e, _f;
+        const registryId = (_b = (_a = func.imageConfig) === null || _a === void 0 ? void 0 : _a.registryId) !== null && _b !== void 0 ? _b : (_d = (_c = func.imageConfig) === null || _c === void 0 ? void 0 : _c.build) === null || _d === void 0 ? void 0 : _d.registryId;
+        const imageType = (_f = (_e = func.imageConfig) === null || _e === void 0 ? void 0 : _e.imageType) !== null && _f !== void 0 ? _f : (registryId ? 'enterprise' : 'personal');
         return (func.type === 'HTTP' &&
             func.buildStrategy === 'cloud' &&
-            ((_a = func.imageConfig) === null || _a === void 0 ? void 0 : _a.imageType) === 'personal');
+            imageType === 'personal');
     }
     validateResources(cwd, config) {
         const errors = [];

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cloudbase/manager-node",
-    "version": "5.8.0-beta.1",
+    "version": "5.8.0-beta.2",
     "description": "The node manage service api for cloudbase.",
     "main": "lib/index.js",
     "scripts": {
@@ -42,7 +42,7 @@
     },
     "dependencies": {
         "@cloudbase/signature-nodejs": "^1.0.0",
-        "@cloudbase/toolbox": "^0.8.3-beta.1",
+        "@cloudbase/toolbox": "^0.8.3-beta.2",
         "@cloudbase/database": "^0.6.2",
         "archiver": "^3.1.1",
         "cos-nodejs-sdk-v5": "^2.14.0",

package/types/deploy/StateStore.d.ts

@@ -58,6 +58,8 @@ export interface IDeployState {
     version: number;
     updatedAt: string;
     gitCommit?: string;
+    /** 写入快照时的目标环境 ID：跨环境切换（如上海 → 新加坡）后旧快照不可信，skip 判定强制失效 */
+    envId?: string;
     resources: {
         hosting?: IHostingStateEntry[];
         gateway?: unknown;
@@ -102,6 +104,8 @@ export declare class StateStore {
     write(state: {
         resources: IDeployState['resources'];
         gitCommit?: string;
+        /** 本次部署的目标环境 ID（用于跨环境切换时使旧快照 skip 判定失效） */
+        envId?: string;
     }): void;
     /**
      * 计算产物目录逐文件 sha256 指纹（仅 hash，兼容旧调用）

package/types/deploy/types.d.ts

@@ -156,6 +156,35 @@ export interface IFunctionDeployCommon {
     /** 声明式配置中的函数代码目录，由 DeployOrchestrator 解析为绝对 functionPath */
     dir?: string;
     l5?: boolean | 'TRUE' | 'FALSE';
+    /** 标签列表（透传为 SCF Tags） */
+    tags?: {
+        Key: string;
+        Value: string;
+    }[];
+    /** 日志投递 CLS 日志集 ID */
+    clsLogsetId?: string;
+    /** 日志投递 CLS 主题 ID */
+    clsTopicId?: string;
+    /** 死信队列配置（透传为 SCF DeadLetterConfig） */
+    deadLetterConfig?: Record<string, unknown>;
+    /** 公网访问配置（透传为 SCF PublicNetConfig） */
+    publicNetConfig?: Record<string, unknown>;
+    /** 文件系统 CFS 配置（透传为 SCF CfsConfig） */
+    cfsConfig?: Record<string, unknown>;
+    /** 内网固定 IP 配置（透传为 SCF IntranetConfig） */
+    intranetConfig?: Record<string, unknown>;
+    /** 初始化超时时间（秒），范围 1-60 */
+    initTimeout?: number;
+    /** 是否开启异步属性（仅 CreateFunction 支持） */
+    asyncRunEnable?: boolean | 'TRUE' | 'FALSE';
+    /** 是否开启事件追踪（仅 CreateFunction 支持） */
+    traceEnable?: boolean | 'TRUE' | 'FALSE';
+    /** 是否自动创建 CLS 索引（仅 CreateFunction 支持） */
+    autoDeployClsTopicIndex?: boolean | 'TRUE' | 'FALSE';
+    /** 是否自动创建 CLS 主题（仅 CreateFunction 支持） */
+    autoCreateClsTopic?: boolean | 'TRUE' | 'FALSE';
+    /** 是否开启 DNS 缓存（仅 Event 函数支持） */
+    dnsCache?: boolean | 'TRUE' | 'FALSE';
 }
 /** 本地代码来源，三者互斥 */
 export interface ILocalCodeSource {
@@ -233,11 +262,11 @@ export interface IImageBuildTarget {
     namespace?: string;
     /**
      * 目标镜像仓库路径。
-     * cloud 策略可提供 repository 名、namespace/repository 或完整
-     * registry/namespace/repository；省略时默认使用函数名。
+     * personal cloud 可省略并默认使用函数名；enterprise cloud 在自动实例发现完成前需提供完整地址；
+     * local 策略当前需提供可直接 push 的完整 registry/namespace/repository 地址。
      */
     repository?: string;
-    /** 目标镜像 tag，缺省时由构建器按构建上下文摘要生成 */
+    /** local 策略的目标镜像 tag；cloud 策略由平台生成，不接受自定义 tag */
     tag?: string;
     /** 目标平台，默认 linux/amd64 */
     platform?: string;
@@ -253,9 +282,9 @@ export interface IHttpImageRuntimeCommon extends IHttpFunctionDeployCommon {
     runtime?: typeof CUSTOM_IMAGE_RUNTIME;
     /** 容器监听端口，仅允许 9000 */
     imagePort?: number;
-    /** 镜像类型，默认 enterprise */
+    /** 镜像类型；省略时有 registryId 推断为 enterprise，否则推断为 personal */
     imageType?: 'enterprise' | 'personal';
-    /** 企业版 TCR 实例 ID；个人版镜像不传 */
+    /** 企业版 TCR 实例 ID 的运行时规范位置；个人版镜像不传 */
     registryId?: string;
     entryPoint?: string;
     command?: string;

package/types/function/index.d.ts

@@ -202,6 +202,7 @@ export interface IFunctionCodeOptions {
     destPath: string;
     functionName: string;
     codeSecret?: string;
+    qualifier?: string;
 }
 export interface ILayerDownloadOptions {
     name: string;