@cloudbase/manager-node 5.8.2 → 5.8.3

package/lib/deploy/function/config-guard.js

@@ -29,7 +29,7 @@ const IMAGE_TAG_PATTERN = /^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$/;
 /** 镜像 digest 规则 */
 const IMAGE_DIGEST_PATTERN = /^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-fA-F0-9]{32,}$/;
 /** 镜像仓库路径规则 */
-const IMAGE_REPOSITORY_PATTERN = /^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*$/;
+const IMAGE_REPOSITORY_PATTERN = /^[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9][a-z0-9._-]*)*$/;
 /** 网关路径字符白名单，避免注入与歧义字符 */
 const GATEWAY_PATH_PATTERN = /^[A-Za-z0-9\-._~%/:@]+$/;
 /** 环境变量与构建参数名规则 */
@@ -182,7 +182,7 @@ function inferHttpBuildStrategy(config) {
  * 以便 checkDeployConfig 汇总全部问题
  */
 function normalizeDeployConfig(config) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
     if (!config || typeof config !== 'object') {
         throw new error_1.CloudBaseError('部署配置必须是对象', {
             code: types_1.FUNCTION_DEPLOY_ERROR.CONFIG_INVALID
@@ -219,11 +219,11 @@ function normalizeDeployConfig(config) {
     delete normalizedImage.handler;
     delete normalizedImage.installDependency;
     if (buildStrategy === 'cloud' || buildStrategy === 'local') {
-        normalizedImage.build = Object.assign(Object.assign({}, (cloned.build || {})), { dockerfile: (_k = (_j = cloned.build) === null || _j === void 0 ? void 0 : _j.dockerfile) !== null && _k !== void 0 ? _k : types_1.DEFAULT_DOCKERFILE, platform: (_m = (_l = cloned.build) === null || _l === void 0 ? void 0 : _l.platform) !== null && _m !== void 0 ? _m : types_1.DEFAULT_IMAGE_PLATFORM, repository: (_p = (_o = cloned.build) === null || _o === void 0 ? void 0 : _o.repository) !== null && _p !== void 0 ? _p : cloned.name });
+        normalizedImage.build = Object.assign(Object.assign({}, (cloned.build || {})), { dockerfile: (_k = (_j = cloned.build) === null || _j === void 0 ? void 0 : _j.dockerfile) !== null && _k !== void 0 ? _k : types_1.DEFAULT_DOCKERFILE, platform: (_m = (_l = cloned.build) === null || _l === void 0 ? void 0 : _l.platform) !== null && _m !== void 0 ? _m : types_1.DEFAULT_IMAGE_PLATFORM });
     }
     if (buildStrategy === 'local') {
         // 默认不静默改变构建环境
-        normalizedImage.localFallback = (_q = cloned.localFallback) !== null && _q !== void 0 ? _q : 'error';
+        normalizedImage.localFallback = (_o = cloned.localFallback) !== null && _o !== void 0 ? _o : 'error';
     }
     return normalizedImage;
 }
@@ -378,21 +378,23 @@ function checkImageIdentity(raw, checks) {
     const buildRegistryId = (_a = raw === null || raw === void 0 ? void 0 : raw.build) === null || _a === void 0 ? void 0 : _a.registryId;
     const buildStrategy = raw === null || raw === void 0 ? void 0 : raw.buildStrategy;
     const registryId = (_c = (_b = raw === null || raw === void 0 ? void 0 : raw.registryId) !== null && _b !== void 0 ? _b : imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.registryId) !== null && _c !== void 0 ? _c : buildRegistryId;
-    const defaultImageType = registryId ? 'enterprise' : 'personal';
-    const imageType = (_e = (_d = raw === null || raw === void 0 ? void 0 : raw.imageType) !== null && _d !== void 0 ? _d : imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.imageType) !== null && _e !== void 0 ? _e : defaultImageType;
+    const explicitImageType = (_d = raw === null || raw === void 0 ? void 0 : raw.imageType) !== null && _d !== void 0 ? _d : imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.imageType;
+    const imageType = resolveBuildImageType(raw, (_e = raw === null || raw === void 0 ? void 0 : raw.build) !== null && _e !== void 0 ? _e : {});
     if (imageType !== 'enterprise' && imageType !== 'personal') {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID, '镜像类型不合法', 'imageType 只能是 enterprise 或 personal'));
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID, buildStrategy === 'cloud' || buildStrategy === 'local'
+            ? `${buildStrategy} 策略必须显式声明镜像类型`
+            : '镜像类型不合法', '请配置 imageConfig.imageType 为 enterprise 或 personal'));
         return;
     }
     if (imageType === 'enterprise') {
-        const registryField = buildStrategy === 'cloud' || buildStrategy === 'local'
-            ? 'build.registryId'
-            : 'registryId';
-        if (registryId === undefined || registryId === null) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_MISSING, '企业版镜像未配置仓库实例 ID', `请配置 ${registryField}；如果当前没有企业版 TCR 实例，请将 imageType 设置为 personal 并改用个人版仓库配置`));
+        if (buildStrategy === 'image' && (registryId === undefined || registryId === null)) {
+            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_MISSING, '企业版镜像未配置仓库实例 ID', '请配置 imageConfig.registryId 或顶层 registryId'));
         }
-        else if (typeof registryId !== 'string' || !registryId.trim()) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_INVALID, '企业版镜像仓库实例 ID 无效', `${registryField} 已声明但解析结果为空；若使用 {{env.*}}，请检查对应环境变量已赋值为实际企业版 TCR 实例 ID。没有企业版实例时请改用 imageType=personal`));
+        else if (registryId !== undefined && (typeof registryId !== 'string' || !registryId.trim())) {
+            const registryField = buildStrategy === 'cloud' || buildStrategy === 'local'
+                ? 'build.registryId'
+                : 'registryId';
+            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_INVALID, '企业版镜像仓库实例 ID 无效', `${registryField} 已声明但解析结果为空；若使用 {{env.*}}，请检查对应环境变量已赋值为实际企业版 TCR 实例 ID`));
         }
     }
     else if (registryId !== undefined) {
@@ -402,7 +404,11 @@ function checkImageIdentity(raw, checks) {
 /** 解析构建策略使用的镜像类型 */
 function resolveBuildImageType(raw, build) {
     var _a, _b, _c, _d, _e, _f;
-    return (_c = (_a = raw.imageType) !== null && _a !== void 0 ? _a : (_b = raw.imageConfig) === null || _b === void 0 ? void 0 : _b.imageType) !== null && _c !== void 0 ? _c : (((_f = (_d = raw.registryId) !== null && _d !== void 0 ? _d : (_e = raw.imageConfig) === null || _e === void 0 ? void 0 : _e.registryId) !== null && _f !== void 0 ? _f : build.registryId) ? 'enterprise' : 'personal');
+    return (_c = (_a = raw.imageType) !== null && _a !== void 0 ? _a : (_b = raw.imageConfig) === null || _b === void 0 ? void 0 : _b.imageType) !== null && _c !== void 0 ? _c : (raw.buildStrategy === 'local' || raw.buildStrategy === 'cloud'
+        ? 'enterprise'
+        : ((_f = (_d = raw.registryId) !== null && _d !== void 0 ? _d : (_e = raw.imageConfig) === null || _e === void 0 ? void 0 : _e.registryId) !== null && _f !== void 0 ? _f : build.registryId)
+            ? 'enterprise'
+            : 'personal');
 }
 /** 校验构建 tag */
 function checkBuildTag(raw, build) {
@@ -441,8 +447,9 @@ function checkBuildSource(build, checks) {
 }
 /** 判断当前构建策略是否要求完整仓库地址 */
 function requiresFullBuildRepository(raw, imageType) {
-    return raw.buildStrategy === 'local' ||
-        (raw.buildStrategy === 'cloud' && imageType === 'enterprise');
+    var _a;
+    return raw.buildStrategy === 'local' && imageType === 'personal' &&
+        ((_a = raw.build) === null || _a === void 0 ? void 0 : _a.repository) !== undefined;
 }
 /** 添加仓库地址缺失或不完整的错误 */
 function addFullRepositoryError(raw, checks, missing) {
@@ -470,14 +477,21 @@ function checkBuildRepository(raw, build, checks) {
         return;
     }
     const repository = typeof build.repository === 'string' ? build.repository.trim() : build.repository;
-    const parsedRepository = typeof repository === 'string' ? parseImageReference(repository) : null;
-    if (!parsedRepository || parsedRepository.tag || parsedRepository.digest) {
+    const isShortRepository = typeof repository === 'string' &&
+        IMAGE_REPOSITORY_PATTERN.test(repository) &&
+        !repository.split('/')[0].includes('.') &&
+        !repository.split('/')[0].includes(':');
+    const parsedRepository = typeof repository === 'string' && !isShortRepository
+        ? parseImageReference(repository)
+        : null;
+    if (!isShortRepository && (!parsedRepository || parsedRepository.tag || parsedRepository.digest)) {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID, '镜像仓库地址不合法', 'repository 需为不含 tag 或 digest 的镜像仓库路径'));
         return;
     }
-    const repositoryPath = parsedRepository.repository;
+    const repositoryPath = isShortRepository ? repository : parsedRepository.repository;
     if (requiresFullRepository &&
-        (!parsedRepository.registry || !repositoryPath.includes('/'))) {
+        (!(parsedRepository === null || parsedRepository === void 0 ? void 0 : parsedRepository.registry) || !repositoryPath.includes('/')) &&
+        repository !== raw.name) {
         addFullRepositoryError(raw, checks, false);
     }
 }
@@ -511,10 +525,10 @@ function checkBuildArgs(raw, build, checks) {
         checkBuildArg(raw, buildArg, checks);
     });
 }
-/** 校验个人版 TCR 云端推送凭证 */
+/** 校验个人版 TCR 推送凭证 */
 function checkPersonalRegistryCredential(registryCredential, checks) {
     if (!lodash_1.default.isPlainObject(registryCredential)) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_MISSING, '个人版 TCR 云端构建缺少推送凭证', '请在 build.registryCredential 中显式声明 username/password，' +
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_MISSING, '个人版 TCR 构建缺少推送凭证', '请在 build.registryCredential 中显式声明 username/password，' +
             '推荐使用 {{env.TCB_TCR_USERNAME}} 与 {{env.TCB_TCR_PASSWORD}}'));
         return;
     }
@@ -527,20 +541,16 @@ function checkPersonalRegistryCredential(registryCredential, checks) {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_INVALID, '个人版 TCR 固定密码未配置或长度不合法', 'password 必须显式声明且不能为空，推荐使用 {{env.TCB_TCR_PASSWORD}}'));
     }
 }
-/** 校验镜像仓库命名空间与推送凭证 */
+/** 校验镜像仓库配置 */
 function checkBuildRegistry(raw, build, checks) {
     const imageType = resolveBuildImageType(raw, build);
     const registryCredential = build.registryCredential;
-    if (raw.buildStrategy === 'cloud' && imageType === 'personal') {
-        if (typeof build.namespace !== 'string' ||
-            !build.namespace.trim() ||
-            !IMAGE_REPOSITORY_PATTERN.test(build.namespace.trim())) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID, '个人版 TCR 命名空间未配置或不合法', '请在 build.namespace 中显式声明，推荐使用 {{env.TCB_TCR_NAMESPACE}}'));
-        }
+    if (imageType === 'personal') {
         checkPersonalRegistryCredential(registryCredential, checks);
+        return;
     }
-    else if (registryCredential !== undefined) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_INVALID, 'registryCredential 仅支持 cloud + personal 构建', '企业版使用 STS 临时凭证换取 token；local 构建使用本机 Docker 登录态'));
+    if (registryCredential !== undefined) {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_INVALID, 'registryCredential 仅支持 personal 镜像构建', '企业版使用 STS 临时凭证换取 token；personal local/cloud 必须显式提供 username/password'));
     }
 }
 /** 校验镜像构建目标配置 */

package/lib/deploy/function/enterprise-tcr.js

@@ -0,0 +1,194 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prepareEnterpriseTcrTarget = prepareEnterpriseTcrTarget;
+exports.createEnterpriseTcrCredential = createEnterpriseTcrCredential;
+exports.createTcrApiService = createTcrApiService;
+const error_1 = require("../../error");
+const types_1 = require("../types");
+const config_guard_1 = require("./config-guard");
+const TCR_API_VERSION = '2019-09-24';
+const NAMESPACE_PATTERN = /^[a-z0-9](?:[a-z0-9]|[._-](?![._-])){0,28}[a-z0-9]$/;
+function responseOf(result) {
+    return (result === null || result === void 0 ? void 0 : result.Response) || result || {};
+}
+function requestIdOf(result) {
+    var _a;
+    const requestId = (_a = responseOf(result)) === null || _a === void 0 ? void 0 : _a.RequestId;
+    return typeof requestId === 'string' && requestId ? requestId : undefined;
+}
+function errorRequestId(error) {
+    var _a, _b, _c;
+    return (error === null || error === void 0 ? void 0 : error.requestId) || ((_a = error === null || error === void 0 ? void 0 : error.original) === null || _a === void 0 ? void 0 : _a.requestId) || ((_c = (_b = error === null || error === void 0 ? void 0 : error.original) === null || _b === void 0 ? void 0 : _b.Response) === null || _c === void 0 ? void 0 : _c.RequestId);
+}
+function throwTcrError(message, code, requestId) {
+    throw new error_1.CloudBaseError(message, Object.assign({ code }, (requestId ? { requestId } : {})));
+}
+function assertNamespace(namespace) {
+    if (!NAMESPACE_PATTERN.test(namespace)) {
+        throwTcrError(`企业版 TCR 命名空间不合法：${namespace}。名称需为 2-30 位小写字母、数字、点、下划线或中划线，且不能以分隔符开头、结尾或连续出现。`, types_1.FUNCTION_DEPLOY_ERROR.TCR_NAMESPACE_INVALID);
+    }
+}
+function parseRepositoryTarget(repository) {
+    const parsed = (0, config_guard_1.parseImageReference)(repository);
+    if (!parsed || parsed.tag || parsed.digest) {
+        throwTcrError('企业版 TCR repository 不合法，需为 repository、namespace/repository 或 registry/namespace/repository，且不能包含 tag 或 digest。', types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID);
+    }
+    const parts = parsed.repository.split('/');
+    if (parsed.registry) {
+        if (parts.length < 2) {
+            throwTcrError('完整企业版 TCR repository 必须包含 namespace/repository。', types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID);
+        }
+        return {
+            registry: parsed.registry,
+            namespace: parts.slice(0, -1).join('/'),
+            repository: parts[parts.length - 1]
+        };
+    }
+    if (parts.length >= 2) {
+        return {
+            namespace: parts.slice(0, -1).join('/'),
+            repository: parts[parts.length - 1]
+        };
+    }
+    return { repository: parts[0] };
+}
+function isRunningRegistry(registry) {
+    return !registry.Status || registry.Status.toLowerCase() === 'running';
+}
+async function resolveRegistry(service, region, explicitRegistryId) {
+    let result;
+    try {
+        result = await service.call({
+            Action: 'DescribeInstances',
+            Param: Object.assign({ AllRegion: true, Limit: 100 }, (explicitRegistryId ? { Registryids: [explicitRegistryId] } : {}))
+        });
+    }
+    catch (error) {
+        throw new error_1.CloudBaseError('查询企业版 TCR 实例失败，请确认当前身份具备 DescribeInstances 权限。', {
+            code: types_1.FUNCTION_DEPLOY_ERROR.TCR_INSTANCE_DISCOVERY_FAILED,
+            requestId: errorRequestId(error) || ''
+        });
+    }
+    const response = responseOf(result);
+    const registries = Array.isArray(response.Registries)
+        ? response.Registries
+        : Array.isArray(response.InstanceSet)
+            ? response.InstanceSet
+            : [];
+    const matching = registries.filter(item => {
+        const registryId = item.RegistryId || item.InstanceId;
+        const registryRegion = item.RegionName || item.Region;
+        return ((!explicitRegistryId || registryId === explicitRegistryId) &&
+            registryRegion === region &&
+            isRunningRegistry(item));
+    });
+    const requestId = requestIdOf(result);
+    if (matching.length === 0) {
+        const message = explicitRegistryId
+            ? `未找到地域 ${region} 内可用的企业版 TCR 实例 ${explicitRegistryId}，请确认实例 ID、状态及其与 SCF 的地域一致。`
+            : `地域 ${region} 内没有可用的企业版 TCR 实例，请先创建实例或显式指定同地域 registryId。`;
+        throwTcrError(message, types_1.FUNCTION_DEPLOY_ERROR.TCR_INSTANCE_NOT_FOUND, requestId);
+    }
+    if (matching.length > 1) {
+        throwTcrError(`地域 ${region} 内发现多个可用的企业版 TCR 实例，请通过 imageConfig.registryId 显式指定目标实例。`, types_1.FUNCTION_DEPLOY_ERROR.TCR_INSTANCE_AMBIGUOUS, requestId);
+    }
+    const selected = matching[0];
+    const registryId = selected.RegistryId || selected.InstanceId;
+    const registry = selected.PublicDomain || selected.RegistryDomain || selected.RegistryDomainName;
+    if (!registryId || !registry) {
+        throwTcrError('企业版 TCR 实例信息缺少 RegistryId 或 PublicDomain，无法生成镜像地址。', types_1.FUNCTION_DEPLOY_ERROR.TCR_INSTANCE_INVALID, requestId);
+    }
+    return { registryId, registry };
+}
+function isNamespaceConflict(error) {
+    var _a, _b;
+    const code = String((error === null || error === void 0 ? void 0 : error.code) || ((_b = (_a = error === null || error === void 0 ? void 0 : error.original) === null || _a === void 0 ? void 0 : _a.Error) === null || _b === void 0 ? void 0 : _b.Code) || '');
+    return /ResourceConflict|AlreadyExists|ResourceInUse/i.test(code);
+}
+async function ensureNamespace(service, registryId, namespace) {
+    var _a;
+    let describeResult;
+    try {
+        describeResult = await service.call({
+            Action: 'DescribeNamespaces',
+            Param: { RegistryId: registryId, NamespaceName: namespace, Limit: 1, Offset: 0 }
+        });
+    }
+    catch (error) {
+        throw new error_1.CloudBaseError(`查询企业版 TCR 命名空间 ${namespace} 失败。`, {
+            code: types_1.FUNCTION_DEPLOY_ERROR.TCR_NAMESPACE_QUERY_FAILED,
+            requestId: errorRequestId(error) || ''
+        });
+    }
+    const namespaceList = (_a = responseOf(describeResult)) === null || _a === void 0 ? void 0 : _a.NamespaceList;
+    if (Array.isArray(namespaceList) && namespaceList.some(item => (item === null || item === void 0 ? void 0 : item.Name) === namespace)) {
+        return;
+    }
+    try {
+        await service.call({
+            Action: 'CreateNamespace',
+            Param: { RegistryId: registryId, NamespaceName: namespace, IsPublic: false }
+        });
+    }
+    catch (error) {
+        if (isNamespaceConflict(error)) {
+            return;
+        }
+        throw new error_1.CloudBaseError(`创建企业版 TCR 命名空间 ${namespace} 失败。`, {
+            code: types_1.FUNCTION_DEPLOY_ERROR.TCR_NAMESPACE_CREATE_FAILED,
+            requestId: errorRequestId(error) || ''
+        });
+    }
+}
+async function prepareEnterpriseTcrTarget(config, options) {
+    var _a;
+    const configuredRegistryId = (_a = config.registryId) !== null && _a !== void 0 ? _a : config.build.registryId;
+    const explicitRegistryId = typeof configuredRegistryId === 'string' && configuredRegistryId.trim()
+        ? configuredRegistryId.trim()
+        : undefined;
+    const resolvedRegistry = await resolveRegistry(options.service, options.region, explicitRegistryId);
+    const repositoryTarget = parseRepositoryTarget(config.build.repository || config.name);
+    const namespace = (config.build.namespace || repositoryTarget.namespace || options.envId).trim();
+    assertNamespace(namespace);
+    if (config.build.namespace && repositoryTarget.namespace && config.build.namespace !== repositoryTarget.namespace) {
+        throwTcrError('build.namespace 与 build.repository 中的命名空间不一致。', types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID);
+    }
+    await ensureNamespace(options.service, resolvedRegistry.registryId, namespace);
+    const registry = repositoryTarget.registry || resolvedRegistry.registry;
+    const repository = repositoryTarget.repository || config.name;
+    const imageRepository = `${registry}/${namespace}/${repository}`;
+    const preparedConfig = Object.assign(Object.assign({}, config), { imageType: 'enterprise', registryId: resolvedRegistry.registryId, build: Object.assign(Object.assign({}, config.build), { registryId: resolvedRegistry.registryId, namespace, repository: imageRepository }) });
+    return {
+        config: preparedConfig,
+        target: {
+            registryId: resolvedRegistry.registryId,
+            registry,
+            namespace,
+            repository,
+            imageRepository
+        }
+    };
+}
+async function createEnterpriseTcrCredential(service, registryId) {
+    let result;
+    try {
+        result = await service.call({
+            Action: 'CreateInstanceToken',
+            Param: { RegistryId: registryId, TokenType: 'temp' }
+        });
+    }
+    catch (error) {
+        throw new error_1.CloudBaseError('获取企业版 TCR 临时登录凭证失败，请确认当前身份具备 CreateInstanceToken 权限。', {
+            code: types_1.FUNCTION_DEPLOY_ERROR.TCR_TOKEN_CREATE_FAILED,
+            requestId: errorRequestId(error) || ''
+        });
+    }
+    const response = responseOf(result);
+    if (typeof response.Username !== 'string' || !response.Username || typeof response.Token !== 'string' || !response.Token) {
+        throwTcrError('CreateInstanceToken 未返回有效的 Username 或 Token。', types_1.FUNCTION_DEPLOY_ERROR.TCR_TOKEN_INVALID, requestIdOf(result));
+    }
+    return { username: response.Username, token: response.Token };
+}
+function createTcrApiService(environment) {
+    return environment.getCommonService('tcr', TCR_API_VERSION);
+}

package/lib/deploy/function/image-tag.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveImageTag = resolveImageTag;
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+async function readGitShortSha(cwd) {
+    try {
+        const { stdout } = await execFileAsync('git', ['rev-parse', '--short=7', 'HEAD'], { cwd });
+        const sha = stdout.trim();
+        return /^[0-9a-f]{7}$/i.test(sha) ? sha.toLowerCase() : undefined;
+    }
+    catch (_) {
+        return undefined;
+    }
+}
+/**
+ * 生成镜像 tag：显式配置优先，其次 Git short SHA，最后回退到毫秒时间戳。
+ */
+async function resolveImageTag(options) {
+    var _a;
+    const explicitTag = (_a = options.explicitTag) === null || _a === void 0 ? void 0 : _a.trim();
+    if (explicitTag) {
+        return explicitTag;
+    }
+    const gitShortSha = await (options.readGitShortSha || readGitShortSha)(options.cwd);
+    if (gitShortSha) {
+        return gitShortSha;
+    }
+    return String((options.now || Date.now)());
+}

package/lib/deploy/function/local-builder.js

@@ -3,12 +3,18 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildLocalImage = buildLocalImage;
+exports.pushLocalImage = pushLocalImage;
+exports.loginDockerRegistry = loginDockerRegistry;
+exports.createTemporaryDockerConfig = createTemporaryDockerConfig;
 exports.buildAndPushImage = buildAndPushImage;
 const child_process_1 = require("child_process");
 const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const error_1 = require("../../error");
 const types_1 = require("../types");
+const image_tag_1 = require("./image-tag");
 /**
  * 本地镜像构建与推送（local 策略，个人版先行版）
  *
@@ -24,15 +30,26 @@ const types_1 = require("../types");
 /** 构建/推送命令超时（毫秒），镜像构建较慢，给足时间 */
 const BUILD_TIMEOUT = 10 * 60 * 1000;
 /** 默认命令执行器：固定参数数组、无 shell、带超时与最大缓冲 */
-function defaultRunCommand(command, args) {
+function defaultRunCommand(command, args, options = {}) {
     return new Promise(resolve => {
-        (0, child_process_1.execFile)(command, args, { timeout: BUILD_TIMEOUT, shell: false, windowsHide: true, maxBuffer: 32 * 1024 * 1024 }, (error, stdout, stderr) => {
+        var _a, _b;
+        const child = (0, child_process_1.execFile)(command, args, {
+            timeout: BUILD_TIMEOUT,
+            shell: false,
+            windowsHide: true,
+            maxBuffer: 32 * 1024 * 1024,
+            env: options.env ? Object.assign(Object.assign({}, process.env), options.env) : process.env
+        }, (error, stdout, stderr) => {
             resolve({
                 ok: !error,
                 stdout: (stdout || '').toString(),
                 stderr: (stderr || '').toString()
             });
         });
+        if (options.input !== undefined) {
+            (_a = child.stdin) === null || _a === void 0 ? void 0 : _a.write(options.input);
+            (_b = child.stdin) === null || _b === void 0 ? void 0 : _b.end();
+        }
     });
 }
 /** 默认依赖：真实命令执行与 fs 检查 */
@@ -48,15 +65,14 @@ function resolveContext(config) {
     return path_1.default.resolve(cwd);
 }
 /** 解析目标镜像完整引用 imageUri（repository 需为含域名与命名空间的完整仓库地址，个人版/企业版通用） */
-function resolveImageUri(config) {
+async function resolveImageUri(config, context) {
     const repository = config.build.repository;
     if (typeof repository !== 'string' || !repository.trim()) {
         throw new error_1.CloudBaseError('local 策略缺少目标镜像仓库地址 build.repository', {
             code: types_1.FUNCTION_DEPLOY_ERROR.LOCAL_BUILD_REPOSITORY_MISSING
         });
     }
-    // tag 缺省用时间戳，避免 latest；不可变 tag 便于回溯
-    const tag = config.build.tag || `v${Date.now()}`;
+    const tag = await (0, image_tag_1.resolveImageTag)({ explicitTag: config.build.tag, cwd: context });
     return `${repository.trim()}:${tag}`;
 }
 /** 从 buildx imagetools inspect 输出解析 digest */
@@ -80,15 +96,10 @@ function formatBuildCommandForLog(args) {
     }
     return `docker ${displayArgs.join(' ')}`;
 }
-/**
- * 本地构建镜像并推送到目标仓库
- *
- * @param config 规范化的 local 部署配置
- * @param onLog 可选日志回调，用于透出构建输出（不含凭证）
- * @param deps 可注入依赖，默认真实命令与 fs；测试可传 mock
- * @returns 最终镜像引用与 digest
- */
-async function buildAndPushImage(config, onLog, deps = defaultDeps) {
+/** 本地构建镜像，不执行推送。 */
+async function buildLocalImage(config, onLog, options = {}) {
+    const deps = options.deps || defaultDeps;
+    const commandOptions = options.commandOptions || {};
     const context = resolveContext(config);
     if (!deps.existsSync(context) || !deps.isDirectory(context)) {
         throw new error_1.CloudBaseError(`构建上下文目录不存在：${context}`, {
@@ -102,28 +113,162 @@ async function buildAndPushImage(config, onLog, deps = defaultDeps) {
             code: types_1.FUNCTION_DEPLOY_ERROR.LOCAL_BUILD_DOCKERFILE_MISSING
         });
     }
-    const imageUri = resolveImageUri(config);
+    const imageUri = await resolveImageUri(config, context);
     const platform = config.build.platform || types_1.DEFAULT_IMAGE_PLATFORM;
-    // 组装 buildx 参数：构建目标平台镜像并直接推送
-    const args = ['buildx', 'build', '--platform', platform, '-f', dockerfilePath, '-t', imageUri];
+    const args = [
+        'buildx',
+        'build',
+        '--platform',
+        platform,
+        '-f',
+        dockerfilePath,
+        '-t',
+        imageUri,
+        '--load'
+    ];
     if (config.build.forceBuild) {
         args.push('--no-cache');
     }
-    // 追加构建参数（键值均作为独立参数，无 shell 拼接）
     const buildArgs = config.build.buildArgs || {};
     for (const key of Object.keys(buildArgs)) {
         args.push('--build-arg', `${key}=${buildArgs[key]}`);
     }
-    args.push('--push', context);
+    args.push(context);
     onLog === null || onLog === void 0 ? void 0 : onLog(`执行 ${formatBuildCommandForLog(args)}`);
-    const build = await deps.runCommand('docker', args);
+    const buildStartedAt = Date.now();
+    const build = await deps.runCommand('docker', args, commandOptions);
+    const buildDurationMs = Date.now() - buildStartedAt;
     if (!build.ok) {
-        throw new error_1.CloudBaseError('镜像构建或推送失败，请查看 Docker 构建输出定位具体原因', {
-            code: types_1.FUNCTION_DEPLOY_ERROR.LOCAL_PUSH_FAILED
+        throw new error_1.CloudBaseError('镜像构建失败，请检查 Dockerfile、构建上下文和本地 Docker 输出。', {
+            code: types_1.FUNCTION_DEPLOY_ERROR.LOCAL_BUILD_FAILED
         });
     }
-    // 查询远端 digest，产出不可变引用
-    const inspect = await deps.runCommand('docker', ['buildx', 'imagetools', 'inspect', imageUri]);
+    return { imageUri, buildDurationMs };
+}
+/** 推送已构建镜像，并尽力查询远端 digest。 */
+async function pushLocalImage(imageUri, onLog, options = {}) {
+    const deps = options.deps || defaultDeps;
+    const commandOptions = options.commandOptions || {};
+    onLog === null || onLog === void 0 ? void 0 : onLog(`执行 docker push ${imageUri}`);
+    const pushStartedAt = Date.now();
+    const push = await deps.runCommand('docker', ['push', imageUri], commandOptions);
+    const pushDurationMs = Date.now() - pushStartedAt;
+    if (!push.ok) {
+        const authFailed = /unauthorized|authentication required|denied|no basic auth credentials/i.test(`${push.stdout}\n${push.stderr}`);
+        throw new error_1.CloudBaseError(authFailed
+            ? '镜像推送鉴权失败，请确认镜像仓库登录凭证有效，并且当前身份具备目标仓库写权限。'
+            : '镜像推送失败，请检查网络、镜像仓库地址和写入权限。', { code: types_1.FUNCTION_DEPLOY_ERROR.LOCAL_PUSH_FAILED });
+    }
+    const inspect = await deps.runCommand('docker', ['buildx', 'imagetools', 'inspect', imageUri], commandOptions);
     const imageDigest = inspect.ok ? parseDigest(inspect.stdout) : undefined;
-    return { imageUri, imageDigest };
+    if (!inspect.ok) {
+        onLog === null || onLog === void 0 ? void 0 : onLog('镜像已推送成功，但未能查询远端 digest，将继续使用镜像 tag 部署');
+    }
+    return { imageDigest, pushDurationMs };
+}
+function resolveRegistry(imageUri) {
+    const repositoryWithRegistry = imageUri.split('@')[0].replace(/:[^/:]+$/, '');
+    const slashIndex = repositoryWithRegistry.indexOf('/');
+    if (slashIndex <= 0) {
+        throw new error_1.CloudBaseError('local 策略的目标镜像地址缺少仓库域名', {
+            code: types_1.FUNCTION_DEPLOY_ERROR.LOCAL_BUILD_REPOSITORY_MISSING
+        });
+    }
+    return repositoryWithRegistry.slice(0, slashIndex);
+}
+async function loginDockerRegistry(registry, credential, options = {}) {
+    const deps = options.deps || defaultDeps;
+    const commandOptions = options.commandOptions || {};
+    const result = await deps.runCommand('docker', ['login', '--username', credential.username, '--password-stdin', registry], Object.assign(Object.assign({}, commandOptions), { input: credential.secret }));
+    if (!result.ok) {
+        throw new error_1.CloudBaseError('镜像仓库 Docker 登录失败，请检查登录凭证、仓库地址和访问权限。', {
+            code: types_1.FUNCTION_DEPLOY_ERROR.TCR_DOCKER_LOGIN_FAILED
+        });
+    }
+}
+function linkDockerState(sourceDir, targetDir, name) {
+    const source = path_1.default.join(sourceDir, name);
+    const target = path_1.default.join(targetDir, name);
+    if (!fs_1.default.existsSync(source)) {
+        return;
+    }
+    try {
+        fs_1.default.symlinkSync(source, target, 'junction');
+    }
+    catch (_a) {
+        // Docker 状态继承失败时继续使用已复制的基础配置，后续命令会返回稳定错误码
+    }
+}
+function copySanitizedDockerConfig(sourceDir, targetDir) {
+    const source = path_1.default.join(sourceDir, 'config.json');
+    if (!fs_1.default.existsSync(source)) {
+        return;
+    }
+    try {
+        const config = JSON.parse(fs_1.default.readFileSync(source, 'utf8'));
+        delete config.auths;
+        delete config.credsStore;
+        delete config.credHelpers;
+        fs_1.default.writeFileSync(path_1.default.join(targetDir, 'config.json'), JSON.stringify(config, null, 2), {
+            encoding: 'utf8',
+            mode: 0o600
+        });
+    }
+    catch (_a) {
+        // 配置不可读或格式异常时使用空配置，避免复制潜在认证信息
+    }
+}
+function createTemporaryDockerConfig() {
+    const sourceDir = process.env.DOCKER_CONFIG || path_1.default.join(os_1.default.homedir(), '.docker');
+    const configDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'tcb-docker-config-'));
+    copySanitizedDockerConfig(sourceDir, configDir);
+    ['cli-plugins', 'contexts', 'buildx'].forEach(name => linkDockerState(sourceDir, configDir, name));
+    return {
+        env: { DOCKER_CONFIG: configDir },
+        cleanup: () => {
+            try {
+                ;
+                fs_1.default.rmSync(configDir, { recursive: true, force: true });
+            }
+            catch (_a) {
+                // 临时登录态清理失败不覆盖部署主错误
+            }
+        }
+    };
+}
+/**
+ * 本地构建镜像并推送到目标仓库。
+ *
+ * 保留组合入口以兼容已有调用；需要实时阶段进度的编排器应分别调用
+ * buildLocalImage 与 pushLocalImage。
+ */
+async function buildAndPushImage(config, onLog, deps = defaultDeps) {
+    const startedAt = Date.now();
+    const credential = config.build.registryCredential;
+    const dockerConfig = credential ? createTemporaryDockerConfig() : undefined;
+    const commandOptions = dockerConfig ? { env: dockerConfig.env } : undefined;
+    try {
+        const { imageUri, buildDurationMs } = await buildLocalImage(config, onLog, {
+            deps,
+            commandOptions
+        });
+        if (credential) {
+            const registry = resolveRegistry(imageUri);
+            await loginDockerRegistry(registry, { username: credential.username, secret: credential.password }, { deps, commandOptions });
+        }
+        const { imageDigest, pushDurationMs } = await pushLocalImage(imageUri, onLog, {
+            deps,
+            commandOptions
+        });
+        return {
+            imageUri,
+            imageDigest,
+            buildDurationMs,
+            pushDurationMs,
+            durationMs: Date.now() - startedAt
+        };
+    }
+    finally {
+        dockerConfig === null || dockerConfig === void 0 ? void 0 : dockerConfig.cleanup();
+    }
 }