@cloudbase/manager-node 5.8.2 → 5.8.3

package/lib/deploy/function/personal-tcr.js

@@ -0,0 +1,153 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PersonalTcrService = exports.DEFAULT_PERSONAL_TCR_REGISTRY = void 0;
+exports.createPersonalTcrService = createPersonalTcrService;
+const config_guard_1 = require("./config-guard");
+const PERSONAL_TCR_VERSION = '2019-09-24';
+exports.DEFAULT_PERSONAL_TCR_REGISTRY = 'ccr.ccs.tencentyun.com';
+const DEFAULT_RETAINED_TAGS = 30;
+const ALREADY_EXISTS_CODES = new Set([
+    'InvalidParameter.ErrNamespaceExist',
+    'InvalidParameter.ErrRepoExist',
+    'ResourceInUse.NamespaceExist',
+    'ResourceInUse.RepositoryExist',
+    'FailedOperation.AlreadyExists',
+    'ResourceConflict'
+]);
+function dataOf(response) {
+    var _a;
+    return (response === null || response === void 0 ? void 0 : response.Data) || ((_a = response === null || response === void 0 ? void 0 : response.Response) === null || _a === void 0 ? void 0 : _a.Data) || (response === null || response === void 0 ? void 0 : response.Response) || response || {};
+}
+function getErrorCode(error) {
+    var _a, _b;
+    return (error === null || error === void 0 ? void 0 : error.code) || (error === null || error === void 0 ? void 0 : error.Code) || ((_b = (_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.Error) === null || _b === void 0 ? void 0 : _b.Code) || '';
+}
+function toTagTimestamp(item) {
+    const value = item.PushTime || item.CreationTime;
+    if (!value) {
+        return 0;
+    }
+    const timestamp = Date.parse(value);
+    return Number.isFinite(timestamp) ? timestamp : 0;
+}
+function resolvePersonalRepoName(namespace, repository) {
+    const parsed = (0, config_guard_1.parseImageReference)(repository);
+    if (parsed === null || parsed === void 0 ? void 0 : parsed.registry) {
+        return parsed.repository;
+    }
+    if (parsed === null || parsed === void 0 ? void 0 : parsed.repository.includes('/')) {
+        return parsed.repository;
+    }
+    return `${namespace}/${repository}`;
+}
+function isAlreadyExists(error) {
+    const code = getErrorCode(error);
+    const message = (error === null || error === void 0 ? void 0 : error.message) || (error === null || error === void 0 ? void 0 : error.Message) || '';
+    return (ALREADY_EXISTS_CODES.has(code) ||
+        /Err(?:Namespace|Repo)Exist|AlreadyExists|ResourceInUse|ResourceConflict/i.test(code) ||
+        /already exists?|has already (?:exist|register)|已存在/i.test(message));
+}
+class PersonalTcrService {
+    constructor(environment) {
+        const service = environment.getCommonService('tcr', PERSONAL_TCR_VERSION);
+        this.request = (action, data = {}) => service.call({ Action: action, Param: data });
+    }
+    async ensurePushTarget(options) {
+        const { namespace, repository, ensureNamespace, ensureRepository } = options;
+        if (ensureNamespace && !(await this.namespaceExists(namespace))) {
+            await this.createIgnoringExisting('CreateNamespacePersonal', {
+                Namespace: namespace
+            });
+        }
+        if (ensureRepository && !(await this.repositoryExists(namespace, repository))) {
+            await this.createIgnoringExisting('CreateRepositoryPersonal', {
+                RepoName: `${namespace}/${repository}`,
+                Public: 0,
+                Description: 'Managed by CloudBase CLI'
+            });
+        }
+    }
+    async cleanupTags(options) {
+        var _a;
+        const retain = (_a = options.retain) !== null && _a !== void 0 ? _a : DEFAULT_RETAINED_TAGS;
+        const repoName = resolvePersonalRepoName(options.namespace, options.repository);
+        const tags = await this.listAllTags(repoName);
+        const staleTags = tags
+            .filter(item => item.TagName)
+            .sort((left, right) => toTagTimestamp(right) - toTagTimestamp(left))
+            .slice(retain);
+        for (const item of staleTags) {
+            try {
+                await this.request('DeleteImagePersonal', {
+                    RepoName: repoName,
+                    Tag: item.TagName
+                });
+            }
+            catch (error) {
+                const code = getErrorCode(error);
+                if (!/not.?found|not.?exist/i.test(code) && !/不存在/i.test((error === null || error === void 0 ? void 0 : error.message) || '')) {
+                    throw error;
+                }
+            }
+        }
+    }
+    async namespaceExists(namespace) {
+        const response = await this.request('DescribeNamespacePersonal', {
+            Namespace: namespace,
+            Limit: 100,
+            Offset: 0
+        });
+        const data = dataOf(response);
+        const namespaces = Array.isArray(data.NamespaceInfo)
+            ? data.NamespaceInfo
+            : [];
+        return namespaces.some(item => item.Namespace === namespace);
+    }
+    async repositoryExists(namespace, repository) {
+        const repoName = `${namespace}/${repository}`;
+        const response = await this.request('DescribeRepositoryFilterPersonal', {
+            RepoName: repoName,
+            Limit: 100,
+            Offset: 0
+        });
+        const data = dataOf(response);
+        const repositories = Array.isArray(data.RepoInfo)
+            ? data.RepoInfo
+            : [];
+        return repositories.some(item => item.RepoName === repoName);
+    }
+    async createIgnoringExisting(action, data) {
+        try {
+            await this.request(action, data);
+        }
+        catch (error) {
+            if (!isAlreadyExists(error)) {
+                throw error;
+            }
+        }
+    }
+    async listAllTags(repoName) {
+        var _a;
+        const result = [];
+        const limit = 100;
+        let offset = 0;
+        while (true) {
+            const response = await this.request('DescribeImagePersonal', {
+                RepoName: repoName,
+                Limit: limit,
+                Offset: offset
+            });
+            const data = (response === null || response === void 0 ? void 0 : response.Data) || ((_a = response === null || response === void 0 ? void 0 : response.Response) === null || _a === void 0 ? void 0 : _a.Data) || {};
+            const page = data.TagInfo || [];
+            result.push(...page);
+            offset += page.length;
+            if (!page.length || offset >= Number(data.TagCount || result.length)) {
+                return result;
+            }
+        }
+    }
+}
+exports.PersonalTcrService = PersonalTcrService;
+function createPersonalTcrService(environment) {
+    return new PersonalTcrService(environment);
+}

package/lib/deploy/types.js

@@ -55,6 +55,17 @@ exports.FUNCTION_DEPLOY_ERROR = {
     BUILD_ARG_INVALID: 'BUILD_ARG_INVALID',
     CLOUD_REGISTRY_CREDENTIAL_MISSING: 'CLOUD_REGISTRY_CREDENTIAL_MISSING',
     CLOUD_REGISTRY_CREDENTIAL_INVALID: 'CLOUD_REGISTRY_CREDENTIAL_INVALID',
+    TCR_REGION_MISSING: 'TCR_REGION_MISSING',
+    TCR_INSTANCE_DISCOVERY_FAILED: 'TCR_INSTANCE_DISCOVERY_FAILED',
+    TCR_INSTANCE_NOT_FOUND: 'TCR_INSTANCE_NOT_FOUND',
+    TCR_INSTANCE_AMBIGUOUS: 'TCR_INSTANCE_AMBIGUOUS',
+    TCR_INSTANCE_INVALID: 'TCR_INSTANCE_INVALID',
+    TCR_NAMESPACE_INVALID: 'TCR_NAMESPACE_INVALID',
+    TCR_NAMESPACE_QUERY_FAILED: 'TCR_NAMESPACE_QUERY_FAILED',
+    TCR_NAMESPACE_CREATE_FAILED: 'TCR_NAMESPACE_CREATE_FAILED',
+    TCR_TOKEN_CREATE_FAILED: 'TCR_TOKEN_CREATE_FAILED',
+    TCR_TOKEN_INVALID: 'TCR_TOKEN_INVALID',
+    TCR_DOCKER_LOGIN_FAILED: 'TCR_DOCKER_LOGIN_FAILED',
     GATEWAY_PATH_INVALID: 'GATEWAY_PATH_INVALID',
     LOCAL_FALLBACK_INVALID: 'LOCAL_FALLBACK_INVALID',
     // Preflight（有 IO 的本地检查）

package/lib/hosting/index.js

@@ -348,19 +348,35 @@ class HostingService {
     }
     /**
      * 查询域名状态信息
+     *
+     * 仅在 CDN 域名（domainType=cdn）或老环境（未返回 domainType）时调用 CDN 接口，
+     * 其他域名类型（gateway / eo 等）返回空结果
      * @param options
      */
     async tcbCheckResource(options) {
+        const domainType = await this.getStorageDomainType();
+        // 白名单：只有 cdn 或空值（老环境）才调用 CDN 接口
+        if (domainType !== 'cdn' && domainType) {
+            return { Domains: [], RecordCount: 0, RequestId: '' };
+        }
         return this.cdnService.request('TcbCheckResource', {
             Domains: options.domains
         });
     }
     /**
      * 域名配置变更
+     *
+     * 仅在 CDN 域名（domainType=cdn）或老环境（未返回 domainType）时调用 CDN 接口，
+     * 其他域名类型（gateway / eo 等）返回空结果
      * @param options
      */
     async tcbModifyAttribute(options) {
         const { domain, domainId, domainConfig } = options;
+        const domainType = await this.getStorageDomainType();
+        // 白名单：只有 cdn 或空值（老环境）才调用 CDN 接口
+        if (domainType !== 'cdn' && domainType) {
+            return { RequestId: '' };
+        }
         const res = await this.cdnService.request('TcbModifyAttribute', {
             Domain: domain,
             DomainId: domainId,
@@ -445,6 +461,17 @@ class HostingService {
         }
         return cloudPath[cloudPath.length - 1] === '/' ? cloudPath : `${cloudPath}/`;
     }
+    /**
+     * 获取静态托管域名类型（cdn / gateway / eo）
+     *
+     * 后端通过 DescribeEnvInfo 返回 StaticStorages[0].DomainType，
+     * 仅 cdn 或空值（老环境）才允许调用 CDN 相关接口。
+     */
+    async getStorageDomainType() {
+        var _a, _b;
+        const { EnvInfo } = await this.environment.getEnvService().getEnvInfo();
+        return (_b = (_a = EnvInfo === null || EnvInfo === void 0 ? void 0 : EnvInfo.StaticStorages) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.DomainType;
+    }
 }
 exports.HostingService = HostingService;
 __decorate([

package/lib/projectValidator/index.js

@@ -92,12 +92,25 @@ class ProjectValidator {
     }
     validateSchema(config, errors) {
         const result = (0, toolbox_1.validateCloudBaseConfigBySchema)(config);
-        result.errors.forEach((error) => {
+        result.errors
+            .filter((error) => error.keyword !== 'if')
+            .forEach((error) => {
+            const errorParams = error.params;
+            const missingProperty = error.keyword === 'required' && typeof errorParams.missingProperty === 'string'
+                ? errorParams.missingProperty
+                : undefined;
+            const baseField = this.normalizeSchemaPath(error.dataPath);
+            const field = [baseField, missingProperty].filter(Boolean).join('.');
+            const isImageTypeMissing = missingProperty === 'imageType';
             errors.push({
                 level: 'error',
-                field: this.normalizeSchemaPath(error.dataPath),
-                message: `配置不符合 v2.1 Schema：${error.message}`,
-                fix: `请检查 ${this.normalizeSchemaPath(error.dataPath) || 'cloudbaserc'} 字段`,
+                field,
+                message: isImageTypeMissing
+                    ? 'local/cloud 镜像构建必须显式声明 imageConfig.imageType'
+                    : `配置不符合 v2.1 Schema：${error.message}`,
+                fix: isImageTypeMissing
+                    ? '请根据镜像仓库类型填写 imageConfig.imageType: "enterprise" 或 "personal"'
+                    : `请检查 ${field || 'cloudbaserc'} 字段`,
             });
         });
     }
@@ -133,8 +146,9 @@ class ProjectValidator {
         });
     }
     /**
-     * 个人版 TCR 的 username/password/namespace 必须在 cloudbaserc 中显式声明。
-     * ConfigParser 已先解析 {{env.*}}，因此这里同时承担缺失 env 值的前置校验。
+     * 个人版 TCR 的 username/password 必须在 cloudbaserc 中显式声明。
+     * namespace/repository 可省略，分别由部署器按 envId/函数名推导。
+     * ConfigParser 已先解析 {{env.*}}，因此这里同时承担缺失凭证 env 值的前置校验。
      */
     validatePersonalRegistryConfig(config, errors) {
         ;
@@ -144,16 +158,6 @@ class ProjectValidator {
                 return;
             }
             const build = (_a = func.imageConfig) === null || _a === void 0 ? void 0 : _a.build;
-            const namespace = build === null || build === void 0 ? void 0 : build.namespace;
-            if (typeof namespace !== 'string' || !namespace.trim()) {
-                errors.push({
-                    level: 'error',
-                    resource: `functions[${index}]`,
-                    field: 'imageConfig.build.namespace',
-                    message: '个人版 TCR 缺少 namespace，或对应环境变量未赋值',
-                    fix: '声明 namespace: "{{env.TCB_TCR_NAMESPACE}}"，并在 .env* 中设置该变量',
-                });
-            }
             const credential = build === null || build === void 0 ? void 0 : build.registryCredential;
             if (!credential || typeof credential !== 'object') {
                 errors.push({
@@ -190,12 +194,10 @@ class ProjectValidator {
         return (config.functions || []).some((func) => this.isPersonalCloudFunction(func));
     }
     isPersonalCloudFunction(func) {
-        var _a, _b, _c, _d, _e, _f;
-        const registryId = (_b = (_a = func.imageConfig) === null || _a === void 0 ? void 0 : _a.registryId) !== null && _b !== void 0 ? _b : (_d = (_c = func.imageConfig) === null || _c === void 0 ? void 0 : _c.build) === null || _d === void 0 ? void 0 : _d.registryId;
-        const imageType = (_f = (_e = func.imageConfig) === null || _e === void 0 ? void 0 : _e.imageType) !== null && _f !== void 0 ? _f : (registryId ? 'enterprise' : 'personal');
+        var _a;
         return (func.type === 'HTTP' &&
             func.buildStrategy === 'cloud' &&
-            imageType === 'personal');
+            ((_a = func.imageConfig) === null || _a === void 0 ? void 0 : _a.imageType) === 'personal');
     }
     validateResources(cwd, config) {
         const errors = [];

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cloudbase/manager-node",
-    "version": "5.8.2",
+    "version": "5.8.3",
     "description": "The node manage service api for cloudbase.",
     "main": "lib/index.js",
     "scripts": {
@@ -42,7 +42,7 @@
     },
     "dependencies": {
         "@cloudbase/signature-nodejs": "^1.0.0",
-        "@cloudbase/toolbox": "~0.8.3",
+        "@cloudbase/toolbox": "~0.8.4",
         "@cloudbase/database": "^0.6.2",
         "archiver": "^3.1.1",
         "cos-nodejs-sdk-v5": "^2.14.0",

package/types/database/index.d.ts

@@ -269,5 +269,6 @@ export declare class DatabaseService {
      * @returns 任务状态详情（TaskType、Status、Phase、Reason 等）
      */
     describeTaskResult(options: IDescribeTaskResultOptions): Promise<IDescribeTaskResultResult>;
+    private getDefaultDatabaseInstanceId;
 }
 export {};

package/types/deploy/DeployOrchestrator.d.ts

@@ -1,4 +1,5 @@
 import { Environment } from '../environment';
+import { IDeployProgressEvent } from './types';
 /** 可编排的资源类型 */
 export type ResourceType = 'database' | 'functions' | 'app' | 'hosting' | 'gateway';
 /** 声明式部署选项 */
@@ -24,6 +25,11 @@ export interface IDeployOptions {
     concurrency?: number;
     /** 失败后继续部署其余资源（database 失败仍强制中断） */
     continueOnError?: boolean;
+    /** 函数资源内部部署阶段进度（校验、构建、推送、部署、等待可用、访问配置） */
+    onProgress?: (event: IDeployProgressEvent & {
+        resourceType: ResourceType;
+        resourceName: string;
+    }) => void;
     log?: {
         info?: (msg: string) => void;
         success?: (msg: string) => void;
@@ -66,7 +72,11 @@ export interface IDeployResult {
         name: string;
         ok: boolean;
         url?: string;
+        /** 资源部署器返回的结构化详情（函数包含策略、镜像、访问地址、阶段状态和耗时） */
+        detail?: Record<string, any>;
         error?: string;
+        errorCode?: string;
+        failedStage?: string;
         /** 原始异常中的请求 ID（若可提取），用于定位平台侧接口报错 */
         requestId?: string;
         /** 未执行原因：skip=未变更自动跳过；no-confirm=无确认机制保守跳过；skipped-by-user=用户拒绝覆盖 */

package/types/deploy/FunctionDeployer.d.ts

@@ -1,6 +1,9 @@
 import { Environment } from '../environment';
 import { ICloudBuildService } from './function/builders/cloud';
 import { IImagePreflightDeps } from './function/image-preflight';
+import { ILocalBuilderDeps } from './function/local-builder';
+import { ITcrApiService } from './function/enterprise-tcr';
+import { IPersonalTcrService } from './function/personal-tcr';
 import { ICheckReport, IFunctionDeployConfig, IFunctionDeployOptions, IFunctionDeployPlan, IFunctionDeployResult, INormalizedDeployConfig } from './types';
 interface ILegacyFunctionDeployResult {
     name: string;
@@ -16,7 +19,7 @@ interface ILegacyFunctionDeployResult {
  *
  * 已支持代码包、已有镜像、云端构建、本地构建、匿名访问与网关路径收敛；
  * 函数类型、运行时或协议等创建期字段变化时不会自动删除函数，而是引导用户
- * 在控制台确认并手工删除后重新部署。local 企业版 TCR 等未实现能力会显式报错。
+ * 在控制台确认并手工删除后重新部署。
  */
 export declare class FunctionDeployer {
     private readonly environment;
@@ -28,9 +31,15 @@ export declare class FunctionDeployer {
      * 测试可注入以替换打包/网络/tcb API，避免真实 IO
      */
     private readonly cloudBuildServiceFactory;
+    private readonly localBuilderDeps?;
+    private readonly tcrServiceFactory;
+    private readonly personalTcrServiceFactory;
     constructor(environment: Environment, deps?: {
         imagePreflightDeps?: IImagePreflightDeps;
         cloudBuildServiceFactory?: () => ICloudBuildService;
+        localBuilderDeps?: ILocalBuilderDeps;
+        tcrServiceFactory?: () => ITcrApiService;
+        personalTcrServiceFactory?: () => IPersonalTcrService;
     });
     /**
      * 兼容既有声明式部署入口
@@ -101,6 +110,8 @@ export declare class FunctionDeployer {
      * 由image-preflight 自动跳过地域校验，不误报。
      */
     private resolveDeployRegion;
+    private resolveEnvironmentId;
+    private requireDeployRegion;
     /**
      * 构造镜像拉取授权 Preflight 所需的 CAM 适配器
      *
@@ -125,6 +136,8 @@ export declare class FunctionDeployer {
      * 未实现的能力必须显式报错，避免用户误认为访问规则或镜像构建已经生效
      */
     private assertPlanExecutable;
+    private prepareEnterpriseBuildConfig;
+    private preparePersonalBuildConfig;
     /**
      * 准备部署物
      *
@@ -133,14 +146,19 @@ export declare class FunctionDeployer {
      * 其余策略走同步的 pack。
      */
     private prepareArtifact;
+    private resolveLocalRegistryCredential;
+    private resolveRegistryFromRepository;
     /** 生成部署物 */
     private createArtifact;
     /** 执行部署计划 */
     private applyPlan;
     /** 收敛 HTTP 函数访问配置（匿名访问 + 网关路由） */
     private applyAccessPlan;
-    /** 执行单个步骤并记录耗时与进度 */
+    /** 执行普通步骤并记录耗时与进度 */
     private runStep;
+    /** 执行带具体名称的步骤并记录耗时与进度 */
+    private runLabeledStep;
+    private executeStep;
     /** 上报进度，回调异常不影响部署流程 */
     private emitProgress;
     /** 汇总部署结果 */

package/types/deploy/StaticDeployer.d.ts

@@ -28,6 +28,17 @@ export interface IHostingDeployConfig {
     ignore?: string[];
     /** 构建时环境变量（注入本地构建进程，非敏感） */
     envVariables?: Record<string, string | number | boolean>;
+    /**
+     * 多页应用（MPA）入口文件列表，相对于产物目录，默认 ["index.html"]。
+     * 一致性上传时用于识别入口文件（内部映射为 uploadFiles 的 entryFiles）。
+     */
+    entryFile?: string[];
+    /** 发布后校验远端文件与本地产物一致（开启后走一致性上传） */
+    verify?: boolean;
+    /** 发布前备份并在上传或校验失败时自动回滚（开启后走一致性上传） */
+    safe?: boolean;
+    /** 发布成功后清理远端冗余文件（危险操作，开启后走一致性上传） */
+    prune?: boolean;
 }
 export interface IStaticDeployResult {
     name: string;

package/types/deploy/function/builders/cloud.d.ts

@@ -1,5 +1,6 @@
 import { ICustomBuildEnv, ICustomBuildSecret, ICustomBuildStep, CloudAppArtifact, CloudAppBuildStep } from '../../../cloudApp/types';
 import { INormalizedHttpCloudConfig } from '../../types';
+import { IEnterpriseTcrCredential } from '../enterprise-tcr';
 export interface ICloudBuildResult {
     imageUri: string;
     imageDigest?: string;
@@ -39,26 +40,13 @@ export interface ICloudVersionStatus {
     /** DescribeCloudAppVersion 接口返回的 RequestId，便于把构建问题反馈给平台后端定位 */
     requestId?: string;
 }
-/** 需要额外注入到构建 zip 的文件条目（zip 内路径 + 内容 + 可选 unix 权限位） */
-export interface ICloudBuildExtraEntry {
-    /** zip 包内的相对路径，如 scripts/tcr-login-and-push.sh */
-    zipPath: string;
-    /** 文件文本内容 */
-    content: string;
-    /** unix 权限位（八进制），如 0o755；脚本需可执行 */
-    mode?: number;
-}
 /**
  * 云端构建所需的外部能力，由编排器注入
  *每个方法对应构建方案（https://iwiki.woa.com/p/4020519533）的一个 API/IO 步骤
  */
 export interface ICloudBuildService {
-    /**
-     * 打包构建上下文为 ZIP，返回本地临时 zip 路径
-     * @param cwd 构建上下文目录
-     * @param extraEntries 额外注入zip 的文件（如 push 脚本），不写入用户源码目录
-     */
-    packContext: (cwd: string, extraEntries?: ICloudBuildExtraEntry[]) => Promise<string>;
+    /** 打包构建上下文为 ZIP，返回本地临时 zip 路径 */
+    packContext: (cwd: string) => Promise<string>;
     /** 获取 COS 上传凭证（DescribeCloudAppCosInfo，DeployType:custom） */
     getCosInfo: (serviceName: string) => Promise<ICloudCosInfo>;
     /** PUT 上传 zip 到 COS，必须携带全部 uploadHeaders */
@@ -72,39 +60,18 @@ export interface ICloudBuildService {
     /** 延时（便于测试注入立即返回） */
     delay: (ms: number) => Promise<void>;
 }
-/** 注入到构建上下文 zip 中的推送脚本相对路径（与 CustomSteps 的 push命令一致） */
-export declare const TCR_PUSH_SCRIPT_ZIP_PATH = "scripts/tcr-login-and-push.sh";
-/**
- * 注入到构建 zip 的 TCR/CCR 登录推送脚本（完整可运行）
- *
- * 对应构建方案（https://iwiki.woa.com/p/4020519533）「阶段 A」的 push 步骤：
- * push-image 步骤执行 `bash./scripts/tcr-login-and-push.sh`，该脚本必须随源码
- * 一同打进zip 根目录，否则云端会 `No such file or directory` 秒挂。
- *
- * 关键设计：
- * - 地域参数化：REGION 读环境变量 $TCR_REGION（由 buildEnv 按部署地域注入），
- *   避免硬编码 ap-shanghai跨地域时 AuthFailure.SignatureFailure。
- * - 双仓库兼容：设置了 $TCR_INSTANCE_ID 走企业版 TCR CreateInstanceToken；
- *   否则走个人版 CCR，用户名来自普通 Env，固定密码来自 CloudApp Secrets。
- * - 安全红线：凭证一律经 --password-stdin 传入，绝不出现在 ps/日志；
- *   不打印任何 $API_SECRET_* / token / $SECRET_TCR_PASSWORD_B64 或解码后的密码。
- *
- * 脚本内容为SDK 固定模板，不拼接任何用户输入（镜像地址等均由已校验的
- * 环境变量在容器内组装），无命令注入面。
- */
-export declare const TCR_LOGIN_PUSH_SCRIPT = "#!/usr/bin/env bash\n# scripts/tcr-login-and-push.sh\n# \u7531 CloudBase SDK \u81EA\u52A8\u6CE8\u5165\uFF1A\u4F01\u4E1A\u7248\u4F7F\u7528 STS \u6362\u53D6\u4E34\u65F6 token\uFF0C\u4E2A\u4EBA\u7248\u4F7F\u7528 CloudApp Secret\nset -euo pipefail\n\n: \"${TCR_REGISTRY:?TCR_REGISTRY \u672A\u8BBE\u7F6E}\"\n: \"${TCR_NAMESPACE:?TCR_NAMESPACE \u672A\u8BBE\u7F6E}\"\n: \"${CLOUDBASE_SERVICE_NAME:?\u5E73\u53F0\u53D8\u91CF\u7F3A\u5931}\"\n: \"${CLOUDBASE_VERSION_NAME:?\u5E73\u53F0\u53D8\u91CF\u7F3A\u5931}\"\n\nREGION=\"${TCR_REGION:-ap-shanghai}\"\nIMAGE=\"${TCR_REGISTRY}/${TCR_NAMESPACE}/${CLOUDBASE_SERVICE_NAME}:${CLOUDBASE_VERSION_NAME}\"\nIS_PERSONAL_REGISTRY=0\n\nif [ -n \"${TCR_INSTANCE_ID:-}\" ]; then\n  : \"${API_SECRET_ID:?STS \u51ED\u8BC1\u7F3A\u5931}\"\n  : \"${API_SECRET_KEY:?STS \u51ED\u8BC1\u7F3A\u5931}\"\n  : \"${API_TOKEN:?STS \u51ED\u8BC1\u7F3A\u5931}\"\n\n  # ---- \u4F01\u4E1A\u7248 TCR\uFF1ACreateInstanceToken \u6362\u767B\u5F55\u6001 ----\n  HOST=\"tcr.tencentcloudapi.com\"\n  SERVICE=\"tcr\"\n  VERSION=\"2019-09-24\"\n  ACTION=\"CreateInstanceToken\"\n  ALGORITHM=\"TC3-HMAC-SHA256\"\n  TIMESTAMP=$(date +%s)\n  DATE=$(date -u -d \"@${TIMESTAMP}\" +\"%Y-%m-%d\" 2>/dev/null || date -u -r \"${TIMESTAMP}\" +\"%Y-%m-%d\")\n\n  # \u6784\u5EFA\u9636\u6BB5\u53EA\u9700\u8981\u4E00\u6B21 docker login/push\uFF0C\u4F7F\u7528 1 \u5C0F\u65F6\u4E34\u65F6\u51ED\u8BC1\uFF0C\u907F\u514D\u521B\u5EFA\u957F\u671F\u51ED\u8BC1\u3002\n  PAYLOAD=$(printf '{\"RegistryId\":\"%s\",\"TokenType\":\"temp\"}' \"${TCR_INSTANCE_ID}\")\n  HASHED_PAYLOAD=$(printf '%s' \"${PAYLOAD}\" | openssl dgst -sha256 -hex | awk '{print $NF}')\n  CANONICAL_HEADERS=\"content-type:application/json; charset=utf-8\\nhost:${HOST}\\nx-tc-action:$(echo \"${ACTION}\" | tr '[:upper:]' '[:lower:]')\\n\"\n  SIGNED_HEADERS=\"content-type;host;x-tc-action\"\n  CANONICAL_REQUEST=\"POST\\n/\\n\\n${CANONICAL_HEADERS}\\n${SIGNED_HEADERS}\\n${HASHED_PAYLOAD}\"\n\n  CREDENTIAL_SCOPE=\"${DATE}/${SERVICE}/tc3_request\"\n  HASHED_CR=$(printf \"${CANONICAL_REQUEST}\" | openssl dgst -sha256 -hex | awk '{print $NF}')\n  STRING_TO_SIGN=\"${ALGORITHM}\\n${TIMESTAMP}\\n${CREDENTIAL_SCOPE}\\n${HASHED_CR}\"\n\n  secret_date=$(printf '%s' \"${DATE}\" | openssl dgst -sha256 -hmac \"TC3${API_SECRET_KEY}\" -hex | awk '{print $NF}')\n  secret_svc=$(printf '%s' \"${SERVICE}\" | openssl dgst -sha256 -mac HMAC -macopt hexkey:\"${secret_date}\" -hex | awk '{print $NF}')\n  secret_sign=$(printf '%s' \"tc3_request\" | openssl dgst -sha256 -mac HMAC -macopt hexkey:\"${secret_svc}\" -hex | awk '{print $NF}')\n  SIGNATURE=$(printf \"${STRING_TO_SIGN}\" | openssl dgst -sha256 -mac HMAC -macopt hexkey:\"${secret_sign}\" -hex | awk '{print $NF}')\n\n  AUTHZ=\"${ALGORITHM} Credential=${API_SECRET_ID}/${CREDENTIAL_SCOPE}, SignedHeaders=${SIGNED_HEADERS}, Signature=${SIGNATURE}\"\n\n  RESP=$(curl -sS -X POST \"https://${HOST}\" \\\n    -H \"Authorization: ${AUTHZ}\" \\\n    -H \"Content-Type: application/json; charset=utf-8\" \\\n    -H \"Host: ${HOST}\" \\\n    -H \"X-TC-Action: ${ACTION}\" \\\n    -H \"X-TC-Timestamp: ${TIMESTAMP}\" \\\n    -H \"X-TC-Version: ${VERSION}\" \\\n    -H \"X-TC-Region: ${REGION}\" \\\n    -H \"X-TC-Token: ${API_TOKEN}\" \\\n    --data \"${PAYLOAD}\")\n\n  # CloudApp custom Runner \u5DF2\u63D0\u4F9B awk\uFF08\u4E0A\u9762\u7684 TC3 \u7B7E\u540D\u4E5F\u4F9D\u8D56\u5B83\uFF09\uFF0C\u4F46\u4E0D\u4FDD\u8BC1\u5B89\u88C5 jq\u3002\n  # \u8FD9\u91CC\u5148\u9650\u5B9A\u9876\u5C42 Response \u5BF9\u8C61\uFF0C\u518D\u89E3\u6790\u5176\u4E2D\u7684\u975E\u7A7A JSON \u5B57\u7B26\u4E32\u5B57\u6BB5\uFF1B\u51ED\u8BC1\u5B57\u6BB5\n  # \u4E0D\u5141\u8BB8 JSON \u8F6C\u4E49\uFF0C\u907F\u514D\u7528 sed/grep \u5BF9\u8BA4\u8BC1\u54CD\u5E94\u505A\u5BBD\u677E\u5339\u914D\u3002\n  extract_json_string() {\n    local field=\"$1\"\n    printf '%s' \"${RESP}\" | JSON_FIELD=\"${field}\" awk '\n      BEGIN {\n        field = ENVIRON[\"JSON_FIELD\"]\n        quote = sprintf(\"%c\", 34)\n        backslash = sprintf(\"%c\", 92)\n        json = \"\"\n      }\n      { json = json $0 }\n      END {\n        response_needle = quote \"Response\" quote \"[[:space:]]*:[[:space:]]*\\{\"\n        if (!match(json, response_needle)) exit 1\n        response_start = RSTART + RLENGTH - 1\n        response = \"\"\n        depth = 0\n        in_string = 0\n        escaped = 0\n        for (i = response_start; i <= length(json); i++) {\n          ch = substr(json, i, 1)\n          response = response ch\n          if (in_string) {\n            if (escaped) escaped = 0\n            else if (ch == backslash) escaped = 1\n            else if (ch == quote) in_string = 0\n            continue\n          }\n          if (ch == quote) in_string = 1\n          else if (ch == \"{\") depth++\n          else if (ch == \"}\") {\n            depth--\n            if (depth == 0) break\n          }\n        }\n        if (depth != 0) exit 1\n\n        depth = 1\n        for (i = 2; i < length(response); i++) {\n          ch = substr(response, i, 1)\n          if (ch == \"{\") depth++\n          else if (ch == \"}\") depth--\n          else if (ch == quote) {\n            key = \"\"\n            escaped = 0\n            for (j = i + 1; j <= length(response); j++) {\n              current = substr(response, j, 1)\n              if (escaped) {\n                escaped = 0\n                key = key current\n              } else if (current == backslash) {\n                escaped = 1\n                key = key current\n              } else if (current == quote) break\n              else key = key current\n            }\n            if (j > length(response)) exit 1\n            k = j + 1\n            while (substr(response, k, 1) ~ /[[:space:]]/) k++\n            if (depth == 1 && substr(response, k, 1) == \":\" && key == field) {\n              k++\n              while (substr(response, k, 1) ~ /[[:space:]]/) k++\n              if (substr(response, k, 1) != quote) exit 1\n              value = \"\"\n              for (k = k + 1; k <= length(response); k++) {\n                current = substr(response, k, 1)\n                if (current == quote) {\n                  if (length(value) == 0) exit 1\n                  printf \"%s\", value\n                  exit 0\n                }\n                if (current == backslash) exit 2\n                value = value current\n              }\n              exit 1\n            }\n            i = j\n          }\n        }\n        exit 1\n      }\n    '\n  }\n\n  extract_tcr_error_code() {\n    printf '%s' \"${RESP}\" | awk '\n      BEGIN {\n        quote = sprintf(\"%c\", 34)\n        json = \"\"\n      }\n      { json = json $0 }\n      END {\n        error_needle = quote \"Error\" quote \"[[:space:]]*:[[:space:]]*\\{\"\n        if (!match(json, error_needle)) exit 1\n        error_json = substr(json, RSTART + RLENGTH)\n        code_needle = quote \"Code\" quote \"[[:space:]]*:[[:space:]]*\" quote\n        if (!match(error_json, code_needle)) exit 1\n        rest = substr(error_json, RSTART + RLENGTH)\n        value = \"\"\n        for (i = 1; i <= length(rest); i++) {\n          ch = substr(rest, i, 1)\n          if (ch == quote) {\n            if (length(value) == 0) exit 1\n            printf \"%s\", value\n            exit 0\n          }\n          if (ch == backslash) exit 1\n          value = value ch\n        }\n        exit 1\n      }\n    '\n  }\n\n  ERROR_CODE=$(extract_tcr_error_code || true)\n  if [ -n \"${ERROR_CODE}\" ]; then\n    case \"${ERROR_CODE}\" in\n      AuthFailure*|UnauthorizedOperation*|FailedOperation.NoPermission*)\n        echo \"\u4F01\u4E1A\u7248 TCR \u9274\u6743\u5931\u8D25\uFF0C\u8BF7\u786E\u8BA4\u5F53\u524D\u8EAB\u4EFD\u6709\u6743\u8BBF\u95EE\u8BE5\u5B9E\u4F8B\u5E76\u8C03\u7528 CreateInstanceToken\" >&2\n        exit 42\n        ;;\n      ResourceNotFound*|InvalidParameterValue.RegistryId*)\n        echo \"\u4F01\u4E1A\u7248 TCR \u5B9E\u4F8B\u4E0D\u5B58\u5728\u6216\u5B9E\u4F8B ID \u65E0\u6548\" >&2\n        exit 43\n        ;;\n      *)\n        echo \"\u4F01\u4E1A\u7248 TCR \u83B7\u53D6\u767B\u5F55\u51ED\u8BC1\u5931\u8D25\uFF1A${ERROR_CODE}\" >&2\n        exit 1\n        ;;\n    esac\n  fi\n\n  if ! TOKEN_USER=$(extract_json_string \"Username\"); then\n    ERROR_CODE=$(extract_tcr_error_code || true)\n    echo \"CreateInstanceToken \u672A\u8FD4\u56DE\u6709\u6548 Username${ERROR_CODE:+\uFF0C\u9519\u8BEF\u7801\uFF1A${ERROR_CODE}}\" >&2\n    exit 42\n  fi\n  if ! TOKEN_PASS=$(extract_json_string \"Token\"); then\n    ERROR_CODE=$(extract_tcr_error_code || true)\n    echo \"CreateInstanceToken \u672A\u8FD4\u56DE\u6709\u6548 Token${ERROR_CODE:+\uFF0C\u9519\u8BEF\u7801\uFF1A${ERROR_CODE}}\" >&2\n    exit 42\n  fi\n\n  printf '%s' \"${TOKEN_PASS}\" | docker login -u \"${TOKEN_USER}\" --password-stdin \"${TCR_REGISTRY}\"\nelse\n  # ---- \u4E2A\u4EBA\u7248 CCR\uFF1A\u8D26\u53F7 ID + \u56FA\u5B9A\u5BC6\u7801\uFF08Base64 \u5C01\u88C5\u540E\u7531 CloudApp Secrets \u6CE8\u5165\uFF09 ----\n  IS_PERSONAL_REGISTRY=1\n  : \"${TCR_USERNAME:?TCR_USERNAME \u672A\u8BBE\u7F6E}\"\n  : \"${SECRET_TCR_PASSWORD_B64:?TCR_PASSWORD \u672A\u8BBE\u7F6E}\"\n  printf '%s' \"${SECRET_TCR_PASSWORD_B64}\" | base64 --decode | docker login -u \"${TCR_USERNAME}\" --password-stdin \"${TCR_REGISTRY}\"\nfi\n\nPUSH_LOG=$(mktemp)\ntrap 'rm -f \"${PUSH_LOG}\"' EXIT\nset +e\ndocker push \"${IMAGE}\" 2>&1 | tee \"${PUSH_LOG}\"\nPUSH_STATUS=${PIPESTATUS[0]}\nset -e\n\nif [ \"${PUSH_STATUS}\" -ne 0 ]; then\n  if [ \"${IS_PERSONAL_REGISTRY}\" -eq 1 ] && {\n    grep -Fq 'LimitExceeded.ErrRepoMaxLimit' \"${PUSH_LOG}\" ||\n    grep -Fq '\u7528\u6237\u4ED3\u5E93\u5DF2\u7ECF\u8FBE\u5230\u6700\u5927\u914D\u989D' \"${PUSH_LOG}\"\n  }; then\n    echo \"\u4E2A\u4EBA\u7248 TCR \u955C\u50CF\u4ED3\u5E93\u6570\u91CF\u5DF2\u8FBE\u5230\u5F53\u524D\u5730\u57DF\u914D\u989D\uFF0C\u65E0\u6CD5\u81EA\u52A8\u521B\u5EFA\u76EE\u6807\u4ED3\u5E93\" >&2\n    exit 44\n  fi\n  exit 1\nfi\n\necho \"::output::tag=${CLOUDBASE_VERSION_NAME}\"\n";
 /** buildImageOnCloud 可选项 */
 export interface IBuildImageOnCloudOptions {
     /** 日志回调，用于透出构建进度（不含凭证） */
     onLog?: (line: string) => void;
-    /** 部署地域，注入构建环境供推送脚本换取仓库登录态（跨地域必需） */
-    region?: string;
+    /** 企业版 TCR 临时登录凭证，由 manager-node 在 CreateCloudApp 前换取 */
+    enterpriseCredential?: IEnterpriseTcrCredential;
 }
 /**
  * 执行云端构建并推送镜像
  *
  * @param config 规范化的 cloud 部署配置
  * @param service 注入的外部能力（打包/tcb API/COS 上传）
- * @param options 可选项：日志回调 onLog、部署地域 region
+ * @param options 可选项：日志回调 onLog、企业版临时登录凭证
  */
 export declare function buildImageOnCloud(config: INormalizedHttpCloudConfig, service: ICloudBuildService, options?: IBuildImageOnCloudOptions): Promise<ICloudBuildResult>;

package/types/deploy/function/enterprise-tcr.d.ts

@@ -0,0 +1,32 @@
+import { INormalizedHttpCloudConfig, INormalizedHttpLocalConfig } from '../types';
+type EnterpriseBuildConfig = INormalizedHttpCloudConfig | INormalizedHttpLocalConfig;
+export interface ITcrApiService {
+    call: (options: {
+        Action: string;
+        Param: Record<string, unknown>;
+    }) => Promise<any>;
+}
+export interface IEnterpriseTcrTarget {
+    registryId: string;
+    registry: string;
+    namespace: string;
+    repository: string;
+    imageRepository: string;
+}
+export interface IEnterpriseTcrCredential {
+    username: string;
+    token: string;
+}
+export declare function prepareEnterpriseTcrTarget(config: EnterpriseBuildConfig, options: {
+    envId: string;
+    region: string;
+    service: ITcrApiService;
+}): Promise<{
+    config: EnterpriseBuildConfig;
+    target: IEnterpriseTcrTarget;
+}>;
+export declare function createEnterpriseTcrCredential(service: ITcrApiService, registryId: string): Promise<IEnterpriseTcrCredential>;
+export declare function createTcrApiService(environment: {
+    getCommonService: (serviceType: string, serviceVersion: string) => ITcrApiService;
+}): ITcrApiService;
+export {};

package/types/deploy/function/image-tag.d.ts

@@ -0,0 +1,10 @@
+export interface IResolveImageTagOptions {
+    explicitTag?: string;
+    cwd: string;
+    now?: () => number;
+    readGitShortSha?: (cwd: string) => Promise<string | undefined>;
+}
+/**
+ * 生成镜像 tag：显式配置优先，其次 Git short SHA，最后回退到毫秒时间戳。
+ */
+export declare function resolveImageTag(options: IResolveImageTagOptions): Promise<string>;

package/types/deploy/function/local-builder.d.ts

@@ -2,25 +2,54 @@ import { INormalizedHttpLocalConfig } from '../types';
 export interface ILocalBuildResult {
     imageUri: string;
     imageDigest?: string;
+    buildDurationMs: number;
+    pushDurationMs: number;
+    durationMs: number;
 }
 export interface IExecResult {
     ok: boolean;
     stdout: string;
     stderr: string;
 }
+export interface ILocalCommandOptions {
+    env?: NodeJS.ProcessEnv;
+    input?: string;
+}
 /** 可注入依赖：命令执行与文件系统检查 */
 export interface ILocalBuilderDeps {
-    runCommand: (command: string, args: string[]) => Promise<IExecResult>;
+    runCommand: (command: string, args: string[], options?: ILocalCommandOptions) => Promise<IExecResult>;
     existsSync: (target: string) => boolean;
     isDirectory: (target: string) => boolean;
     isFile: (target: string) => boolean;
 }
+/** 本地镜像构建阶段结果 */
+export interface ILocalImageBuildResult {
+    imageUri: string;
+    buildDurationMs: number;
+}
+export interface ILocalBuilderOptions {
+    deps?: ILocalBuilderDeps;
+    commandOptions?: ILocalCommandOptions;
+}
+/** 本地构建镜像，不执行推送。 */
+export declare function buildLocalImage(config: INormalizedHttpLocalConfig, onLog?: (line: string) => void, options?: ILocalBuilderOptions): Promise<ILocalImageBuildResult>;
+/** 推送已构建镜像，并尽力查询远端 digest。 */
+export declare function pushLocalImage(imageUri: string, onLog?: (line: string) => void, options?: ILocalBuilderOptions): Promise<{
+    imageDigest?: string;
+    pushDurationMs: number;
+}>;
+export declare function loginDockerRegistry(registry: string, credential: {
+    username: string;
+    secret: string;
+}, options?: ILocalBuilderOptions): Promise<void>;
+export declare function createTemporaryDockerConfig(): {
+    env: NodeJS.ProcessEnv;
+    cleanup: () => void;
+};
 /**
- * 本地构建镜像并推送到目标仓库
+ * 本地构建镜像并推送到目标仓库。
  *
- * @param config 规范化的 local 部署配置
- * @param onLog 可选日志回调，用于透出构建输出（不含凭证）
- * @param deps 可注入依赖，默认真实命令与 fs；测试可传 mock
- * @returns 最终镜像引用与 digest
+ * 保留组合入口以兼容已有调用；需要实时阶段进度的编排器应分别调用
+ * buildLocalImage 与 pushLocalImage。
  */
 export declare function buildAndPushImage(config: INormalizedHttpLocalConfig, onLog?: (line: string) => void, deps?: ILocalBuilderDeps): Promise<ILocalBuildResult>;