@cloudbase/manager-node 5.8.2 → 5.8.4

package/lib/deploy/function/builders/cloud.js

@@ -3,7 +3,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TCR_LOGIN_PUSH_SCRIPT = exports.TCR_PUSH_SCRIPT_ZIP_PATH = void 0;
 exports.buildImageOnCloud = buildImageOnCloud;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
@@ -42,10 +41,6 @@ const POLL_MAX_INTERVAL = 30000;
 const POLL_TOTAL_TIMEOUT = 15 * 60 * 1000;
 /** 轮询临时错误最大连续重试次数，超过则判失败 */
 const POLL_MAX_TRANSIENT_ERRORS = 5;
-const TCR_REGISTRY_AUTH_EXIT_CODE = 42;
-const TCR_REGISTRY_INVALID_EXIT_CODE = 43;
-/** 个人版 TCR 自动创建目标仓库时，仓库数量已达到地域配额 */
-const TCR_PERSONAL_REPOSITORY_QUOTA_EXIT_CODE = 44;
 /** 仓库地址/命名空间/服务名等安全字符白名单：域名、路径、字母数字与常见分隔符 */
 const SAFE_REGISTRY_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9._\-/]*$/;
 /** tag 白名单：字母数字、下划线、点、中划线 */
@@ -113,263 +108,13 @@ function assertSafeBuildArgs(buildArgs) {
 }
 /** 个人版 CCR 默认域名 */
 const DEFAULT_PERSONAL_REGISTRY = 'ccr.ccs.tencentyun.com';
-/** 注入到构建上下文 zip 中的推送脚本相对路径（与 CustomSteps 的 push命令一致） */
-exports.TCR_PUSH_SCRIPT_ZIP_PATH = 'scripts/tcr-login-and-push.sh';
-/**
- * 注入到构建 zip 的 TCR/CCR 登录推送脚本（完整可运行）
- *
- * 对应构建方案（https://iwiki.woa.com/p/4020519533）「阶段 A」的 push 步骤：
- * push-image 步骤执行 `bash./scripts/tcr-login-and-push.sh`，该脚本必须随源码
- * 一同打进zip 根目录，否则云端会 `No such file or directory` 秒挂。
- *
- * 关键设计：
- * - 地域参数化：REGION 读环境变量 $TCR_REGION（由 buildEnv 按部署地域注入），
- *   避免硬编码 ap-shanghai跨地域时 AuthFailure.SignatureFailure。
- * - 双仓库兼容：设置了 $TCR_INSTANCE_ID 走企业版 TCR CreateInstanceToken；
- *   否则走个人版 CCR，用户名来自普通 Env，固定密码来自 CloudApp Secrets。
- * - 安全红线：凭证一律经 --password-stdin 传入，绝不出现在 ps/日志；
- *   不打印任何 $API_SECRET_* / token / $SECRET_TCR_PASSWORD_B64 或解码后的密码。
- *
- * 脚本内容为SDK 固定模板，不拼接任何用户输入（镜像地址等均由已校验的
- * 环境变量在容器内组装），无命令注入面。
- */
-exports.TCR_LOGIN_PUSH_SCRIPT = `#!/usr/bin/env bash
-# scripts/tcr-login-and-push.sh
-# 由 CloudBase SDK 自动注入：企业版使用 STS 换取临时 token，个人版使用 CloudApp Secret
-set -euo pipefail
-
-: "\${TCR_REGISTRY:?TCR_REGISTRY 未设置}"
-: "\${TCR_NAMESPACE:?TCR_NAMESPACE 未设置}"
-: "\${CLOUDBASE_SERVICE_NAME:?平台变量缺失}"
-: "\${CLOUDBASE_VERSION_NAME:?平台变量缺失}"
-
-REGION="\${TCR_REGION:-ap-shanghai}"
-IMAGE="\${TCR_REGISTRY}/\${TCR_NAMESPACE}/\${CLOUDBASE_SERVICE_NAME}:\${CLOUDBASE_VERSION_NAME}"
-IS_PERSONAL_REGISTRY=0
-
-if [ -n "\${TCR_INSTANCE_ID:-}" ]; then
-  : "\${API_SECRET_ID:?STS 凭证缺失}"
-  : "\${API_SECRET_KEY:?STS 凭证缺失}"
-  : "\${API_TOKEN:?STS 凭证缺失}"
-
-  # ---- 企业版 TCR：CreateInstanceToken 换登录态 ----
-  HOST="tcr.tencentcloudapi.com"
-  SERVICE="tcr"
-  VERSION="2019-09-24"
-  ACTION="CreateInstanceToken"
-  ALGORITHM="TC3-HMAC-SHA256"
-  TIMESTAMP=$(date +%s)
-  DATE=$(date -u -d "@\${TIMESTAMP}" +"%Y-%m-%d" 2>/dev/null || date -u -r "\${TIMESTAMP}" +"%Y-%m-%d")
-
-  # 构建阶段只需要一次 docker login/push，使用 1 小时临时凭证，避免创建长期凭证。
-  PAYLOAD=$(printf '{"RegistryId":"%s","TokenType":"temp"}' "\${TCR_INSTANCE_ID}")
-  HASHED_PAYLOAD=$(printf '%s' "\${PAYLOAD}" | openssl dgst -sha256 -hex | awk '{print $NF}')
-  CANONICAL_HEADERS="content-type:application/json; charset=utf-8\\nhost:\${HOST}\\nx-tc-action:$(echo "\${ACTION}" | tr '[:upper:]' '[:lower:]')\\n"
-  SIGNED_HEADERS="content-type;host;x-tc-action"
-  CANONICAL_REQUEST="POST\\n/\\n\\n\${CANONICAL_HEADERS}\\n\${SIGNED_HEADERS}\\n\${HASHED_PAYLOAD}"
-
-  CREDENTIAL_SCOPE="\${DATE}/\${SERVICE}/tc3_request"
-  HASHED_CR=$(printf "\${CANONICAL_REQUEST}" | openssl dgst -sha256 -hex | awk '{print $NF}')
-  STRING_TO_SIGN="\${ALGORITHM}\\n\${TIMESTAMP}\\n\${CREDENTIAL_SCOPE}\\n\${HASHED_CR}"
-
-  secret_date=$(printf '%s' "\${DATE}" | openssl dgst -sha256 -hmac "TC3\${API_SECRET_KEY}" -hex | awk '{print $NF}')
-  secret_svc=$(printf '%s' "\${SERVICE}" | openssl dgst -sha256 -mac HMAC -macopt hexkey:"\${secret_date}" -hex | awk '{print $NF}')
-  secret_sign=$(printf '%s' "tc3_request" | openssl dgst -sha256 -mac HMAC -macopt hexkey:"\${secret_svc}" -hex | awk '{print $NF}')
-  SIGNATURE=$(printf "\${STRING_TO_SIGN}" | openssl dgst -sha256 -mac HMAC -macopt hexkey:"\${secret_sign}" -hex | awk '{print $NF}')
-
-  AUTHZ="\${ALGORITHM} Credential=\${API_SECRET_ID}/\${CREDENTIAL_SCOPE}, SignedHeaders=\${SIGNED_HEADERS}, Signature=\${SIGNATURE}"
-
-  RESP=$(curl -sS -X POST "https://\${HOST}" \\
-    -H "Authorization: \${AUTHZ}" \\
-    -H "Content-Type: application/json; charset=utf-8" \\
-    -H "Host: \${HOST}" \\
-    -H "X-TC-Action: \${ACTION}" \\
-    -H "X-TC-Timestamp: \${TIMESTAMP}" \\
-    -H "X-TC-Version: \${VERSION}" \\
-    -H "X-TC-Region: \${REGION}" \\
-    -H "X-TC-Token: \${API_TOKEN}" \\
-    --data "\${PAYLOAD}")
-
-  # CloudApp custom Runner 已提供 awk（上面的 TC3 签名也依赖它），但不保证安装 jq。
-  # 这里先限定顶层 Response 对象，再解析其中的非空 JSON 字符串字段；凭证字段
-  # 不允许 JSON 转义，避免用 sed/grep 对认证响应做宽松匹配。
-  extract_json_string() {
-    local field="$1"
-    printf '%s' "\${RESP}" | JSON_FIELD="\${field}" awk '
-      BEGIN {
-        field = ENVIRON["JSON_FIELD"]
-        quote = sprintf("%c", 34)
-        backslash = sprintf("%c", 92)
-        json = ""
-      }
-      { json = json $0 }
-      END {
-        response_needle = quote "Response" quote "[[:space:]]*:[[:space:]]*\\{"
-        if (!match(json, response_needle)) exit 1
-        response_start = RSTART + RLENGTH - 1
-        response = ""
-        depth = 0
-        in_string = 0
-        escaped = 0
-        for (i = response_start; i <= length(json); i++) {
-          ch = substr(json, i, 1)
-          response = response ch
-          if (in_string) {
-            if (escaped) escaped = 0
-            else if (ch == backslash) escaped = 1
-            else if (ch == quote) in_string = 0
-            continue
-          }
-          if (ch == quote) in_string = 1
-          else if (ch == "{") depth++
-          else if (ch == "}") {
-            depth--
-            if (depth == 0) break
-          }
-        }
-        if (depth != 0) exit 1
-
-        depth = 1
-        for (i = 2; i < length(response); i++) {
-          ch = substr(response, i, 1)
-          if (ch == "{") depth++
-          else if (ch == "}") depth--
-          else if (ch == quote) {
-            key = ""
-            escaped = 0
-            for (j = i + 1; j <= length(response); j++) {
-              current = substr(response, j, 1)
-              if (escaped) {
-                escaped = 0
-                key = key current
-              } else if (current == backslash) {
-                escaped = 1
-                key = key current
-              } else if (current == quote) break
-              else key = key current
-            }
-            if (j > length(response)) exit 1
-            k = j + 1
-            while (substr(response, k, 1) ~ /[[:space:]]/) k++
-            if (depth == 1 && substr(response, k, 1) == ":" && key == field) {
-              k++
-              while (substr(response, k, 1) ~ /[[:space:]]/) k++
-              if (substr(response, k, 1) != quote) exit 1
-              value = ""
-              for (k = k + 1; k <= length(response); k++) {
-                current = substr(response, k, 1)
-                if (current == quote) {
-                  if (length(value) == 0) exit 1
-                  printf "%s", value
-                  exit 0
-                }
-                if (current == backslash) exit 2
-                value = value current
-              }
-              exit 1
-            }
-            i = j
-          }
-        }
-        exit 1
-      }
-    '
-  }
-
-  extract_tcr_error_code() {
-    printf '%s' "\${RESP}" | awk '
-      BEGIN {
-        quote = sprintf("%c", 34)
-        json = ""
-      }
-      { json = json $0 }
-      END {
-        error_needle = quote "Error" quote "[[:space:]]*:[[:space:]]*\\{"
-        if (!match(json, error_needle)) exit 1
-        error_json = substr(json, RSTART + RLENGTH)
-        code_needle = quote "Code" quote "[[:space:]]*:[[:space:]]*" quote
-        if (!match(error_json, code_needle)) exit 1
-        rest = substr(error_json, RSTART + RLENGTH)
-        value = ""
-        for (i = 1; i <= length(rest); i++) {
-          ch = substr(rest, i, 1)
-          if (ch == quote) {
-            if (length(value) == 0) exit 1
-            printf "%s", value
-            exit 0
-          }
-          if (ch == backslash) exit 1
-          value = value ch
-        }
-        exit 1
-      }
-    '
-  }
-
-  ERROR_CODE=$(extract_tcr_error_code || true)
-  if [ -n "\${ERROR_CODE}" ]; then
-    case "\${ERROR_CODE}" in
-      AuthFailure*|UnauthorizedOperation*|FailedOperation.NoPermission*)
-        echo "企业版 TCR 鉴权失败，请确认当前身份有权访问该实例并调用 CreateInstanceToken" >&2
-        exit ${TCR_REGISTRY_AUTH_EXIT_CODE}
-        ;;
-      ResourceNotFound*|InvalidParameterValue.RegistryId*)
-        echo "企业版 TCR 实例不存在或实例 ID 无效" >&2
-        exit ${TCR_REGISTRY_INVALID_EXIT_CODE}
-        ;;
-      *)
-        echo "企业版 TCR 获取登录凭证失败：\${ERROR_CODE}" >&2
-        exit 1
-        ;;
-    esac
-  fi
-
-  if ! TOKEN_USER=$(extract_json_string "Username"); then
-    ERROR_CODE=$(extract_tcr_error_code || true)
-    echo "CreateInstanceToken 未返回有效 Username\${ERROR_CODE:+，错误码：\${ERROR_CODE}}" >&2
-    exit ${TCR_REGISTRY_AUTH_EXIT_CODE}
-  fi
-  if ! TOKEN_PASS=$(extract_json_string "Token"); then
-    ERROR_CODE=$(extract_tcr_error_code || true)
-    echo "CreateInstanceToken 未返回有效 Token\${ERROR_CODE:+，错误码：\${ERROR_CODE}}" >&2
-    exit ${TCR_REGISTRY_AUTH_EXIT_CODE}
-  fi
-
-  printf '%s' "\${TOKEN_PASS}" | docker login -u "\${TOKEN_USER}" --password-stdin "\${TCR_REGISTRY}"
-else
-  # ---- 个人版 CCR：账号 ID + 固定密码（Base64 封装后由 CloudApp Secrets 注入） ----
-  IS_PERSONAL_REGISTRY=1
-  : "\${TCR_USERNAME:?TCR_USERNAME 未设置}"
-  : "\${SECRET_TCR_PASSWORD_B64:?TCR_PASSWORD 未设置}"
-  printf '%s' "\${SECRET_TCR_PASSWORD_B64}" | base64 --decode | docker login -u "\${TCR_USERNAME}" --password-stdin "\${TCR_REGISTRY}"
-fi
-
-PUSH_LOG=$(mktemp)
-trap 'rm -f "\${PUSH_LOG}"' EXIT
-set +e
-docker push "\${IMAGE}" 2>&1 | tee "\${PUSH_LOG}"
-PUSH_STATUS=\${PIPESTATUS[0]}
-set -e
-
-if [ "\${PUSH_STATUS}" -ne 0 ]; then
-  if [ "\${IS_PERSONAL_REGISTRY}" -eq 1 ] && {
-    grep -Fq 'LimitExceeded.ErrRepoMaxLimit' "\${PUSH_LOG}" ||
-    grep -Fq '用户仓库已经达到最大配额' "\${PUSH_LOG}"
-  }; then
-    echo "个人版 TCR 镜像仓库数量已达到当前地域配额，无法自动创建目标仓库" >&2
-    exit ${TCR_PERSONAL_REPOSITORY_QUOTA_EXIT_CODE}
-  fi
-  exit 1
-fi
-
-echo "::output::tag=\${CLOUDBASE_VERSION_NAME}"
-`;
 function resolveTarget(config) {
-    const build = config.build;
+    const build = config.imageConfig.build;
+    const imageType = config.imageConfig.imageType;
     const repository = (build.repository || config.name).trim();
     const rawRegistryId = build.registryId;
     const registryId = typeof rawRegistryId === 'string' ? rawRegistryId.trim() : rawRegistryId;
-    const isEnterprise = config.imageType === 'enterprise' || Boolean(registryId);
+    const isEnterprise = imageType === 'enterprise' || Boolean(registryId);
     // CloudApp custom 构建与推送必须使用同一个平台版本 tag。
     // 若允许自定义 tag，build-image 会构建自定义 tag，而固定推送脚本会推
     // $CLOUDBASE_VERSION_NAME，最终必然找不到本地镜像。
@@ -384,10 +129,6 @@ function resolveTarget(config) {
     let hasExplicitRegistry = false;
     let namespace = (build.namespace || '').trim();
     let imageName = repository;
-    if (!isEnterprise && !namespace) {
-        throw new error_1.CloudBaseError('个人版 TCR 云端构建缺少 build.namespace；请在 cloudbaserc 中显式声明，' +
-            '推荐使用 "{{env.TCB_TCR_NAMESPACE}}"', { code: types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID });
-    }
     if (repository.includes('/')) {
         assertSafeRegistryToken(repository, 'build.repository');
         const parts = repository.split('/').filter(Boolean);
@@ -415,10 +156,10 @@ function resolveTarget(config) {
         throw new error_1.CloudBaseError('cloud 策略缺少 TCR 命名空间，请配置 build.namespace 或在完整 repository 中声明', { code: types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID });
     }
     assertSafeRegistryToken(namespace, 'TCR namespace');
-    if (config.imageType === 'personal' && registryId) {
+    if (imageType === 'personal' && registryId) {
         throw new error_1.CloudBaseError('cloud 策略的 personal 镜像不能配置 build.registryId；请移除该字段或改用 enterprise', { code: types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID });
     }
-    if (config.imageType === 'enterprise') {
+    if (imageType === 'enterprise') {
         if (rawRegistryId === undefined || rawRegistryId === null) {
             throw new error_1.CloudBaseError('cloud 策略的企业版 TCR 未配置 build.registryId；如果当前没有企业版实例，请改用 imageType=personal', { code: types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_MISSING });
         }
@@ -443,9 +184,10 @@ function resolveTarget(config) {
  * CustomSteps 只包含 SDK 固定命令和经过白名单校验的 build arg key。
  */
 function resolveCloudBuildOptions(config) {
-    const dockerfile = config.build.dockerfile || types_1.DEFAULT_DOCKERFILE;
-    const platform = config.build.platform || types_1.DEFAULT_IMAGE_PLATFORM;
-    const buildArgs = config.build.buildArgs || {};
+    const build = config.imageConfig.build;
+    const dockerfile = build.dockerfile || types_1.DEFAULT_DOCKERFILE;
+    const platform = build.platform || types_1.DEFAULT_IMAGE_PLATFORM;
+    const buildArgs = build.buildArgs || {};
     assertSafeDockerfile(dockerfile);
     if (platform !== types_1.DEFAULT_IMAGE_PLATFORM) {
         throw new error_1.CloudBaseError(`当前仅支持构建 ${types_1.DEFAULT_IMAGE_PLATFORM} 镜像`, {
@@ -457,7 +199,7 @@ function resolveCloudBuildOptions(config) {
         dockerfile,
         platform,
         buildArgs,
-        forceBuild: config.build.forceBuild === true
+        forceBuild: build.forceBuild === true
     };
 }
 /**
@@ -465,14 +207,23 @@ function resolveCloudBuildOptions(config) {
  *
  * Dockerfile、platform 和 build arg value 通过 CloudApp Env 注入；只有通过严格
  * ENV key 校验的 build arg key 会进入固定 command。forceBuild 显式映射为 --no-cache。
+ *
+ * push-image 直接在 CloudApp 构建容器内执行 docker login 与 docker push：
+ * 登录凭证一律经 --password-stdin 传入，不落 ps/日志，也不再向构建上下文注入脚本文件。
  */
-function buildCustomSteps(options) {
+function buildCustomSteps(options, isEnterpriseRegistry) {
     const buildArgs = Object.keys(options.buildArgs)
         .sort()
         .map(key => `--build-arg ${key}="$BUILD_ARG_${key}"`)
         .join(' ');
     const noCache = options.forceBuild ? ' --no-cache' : '';
     const extraArgs = buildArgs ? ` ${buildArgs}` : '';
+    const image = '"$TCR_REGISTRY/$TCR_NAMESPACE/$CLOUDBASE_SERVICE_NAME:$CLOUDBASE_VERSION_NAME"';
+    // 企业版临时登录凭证由 manager-node 在 CreateCloudApp 前换取并经 CloudApp Secrets 注入；
+    // 个人版沿用账号 ID 与 Base64 封装的固定密码 Secret，容器内解码后直接送入 stdin。
+    const loginCommand = isEnterpriseRegistry
+        ? 'printf \'%s\' "$SECRET_TCR_TOKEN_PASSWORD" | docker login -u "$SECRET_TCR_TOKEN_USERNAME" --password-stdin "$TCR_REGISTRY"'
+        : 'printf \'%s\' "$SECRET_TCR_PASSWORD_B64" | base64 --decode | docker login -u "$TCR_USERNAME" --password-stdin "$TCR_REGISTRY"';
     return [
         {
             name: 'build-image',
@@ -481,24 +232,17 @@ function buildCustomSteps(options) {
                 ' -f "$CLOUDBASE_DOCKERFILE"' +
                 noCache +
                 extraArgs +
-                ' -t $TCR_REGISTRY/$TCR_NAMESPACE/$CLOUDBASE_SERVICE_NAME:$CLOUDBASE_VERSION_NAME .'
+                ` -t ${image} .`
         },
         {
             name: 'push-image',
-            command: 'bash ./scripts/tcr-login-and-push.sh'
+            command: `${loginCommand} && docker push ${image}`
         }
     ];
 }
-/**
- * 组装 custom 构建的环境变量（用户可控值已校验，此处只做键值透传）
- *
- * - TCR_REGION：部署地域，供推送脚本换取镜像仓库登录态时签名/请求用，
- *   缺省交由脚本回退默认地域；参数化后跨地域不会 SignatureFailure。
- * - TCR_INSTANCE_ID：仅企业版 TCR 注入，脚本据此走 CreateInstanceToken 分支；
- *   个人版 CCR 不注入，脚本走 STS 直接 docker login 分支。
- */
-function buildEnv(target, buildOptions, region) {
-    const env = [
+/** 组装 custom 构建的环境变量（用户可控值已校验，此处只做键值透传） */
+function buildEnv(target, buildOptions) {
+    return [
         { key: 'TCR_REGISTRY', value: target.registry },
         { key: 'TCR_NAMESPACE', value: target.namespace },
         { key: 'CLOUDBASE_DOCKERFILE', value: buildOptions.dockerfile },
@@ -508,27 +252,29 @@ function buildEnv(target, buildOptions, region) {
             value
         }))
     ];
-    if (region) {
-        env.push({ key: 'TCR_REGION', value: region });
-    }
-    if (target.registryId) {
-        assertSafeRegistryToken(target.registryId, 'registryId');
-        env.push({ key: 'TCR_INSTANCE_ID', value: target.registryId });
-    }
-    return env;
 }
 /**
- * 组装个人版 TCR 凭证。
- * username 可作为普通构建变量；password 必须进入 CloudApp Secrets。
+ * 组装 TCR 登录凭证。
+ * 企业版使用 manager-node 预先换取的临时 Username/Token；个人版 username 可作为
+ * 普通构建变量，password 必须经 Base64 封装后进入 CloudApp Secrets。
  */
-function buildRegistryCredentials(config, target) {
+function buildRegistryCredentials(config, target, enterpriseCredential) {
     var _a;
     if (target.registryId) {
-        return { env: [] };
+        if (!(enterpriseCredential === null || enterpriseCredential === void 0 ? void 0 : enterpriseCredential.username) || !(enterpriseCredential === null || enterpriseCredential === void 0 ? void 0 : enterpriseCredential.token)) {
+            throw new error_1.CloudBaseError('企业版 TCR 云端构建缺少临时登录凭证，请确认当前身份具备 CreateInstanceToken 权限', { code: types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_MISSING });
+        }
+        return {
+            env: [],
+            secrets: [
+                { name: 'TCR_TOKEN_USERNAME', value: enterpriseCredential.username },
+                { name: 'TCR_TOKEN_PASSWORD', value: enterpriseCredential.token }
+            ]
+        };
     }
-    const credential = config.build.registryCredential;
+    const credential = config.imageConfig.build.registryCredential;
     if (!credential) {
-        throw new error_1.CloudBaseError('个人版 TCR 云端构建缺少 build.registryCredential；请在 cloudbaserc 中显式声明 ' +
+        throw new error_1.CloudBaseError('个人版 TCR 云端构建缺少 imageConfig.build.registryCredential；请在 cloudbaserc 中显式声明 ' +
             'username/password，推荐分别使用 "{{env.TCB_TCR_USERNAME}}" 和 ' +
             '"{{env.TCB_TCR_PASSWORD}}"', { code: types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_MISSING });
     }
@@ -552,7 +298,7 @@ function buildRegistryCredentials(config, target) {
     };
 }
 function resolveCloudBuildContext(config, dockerfile) {
-    const cwd = path_1.default.resolve(config.build.cwd || config.functionPath || process.cwd());
+    const cwd = path_1.default.resolve(config.imageConfig.build.cwd || config.functionPath || process.cwd());
     const dockerfilePath = path_1.default.resolve(cwd, dockerfile);
     let stat = null;
     try {
@@ -581,35 +327,9 @@ function resolveImageUri(target, versionName, artifacts) {
     const imageUri = `${target.registry}/${target.namespace}/${target.serviceName}:${versionName}`;
     return { imageUri, imageDigest: imageArtifact === null || imageArtifact === void 0 ? void 0 : imageArtifact.Digest };
 }
-/** 判断企业版 TCR 推送步骤是否因实例鉴权失败 */
-function isRegistryAuthFailure(steps) {
-    return (steps || []).some(step => {
-        var _a;
-        return (step === null || step === void 0 ? void 0 : step.Name) === 'push-image' &&
-            ((_a = step === null || step === void 0 ? void 0 : step.Status) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'failed' &&
-            step.ExitCode === TCR_REGISTRY_AUTH_EXIT_CODE;
-    });
-}
-/** 判断企业版 TCR 推送步骤是否因实例 ID 无效失败 */
-function isRegistryIdFailure(steps) {
-    return (steps || []).some(step => {
-        var _a;
-        return (step === null || step === void 0 ? void 0 : step.Name) === 'push-image' &&
-            ((_a = step === null || step === void 0 ? void 0 : step.Status) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'failed' &&
-            step.ExitCode === TCR_REGISTRY_INVALID_EXIT_CODE;
-    });
-}
-/** 判断个人版 TCR 是否因自动创建目标仓库时达到仓库数量配额而失败 */
-function isPersonalRepositoryQuotaFailure(target, steps) {
-    if (target.registryId) {
-        return false;
-    }
-    return (steps || []).some(step => {
-        var _a;
-        return (step === null || step === void 0 ? void 0 : step.Name) === 'push-image' &&
-            ((_a = step === null || step === void 0 ? void 0 : step.Status) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'failed' &&
-            step.ExitCode === TCR_PERSONAL_REPOSITORY_QUOTA_EXIT_CODE;
-    });
+/** 判断失败是否发生在 push-image 步骤，用于给出针对性的排查引导 */
+function isPushStepFailure(steps) {
+    return (steps || []).some(step => { var _a; return (step === null || step === void 0 ? void 0 : step.Name) === 'push-image' && ((_a = step === null || step === void 0 ? void 0 : step.Status) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'failed'; });
 }
 /** 汇总失败 Step 的定位信息（脱敏：只取步骤名/状态/退出码，不含日志明文） */
 function summarizeFailedSteps(steps) {
@@ -629,25 +349,19 @@ function summarizeFailedSteps(steps) {
  *
  * @param config 规范化的 cloud 部署配置
  * @param service 注入的外部能力（打包/tcb API/COS 上传）
- * @param options 可选项：日志回调 onLog、部署地域 region
+ * @param options 可选项：日志回调 onLog、企业版临时登录凭证
  */
 async function buildImageOnCloud(config, service, options = {}) {
-    const { onLog, region } = options;
+    const { onLog, enterpriseCredential } = options;
     const target = resolveTarget(config);
     const buildOptions = resolveCloudBuildOptions(config);
     // 在打包和上传前完成真实消费字段校验，避免无效配置触发远端资源操作。
-    const registryCredentials = buildRegistryCredentials(config, target);
+    const registryCredentials = buildRegistryCredentials(config, target, enterpriseCredential);
     const serviceName = target.serviceName;
     const cwd = resolveCloudBuildContext(config, buildOptions.dockerfile);
-    // 1. 打包构建上下文（注入 push 脚本，不污染用户源码目录）
+    // 1. 只打包用户构建上下文；登录推送逻辑已收敛到 CloudApp CustomStep 命令
     onLog === null || onLog === void 0 ? void 0 : onLog('打包构建上下文');
-    const zipPath = await service.packContext(cwd, [
-        {
-            zipPath: exports.TCR_PUSH_SCRIPT_ZIP_PATH,
-            content: exports.TCR_LOGIN_PUSH_SCRIPT,
-            mode: 0o755
-        }
-    ]);
+    const zipPath = await service.packContext(cwd);
     try {
         // 2. 获取 COS 上传凭证
         onLog === null || onLog === void 0 ? void 0 : onLog('获取 COS 上传凭证');
@@ -665,12 +379,9 @@ async function buildImageOnCloud(config, service, options = {}) {
         const created = await service.createBuild({
             serviceName,
             cosTimestamp: cosInfo.unixTimestamp,
-            env: [
-                ...buildEnv(target, buildOptions, region),
-                ...registryCredentials.env
-            ],
+            env: [...buildEnv(target, buildOptions), ...registryCredentials.env],
             secrets: registryCredentials.secrets,
-            customSteps: buildCustomSteps(buildOptions)
+            customSteps: buildCustomSteps(buildOptions, Boolean(target.registryId))
         });
         if (!(created === null || created === void 0 ? void 0 : created.versionName)) {
             throw new error_1.CloudBaseError('触发云端构建失败：返回缺少 VersionName', {
@@ -693,27 +404,15 @@ async function buildImageOnCloud(config, service, options = {}) {
             const reqId = finalStatus.requestId
                 ? `，requestId=${finalStatus.requestId}`
                 : '';
-            const registryAuthFailure = isRegistryAuthFailure(finalStatus.steps);
-            const registryIdFailure = isRegistryIdFailure(finalStatus.steps);
-            const personalRepositoryQuotaFailure = isPersonalRepositoryQuotaFailure(target, finalStatus.steps);
+            // 登录凭证与目标仓库均在触发构建前由 manager-node 校验并准备，
+            // 因此这里只区分取消与失败，具体原因以构建日志中的 docker 输出为准。
             const code = finalStatus.status === 'CANCELED'
                 ? types_1.FUNCTION_DEPLOY_ERROR.CLOUD_BUILD_CANCELED
-                : registryAuthFailure
-                    ? types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_AUTH_FAILED
-                    : registryIdFailure
-                        ? types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_INVALID
-                        : personalRepositoryQuotaFailure
-                            ? types_1.FUNCTION_DEPLOY_ERROR.CLOUD_PERSONAL_REGISTRY_REPOSITORY_QUOTA_EXCEEDED
-                            : types_1.FUNCTION_DEPLOY_ERROR.CLOUD_BUILD_FAILED;
-            const guidance = finalStatus.status === 'CANCELED'
+                : types_1.FUNCTION_DEPLOY_ERROR.CLOUD_BUILD_FAILED;
+            const guidance = finalStatus.status === 'CANCELED' || !isPushStepFailure(finalStatus.steps)
                 ? ''
-                : registryAuthFailure
-                    ? '；企业版 TCR 鉴权失败，请确认实例属于当前账号/地域，且当前身份拥有 CreateInstanceToken 和仓库推送权限'
-                    : registryIdFailure
-                        ? '；企业版 TCR 实例不存在或实例 ID 无效，请检查 build.registryId 对应的环境变量和实例状态'
-                        : personalRepositoryQuotaFailure
-                            ? '；个人版 TCR 当前地域的镜像仓库数量已达到配额，目标仓库无法自动创建。请在容器镜像服务个人版中删除不再使用的仓库（删除前请备份其中镜像），或将 build.repository 改为已有仓库；如需更多仓库，请切换企业版 TCR。实际配额请以控制台为准'
-                            : '';
+                : '；推送镜像失败，请在云开发控制台查看构建日志中的 docker login/push 输出，' +
+                    '并确认镜像仓库凭证、命名空间与仓库配额';
             throw new error_1.CloudBaseError(`云端构建未成功（${finalStatus.status}）${detail}${reqId}${guidance}`, { code });
         }
         // 6. 得到不可变镜像地址与digest

package/lib/deploy/function/cam-preflight.js

@@ -74,9 +74,10 @@ function needsImagePullAuth(config) {
 }
 /** 只有企业版 cloud 策略需要 CloudApp 向企业版 TCR 推送镜像 */
 function needsEnterpriseTcrPushAuth(config) {
+    var _a;
     return (config.type === 'HTTP' &&
         config.buildStrategy === 'cloud' &&
-        config.imageType === 'enterprise');
+        ((_a = config.imageConfig) === null || _a === void 0 ? void 0 : _a.imageType) === 'enterprise');
 }
 function resolveRequirements(config) {
     const requirements = [];

package/lib/deploy/function/cloud-build-service.js

@@ -60,32 +60,18 @@ const DEFAULT_IGNORE = [
 function createCloudBuildService(cloudApp, options = {}) {
     const ignore = [...DEFAULT_IGNORE, ...(options.ignore || [])];
     return {
-        async packContext(cwd, extraEntries) {
+        async packContext(cwd) {
             if (!fs_1.default.existsSync(cwd) || !fs_1.default.statSync(cwd).isDirectory()) {
                 throw new error_1.CloudBaseError(`构建上下文目录不存在或不是目录：${cwd}`, {
                     code: types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONTEXT_INVALID
                 });
             }
             const zipPath = path_1.default.join(os_1.default.tmpdir(), `fn-cloud-build-${Date.now()}-${Math.random().toString(36).slice(2)}.zip`);
-            const injectedEntries = (extraEntries || []).map(entry => ({
-                zipPath: entry.zipPath.replace(/\\/g, '/').replace(/^\.\//, ''),
-                content: entry.content,
-                mode: entry.mode
-            }));
-            // 源码中若存在与 SDK 注入文件同名的路径，必须从 glob 中排除，
-            // 避免 ZIP 出现重复 entry 后由解压顺序决定最终执行内容。
-            const contextIgnore = [
-                ...ignore,
-                ...injectedEntries.map(entry => entry.zipPath)
-            ];
-            // 把 SDK 注入的辅助文件（如 push 脚本）随源码一起打进zip，
-            // 通过临时文件注入，绝不写入用户源码目录。
             try {
                 await (0, utils_1.compressToZip)({
                     dirPath: cwd,
                     outputPath: zipPath,
-                    ignore: contextIgnore,
-                    extraEntries: injectedEntries
+                    ignore
                 });
             }
             catch (error) {