@cloudbase/manager-node 5.8.2 → 5.8.4

package/lib/deploy/function/config-guard.js

@@ -6,6 +6,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseImageReference = parseImageReference;
 exports.normalizeGatewayPath = normalizeGatewayPath;
 exports.isCustomImageRuntime = isCustomImageRuntime;
+exports.applyMinimalDeployConfigDefaults = applyMinimalDeployConfigDefaults;
+exports.getMissingDeployInputs = getMissingDeployInputs;
+exports.prepareMinimalDeployConfig = prepareMinimalDeployConfig;
 exports.normalizeDeployConfig = normalizeDeployConfig;
 exports.checkDeployConfig = checkDeployConfig;
 exports.assertDeployConfig = assertDeployConfig;
@@ -29,7 +32,7 @@ const IMAGE_TAG_PATTERN = /^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$/;
 /** 镜像 digest 规则 */
 const IMAGE_DIGEST_PATTERN = /^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-fA-F0-9]{32,}$/;
 /** 镜像仓库路径规则 */
-const IMAGE_REPOSITORY_PATTERN = /^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*$/;
+const IMAGE_REPOSITORY_PATTERN = /^[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9][a-z0-9._-]*)*$/;
 /** 网关路径字符白名单，避免注入与歧义字符 */
 const GATEWAY_PATH_PATTERN = /^[A-Za-z0-9\-._~%/:@]+$/;
 /** 环境变量与构建参数名规则 */
@@ -163,18 +166,151 @@ function inferHttpBuildStrategy(config) {
     if (config === null || config === void 0 ? void 0 : config.buildStrategy) {
         return config.buildStrategy;
     }
-    if (config === null || config === void 0 ? void 0 : config.imageConfig) {
-        return 'image';
-    }
-    if (config === null || config === void 0 ? void 0 : config.build) {
+    const imageConfig = config === null || config === void 0 ? void 0 : config.imageConfig;
+    if (imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.build) {
         // 有构建上下文但未声明策略时，默认使用无需本地 Docker 的云端构建
         return 'cloud';
     }
+    if (imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.imageUri) {
+        return 'image';
+    }
     if (isCustomImageRuntime(config === null || config === void 0 ? void 0 : config.runtime)) {
         return 'image';
     }
     return 'zip';
 }
+/**
+ * 应用最小化镜像配置的可安全默认值，不执行 IO，不生成凭证。
+ * 仅填充构建上下文、仓库名、namespace 和运行时固定值；用户凭证必须显式传入。
+ *
+ * 直接在 cloudbaserc 的嵌套形状上操作：镜像字段位于 imageConfig，构建目标位于
+ * imageConfig.build，不再做字段平铺映射。
+ */
+function applyMinimalDeployConfigDefaults(config, context = {}) {
+    var _a, _b, _c, _d, _e, _f, _g;
+    const result = lodash_1.default.cloneDeep(config);
+    if ((result === null || result === void 0 ? void 0 : result.type) !== 'HTTP') {
+        return result;
+    }
+    const strategy = inferHttpBuildStrategy(result);
+    if (!['image', 'local', 'cloud'].includes(strategy)) {
+        return result;
+    }
+    result.buildStrategy = strategy;
+    const imageConfig = Object.assign({}, (result.imageConfig || {}));
+    result.imageConfig = imageConfig;
+    if (strategy === 'image') {
+        if (imageConfig.imageUri === undefined && ((_a = context.defaults) === null || _a === void 0 ? void 0 : _a.imageUri) !== undefined) {
+            imageConfig.imageUri = context.defaults.imageUri;
+        }
+        return result;
+    }
+    if (result.runtime === undefined) {
+        result.runtime = types_1.CUSTOM_IMAGE_RUNTIME;
+    }
+    if (imageConfig.imagePort === undefined) {
+        imageConfig.imagePort = types_1.IMAGE_FUNCTION_PORT;
+    }
+    const build = Object.assign({}, (imageConfig.build || {}));
+    imageConfig.build = build;
+    const functionPath = context.functionPath ||
+        (context.functionRootPath && result.name ? `${context.functionRootPath}/${result.name}` : undefined);
+    if (build.cwd === undefined && functionPath) {
+        build.cwd = functionPath;
+    }
+    if (build.dockerfile === undefined) {
+        build.dockerfile = types_1.DEFAULT_DOCKERFILE;
+    }
+    if (build.platform === undefined) {
+        build.platform = types_1.DEFAULT_IMAGE_PLATFORM;
+    }
+    const defaultRepository = (_c = (_b = context.defaults) === null || _b === void 0 ? void 0 : _b.repository) !== null && _c !== void 0 ? _c : result.name;
+    const defaultNamespace = (_e = (_d = context.defaults) === null || _d === void 0 ? void 0 : _d.namespace) !== null && _e !== void 0 ? _e : context.envId;
+    if (build.repository === undefined && defaultRepository !== undefined) {
+        build.repository = defaultRepository;
+    }
+    if (build.namespace === undefined && defaultNamespace !== undefined) {
+        build.namespace = defaultNamespace;
+    }
+    if (imageConfig.registryId === undefined && ((_f = context.defaults) === null || _f === void 0 ? void 0 : _f.registryId) !== undefined) {
+        imageConfig.registryId = context.defaults.registryId;
+    }
+    if (build.registryCredential === undefined && ((_g = context.defaults) === null || _g === void 0 ? void 0 : _g.registryCredential) !== undefined) {
+        build.registryCredential = lodash_1.default.cloneDeep(context.defaults.registryCredential);
+    }
+    return result;
+}
+/**
+ * 返回最小化部署在当前配置下仍缺失的输入字段；不执行网络、文件或凭证操作。
+ */
+function getMissingDeployInputs(config, context = {}) {
+    var _a, _b, _c;
+    const normalized = lodash_1.default.cloneDeep(config);
+    const missing = [];
+    if ((normalized === null || normalized === void 0 ? void 0 : normalized.type) !== 'HTTP') {
+        return missing;
+    }
+    const strategy = (_a = normalized.buildStrategy) !== null && _a !== void 0 ? _a : inferHttpBuildStrategy(normalized);
+    if (!['image', 'local', 'cloud'].includes(strategy)) {
+        return missing;
+    }
+    const imageConfig = normalized.imageConfig || {};
+    if (strategy === 'image') {
+        if (!imageConfig.imageUri) {
+            missing.push({ name: 'imageUri', path: 'imageConfig.imageUri', required: true, reason: '已有镜像部署需要固定 tag 或 digest 的 imageUri' });
+        }
+        return missing;
+    }
+    const build = imageConfig.build || {};
+    const imageType = imageConfig.imageType || (imageConfig.registryId || build.registryId ? 'enterprise' : 'personal');
+    if (imageType === 'enterprise') {
+        if (!imageConfig.registryId && !build.registryId) {
+            missing.push({ name: 'registryId', path: 'imageConfig.registryId', required: true, reason: '企业版镜像构建需要指定 TCR 实例 ID' });
+        }
+        if (!build.repository) {
+            missing.push({ name: 'repository', path: 'imageConfig.build.repository', required: true, reason: '企业版镜像构建需要目标仓库' });
+        }
+        return missing;
+    }
+    const namespace = build.namespace || context.envId;
+    if (!namespace) {
+        missing.push({ name: 'namespace', path: 'imageConfig.build.namespace', required: true, reason: '个人版镜像构建需要 namespace，且无法从 envId 推导' });
+    }
+    if (!((_b = build.registryCredential) === null || _b === void 0 ? void 0 : _b.username)) {
+        missing.push({ name: 'registryCredential.username', path: 'imageConfig.build.registryCredential.username', required: true, reason: '个人版 TCR 构建需要推送用户名' });
+    }
+    if (!((_c = build.registryCredential) === null || _c === void 0 ? void 0 : _c.password)) {
+        missing.push({ name: 'registryCredential.password', path: 'imageConfig.build.registryCredential.password', required: true, reason: '个人版 TCR 构建需要推送密码' });
+    }
+    return missing;
+}
+/**
+ * 生成最小化配置准备结果：先应用安全默认值，再返回剩余缺失字段和默认值路径。
+ */
+function prepareMinimalDeployConfig(config, context = {}) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3;
+    const prepared = applyMinimalDeployConfigDefaults(config, context);
+    const missing = getMissingDeployInputs(prepared, { envId: context.envId });
+    const original = lodash_1.default.cloneDeep(config);
+    const preparedAny = prepared;
+    const appliedDefaults = [];
+    const candidates = [
+        ['imageConfig.imageUri', (_a = original.imageConfig) === null || _a === void 0 ? void 0 : _a.imageUri, (_b = preparedAny.imageConfig) === null || _b === void 0 ? void 0 : _b.imageUri],
+        ['imageConfig.build.cwd', (_d = (_c = original.imageConfig) === null || _c === void 0 ? void 0 : _c.build) === null || _d === void 0 ? void 0 : _d.cwd, (_f = (_e = preparedAny.imageConfig) === null || _e === void 0 ? void 0 : _e.build) === null || _f === void 0 ? void 0 : _f.cwd],
+        ['imageConfig.build.dockerfile', (_h = (_g = original.imageConfig) === null || _g === void 0 ? void 0 : _g.build) === null || _h === void 0 ? void 0 : _h.dockerfile, (_k = (_j = preparedAny.imageConfig) === null || _j === void 0 ? void 0 : _j.build) === null || _k === void 0 ? void 0 : _k.dockerfile],
+        ['imageConfig.build.platform', (_m = (_l = original.imageConfig) === null || _l === void 0 ? void 0 : _l.build) === null || _m === void 0 ? void 0 : _m.platform, (_p = (_o = preparedAny.imageConfig) === null || _o === void 0 ? void 0 : _o.build) === null || _p === void 0 ? void 0 : _p.platform],
+        ['imageConfig.build.repository', (_r = (_q = original.imageConfig) === null || _q === void 0 ? void 0 : _q.build) === null || _r === void 0 ? void 0 : _r.repository, (_t = (_s = preparedAny.imageConfig) === null || _s === void 0 ? void 0 : _s.build) === null || _t === void 0 ? void 0 : _t.repository],
+        ['imageConfig.build.namespace', (_v = (_u = original.imageConfig) === null || _u === void 0 ? void 0 : _u.build) === null || _v === void 0 ? void 0 : _v.namespace, (_x = (_w = preparedAny.imageConfig) === null || _w === void 0 ? void 0 : _w.build) === null || _x === void 0 ? void 0 : _x.namespace],
+        ['imageConfig.registryId', (_y = original.imageConfig) === null || _y === void 0 ? void 0 : _y.registryId, (_z = preparedAny.imageConfig) === null || _z === void 0 ? void 0 : _z.registryId],
+        ['imageConfig.build.registryCredential', (_1 = (_0 = original.imageConfig) === null || _0 === void 0 ? void 0 : _0.build) === null || _1 === void 0 ? void 0 : _1.registryCredential, (_3 = (_2 = preparedAny.imageConfig) === null || _2 === void 0 ? void 0 : _2.build) === null || _3 === void 0 ? void 0 : _3.registryCredential]
+    ];
+    candidates.forEach(([fieldPath, before, after]) => {
+        if (before === undefined && after !== undefined) {
+            appliedDefaults.push(fieldPath);
+        }
+    });
+    return { config: prepared, missing, appliedDefaults };
+}
 /**
  * 规范化部署配置
  *
@@ -182,7 +318,7 @@ function inferHttpBuildStrategy(config) {
  * 以便 checkDeployConfig 汇总全部问题
  */
 function normalizeDeployConfig(config) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
     if (!config || typeof config !== 'object') {
         throw new error_1.CloudBaseError('部署配置必须是对象', {
             code: types_1.FUNCTION_DEPLOY_ERROR.CONFIG_INVALID
@@ -210,20 +346,20 @@ function normalizeDeployConfig(config) {
             // node_modules 必须随代码包上传，不能被 ignore 排除
             ignore: ignoreList.filter((item) => !/node_modules/.test(item)) });
     }
-    const normalizedImage = Object.assign(Object.assign({}, cloned), { type: 'HTTP', buildStrategy, runtime: types_1.CUSTOM_IMAGE_RUNTIME, imagePort: (_a = cloned.imagePort) !== null && _a !== void 0 ? _a : types_1.IMAGE_FUNCTION_PORT });
-    normalizedImage.imageType =
-        (_d = (_b = cloned.imageType) !== null && _b !== void 0 ? _b : (_c = cloned.imageConfig) === null || _c === void 0 ? void 0 : _c.imageType) !== null && _d !== void 0 ? _d : (((_g = (_e = cloned.registryId) !== null && _e !== void 0 ? _e : (_f = cloned.imageConfig) === null || _f === void 0 ? void 0 : _f.registryId) !== null && _g !== void 0 ? _g : (_h = cloned.build) === null || _h === void 0 ? void 0 : _h.registryId)
-            ? 'enterprise'
-            : 'personal');
+    const imageConfig = Object.assign({}, (cloned.imageConfig || {}));
+    const normalizedImage = Object.assign(Object.assign({}, cloned), { type: 'HTTP', buildStrategy, runtime: types_1.CUSTOM_IMAGE_RUNTIME, imageConfig });
+    imageConfig.imagePort = (_a = imageConfig.imagePort) !== null && _a !== void 0 ? _a : types_1.IMAGE_FUNCTION_PORT;
+    imageConfig.imageType =
+        (_b = imageConfig.imageType) !== null && _b !== void 0 ? _b : (((_c = imageConfig.registryId) !== null && _c !== void 0 ? _c : (_d = imageConfig.build) === null || _d === void 0 ? void 0 : _d.registryId) ? 'enterprise' : 'personal');
     // 镜像函数由容器启动命令决定入口，不使用 handler 与云端装依赖
     delete normalizedImage.handler;
     delete normalizedImage.installDependency;
     if (buildStrategy === 'cloud' || buildStrategy === 'local') {
-        normalizedImage.build = Object.assign(Object.assign({}, (cloned.build || {})), { dockerfile: (_k = (_j = cloned.build) === null || _j === void 0 ? void 0 : _j.dockerfile) !== null && _k !== void 0 ? _k : types_1.DEFAULT_DOCKERFILE, platform: (_m = (_l = cloned.build) === null || _l === void 0 ? void 0 : _l.platform) !== null && _m !== void 0 ? _m : types_1.DEFAULT_IMAGE_PLATFORM, repository: (_p = (_o = cloned.build) === null || _o === void 0 ? void 0 : _o.repository) !== null && _p !== void 0 ? _p : cloned.name });
+        imageConfig.build = Object.assign(Object.assign({}, (imageConfig.build || {})), { dockerfile: (_f = (_e = imageConfig.build) === null || _e === void 0 ? void 0 : _e.dockerfile) !== null && _f !== void 0 ? _f : types_1.DEFAULT_DOCKERFILE, platform: (_h = (_g = imageConfig.build) === null || _g === void 0 ? void 0 : _g.platform) !== null && _h !== void 0 ? _h : types_1.DEFAULT_IMAGE_PLATFORM });
     }
     if (buildStrategy === 'local') {
         // 默认不静默改变构建环境
-        normalizedImage.localFallback = (_q = cloned.localFallback) !== null && _q !== void 0 ? _q : 'error';
+        imageConfig.localFallback = (_j = imageConfig.localFallback) !== null && _j !== void 0 ? _j : 'error';
     }
     return normalizedImage;
 }
@@ -334,10 +470,11 @@ function checkHttpCommon(raw, checks) {
 }
 /** 校验镜像函数公共约束 */
 function checkImageRuntimeCommon(raw, checks) {
+    var _a;
     if (raw.runtime !== undefined && !isCustomImageRuntime(raw.runtime)) {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_RUNTIME_INVALID, `镜像部署要求 runtime 为 ${types_1.CUSTOM_IMAGE_RUNTIME}`, `当前为 ${raw.runtime}，请移除 runtime 或设置为 ${types_1.CUSTOM_IMAGE_RUNTIME}`));
     }
-    if (raw.imagePort !== undefined && raw.imagePort !== types_1.IMAGE_FUNCTION_PORT) {
+    if (((_a = raw.imageConfig) === null || _a === void 0 ? void 0 : _a.imagePort) !== undefined && raw.imageConfig.imagePort !== types_1.IMAGE_FUNCTION_PORT) {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_PORT_INVALID, `镜像监听端口必须为 ${types_1.IMAGE_FUNCTION_PORT}`, `请让容器监听 ${types_1.IMAGE_FUNCTION_PORT} 端口`));
     }
     if (raw.handler !== undefined) {
@@ -369,40 +506,46 @@ function checkImageReference(imageConfig, checks) {
 }
 /**
  * 校验镜像类型与仓库 ID
- * image 策略从 imageConfig.registryId（兼容顶层 registryId）读取；
- * local/cloud 策略从 build.registryId 读取，imageType 仍位于镜像运行时公共配置顶层。
+ * 直接读取 cloudbaserc 嵌套形状：imageType 位于 imageConfig.imageType；
+ * registryId 位于 imageConfig.registryId（cloud/local 兼容 imageConfig.build.registryId）。
  */
 function checkImageIdentity(raw, checks) {
-    var _a, _b, _c, _d, _e;
+    var _a;
     const imageConfig = raw === null || raw === void 0 ? void 0 : raw.imageConfig;
-    const buildRegistryId = (_a = raw === null || raw === void 0 ? void 0 : raw.build) === null || _a === void 0 ? void 0 : _a.registryId;
+    const build = imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.build;
+    const buildRegistryId = build === null || build === void 0 ? void 0 : build.registryId;
     const buildStrategy = raw === null || raw === void 0 ? void 0 : raw.buildStrategy;
-    const registryId = (_c = (_b = raw === null || raw === void 0 ? void 0 : raw.registryId) !== null && _b !== void 0 ? _b : imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.registryId) !== null && _c !== void 0 ? _c : buildRegistryId;
-    const defaultImageType = registryId ? 'enterprise' : 'personal';
-    const imageType = (_e = (_d = raw === null || raw === void 0 ? void 0 : raw.imageType) !== null && _d !== void 0 ? _d : imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.imageType) !== null && _e !== void 0 ? _e : defaultImageType;
+    const registryId = (_a = imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.registryId) !== null && _a !== void 0 ? _a : buildRegistryId;
+    const imageType = resolveBuildImageType(raw, build !== null && build !== void 0 ? build : {});
     if (imageType !== 'enterprise' && imageType !== 'personal') {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID, '镜像类型不合法', 'imageType 只能是 enterprise 或 personal'));
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID, buildStrategy === 'cloud' || buildStrategy === 'local'
+            ? `${buildStrategy} 策略必须显式声明镜像类型`
+            : '镜像类型不合法', '请配置 imageConfig.imageType 为 enterprise 或 personal'));
         return;
     }
     if (imageType === 'enterprise') {
-        const registryField = buildStrategy === 'cloud' || buildStrategy === 'local'
-            ? 'build.registryId'
-            : 'registryId';
-        if (registryId === undefined || registryId === null) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_MISSING, '企业版镜像未配置仓库实例 ID', `请配置 ${registryField}；如果当前没有企业版 TCR 实例，请将 imageType 设置为 personal 并改用个人版仓库配置`));
+        if (buildStrategy === 'image' && (registryId === undefined || registryId === null)) {
+            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_MISSING, '企业版镜像未配置仓库实例 ID', '请配置 imageConfig.registryId'));
         }
-        else if (typeof registryId !== 'string' || !registryId.trim()) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_INVALID, '企业版镜像仓库实例 ID 无效', `${registryField} 已声明但解析结果为空；若使用 {{env.*}}，请检查对应环境变量已赋值为实际企业版 TCR 实例 ID。没有企业版实例时请改用 imageType=personal`));
+        else if (registryId !== undefined && (typeof registryId !== 'string' || !registryId.trim())) {
+            const registryField = buildStrategy === 'cloud' || buildStrategy === 'local'
+                ? 'imageConfig.build.registryId'
+                : 'imageConfig.registryId';
+            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_INVALID, '企业版镜像仓库实例 ID 无效', `${registryField} 已声明但解析结果为空；若使用 {{env.*}}，请检查对应环境变量已赋值为实际企业版 TCR 实例 ID`));
         }
     }
     else if (registryId !== undefined) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID, '个人版镜像不能配置企业版仓库实例 ID', '请移除 build.registryId，或将 imageType 设置为 enterprise'));
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID, '个人版镜像不能配置企业版仓库实例 ID', '请移除 imageConfig.build.registryId，或将 imageConfig.imageType 设置为 enterprise'));
     }
 }
 /** 解析构建策略使用的镜像类型 */
 function resolveBuildImageType(raw, build) {
-    var _a, _b, _c, _d, _e, _f;
-    return (_c = (_a = raw.imageType) !== null && _a !== void 0 ? _a : (_b = raw.imageConfig) === null || _b === void 0 ? void 0 : _b.imageType) !== null && _c !== void 0 ? _c : (((_f = (_d = raw.registryId) !== null && _d !== void 0 ? _d : (_e = raw.imageConfig) === null || _e === void 0 ? void 0 : _e.registryId) !== null && _f !== void 0 ? _f : build.registryId) ? 'enterprise' : 'personal');
+    var _a, _b, _c, _d;
+    return (_b = (_a = raw.imageConfig) === null || _a === void 0 ? void 0 : _a.imageType) !== null && _b !== void 0 ? _b : (raw.buildStrategy === 'local' || raw.buildStrategy === 'cloud'
+        ? 'enterprise'
+        : ((_d = (_c = raw.imageConfig) === null || _c === void 0 ? void 0 : _c.registryId) !== null && _d !== void 0 ? _d : build.registryId)
+            ? 'enterprise'
+            : 'personal');
 }
 /** 校验构建 tag */
 function checkBuildTag(raw, build) {
@@ -441,8 +584,9 @@ function checkBuildSource(build, checks) {
 }
 /** 判断当前构建策略是否要求完整仓库地址 */
 function requiresFullBuildRepository(raw, imageType) {
-    return raw.buildStrategy === 'local' ||
-        (raw.buildStrategy === 'cloud' && imageType === 'enterprise');
+    var _a, _b;
+    return raw.buildStrategy === 'local' && imageType === 'personal' &&
+        ((_b = (_a = raw.imageConfig) === null || _a === void 0 ? void 0 : _a.build) === null || _b === void 0 ? void 0 : _b.repository) !== undefined;
 }
 /** 添加仓库地址缺失或不完整的错误 */
 function addFullRepositoryError(raw, checks, missing) {
@@ -470,14 +614,21 @@ function checkBuildRepository(raw, build, checks) {
         return;
     }
     const repository = typeof build.repository === 'string' ? build.repository.trim() : build.repository;
-    const parsedRepository = typeof repository === 'string' ? parseImageReference(repository) : null;
-    if (!parsedRepository || parsedRepository.tag || parsedRepository.digest) {
+    const isShortRepository = typeof repository === 'string' &&
+        IMAGE_REPOSITORY_PATTERN.test(repository) &&
+        !repository.split('/')[0].includes('.') &&
+        !repository.split('/')[0].includes(':');
+    const parsedRepository = typeof repository === 'string' && !isShortRepository
+        ? parseImageReference(repository)
+        : null;
+    if (!isShortRepository && (!parsedRepository || parsedRepository.tag || parsedRepository.digest)) {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID, '镜像仓库地址不合法', 'repository 需为不含 tag 或 digest 的镜像仓库路径'));
         return;
     }
-    const repositoryPath = parsedRepository.repository;
+    const repositoryPath = isShortRepository ? repository : parsedRepository.repository;
     if (requiresFullRepository &&
-        (!parsedRepository.registry || !repositoryPath.includes('/'))) {
+        (!(parsedRepository === null || parsedRepository === void 0 ? void 0 : parsedRepository.registry) || !repositoryPath.includes('/')) &&
+        repository !== raw.name) {
         addFullRepositoryError(raw, checks, false);
     }
 }
@@ -511,10 +662,10 @@ function checkBuildArgs(raw, build, checks) {
         checkBuildArg(raw, buildArg, checks);
     });
 }
-/** 校验个人版 TCR 云端推送凭证 */
+/** 校验个人版 TCR 推送凭证 */
 function checkPersonalRegistryCredential(registryCredential, checks) {
     if (!lodash_1.default.isPlainObject(registryCredential)) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_MISSING, '个人版 TCR 云端构建缺少推送凭证', '请在 build.registryCredential 中显式声明 username/password，' +
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_MISSING, '个人版 TCR 构建缺少推送凭证', '请在 build.registryCredential 中显式声明 username/password，' +
             '推荐使用 {{env.TCB_TCR_USERNAME}} 与 {{env.TCB_TCR_PASSWORD}}'));
         return;
     }
@@ -527,27 +678,30 @@ function checkPersonalRegistryCredential(registryCredential, checks) {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_INVALID, '个人版 TCR 固定密码未配置或长度不合法', 'password 必须显式声明且不能为空，推荐使用 {{env.TCB_TCR_PASSWORD}}'));
     }
 }
-/** 校验镜像仓库命名空间与推送凭证 */
+/** 校验镜像仓库配置 */
 function checkBuildRegistry(raw, build, checks) {
     const imageType = resolveBuildImageType(raw, build);
     const registryCredential = build.registryCredential;
-    if (raw.buildStrategy === 'cloud' && imageType === 'personal') {
-        if (typeof build.namespace !== 'string' ||
-            !build.namespace.trim() ||
-            !IMAGE_REPOSITORY_PATTERN.test(build.namespace.trim())) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID, '个人版 TCR 命名空间未配置或不合法', '请在 build.namespace 中显式声明，推荐使用 {{env.TCB_TCR_NAMESPACE}}'));
+    if (imageType === 'personal') {
+        if (build.namespace !== undefined &&
+            (typeof build.namespace !== 'string' ||
+                !build.namespace.trim() ||
+                !IMAGE_REPOSITORY_PATTERN.test(build.namespace.trim()))) {
+            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID, '个人版 TCR 命名空间未配置或不合法', 'build.namespace 必须为合法的个人版 TCR 命名空间；未声明时可由 envId 默认补齐'));
         }
         checkPersonalRegistryCredential(registryCredential, checks);
+        return;
     }
-    else if (registryCredential !== undefined) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_INVALID, 'registryCredential 仅支持 cloud + personal 构建', '企业版使用 STS 临时凭证换取 token；local 构建使用本机 Docker 登录态'));
+    if (registryCredential !== undefined) {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_INVALID, 'registryCredential 仅支持 personal 镜像构建', '企业版使用 STS 临时凭证换取 token；personal local/cloud 必须显式提供 username/password'));
     }
 }
 /** 校验镜像构建目标配置 */
 function checkBuildTarget(raw, checks) {
-    const build = raw.build;
+    var _a, _b;
+    const build = (_a = raw.imageConfig) === null || _a === void 0 ? void 0 : _a.build;
     if (!lodash_1.default.isPlainObject(build)) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONFIG_MISSING, '缺少镜像构建配置', '请配置 build，至少包含构建上下文与 Dockerfile 信息'));
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONFIG_MISSING, '缺少镜像构建配置', '请配置 imageConfig.build，至少包含构建上下文与 Dockerfile 信息'));
         return;
     }
     checks.push(...checkBuildTag(raw, build));
@@ -555,8 +709,8 @@ function checkBuildTarget(raw, checks) {
     checkBuildRepository(raw, build, checks);
     checkBuildArgs(raw, build, checks);
     checkBuildRegistry(raw, build, checks);
-    if (raw.imageConfig !== undefined) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_CONFIG_NOT_ALLOWED, `buildStrategy 为 ${raw.buildStrategy} 时不能指定 imageConfig`, '镜像地址将由构建结果决定，如需直接部署已有镜像请使用 buildStrategy: image'));
+    if (((_b = raw.imageConfig) === null || _b === void 0 ? void 0 : _b.imageUri) !== undefined) {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_CONFIG_NOT_ALLOWED, `buildStrategy 为 ${raw.buildStrategy} 时不能指定 imageConfig.imageUri`, '镜像地址将由构建结果决定，如需直接部署已有镜像请使用 buildStrategy: image'));
     }
 }
 /**
@@ -564,6 +718,7 @@ function checkBuildTarget(raw, checks) {
  * @returns 检查报告，包含全部问题而非仅第一个
  */
 function checkDeployConfig(config) {
+    var _a;
     const checks = [];
     if (!config || typeof config !== 'object') {
         return {
@@ -613,16 +768,16 @@ function checkDeployConfig(config) {
                 }
                 else {
                     checkImageReference(raw.imageConfig, checks);
-                    // imageType 在顶层，registryId 允许顶层或 imageConfig，统一传 raw
+                    // imageType 与 registryId 位于 imageConfig，统一传 raw 由 checkImageIdentity 读取
                     checkImageIdentity(raw, checks);
-                    // 注：imagePort 定义在顶层，已由 checkImageRuntimeCommon 校验，此处不重复
+                    // 注：imagePort 位于 imageConfig，已由 checkImageRuntimeCommon 校验，此处不重复
                 }
             }
             else {
                 checkImageIdentity(raw, checks);
                 checkBuildTarget(raw, checks);
                 if (strategy === 'local') {
-                    const fallback = raw.localFallback;
+                    const fallback = (_a = raw.imageConfig) === null || _a === void 0 ? void 0 : _a.localFallback;
                     if (fallback !== undefined && fallback !== 'cloud' && fallback !== 'error') {
                         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.LOCAL_FALLBACK_INVALID, 'localFallback 取值不合法', "只能是 'cloud' 或 'error'"));
                     }

package/lib/deploy/function/enterprise-tcr.js

@@ -0,0 +1,195 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prepareEnterpriseTcrTarget = prepareEnterpriseTcrTarget;
+exports.createEnterpriseTcrCredential = createEnterpriseTcrCredential;
+exports.createTcrApiService = createTcrApiService;
+const error_1 = require("../../error");
+const types_1 = require("../types");
+const config_guard_1 = require("./config-guard");
+const TCR_API_VERSION = '2019-09-24';
+const NAMESPACE_PATTERN = /^[a-z0-9](?:[a-z0-9]|[._-](?![._-])){0,28}[a-z0-9]$/;
+function responseOf(result) {
+    return (result === null || result === void 0 ? void 0 : result.Response) || result || {};
+}
+function requestIdOf(result) {
+    var _a;
+    const requestId = (_a = responseOf(result)) === null || _a === void 0 ? void 0 : _a.RequestId;
+    return typeof requestId === 'string' && requestId ? requestId : undefined;
+}
+function errorRequestId(error) {
+    var _a, _b, _c;
+    return (error === null || error === void 0 ? void 0 : error.requestId) || ((_a = error === null || error === void 0 ? void 0 : error.original) === null || _a === void 0 ? void 0 : _a.requestId) || ((_c = (_b = error === null || error === void 0 ? void 0 : error.original) === null || _b === void 0 ? void 0 : _b.Response) === null || _c === void 0 ? void 0 : _c.RequestId);
+}
+function throwTcrError(message, code, requestId) {
+    throw new error_1.CloudBaseError(message, Object.assign({ code }, (requestId ? { requestId } : {})));
+}
+function assertNamespace(namespace) {
+    if (!NAMESPACE_PATTERN.test(namespace)) {
+        throwTcrError(`企业版 TCR 命名空间不合法：${namespace}。名称需为 2-30 位小写字母、数字、点、下划线或中划线，且不能以分隔符开头、结尾或连续出现。`, types_1.FUNCTION_DEPLOY_ERROR.TCR_NAMESPACE_INVALID);
+    }
+}
+function parseRepositoryTarget(repository) {
+    const parsed = (0, config_guard_1.parseImageReference)(repository);
+    if (!parsed || parsed.tag || parsed.digest) {
+        throwTcrError('企业版 TCR repository 不合法，需为 repository、namespace/repository 或 registry/namespace/repository，且不能包含 tag 或 digest。', types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID);
+    }
+    const parts = parsed.repository.split('/');
+    if (parsed.registry) {
+        if (parts.length < 2) {
+            throwTcrError('完整企业版 TCR repository 必须包含 namespace/repository。', types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID);
+        }
+        return {
+            registry: parsed.registry,
+            namespace: parts.slice(0, -1).join('/'),
+            repository: parts[parts.length - 1]
+        };
+    }
+    if (parts.length >= 2) {
+        return {
+            namespace: parts.slice(0, -1).join('/'),
+            repository: parts[parts.length - 1]
+        };
+    }
+    return { repository: parts[0] };
+}
+function isRunningRegistry(registry) {
+    return !registry.Status || registry.Status.toLowerCase() === 'running';
+}
+async function resolveRegistry(service, region, explicitRegistryId) {
+    let result;
+    try {
+        result = await service.call({
+            Action: 'DescribeInstances',
+            Param: Object.assign({ AllRegion: true, Limit: 100 }, (explicitRegistryId ? { Registryids: [explicitRegistryId] } : {}))
+        });
+    }
+    catch (error) {
+        throw new error_1.CloudBaseError('查询企业版 TCR 实例失败，请确认当前身份具备 DescribeInstances 权限。', {
+            code: types_1.FUNCTION_DEPLOY_ERROR.TCR_INSTANCE_DISCOVERY_FAILED,
+            requestId: errorRequestId(error) || ''
+        });
+    }
+    const response = responseOf(result);
+    const registries = Array.isArray(response.Registries)
+        ? response.Registries
+        : Array.isArray(response.InstanceSet)
+            ? response.InstanceSet
+            : [];
+    const matching = registries.filter(item => {
+        const registryId = item.RegistryId || item.InstanceId;
+        const registryRegion = item.RegionName || item.Region;
+        return ((!explicitRegistryId || registryId === explicitRegistryId) &&
+            registryRegion === region &&
+            isRunningRegistry(item));
+    });
+    const requestId = requestIdOf(result);
+    if (matching.length === 0) {
+        const message = explicitRegistryId
+            ? `未找到地域 ${region} 内可用的企业版 TCR 实例 ${explicitRegistryId}，请确认实例 ID、状态及其与 SCF 的地域一致。`
+            : `地域 ${region} 内没有可用的企业版 TCR 实例，请先创建实例或显式指定同地域 registryId。`;
+        throwTcrError(message, types_1.FUNCTION_DEPLOY_ERROR.TCR_INSTANCE_NOT_FOUND, requestId);
+    }
+    if (matching.length > 1) {
+        throwTcrError(`地域 ${region} 内发现多个可用的企业版 TCR 实例，请通过 imageConfig.registryId 显式指定目标实例。`, types_1.FUNCTION_DEPLOY_ERROR.TCR_INSTANCE_AMBIGUOUS, requestId);
+    }
+    const selected = matching[0];
+    const registryId = selected.RegistryId || selected.InstanceId;
+    const registry = selected.PublicDomain || selected.RegistryDomain || selected.RegistryDomainName;
+    if (!registryId || !registry) {
+        throwTcrError('企业版 TCR 实例信息缺少 RegistryId 或 PublicDomain，无法生成镜像地址。', types_1.FUNCTION_DEPLOY_ERROR.TCR_INSTANCE_INVALID, requestId);
+    }
+    return { registryId, registry };
+}
+function isNamespaceConflict(error) {
+    var _a, _b;
+    const code = String((error === null || error === void 0 ? void 0 : error.code) || ((_b = (_a = error === null || error === void 0 ? void 0 : error.original) === null || _a === void 0 ? void 0 : _a.Error) === null || _b === void 0 ? void 0 : _b.Code) || '');
+    return /ResourceConflict|AlreadyExists|ResourceInUse/i.test(code);
+}
+async function ensureNamespace(service, registryId, namespace) {
+    var _a;
+    let describeResult;
+    try {
+        describeResult = await service.call({
+            Action: 'DescribeNamespaces',
+            Param: { RegistryId: registryId, NamespaceName: namespace, Limit: 1, Offset: 0 }
+        });
+    }
+    catch (error) {
+        throw new error_1.CloudBaseError(`查询企业版 TCR 命名空间 ${namespace} 失败。`, {
+            code: types_1.FUNCTION_DEPLOY_ERROR.TCR_NAMESPACE_QUERY_FAILED,
+            requestId: errorRequestId(error) || ''
+        });
+    }
+    const namespaceList = (_a = responseOf(describeResult)) === null || _a === void 0 ? void 0 : _a.NamespaceList;
+    if (Array.isArray(namespaceList) && namespaceList.some(item => (item === null || item === void 0 ? void 0 : item.Name) === namespace)) {
+        return;
+    }
+    try {
+        await service.call({
+            Action: 'CreateNamespace',
+            Param: { RegistryId: registryId, NamespaceName: namespace, IsPublic: false }
+        });
+    }
+    catch (error) {
+        if (isNamespaceConflict(error)) {
+            return;
+        }
+        throw new error_1.CloudBaseError(`创建企业版 TCR 命名空间 ${namespace} 失败。`, {
+            code: types_1.FUNCTION_DEPLOY_ERROR.TCR_NAMESPACE_CREATE_FAILED,
+            requestId: errorRequestId(error) || ''
+        });
+    }
+}
+async function prepareEnterpriseTcrTarget(config, options) {
+    var _a;
+    const build = config.imageConfig.build;
+    const configuredRegistryId = (_a = config.imageConfig.registryId) !== null && _a !== void 0 ? _a : build.registryId;
+    const explicitRegistryId = typeof configuredRegistryId === 'string' && configuredRegistryId.trim()
+        ? configuredRegistryId.trim()
+        : undefined;
+    const resolvedRegistry = await resolveRegistry(options.service, options.region, explicitRegistryId);
+    const repositoryTarget = parseRepositoryTarget(build.repository || config.name);
+    const namespace = (build.namespace || repositoryTarget.namespace || options.envId).trim();
+    assertNamespace(namespace);
+    if (build.namespace && repositoryTarget.namespace && build.namespace !== repositoryTarget.namespace) {
+        throwTcrError('imageConfig.build.namespace 与 imageConfig.build.repository 中的命名空间不一致。', types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID);
+    }
+    await ensureNamespace(options.service, resolvedRegistry.registryId, namespace);
+    const registry = repositoryTarget.registry || resolvedRegistry.registry;
+    const repository = repositoryTarget.repository || config.name;
+    const imageRepository = `${registry}/${namespace}/${repository}`;
+    const preparedConfig = Object.assign(Object.assign({}, config), { imageConfig: Object.assign(Object.assign({}, config.imageConfig), { imageType: 'enterprise', registryId: resolvedRegistry.registryId, build: Object.assign(Object.assign({}, build), { registryId: resolvedRegistry.registryId, namespace, repository: imageRepository }) }) });
+    return {
+        config: preparedConfig,
+        target: {
+            registryId: resolvedRegistry.registryId,
+            registry,
+            namespace,
+            repository,
+            imageRepository
+        }
+    };
+}
+async function createEnterpriseTcrCredential(service, registryId) {
+    let result;
+    try {
+        result = await service.call({
+            Action: 'CreateInstanceToken',
+            Param: { RegistryId: registryId, TokenType: 'temp' }
+        });
+    }
+    catch (error) {
+        throw new error_1.CloudBaseError('获取企业版 TCR 临时登录凭证失败，请确认当前身份具备 CreateInstanceToken 权限。', {
+            code: types_1.FUNCTION_DEPLOY_ERROR.TCR_TOKEN_CREATE_FAILED,
+            requestId: errorRequestId(error) || ''
+        });
+    }
+    const response = responseOf(result);
+    if (typeof response.Username !== 'string' || !response.Username || typeof response.Token !== 'string' || !response.Token) {
+        throwTcrError('CreateInstanceToken 未返回有效的 Username 或 Token。', types_1.FUNCTION_DEPLOY_ERROR.TCR_TOKEN_INVALID, requestIdOf(result));
+    }
+    return { username: response.Username, token: response.Token };
+}
+function createTcrApiService(environment) {
+    return environment.getCommonService('tcr', TCR_API_VERSION);
+}