@cloudbase/manager-node 5.8.3 → 5.8.4

package/lib/deploy/function/config-guard.js

@@ -6,6 +6,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseImageReference = parseImageReference;
 exports.normalizeGatewayPath = normalizeGatewayPath;
 exports.isCustomImageRuntime = isCustomImageRuntime;
+exports.applyMinimalDeployConfigDefaults = applyMinimalDeployConfigDefaults;
+exports.getMissingDeployInputs = getMissingDeployInputs;
+exports.prepareMinimalDeployConfig = prepareMinimalDeployConfig;
 exports.normalizeDeployConfig = normalizeDeployConfig;
 exports.checkDeployConfig = checkDeployConfig;
 exports.assertDeployConfig = assertDeployConfig;
@@ -163,18 +166,151 @@ function inferHttpBuildStrategy(config) {
     if (config === null || config === void 0 ? void 0 : config.buildStrategy) {
         return config.buildStrategy;
     }
-    if (config === null || config === void 0 ? void 0 : config.imageConfig) {
-        return 'image';
-    }
-    if (config === null || config === void 0 ? void 0 : config.build) {
+    const imageConfig = config === null || config === void 0 ? void 0 : config.imageConfig;
+    if (imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.build) {
         // 有构建上下文但未声明策略时，默认使用无需本地 Docker 的云端构建
         return 'cloud';
     }
+    if (imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.imageUri) {
+        return 'image';
+    }
     if (isCustomImageRuntime(config === null || config === void 0 ? void 0 : config.runtime)) {
         return 'image';
     }
     return 'zip';
 }
+/**
+ * 应用最小化镜像配置的可安全默认值，不执行 IO，不生成凭证。
+ * 仅填充构建上下文、仓库名、namespace 和运行时固定值；用户凭证必须显式传入。
+ *
+ * 直接在 cloudbaserc 的嵌套形状上操作：镜像字段位于 imageConfig，构建目标位于
+ * imageConfig.build，不再做字段平铺映射。
+ */
+function applyMinimalDeployConfigDefaults(config, context = {}) {
+    var _a, _b, _c, _d, _e, _f, _g;
+    const result = lodash_1.default.cloneDeep(config);
+    if ((result === null || result === void 0 ? void 0 : result.type) !== 'HTTP') {
+        return result;
+    }
+    const strategy = inferHttpBuildStrategy(result);
+    if (!['image', 'local', 'cloud'].includes(strategy)) {
+        return result;
+    }
+    result.buildStrategy = strategy;
+    const imageConfig = Object.assign({}, (result.imageConfig || {}));
+    result.imageConfig = imageConfig;
+    if (strategy === 'image') {
+        if (imageConfig.imageUri === undefined && ((_a = context.defaults) === null || _a === void 0 ? void 0 : _a.imageUri) !== undefined) {
+            imageConfig.imageUri = context.defaults.imageUri;
+        }
+        return result;
+    }
+    if (result.runtime === undefined) {
+        result.runtime = types_1.CUSTOM_IMAGE_RUNTIME;
+    }
+    if (imageConfig.imagePort === undefined) {
+        imageConfig.imagePort = types_1.IMAGE_FUNCTION_PORT;
+    }
+    const build = Object.assign({}, (imageConfig.build || {}));
+    imageConfig.build = build;
+    const functionPath = context.functionPath ||
+        (context.functionRootPath && result.name ? `${context.functionRootPath}/${result.name}` : undefined);
+    if (build.cwd === undefined && functionPath) {
+        build.cwd = functionPath;
+    }
+    if (build.dockerfile === undefined) {
+        build.dockerfile = types_1.DEFAULT_DOCKERFILE;
+    }
+    if (build.platform === undefined) {
+        build.platform = types_1.DEFAULT_IMAGE_PLATFORM;
+    }
+    const defaultRepository = (_c = (_b = context.defaults) === null || _b === void 0 ? void 0 : _b.repository) !== null && _c !== void 0 ? _c : result.name;
+    const defaultNamespace = (_e = (_d = context.defaults) === null || _d === void 0 ? void 0 : _d.namespace) !== null && _e !== void 0 ? _e : context.envId;
+    if (build.repository === undefined && defaultRepository !== undefined) {
+        build.repository = defaultRepository;
+    }
+    if (build.namespace === undefined && defaultNamespace !== undefined) {
+        build.namespace = defaultNamespace;
+    }
+    if (imageConfig.registryId === undefined && ((_f = context.defaults) === null || _f === void 0 ? void 0 : _f.registryId) !== undefined) {
+        imageConfig.registryId = context.defaults.registryId;
+    }
+    if (build.registryCredential === undefined && ((_g = context.defaults) === null || _g === void 0 ? void 0 : _g.registryCredential) !== undefined) {
+        build.registryCredential = lodash_1.default.cloneDeep(context.defaults.registryCredential);
+    }
+    return result;
+}
+/**
+ * 返回最小化部署在当前配置下仍缺失的输入字段；不执行网络、文件或凭证操作。
+ */
+function getMissingDeployInputs(config, context = {}) {
+    var _a, _b, _c;
+    const normalized = lodash_1.default.cloneDeep(config);
+    const missing = [];
+    if ((normalized === null || normalized === void 0 ? void 0 : normalized.type) !== 'HTTP') {
+        return missing;
+    }
+    const strategy = (_a = normalized.buildStrategy) !== null && _a !== void 0 ? _a : inferHttpBuildStrategy(normalized);
+    if (!['image', 'local', 'cloud'].includes(strategy)) {
+        return missing;
+    }
+    const imageConfig = normalized.imageConfig || {};
+    if (strategy === 'image') {
+        if (!imageConfig.imageUri) {
+            missing.push({ name: 'imageUri', path: 'imageConfig.imageUri', required: true, reason: '已有镜像部署需要固定 tag 或 digest 的 imageUri' });
+        }
+        return missing;
+    }
+    const build = imageConfig.build || {};
+    const imageType = imageConfig.imageType || (imageConfig.registryId || build.registryId ? 'enterprise' : 'personal');
+    if (imageType === 'enterprise') {
+        if (!imageConfig.registryId && !build.registryId) {
+            missing.push({ name: 'registryId', path: 'imageConfig.registryId', required: true, reason: '企业版镜像构建需要指定 TCR 实例 ID' });
+        }
+        if (!build.repository) {
+            missing.push({ name: 'repository', path: 'imageConfig.build.repository', required: true, reason: '企业版镜像构建需要目标仓库' });
+        }
+        return missing;
+    }
+    const namespace = build.namespace || context.envId;
+    if (!namespace) {
+        missing.push({ name: 'namespace', path: 'imageConfig.build.namespace', required: true, reason: '个人版镜像构建需要 namespace，且无法从 envId 推导' });
+    }
+    if (!((_b = build.registryCredential) === null || _b === void 0 ? void 0 : _b.username)) {
+        missing.push({ name: 'registryCredential.username', path: 'imageConfig.build.registryCredential.username', required: true, reason: '个人版 TCR 构建需要推送用户名' });
+    }
+    if (!((_c = build.registryCredential) === null || _c === void 0 ? void 0 : _c.password)) {
+        missing.push({ name: 'registryCredential.password', path: 'imageConfig.build.registryCredential.password', required: true, reason: '个人版 TCR 构建需要推送密码' });
+    }
+    return missing;
+}
+/**
+ * 生成最小化配置准备结果：先应用安全默认值，再返回剩余缺失字段和默认值路径。
+ */
+function prepareMinimalDeployConfig(config, context = {}) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3;
+    const prepared = applyMinimalDeployConfigDefaults(config, context);
+    const missing = getMissingDeployInputs(prepared, { envId: context.envId });
+    const original = lodash_1.default.cloneDeep(config);
+    const preparedAny = prepared;
+    const appliedDefaults = [];
+    const candidates = [
+        ['imageConfig.imageUri', (_a = original.imageConfig) === null || _a === void 0 ? void 0 : _a.imageUri, (_b = preparedAny.imageConfig) === null || _b === void 0 ? void 0 : _b.imageUri],
+        ['imageConfig.build.cwd', (_d = (_c = original.imageConfig) === null || _c === void 0 ? void 0 : _c.build) === null || _d === void 0 ? void 0 : _d.cwd, (_f = (_e = preparedAny.imageConfig) === null || _e === void 0 ? void 0 : _e.build) === null || _f === void 0 ? void 0 : _f.cwd],
+        ['imageConfig.build.dockerfile', (_h = (_g = original.imageConfig) === null || _g === void 0 ? void 0 : _g.build) === null || _h === void 0 ? void 0 : _h.dockerfile, (_k = (_j = preparedAny.imageConfig) === null || _j === void 0 ? void 0 : _j.build) === null || _k === void 0 ? void 0 : _k.dockerfile],
+        ['imageConfig.build.platform', (_m = (_l = original.imageConfig) === null || _l === void 0 ? void 0 : _l.build) === null || _m === void 0 ? void 0 : _m.platform, (_p = (_o = preparedAny.imageConfig) === null || _o === void 0 ? void 0 : _o.build) === null || _p === void 0 ? void 0 : _p.platform],
+        ['imageConfig.build.repository', (_r = (_q = original.imageConfig) === null || _q === void 0 ? void 0 : _q.build) === null || _r === void 0 ? void 0 : _r.repository, (_t = (_s = preparedAny.imageConfig) === null || _s === void 0 ? void 0 : _s.build) === null || _t === void 0 ? void 0 : _t.repository],
+        ['imageConfig.build.namespace', (_v = (_u = original.imageConfig) === null || _u === void 0 ? void 0 : _u.build) === null || _v === void 0 ? void 0 : _v.namespace, (_x = (_w = preparedAny.imageConfig) === null || _w === void 0 ? void 0 : _w.build) === null || _x === void 0 ? void 0 : _x.namespace],
+        ['imageConfig.registryId', (_y = original.imageConfig) === null || _y === void 0 ? void 0 : _y.registryId, (_z = preparedAny.imageConfig) === null || _z === void 0 ? void 0 : _z.registryId],
+        ['imageConfig.build.registryCredential', (_1 = (_0 = original.imageConfig) === null || _0 === void 0 ? void 0 : _0.build) === null || _1 === void 0 ? void 0 : _1.registryCredential, (_3 = (_2 = preparedAny.imageConfig) === null || _2 === void 0 ? void 0 : _2.build) === null || _3 === void 0 ? void 0 : _3.registryCredential]
+    ];
+    candidates.forEach(([fieldPath, before, after]) => {
+        if (before === undefined && after !== undefined) {
+            appliedDefaults.push(fieldPath);
+        }
+    });
+    return { config: prepared, missing, appliedDefaults };
+}
 /**
  * 规范化部署配置
  *
@@ -182,7 +318,7 @@ function inferHttpBuildStrategy(config) {
  * 以便 checkDeployConfig 汇总全部问题
  */
 function normalizeDeployConfig(config) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
     if (!config || typeof config !== 'object') {
         throw new error_1.CloudBaseError('部署配置必须是对象', {
             code: types_1.FUNCTION_DEPLOY_ERROR.CONFIG_INVALID
@@ -210,20 +346,20 @@ function normalizeDeployConfig(config) {
             // node_modules 必须随代码包上传，不能被 ignore 排除
             ignore: ignoreList.filter((item) => !/node_modules/.test(item)) });
     }
-    const normalizedImage = Object.assign(Object.assign({}, cloned), { type: 'HTTP', buildStrategy, runtime: types_1.CUSTOM_IMAGE_RUNTIME, imagePort: (_a = cloned.imagePort) !== null && _a !== void 0 ? _a : types_1.IMAGE_FUNCTION_PORT });
-    normalizedImage.imageType =
-        (_d = (_b = cloned.imageType) !== null && _b !== void 0 ? _b : (_c = cloned.imageConfig) === null || _c === void 0 ? void 0 : _c.imageType) !== null && _d !== void 0 ? _d : (((_g = (_e = cloned.registryId) !== null && _e !== void 0 ? _e : (_f = cloned.imageConfig) === null || _f === void 0 ? void 0 : _f.registryId) !== null && _g !== void 0 ? _g : (_h = cloned.build) === null || _h === void 0 ? void 0 : _h.registryId)
-            ? 'enterprise'
-            : 'personal');
+    const imageConfig = Object.assign({}, (cloned.imageConfig || {}));
+    const normalizedImage = Object.assign(Object.assign({}, cloned), { type: 'HTTP', buildStrategy, runtime: types_1.CUSTOM_IMAGE_RUNTIME, imageConfig });
+    imageConfig.imagePort = (_a = imageConfig.imagePort) !== null && _a !== void 0 ? _a : types_1.IMAGE_FUNCTION_PORT;
+    imageConfig.imageType =
+        (_b = imageConfig.imageType) !== null && _b !== void 0 ? _b : (((_c = imageConfig.registryId) !== null && _c !== void 0 ? _c : (_d = imageConfig.build) === null || _d === void 0 ? void 0 : _d.registryId) ? 'enterprise' : 'personal');
     // 镜像函数由容器启动命令决定入口，不使用 handler 与云端装依赖
     delete normalizedImage.handler;
     delete normalizedImage.installDependency;
     if (buildStrategy === 'cloud' || buildStrategy === 'local') {
-        normalizedImage.build = Object.assign(Object.assign({}, (cloned.build || {})), { dockerfile: (_k = (_j = cloned.build) === null || _j === void 0 ? void 0 : _j.dockerfile) !== null && _k !== void 0 ? _k : types_1.DEFAULT_DOCKERFILE, platform: (_m = (_l = cloned.build) === null || _l === void 0 ? void 0 : _l.platform) !== null && _m !== void 0 ? _m : types_1.DEFAULT_IMAGE_PLATFORM });
+        imageConfig.build = Object.assign(Object.assign({}, (imageConfig.build || {})), { dockerfile: (_f = (_e = imageConfig.build) === null || _e === void 0 ? void 0 : _e.dockerfile) !== null && _f !== void 0 ? _f : types_1.DEFAULT_DOCKERFILE, platform: (_h = (_g = imageConfig.build) === null || _g === void 0 ? void 0 : _g.platform) !== null && _h !== void 0 ? _h : types_1.DEFAULT_IMAGE_PLATFORM });
     }
     if (buildStrategy === 'local') {
         // 默认不静默改变构建环境
-        normalizedImage.localFallback = (_o = cloned.localFallback) !== null && _o !== void 0 ? _o : 'error';
+        imageConfig.localFallback = (_j = imageConfig.localFallback) !== null && _j !== void 0 ? _j : 'error';
     }
     return normalizedImage;
 }
@@ -334,10 +470,11 @@ function checkHttpCommon(raw, checks) {
 }
 /** 校验镜像函数公共约束 */
 function checkImageRuntimeCommon(raw, checks) {
+    var _a;
     if (raw.runtime !== undefined && !isCustomImageRuntime(raw.runtime)) {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_RUNTIME_INVALID, `镜像部署要求 runtime 为 ${types_1.CUSTOM_IMAGE_RUNTIME}`, `当前为 ${raw.runtime}，请移除 runtime 或设置为 ${types_1.CUSTOM_IMAGE_RUNTIME}`));
     }
-    if (raw.imagePort !== undefined && raw.imagePort !== types_1.IMAGE_FUNCTION_PORT) {
+    if (((_a = raw.imageConfig) === null || _a === void 0 ? void 0 : _a.imagePort) !== undefined && raw.imageConfig.imagePort !== types_1.IMAGE_FUNCTION_PORT) {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_PORT_INVALID, `镜像监听端口必须为 ${types_1.IMAGE_FUNCTION_PORT}`, `请让容器监听 ${types_1.IMAGE_FUNCTION_PORT} 端口`));
     }
     if (raw.handler !== undefined) {
@@ -369,17 +506,17 @@ function checkImageReference(imageConfig, checks) {
 }
 /**
  * 校验镜像类型与仓库 ID
- * image 策略从 imageConfig.registryId（兼容顶层 registryId）读取；
- * local/cloud 策略从 build.registryId 读取，imageType 仍位于镜像运行时公共配置顶层。
+ * 直接读取 cloudbaserc 嵌套形状：imageType 位于 imageConfig.imageType；
+ * registryId 位于 imageConfig.registryId（cloud/local 兼容 imageConfig.build.registryId）。
  */
 function checkImageIdentity(raw, checks) {
-    var _a, _b, _c, _d, _e;
+    var _a;
     const imageConfig = raw === null || raw === void 0 ? void 0 : raw.imageConfig;
-    const buildRegistryId = (_a = raw === null || raw === void 0 ? void 0 : raw.build) === null || _a === void 0 ? void 0 : _a.registryId;
+    const build = imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.build;
+    const buildRegistryId = build === null || build === void 0 ? void 0 : build.registryId;
     const buildStrategy = raw === null || raw === void 0 ? void 0 : raw.buildStrategy;
-    const registryId = (_c = (_b = raw === null || raw === void 0 ? void 0 : raw.registryId) !== null && _b !== void 0 ? _b : imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.registryId) !== null && _c !== void 0 ? _c : buildRegistryId;
-    const explicitImageType = (_d = raw === null || raw === void 0 ? void 0 : raw.imageType) !== null && _d !== void 0 ? _d : imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.imageType;
-    const imageType = resolveBuildImageType(raw, (_e = raw === null || raw === void 0 ? void 0 : raw.build) !== null && _e !== void 0 ? _e : {});
+    const registryId = (_a = imageConfig === null || imageConfig === void 0 ? void 0 : imageConfig.registryId) !== null && _a !== void 0 ? _a : buildRegistryId;
+    const imageType = resolveBuildImageType(raw, build !== null && build !== void 0 ? build : {});
     if (imageType !== 'enterprise' && imageType !== 'personal') {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID, buildStrategy === 'cloud' || buildStrategy === 'local'
             ? `${buildStrategy} 策略必须显式声明镜像类型`
@@ -388,25 +525,25 @@ function checkImageIdentity(raw, checks) {
     }
     if (imageType === 'enterprise') {
         if (buildStrategy === 'image' && (registryId === undefined || registryId === null)) {
-            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_MISSING, '企业版镜像未配置仓库实例 ID', '请配置 imageConfig.registryId 或顶层 registryId'));
+            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_MISSING, '企业版镜像未配置仓库实例 ID', '请配置 imageConfig.registryId'));
         }
         else if (registryId !== undefined && (typeof registryId !== 'string' || !registryId.trim())) {
             const registryField = buildStrategy === 'cloud' || buildStrategy === 'local'
-                ? 'build.registryId'
-                : 'registryId';
+                ? 'imageConfig.build.registryId'
+                : 'imageConfig.registryId';
             checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_INVALID, '企业版镜像仓库实例 ID 无效', `${registryField} 已声明但解析结果为空；若使用 {{env.*}}，请检查对应环境变量已赋值为实际企业版 TCR 实例 ID`));
         }
     }
     else if (registryId !== undefined) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID, '个人版镜像不能配置企业版仓库实例 ID', '请移除 build.registryId，或将 imageType 设置为 enterprise'));
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID, '个人版镜像不能配置企业版仓库实例 ID', '请移除 imageConfig.build.registryId，或将 imageConfig.imageType 设置为 enterprise'));
     }
 }
 /** 解析构建策略使用的镜像类型 */
 function resolveBuildImageType(raw, build) {
-    var _a, _b, _c, _d, _e, _f;
-    return (_c = (_a = raw.imageType) !== null && _a !== void 0 ? _a : (_b = raw.imageConfig) === null || _b === void 0 ? void 0 : _b.imageType) !== null && _c !== void 0 ? _c : (raw.buildStrategy === 'local' || raw.buildStrategy === 'cloud'
+    var _a, _b, _c, _d;
+    return (_b = (_a = raw.imageConfig) === null || _a === void 0 ? void 0 : _a.imageType) !== null && _b !== void 0 ? _b : (raw.buildStrategy === 'local' || raw.buildStrategy === 'cloud'
         ? 'enterprise'
-        : ((_f = (_d = raw.registryId) !== null && _d !== void 0 ? _d : (_e = raw.imageConfig) === null || _e === void 0 ? void 0 : _e.registryId) !== null && _f !== void 0 ? _f : build.registryId)
+        : ((_d = (_c = raw.imageConfig) === null || _c === void 0 ? void 0 : _c.registryId) !== null && _d !== void 0 ? _d : build.registryId)
             ? 'enterprise'
             : 'personal');
 }
@@ -447,9 +584,9 @@ function checkBuildSource(build, checks) {
 }
 /** 判断当前构建策略是否要求完整仓库地址 */
 function requiresFullBuildRepository(raw, imageType) {
-    var _a;
+    var _a, _b;
     return raw.buildStrategy === 'local' && imageType === 'personal' &&
-        ((_a = raw.build) === null || _a === void 0 ? void 0 : _a.repository) !== undefined;
+        ((_b = (_a = raw.imageConfig) === null || _a === void 0 ? void 0 : _a.build) === null || _b === void 0 ? void 0 : _b.repository) !== undefined;
 }
 /** 添加仓库地址缺失或不完整的错误 */
 function addFullRepositoryError(raw, checks, missing) {
@@ -546,6 +683,12 @@ function checkBuildRegistry(raw, build, checks) {
     const imageType = resolveBuildImageType(raw, build);
     const registryCredential = build.registryCredential;
     if (imageType === 'personal') {
+        if (build.namespace !== undefined &&
+            (typeof build.namespace !== 'string' ||
+                !build.namespace.trim() ||
+                !IMAGE_REPOSITORY_PATTERN.test(build.namespace.trim()))) {
+            checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID, '个人版 TCR 命名空间未配置或不合法', 'build.namespace 必须为合法的个人版 TCR 命名空间；未声明时可由 envId 默认补齐'));
+        }
         checkPersonalRegistryCredential(registryCredential, checks);
         return;
     }
@@ -555,9 +698,10 @@ function checkBuildRegistry(raw, build, checks) {
 }
 /** 校验镜像构建目标配置 */
 function checkBuildTarget(raw, checks) {
-    const build = raw.build;
+    var _a, _b;
+    const build = (_a = raw.imageConfig) === null || _a === void 0 ? void 0 : _a.build;
     if (!lodash_1.default.isPlainObject(build)) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONFIG_MISSING, '缺少镜像构建配置', '请配置 build，至少包含构建上下文与 Dockerfile 信息'));
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONFIG_MISSING, '缺少镜像构建配置', '请配置 imageConfig.build，至少包含构建上下文与 Dockerfile 信息'));
         return;
     }
     checks.push(...checkBuildTag(raw, build));
@@ -565,8 +709,8 @@ function checkBuildTarget(raw, checks) {
     checkBuildRepository(raw, build, checks);
     checkBuildArgs(raw, build, checks);
     checkBuildRegistry(raw, build, checks);
-    if (raw.imageConfig !== undefined) {
-        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_CONFIG_NOT_ALLOWED, `buildStrategy 为 ${raw.buildStrategy} 时不能指定 imageConfig`, '镜像地址将由构建结果决定，如需直接部署已有镜像请使用 buildStrategy: image'));
+    if (((_b = raw.imageConfig) === null || _b === void 0 ? void 0 : _b.imageUri) !== undefined) {
+        checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.IMAGE_CONFIG_NOT_ALLOWED, `buildStrategy 为 ${raw.buildStrategy} 时不能指定 imageConfig.imageUri`, '镜像地址将由构建结果决定，如需直接部署已有镜像请使用 buildStrategy: image'));
     }
 }
 /**
@@ -574,6 +718,7 @@ function checkBuildTarget(raw, checks) {
  * @returns 检查报告，包含全部问题而非仅第一个
  */
 function checkDeployConfig(config) {
+    var _a;
     const checks = [];
     if (!config || typeof config !== 'object') {
         return {
@@ -623,16 +768,16 @@ function checkDeployConfig(config) {
                 }
                 else {
                     checkImageReference(raw.imageConfig, checks);
-                    // imageType 在顶层，registryId 允许顶层或 imageConfig，统一传 raw
+                    // imageType 与 registryId 位于 imageConfig，统一传 raw 由 checkImageIdentity 读取
                     checkImageIdentity(raw, checks);
-                    // 注：imagePort 定义在顶层，已由 checkImageRuntimeCommon 校验，此处不重复
+                    // 注：imagePort 位于 imageConfig，已由 checkImageRuntimeCommon 校验，此处不重复
                 }
             }
             else {
                 checkImageIdentity(raw, checks);
                 checkBuildTarget(raw, checks);
                 if (strategy === 'local') {
-                    const fallback = raw.localFallback;
+                    const fallback = (_a = raw.imageConfig) === null || _a === void 0 ? void 0 : _a.localFallback;
                     if (fallback !== undefined && fallback !== 'cloud' && fallback !== 'error') {
                         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.LOCAL_FALLBACK_INVALID, 'localFallback 取值不合法', "只能是 'cloud' 或 'error'"));
                     }

package/lib/deploy/function/enterprise-tcr.js

@@ -142,22 +142,23 @@ async function ensureNamespace(service, registryId, namespace) {
 }
 async function prepareEnterpriseTcrTarget(config, options) {
     var _a;
-    const configuredRegistryId = (_a = config.registryId) !== null && _a !== void 0 ? _a : config.build.registryId;
+    const build = config.imageConfig.build;
+    const configuredRegistryId = (_a = config.imageConfig.registryId) !== null && _a !== void 0 ? _a : build.registryId;
     const explicitRegistryId = typeof configuredRegistryId === 'string' && configuredRegistryId.trim()
         ? configuredRegistryId.trim()
         : undefined;
     const resolvedRegistry = await resolveRegistry(options.service, options.region, explicitRegistryId);
-    const repositoryTarget = parseRepositoryTarget(config.build.repository || config.name);
-    const namespace = (config.build.namespace || repositoryTarget.namespace || options.envId).trim();
+    const repositoryTarget = parseRepositoryTarget(build.repository || config.name);
+    const namespace = (build.namespace || repositoryTarget.namespace || options.envId).trim();
     assertNamespace(namespace);
-    if (config.build.namespace && repositoryTarget.namespace && config.build.namespace !== repositoryTarget.namespace) {
-        throwTcrError('build.namespace 与 build.repository 中的命名空间不一致。', types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID);
+    if (build.namespace && repositoryTarget.namespace && build.namespace !== repositoryTarget.namespace) {
+        throwTcrError('imageConfig.build.namespace 与 imageConfig.build.repository 中的命名空间不一致。', types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID);
     }
     await ensureNamespace(options.service, resolvedRegistry.registryId, namespace);
     const registry = repositoryTarget.registry || resolvedRegistry.registry;
     const repository = repositoryTarget.repository || config.name;
     const imageRepository = `${registry}/${namespace}/${repository}`;
-    const preparedConfig = Object.assign(Object.assign({}, config), { imageType: 'enterprise', registryId: resolvedRegistry.registryId, build: Object.assign(Object.assign({}, config.build), { registryId: resolvedRegistry.registryId, namespace, repository: imageRepository }) });
+    const preparedConfig = Object.assign(Object.assign({}, config), { imageConfig: Object.assign(Object.assign({}, config.imageConfig), { imageType: 'enterprise', registryId: resolvedRegistry.registryId, build: Object.assign(Object.assign({}, build), { registryId: resolvedRegistry.registryId, namespace, repository: imageRepository }) }) });
     return {
         config: preparedConfig,
         target: {

package/lib/deploy/function/local-builder.js

@@ -61,18 +61,19 @@ const defaultDeps = {
 };
 /** 解析构建上下文目录（绝对路径） */
 function resolveContext(config) {
-    const cwd = config.build.cwd || config.functionPath || process.cwd();
+    const cwd = config.imageConfig.build.cwd || config.functionPath || process.cwd();
     return path_1.default.resolve(cwd);
 }
 /** 解析目标镜像完整引用 imageUri（repository 需为含域名与命名空间的完整仓库地址，个人版/企业版通用） */
 async function resolveImageUri(config, context) {
-    const repository = config.build.repository;
+    const build = config.imageConfig.build;
+    const repository = build.repository;
     if (typeof repository !== 'string' || !repository.trim()) {
-        throw new error_1.CloudBaseError('local 策略缺少目标镜像仓库地址 build.repository', {
+        throw new error_1.CloudBaseError('local 策略缺少目标镜像仓库地址 imageConfig.build.repository', {
             code: types_1.FUNCTION_DEPLOY_ERROR.LOCAL_BUILD_REPOSITORY_MISSING
         });
     }
-    const tag = await (0, image_tag_1.resolveImageTag)({ explicitTag: config.build.tag, cwd: context });
+    const tag = await (0, image_tag_1.resolveImageTag)({ explicitTag: build.tag, cwd: context });
     return `${repository.trim()}:${tag}`;
 }
 /** 从 buildx imagetools inspect 输出解析 digest */
@@ -106,7 +107,7 @@ async function buildLocalImage(config, onLog, options = {}) {
             code: types_1.FUNCTION_DEPLOY_ERROR.LOCAL_BUILD_CONTEXT_MISSING
         });
     }
-    const dockerfile = config.build.dockerfile || types_1.DEFAULT_DOCKERFILE;
+    const dockerfile = config.imageConfig.build.dockerfile || types_1.DEFAULT_DOCKERFILE;
     const dockerfilePath = path_1.default.resolve(context, dockerfile);
     if (!deps.existsSync(dockerfilePath) || !deps.isFile(dockerfilePath)) {
         throw new error_1.CloudBaseError(`Dockerfile 不存在：${dockerfilePath}`, {
@@ -114,7 +115,7 @@ async function buildLocalImage(config, onLog, options = {}) {
         });
     }
     const imageUri = await resolveImageUri(config, context);
-    const platform = config.build.platform || types_1.DEFAULT_IMAGE_PLATFORM;
+    const platform = config.imageConfig.build.platform || types_1.DEFAULT_IMAGE_PLATFORM;
     const args = [
         'buildx',
         'build',
@@ -126,10 +127,10 @@ async function buildLocalImage(config, onLog, options = {}) {
         imageUri,
         '--load'
     ];
-    if (config.build.forceBuild) {
+    if (config.imageConfig.build.forceBuild) {
         args.push('--no-cache');
     }
-    const buildArgs = config.build.buildArgs || {};
+    const buildArgs = config.imageConfig.build.buildArgs || {};
     for (const key of Object.keys(buildArgs)) {
         args.push('--build-arg', `${key}=${buildArgs[key]}`);
     }
@@ -244,7 +245,7 @@ function createTemporaryDockerConfig() {
  */
 async function buildAndPushImage(config, onLog, deps = defaultDeps) {
     const startedAt = Date.now();
-    const credential = config.build.registryCredential;
+    const credential = config.imageConfig.build.registryCredential;
     const dockerConfig = credential ? createTemporaryDockerConfig() : undefined;
     const commandOptions = dockerConfig ? { env: dockerConfig.env } : undefined;
     try {

package/lib/deploy/function/preflight.js

@@ -71,7 +71,8 @@ function safeStat(target) {
 }
 /** 检查 cloud 构建上下文与 Dockerfile，确保任何云端操作前即可失败 */
 function checkCloudBuildSource(config, checks) {
-    const cwd = path_1.default.resolve(config.build.cwd || config.functionPath || process.cwd());
+    const build = config.imageConfig.build;
+    const cwd = path_1.default.resolve(build.cwd || config.functionPath || process.cwd());
     const contextStat = safeStat(cwd);
     if (contextStat === null) {
         checks.push(fail(types_1.FUNCTION_DEPLOY_ERROR.BUILD_CONTEXT_INVALID, '云端镜像构建上下文目录不存在', {
@@ -87,7 +88,7 @@ function checkCloudBuildSource(config, checks) {
         }));
         return;
     }
-    const dockerfile = config.build.dockerfile || types_1.DEFAULT_DOCKERFILE;
+    const dockerfile = build.dockerfile || types_1.DEFAULT_DOCKERFILE;
     const dockerfilePath = path_1.default.resolve(cwd, dockerfile);
     const dockerfileStat = safeStat(dockerfilePath);
     if (dockerfileStat === null || !dockerfileStat.isFile()) {

package/lib/projectValidator/index.js

@@ -23,7 +23,6 @@ const path_1 = __importDefault(require("path"));
 const toolbox_1 = require("@cloudbase/toolbox");
 class ProjectValidator {
     async validate(options = {}) {
-        var _a;
         const cwd = path_1.default.resolve(options.cwd || process.cwd());
         const errors = [];
         const warnings = [];
@@ -32,7 +31,6 @@ class ProjectValidator {
             mode: options.mode,
             errors,
         });
-        const version = String(((_a = loaded.rawConfig) === null || _a === void 0 ? void 0 : _a.version) || '2.1');
         if (loaded.rawConfig) {
             this.validateSchema(loaded.rawConfig, errors);
         }
@@ -47,7 +45,6 @@ class ProjectValidator {
         const summary = this.getSummary(loaded.config);
         return {
             valid: errors.length === 0,
-            version,
             errors,
             warnings,
             summary,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cloudbase/manager-node",
-    "version": "5.8.3",
+    "version": "5.8.4",
     "description": "The node manage service api for cloudbase.",
     "main": "lib/index.js",
     "scripts": {

package/types/deploy/DeployOrchestrator.d.ts

@@ -19,8 +19,6 @@ export interface IDeployOptions {
     yes?: boolean;
     /** 已存在资源（函数）的覆盖更新确认回调：返回 true 部署、false 跳过（CLI 注入 autoConfirm） */
     confirmUpdate?: (item: IDeployPlanItem) => Promise<boolean>;
-    /** 强制云端对比（漂移检测）：忽略本地 state 快照的 skip 判定，强制重新对比/部署 */
-    refresh?: boolean;
     /** 同类型资源最大并行数，默认 1（串行）。仅作用于同类型连续实例之间，跨类型依赖顺序不变 */
     concurrency?: number;
     /** 失败后继续部署其余资源（database 失败仍强制中断） */
@@ -51,13 +49,6 @@ export interface IDeployPlanItem {
         from?: string;
         to?: string;
     }>;
-    /** hosting 文件级 diff（新增/修改/删除，前 N 条 + 统计） */
-    fileDiff?: {
-        added: string[];
-        modified: string[];
-        deleted: string[];
-        totalChanged: number;
-    };
     /** 资源级详情子行（dry-run 树状渲染用）：如函数 runtime/构建策略、迁移逐条状态等 */
     details?: Array<{
         label: string;
@@ -109,6 +100,11 @@ export declare class DeployOrchestrator {
      * - database 失败始终强制中断（无论是否 continueOnError）
      */
     deploy(options: IDeployOptions): Promise<IDeployResult>;
+    /**
+     * 归一化声明式函数配置：直接消费 cloudbaserc 的嵌套形状（imageConfig.build），
+     * 不做字段平铺映射；非 HTTP 函数原样返回。
+     */
+    private normalizeFunctionConfigs;
     /**
      * 将扁平 plan 按「连续相同资源类型」切成有序 segments
      *
@@ -117,22 +113,14 @@ export declare class DeployOrchestrator {
      * → [[db], [fnA, fnB], [hostingX, hostingY], [gateway]]
      */
     private segmentPlan;
-    /**
-     * 部署成功后写回本地 state 快照
-     *
-     * - hosting：成功部署/未变更（skip）的项重算产物指纹；失败项保留旧快照
-     * - app：成功部署写 buildAppConfig 快照；skip 复用旧快照
-     * - gateway：保留旧快照（本轮不做路由级实时快照）
-     */
-    private persistState;
     /**
      * 构建完整部署计划（按依赖顺序 + only/skip 过滤）
      *
      * 通过查询云端状态判定每个资源的动作：
      * - database：先按迁移文件做 preview，再聚合成单条资源级计划项（pending→create，存在 conflict→conflict，全部 applied→不出现在 plan）
      * - functions：ListFunctions 判断是否已存在 → create / update（不做本地 hash / 字段 diff）
-     * - app：describeAppInfo 判断是否已存在 → create / update；本地 state 配置一致 → skip
-     * - hosting：本地 state 指纹 diff → 一致 skip（不重新上传）/ 有差异 deploy（带文件级明细）
+     * - app：describeAppInfo 判断是否已存在 → create / update
+     * - hosting：直传覆盖（无存在性概念）
      * - gateway：planRoutes 对比云端路由 → create / update / skip（含变更字段明细）
      * 云端查询失败时降级为保守判定（全 create），不影响 dry-run 展示。
      */
@@ -146,11 +134,11 @@ export declare class DeployOrchestrator {
      */
     private buildDatabasePlan;
     /**
-     * app 计划：本地 state 配置一致 → skip；否则按云端存在性 → create / update
+     * app 计划：按云端存在性 → create / update
      */
     private buildAppPlan;
     /**
-     * hosting 计划：本地 state 指纹 diff → 一致 skip / 有差异 deploy（带文件级明细）
+     * hosting 计划：每次直传覆盖（无本地指纹 skip）
      */
     private buildHostingPlans;
     /**
@@ -169,10 +157,6 @@ export declare class DeployOrchestrator {
      * 执行单个计划步骤
      */
     private executeStep;
-    /** 深比较（JSON 快照语义）：仅用于 app 配置快照等简单对象 */
-    private deepEqual;
-    /** app 配置差异明细（from → to） */
-    private appConfigChanges;
     /**
      * 轻量 inline 守卫：配置合法 + 目录存在（validateProject 接线点）
      */

package/types/deploy/FunctionDeployer.d.ts

@@ -80,6 +80,20 @@ export declare class FunctionDeployer {
      * 只做纯函数、无 IO 的配置契约校验，一次返回全部问题
      */
     checkConfig(config: IFunctionDeployConfig): ICheckReport;
+    /**
+     * 计算最小化部署配置的默认值，不执行网络或云端变更。
+     */
+    applyMinimalConfigDefaults(config: IFunctionDeployConfig, context?: import('./types').IMinimalDeployConfigContext): IFunctionDeployConfig;
+    /**
+     * 返回最小化配置仍缺失的字段，不执行网络或云端变更。
+     */
+    getMissingConfigInputs(config: IFunctionDeployConfig, context?: {
+        envId?: string;
+    }): import('./types').IDeployInputField[];
+    /**
+     * 应用安全默认值并返回缺失字段，供 CLI/MCP 逐步收集用户输入。
+     */
+    prepareMinimalConfig(config: IFunctionDeployConfig, context?: import('./types').IMinimalDeployConfigContext): import('./types').IMinimalDeployConfigResult;
     /**
      * 生成部署计划
      *
@@ -166,7 +180,7 @@ export declare class FunctionDeployer {
     private emitProgressDone;
 }
 export * from './types';
-export { assertDeployConfig, checkDeployConfig, isCustomImageRuntime, normalizeDeployConfig, normalizeGatewayPath, parseImageReference } from './function/config-guard';
+export { assertDeployConfig, checkDeployConfig, applyMinimalDeployConfigDefaults, getMissingDeployInputs, prepareMinimalDeployConfig, isCustomImageRuntime, normalizeDeployConfig, normalizeGatewayPath, parseImageReference } from './function/config-guard';
 export { createDeployPlan, toCurrentState } from './function/planner';
 export { createCodeArtifact, createImageArtifactFromConfig, toCloudFunction } from './function/artifact';
 export { buildImageOnCloud } from './function/builders/cloud';

package/types/deploy/function/artifact.d.ts

@@ -1,10 +1,5 @@
 import { ICloudFunction } from '../../interfaces';
 import { ICodeArtifact, IFunctionArtifact, IImageArtifact, INormalizedDeployConfig, INormalizedHttpCloudConfig, INormalizedHttpImageConfig, INormalizedHttpLocalConfig } from '../types';
-/**
- * 部署物构造与 SCF 参数映射
- *
- * 四种构建策略最终都产出统一的部署物，之后走同一条 SCF 创建或更新流程
- */
 /** 由本地代码来源构造代码类部署物 */
 export declare function createCodeArtifact(config: INormalizedDeployConfig): ICodeArtifact;
 /** 由已有镜像配置构造镜像类部署物 */