@cloudbase/manager-node 5.8.3 → 5.8.5

package/lib/deploy/FunctionDeployer.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IMAGE_PULL_GRANT_URL = exports.REQUIRED_IMAGE_PULL_POLICY = exports.SCF_PULL_IMAGE_ROLE = exports.isCamPermissionError = exports.runImagePullAuthPreflight = exports.runImageRemotePreflight = exports.runLocalPreflight = exports.createCloudBuildService = exports.buildImageOnCloud = exports.toCloudFunction = exports.createImageArtifactFromConfig = exports.createCodeArtifact = exports.toCurrentState = exports.createDeployPlan = exports.parseImageReference = exports.normalizeGatewayPath = exports.normalizeDeployConfig = exports.isCustomImageRuntime = exports.checkDeployConfig = exports.assertDeployConfig = exports.FunctionDeployer = void 0;
+exports.IMAGE_PULL_GRANT_URL = exports.REQUIRED_IMAGE_PULL_POLICY = exports.SCF_PULL_IMAGE_ROLE = exports.isCamPermissionError = exports.runImagePullAuthPreflight = exports.runImageRemotePreflight = exports.runLocalPreflight = exports.createCloudBuildService = exports.buildImageOnCloud = exports.toCloudFunction = exports.createImageArtifactFromConfig = exports.createCodeArtifact = exports.toCurrentState = exports.createDeployPlan = exports.parseImageReference = exports.normalizeGatewayPath = exports.normalizeDeployConfig = exports.isCustomImageRuntime = exports.prepareMinimalDeployConfig = exports.getMissingDeployInputs = exports.applyMinimalDeployConfigDefaults = exports.checkDeployConfig = exports.assertDeployConfig = exports.FunctionDeployer = void 0;
 const error_1 = require("../error");
 const artifact_1 = require("./function/artifact");
 const config_guard_1 = require("./function/config-guard");
@@ -95,7 +95,12 @@ class FunctionDeployer {
             return;
         }
         const rule = this.buildPublicAccessRego(functionName);
-        const mergedRego = currentRego.trim() ? `${currentRego.trim()}\n\n${rule}` : rule;
+        // 云端 Rego 校验器要求首条有效语句（注释不计）必须是 package 声明。
+        // currentRego 非空时已含 package authz.user，直接追加规则体即可；
+        // 为空（新环境首次配置）时需补齐 package 声明，否则触发 2:1: package expected。
+        const mergedRego = currentRego.trim()
+            ? `${currentRego.trim()}\n\n${rule}`
+            : `package authz.user\n\n${rule}`;
         await permissionService.modifyEnvAuthzConfig({
             key: AUTHZ_USER_REGO_KEY,
             value: mergedRego
@@ -176,6 +181,24 @@ class FunctionDeployer {
     checkConfig(config) {
         return (0, config_guard_1.checkDeployConfig)(config);
     }
+    /**
+     * 计算最小化部署配置的默认值，不执行网络或云端变更。
+     */
+    applyMinimalConfigDefaults(config, context = {}) {
+        return (0, config_guard_1.applyMinimalDeployConfigDefaults)(config, context);
+    }
+    /**
+     * 返回最小化配置仍缺失的字段，不执行网络或云端变更。
+     */
+    getMissingConfigInputs(config, context = {}) {
+        return (0, config_guard_1.getMissingDeployInputs)(config, context);
+    }
+    /**
+     * 应用安全默认值并返回缺失字段，供 CLI/MCP 逐步收集用户输入。
+     */
+    prepareMinimalConfig(config, context = {}) {
+        return (0, config_guard_1.prepareMinimalDeployConfig)(config, context);
+    }
     /**
      * 生成部署计划
      *
@@ -202,13 +225,14 @@ class FunctionDeployer {
      * @param options 部署选项，dryRun 时只生成计划不做任何变更
      */
     async deployFunction(config, options = {}) {
+        const deployConfig = config;
         const startTime = Date.now();
         const ctx = { steps: [], options };
         const warnings = [];
-        const report = (0, config_guard_1.checkDeployConfig)(config);
+        const report = (0, config_guard_1.checkDeployConfig)(deployConfig);
         this.appendWarnings(warnings, report);
         const normalized = await this.runStep(ctx, 'validate', async () => {
-            return (0, config_guard_1.assertDeployConfig)(config);
+            return (0, config_guard_1.assertDeployConfig)(deployConfig);
         });
         const plan = await this.runStep(ctx, 'plan', async () => {
             const current = await this.getCurrentFunction(normalized.name, normalized.codeSecret);
@@ -298,7 +322,7 @@ class FunctionDeployer {
      * 将既有声明式调用补齐为完整部署配置
      */
     withLegacyDeployContext(func, functionRootPath, functionPath) {
-        var _a, _b;
+        var _a, _b, _c, _d, _e;
         const config = Object.assign({}, func);
         const strategy = this.resolveStrategy(config);
         if (functionPath) {
@@ -316,16 +340,14 @@ class FunctionDeployer {
                 (effectiveFunctionRootPath
                     ? `${effectiveFunctionRootPath}/${config.name}`
                     : undefined);
-            if (buildCwd || ((_a = config.build) === null || _a === void 0 ? void 0 : _a.cwd)) {
-                config.build = Object.assign(Object.assign({}, (config.build || {})), { cwd: ((_b = config.build) === null || _b === void 0 ? void 0 : _b.cwd) || buildCwd });
+            const existingCwd = (_b = (_a = config.imageConfig) === null || _a === void 0 ? void 0 : _a.build) === null || _b === void 0 ? void 0 : _b.cwd;
+            if (buildCwd || existingCwd) {
+                config.imageConfig = Object.assign(Object.assign({}, (config.imageConfig || {})), { build: Object.assign(Object.assign({}, (((_c = config.imageConfig) === null || _c === void 0 ? void 0 : _c.build) || {})), { cwd: existingCwd || buildCwd }) });
             }
         }
-        // 兼容旧声明式 imageUri 字段，统一转换到运行时 imageConfig 契约
-        if (strategy === 'image' && config.imageUri && !config.imageConfig) {
-            config.imageType = config.imageType || 'personal';
-            config.imageConfig = {
-                imageUri: config.imageUri
-            };
+        // 兼容旧声明式顶层 imageUri 字段，统一收敛到 imageConfig 契约
+        if (strategy === 'image' && config.imageUri && !((_d = config.imageConfig) === null || _d === void 0 ? void 0 : _d.imageUri)) {
+            config.imageConfig = Object.assign(Object.assign({ imageType: ((_e = config.imageConfig) === null || _e === void 0 ? void 0 : _e.imageType) || 'personal' }, (config.imageConfig || {})), { imageUri: config.imageUri });
             delete config.imageUri;
         }
         return config;
@@ -448,9 +470,10 @@ class FunctionDeployer {
         }
     }
     async prepareEnterpriseBuildConfig(ctx, config) {
-        const repository = config.build.repository || '';
-        const hasPreparedTarget = Boolean((config.registryId || config.build.registryId) && repository.split('/').length >= 3);
-        if (config.imageType !== 'enterprise' || hasPreparedTarget) {
+        const build = config.imageConfig.build;
+        const repository = build.repository || '';
+        const hasPreparedTarget = Boolean((config.imageConfig.registryId || build.registryId) && repository.split('/').length >= 3);
+        if (config.imageConfig.imageType !== 'enterprise' || hasPreparedTarget) {
             return { config };
         }
         const prepared = await this.runLabeledStep(ctx, {
@@ -466,13 +489,14 @@ class FunctionDeployer {
     }
     async preparePersonalBuildConfig(ctx, config) {
         var _a, _b, _c;
-        if (config.imageType !== 'personal') {
+        if (config.imageConfig.imageType !== 'personal') {
             return config;
         }
         const envId = this.resolveEnvironmentId();
-        const configuredNamespace = (_a = config.build.namespace) === null || _a === void 0 ? void 0 : _a.trim();
-        const hasConfiguredRepository = Boolean((_b = config.build.repository) === null || _b === void 0 ? void 0 : _b.trim());
-        const configuredRepository = ((_c = config.build.repository) === null || _c === void 0 ? void 0 : _c.trim()) || config.name;
+        const build = config.imageConfig.build;
+        const configuredNamespace = (_a = build.namespace) === null || _a === void 0 ? void 0 : _a.trim();
+        const hasConfiguredRepository = Boolean((_b = build.repository) === null || _b === void 0 ? void 0 : _b.trim());
+        const configuredRepository = ((_c = build.repository) === null || _c === void 0 ? void 0 : _c.trim()) || config.name;
         const parsedRepository = (0, config_guard_1.parseImageReference)(configuredRepository);
         if (!parsedRepository || parsedRepository.tag || parsedRepository.digest) {
             throw new error_1.CloudBaseError('个人版 TCR repository 不合法。', {
@@ -485,7 +509,7 @@ class FunctionDeployer {
         const namespace = configuredNamespace || repositoryNamespace || envId;
         const hasConfiguredNamespace = Boolean(configuredNamespace || repositoryNamespace);
         const registry = parsedRepository.registry || personal_tcr_1.DEFAULT_PERSONAL_TCR_REGISTRY;
-        const credential = config.build.registryCredential;
+        const credential = build.registryCredential;
         if (!(credential === null || credential === void 0 ? void 0 : credential.username) || !credential.password) {
             throw new error_1.CloudBaseError('个人版 TCR 构建缺少推送凭证。', {
                 code: types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_MISSING
@@ -502,7 +526,7 @@ class FunctionDeployer {
             })
         });
         const targetRepository = `${registry}/${namespace}/${repository}`;
-        const preparedConfig = Object.assign(Object.assign({}, config), { build: Object.assign(Object.assign({}, config.build), { namespace, repository: targetRepository, registryCredential: credential }) });
+        const preparedConfig = Object.assign(Object.assign({}, config), { imageConfig: Object.assign(Object.assign({}, config.imageConfig), { build: Object.assign(Object.assign({}, build), { namespace, repository: targetRepository, registryCredential: credential }) }) });
         return preparedConfig;
     }
     /**
@@ -520,9 +544,9 @@ class FunctionDeployer {
             // 企业版登录凭证在触发 CloudApp 构建前换取，构建容器只消费 Secrets，
             // 不再自行签名调用 TCR API。
             const cloudRegistryId = ((_a = prepared.target) === null || _a === void 0 ? void 0 : _a.registryId) ||
-                cloudConfig.build.registryId ||
-                cloudConfig.registryId;
-            const enterpriseCredential = cloudConfig.imageType === 'enterprise' && cloudRegistryId
+                cloudConfig.imageConfig.build.registryId ||
+                cloudConfig.imageConfig.registryId;
+            const enterpriseCredential = cloudConfig.imageConfig.imageType === 'enterprise' && cloudRegistryId
                 ? await this.runLabeledStep(ctx, {
                     stage: 'preflight',
                     label: '获取企业版 TCR 临时登录凭证',
@@ -560,7 +584,7 @@ class FunctionDeployer {
             try {
                 if (credential) {
                     await this.runStep(ctx, 'login', async () => {
-                        await (0, local_builder_1.loginDockerRegistry)(this.resolveRegistryFromRepository(localConfig.build.repository), credential, { deps: this.localBuilderDeps, commandOptions });
+                        await (0, local_builder_1.loginDockerRegistry)(this.resolveRegistryFromRepository(localConfig.imageConfig.build.repository), credential, { deps: this.localBuilderDeps, commandOptions });
                     });
                 }
                 const buildResult = await this.runStep(ctx, 'build', async () => {
@@ -577,14 +601,14 @@ class FunctionDeployer {
                         message: line
                     }), { deps: this.localBuilderDeps, commandOptions });
                 });
-                if (localConfig.imageType === 'personal') {
+                if (localConfig.imageConfig.imageType === 'personal') {
                     await this.runLabeledStep(ctx, {
                         stage: 'push',
                         label: '清理历史镜像标签',
                         handler: () => this.personalTcrServiceFactory().cleanupTags({
-                            namespace: localConfig.build.namespace,
-                            repository: localConfig.build.repository,
-                            retain: localConfig.build.retainedTags
+                            namespace: localConfig.imageConfig.build.namespace,
+                            repository: localConfig.imageConfig.build.repository,
+                            retain: localConfig.imageConfig.build.retainedTags
                         })
                     });
                 }
@@ -603,9 +627,10 @@ class FunctionDeployer {
     }
     async resolveLocalRegistryCredential(config) {
         var _a, _b, _c;
-        const imageType = (_a = config.imageType) !== null && _a !== void 0 ? _a : (((_b = config.registryId) !== null && _b !== void 0 ? _b : config.build.registryId) ? 'enterprise' : 'personal');
+        const build = config.imageConfig.build;
+        const imageType = (_a = config.imageConfig.imageType) !== null && _a !== void 0 ? _a : (((_b = config.imageConfig.registryId) !== null && _b !== void 0 ? _b : build.registryId) ? 'enterprise' : 'personal');
         if (imageType === 'enterprise') {
-            const registryId = (_c = config.registryId) !== null && _c !== void 0 ? _c : config.build.registryId;
+            const registryId = (_c = config.imageConfig.registryId) !== null && _c !== void 0 ? _c : build.registryId;
             if (!registryId) {
                 throw new error_1.CloudBaseError('企业版 TCR local 构建缺少 registryId。', {
                     code: types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_MISSING
@@ -614,7 +639,7 @@ class FunctionDeployer {
             const credential = await (0, enterprise_tcr_1.createEnterpriseTcrCredential)(this.tcrServiceFactory(), registryId);
             return { username: credential.username, secret: credential.token };
         }
-        const credential = config.build.registryCredential;
+        const credential = build.registryCredential;
         if (!credential) {
             return undefined;
         }
@@ -809,6 +834,9 @@ __exportStar(require("./types"), exports);
 var config_guard_2 = require("./function/config-guard");
 Object.defineProperty(exports, "assertDeployConfig", { enumerable: true, get: function () { return config_guard_2.assertDeployConfig; } });
 Object.defineProperty(exports, "checkDeployConfig", { enumerable: true, get: function () { return config_guard_2.checkDeployConfig; } });
+Object.defineProperty(exports, "applyMinimalDeployConfigDefaults", { enumerable: true, get: function () { return config_guard_2.applyMinimalDeployConfigDefaults; } });
+Object.defineProperty(exports, "getMissingDeployInputs", { enumerable: true, get: function () { return config_guard_2.getMissingDeployInputs; } });
+Object.defineProperty(exports, "prepareMinimalDeployConfig", { enumerable: true, get: function () { return config_guard_2.prepareMinimalDeployConfig; } });
 Object.defineProperty(exports, "isCustomImageRuntime", { enumerable: true, get: function () { return config_guard_2.isCustomImageRuntime; } });
 Object.defineProperty(exports, "normalizeDeployConfig", { enumerable: true, get: function () { return config_guard_2.normalizeDeployConfig; } });
 Object.defineProperty(exports, "normalizeGatewayPath", { enumerable: true, get: function () { return config_guard_2.normalizeGatewayPath; } });

package/lib/deploy/function/artifact.js

@@ -5,12 +5,30 @@ exports.createImageArtifactFromConfig = createImageArtifactFromConfig;
 exports.createImageArtifactFromBuild = createImageArtifactFromBuild;
 exports.createImageArtifactFromCloudBuild = createImageArtifactFromCloudBuild;
 exports.toCloudFunction = toCloudFunction;
+const error_1 = require("../../error");
 const types_1 = require("../types");
 /**
- * 部署物构造与 SCF 参数映射
+ * 解析构建类镜像部署物的 SCF RegistryId
  *
- * 四种构建策略最终都产出统一的部署物，之后走同一条 SCF 创建或更新流程
+ * 个人版镜像（personal，如个人版 CCR）不携带 registryId；企业版优先取
+ * imageConfig.registryId，回退到构建配置 imageConfig.build.registryId。
+ * 正常流程下企业版 registryId 已由 prepareEnterpriseTcrTarget 在构建前解析补齐，
+ * 此处对缺失场景 fail-fast 并给出明确错误：避免产出缺少 RegistryId 的部署物，
+ * 导致后续 SCF 拉取企业版镜像时失败且难以排查。
  */
+function resolveBuildRegistryId(imageConfig) {
+    var _a, _b;
+    if (imageConfig.imageType !== 'enterprise') {
+        return undefined;
+    }
+    const registryId = (_a = imageConfig.registryId) !== null && _a !== void 0 ? _a : (_b = imageConfig.build) === null || _b === void 0 ? void 0 : _b.registryId;
+    if (!registryId) {
+        throw new error_1.CloudBaseError('企业版镜像缺少 TCR 实例 ID（registryId），无法生成镜像部署物。', {
+            code: types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_MISSING
+        });
+    }
+    return registryId;
+}
 /** 由本地代码来源构造代码类部署物 */
 function createCodeArtifact(config) {
     const functionRootPath = 'functionRootPath' in config ? config.functionRootPath : undefined;
@@ -28,28 +46,26 @@ function createCodeArtifact(config) {
 }
 /** 由已有镜像配置构造镜像类部署物 */
 function createImageArtifactFromConfig(config) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+    var _a;
     const { imageConfig } = config;
-    // imageType/registryId 的契约位置在配置顶层（IHttpImageRuntimeCommon），
-    // 与 local/cloud 策略一致；imageConfig 内的同名字段仅作向后兼容兜底。
+    // 直接读取 cloudbaserc 嵌套形状：镜像字段全部位于 imageConfig。
     // 个人版镜像（personal，如个人版 CCR）不应携带 registryId。
-    const configuredRegistryId = (_a = config.registryId) !== null && _a !== void 0 ? _a : imageConfig.registryId;
-    const imageType = (_c = (_b = config.imageType) !== null && _b !== void 0 ? _b : imageConfig.imageType) !== null && _c !== void 0 ? _c : (configuredRegistryId ? 'enterprise' : 'personal');
-    const registryId = imageType === 'enterprise' ? configuredRegistryId : undefined;
+    const imageType = imageConfig.imageType;
+    const registryId = imageType === 'enterprise' ? imageConfig.registryId : undefined;
     return {
         kind: 'image',
         deployMode: 'image',
         imageUri: imageConfig.imageUri,
         imageType,
         registryId,
-        imagePort: types_1.IMAGE_FUNCTION_PORT,
+        imagePort: (_a = imageConfig.imagePort) !== null && _a !== void 0 ? _a : types_1.IMAGE_FUNCTION_PORT,
         effectiveStrategy: 'image',
-        entryPoint: (_d = imageConfig.entryPoint) !== null && _d !== void 0 ? _d : config.entryPoint,
-        command: (_e = imageConfig.command) !== null && _e !== void 0 ? _e : config.command,
-        args: (_f = imageConfig.args) !== null && _f !== void 0 ? _f : config.args,
-        commandList: (_g = imageConfig.commandList) !== null && _g !== void 0 ? _g : config.commandList,
-        argsList: (_h = imageConfig.argsList) !== null && _h !== void 0 ? _h : config.argsList,
-        containerImageAccelerate: (_j = imageConfig.containerImageAccelerate) !== null && _j !== void 0 ? _j : config.containerImageAccelerate
+        entryPoint: imageConfig.entryPoint,
+        command: imageConfig.command,
+        args: imageConfig.args,
+        commandList: imageConfig.commandList,
+        argsList: imageConfig.argsList,
+        containerImageAccelerate: imageConfig.containerImageAccelerate
     };
 }
 /**
@@ -59,11 +75,10 @@ function createImageArtifactFromConfig(config) {
  * 此处仅承载最终 imageUri/digest 与容器启动配置，之后复用镜像部署链。
  */
 function createImageArtifactFromBuild(config, build) {
-    var _a, _b, _c;
-    const imageType = (_a = config.imageType) !== null && _a !== void 0 ? _a : (((_b = config.registryId) !== null && _b !== void 0 ? _b : config.build.registryId) ? 'enterprise' : 'personal');
-    const registryId = imageType === 'enterprise'
-        ? (_c = config.registryId) !== null && _c !== void 0 ? _c : config.build.registryId
-        : undefined;
+    var _a;
+    const { imageConfig } = config;
+    const imageType = imageConfig.imageType;
+    const registryId = resolveBuildRegistryId(imageConfig);
     return {
         kind: 'image',
         deployMode: 'image',
@@ -71,14 +86,14 @@ function createImageArtifactFromBuild(config, build) {
         imageDigest: build.imageDigest,
         imageType,
         registryId,
-        imagePort: types_1.IMAGE_FUNCTION_PORT,
+        imagePort: (_a = imageConfig.imagePort) !== null && _a !== void 0 ? _a : types_1.IMAGE_FUNCTION_PORT,
         effectiveStrategy: 'local',
-        entryPoint: config.entryPoint,
-        command: config.command,
-        args: config.args,
-        commandList: config.commandList,
-        argsList: config.argsList,
-        containerImageAccelerate: config.containerImageAccelerate
+        entryPoint: imageConfig.entryPoint,
+        command: imageConfig.command,
+        args: imageConfig.args,
+        commandList: imageConfig.commandList,
+        argsList: imageConfig.argsList,
+        containerImageAccelerate: imageConfig.containerImageAccelerate
     };
 }
 /**
@@ -89,30 +104,29 @@ function createImageArtifactFromBuild(config, build) {
  * effectiveStrategy 标记为 cloud，便于结果层如实回传实际生效的策略。
  */
 function createImageArtifactFromCloudBuild(config, build) {
-    var _a, _b;
-    const imageType = (_a = config.imageType) !== null && _a !== void 0 ? _a : (config.build.registryId ? 'enterprise' : 'personal');
-    const registryId = imageType === 'enterprise'
-        ? (_b = config.registryId) !== null && _b !== void 0 ? _b : config.build.registryId
-        : undefined;
+    var _a;
+    const { imageConfig } = config;
+    const imageType = imageConfig.imageType;
+    // 云端构建默认推送到个人版 TCR（CCR）；企业版实例 ID 位于 imageConfig.build.registryId，
+    // 需继续透传到 Stage B 的 SCF ImageConfig，避免构建成功后拉取镜像时丢失 RegistryId。
+    const registryId = resolveBuildRegistryId(imageConfig);
     return {
         kind: 'image',
         deployMode: 'image',
         imageUri: build.imageUri,
         imageDigest: build.imageDigest,
-        // 云端构建默认推送到个人版 TCR（CCR）；企业版实例 ID 位于 build.registryId，
-        // 需继续透传到 Stage B 的 SCF ImageConfig，避免构建成功后拉取镜像时丢失 RegistryId。
         imageType,
         registryId,
-        imagePort: types_1.IMAGE_FUNCTION_PORT,
+        imagePort: (_a = imageConfig.imagePort) !== null && _a !== void 0 ? _a : types_1.IMAGE_FUNCTION_PORT,
         effectiveStrategy: 'cloud',
         buildId: build.buildId,
         logsUrl: build.logsUrl,
-        entryPoint: config.entryPoint,
-        command: config.command,
-        args: config.args,
-        commandList: config.commandList,
-        argsList: config.argsList,
-        containerImageAccelerate: config.containerImageAccelerate
+        entryPoint: imageConfig.entryPoint,
+        command: imageConfig.command,
+        args: imageConfig.args,
+        commandList: imageConfig.commandList,
+        argsList: imageConfig.argsList,
+        containerImageAccelerate: imageConfig.containerImageAccelerate
     };
 }
 /** 将构建产出的 tag 地址与 digest 合成为 SCF 支持的不可变镜像引用 */

package/lib/deploy/function/builders/cloud.js

@@ -109,11 +109,12 @@ function assertSafeBuildArgs(buildArgs) {
 /** 个人版 CCR 默认域名 */
 const DEFAULT_PERSONAL_REGISTRY = 'ccr.ccs.tencentyun.com';
 function resolveTarget(config) {
-    const build = config.build;
+    const build = config.imageConfig.build;
+    const imageType = config.imageConfig.imageType;
     const repository = (build.repository || config.name).trim();
     const rawRegistryId = build.registryId;
     const registryId = typeof rawRegistryId === 'string' ? rawRegistryId.trim() : rawRegistryId;
-    const isEnterprise = config.imageType === 'enterprise' || Boolean(registryId);
+    const isEnterprise = imageType === 'enterprise' || Boolean(registryId);
     // CloudApp custom 构建与推送必须使用同一个平台版本 tag。
     // 若允许自定义 tag，build-image 会构建自定义 tag，而固定推送脚本会推
     // $CLOUDBASE_VERSION_NAME，最终必然找不到本地镜像。
@@ -155,10 +156,10 @@ function resolveTarget(config) {
         throw new error_1.CloudBaseError('cloud 策略缺少 TCR 命名空间，请配置 build.namespace 或在完整 repository 中声明', { code: types_1.FUNCTION_DEPLOY_ERROR.BUILD_REPOSITORY_INVALID });
     }
     assertSafeRegistryToken(namespace, 'TCR namespace');
-    if (config.imageType === 'personal' && registryId) {
+    if (imageType === 'personal' && registryId) {
         throw new error_1.CloudBaseError('cloud 策略的 personal 镜像不能配置 build.registryId；请移除该字段或改用 enterprise', { code: types_1.FUNCTION_DEPLOY_ERROR.IMAGE_TYPE_INVALID });
     }
-    if (config.imageType === 'enterprise') {
+    if (imageType === 'enterprise') {
         if (rawRegistryId === undefined || rawRegistryId === null) {
             throw new error_1.CloudBaseError('cloud 策略的企业版 TCR 未配置 build.registryId；如果当前没有企业版实例，请改用 imageType=personal', { code: types_1.FUNCTION_DEPLOY_ERROR.IMAGE_REGISTRY_ID_MISSING });
         }
@@ -183,9 +184,10 @@ function resolveTarget(config) {
  * CustomSteps 只包含 SDK 固定命令和经过白名单校验的 build arg key。
  */
 function resolveCloudBuildOptions(config) {
-    const dockerfile = config.build.dockerfile || types_1.DEFAULT_DOCKERFILE;
-    const platform = config.build.platform || types_1.DEFAULT_IMAGE_PLATFORM;
-    const buildArgs = config.build.buildArgs || {};
+    const build = config.imageConfig.build;
+    const dockerfile = build.dockerfile || types_1.DEFAULT_DOCKERFILE;
+    const platform = build.platform || types_1.DEFAULT_IMAGE_PLATFORM;
+    const buildArgs = build.buildArgs || {};
     assertSafeDockerfile(dockerfile);
     if (platform !== types_1.DEFAULT_IMAGE_PLATFORM) {
         throw new error_1.CloudBaseError(`当前仅支持构建 ${types_1.DEFAULT_IMAGE_PLATFORM} 镜像`, {
@@ -197,7 +199,7 @@ function resolveCloudBuildOptions(config) {
         dockerfile,
         platform,
         buildArgs,
-        forceBuild: config.build.forceBuild === true
+        forceBuild: build.forceBuild === true
     };
 }
 /**
@@ -270,9 +272,9 @@ function buildRegistryCredentials(config, target, enterpriseCredential) {
             ]
         };
     }
-    const credential = config.build.registryCredential;
+    const credential = config.imageConfig.build.registryCredential;
     if (!credential) {
-        throw new error_1.CloudBaseError('个人版 TCR 云端构建缺少 build.registryCredential；请在 cloudbaserc 中显式声明 ' +
+        throw new error_1.CloudBaseError('个人版 TCR 云端构建缺少 imageConfig.build.registryCredential；请在 cloudbaserc 中显式声明 ' +
             'username/password，推荐分别使用 "{{env.TCB_TCR_USERNAME}}" 和 ' +
             '"{{env.TCB_TCR_PASSWORD}}"', { code: types_1.FUNCTION_DEPLOY_ERROR.CLOUD_REGISTRY_CREDENTIAL_MISSING });
     }
@@ -296,7 +298,7 @@ function buildRegistryCredentials(config, target, enterpriseCredential) {
     };
 }
 function resolveCloudBuildContext(config, dockerfile) {
-    const cwd = path_1.default.resolve(config.build.cwd || config.functionPath || process.cwd());
+    const cwd = path_1.default.resolve(config.imageConfig.build.cwd || config.functionPath || process.cwd());
     const dockerfilePath = path_1.default.resolve(cwd, dockerfile);
     let stat = null;
     try {

package/lib/deploy/function/cam-preflight.js

@@ -74,9 +74,10 @@ function needsImagePullAuth(config) {
 }
 /** 只有企业版 cloud 策略需要 CloudApp 向企业版 TCR 推送镜像 */
 function needsEnterpriseTcrPushAuth(config) {
+    var _a;
     return (config.type === 'HTTP' &&
         config.buildStrategy === 'cloud' &&
-        config.imageType === 'enterprise');
+        ((_a = config.imageConfig) === null || _a === void 0 ? void 0 : _a.imageType) === 'enterprise');
 }
 function resolveRequirements(config) {
     const requirements = [];