@pmate/cli 0.24.1 → 0.24.3

package/dist/index.js

@@ -10136,12 +10136,90 @@ var LoginCommandHandler = class {
 // src/services/AliyunService.ts
 var import_alidns20150109 = __toESM(require("@alicloud/alidns20150109"));
 var import_cdn20180510 = __toESM(require("@alicloud/cdn20180510"));
+var import_fc20230330 = __toESM(require("@alicloud/fc20230330"));
 var import_openapi_client = require("@alicloud/openapi-client");
+var import_sts20150401 = __toESM(require("@alicloud/sts20150401"));
 var import_ali_oss = __toESM(require("ali-oss"));
 var import_node_crypto = require("crypto");
 var import_node_fs3 = require("fs");
 var import_node_path4 = __toESM(require("path"));
 var AliyunService = class {
+  static async getAccountId() {
+    const client = this.createStsClient();
+    const response = await client.getCallerIdentity();
+    const accountId = response.body?.accountId?.trim();
+    if (!accountId) {
+      throw new Error("Aliyun STS GetCallerIdentity did not return AccountId.");
+    }
+    return accountId;
+  }
+  static async getFcFunction(functionName, options) {
+    const client = await this.createFcClient(options.region);
+    const response = await client.getFunction(
+      functionName,
+      new import_fc20230330.GetFunctionRequest({
+        ...options.qualifier ? { qualifier: options.qualifier } : {}
+      })
+    );
+    return {
+      functionName: response.body?.functionName,
+      runtime: response.body?.runtime,
+      state: response.body?.state,
+      lastModifiedTime: response.body?.lastModifiedTime
+    };
+  }
+  static async ensureFcCustomDomain(input) {
+    const client = await this.createFcClient(input.region);
+    const route = this.buildFcPathConfig(input);
+    try {
+      const response = await client.getCustomDomain(input.domainName);
+      const existing = response.body;
+      const routes = existing?.routeConfig?.routes ?? [];
+      const routeIndex = routes.findIndex((item) => item?.path === route.path);
+      if (routeIndex >= 0) {
+        const current = routes[routeIndex];
+        if (current?.functionName === route.functionName && (current?.qualifier || "LATEST") === route.qualifier && !input.certConfig && (existing?.protocol || "HTTP") === (input.protocol ?? existing?.protocol ?? "HTTP")) {
+          ui.success(`FC custom domain route already exists: ${input.domainName}${route.path}`);
+          return;
+        }
+        routes[routeIndex] = route;
+      } else {
+        routes.push(route);
+      }
+      await client.updateCustomDomain(
+        input.domainName,
+        new import_fc20230330.UpdateCustomDomainRequest({
+          body: new import_fc20230330.UpdateCustomDomainInput({
+            protocol: input.protocol ?? existing?.protocol ?? "HTTP",
+            ...input.certConfig ? {
+              certConfig: new import_fc20230330.CertConfig(input.certConfig)
+            } : {},
+            routeConfig: new import_fc20230330.RouteConfig({ routes })
+          })
+        })
+      );
+      ui.success(`Updated FC custom domain route: ${input.domainName}${route.path}`);
+      return;
+    } catch (error) {
+      if (!this.isNotFoundError(error)) {
+        throw error;
+      }
+    }
+    await client.createCustomDomain(
+      new import_fc20230330.CreateCustomDomainRequest({
+        body: new import_fc20230330.CreateCustomDomainInput({
+          domainName: input.domainName,
+          protocol: input.protocol ?? (input.certConfig ? "HTTP,HTTPS" : "HTTP"),
+          ...input.certConfig ? {
+            certConfig: new import_fc20230330.CertConfig(input.certConfig)
+          } : {},
+          authConfig: new import_fc20230330.AuthConfig({ authType: "anonymous", authInfo: "{}" }),
+          routeConfig: new import_fc20230330.RouteConfig({ routes: [route] })
+        })
+      })
+    );
+    ui.success(`Created FC custom domain: ${input.domainName}`);
+  }
   /** Add a DNS record via Aliyun DNS. */
   static async addRecord(input) {
     const userConfig = loadPmateConfig();
@@ -10797,6 +10875,48 @@ var AliyunService = class {
         return void 0;
     }
   }
+  static buildFcPathConfig(input) {
+    return new import_fc20230330.PathConfig({
+      path: input.routePath ?? "/*",
+      functionName: input.functionName,
+      qualifier: input.qualifier ?? "LATEST",
+      methods: ["GET", "POST", "PUT", "DELETE", "HEAD", "OPTIONS"]
+    });
+  }
+  static createStsClient() {
+    const cfg = loadPmateConfig();
+    const accessKeyId = cfg.aliyun?.ak?.trim();
+    const accessKeySecret = cfg.aliyun?.sk?.trim();
+    if (!accessKeyId) throw new Error("Missing aliyun.ak in ~/.pmate/config.yaml.");
+    if (!accessKeySecret) throw new Error("Missing aliyun.sk in ~/.pmate/config.yaml.");
+    return new import_sts20150401.default(
+      new import_openapi_client.Config({
+        accessKeyId,
+        accessKeySecret,
+        regionId: cfg.aliyun?.region?.trim() || "cn-hangzhou"
+      })
+    );
+  }
+  static async createFcClient(region) {
+    const cfg = loadPmateConfig();
+    const accessKeyId = cfg.aliyun?.ak?.trim();
+    const accessKeySecret = cfg.aliyun?.sk?.trim();
+    if (!accessKeyId) throw new Error("Missing aliyun.ak in ~/.pmate/config.yaml.");
+    if (!accessKeySecret) throw new Error("Missing aliyun.sk in ~/.pmate/config.yaml.");
+    const accountId = await this.getAccountId();
+    return new import_fc20230330.default(
+      new import_openapi_client.Config({
+        accessKeyId,
+        accessKeySecret,
+        regionId: region,
+        endpoint: `${accountId}.${region}.fc.aliyuncs.com`
+      })
+    );
+  }
+  static isNotFoundError(error) {
+    const maybe = error;
+    return maybe?.statusCode === 404 || maybe?.code === "DomainNameNotFound" || maybe?.code === "ResourceNotFound" || /not found|not exist/i.test(maybe?.message || "");
+  }
 };
 
 // src/commands/AddDnsCommandHandler.ts
@@ -15932,10 +16052,12 @@ var CollectCommandHandler = class {
     return best?.page ?? null;
   }
   async extractThreadsFromConversationData(page) {
-    const result = await this.evaluateInPage(page, buildListThreadsExpr()).catch((error) => ({
-      ok: false,
-      reason: error instanceof Error ? error.message : String(error)
-    }));
+    const result = await this.evaluateInPage(page, buildListThreadsExpr()).catch(
+      (error) => ({
+        ok: false,
+        reason: error instanceof Error ? error.message : String(error)
+      })
+    );
     if (!result || !("ok" in result) || !result.ok || !Array.isArray(result.threads)) {
       throw new Error(
         result && "reason" in result && typeof result.reason === "string" ? result.reason : "unknown error"
@@ -15967,7 +16089,12 @@ var CollectCommandHandler = class {
     const result = await this.evaluateInPage(
       page,
       buildGetMessagesByConversationExpr(thread.conversationId, limit)
-    ).catch((error) => ({ ok: false, reason: error instanceof Error ? error.message : String(error) }));
+    ).catch(
+      (error) => ({
+        ok: false,
+        reason: error instanceof Error ? error.message : String(error)
+      })
+    );
     if (!result || !("ok" in result) || !result.ok || !Array.isArray(result.messages)) {
       return {
         error: result && "reason" in result && typeof result.reason === "string" ? result.reason : "unknown error"
@@ -17945,6 +18072,159 @@ var import_node_path22 = __toESM(require("path"));
 var import_node_child_process10 = require("child_process");
 var import_node_readline = require("readline");
 var import_chalk3 = __toESM(require("chalk"));
+
+// src/services/ServiceRegistryClient.ts
+init_sessionStore();
+var ServiceRegistryNotFoundError = class extends Error {
+  constructor(namespace, name) {
+    super(`Service not found: ${namespace}/${name}`);
+    this.name = "ServiceRegistryNotFoundError";
+  }
+};
+var ServiceRegistryClient = class {
+  constructor(baseUrl) {
+    this.baseUrl = baseUrl;
+  }
+  async listServices(filters) {
+    const searchParams = new URLSearchParams();
+    const repository = normalizeRepository(filters?.repository);
+    if (repository) {
+      searchParams.set("repo", repository);
+    }
+    const server = filters?.server?.trim();
+    if (server) {
+      searchParams.set("server", server);
+    }
+    const payload = await this.request(
+      "GET",
+      `/services${searchParams.size > 0 ? `?${searchParams.toString()}` : ""}`
+    );
+    const namespace = filters?.namespace?.trim();
+    return payload.items.filter((item) => {
+      if (namespace && item.namespace !== namespace) {
+        return false;
+      }
+      return true;
+    });
+  }
+  async getService(namespace, name) {
+    return this.request(
+      "GET",
+      `/services/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}`
+    );
+  }
+  async updateService(namespace, name, payload) {
+    return this.requestWithBody(
+      "PUT",
+      `/services/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}`,
+      payload
+    );
+  }
+  async listEnvItems(appId, options = {}) {
+    const params = new URLSearchParams();
+    if (options.scope) {
+      params.set("scope", options.scope);
+    }
+    if (options.includeSecretMeta) {
+      params.set("includeSecretMeta", "true");
+    }
+    const payload = await this.request(
+      "GET",
+      `/apps/by-id/${encodeURIComponent(appId)}/env${params.size > 0 ? `?${params.toString()}` : ""}`
+    );
+    return payload.items;
+  }
+  async resolveEnv(appId, options) {
+    return this.requestWithBody(
+      "POST",
+      `/apps/by-id/${encodeURIComponent(appId)}/env/resolve`,
+      {
+        stage: options.stage,
+        ...options.branch ? { branch: options.branch } : {},
+        ...options.includeSecretValue ? { includeSecretValue: true } : {}
+      }
+    );
+  }
+  resolveBaseUrl() {
+    return (this.baseUrl || process.env.PMATE_APPS_API_BASE_URL || "https://apps-api.pmate.chat").replace(/\/+$/, "");
+  }
+  readToken() {
+    return readRequiredSession({
+      preferredApp: DEFAULT_APP_ID,
+      fallbackToActiveApp: true
+    }).token;
+  }
+  async request(method, pathname) {
+    const response = await fetch(`${this.resolveBaseUrl()}${pathname}`, {
+      method,
+      headers: {
+        Authorization: `Bearer ${this.readToken()}`,
+        Accept: "application/json"
+      }
+    });
+    let payload = null;
+    try {
+      payload = await response.json();
+    } catch {
+      payload = null;
+    }
+    if (response.status === 404) {
+      const segments = pathname.split("/").filter(Boolean);
+      throw new ServiceRegistryNotFoundError(
+        decodeURIComponent(segments[1] || "unknown"),
+        decodeURIComponent(segments[2] || "unknown")
+      );
+    }
+    if (!response.ok || !payload?.success || payload.data === void 0) {
+      throw new Error(payload?.message || `Request failed with status ${response.status}`);
+    }
+    return payload.data;
+  }
+  async requestWithBody(method, pathname, body) {
+    const response = await fetch(`${this.resolveBaseUrl()}${pathname}`, {
+      method,
+      headers: {
+        Authorization: `Bearer ${this.readToken()}`,
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+    });
+    let payload = null;
+    try {
+      payload = await response.json();
+    } catch {
+      payload = null;
+    }
+    if (response.status === 404) {
+      const segments = pathname.split("/").filter(Boolean);
+      throw new ServiceRegistryNotFoundError(
+        decodeURIComponent(segments[1] || "unknown"),
+        decodeURIComponent(segments[2] || "unknown")
+      );
+    }
+    if (!response.ok || !payload?.success || payload.data === void 0) {
+      throw new Error(payload?.message || `Request failed with status ${response.status}`);
+    }
+    return payload.data;
+  }
+};
+function normalizeRepository(repository) {
+  if (!repository) {
+    return void 0;
+  }
+  const trimmed = repository.trim().replace(/\/+$/, "").replace(/\.git$/i, "");
+  if (!trimmed) {
+    return void 0;
+  }
+  const match = trimmed.match(/^https?:\/\/github\.com\/([^/]+\/[^/]+)$/i);
+  if (match) {
+    return match[1];
+  }
+  return trimmed.replace(/^\/+/, "");
+}
+
+// src/services/ServiceRuntimeRunner.ts
 var ServiceRuntimeRunner = class {
   async deploy(service, options = {}) {
     switch (this.getType(service)) {
@@ -17961,6 +18241,9 @@ var ServiceRuntimeRunner = class {
       case "python":
         await this.deployScriptManaged(service);
         return;
+      case "fc":
+        await this.deployFc(service);
+        return;
       case "ios":
       case "android":
         throw new Error(
@@ -17983,6 +18266,9 @@ var ServiceRuntimeRunner = class {
       case "python":
         await this.initServerApp(service, options, { ensurePackageJson: false });
         return;
+      case "fc":
+        await this.initFc(service, options);
+        return;
       case "ios":
       case "android":
         throw new Error(
@@ -18084,13 +18370,21 @@ var ServiceRuntimeRunner = class {
       return service.network;
     }
     const deploy = this.isLegacy(service) ? service.deploy ?? {} : {};
-    const exposeType = deploy.port === void 0 ? "internal" : deploy.serviceType === "ws" ? "websocket" : "rest";
+    if (deploy.port === void 0) {
+      return {
+        exposeType: "internal",
+        repository: String(deploy.repository ?? ""),
+        dir: String(deploy.dir ?? ""),
+        server: String(deploy.server ?? "")
+      };
+    }
+    const exposeType = deploy.serviceType === "ws" ? "websocket" : "rest";
     return {
       exposeType,
       repository: String(deploy.repository ?? ""),
       dir: String(deploy.dir ?? ""),
       server: String(deploy.server ?? ""),
-      ...deploy.port !== void 0 ? { port: Number(deploy.port) } : {},
+      port: Number(deploy.port),
       ...deploy.domain ? { domain: deploy.domain } : {},
       ...deploy.subdomain ? { subdomain: deploy.subdomain } : {}
     };
@@ -18104,17 +18398,28 @@ var ServiceRuntimeRunner = class {
       script: String(deploy.script ?? "")
     };
   }
+  getFc(service) {
+    if (!this.isLegacy(service) && service.fc) {
+      return service.fc;
+    }
+    throw new Error(`Missing fc config for ${service.id}`);
+  }
   resolveRepoRoot(service, cwd) {
     if (cwd) {
       return import_node_path22.default.resolve(process.cwd(), cwd);
     }
-    const repository = this.getType(service) === "vite" || this.getType(service) === "static" ? this.getSite(service).repository?.trim() : this.getType(service) === "ios" || this.getType(service) === "android" ? void 0 : this.getNetwork(service).repository?.trim();
+    const repository = this.getType(service) === "vite" || this.getType(service) === "static" ? this.getSite(service).repository?.trim() : this.getType(service) === "fc" ? this.getFc(service).repository?.trim() : this.getType(service) === "ios" || this.getType(service) === "android" ? void 0 : this.getNetwork(service).repository?.trim();
     if (repository) {
       const repoName = repository.replace(/\/+$/, "").split("/").pop()?.replace(/\.git$/i, "");
       if (repoName) {
-        const candidate = import_node_path22.default.join(import_node_os8.default.homedir(), "dev", "pmate", repoName);
-        if ((0, import_node_fs17.existsSync)(candidate)) {
-          return candidate;
+        const candidates = [
+          import_node_path22.default.join(import_node_os8.default.homedir(), "dev", "pmate", repoName),
+          import_node_path22.default.join(import_node_os8.default.homedir(), "dev", "pmate-envs", repoName)
+        ];
+        for (const candidate of candidates) {
+          if ((0, import_node_fs17.existsSync)(candidate)) {
+            return candidate;
+          }
         }
       }
     }
@@ -18122,7 +18427,7 @@ var ServiceRuntimeRunner = class {
   }
   resolveLocalDir(service, cwd) {
     const repoRoot = this.resolveRepoRoot(service, cwd);
-    const dir = this.getType(service) === "vite" || this.getType(service) === "static" ? this.getSite(service).dir?.trim() : this.getType(service) === "ios" || this.getType(service) === "android" ? void 0 : this.getNetwork(service).dir?.trim();
+    const dir = this.getType(service) === "vite" || this.getType(service) === "static" ? this.getSite(service).dir?.trim() : this.getType(service) === "fc" ? this.getFc(service).dir?.trim() : this.getType(service) === "ios" || this.getType(service) === "android" ? void 0 : this.getNetwork(service).dir?.trim();
     if (!dir) {
       throw new Error(`Missing service dir for ${service.id}`);
     }
@@ -18164,6 +18469,122 @@ var ServiceRuntimeRunner = class {
     }
     await AliyunService.uploadDirectory(srcDir, bucketName);
   }
+  async deployFc(service) {
+    const fc = this.getFc(service);
+    this.validateFcConfig(service, fc);
+    const repoRoot = this.resolveRepoRoot(service);
+    const appDir = this.resolveLocalDir(service);
+    const packageJsonPath = import_node_path22.default.join(appDir, "package.json");
+    if (!(0, import_node_fs17.existsSync)(packageJsonPath)) {
+      throw new Error(`No package.json found at ${packageJsonPath}`);
+    }
+    const pkg2 = this.loadPackageJson(packageJsonPath);
+    const pkgName = pkg2.name?.trim();
+    if (!pkgName) {
+      throw new Error(`Missing package name in ${packageJsonPath}`);
+    }
+    await this.ensurePnpmWorkspaceRoot(repoRoot);
+    await this.runCommand("pnpm", ["--filter", pkgName, "build"], repoRoot);
+    const registry = new ServiceRegistryClient();
+    const appId = `${service.namespace}:${service.name}`;
+    const stage = fc.deployStage ?? "prod";
+    const requiredEnv = await this.syncFcRequiredEnv(service, registry, stage);
+    const resolved = await registry.resolveEnv(appId, {
+      stage,
+      includeSecretValue: true
+    });
+    const missing = requiredEnv.filter((key) => !this.hasResolvedEnvValue(resolved.values, key));
+    if (missing.length > 0) {
+      throw new Error(`Missing resolved env for ${service.id}: ${missing.join(", ")}`);
+    }
+    const deployEnv = {
+      ...resolved.values,
+      ...await this.resolveAliyunDeploymentEnv(),
+      ...this.resolveFcNoProxyEnv()
+    };
+    const deployCommand = fc.deployCommand?.trim();
+    if (deployCommand) {
+      await this.runShellCommand(deployCommand, repoRoot, deployEnv);
+    } else if (pkg2.scripts?.release) {
+      await this.runCommandWithEnv("pnpm", ["--filter", pkgName, "release"], repoRoot, deployEnv);
+    } else {
+      await this.runCommandWithEnv("pnpm", ["release"], appDir, deployEnv);
+    }
+    const functionInfo = await AliyunService.getFcFunction(fc.functionName, {
+      region: fc.region,
+      qualifier: fc.qualifier
+    });
+    ui.success(`Deployed FC function ${fc.functionName}`, {
+      region: fc.region,
+      runtime: functionInfo.runtime,
+      state: functionInfo.state,
+      lastModifiedTime: functionInfo.lastModifiedTime,
+      url: this.buildFcUrl(fc)
+    });
+  }
+  async initFc(service, options) {
+    const fc = this.getFc(service);
+    this.validateFcConfig(service, fc);
+    const repoRoot = this.resolveRepoRoot(service, options.cwd);
+    const appDir = this.resolveLocalDir(service, options.cwd);
+    await this.ensurePnpmWorkspaceRoot(repoRoot);
+    const configPath = import_node_path22.default.join(appDir, fc.configFile ?? "s.yaml");
+    if (!(0, import_node_fs17.existsSync)(configPath)) {
+      throw new Error(`Missing FC config file at ${configPath}`);
+    }
+    const packageJsonPath = import_node_path22.default.join(appDir, "package.json");
+    if (!(0, import_node_fs17.existsSync)(packageJsonPath)) {
+      throw new Error(`No package.json found at ${packageJsonPath}`);
+    }
+    const rawConfig = (0, import_node_fs17.readFileSync)(configPath, "utf8");
+    if (!rawConfig.includes(fc.functionName)) {
+      throw new Error(`FC config ${configPath} does not mention functionName ${fc.functionName}`);
+    }
+    const accountId = await AliyunService.getAccountId();
+    await AliyunService.getFcFunction(fc.functionName, {
+      region: fc.region,
+      qualifier: fc.qualifier
+    });
+    const host = this.buildFcHost(fc);
+    if (host) {
+      const cnameTarget = `${accountId}.${fc.region}.fc.aliyuncs.com`;
+      const rr = fc.subdomain?.trim() || "@";
+      const domain = fc.domain.trim();
+      const existing = await AliyunService.getCnameRecordValue(domain, rr);
+      if (existing) {
+        if (this.normalizeDnsValue(existing) !== this.normalizeDnsValue(cnameTarget)) {
+          throw new Error(
+            `Existing CNAME for ${host} points to ${existing}, not ${cnameTarget}.`
+          );
+        }
+        ui.success(`CNAME already exists: ${host} -> ${cnameTarget}`);
+      } else {
+        await AliyunService.addRecord({
+          domainName: domain,
+          rr,
+          type: "CNAME",
+          value: cnameTarget,
+          ttl: 600
+        });
+        ui.success(`Added CNAME ${host} -> ${cnameTarget}`);
+      }
+      const certConfig = this.resolveFcCertConfig(host);
+      await AliyunService.ensureFcCustomDomain({
+        domainName: host,
+        region: fc.region,
+        functionName: fc.functionName,
+        routePath: fc.routePath,
+        protocol: this.resolveFcProtocol(fc, certConfig),
+        qualifier: fc.qualifier,
+        certConfig
+      });
+    }
+    ui.success(`Initialized FC service ${service.id}`, {
+      functionName: fc.functionName,
+      region: fc.region,
+      url: this.buildFcUrl(fc)
+    });
+  }
   async deployNode(service) {
     const network = this.getNetwork(service);
     const server = network.server?.trim();
@@ -18828,9 +19249,185 @@ var ServiceRuntimeRunner = class {
     (0, import_node_fs17.writeFileSync)(packageJsonPath, `${serialized}
 `, "utf8");
   }
+  validateFcConfig(service, fc) {
+    if (fc.provider !== "aliyun") {
+      throw new Error(`Unsupported fc.provider for ${service.id}: ${fc.provider}`);
+    }
+    if (!fc.region?.trim()) {
+      throw new Error(`Missing fc.region for ${service.id}`);
+    }
+    if (!fc.repository?.trim()) {
+      throw new Error(`Missing fc.repository for ${service.id}`);
+    }
+    if (!fc.dir?.trim()) {
+      throw new Error(`Missing fc.dir for ${service.id}`);
+    }
+    if (!fc.functionName?.trim()) {
+      throw new Error(`Missing fc.functionName for ${service.id}`);
+    }
+    if (fc.domain && !fc.domain.trim()) {
+      throw new Error(`Invalid fc.domain for ${service.id}`);
+    }
+    if (fc.subdomain && !fc.domain?.trim()) {
+      throw new Error(`Missing fc.domain for ${service.id} (required when fc.subdomain is set)`);
+    }
+  }
+  async ensurePnpmWorkspaceRoot(repoRoot) {
+    const workspacePath = import_node_path22.default.join(repoRoot, "pnpm-workspace.yaml");
+    if (!(0, import_node_fs17.existsSync)(workspacePath)) {
+      throw new Error(`Missing pnpm-workspace.yaml at ${workspacePath}`);
+    }
+  }
+  async syncFcRequiredEnv(service, registry, stage) {
+    if (this.isLegacy(service)) {
+      return [];
+    }
+    const appId = `${service.namespace}:${service.name}`;
+    const items = await registry.listEnvItems(appId, {
+      scope: stage,
+      includeSecretMeta: true
+    });
+    const requiredEnv = Array.from(
+      new Set(
+        items.map((item) => item.key ?? item.name).filter((key) => typeof key === "string" && key.trim().length > 0).map((key) => key.trim())
+      )
+    ).sort();
+    const current = service.fc?.requiredEnv ?? [];
+    if (this.sameStringSet(current, requiredEnv)) {
+      return requiredEnv;
+    }
+    service.fc = {
+      ...service.fc,
+      requiredEnv
+    };
+    await registry.updateService(service.namespace, service.name, service);
+    ui.success(`Synced fc.requiredEnv for ${service.id}`, requiredEnv);
+    return requiredEnv;
+  }
+  sameStringSet(left, right) {
+    if (left.length !== right.length) {
+      return false;
+    }
+    const normalizedLeft = [...left].sort();
+    const normalizedRight = [...right].sort();
+    return normalizedLeft.every((value, index) => value === normalizedRight[index]);
+  }
+  hasResolvedEnvValue(values, key) {
+    return Object.prototype.hasOwnProperty.call(values, key) && values[key] !== void 0 && values[key] !== "";
+  }
+  buildFcHost(fc) {
+    const domain = fc.domain?.trim();
+    if (!domain) {
+      return void 0;
+    }
+    const subdomain = fc.subdomain?.trim();
+    return subdomain ? `${subdomain}.${domain}` : domain;
+  }
+  buildFcUrl(fc) {
+    const host = this.buildFcHost(fc);
+    return host ? `https://${host}` : void 0;
+  }
+  normalizeDnsValue(value) {
+    return value.trim().replace(/\.$/, "").toLowerCase();
+  }
+  resolveFcCertConfig(host) {
+    const config = loadPmateConfig();
+    const certificatePath = config.ssl?.pub?.trim();
+    const privateKeyPath = config.ssl?.prv?.trim();
+    if (!certificatePath && !privateKeyPath) {
+      return void 0;
+    }
+    if (!certificatePath) {
+      throw new Error("Missing ssl.pub in ~/.pmate/config.yaml.");
+    }
+    if (!privateKeyPath) {
+      throw new Error("Missing ssl.prv in ~/.pmate/config.yaml.");
+    }
+    if (!(0, import_node_fs17.existsSync)(certificatePath)) {
+      throw new Error(`SSL certificate file not found: ${certificatePath}`);
+    }
+    if (!(0, import_node_fs17.existsSync)(privateKeyPath)) {
+      throw new Error(`SSL private key file not found: ${privateKeyPath}`);
+    }
+    return {
+      certName: host,
+      certificate: (0, import_node_fs17.readFileSync)(certificatePath, "utf8"),
+      privateKey: (0, import_node_fs17.readFileSync)(privateKeyPath, "utf8")
+    };
+  }
+  resolveFcProtocol(fc, certConfig) {
+    if (!certConfig) {
+      return fc.protocol;
+    }
+    return fc.protocol === "HTTPS" ? "HTTPS" : "HTTP,HTTPS";
+  }
+  async resolveAliyunDeploymentEnv() {
+    const config = loadPmateConfig();
+    const accessKeyId = config.aliyun?.ak?.trim();
+    const accessKeySecret = config.aliyun?.sk?.trim();
+    if (!accessKeyId) {
+      throw new Error("Missing aliyun.ak in ~/.pmate/config.yaml.");
+    }
+    if (!accessKeySecret) {
+      throw new Error("Missing aliyun.sk in ~/.pmate/config.yaml.");
+    }
+    return {
+      AccessKeyID: accessKeyId,
+      AccessKeySecret: accessKeySecret,
+      AccountID: await AliyunService.getAccountId()
+    };
+  }
+  resolveFcNoProxyEnv() {
+    const noProxy = /* @__PURE__ */ new Set(
+      [
+        "localhost",
+        "127.0.0.1",
+        "api.devsapp.cn",
+        "devsapp.cn",
+        "aliyuncs.com"
+      ]
+    );
+    for (const value of [process.env.NO_PROXY, process.env.no_proxy]) {
+      for (const item of value?.split(",") ?? []) {
+        const trimmed = item.trim();
+        if (trimmed) {
+          noProxy.add(trimmed);
+        }
+      }
+    }
+    return {
+      HTTP_PROXY: "",
+      HTTPS_PROXY: "",
+      ALL_PROXY: "",
+      http_proxy: "",
+      https_proxy: "",
+      all_proxy: "",
+      NO_PROXY: Array.from(noProxy).join(","),
+      no_proxy: Array.from(noProxy).join(",")
+    };
+  }
   runCommand(command, args, cwd) {
+    return this.runCommandWithEnv(command, args, cwd);
+  }
+  runCommandWithEnv(command, args, cwd, env) {
+    return new Promise((resolve, reject) => {
+      const child = (0, import_node_child_process10.spawn)(command, args, {
+        cwd,
+        stdio: "inherit",
+        env: { ...process.env, ...env ?? {} }
+      });
+      child.on("error", reject);
+      child.on("close", (code) => code === 0 ? resolve() : reject(new Error(`${command} exited with code ${code}`)));
+    });
+  }
+  runShellCommand(command, cwd, env) {
     return new Promise((resolve, reject) => {
-      const child = (0, import_node_child_process10.spawn)(command, args, { cwd, stdio: "inherit" });
+      const child = (0, import_node_child_process10.spawn)(command, [], {
+        cwd,
+        stdio: "inherit",
+        shell: true,
+        env: { ...process.env, ...env ?? {} }
+      });
       child.on("error", reject);
       child.on("close", (code) => code === 0 ? resolve() : reject(new Error(`${command} exited with code ${code}`)));
     });
@@ -18877,97 +19474,6 @@ var ServiceRuntimeRunner = class {
   }
 };
 
-// src/services/ServiceRegistryClient.ts
-init_sessionStore();
-var ServiceRegistryNotFoundError = class extends Error {
-  constructor(namespace, name) {
-    super(`Service not found: ${namespace}/${name}`);
-    this.name = "ServiceRegistryNotFoundError";
-  }
-};
-var ServiceRegistryClient = class {
-  constructor(baseUrl) {
-    this.baseUrl = baseUrl;
-  }
-  async listServices(filters) {
-    const searchParams = new URLSearchParams();
-    const repository = normalizeRepository(filters?.repository);
-    if (repository) {
-      searchParams.set("repo", repository);
-    }
-    const server = filters?.server?.trim();
-    if (server) {
-      searchParams.set("server", server);
-    }
-    const payload = await this.request(
-      "GET",
-      `/services${searchParams.size > 0 ? `?${searchParams.toString()}` : ""}`
-    );
-    const namespace = filters?.namespace?.trim();
-    return payload.items.filter((item) => {
-      if (namespace && item.namespace !== namespace) {
-        return false;
-      }
-      return true;
-    });
-  }
-  async getService(namespace, name) {
-    return this.request(
-      "GET",
-      `/services/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}`
-    );
-  }
-  resolveBaseUrl() {
-    return (this.baseUrl || process.env.PMATE_APPS_API_BASE_URL || "https://apps-api.pmate.chat").replace(/\/+$/, "");
-  }
-  readToken() {
-    return readRequiredSession({
-      preferredApp: DEFAULT_APP_ID,
-      fallbackToActiveApp: true
-    }).token;
-  }
-  async request(method, pathname) {
-    const response = await fetch(`${this.resolveBaseUrl()}${pathname}`, {
-      method,
-      headers: {
-        Authorization: `Bearer ${this.readToken()}`,
-        Accept: "application/json"
-      }
-    });
-    let payload = null;
-    try {
-      payload = await response.json();
-    } catch {
-      payload = null;
-    }
-    if (response.status === 404) {
-      const segments = pathname.split("/").filter(Boolean);
-      throw new ServiceRegistryNotFoundError(
-        decodeURIComponent(segments[1] || "unknown"),
-        decodeURIComponent(segments[2] || "unknown")
-      );
-    }
-    if (!response.ok || !payload?.success || payload.data === void 0) {
-      throw new Error(payload?.message || `Request failed with status ${response.status}`);
-    }
-    return payload.data;
-  }
-};
-function normalizeRepository(repository) {
-  if (!repository) {
-    return void 0;
-  }
-  const trimmed = repository.trim().replace(/\/+$/, "").replace(/\.git$/i, "");
-  if (!trimmed) {
-    return void 0;
-  }
-  const match = trimmed.match(/^https?:\/\/github\.com\/([^/]+\/[^/]+)$/i);
-  if (match) {
-    return match[1];
-  }
-  return trimmed.replace(/^\/+/, "");
-}
-
 // src/commands/ServiceCommandHandler.ts
 init_namespacedRef();
 var ServiceCommandHandler = class {
@@ -19122,6 +19628,7 @@ var ServiceCommandHandler = class {
           }
         );
         ui.success(`Updated env ${args.key} for ${args.appId}`);
+        await this.syncFcRequiredEnvFromServiceEnv(registry, args.appId, args.scope);
         this.renderJson(payload, args.json);
         return;
       }
@@ -19134,6 +19641,7 @@ var ServiceCommandHandler = class {
           }).toString()}`
         );
         ui.success(`Deleted env ${payload.key} (${payload.scope}) from ${args.appId}`);
+        await this.syncFcRequiredEnvFromServiceEnv(registry, args.appId, args.scope);
         this.renderJson(payload, args.json);
         return;
       }
@@ -19319,6 +19827,48 @@ var ServiceCommandHandler = class {
       );
     }
   }
+  async syncFcRequiredEnvFromServiceEnv(registry, appId, scope) {
+    const [namespace, name, extra] = appId.split(":");
+    if (!namespace || !name || extra !== void 0) {
+      return;
+    }
+    let service;
+    try {
+      service = await registry.getService(namespace, name);
+    } catch (error) {
+      if (error instanceof ServiceRegistryNotFoundError) {
+        return;
+      }
+      throw error;
+    }
+    if (!("type" in service) || service.type !== "fc" || !service.fc) {
+      return;
+    }
+    const items = await registry.listEnvItems(appId, {
+      scope,
+      includeSecretMeta: true
+    });
+    const requiredEnv = Array.from(
+      new Set(
+        items.map((item) => item.key ?? item.name).filter((key) => typeof key === "string" && key.trim().length > 0).map((key) => key.trim())
+      )
+    ).sort();
+    const current = service.fc.requiredEnv ?? [];
+    if (this.sameStringSet(current, requiredEnv)) {
+      return;
+    }
+    service.fc = { ...service.fc, requiredEnv };
+    await registry.updateService(namespace, name, service);
+    ui.success(`Synced fc.requiredEnv for ${appId}`);
+  }
+  sameStringSet(left, right) {
+    if (left.length !== right.length) {
+      return false;
+    }
+    const normalizedLeft = [...left].sort();
+    const normalizedRight = [...right].sort();
+    return normalizedLeft.every((value, index) => value === normalizedRight[index]);
+  }
   renderList(items, asJson) {
     if (asJson) {
       ui.plain(JSON.stringify(items, null, 2));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pmate/cli",
-  "version": "0.24.1",
+  "version": "0.24.3",
   "description": "CLI utilities for the pMate project",
   "license": "MIT",
   "bin": {
@@ -36,7 +36,9 @@
   "dependencies": {
     "@alicloud/alidns20150109": "^4.0.0",
     "@alicloud/cdn20180510": "^8.0.0",
+    "@alicloud/fc20230330": "^4.7.4",
     "@alicloud/openapi-client": "^0.4.15",
+    "@alicloud/sts20150401": "^1.2.0",
     "@linear/sdk": "^70.0.0",
     "@types/ali-oss": "^6.16.13",
     "ajv": "^8.17.1",