huaweicloud-devkit 0.1.17

package/plugins/huaweicloud-core/skills/huawei-ecs/SKILL.md

@@ -0,0 +1,131 @@
+---
+name: huawei-ecs
+description: "Use when creating, configuring, managing, or troubleshooting ECS instances on Huawei Cloud. Covers instance creation (hcloud ECS CreateServers), flavor selection, image management, security groups, EIP binding, disk attachment, auto-scaling (AS), and troubleshooting. Triggers on: ECS, instance, flavor, image, security group, EIP, EVS, auto-scaling. NOT for: CCE container workloads (use huawei-cce), BMS bare metal servers."
+version: 1
+---
+
+# Huawei Cloud ECS
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for Huawei Cloud Elastic Cloud Server (ECS). Covers instance lifecycle, flavor selection, image management, networking, storage attachment, auto-scaling, and troubleshooting.
+
+## Prerequisites
+
+Before creating an ECS instance from scratch, you MUST have:
+- A VPC (see `huawei-vpc`)
+- A subnet with DNS configured (see `huawei-vpc`)
+- A security group with application ports open (see `huawei-vpc`)
+
+If these do not exist, load the `huawei-vpc` skill first and create them before returning here.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Flavor not in region | Not all flavors available everywhere. Check with ECS ListFlavors first |
+| Security group denies all | New SGs deny ALL inbound. Must explicitly add rules |
+| EIP bills when idle | Unattached EIP still incurs charges |
+| Stopped instance still bills | Pay-per-use instances bill when stopped (unless shutdown-no-billing flavor) |
+| Disk survives instance delete | Deleting instance does NOT delete system disk by default |
+
+## Flavor Selection Guide
+
+Flavor families are **region-dependent**. Always run `hcloud ECS ListFlavors --cli-region=<r>` to discover available flavors before recommending.
+
+| Scenario | Family | What to look for |
+|----------|--------|-----------------|
+| Web app / microservices | General-purpose (ac, s, sn, c) | 2-4 vCPU, 4-8 GB RAM |
+| Database / big data | Memory-optimized (m, r) | 4-8 vCPU, 16-64 GB RAM |
+| AI inference | GPU (g, p) | 8+ vCPU, 64+ GB RAM + GPU |
+| HPC | High-IO (h, ir, i) | 8+ vCPU, local SSD |
+
+> See `references/flavors.md` for discovery workflow. **Do not hardcode flavor names** — availability changes by region and over time.
+
+## Common Workflows
+
+| Task | Command | Steps |
+|------|---------|-------|
+| List flavors | hcloud ECS ListFlavors --cli-region=<region> | references/flavors.md |
+| Create instance | hcloud ECS CreateServers --server.name=<n> --server.flavorRef=<id> --server.imageRef=<id> --server.nics.1.subnet_id=<id> --server.availability_zone=<az> | references/create-instance.md |
+| Find by name | See "How to search for instances" below | |
+| Bind EIP | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id` |
+| Security group rule | hcloud VPC CreateSecurityGroupRule --security_group_id=<id> --direction=<direction> --protocol=<protocol> | references/sg.md |
+| Attach disk | hcloud EVS AttachVolume --volume_id=<id> --server_id=<id> | references/evs.md |
+| Delete instance | hcloud ECS DeleteServers --servers.1.id=<id> --delete_publicip=true --delete_volume=true | references/create-instance.md |
+
+## How to Search for Instances
+
+`ListServersDetails` supports `--name` for exact match only. For fuzzy search:
+
+1. List all instances: `hcloud ECS ListServersDetails --cli-region=<region> --limit=100`
+2. Filter client-side by name substring, tag, or status
+3. Use `--server_tags` filter if instances are tagged: `hcloud ECS ListServersDetails --server_tags.1.key=Project`
+
+Abort if the result set is larger than `--limit` and ask the user to narrow the search.
+
+## Deleting Instances
+
+- Show the user the exact command and get explicit approval before running
+- By default, `--delete_publicip` and `--delete_volume` are **false** — public IP and system disk survive deletion
+- Set both to `true` to avoid orphaned resources and unexpected billing
+- Data disks ARE deleted by default (unlike system disk)
+
+## Troubleshooting
+
+| Error | Root Cause -> Fix |
+|-------|------------------|
+| Cannot SSH | SG missing port 22 or no EIP -> Add ingress rule / Bind EIP |
+| Flavor unavailable | Region limitation -> ListFlavors in target region |
+| Insufficient resources | Stock depleted -> Change flavor or AZ |
+| AuthFailure | Expired AK/SK -> hcloud configure init |
+| APIGW.0802 / region permission | IAM user has no access to this region -> IAM console → User → Permissions → add region, or switch to another region |
+
+## Security Considerations
+
+- MUST use security groups, not iptables
+- MUST store SSH keys in DEW, never in user-data
+- SHOULD enable CTS audit logging
+- MUST NOT open 0.0.0.0/0 for SSH
+
+## MCP Tools
+
+Prefer these tools over raw hcloud CLI — they enforce safety policies:
+
+- huaweicloud_list_operations service=ECS
+- huaweicloud_run_readonly_command for discovery (auto-redacts output)
+- huaweicloud_run_approved_command for writes (requires exact command approval)
+- huaweicloud_check_cli to verify hcloud is available
+
+## Without MCP (Fallback)
+
+If MCP tools are NOT available (new install, session not restarted):
+- Raw hcloud commands WILL appear in shell history — passwords and secrets are at risk
+- Always use key_name instead of adminPass
+- Verify safety manually: no secret value reads, no credential file access
+- Restart session as soon as possible to enable safety policies
+
+## Without MCP
+
+Fall back to hcloud CLI. State: "MCP unavailable, using local hcloud CLI."
+
+## Flexus (Lightweight ECS)
+
+Flexus is the lightweight ECS family. Two variants:
+
+| Variant | API | CLI | Billing |
+|---------|-----|:---:|---------|
+| **Flexus L** | HCSS (hcss:lightInstances) | ❌ No hcloud — Python SDK only | Prepaid only |
+| **Flexus X** | Standard ECS API | ✅ `hcloud ECS` with `x1.*` flavors | On-demand & prepaid |
+
+For Flexus X, use standard ECS CreateServers flow with `x1.*` flavors. For Flexus L, manual console provisioning is recommended — no KooCLI path exists.
+
+## References
+
+- ECS Docs: https://support.huaweicloud.com/ecs/
+- Flavor specs: references/flavors.md
+- Create instance: references/create-instance.md

package/plugins/huaweicloud-core/skills/huawei-ecs/references/create-instance.md

@@ -0,0 +1,92 @@
+# Create ECS Instance SOP
+
+**Before executing any command: If MCP tools are not available** (new session after install), restart your session or use hcloud CLI directly with caution. Commands using adminPass/password WILL appear in shell history — prefer key_name.
+
+## 1. Discover flavors
+hcloud ECS ListFlavors --cli-region=<region> --cli-output=json
+
+## 2. Find availability zones
+hcloud ECS NovaListAvailabilityZones --cli-region=<region>
+
+## 3. Find image
+hcloud IMS ListImages --cli-region=<region> --__imagetype=gold --__isregistered=true --limit=20
+
+Common image IDs (cn-south-1, verify with region):
+| Image | ID |
+|-------|----|
+| Ubuntu 22.04 | Query live via ListImages |
+| CentOS 8.2 64bit | Query live via ListImages |
+| EulerOS 2.9 64bit | Query live via ListImages |
+
+Always run ListImages to get the latest image IDs — they change over time.
+
+## 4. Verify or create VPC/subnet
+hcloud VPC ListVpcs --cli-region=<region>
+hcloud VPC ListSubnets --vpc_id=<vpc-id> --cli-region=<region>
+If no VPC/subnet exists: load `huawei-vpc` skill → create VPC → create subnet (with DNS) → create security group → return here.
+
+## 5. Create keypair (recommended over adminPass)
+hcloud ECS NovaCreateKeypair --keypair.name=<name>
+Save the returned private key to a local file. The public key is auto-injected.
+
+Password alternative:
+- adminPass: 8-26 chars, must have uppercase + lowercase + digit + special char
+- Passwords appear ONCE in creation output and are not retrievable
+- Passwords are logged in shell history — this is a security risk
+
+## 6. Create instance
+hcloud ECS CreateServers --cli-region=<region> --server.name=<name> --server.flavorRef=<flavor-id> --server.imageRef=<image-id> --server.nics.1.subnet_id=<subnet-id> --server.root_volume.volumetype=<type> --server.root_volume.size=<minsize> --server.vpcid=<vpc-id> --server.availability_zone=<az> --server.key_name=<keypair-name> --server.count=1
+
+### Bootstrap with user_data (cloud-init)
+
+Use `--server.user_data` to run a cloud-init script at first boot. The value must be **base64-encoded**:
+
+```bash
+# Encode the script
+user_data=$(cat << 'SCRIPT' | base64
+#!/bin/bash
+# Your bootstrap commands here.
+# Output logs: /var/log/cloud-init-output.log
+SCRIPT
+)
+
+hcloud ECS CreateServers ... --server.user_data=$user_data
+```
+
+> **Security**: Never embed secrets (passwords, AK/SK, tokens) in user_data. It is stored unencrypted and readable from within the instance via IMDS. Fetch secrets at boot from DEW/CSMS instead.
+
+> **Debugging**: If the script didn't run, check `/var/log/cloud-init-output.log` on the instance.
+
+## 7. EIP (optional)
+hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name>
+
+# Get the ECS network port ID
+hcloud ECS ListServersDetails --cli-region=<region> --server_id=<instance-id>
+# → addresses.<vpc-id>[].OS-EXT-IPS:port_id
+
+# Bind EIP via port
+hcloud EIP AssociatePublicips --publicip_id=<eip-id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT
+
+## 8. Verify
+hcloud ECS ListServersDetails --cli-region=<region> --server_id=<instance-id>
+Expected: status=ACTIVE
+
+### Verify HTTP accessibility (if EIP bound)
+
+```bash
+# Get the EIP address from instance details
+hcloud ECS ListServersDetails --cli-region=<region> --server_id=<instance-id>
+# → addresses.<vpc-id>[].OS-EXT-IPS:addr
+
+curl http://<eip-address>
+# Expected: HTTP 200 (if port 80 open and web server installed)
+
+## 9. Delete instance (with cleanup)
+hcloud ECS DeleteServers --servers.1.id=<instance-id> --delete_publicip=true --delete_volume=true
+Warning: --delete_publicip and --delete_volume default to false. Set to true to avoid orphaned charges.
+
+## Constraints
+- Name: 1-64 chars, letters/digits/hyphens
+- Flavor: must be available in target region — always ListFlavors first
+- Root volume: SSD 40GB min
+- Keypair is safer than adminPass (passwords leak into shell history)

package/plugins/huaweicloud-core/skills/huawei-ecs/references/evs.md

@@ -0,0 +1,31 @@
+# EVS Cloud Disk
+
+## Create Volume
+
+```bash
+hcloud EVS CreateVolume --help
+# Required: --volume.availability_zone, --volume.size, --volume.volume_type
+```
+
+```bash
+hcloud EVS CreateVolume \
+  --volume.availability_zone=<az> \
+  --volume.size=<size> \
+  --volume.volume_type=<type> \
+  --volume.name=<name>
+```
+
+## Attach to ECS
+
+```bash
+hcloud EVS AttachVolume --volume_id=<vol-id> --server_id=<ecs-id>
+```
+
+## List / Delete
+
+```bash
+hcloud EVS ListVolumes
+hcloud EVS DeleteVolume --volume_id=<id>
+```
+
+> Deleting an ECS instance does NOT automatically delete attached EVS volumes unless `--delete_volume=true` is set during instance deletion.

package/plugins/huaweicloud-core/skills/huawei-ecs/references/flavors.md

@@ -0,0 +1,28 @@
+# ECS Flavor Selection
+
+**Always discover flavors dynamically before recommending a specific flavor name.** Flavor availability varies by region and changes over time.
+
+## Step 1: List available flavors
+hcloud ECS ListFlavors --cli-region=<region> --cli-output=json
+
+## Step 2: Filter by scenario
+
+| Scenario | Look for | Preference |
+|----------|----------|------------|
+| Web app / microservices | General-purpose families (ac, s, sn) | 2-4 vCPU, 4-8 GB RAM |
+| Database / big data | Memory-optimized families (m, r) | 4-8 vCPU, 16-64 GB RAM |
+| AI inference / training | GPU families (g, p) | 8+ vCPU, 64+ GB RAM |
+| HPC / high throughput | High-IO families (h, ir, i) | 8+ vCPU, local SSD |
+
+## Step 3: Match spec from ListFlavors output
+
+Common naming pattern: `<family><gen>.<type>x<ratio>`
+- `ac6.2xlarge.2` = ac6 family, 2xlarge (8 vCPU), ratio 2 (vCPU:RAM = 1:2 → 16 GB)
+
+## Do Not Hardcode
+
+Flavor family names are region-dependent. Example discrepancies seen in testing:
+- cn-south-1: ac6/ac7/kc/r-c7e (s6/m6/g6 NOT available)
+- Other regions may have s6/m6/g6 families
+
+Always run ListFlavors and pick from actual results.

package/plugins/huaweicloud-core/skills/huawei-ecs/references/troubleshooting.md

@@ -0,0 +1,52 @@
+# ECS Troubleshooting
+
+基于真实测试暴露的常见错误和诊断步骤。
+
+## 错误码映射
+
+| 错误 | 根因 | 修复 |
+|------|------|------|
+| `Ecs.0005` flavor-image 不匹配 | 镜像虚拟化类型与规格不兼容 | 检查 image `__support_amd`/`__support_xen` 与 flavor `os_extra_specs`。BareMetal 镜像不兼容标准 ECS 规格 |
+| `[USE_ERROR]不正确的参数:imagetype` | 参数名错误 | KooCLI 使用双下划线前缀：`--__imagetype=gold`（不是 `--imagetype`） |
+| `[USE_ERROR]不正确的参数:chargingMode` | 参数路径错误 | 计费模式参数路径：`--server.extendparam.chargingMode=postPaid`。不传默认按需付费 |
+| `[USE_ERROR]不正确的参数:__support_amd` | 参数无效 | `IMS ListImages` 某些版本不支持此过滤。去掉该参数，使用 client-side 过滤 |
+| Cannot SSH | 安全组未开放22端口 或 未绑定EIP | 1) 添加入方向规则 tcp 22。2) `hcloud EIP BindPublicIp` |
+| Flavor unavailable | 区域不支持该规格 | `hcloud ECS ListFlavors --cli-region=<r>` 先查。不硬编码 s6/m6 等规格名 |
+| Insufficient resources | AZ 库存不足 | 换规格、换 AZ、或等待资源释放 |
+| AuthFailure | AK/SK 过期或无效 | `hcloud configure init` 重新配置 |
+
+## 创建失败诊断流程
+
+1. 运行 `hcloud ECS ListFlavors` — 确认规格在目标区域可用
+2. 运行 `hcloud IMS ListImages --__imagetype=gold --limit=20` — 确认可用的公共镜像
+3. 交叉检查：flavor `os_extra_specs` 中的虚拟化类型 vs image 的 `__support_*` 属性
+4. 运行 `hcloud VPC ListVpcs` / `ListSubnets` — 确认 VPC 和子网存在
+5. 运行 `hcloud ECS NovaListAvailabilityZones` — 确认 AZ 可用
+6. 创建后：`hcloud ECS ListServersDetails --server_id=<id>` 检查状态
+7. 状态 `BUILD` → 等待。`ERROR` → 查看 job_id 详情
+
+## 镜像查询正确姿势
+
+```bash
+# 正确：双下划线前缀
+hcloud IMS ListImages --cli-region=<r> --__imagetype=gold --__isregistered=true --limit=20
+
+# 按需过滤（如果参数支持）
+# --virtual_env_type=FusionCompute  排除 BareMetal
+# 不支持的参数不要传，用 client-side 过滤
+```
+
+## 密钥对 vs 密码
+
+| 方式 | 安全 | 建议 |
+|------|------|------|
+| `--server.key_name=<name>` | ✅ 高 | **推荐**。先 `hcloud DEW CreateKeypair` 创建密钥对 |
+| `--server.adminPass=<pw>` | ❌ 低 | 密码明文进入 shell 历史。仅测试用 |
+
+密码要求：8-26 字符，含大写 + 小写 + 数字 + 特殊字符。
+
+## 删除注意事项
+
+- `--delete_publicip` 默认 false — EIP 不随实例删除，继续计费
+- `--delete_volume` 默认 false — 系统盘不随实例删除
+- 数据盘默认随实例删除（与系统盘行为相反）

package/plugins/huaweicloud-core/skills/huawei-functiongraph/SKILL.md

@@ -0,0 +1,132 @@
+---
+name: huawei-functiongraph
+description: "Use when creating, deploying, or managing serverless functions on FunctionGraph. Covers triggers (APIG/OBS/timer/SMN), cold start, reserved concurrency. Triggers: FunctionGraph, serverless, function, Lambda, trigger. NOT for: CCE containers (use huawei-cce)."
+version: 1
+---
+
+# Huawei Cloud FunctionGraph
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+## Overview
+
+Domain expertise for Huawei Cloud FunctionGraph. Covers function lifecycle, code deployment, trigger configuration, and troubleshooting.
+
+## How to Use This Skill
+
+1. This skill tells you the **correct service/operation names** and **non-obvious traps**.
+2. **Parameters are discovered via `--help`, not hardcoded.** Always run `hcloud FunctionGraph <Operation> --help` before constructing commands.
+3. Detailed examples are in `references/` — load them only when needed.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Service name is `FunctionGraph` | NOT `FGS`. KooCLI 7.x uses the full service name |
+| CLI requires `project_id` | Get it: `hcloud IAM KeystoneListProjects` or extract from URN `urn:fss:<region>:<project_id>:...` |
+| Cold start 100ms-2s | Reserve concurrency for latency-sensitive workloads |
+| Max execution 900s | Use ECS/CCE for long-running tasks |
+| Env vars plaintext | Use DEW for secrets |
+| **ZIP upload is unreliable** | `CreateFunction --code_type=zip --code_filename=xxx.zip` succeeds even with a nonexistent file — the function is created with empty code. Prefer `code_type=inline` for simple functions. If using zip, verify `code_size` > placeholder after creation and run `InvokeFunction` to confirm output. |
+| **DeleteFunction strip `:latest`** | Passing `urn:fss:...:function:xxx:latest` causes FSS.0400. Strip `:latest` suffix (DeleteFunction only — UpdateApiV2 needs the full URN). |
+| **DeleteFunctionTrigger does NOT cascade** | Deleting a DEDICATEDGATEWAY trigger leaves the API in APIG. Manually clean up: `hcloud APIG DeleteApiV2 --instance_id=<id> --api_id=<api-id>`. |
+
+## Prerequisites
+
+```bash
+hcloud configure list              # confirm a profile exists
+hcloud FunctionGraph --help        # confirm service is available
+```
+
+## IAM Permissions
+
+If you see `FSS.0403 Forbidden`, the user needs these permissions:
+
+| Operation | Required Permission |
+|-----------|---------------------|
+| Create function | `functiongraph:function:createFunction` |
+| List functions | `functiongraph:function:list` |
+| Delete function | `functiongraph:function:deleteFunction` |
+| Invoke function | `functiongraph:function:invoke` |
+| Create trigger | `functiongraph:trigger:*` |
+
+Grant via IAM console (`FunctionGraph FullAccess` role) or ask project admin.
+
+## Operations
+
+Always discover parameters with `--help` before executing. These are the correct operation names:
+
+| Task | Operation | Gotchas |
+|------|-----------|---------|
+| List functions | `ListFunctions` | |
+| Show function | `ShowFunctionConfig` | |
+| Create function | `CreateFunction` | references/create-function.md |
+| Delete function | `DeleteFunction` | Strip `:latest` from URN |
+| Invoke function | `InvokeFunction` | Requires body param (`--name=<value>` becomes event body). Use `--x_cff_request_version=v0` for raw output, `v1` for APIG-wrapped. |
+| List runtimes | `ListRuntimes` | |
+| Create trigger | `CreateFunctionTrigger` | references/triggers.md |
+| List triggers | `ListFunctionTriggers` | |
+| Delete trigger | `DeleteFunctionTrigger` | |
+
+Discover exact parameters:
+```bash
+hcloud FunctionGraph CreateFunction --help
+hcloud FunctionGraph CreateFunctionTrigger --help
+```
+
+## Deployment Workflow
+
+```
+Write code → zip → CreateFunction → InvokeFunction → CreateFunctionTrigger
+```
+
+See `references/deploy-workflow.md` for a step-by-step example with code templates.
+
+## Troubleshooting
+
+| Error | Root Cause -> Fix |
+|-------|------------------|
+| `不支持的服务名称:FGS` | Use `FunctionGraph`, not `FGS` |
+| `不支持的operation:CreateTrigger` | Use `CreateFunctionTrigger` |
+| `FSS.0403` / Forbidden | Missing IAM permissions — see IAM Permissions above |
+| `缺少必填参数:{*}` on Invoke | Add body param: `--name=<value>` |
+| APIG/EOM trigger error | `trigger_type_code=APIG` deprecated — use `DEDICATEDGATEWAY` |
+| `event_data` parse error | Use dotted format: `--event_data.key=value`, NOT JSON string |
+| FSS.1078 / code upload fails | `--code_filename` is filename-only, no path. `cd` to zip directory first |
+| DeleteFunction with `:latest` | Strip `:latest` version suffix from URN |
+| Code too large | Inline limit 10KB — use `zip`/`obs` code type |
+| Cold start slow | Set reserved instances for critical functions |
+| Auth failure | Run `hcloud configure init` |
+
+## Security Considerations
+
+- MUST use DEW for secrets, never hardcode in environment variables
+- MUST use `--app_xrole` (agency) for cross-service access
+- SHOULD enable CTS audit logging for function invocations
+- MUST NOT expose AK/SK in function code
+
+## MCP Tools
+
+- `huaweicloud_list_operations` service=FunctionGraph
+- `huaweicloud_run_readonly_command` for discovery
+- `huaweicloud_run_approved_command` for writes
+
+## Without MCP
+
+Fall back to hcloud CLI. State: "MCP unavailable, using local hcloud CLI."
+
+## Cross-Skill References
+
+- **APIG trigger setup**: See `huawei-apig` for API group creation and publishing
+- **OBS trigger setup**: See `huawei-obs` for bucket and object event configuration
+- **DEW secrets**: See `huawei-dew` for managing function secrets
+- **SMN notifications**: See `huawei-smn-dms` for notification topics
+- **VPC configuration**: See `huawei-vpc` for network settings
+
+## References
+
+- FunctionGraph Docs: https://support.huaweicloud.com/functiongraph/
+- Create function: references/create-function.md
+- Triggers: references/triggers.md
+- Deploy workflow: references/deploy-workflow.md
+- APIG event format: references/apig-event-format.md

package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/apig-event-format.md

@@ -0,0 +1,58 @@
+# APIG DEDICATEDGATEWAY Event Format
+
+When APIG calls FunctionGraph via DEDICATEDGATEWAY trigger, the event structure is NOT the standard HTTP event. Key differences:
+
+## Event Structure
+
+```json
+{
+  "isBase64Encoded": true,
+  "body": "<Base64-encoded request body>",
+  "httpMethod": "POST",
+  "requestContext": {
+    "apiId": "xxx",
+    "requestId": "xxx",
+    "stage": "RELEASE"
+  }
+}
+```
+
+## Critical: body is Base64 Encoded
+
+`event["body"]` is Base64 encoded. You MUST decode it:
+
+**Python handler template:**
+```python
+import json, base64
+
+def handler(event, context):
+    body = event.get("body", "")
+    if event.get("isBase64Encoded"):
+        body = base64.b64decode(body).decode("utf-8")
+    data = json.loads(body) if body else {}
+    return {
+        "statusCode": 200,
+        "body": json.dumps({"message": "ok", "received": data}),
+        "headers": {"Content-Type": "application/json"}
+    }
+```
+
+**Node.js handler template:**
+```js
+exports.handler = async (event, context) => {
+    let body = event.body || "";
+    if (event.isBase64Encoded) {
+        body = Buffer.from(body, "base64").toString("utf8");
+    }
+    const data = body ? JSON.parse(body) : {};
+    return {
+        statusCode: 200,
+        body: JSON.stringify({ message: "ok", received: data }),
+        headers: { "Content-Type": "application/json" }
+    };
+};
+```
+
+## Missing Fields vs Standard HTTP
+
+Fields NOT in DEDICATEDGATEWAY event: `event.path`, `event.headers`, `event.queryStringParameters`. Use `event.httpMethod` for method detection.

package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/create-function.md

@@ -0,0 +1,71 @@
+# FunctionGraph Function Creation Reference
+
+## Runtime Options
+
+| Runtime | Handler Format | Example |
+|---------|---------------|---------|
+| Python3.9 | `index.handler` | `def handler(event, context): return {"statusCode": 200}` |
+| Python3.10 | `index.handler` | Same as 3.9 |
+| Node.js 18 | `index.handler` | `exports.handler = async (event, context) => ({statusCode: 200})` |
+| Java 8/11/17 | `com.example.Handler::handleRequest` | Java class method |
+| Go 1.x | `handler` | Go function name |
+| C# (.NET Core) | `CsharpDemo::CsharpDemo.Function::Handler` | Namespace.Class::Method |
+
+## Create Function (inline)
+
+```bash
+hcloud FunctionGraph CreateFunction \
+  --func_name=<name> \
+  --package=default \
+  --runtime=Python3.10 \
+  --handler=index.handler \
+  --memory_size=128 \
+  --timeout=3 \
+  --code_type=inline \
+  --func_code.file=<base64-encoded-code> \
+  --cli-region=<region>
+```
+
+| Param | Required | Range/Default |
+|-------|----------|---------------|
+| `--func_name` | Yes | 1-60 chars |
+| `--runtime` | Yes | See runtime options above |
+| `--handler` | Yes | Per runtime |
+| `--memory_size` | No | 128-4096 MB, default 128 |
+| `--timeout` | No | 1-900s, default 3 |
+
+## ZIP Upload Warning
+
+`--code_type=zip --code_filename=xxx.zip` **succeeds even with non-existent file** — function created with empty code. Prefer `code_type=inline` for simple functions. If using zip, verify `code_size > 0` after creation and invoke the function to confirm output.
+
+## Required IAM Permissions
+
+- `functiongraph:function:createFunction` — Create
+- `functiongraph:function:list` — List
+- `functiongraph:function:getConfig` — Read config
+- `functiongraph:function:invoke` — Invoke
+
+Grant `FunctionGraph FullAccess` role or custom policy.
+
+## Error Codes
+
+| Error | Root Cause -> Fix |
+|-------|-------------------|
+| FSS.0400 | `:latest` suffix on URN. Strip it |
+| FSS.1417 | Missing DEDICATEDGATEWAY params |
+| FSS.0403 | Insufficient IAM permission |
+| FSS.1020 | Missing `--app_xrole` when binding VPC. Create IAM agency with `trust_domain_name=functiongraph`. See `huawei-iam` skill → Agencies section |
+
+## VPC + Agency Configuration
+
+To access VPC-internal resources from FunctionGraph:
+
+```bash
+# 1. Create agency (see huawei-iam skill)
+hcloud IAM CreateAgency --agency_name=<name> --trust_domain_name=functiongraph
+# 2. Grant role (e.g., VPC Administrator)
+hcloud IAM GrantRoleToAgency --agency_name=<name> --role_id=<role-id>
+# 3. Use in CreateFunction
+hcloud FunctionGraph CreateFunction --func_vpc.vpc_id=<vpc> --func_vpc.subnet_id=<subnet> --app_xrole=<name> ...
+```
+| QuotaExceeded | Max 10 functions per project per region |