huaweicloud-devkit 1.0.2-dev.9 → 1.0.2-next.0

package/plugins/huaweicloud-core/skills/huawei-functiongraph/SKILL.md

@@ -1,131 +1,131 @@
----
-name: huawei-functiongraph
-description: "Use when creating, deploying, or managing serverless functions on FunctionGraph. Covers triggers (APIG/OBS/timer/SMN), cold start, reserved concurrency. Triggers: FunctionGraph, serverless, function, Lambda, trigger. NOT for: CCE containers (use huawei-cce)."
-version: 1
----
-
-# Huawei Cloud FunctionGraph
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-## Overview
-
-Domain expertise for Huawei Cloud FunctionGraph. Covers function lifecycle, code deployment, trigger configuration, and troubleshooting.
-
-## How to Use This Skill
-
-1. This skill tells you the **correct service/operation names** and **non-obvious traps**.
-2. **Parameters are discovered via `--help`, not hardcoded.** Always run `hcloud FunctionGraph <Operation> --help` before constructing commands.
-3. Detailed examples are in `references/` — load them only when needed.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| Service name is `FunctionGraph` | NOT `FGS`. KooCLI 7.x uses the full service name |
-| CLI requires `project_id` | Get it: `hcloud IAM KeystoneListProjects` or extract from URN `urn:fss:<region>:<project_id>:...` |
-| Cold start 100ms-2s | Reserve concurrency for latency-sensitive workloads |
-| Max execution 900s | Use ECS/CCE for long-running tasks |
-| Env vars plaintext | Use DEW for secrets |
-| **ZIP upload is unreliable** | `CreateFunction --code_type=zip --code_filename=xxx.zip` succeeds even with a nonexistent file — the function is created with empty code. Prefer `code_type=inline` for simple functions. If using zip, verify `code_size` > placeholder after creation and run `InvokeFunction` to confirm output. |
-| **DeleteFunction strip `:latest`** | Passing `urn:fss:...:function:xxx:latest` causes FSS.0400. Strip `:latest` suffix (DeleteFunction only — UpdateApiV2 needs the full URN). |
-| **DeleteFunctionTrigger does NOT cascade** | Deleting a DEDICATEDGATEWAY trigger leaves the API in APIG. Manually clean up: `hcloud APIG DeleteApiV2 --instance_id=<id> --api_id=<api-id>`. |
-
-## Prerequisites
-
-```bash
-hcloud configure list              # confirm a profile exists
-hcloud FunctionGraph --help        # confirm service is available
-```
-
-## IAM Permissions
-
-If you see `FSS.0403 Forbidden`, the user needs these permissions:
-
-| Operation | Required Permission |
-|-----------|---------------------|
-| Create function | `functiongraph:function:createFunction` |
-| List functions | `functiongraph:function:list` |
-| Delete function | `functiongraph:function:deleteFunction` |
-| Invoke function | `functiongraph:function:invoke` |
-| Create trigger | `functiongraph:trigger:*` |
-
-Grant via IAM console (`FunctionGraph FullAccess` role) or ask project admin.
-
-## Operations
-
-Always discover parameters with `--help` before executing. These are the correct operation names:
-
-| Task | Operation | Gotchas |
-|------|-----------|---------|
-| List functions | `ListFunctions` | |
-| Show function | `ShowFunctionConfig` | |
-| Create function | `CreateFunction` | references/create-function.md |
-| Delete function | `DeleteFunction` | Strip `:latest` from URN |
-| Invoke function | `InvokeFunction` | Requires body param (`--name=<value>` becomes event body). Use `--x_cff_request_version=v0` for raw output, `v1` for APIG-wrapped. |
-| Create trigger | `CreateFunctionTrigger` | references/triggers.md |
-| List triggers | `ListFunctionTriggers` | |
-| Delete trigger | `DeleteFunctionTrigger` | |
-
-Discover exact parameters:
-```bash
-hcloud FunctionGraph CreateFunction --help
-hcloud FunctionGraph CreateFunctionTrigger --help
-```
-
-## Deployment Workflow
-
-```
-Write code → zip → CreateFunction → InvokeFunction → CreateFunctionTrigger
-```
-
-See `references/deploy-workflow.md` for a step-by-step example with code templates.
-
-## Troubleshooting
-
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| `不支持的服务名称:FGS` | Use `FunctionGraph`, not `FGS` |
-| `不支持的operation:CreateTrigger` | Use `CreateFunctionTrigger` |
-| `FSS.0403` / Forbidden | Missing IAM permissions — see IAM Permissions above |
-| `缺少必填参数:{*}` on Invoke | Add body param: `--name=<value>` |
-| APIG/EOM trigger error | `trigger_type_code=APIG` deprecated — use `DEDICATEDGATEWAY` |
-| `event_data` parse error | Use dotted format: `--event_data.key=value`, NOT JSON string |
-| FSS.1078 / code upload fails | `--code_filename` is filename-only, no path. `cd` to zip directory first |
-| DeleteFunction with `:latest` | Strip `:latest` version suffix from URN |
-| Code too large | Inline limit 10KB — use `zip`/`obs` code type |
-| Cold start slow | Set reserved instances for critical functions |
-| Auth failure | Run `npx huaweicloud-devkit auth init` |
-
-## Security Considerations
-
-- MUST use DEW for secrets, never hardcode in environment variables
-- MUST use `--app_xrole` (agency) for cross-service access
-- SHOULD enable CTS audit logging for function invocations
-- MUST NOT expose AK/SK in function code
-
-## MCP Tools
-
-- `huaweicloud_list_operations` service=FunctionGraph
-- `huaweicloud_run_readonly_command` for discovery
-- `huaweicloud_run_approved_command` for writes
-
-## Without MCP
-
-Fall back to hcloud CLI. State: "MCP unavailable, using local hcloud CLI."
-
-## Cross-Skill References
-
-- **APIG trigger setup**: See `huawei-apig` for API group creation and publishing
-- **OBS trigger setup**: See `huawei-obs` for bucket and object event configuration
-- **DEW secrets**: See `huawei-dew` for managing function secrets
-- **SMN notifications**: See `huawei-smn-dms` for notification topics
-- **VPC configuration**: See `huawei-vpc` for network settings
-
-## References
-
-- FunctionGraph Docs: https://support.huaweicloud.com/functiongraph/
-- Create function: references/create-function.md
-- Triggers: references/triggers.md
-- Deploy workflow: references/deploy-workflow.md
-- APIG event format: references/apig-event-format.md
+---
+name: huawei-functiongraph
+description: "Use when creating, deploying, or managing serverless functions on FunctionGraph. Covers triggers (APIG/OBS/timer/SMN), cold start, reserved concurrency. Triggers: FunctionGraph, serverless, function, Lambda, trigger. NOT for: CCE containers (use huawei-cce)."
+version: 1
+---
+
+# Huawei Cloud FunctionGraph
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+## Overview
+
+Domain expertise for Huawei Cloud FunctionGraph. Covers function lifecycle, code deployment, trigger configuration, and troubleshooting.
+
+## How to Use This Skill
+
+1. This skill tells you the **correct service/operation names** and **non-obvious traps**.
+2. **Parameters are discovered via `--help`, not hardcoded.** Always run `hcloud FunctionGraph <Operation> --help` before constructing commands.
+3. Detailed examples are in `references/` — load them only when needed.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Service name is `FunctionGraph` | NOT `FGS`. KooCLI 7.x uses the full service name |
+| CLI requires `project_id` | Get it: `hcloud IAM KeystoneListProjects` or extract from URN `urn:fss:<region>:<project_id>:...` |
+| Cold start 100ms-2s | Reserve concurrency for latency-sensitive workloads |
+| Max execution 900s | Use ECS/CCE for long-running tasks |
+| Env vars plaintext | Use DEW for secrets |
+| **ZIP upload is unreliable** | `CreateFunction --code_type=zip --code_filename=xxx.zip` succeeds even with a nonexistent file — the function is created with empty code. Prefer `code_type=inline` for simple functions. If using zip, verify `code_size` > placeholder after creation and run `InvokeFunction` to confirm output. |
+| **DeleteFunction strip `:latest`** | Passing `urn:fss:...:function:xxx:latest` causes FSS.0400. Strip `:latest` suffix (DeleteFunction only — UpdateApiV2 needs the full URN). |
+| **DeleteFunctionTrigger does NOT cascade** | Deleting a DEDICATEDGATEWAY trigger leaves the API in APIG. Manually clean up: `hcloud APIG DeleteApiV2 --instance_id=<id> --api_id=<api-id>`. |
+
+## Prerequisites
+
+```bash
+hcloud configure list              # confirm a profile exists
+hcloud FunctionGraph --help        # confirm service is available
+```
+
+## IAM Permissions
+
+If you see `FSS.0403 Forbidden`, the user needs these permissions:
+
+| Operation | Required Permission |
+|-----------|---------------------|
+| Create function | `functiongraph:function:createFunction` |
+| List functions | `functiongraph:function:list` |
+| Delete function | `functiongraph:function:deleteFunction` |
+| Invoke function | `functiongraph:function:invoke` |
+| Create trigger | `functiongraph:trigger:*` |
+
+Grant via IAM console (`FunctionGraph FullAccess` role) or ask project admin.
+
+## Operations
+
+Always discover parameters with `--help` before executing. These are the correct operation names:
+
+| Task | Operation | Gotchas |
+|------|-----------|---------|
+| List functions | `ListFunctions` | |
+| Show function | `ShowFunctionConfig` | |
+| Create function | `CreateFunction` | references/create-function.md |
+| Delete function | `DeleteFunction` | Strip `:latest` from URN |
+| Invoke function | `InvokeFunction` | Requires body param (`--name=<value>` becomes event body). Use `--x_cff_request_version=v0` for raw output, `v1` for APIG-wrapped. |
+| Create trigger | `CreateFunctionTrigger` | references/triggers.md |
+| List triggers | `ListFunctionTriggers` | |
+| Delete trigger | `DeleteFunctionTrigger` | |
+
+Discover exact parameters:
+```bash
+hcloud FunctionGraph CreateFunction --help
+hcloud FunctionGraph CreateFunctionTrigger --help
+```
+
+## Deployment Workflow
+
+```
+Write code → zip → CreateFunction → InvokeFunction → CreateFunctionTrigger
+```
+
+See `references/deploy-workflow.md` for a step-by-step example with code templates.
+
+## Troubleshooting
+
+| Error | Root Cause -> Fix |
+|-------|------------------|
+| `不支持的服务名称:FGS` | Use `FunctionGraph`, not `FGS` |
+| `不支持的operation:CreateTrigger` | Use `CreateFunctionTrigger` |
+| `FSS.0403` / Forbidden | Missing IAM permissions — see IAM Permissions above |
+| `缺少必填参数:{*}` on Invoke | Add body param: `--name=<value>` |
+| APIG/EOM trigger error | `trigger_type_code=APIG` deprecated — use `DEDICATEDGATEWAY` |
+| `event_data` parse error | Use dotted format: `--event_data.key=value`, NOT JSON string |
+| FSS.1078 / code upload fails | `--code_filename` is filename-only, no path. `cd` to zip directory first |
+| DeleteFunction with `:latest` | Strip `:latest` version suffix from URN |
+| Code too large | Inline limit 10KB — use `zip`/`obs` code type |
+| Cold start slow | Set reserved instances for critical functions |
+| Auth failure | Run `npx huaweicloud-devkit auth init` |
+
+## Security Considerations
+
+- MUST use DEW for secrets, never hardcode in environment variables
+- MUST use `--app_xrole` (agency) for cross-service access
+- SHOULD enable CTS audit logging for function invocations
+- MUST NOT expose AK/SK in function code
+
+## MCP Tools
+
+- `huaweicloud_list_operations` service=FunctionGraph
+- `huaweicloud_run_readonly_command` for discovery
+- `huaweicloud_run_approved_command` for writes
+
+## Without MCP
+
+Fall back to hcloud CLI. State: "MCP unavailable, using local hcloud CLI."
+
+## Cross-Skill References
+
+- **APIG trigger setup**: See `huawei-apig` for API group creation and publishing
+- **OBS trigger setup**: See `huawei-obs` for bucket and object event configuration
+- **DEW secrets**: See `huawei-dew` for managing function secrets
+- **SMN notifications**: See `huawei-smn-dms` for notification topics
+- **VPC configuration**: See `huawei-vpc` for network settings
+
+## References
+
+- FunctionGraph Docs: https://support.huaweicloud.com/functiongraph/
+- Create function: references/create-function.md
+- Triggers: references/triggers.md
+- Deploy workflow: references/deploy-workflow.md
+- APIG event format: references/apig-event-format.md

package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/apig-event-format.md

@@ -1,58 +1,58 @@
-# APIG DEDICATEDGATEWAY Event Format
-
-When APIG calls FunctionGraph via DEDICATEDGATEWAY trigger, the event structure is NOT the standard HTTP event. Key differences:
-
-## Event Structure
-
-```json
-{
-  "isBase64Encoded": true,
-  "body": "<Base64-encoded request body>",
-  "httpMethod": "POST",
-  "requestContext": {
-    "apiId": "xxx",
-    "requestId": "xxx",
-    "stage": "RELEASE"
-  }
-}
-```
-
-## Critical: body is Base64 Encoded
-
-`event["body"]` is Base64 encoded. You MUST decode it:
-
-**Python handler template:**
-```python
-import json, base64
-
-def handler(event, context):
-    body = event.get("body", "")
-    if event.get("isBase64Encoded"):
-        body = base64.b64decode(body).decode("utf-8")
-    data = json.loads(body) if body else {}
-    return {
-        "statusCode": 200,
-        "body": json.dumps({"message": "ok", "received": data}),
-        "headers": {"Content-Type": "application/json"}
-    }
-```
-
-**Node.js handler template:**
-```js
-exports.handler = async (event, context) => {
-    let body = event.body || "";
-    if (event.isBase64Encoded) {
-        body = Buffer.from(body, "base64").toString("utf8");
-    }
-    const data = body ? JSON.parse(body) : {};
-    return {
-        statusCode: 200,
-        body: JSON.stringify({ message: "ok", received: data }),
-        headers: { "Content-Type": "application/json" }
-    };
-};
-```
-
-## Missing Fields vs Standard HTTP
-
-Fields NOT in DEDICATEDGATEWAY event: `event.path`, `event.headers`, `event.queryStringParameters`. Use `event.httpMethod` for method detection.
+# APIG DEDICATEDGATEWAY Event Format
+
+When APIG calls FunctionGraph via DEDICATEDGATEWAY trigger, the event structure is NOT the standard HTTP event. Key differences:
+
+## Event Structure
+
+```json
+{
+  "isBase64Encoded": true,
+  "body": "<Base64-encoded request body>",
+  "httpMethod": "POST",
+  "requestContext": {
+    "apiId": "xxx",
+    "requestId": "xxx",
+    "stage": "RELEASE"
+  }
+}
+```
+
+## Critical: body is Base64 Encoded
+
+`event["body"]` is Base64 encoded. You MUST decode it:
+
+**Python handler template:**
+```python
+import json, base64
+
+def handler(event, context):
+    body = event.get("body", "")
+    if event.get("isBase64Encoded"):
+        body = base64.b64decode(body).decode("utf-8")
+    data = json.loads(body) if body else {}
+    return {
+        "statusCode": 200,
+        "body": json.dumps({"message": "ok", "received": data}),
+        "headers": {"Content-Type": "application/json"}
+    }
+```
+
+**Node.js handler template:**
+```js
+exports.handler = async (event, context) => {
+    let body = event.body || "";
+    if (event.isBase64Encoded) {
+        body = Buffer.from(body, "base64").toString("utf8");
+    }
+    const data = body ? JSON.parse(body) : {};
+    return {
+        statusCode: 200,
+        body: JSON.stringify({ message: "ok", received: data }),
+        headers: { "Content-Type": "application/json" }
+    };
+};
+```
+
+## Missing Fields vs Standard HTTP
+
+Fields NOT in DEDICATEDGATEWAY event: `event.path`, `event.headers`, `event.queryStringParameters`. Use `event.httpMethod` for method detection.

package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/create-function.md

@@ -1,71 +1,71 @@
-# FunctionGraph Function Creation Reference
-
-## Runtime Options
-
-| Runtime | Handler Format | Example |
-|---------|---------------|---------|
-| Python3.9 | `index.handler` | `def handler(event, context): return {"statusCode": 200}` |
-| Python3.10 | `index.handler` | Same as 3.9 |
-| Node.js 18 | `index.handler` | `exports.handler = async (event, context) => ({statusCode: 200})` |
-| Java 8/11/17 | `com.example.Handler::handleRequest` | Java class method |
-| Go 1.x | `handler` | Go function name |
-| C# (.NET Core) | `CsharpDemo::CsharpDemo.Function::Handler` | Namespace.Class::Method |
-
-## Create Function (inline)
-
-```bash
-hcloud FunctionGraph CreateFunction \
-  --func_name=<name> \
-  --package=default \
-  --runtime=Python3.10 \
-  --handler=index.handler \
-  --memory_size=128 \
-  --timeout=3 \
-  --code_type=inline \
-  --func_code.file=<base64-encoded-code> \
-  --cli-region=<region>
-```
-
-| Param | Required | Range/Default |
-|-------|----------|---------------|
-| `--func_name` | Yes | 1-60 chars |
-| `--runtime` | Yes | See runtime options above |
-| `--handler` | Yes | Per runtime |
-| `--memory_size` | No | 128-4096 MB, default 128 |
-| `--timeout` | No | 1-900s, default 3 |
-
-## ZIP Upload Warning
-
-`--code_type=zip --code_filename=xxx.zip` **succeeds even with non-existent file** — function created with empty code. Prefer `code_type=inline` for simple functions. If using zip, verify `code_size > 0` after creation and invoke the function to confirm output.
-
-## Required IAM Permissions
-
-- `functiongraph:function:createFunction` — Create
-- `functiongraph:function:list` — List
-- `functiongraph:function:getConfig` — Read config
-- `functiongraph:function:invoke` — Invoke
-
-Grant `FunctionGraph FullAccess` role or custom policy.
-
-## Error Codes
-
-| Error | Root Cause -> Fix |
-|-------|-------------------|
-| FSS.0400 | `:latest` suffix on URN. Strip it |
-| FSS.1417 | Missing DEDICATEDGATEWAY params |
-| FSS.0403 | Insufficient IAM permission |
-| FSS.1020 | Missing `--app_xrole` when binding VPC. Create IAM agency with `trust_domain_name=functiongraph`. See `huawei-iam` skill → Agencies section |
-
-## VPC + Agency Configuration
-
-To access VPC-internal resources from FunctionGraph:
-
-```bash
-# 1. Create agency (see huawei-iam skill)
-hcloud IAM CreateAgency --agency_name=<name> --trust_domain_name=functiongraph
-# 2. Grant role (e.g., VPC Administrator)
-hcloud IAM GrantRoleToAgency --agency_name=<name> --role_id=<role-id>
-# 3. Use in CreateFunction
-hcloud FunctionGraph CreateFunction --func_vpc.vpc_id=<vpc> --func_vpc.subnet_id=<subnet> --app_xrole=<name> ...
-```
-| QuotaExceeded | Max 10 functions per project per region |
+# FunctionGraph Function Creation Reference
+
+## Runtime Options
+
+| Runtime | Handler Format | Example |
+|---------|---------------|---------|
+| Python3.9 | `index.handler` | `def handler(event, context): return {"statusCode": 200}` |
+| Python3.10 | `index.handler` | Same as 3.9 |
+| Node.js 18 | `index.handler` | `exports.handler = async (event, context) => ({statusCode: 200})` |
+| Java 8/11/17 | `com.example.Handler::handleRequest` | Java class method |
+| Go 1.x | `handler` | Go function name |
+| C# (.NET Core) | `CsharpDemo::CsharpDemo.Function::Handler` | Namespace.Class::Method |
+
+## Create Function (inline)
+
+```bash
+hcloud FunctionGraph CreateFunction \
+  --func_name=<name> \
+  --package=default \
+  --runtime=Python3.10 \
+  --handler=index.handler \
+  --memory_size=128 \
+  --timeout=3 \
+  --code_type=inline \
+  --func_code.file=<base64-encoded-code> \
+  --cli-region=<region>
+```
+
+| Param | Required | Range/Default |
+|-------|----------|---------------|
+| `--func_name` | Yes | 1-60 chars |
+| `--runtime` | Yes | See runtime options above |
+| `--handler` | Yes | Per runtime |
+| `--memory_size` | No | 128-4096 MB, default 128 |
+| `--timeout` | No | 1-900s, default 3 |
+
+## ZIP Upload Warning
+
+`--code_type=zip --code_filename=xxx.zip` **succeeds even with non-existent file** — function created with empty code. Prefer `code_type=inline` for simple functions. If using zip, verify `code_size > 0` after creation and invoke the function to confirm output.
+
+## Required IAM Permissions
+
+- `functiongraph:function:createFunction` — Create
+- `functiongraph:function:list` — List
+- `functiongraph:function:getConfig` — Read config
+- `functiongraph:function:invoke` — Invoke
+
+Grant `FunctionGraph FullAccess` role or custom policy.
+
+## Error Codes
+
+| Error | Root Cause -> Fix |
+|-------|-------------------|
+| FSS.0400 | `:latest` suffix on URN. Strip it |
+| FSS.1417 | Missing DEDICATEDGATEWAY params |
+| FSS.0403 | Insufficient IAM permission |
+| FSS.1020 | Missing `--app_xrole` when binding VPC. Create IAM agency with `trust_domain_name=functiongraph`. See `huawei-iam` skill → Agencies section |
+
+## VPC + Agency Configuration
+
+To access VPC-internal resources from FunctionGraph:
+
+```bash
+# 1. Create agency (see huawei-iam skill)
+hcloud IAM CreateAgency --agency_name=<name> --trust_domain_name=functiongraph
+# 2. Grant role (e.g., VPC Administrator)
+hcloud IAM GrantRoleToAgency --agency_name=<name> --role_id=<role-id>
+# 3. Use in CreateFunction
+hcloud FunctionGraph CreateFunction --func_vpc.vpc_id=<vpc> --func_vpc.subnet_id=<subnet> --app_xrole=<name> ...
+```
+| QuotaExceeded | Max 10 functions per project per region |