huaweicloud-devkit 1.1.2-next.0 → 1.1.2-next.2

package/plugins/huaweicloud-core/skills/huawei-modelarts/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-modelarts
-description: "Use when training, deploying, or managing AI/ML models on Huawei Cloud ModelArts. Covers training jobs, model registry, online services, notebook instances. Triggers: ModelArts, model training, AI, machine learning, deep learning, notebook, inference, deployment. NOT for: general AI/ML concepts, non-Huawei platforms."
+description: 'Use when training, deploying, or managing AI/ML models on Huawei Cloud ModelArts. Covers training jobs, model registry, online services, notebook instances. Triggers: ModelArts, model training, AI, machine learning, deep learning, notebook, inference, deployment. NOT for: general AI/ML concepts, non-Huawei platforms.'
 version: 1
 ---
 
@@ -16,13 +16,13 @@ Domain expertise for ModelArts. Covers training jobs, model deployment, notebook
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| OBS bucket required | All training data, model outputs, and notebook storage use OBS. Create bucket first |
-| Training charges by duration | Pay-per-minute GPU/CPU billing. Stop unused notebooks and services |
-| Notebook auto-stop needed | Default no auto-stop — can run indefinitely and incur charges |
-| Model deployment needs quota | Online services may require service quota approval in new accounts |
-| Training job output must be OBS | Local output not supported. Ensure `--output_path` is a valid OBS path |
+| Trap                            | Why                                                                                 |
+| ------------------------------- | ----------------------------------------------------------------------------------- |
+| OBS bucket required             | All training data, model outputs, and notebook storage use OBS. Create bucket first |
+| Training charges by duration    | Pay-per-minute GPU/CPU billing. Stop unused notebooks and services                  |
+| Notebook auto-stop needed       | Default no auto-stop — can run indefinitely and incur charges                       |
+| Model deployment needs quota    | Online services may require service quota approval in new accounts                  |
+| Training job output must be OBS | Local output not supported. Ensure `--output_path` is a valid OBS path              |
 
 ## Prerequisites
 
@@ -32,34 +32,42 @@ Domain expertise for ModelArts. Covers training jobs, model deployment, notebook
 
 ## Common Workflows
 
-| Task | Operation |
-|------|-----------|
-| List models | `ListModels --cli-region=<r> --project_id=<p>` |
-| List training jobs | `ListTrainJobs --cli-region=<r> --project_id=<p>` |
-| List services | `ListServices --cli-region=<r> --project_id=<p>` |
-| List notebooks | `ListNotebooks --cli-region=<r> --project_id=<p>` |
-| Create model | `CreateModel --cli-region=<r> --project_id=<p>` |
-| Create notebook | `CreateNotebook --cli-region=<r> --project_id=<p>` |
+| Task               | Operation                                          |
+| ------------------ | -------------------------------------------------- |
+| List models        | `ListModels --cli-region=<r> --project_id=<p>`     |
+| List training jobs | `ListTrainJobs --cli-region=<r> --project_id=<p>`  |
+| List services      | `ListServices --cli-region=<r> --project_id=<p>`   |
+| List notebooks     | `ListNotebooks --cli-region=<r> --project_id=<p>`  |
+| Create model       | `CreateModel --cli-region=<r> --project_id=<p>`    |
+| Create notebook    | `CreateNotebook --cli-region=<r> --project_id=<p>` |
 
 Discover operation parameters with `--help` before executing any write operation.
 
 ## Service Types
 
-| Type | Purpose |
-|------|---------|
-| Training Job | Train models on GPU/CPU resources |
-| Model | Register trained models for deployment |
-| Service (Online) | Deploy models as REST API endpoints |
-| Notebook | JupyterLab environments for development |
+| Type             | Purpose                                 |
+| ---------------- | --------------------------------------- |
+| Training Job     | Train models on GPU/CPU resources       |
+| Model            | Register trained models for deployment  |
+| Service (Online) | Deploy models as REST API endpoints     |
+| Notebook         | JupyterLab environments for development |
 
 ## Troubleshooting
 
-| Error | Fix |
-|-------|-----|
-| OBS path not found | Verify OBS bucket exists and path is correct |
+| Error              | Fix                                                              |
+| ------------------ | ---------------------------------------------------------------- |
+| OBS path not found | Verify OBS bucket exists and path is correct                     |
 | Training job fails | Check training data format, resource quotas, and logs in console |
 
 ## Cross-Skill References
 
 - **OBS storage**: See `huawei-obs` for bucket and training data management
 - **VPC/Subnet**: See `huawei-vpc` for notebook network configuration
+
+## External Skills
+
+For advanced workflows (notebook lifecycle, training job diagnosis,
+hyperparameter tuning), search the marketplace:
+`huaweicloud_search_marketplace` query="ModelArts notebook/training/diagnosis"
+→ install via `npx skills add huaweicloud/huaweicloud-skills --skill <name> -y -g`
+→ load and execute.

package/plugins/huaweicloud-core/skills/huawei-obs/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-obs
-description: "Use when creating, configuring, or managing OBS buckets and objects on Huawei Cloud. Covers bucket creation, lifecycle policies, versioning, static website hosting, CORS, access control (IAM/bucket policy/ACL), cross-region replication, event notifications, and presigned URLs. Triggers on: OBS, bucket, object storage, lifecycle, versioning, static website, CORS, presigned, replication. NOT for: EVS block storage (use huawei-ecs), SFS file storage, CBR backup (use huawei-cbr)."
+description: 'Use when creating, configuring, or managing OBS buckets and objects on Huawei Cloud. Covers bucket creation, lifecycle policies, versioning, static website hosting, CORS, access control (IAM/bucket policy/ACL), cross-region replication, event notifications, and presigned URLs. Triggers on: OBS, bucket, object storage, lifecycle, versioning, static website, CORS, presigned, replication. NOT for: EVS block storage (use huawei-ecs), SFS file storage, CBR backup (use huawei-cbr).'
 version: 1
 ---
 
@@ -11,7 +11,7 @@ version: 1
 ## Routing Guard: Deploy vs Store
 
 - If the developer's goal is to **deploy, host, or preview a web app / static website** (temporary hosting, quick preview), do NOT default to OBS. Present deployment-target options with the sandbox first: ① huawei-sandbox (recommended), ② OBS static hosting, ③ ECS, ④ CCE. Ask: "建议优先部署到沙箱（临时运行环境，可预览访问），也可选 OBS 静态托管/ECS/CCE，你想部署到哪里？"
-- Proceed with OBS only when the developer selects OBS, explicitly asks for OBS, or the intent is long-term static hosting / CDN / file storage.
+- Proceed with OBS only when the developer selects OBS, explicitly asks for OBS, or the intent is long-term static hosting / CDN / file storage. **Deployment intent proceeding on OBS is a resource purchase: load `huawei-iac` for orchestration (cost+balance gate, batch approval, state tracking, ordered destroy) - this skill then supplies the bucket/object commands.** Sandbox choice (huawei-sandbox) bypasses iac - no purchase involved.
 - OBS is a storage service; it is not a general web-hosting default.
 
 ## Critical: OBS Command Syntax
@@ -23,11 +23,11 @@ hcloud OBS help           # NOT --help
 hcloud OBS help <command> # e.g. hcloud OBS help mb
 ```
 
-| Wrong (API-style) | Correct (obsutil-style) |
-|-------------------|-------------------------|
-| `OBS CreateBucket` | `OBS mb obs://<bucket>` |
-| `OBS PutObject` | `OBS cp <file> obs://<bucket>/` |
-| `OBS DeleteBucket` | `OBS rm obs://<bucket> -r` |
+| Wrong (API-style)  | Correct (obsutil-style)         |
+| ------------------ | ------------------------------- |
+| `OBS CreateBucket` | `OBS mb obs://<bucket>`         |
+| `OBS PutObject`    | `OBS cp <file> obs://<bucket>/` |
+| `OBS DeleteBucket` | `OBS rm obs://<bucket> -r`      |
 
 ## Overview
 
@@ -35,16 +35,16 @@ Domain expertise for Huawei Cloud Object Storage Service (OBS). Covers bucket/ob
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| Bucket name is global | All users share bucket namespace. Always use a unique name: `{prefix}-{timestamp}` (e.g. `mybucket-20260810155048`) |
-| Three-layer permissions | IAM > Bucket Policy > ACL. Most restrictive wins |
-| Versioning is irreversible | Once enabled, cannot be disabled, only suspended |
-| OBS uses AK/SK directly | NOT IAM tokens. Auth errors mean check AK/SK validity |
-| Static website via CLI missing | KooCLI OBS lacks website config. Use REST API or console |
-| **OBS needs separate cred config** | `hcloud configure` is NOT enough for OBS. Before any OBS operation, call `huaweicloud_setup_obs_config` to sync credentials from hcloud profile. |
-| **obsutil interactive prompts** | `cp`/`rm` without `-f` causes "Please input (y/n)" → Agent hangs (TIMEOUT). Always use `-f` for non-interactive. |
-| **Directory upload adds prefix** | `cp <dir>/ obs://<bucket>/ -r` puts files under `bucket/<dir>/...`. Use `-flat` for root-level files (static sites). Preview with `-dryRun` first. |
+| Trap                               | Why                                                                                                                                                |
+| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Bucket name is global              | All users share bucket namespace. Always use a unique name: `{prefix}-{timestamp}` (e.g. `mybucket-20260810155048`)                                |
+| Three-layer permissions            | IAM > Bucket Policy > ACL. Most restrictive wins                                                                                                   |
+| Versioning is irreversible         | Once enabled, cannot be disabled, only suspended                                                                                                   |
+| OBS uses AK/SK directly            | NOT IAM tokens. Auth errors mean check AK/SK validity                                                                                              |
+| Static website via CLI missing     | KooCLI OBS lacks website config. Use REST API or console                                                                                           |
+| **OBS needs separate cred config** | `hcloud configure` is NOT enough for OBS. Before any OBS operation, call `huaweicloud_setup_obs_config` to sync credentials from hcloud profile.   |
+| **obsutil interactive prompts**    | `cp`/`rm` without `-f` causes "Please input (y/n)" → Agent hangs (TIMEOUT). Always use `-f` for non-interactive.                                   |
+| **Directory upload adds prefix**   | `cp <dir>/ obs://<bucket>/ -r` puts files under `bucket/<dir>/...`. Use `-flat` for root-level files (static sites). Preview with `-dryRun` first. |
 
 ## OBS Credential Setup (Required Before First Use)
 
@@ -62,21 +62,21 @@ hcloud OBS config -e=<endpoint> -i=<AK> -k=<SK> -t=token
 
 ## Common Workflows
 
-| Task | Command |
-|------|---------|
-| Create bucket | `hcloud OBS mb obs://<bucket> -location=<region>` |
-| List buckets/objects | `hcloud OBS ls [obs://<bucket>]` |
-| Upload file | `hcloud OBS cp <file> obs://<bucket>/<key>` |
-| Upload directory (recursive) | `hcloud OBS cp <dir>/ obs://<bucket>/ -r -f -flat` |
-| Download object | `hcloud OBS cp obs://<bucket>/<key> <local-path>` |
-| Set bucket ACL | `hcloud OBS chattri obs://<bucket> -acl=public-read` |
-| Set object ACL | `hcloud OBS chattri obs://<bucket>/<key> -acl=public-read` | Bucket ACL does NOT cascade — anonymous reads need both |
-| Set lifecycle | `hcloud OBS lifecycle obs://<bucket> -method=put -localfile=<json>` |
-| Set bucket policy | `hcloud OBS bucketpolicy obs://<bucket> -method=put -localfile=<json>` |
-| Set CORS | `hcloud OBS cors obs://<bucket> -method=put -localfile=<json>` |
-| Delete bucket | `hcloud OBS rm obs://<bucket> -r` (must be empty) |
-| Presigned URL | `hcloud OBS sign obs://<bucket>/<key> -e=<seconds>` |
-| Object metadata | `hcloud OBS stat obs://<bucket>/<key>` |
+| Task                         | Command                                                                |
+| ---------------------------- | ---------------------------------------------------------------------- |
+| Create bucket                | `hcloud OBS mb obs://<bucket> -location=<region>`                      |
+| List buckets/objects         | `hcloud OBS ls [obs://<bucket>]`                                       |
+| Upload file                  | `hcloud OBS cp <file> obs://<bucket>/<key>`                            |
+| Upload directory (recursive) | `hcloud OBS cp <dir>/ obs://<bucket>/ -r -f -flat`                     |
+| Download object              | `hcloud OBS cp obs://<bucket>/<key> <local-path>`                      |
+| Set bucket ACL               | `hcloud OBS chattri obs://<bucket> -acl=public-read`                   |
+| Set object ACL               | `hcloud OBS chattri obs://<bucket>/<key> -acl=public-read`             | Bucket ACL does NOT cascade — anonymous reads need both |
+| Set lifecycle                | `hcloud OBS lifecycle obs://<bucket> -method=put -localfile=<json>`    |
+| Set bucket policy            | `hcloud OBS bucketpolicy obs://<bucket> -method=put -localfile=<json>` |
+| Set CORS                     | `hcloud OBS cors obs://<bucket> -method=put -localfile=<json>`         |
+| Delete bucket                | `hcloud OBS rm obs://<bucket> -r` (must be empty)                      |
+| Presigned URL                | `hcloud OBS sign obs://<bucket>/<key> -e=<seconds>`                    |
+| Object metadata              | `hcloud OBS stat obs://<bucket>/<key>`                                 |
 
 ## Static Website Deployment Workflow
 
@@ -94,22 +94,23 @@ See `references/single-file-share.md` for the full workflow to host one file and
 
 ## Storage Classes
 
-| Class | Use Case | Min Storage | Retrieval Fee |
-|-------|----------|-------------|---------------|
-| STANDARD | Frequently accessed | None | No |
-| STANDARD_IA | Infrequent access | 30 days | Yes |
-| ARCHIVE | Long-term archive | 90 days | Yes (hours) |
+| Class       | Use Case            | Min Storage | Retrieval Fee |
+| ----------- | ------------------- | ----------- | ------------- |
+| STANDARD    | Frequently accessed | None        | No            |
+| STANDARD_IA | Infrequent access   | 30 days     | Yes           |
+| ARCHIVE     | Long-term archive   | 90 days     | Yes (hours)   |
 
 ## Troubleshooting
 
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| AccessDenied on bucket | IAM/bucket policy/ACL conflict -> Check all three layers |
-| BucketAlreadyExists | Name taken globally -> Generate unique name with timestamp suffix: `{prefix}-{yyyymmddHHMMSS}` |
-| NoSuchKey | Object doesn't exist or wrong region -> Verify key and region |
-| InvalidAccessKeyId | OBS uses AK/SK directly -> Verify AK/SK validity, OBS endpoint, OBS permissions |
-| EntityTooLarge | Single PUT limit 5GB -> Use multipart upload |
-| OBS --help fails | KooCLI OBS uses `help` not `--help` -> Run `hcloud OBS help` |
+| Error                                 | Root Cause -> Fix                                                                                                                                                                                                                                      |
+| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| AccessDenied on bucket                | IAM/bucket policy/ACL conflict -> Check all three layers                                                                                                                                                                                               |
+| BucketAlreadyExists                   | Name taken globally -> Generate unique name with timestamp suffix: `{prefix}-{yyyymmddHHMMSS}`                                                                                                                                                         |
+| NoSuchKey                             | Object doesn't exist or wrong region -> Verify key and region                                                                                                                                                                                          |
+| InvalidAccessKeyId                    | OBS uses AK/SK directly -> Verify AK/SK validity, OBS endpoint, OBS permissions                                                                                                                                                                        |
+| EntityTooLarge                        | Single PUT limit 5GB -> Use multipart upload                                                                                                                                                                                                           |
+| OBS --help fails                      | KooCLI OBS uses `help` not `--help` -> Run `hcloud OBS help`                                                                                                                                                                                           |
+| Configuration file is not well-formed | `~/.obsutilconfig` was generated by a non-standard path (CRLF line endings or field-order differences). Even `hcloud OBS --help` fails. Rebuild it with `hcloud OBS config -e=<endpoint> -i=<AK> -k=<SK>` (or `huaweicloud_setup_obs_config`) -> retry |
 
 ## Security Considerations
 

package/plugins/huaweicloud-core/skills/huawei-obs/references/bucket-create.md

@@ -4,14 +4,14 @@ From Huawei Cloud marketplace best practices.
 
 ## Naming Rules
 
-| Rule | Detail |
-|------|--------|
-| Length | 3-63 characters |
-| Characters | Lowercase letters, numbers, `-`, `.` |
-| No IP format | Cannot be IP address pattern |
-| No leading/trailing `-` or `.` | Start and end must be alphanumeric |
-| No `..` | Adjacent dots forbidden |
-| No `-.` or `.-` | Adjacent dot-hyphen combos forbidden |
+| Rule                           | Detail                               |
+| ------------------------------ | ------------------------------------ |
+| Length                         | 3-63 characters                      |
+| Characters                     | Lowercase letters, numbers, `-`, `.` |
+| No IP format                   | Cannot be IP address pattern         |
+| No leading/trailing `-` or `.` | Start and end must be alphanumeric   |
+| No `..`                        | Adjacent dots forbidden              |
+| No `-.` or `.-`                | Adjacent dot-hyphen combos forbidden |
 
 ## Create Bucket
 
@@ -19,11 +19,11 @@ From Huawei Cloud marketplace best practices.
 hcloud OBS mb obs://<bucket> [-acl=xxx] [-location=<r>] [-sc=xxx]
 ```
 
-| Option | Values | Default |
-|--------|--------|---------|
-| `-acl` | private, public-read, public-read-write | private |
-| `-location` | cn-south-1, cn-north-4, ... | config default |
-| `-sc` | standard, warm, cold, deep-archive | standard |
+| Option      | Values                                  | Default        |
+| ----------- | --------------------------------------- | -------------- |
+| `-acl`      | private, public-read, public-read-write | private        |
+| `-location` | cn-south-1, cn-north-4, ...             | config default |
+| `-sc`       | standard, warm, cold, deep-archive      | standard       |
 
 ## Quick Verify
 
@@ -34,12 +34,12 @@ hcloud OBS stat obs://<bucket>
 
 ## Storage Class Guide
 
-| Class | Access Frequency | Min Storage | Retrieval Cost |
-|-------|-----------------|-------------|----------------|
-| standard | Frequent | None | No |
-| warm | Infrequent | 30 days | Yes |
-| cold | Rare | 90 days | Yes |
-| deep-archive | Archive | 180 days | Yes |
+| Class        | Access Frequency | Min Storage | Retrieval Cost |
+| ------------ | ---------------- | ----------- | -------------- |
+| standard     | Frequent         | None        | No             |
+| warm         | Infrequent       | 30 days     | Yes            |
+| cold         | Rare             | 90 days     | Yes            |
+| deep-archive | Archive          | 180 days    | Yes            |
 
 ## Critical Rules
 

package/plugins/huaweicloud-core/skills/huawei-obs/references/bucket-lifecycle.md

@@ -3,24 +3,29 @@
 > KooCLI OBS uses obsutil-style commands. `OBS CreateBucket` → `OBS mb`. `SetBucketWebsite` is NOT supported in KooCLI OBS (use API/SDK).
 
 ## Create Bucket
+
 hcloud OBS mb obs://<bucket> -location=<region>
 
 ## Lifecycle Rules (JSON)
+
 {
-  "Rules": [{
-    "ID": "move-to-ia-after-30d",
-    "Status": "Enabled",
-    "Filter": {"Prefix": ""},
-    "Transitions": [{"Days": 30, "StorageClass": "STANDARD_IA"}],
-    "Expiration": {"Days": 365}
-  }]
+"Rules": [{
+"ID": "move-to-ia-after-30d",
+"Status": "Enabled",
+"Filter": {"Prefix": ""},
+"Transitions": [{"Days": 30, "StorageClass": "STANDARD_IA"}],
+"Expiration": {"Days": 365}
+}]
 }
 
 ## Apply
+
 hcloud OBS lifecycle obs://<bucket> -method=put -localfile=<lifecycle.json>
 
 ## Static Website
+
 Not available via KooCLI OBS CLI. Use `hcloud OBS chattri obs://<bucket> -acl=public-read` for bucket ACL, or use API/SDK for website configuration.
 
 ## Cross-Region Replication
+
 Requires: source bucket versioning enabled, destination bucket in different region, replication IAM role.

package/plugins/huaweicloud-core/skills/huawei-obs/references/common-pitfalls.md

@@ -6,13 +6,13 @@
 
 OBS 使用 **obsutil-style** 子命令，不是 API-style 操作名：
 
-| 错误写法（API-style） | 正确写法（obsutil-style） |
-|----------------------|--------------------------|
-| `OBS --help` | `hcloud OBS help`（无 `--`，`help` 是子命令） |
-| `OBS CreateBucket` | `hcloud OBS mb obs://<bucket>` |
-| `OBS PutObject` | `hcloud OBS cp <file> obs://<bucket>/` |
-| `OBS DeleteBucket` | `hcloud OBS rm obs://<bucket> -r` |
-| `OBS ListBuckets` | `hcloud OBS ls` |
+| 错误写法（API-style） | 正确写法（obsutil-style）                     |
+| --------------------- | --------------------------------------------- |
+| `OBS --help`          | `hcloud OBS help`（无 `--`，`help` 是子命令） |
+| `OBS CreateBucket`    | `hcloud OBS mb obs://<bucket>`                |
+| `OBS PutObject`       | `hcloud OBS cp <file> obs://<bucket>/`        |
+| `OBS DeleteBucket`    | `hcloud OBS rm obs://<bucket> -r`             |
+| `OBS ListBuckets`     | `hcloud OBS ls`                               |
 
 ## 独立凭证配置
 
@@ -45,6 +45,7 @@ hcloud OBS config -i
 ```
 
 **规避方法**：
+
 1. 先 `-dryRun` 预览实际键名，再执行真实上传
 2. 或先将本地目录重命名为目标前缀名，如 `mv devkit/ root/` 后上传 `root/`
 3. 或使用 `-flat` 参数（如支持）
@@ -60,11 +61,11 @@ KooCLI OBS **不支持** `SetBucketWebsite` 命令。配置静态网站托管需
 
 ## 权限模型（三层）
 
-| 层级 | 作用域 | 优先级 |
-|------|--------|--------|
-| IAM Policy | 用户/用户组 | 最高 |
-| Bucket Policy | 桶级 | 中 |
-| ACL | 对象级 | 最低 |
+| 层级          | 作用域      | 优先级 |
+| ------------- | ----------- | ------ |
+| IAM Policy    | 用户/用户组 | 最高   |
+| Bucket Policy | 桶级        | 中     |
+| ACL           | 对象级      | 最低   |
 
 **关键规则**：三层中**最严格**的生效。Bucket Policy 设为 public-read，但 IAM deny 了 → 结果是 deny。
 

package/plugins/huaweicloud-core/skills/huawei-obs/references/single-file-share.md

@@ -2,10 +2,10 @@
 
 Host one file and get a shareable link in seconds. Two options:
 
-| Option | Link type | Bucket/object visibility | Expiry |
-|--------|-----------|--------------------------|--------|
-| Presigned URL | Time-limited private link | Keep private | `-e=<seconds>`, max 7 days |
-| Public URL | Permanent public link | Set object `-acl=public-read` | None |
+| Option        | Link type                 | Bucket/object visibility      | Expiry                     |
+| ------------- | ------------------------- | ----------------------------- | -------------------------- |
+| Presigned URL | Time-limited private link | Keep private                  | `-e=<seconds>`, max 7 days |
+| Public URL    | Permanent public link     | Set object `-acl=public-read` | None                       |
 
 ## Option 1: Presigned URL (private, time-limited)
 

package/plugins/huaweicloud-core/skills/huawei-rds/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-rds
-description: "Use when creating, configuring, managing, or troubleshooting RDS instances on Huawei Cloud. Covers MySQL, PostgreSQL, SQL Server. Triggers: RDS, MySQL, PostgreSQL, database instance, backup, read replica. NOT for: GaussDB (use huawei-gaussdb), DDS (use huawei-dds-dcs)."
+description: 'Use when creating, configuring, managing, or troubleshooting RDS instances on Huawei Cloud. Covers MySQL, PostgreSQL, SQL Server. Triggers: RDS, MySQL, PostgreSQL, database instance, backup, read replica. NOT for: GaussDB (use huawei-gaussdb), DDS (use huawei-dds-dcs).'
 version: 1
 ---
 
@@ -10,9 +10,14 @@ version: 1
 
 Always run `hcloud RDS <Operation> --help` before constructing commands to discover exact parameter names and requirements.
 
+## Deployment Routing Guard
+
+If this skill was reached via a DEPLOYMENT intent (the database is part of an application deployment, not a standalone ad-hoc operation), this is a cloud resource purchase: load `huawei-iac` first for orchestration (mandatory cost+balance gate, batch approval, session state, ordered destroy), then return here for the exact instance commands. Sandbox-deployed workloads (huawei-sandbox) bypass iac - no purchase involved.
+
 ## Prerequisites
 
 Before creating an RDS instance, you MUST have:
+
 - A VPC and subnet (see `huawei-vpc`)
 - A security group with database port open (MySQL=3306, PostgreSQL=5432, SQL Server=1433)
 - Run `hcloud RDS ListFlavors --database_name=<engine> --cli-region=<r>` to get spec codes
@@ -23,40 +28,42 @@ Before creating an RDS instance, you MUST have:
 hcloud RDS <Operation> --cli-region=<region> [--key=value ...]
 ```
 
-| Rule | Detail |
-|------|--------|
-| Service name | `RDS` (uppercase) |
-| Operation | PascalCase: `ListInstances`, `CreateManualBackup` |
-| Params | `--key=value` format. JSON params: `--key='{"k":"v"}'` |
-| Array params | 1-based: `--instance_ids.1=xxx` |
+| Rule           | Detail                                                                            |
+| -------------- | --------------------------------------------------------------------------------- |
+| Service name   | `RDS` (uppercase)                                                                 |
+| Operation      | PascalCase: `ListInstances`, `CreateManualBackup`                                 |
+| Params         | `--key=value` format. JSON params: `--key='{"k":"v"}'`                            |
+| Array params   | 1-based: `--instance_ids.1=xxx`                                                   |
 | Password param | Conflicts with KooCLI system param; use `--cli-jsonInput` (see Critical Warnings) |
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| Engine version immutable | Cannot change MySQL to PostgreSQL in-place |
-| Automated backups use OBS | Backup storage incurs separate charges. Set retention period explicitly |
-| Storage auto-scaling off by default | Enable before storage runs out or instance goes read-only |
-| `--password` conflicts with KooCLI | Use `--cli-jsonInput=<file>` with JSON file (see `--cli-jsonInput` section below). The `printf "b\n"` workaround is broken in KooCLI 7.2.12+ |
-| Volume type must match flavor | General→CLOUDSSD; Dedicated→CLOUDSSD\|ESSD; ARM→ULTRAHIGH |
-| Flavor not in region | Always `ListFlavors` first. Spec codes vary by region |
-| `database_name` is case-sensitive | Use `MySQL` / `PostgreSQL` / `SQLServer` / `MariaDB` — NOT lower-case `mysql` |
-| Instance creation takes 3–8 min | Status: BUILD→MODIFYING→ACTIVE. Poll every 15s: `hcloud RDS ListInstances --cli-region=<r> --instance_id=<id> \| jq '.instances[0].status'` |
-| Body `--region` is required | CreateInstance body requires `--region=<r>` (same as `--cli-region`) or `DBS.280243` |
-| Restore creates new instance | No in-place restore. Verify target flavor before restoring |
+| Trap                                | Why                                                                                                                                          |
+| ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| Engine version immutable            | Cannot change MySQL to PostgreSQL in-place                                                                                                   |
+| Automated backups use OBS           | Backup storage incurs separate charges. Set retention period explicitly                                                                      |
+| Storage auto-scaling off by default | Enable before storage runs out or instance goes read-only                                                                                    |
+| `--password` conflicts with KooCLI  | Use `--cli-jsonInput=<file>` with JSON file (see `--cli-jsonInput` section below). The `printf "b\n"` workaround is broken in KooCLI 7.2.12+ |
+| Volume type must match flavor       | General→CLOUDSSD; Dedicated→CLOUDSSD\|ESSD; ARM→CLOUDSSD                                                                                     |
+| Flavor not in region                | Always `ListFlavors` first. Spec codes vary by region                                                                                        |
+| `database_name` is case-sensitive   | Use `MySQL` / `PostgreSQL` / `SQLServer` / `MariaDB` — NOT lower-case `mysql`                                                                |
+| Instance creation takes 3–8 min     | Status: BUILD→MODIFYING→ACTIVE. Poll every 15s: `hcloud RDS ListInstances --cli-region=<r> --instance_id=<id> \| jq '.instances[0].status'`  |
+| Body `--region` is required         | CreateInstance body requires `--region=<r>` (same as `--cli-region`) or `DBS.280243`                                                         |
+| Restore creates new instance        | No in-place restore. Verify target flavor before restoring                                                                                   |
 
 ## Instance Management
 
 ### List
+
 ```bash
 hcloud RDS ListInstances --cli-region=<r>
 hcloud RDS ListFlavors --database_name=<engine> --cli-region=<r>
 hcloud RDS ListDatastores --database_name=<engine> --cli-region=<r>
-hcloud RDS ListEngineFlavors --instance_id=<id> --cli-region=<r>
+hcloud RDS ListEngineFlavors --instance_id=<id> --availability_zone_ids=<az> --ha_mode=<mode> --cli-region=<r>
 ```
 
 ### Create Instance
+
 ```bash
 hcloud RDS CreateInstance --cli-region=<r> \
   --region=<r> \
@@ -101,21 +108,22 @@ hcloud RDS CreateInstance --cli-region=<r> \
 
 > Save as `rds-create.json` then: `hcloud RDS CreateInstance --cli-jsonInput=rds-create.json`. For `project_id`, run `hcloud IAM KeystoneListProjects`.
 
-| Param | Required | Note |
-|-------|----------|------|
-| `--name` | Yes | Instance name |
-| `--datastore` | Yes | `--datastore.type=<engine> --datastore.version=<version>` |
-| `--flavor_ref` | Yes | From `ListFlavors` output |
-| `--volume` | Yes | Type matching: General→CLOUDSSD, Dedicated→CLOUDSSD\|ESSD, ARM→ULTRAHIGH |
-| `--vpc_id` | Yes | Must exist in target region |
-| `--subnet_id` | Yes | Must exist in target region |
-| `--security_group_id` | Yes | Must have DB port open |
-| `--availability_zone` | Yes | Use AZ code from `NovaListAvailabilityZones` |
-| `--charge_info` | No | `--charge_info.charge_mode=<mode>`. Default postPaid (pay-per-use). Run `--help` for options |
-| `--password` | Yes | 8-32 chars, uppercase+lowercase+digit+special |
-| `--port` | No | Default 3306 (MySQL) / 5432 (PG) / 1433 (SQL Server) |
+| Param                 | Required | Note                                                                                         |
+| --------------------- | -------- | -------------------------------------------------------------------------------------------- |
+| `--name`              | Yes      | Instance name                                                                                |
+| `--datastore`         | Yes      | `--datastore.type=<engine> --datastore.version=<version>`                                    |
+| `--flavor_ref`        | Yes      | From `ListFlavors` output                                                                    |
+| `--volume`            | Yes      | Type matching: General→CLOUDSSD, Dedicated→CLOUDSSD\|ESSD, ARM→CLOUDSSD                      |
+| `--vpc_id`            | Yes      | Must exist in target region                                                                  |
+| `--subnet_id`         | Yes      | Must exist in target region                                                                  |
+| `--security_group_id` | Yes      | Must have DB port open                                                                       |
+| `--availability_zone` | Yes      | Use AZ code from `NovaListAvailabilityZones`                                                 |
+| `--charge_info`       | No       | `--charge_info.charge_mode=<mode>`. Default postPaid (pay-per-use). Run `--help` for options |
+| `--password`          | Yes      | 8-32 chars, uppercase+lowercase+digit+special                                                |
+| `--port`              | No       | Default 3306 (MySQL) / 5432 (PG) / 1433 (SQL Server)                                         |
 
 ### Modify / Resize
+
 ```bash
 hcloud RDS StartInstanceRestartAction --instance_id=<id> --cli-region=<r>
 hcloud RDS StartResizeFlavorAction --instance_id=<id> --flavor_ref=<new-id> --cli-region=<r>
@@ -125,6 +133,7 @@ hcloud RDS UpdateInstanceAlias --instance_id=<id> --alias=<new-name> --cli-regio
 ```
 
 ### Delete
+
 ```bash
 hcloud RDS DeleteInstance --instance_id=<id> --cli-region=<r>
 ```
@@ -145,7 +154,8 @@ hcloud RDS CreateRestoreInstance --instance_id=<id> --backup_id=<id> --name=<new
 ## Read Replicas
 
 ```bash
-hcloud RDS CreateReadReplica --replica_of_id=<primary-id> --name=<name> --flavor_ref=<id> --volume.type=<vol-type> --volume.size=<size> --cli-region=<r>
+# Create a read replica via CreateInstance with --replica_of_id
+hcloud RDS CreateInstance --replica_of_id=<primary-id> --name=<name> --flavor_ref=<id> --volume.type=<vol-type> --volume.size=<size> --cli-region=<r>
 ```
 
 ## Fault Diagnosis
@@ -154,7 +164,7 @@ hcloud RDS CreateReadReplica --replica_of_id=<primary-id> --name=<name> --flavor
 hcloud RDS ListErrorLogs --instance_id=<id> --start_date=2024-01-01T00:00:00Z --end_date=2024-01-31T23:59:59Z --cli-region=<r>
 hcloud RDS ListSlowLogs --instance_id=<id> --start_date=... --end_date=... --cli-region=<r>
 hcloud RDS ShowReplicationStatus --instance_id=<id> --cli-region=<r>
-hcloud RDS ListInstanceDiagnosis --cli-region=<r>
+hcloud RDS ListInstanceDiagnosis --engine=<engine> --cli-region=<r>
 ```
 
 ## Connecting
@@ -172,41 +182,41 @@ psql -h <private_ip> -p 5432 -U root -d postgres
 
 If a database client is not installed on the agent's machine, install one:
 
-| Platform | MySQL | PostgreSQL |
-|----------|-------|------------|
-| **Linux** | `apt install mysql-client` / `yum install mysql` | `apt install postgresql-client` |
-| **macOS** | `brew install mysql-client` | `brew install libpq` |
-| **Windows** | Download MySQL Workbench or `winget install Oracle.MySQL` | Download pgAdmin or `winget install PostgreSQL.PostgreSQL` |
+| Platform         | MySQL                                                        | PostgreSQL                                                     |
+| ---------------- | ------------------------------------------------------------ | -------------------------------------------------------------- |
+| **Linux**        | `apt install mysql-client` / `yum install mysql`             | `apt install postgresql-client`                                |
+| **macOS**        | `brew install mysql-client`                                  | `brew install libpq`                                           |
+| **Windows**      | Download MySQL Workbench or `winget install Oracle.MySQL`    | Download pgAdmin or `winget install PostgreSQL.PostgreSQL`     |
 | **Python (any)** | `pip install pymysql` then `python -c "import pymysql; ..."` | `pip install psycopg2` then `python -c "import psycopg2; ..."` |
-| **Docker (any)** | `docker run -it --rm mysql:8 mysql -h <ip> -u root -p` | `docker run -it --rm postgres:16 psql -h <ip> -U root` |
+| **Docker (any)** | `docker run -it --rm mysql:8 mysql -h <ip> -u root -p`       | `docker run -it --rm postgres:16 psql -h <ip> -U root`         |
 
 > If no client can be installed, use the Huawei Cloud **Data Studio** console: https://console.huaweicloud.com/dms/
 
 ## Mutating Operations (Require Approval)
 
-| Operation | Effect |
-|-----------|--------|
-| `CreateInstance` | New instance (billing starts) |
-| `DeleteInstance` | Irreversible data loss |
-| `StartResizeFlavorAction` | Brief interruption during switchover |
-| `StartInstanceEnlargeVolumeAction` | Online, but irreversible |
-| `StartFailover` | Primary-standby switchover |
-| `CreateRestoreInstance` | Creates new instance from backup |
-| `CreateManualBackup` | Incurs OBS storage charges |
-| `DeleteManualBackup` | Irreversible |
+| Operation                          | Effect                               |
+| ---------------------------------- | ------------------------------------ |
+| `CreateInstance`                   | New instance (billing starts)        |
+| `DeleteInstance`                   | Irreversible data loss               |
+| `StartResizeFlavorAction`          | Brief interruption during switchover |
+| `StartInstanceEnlargeVolumeAction` | Online, but irreversible             |
+| `StartFailover`                    | Primary-standby switchover           |
+| `CreateRestoreInstance`            | Creates new instance from backup     |
+| `CreateManualBackup`               | Incurs OBS storage charges           |
+| `DeleteManualBackup`               | Irreversible                         |
 
 ## Troubleshooting
 
-| Error | Root Cause -> Fix |
-|-------|-------------------|
-| Connection refused | SG missing DB port. Add ingress rule |
-| Storage full | Manual resize or enable auto-scaling |
-| DBS.280241 Invalid storage type | Volume type doesn't match flavor group |
-| DBS.280448 Sold out | Try different volume type or AZ |
-| Replication lag | Check `ShowReplicationStatus`. Consider read replica |
-| Instance stuck BUILDING | Check task status: `hcloud RDS ListTasks` |
-| SYS.0403 | SCP policy denies this operation (e.g. security group rules, EIP binding). See `huawei-vpc` troubleshooting |
-| EIP.7905 | EIP quota exceeded — cannot create new EIP for public access. See `huawei-vpc` troubleshooting |
+| Error                           | Root Cause -> Fix                                                                                           |
+| ------------------------------- | ----------------------------------------------------------------------------------------------------------- |
+| Connection refused              | SG missing DB port. Add ingress rule                                                                        |
+| Storage full                    | Manual resize or enable auto-scaling                                                                        |
+| DBS.280241 Invalid storage type | Volume type doesn't match flavor group                                                                      |
+| DBS.280448 Sold out             | Try different volume type or AZ                                                                             |
+| Replication lag                 | Check `ShowReplicationStatus`. Consider read replica                                                        |
+| Instance stuck BUILDING         | Check task status: `hcloud RDS ListTasks`                                                                   |
+| SYS.0403                        | SCP policy denies this operation (e.g. security group rules, EIP binding). See `huawei-vpc` troubleshooting |
+| EIP.7905                        | EIP quota exceeded — cannot create new EIP for public access. See `huawei-vpc` troubleshooting              |
 
 ## Security