huaweicloud-devkit 1.1.2-next.0 → 1.1.2-next.2

package/plugins/huaweicloud-core/skills/huawei-functiongraph/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-functiongraph
-description: "Use when creating, deploying, or managing serverless functions on FunctionGraph. Covers triggers (APIG/OBS/timer/SMN), cold start, reserved concurrency. Triggers: FunctionGraph, serverless, function, Lambda, trigger. NOT for: CCE containers (use huawei-cce)."
+description: 'Use when creating, deploying, or managing serverless functions on FunctionGraph. Covers triggers (APIG/OBS/timer/SMN), cold start, reserved concurrency. Triggers: FunctionGraph, serverless, function, Lambda, trigger. NOT for: CCE containers (use huawei-cce).'
 version: 1
 ---
 
@@ -8,6 +8,10 @@ version: 1
 
 **STOP - Do not answer from general knowledge.** Follow the procedure below.
 
+## Deployment Routing Guard
+
+If this skill was reached via a DEPLOYMENT intent ("部署/搭建/上线一个应用/接口" - the function is part of an application deployment), this is a cloud resource purchase: load `huawei-iac` first for orchestration (mandatory cost+balance gate, batch approval, session state, ordered destroy), then return here for the exact function/trigger commands. Direct function operations (query/update/debug an existing function) do not need iac.
+
 ## Overview
 
 Domain expertise for Huawei Cloud FunctionGraph. Covers function lifecycle, code deployment, trigger configuration, and troubleshooting.
@@ -20,16 +24,16 @@ Domain expertise for Huawei Cloud FunctionGraph. Covers function lifecycle, code
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| Service name is `FunctionGraph` | NOT `FGS`. KooCLI 7.x uses the full service name |
-| CLI requires `project_id` | Get it: `hcloud IAM KeystoneListProjects` or extract from URN `urn:fss:<region>:<project_id>:...` |
-| Cold start 100ms-2s | Reserve concurrency for latency-sensitive workloads |
-| Max execution 900s | Use ECS/CCE for long-running tasks |
-| Env vars plaintext | Use DEW for secrets |
-| **ZIP upload is unreliable** | `CreateFunction --code_type=zip --code_filename=xxx.zip` succeeds even with a nonexistent file — the function is created with empty code. Prefer `code_type=inline` for simple functions. If using zip, verify `code_size` > placeholder after creation and run `InvokeFunction` to confirm output. |
-| **DeleteFunction strip `:latest`** | Passing `urn:fss:...:function:xxx:latest` causes FSS.0400. Strip `:latest` suffix (DeleteFunction only — UpdateApiV2 needs the full URN). |
-| **DeleteFunctionTrigger does NOT cascade** | Deleting a DEDICATEDGATEWAY trigger leaves the API in APIG. Manually clean up: `hcloud APIG DeleteApiV2 --instance_id=<id> --api_id=<api-id>`. |
+| Trap                                       | Why                                                                                                                                                                                                                                                                                                 |
+| ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Service name is `FunctionGraph`            | NOT `FGS`. KooCLI 7.x uses the full service name                                                                                                                                                                                                                                                    |
+| CLI requires `project_id`                  | Get it: `hcloud IAM KeystoneListProjects` or extract from URN `urn:fss:<region>:<project_id>:...`                                                                                                                                                                                                   |
+| Cold start 100ms-2s                        | Reserve concurrency for latency-sensitive workloads                                                                                                                                                                                                                                                 |
+| Max execution 900s                         | Use ECS/CCE for long-running tasks                                                                                                                                                                                                                                                                  |
+| Env vars plaintext                         | Use DEW for secrets                                                                                                                                                                                                                                                                                 |
+| **ZIP upload is unreliable**               | `CreateFunction --code_type=zip --code_filename=xxx.zip` succeeds even with a nonexistent file — the function is created with empty code. Prefer `code_type=inline` for simple functions. If using zip, verify `code_size` > placeholder after creation and run `InvokeFunction` to confirm output. |
+| **DeleteFunction strip `:latest`**         | Passing `urn:fss:...:function:xxx:latest` causes FSS.0400. Strip `:latest` suffix (DeleteFunction only — UpdateApiV2 needs the full URN).                                                                                                                                                           |
+| **DeleteFunctionTrigger does NOT cascade** | Deleting a DEDICATEDGATEWAY trigger leaves the API in APIG. Manually clean up: `hcloud APIG DeleteApiV2 --instance_id=<id> --api_id=<api-id>`.                                                                                                                                                      |
 
 ## Prerequisites
 
@@ -42,13 +46,13 @@ hcloud FunctionGraph --help        # confirm service is available
 
 If you see `FSS.0403 Forbidden`, the user needs these permissions:
 
-| Operation | Required Permission |
-|-----------|---------------------|
+| Operation       | Required Permission                     |
+| --------------- | --------------------------------------- |
 | Create function | `functiongraph:function:createFunction` |
-| List functions | `functiongraph:function:list` |
+| List functions  | `functiongraph:function:list`           |
 | Delete function | `functiongraph:function:deleteFunction` |
-| Invoke function | `functiongraph:function:invoke` |
-| Create trigger | `functiongraph:trigger:*` |
+| Invoke function | `functiongraph:function:invoke`         |
+| Create trigger  | `functiongraph:trigger:*`               |
 
 Grant via IAM console (`FunctionGraph FullAccess` role) or ask project admin.
 
@@ -56,18 +60,19 @@ Grant via IAM console (`FunctionGraph FullAccess` role) or ask project admin.
 
 Always discover parameters with `--help` before executing. These are the correct operation names:
 
-| Task | Operation | Gotchas |
-|------|-----------|---------|
-| List functions | `ListFunctions` | |
-| Show function | `ShowFunctionConfig` | |
-| Create function | `CreateFunction` | references/create-function.md |
-| Delete function | `DeleteFunction` | Strip `:latest` from URN |
-| Invoke function | `InvokeFunction` | Requires body param (`--name=<value>` becomes event body). Use `--x_cff_request_version=v0` for raw output, `v1` for APIG-wrapped. |
-| Create trigger | `CreateFunctionTrigger` | references/triggers.md |
-| List triggers | `ListFunctionTriggers` | |
-| Delete trigger | `DeleteFunctionTrigger` | |
+| Task            | Operation               | Gotchas                                                                                                                            |
+| --------------- | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
+| List functions  | `ListFunctions`         |                                                                                                                                    |
+| Show function   | `ShowFunctionConfig`    |                                                                                                                                    |
+| Create function | `CreateFunction`        | references/create-function.md                                                                                                      |
+| Delete function | `DeleteFunction`        | Strip `:latest` from URN                                                                                                           |
+| Invoke function | `InvokeFunction`        | Requires body param (`--name=<value>` becomes event body). Use `--x_cff_request_version=v0` for raw output, `v1` for APIG-wrapped. |
+| Create trigger  | `CreateFunctionTrigger` | references/triggers.md                                                                                                             |
+| List triggers   | `ListFunctionTriggers`  |                                                                                                                                    |
+| Delete trigger  | `DeleteFunctionTrigger` |                                                                                                                                    |
 
 Discover exact parameters:
+
 ```bash
 hcloud FunctionGraph CreateFunction --help
 hcloud FunctionGraph CreateFunctionTrigger --help
@@ -83,19 +88,19 @@ See `references/deploy-workflow.md` for a step-by-step example with code templat
 
 ## Troubleshooting
 
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| `不支持的服务名称:FGS` | Use `FunctionGraph`, not `FGS` |
-| `不支持的operation:CreateTrigger` | Use `CreateFunctionTrigger` |
-| `FSS.0403` / Forbidden | Missing IAM permissions — see IAM Permissions above |
-| `缺少必填参数:{*}` on Invoke | Add body param: `--name=<value>` |
-| APIG/EOM trigger error | `trigger_type_code=APIG` deprecated — use `DEDICATEDGATEWAY` |
-| `event_data` parse error | Use dotted format: `--event_data.key=value`, NOT JSON string |
-| FSS.1078 / code upload fails | `--code_filename` is filename-only, no path. `cd` to zip directory first |
-| DeleteFunction with `:latest` | Strip `:latest` version suffix from URN |
-| Code too large | Inline limit 10KB — use `zip`/`obs` code type |
-| Cold start slow | Set reserved instances for critical functions |
-| Auth failure | Run `npx huaweicloud-devkit auth init` |
+| Error                             | Root Cause -> Fix                                                        |
+| --------------------------------- | ------------------------------------------------------------------------ |
+| `不支持的服务名称:FGS`            | Use `FunctionGraph`, not `FGS`                                           |
+| `不支持的operation:CreateTrigger` | Use `CreateFunctionTrigger`                                              |
+| `FSS.0403` / Forbidden            | Missing IAM permissions — see IAM Permissions above                      |
+| `缺少必填参数:{*}` on Invoke      | Add body param: `--name=<value>`                                         |
+| APIG/EOM trigger error            | `trigger_type_code=APIG` deprecated — use `DEDICATEDGATEWAY`             |
+| `event_data` parse error          | Use dotted format: `--event_data.key=value`, NOT JSON string             |
+| FSS.1078 / code upload fails      | `--code_filename` is filename-only, no path. `cd` to zip directory first |
+| DeleteFunction with `:latest`     | Strip `:latest` version suffix from URN                                  |
+| Code too large                    | Inline limit 10KB — use `zip`/`obs` code type                            |
+| Cold start slow                   | Set reserved instances for critical functions                            |
+| Auth failure                      | Run `npx huaweicloud-devkit auth init`                                   |
 
 ## Security Considerations
 

package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/apig-event-format.md

@@ -22,6 +22,7 @@ When APIG calls FunctionGraph via DEDICATEDGATEWAY trigger, the event structure
 `event["body"]` is Base64 encoded. You MUST decode it:
 
 **Python handler template:**
+
 ```python
 import json, base64
 
@@ -38,18 +39,19 @@ def handler(event, context):
 ```
 
 **Node.js handler template:**
+
 ```js
 exports.handler = async (event, context) => {
-    let body = event.body || "";
-    if (event.isBase64Encoded) {
-        body = Buffer.from(body, "base64").toString("utf8");
-    }
-    const data = body ? JSON.parse(body) : {};
-    return {
-        statusCode: 200,
-        body: JSON.stringify({ message: "ok", received: data }),
-        headers: { "Content-Type": "application/json" }
-    };
+  let body = event.body || '';
+  if (event.isBase64Encoded) {
+    body = Buffer.from(body, 'base64').toString('utf8');
+  }
+  const data = body ? JSON.parse(body) : {};
+  return {
+    statusCode: 200,
+    body: JSON.stringify({ message: 'ok', received: data }),
+    headers: { 'Content-Type': 'application/json' },
+  };
 };
 ```
 

package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/create-function.md

@@ -2,14 +2,14 @@
 
 ## Runtime Options
 
-| Runtime | Handler Format | Example |
-|---------|---------------|---------|
-| Python3.9 | `index.handler` | `def handler(event, context): return {"statusCode": 200}` |
-| Python3.10 | `index.handler` | Same as 3.9 |
-| Node.js 18 | `index.handler` | `exports.handler = async (event, context) => ({statusCode: 200})` |
-| Java 8/11/17 | `com.example.Handler::handleRequest` | Java class method |
-| Go 1.x | `handler` | Go function name |
-| C# (.NET Core) | `CsharpDemo::CsharpDemo.Function::Handler` | Namespace.Class::Method |
+| Runtime        | Handler Format                             | Example                                                           |
+| -------------- | ------------------------------------------ | ----------------------------------------------------------------- |
+| Python3.9      | `index.handler`                            | `def handler(event, context): return {"statusCode": 200}`         |
+| Python3.10     | `index.handler`                            | Same as 3.9                                                       |
+| Node.js 18     | `index.handler`                            | `exports.handler = async (event, context) => ({statusCode: 200})` |
+| Java 8/11/17   | `com.example.Handler::handleRequest`       | Java class method                                                 |
+| Go 1.x         | `handler`                                  | Go function name                                                  |
+| C# (.NET Core) | `CsharpDemo::CsharpDemo.Function::Handler` | Namespace.Class::Method                                           |
 
 ## Create Function (inline)
 
@@ -26,13 +26,13 @@ hcloud FunctionGraph CreateFunction \
   --cli-region=<region>
 ```
 
-| Param | Required | Range/Default |
-|-------|----------|---------------|
-| `--func_name` | Yes | 1-60 chars |
-| `--runtime` | Yes | See runtime options above |
-| `--handler` | Yes | Per runtime |
-| `--memory_size` | No | 128-4096 MB, default 128 |
-| `--timeout` | No | 1-900s, default 3 |
+| Param           | Required | Range/Default             |
+| --------------- | -------- | ------------------------- |
+| `--func_name`   | Yes      | 1-60 chars                |
+| `--runtime`     | Yes      | See runtime options above |
+| `--handler`     | Yes      | Per runtime               |
+| `--memory_size` | No       | 128-4096 MB, default 128  |
+| `--timeout`     | No       | 1-900s, default 3         |
 
 ## ZIP Upload Warning
 
@@ -49,11 +49,11 @@ Grant `FunctionGraph FullAccess` role or custom policy.
 
 ## Error Codes
 
-| Error | Root Cause -> Fix |
-|-------|-------------------|
-| FSS.0400 | `:latest` suffix on URN. Strip it |
-| FSS.1417 | Missing DEDICATEDGATEWAY params |
-| FSS.0403 | Insufficient IAM permission |
+| Error    | Root Cause -> Fix                                                                                                                           |
+| -------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
+| FSS.0400 | `:latest` suffix on URN. Strip it                                                                                                           |
+| FSS.1417 | Missing DEDICATEDGATEWAY params                                                                                                             |
+| FSS.0403 | Insufficient IAM permission                                                                                                                 |
 | FSS.1020 | Missing `--app_xrole` when binding VPC. Create IAM agency with `trust_domain_name=functiongraph`. See `huawei-iam` skill → Agencies section |
 
 ## VPC + Agency Configuration
@@ -68,4 +68,5 @@ hcloud IAM GrantRoleToAgency --agency_name=<name> --role_id=<role-id>
 # 3. Use in CreateFunction
 hcloud FunctionGraph CreateFunction --func_vpc.vpc_id=<vpc> --func_vpc.subnet_id=<subnet> --app_xrole=<name> ...
 ```
+
 | QuotaExceeded | Max 10 functions per project per region |

package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/triggers.md

@@ -16,12 +16,12 @@ KooCLI uses **dotted key-value format**, NOT JSON strings:
 
 ## Trigger Types
 
-| Type | `--trigger_type_code` | Notes |
-|------|----------------------|-------|
-| APIG Dedicated | `DEDICATEDGATEWAY` | Use this, not `APIG` (deprecated). Requires APIG instance. |
-| Timer / Cron | `TIMER` | Simplest trigger for testing. No APIG dependency. |
-| OBS | `OBS` | Event when objects created/deleted in bucket |
-| SMN | `SMN` | Message notification trigger |
+| Type           | `--trigger_type_code` | Notes                                                      |
+| -------------- | --------------------- | ---------------------------------------------------------- |
+| APIG Dedicated | `DEDICATEDGATEWAY`    | Use this, not `APIG` (deprecated). Requires APIG instance. |
+| Timer / Cron   | `TIMER`               | Simplest trigger for testing. No APIG dependency.          |
+| OBS            | `OBS`                 | Event when objects created/deleted in bucket               |
+| SMN            | `SMN`                 | Message notification trigger                               |
 
 ## TIMER Trigger (Simple Testing)
 
@@ -46,22 +46,22 @@ hcloud FunctionGraph CreateFunctionTrigger \
 
 These are labeled optional by `--help` but are **required** for DEDICATEDGATEWAY:
 
-| Param | Note |
-|-------|------|
-| `--event_data.protocol` | `HTTPS` or `HTTP` or `BOTH` |
-| `--event_data.sl_domain` | Subdomain from APIG instance (e.g. `xxxx.apic.<region>.huaweicloudapis.com`) |
-| `--event_data.env_name` | API environment name (`RELEASE`) |
-| `--event_data.env_id` | API environment ID |
-| `--event_data.instance_id` | APIG dedicated instance ID |
-| `--event_data.group_id` | API group ID |
-| `--event_data.name` | API name — **hyphens (`-`) are DISALLOWED**. Use underscores (`_`) instead. |
+| Param                      | Note                                                                         |
+| -------------------------- | ---------------------------------------------------------------------------- |
+| `--event_data.protocol`    | `HTTPS` or `HTTP` or `BOTH`                                                  |
+| `--event_data.sl_domain`   | Subdomain from APIG instance (e.g. `xxxx.apic.<region>.huaweicloudapis.com`) |
+| `--event_data.env_name`    | API environment name (`RELEASE`)                                             |
+| `--event_data.env_id`      | API environment ID                                                           |
+| `--event_data.instance_id` | APIG dedicated instance ID                                                   |
+| `--event_data.group_id`    | API group ID                                                                 |
+| `--event_data.name`        | API name — **hyphens (`-`) are DISALLOWED**. Use underscores (`_`) instead.  |
 
 ### Error Mapping
 
-| Error | Root Cause → Fix |
-|-------|-----------------|
-| FSS.1417 | Missing `instance_id`, `group_id`, `protocol`, `env_name`, or `env_id`. These are labeled optional but REQUIRED. |
-| API name regex fail | Rename API — remove hyphens (`-`), use `[a-zA-Z0-9_]+` only. |
+| Error               | Root Cause → Fix                                                                                                 |
+| ------------------- | ---------------------------------------------------------------------------------------------------------------- |
+| FSS.1417            | Missing `instance_id`, `group_id`, `protocol`, `env_name`, or `env_id`. These are labeled optional but REQUIRED. |
+| API name regex fail | Rename API — remove hyphens (`-`), use `[a-zA-Z0-9_]+` only.                                                     |
 
 ### Example
 

package/plugins/huaweicloud-core/skills/huawei-gaussdb/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-gaussdb
-description: "Use when creating or managing GaussDB distributed database on Huawei Cloud. Covers GaussDB(for MySQL), GaussDB(for openGauss), sharding, HTAP. Triggers: GaussDB, distributed database, sharding, openGauss, HTAP. NOT for: single RDS (use huawei-rds)."
+description: 'Use when creating or managing GaussDB distributed database on Huawei Cloud. Covers GaussDB(for MySQL), GaussDB(for openGauss), sharding, HTAP. Triggers: GaussDB, distributed database, sharding, openGauss, HTAP. NOT for: single RDS (use huawei-rds).'
 version: 1
 ---
 
@@ -16,34 +16,34 @@ Domain expertise for GaussDB. Covers instance lifecycle, databases, backups, con
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| Shard key permanent | Once set, shard key cannot be changed |
-| Minimum nodes | Distributed GaussDB requires at least 3 nodes for production |
-| Engine version pinned | MySQL-compatible vs openGauss are separate products |
+| Trap                  | Why                                                          |
+| --------------------- | ------------------------------------------------------------ |
+| Shard key permanent   | Once set, shard key cannot be changed                        |
+| Minimum nodes         | Distributed GaussDB requires at least 3 nodes for production |
+| Engine version pinned | MySQL-compatible vs openGauss are separate products          |
 
 ## Common Workflows
 
-| Task | Operation |
-|------|-----------|
-| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
-| Show instance | `ShowInstance --cli-region=<r> --project_id=<p>` |
-| List flavors | `ListFlavors --cli-region=<r> --project_id=<p>` |
-| Create instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
-| Delete instance | `DeleteInstance --cli-region=<r> --project_id=<p>` |
-| Create backup | `CreateGaussMySqlBackup --cli-region=<r> --project_id=<p>` |
-| Add readonly node | `AddReadonlyNode --cli-region=<r> --project_id=<p>` |
-| Add shard | `AddShardingNode --cli-region=<r> --project_id=<p>` |
-| Manage database | `AddDatabasePermission --cli-region=<r> --project_id=<p>` |
+| Task              | Operation                                                  |
+| ----------------- | ---------------------------------------------------------- |
+| List instances    | `ListInstances --cli-region=<r> --project_id=<p>`          |
+| Show instance     | `ShowInstance --cli-region=<r> --project_id=<p>`           |
+| List flavors      | `ListFlavors --cli-region=<r> --project_id=<p>`            |
+| Create instance   | `CreateInstance --cli-region=<r> --project_id=<p>`         |
+| Delete instance   | `DeleteInstance --cli-region=<r> --project_id=<p>`         |
+| Create backup     | `CreateGaussMySqlBackup --cli-region=<r> --project_id=<p>` |
+| Add readonly node | `AddReadonlyNode --cli-region=<r> --project_id=<p>`        |
+| Add shard         | `AddShardingNode --cli-region=<r> --project_id=<p>`        |
+| Manage database   | `AddDatabasePermission --cli-region=<r> --project_id=<p>`  |
 
 Discover exact parameters with `--help` before executing any command.
 
 ## Troubleshooting
 
-| Error | Fix |
-|-------|-----|
+| Error                   | Fix                                               |
+| ----------------------- | ------------------------------------------------- |
 | Instance creation fails | Check VPC/subnet availability and flavor capacity |
-| Connection refused | SG missing database port |
+| Connection refused      | SG missing database port                          |
 
 ## Security
 

package/plugins/huaweicloud-core/skills/huawei-getting-started/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-getting-started
-description: "Use when starting fresh with Huawei Cloud or KooCLI, installing prerequisites, setting up authentication, or exploring what is possible. Triggers: getting started, first time, setup, install, explore, quickstart, beginner, tutorial. NOT for: specific service operations (use huawei-ecs, huawei-obs, etc.)."
+description: 'Use when starting fresh with Huawei Cloud or KooCLI, installing prerequisites, setting up authentication, or exploring what is possible. Triggers: getting started, first time, setup, install, explore, quickstart, beginner, tutorial. NOT for: specific service operations (use huawei-ecs, huawei-obs, etc.).'
 version: 1
 ---
 
@@ -10,13 +10,14 @@ version: 1
 
 ## KooCLI Installation
 
-| OS | Command |
-|----|---------|
-| Windows (PowerShell) | See https://support.huaweicloud.com/qs-hcli/hcli_02_003.html for MSI download |
-| Linux | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
-| macOS | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
+| OS                   | Command                                                                                                               |
+| -------------------- | --------------------------------------------------------------------------------------------------------------------- |
+| Windows (PowerShell) | See https://support.huaweicloud.com/qs-hcli/hcli_02_003.html for MSI download                                         |
+| Linux                | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
+| macOS                | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
 
 ## First-Time Setup
+
 1. **Install KooCLI** using command above
 2. **Accept privacy policy** (first run only): KooCLI requires one-time privacy agreement. Run `hcloud version` to read the agreement, then respond `y` to accept. Do not pipe `echo "y" |` — you must review the terms first.
 3. **Configure credentials (unified)**: `npx huaweicloud-devkit auth init` — prefer this over `hcloud configure init`, which only covers KooCLI.
@@ -38,28 +39,31 @@ hcloud configure list
 ```
 
 ## Critical Warnings
-| Trap | Why |
-|------|-----|
-| AK/SK must be kept secret | Never commit to git or share |
-| Default region applies to all commands | Override with --cli-region= per command |
-| Some services region-specific | Not all services available in all regions |
-| Privacy policy blocks first run | Run `hcloud version` to read and accept the agreement. Review the terms before responding `y` |
+
+| Trap                                   | Why                                                                                           |
+| -------------------------------------- | --------------------------------------------------------------------------------------------- |
+| AK/SK must be kept secret              | Never commit to git or share                                                                  |
+| Default region applies to all commands | Override with --cli-region= per command                                                       |
+| Some services region-specific          | Not all services available in all regions                                                     |
+| Privacy policy blocks first run        | Run `hcloud version` to read and accept the agreement. Review the terms before responding `y` |
 
 ## What Can I Do? (Quick Index)
-| Goal | Skill |
-|------|-------|
-| Create a VM | huawei-ecs |
-| Store files | huawei-obs |
+
+| Goal              | Skill                       |
+| ----------------- | --------------------------- |
+| Create a VM       | huawei-ecs                  |
+| Store files       | huawei-obs                  |
 | Set up a database | huawei-rds / huawei-gaussdb |
-| Create a network | huawei-vpc |
-| Manage access | huawei-iam |
-| Deploy an app | huawei-deployment |
-| Run containers | huawei-cce |
-| Build an API | huawei-apig |
-| Run serverless | huawei-functiongraph |
-| Monitor resources | huawei-cloud-eye |
+| Create a network  | huawei-vpc                  |
+| Manage access     | huawei-iam                  |
+| Deploy an app     | huawei-deployment           |
+| Run containers    | huawei-cce                  |
+| Build an API      | huawei-apig                 |
+| Run serverless    | huawei-functiongraph        |
+| Monitor resources | huawei-cloud-eye            |
 
 ## Pro Tips
+
 - Use `hcloud <Service> --help` to discover operations (see huaweicloud-capability-discovery)
 - Prepend `hcloud configure set --cli-region=<r>` to avoid per-command region flags
 - Pipe sensitive output through IAM with `--cli-output-format=json`

package/plugins/huaweicloud-core/skills/huawei-iac/SKILL.md

@@ -0,0 +1,93 @@
+---
+name: huawei-iac
+description: 'Use whenever the user wants to DEPLOY, host, or purchase anything on Huawei Cloud that creates billable resources: application deployments (部署应用到华为云, deploy my app, 上线, 搭建), architecture proposals, cost estimation, multi-resource provisioning (VPC, subnet, security group, ECS, EIP, RDS, OBS, CDN, DNS, FunctionGraph, CCE, GaussDB and more), session-scoped state tracking, and reverse-order destroy. Trigger words: 部署, 部署到华为云, 上线, 购买, 搭建, 开通, 成本估算, 多少钱, 销毁, deploy, deploy to Huawei Cloud, provision, purchase, architecture, hosting. Reusing an existing VPC does NOT make it single-resource - any purchase (ECS, EIP, disk, keypair, rules) must pass the cost+balance gate here. NOT for: sandbox preview (huawei-sandbox - free, no purchase), read-only or lifecycle operations on EXISTING resources (query/reboot/resize/delete - use the service skill directly).'
+version: 1
+---
+
+# Huawei Cloud IaC Orchestration
+
+**STOP - Do not answer from general knowledge.** Follow the 8-stage workflow below in strict order.
+
+Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Scope and Routing Guard
+
+- This skill orchestrates the **purchase lifecycle of ALL supported resources**: proposal → pricing → provisioning → destroy, across every service in the plugin catalog.
+- **Web app deployment keeps sandbox as the first choice** (see `huaweicloud-core` Deployment Target Options). Route here only when the user wants billed, long-term, or multi-resource cloud infrastructure, or explicitly asks for an architecture + cost proposal.
+- Single-resource tasks go directly to the service skill. This skill adds value for **multi-resource orchestration, mandatory cost gating, and ordered destroy**.
+
+## Workflow (strict order)
+
+**Proactive by design**: any deployment intent ("部署一个博客", "搭一套环境", "买个服务器") automatically triggers stages 1-5 BEFORE anything is created. The user NEVER needs to ask for an architecture proposal, cost estimate, or risk warnings - they are built into the flow. Only stages 6-8 (create / verify / manage) wait for explicit user confirmation at the approval gates.
+
+| Stage                      | What happens                                                                                                                                                                                                                      | Hard rule                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 1. Scale assessment        | **FIRST inspect the project code** (clone remote repos to a temp dir, or read the local path): tech stack, data services (Redis/MySQL/SQLite...), build artifacts, existing Dockerfile/k8s manifests → then classify or ask scale | **NEVER present deployment options (sandbox/ECS/OBS...) before the codebase has been inspected** - options without code analysis are guesses. If scale is not stated or clearly inferable, ASK - present the 3 tiers as options with what each includes and its monthly cost band (see `references/architectures.md`), and let the user choose. Never assume a tier. The scale question and the hosting-target question are SEPARATE questions on separate axes. FunctionGraph filesystem is ephemeral - never recommend SQLite/local files for persistent data                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| 2. Frontend hosting choice | Present BOTH options: (a) OBS+CDN+DNS custom domain, (b) ECS+EIP                                                                                                                                                                  | For SPA/static frontends (Vue/React dist), **OBS hosting must always appear as an option** with cost comparison against same-host Nginx - do not silently merge the frontend into a compute node. For option (a) three prerequisites: domain ownership verification (CDN requires a DNS record or file upload first - `CDN.00010185` otherwise), ICP filing check, DNS hosting check; domain registration link: https://www.huaweicloud.com/product/domain.html                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| 3. Architecture proposal   | ASCII topology tree with dependencies                                                                                                                                                                                             | User confirms before continuing. **Architecture decision points must be surfaced as explicit choices, never silently made**: (a) app depends on Redis/MySQL/Kafka etc. → managed service (DCS/RDS/DMS, billed) vs same-host install (cheap, ops burden) - state the trade-off and ask; (b) repo ships a Dockerfile / SWR image / k8s manifests → offer container path (Docker on ECS or CCE) alongside source-build path; (c) frontend hosting layer (Nginx same-host vs OBS+CDN). Silent defaults here are a correctness failure                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| 4. Parameter discovery     | `ListFlavors` / `ListImages` / `huaweicloud_list_regions`                                                                                                                                                                         | Never hardcode flavor/image names                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| 5. Cost + balance gate     | Price every resource via BSS `ListOnDemandResourceRatings`, then query balance                                                                                                                                                    | Balance = 0 → the FIRST message must state: "您的余额为 0，按时长计费的资源（ECS/EIP/RDS 等）需要交保证金，金额约 1~5 元人民币不等。保证金与余额是两个概念——它是可退还的押金，且是代金券正常使用的前提"。官方解释（用户追问"为什么冻结保证金"时引用）：https://support.huaweicloud.com/price-eip/faq_eip_0033.html （开通按需资源时冻结一定金额作为保证金；金额规则详见 https://support.huaweicloud.com/billing_faq/billing_faq_6200009.html ）。充值入口：https://account.huaweicloud.com/usercenter/?region=cn-north-4#/userindex/balanceRecharge 。Remedy priority: (1) FIRST claim the one-time incentive voucher (huaweicloud_voucher_status → huaweicloud_voucher_claim) to offset usage fees; (2) then instruct the user to pay the refundable deposit (top-up via the link above) so the voucher applies and orders pass (otherwise `Ecs.7000`); (3) free-tier resources (FunctionGraph, small OBS) may proceed meanwhile without deposit. Balance > 0 → report how long it can sustain (balance ÷ monthly estimate). **权限降级（实测）**：IAM 用户无 `billing:balance:view` 时余额查询报 `CBC.0151` → 不阻塞流程，明确告知"余额无法程序化查询，请自行核对；若下单报 Ecs.7000 即余额/保证金不足"，领券后继续。定价编码逐服务查证，见 `references/resource-catalog.md` § Pricing |
+| 6. Provision               | deployment_id, session state, batch approval, ordered creation                                                                                                                                                                    | See "Provisioning Rules" below                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| 7. Verify                  | `curl -I` the site / API; expect 200                                                                                                                                                                                              | DNS CNAME may take minutes to propagate - not an error                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| 8. Manage                  | Session-scoped status query and destroy                                                                                                                                                                                           | See "Destroy Rules" below                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+
+## Provisioning Rules (Stage 6)
+
+1. Generate `deployment_id` (`d-xxx`), initialize the session state file (path and schema: `references/state-file.md`).
+2. **Batch approval: show the RESOURCE LIST (name / type / purpose), never the raw commands.** After the user approves, execute each resource via `huaweicloud_run_approved_command`. Never execute anything outside the approved list.
+3. Create in dependency-topological order (network → compute/db → bindings). After each success, extract the resource ID and write it to state immediately.
+4. Any failure: stop immediately, mark state `partial`, report the error, offer destroy of already-created resources. No automatic rollback.
+
+## Destroy Rules (Stage 8, current session only)
+
+Preconditions - all required:
+
+1. Session state file exists and contains the deployment_id (state dies with the session; a fresh session cannot destroy past deployments - direct the user to the console instead).
+2. Status is `deployed` or `partial` (`destroyed` is terminal).
+3. The user explicitly names the target deployment. Ambiguous "delete it" → list deployments and ask. Never guess.
+4. Every delete command still goes through plan → approve → run.
+
+Execution: show the to-be-deleted list for final confirmation → delete in **reverse creation order** → a "resource not found" error counts as already deleted, continue → mark `destroyed`. OBS: upload paths like `assets/style.css` auto-create folder-marker objects that outlive the files - prefer one recursive sweep `hcloud OBS rm obs://<bucket>/ -r -f` over per-object deletes, then delete the bucket (a non-empty bucket fails with 409 `BucketNotEmpty`). CDN: disable then delete. DNS: delete the record set (only if hosted in Huawei Cloud DNS).
+
+## Critical Warnings
+
+| Trap                                                 | Why / Rule                                                                                                                                                                                                                                                                                                                                         |
+| ---------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Stale `securityToken` poisons every hcloud call      | Symptom: every API returns `APIGW.0301 Incorrect IAM authentication information` while OBS/obsutil still works. `configure set` refuses empty values and auth-sync never clears the field. Fix: `hcloud configure delete --cli-profile=default`, then re-run auth init with AK/SK only (no token)                                                  |
+| OBS writes bypass the REST write-prefix policy       | `mb` / `cp` / `rm` / `chattri` are obsutil-style commands. ALWAYS route them through `huaweicloud_plan_cli_command` → approval → `huaweicloud_run_approved_command`. Never treat them as read-only                                                                                                                                                 |
+| `OBS mb` flag rules differ from cp/rm                | `mb` does NOT accept `-f` (flag parse error) and REQUIRES explicit `-location=<region>` even with a regional endpoint (else `IllegalLocationConstraintException`)                                                                                                                                                                                  |
+| Duplicate `OBS mb` is idempotent success             | Same-account same-name bucket creation returns success, not an error - never treat a second create as failure. OBS deletes are also idempotent (deleting a nonexistent object succeeds)                                                                                                                                                            |
+| Bucket ACL does not cascade to objects               | Every uploaded object needs `-acl=public-read` at upload time (`-f` IS valid on cp/rm)                                                                                                                                                                                                                                                             |
+| OBS static website bucket name must equal the domain | e.g. bucket `www.example.com` for domain `www.example.com`                                                                                                                                                                                                                                                                                         |
+| VPC v3 API differs from older docs                   | v3 `CreateSecurityGroup` has NO `vpc_id` (account-scoped); `CreateSecurityGroupRule` uses `multiport=80` not `port_range_min/max`; `DeleteSubnet` requires `vpc_id` too. Always `--help` first                                                                                                                                                     |
+| Public exposure is auto-blocked                      | Risk rules deny `0.0.0.0/0` port rules at plan time. For test/dev use a narrower `remote_ip_prefix` (e.g. the VPC CIDR) or get user consent for a documented exception                                                                                                                                                                             |
+| ECS CreateServers hidden required params             | Besides flavor/image/nics/az it also needs `--server.vpcid` and `--server.root_volume.volumetype` - order submission fails without them                                                                                                                                                                                                            |
+| FunctionGraph runtime/code enums are strict          | runtime must be exact (`Node.js18.15`, `Python3.9`, `Go1.x`, ...); inline code is the PAIR `--package=default --code_type=inline` (`--package=inline` → `FSS.1006`); TIMER triggers use `--event_data.schedule_type=Rate --event_data.schedule=1m` (`@every` style → `FSS.1109`); DeleteFunction takes `--function_urn` WITHOUT `:latest`          |
+| Zero balance blocks order submission                 | ECS creation fails with `Ecs.7000 Insufficient account balance` when cash + voucher accounts are 0. This is the stage-5 gate materialized: stop, mark `partial`, tell the user pay-by-duration resources need a deposit. Free-tier resources (FunctionGraph, small OBS) DO work at 0 balance - the gate applies to order-submission resources only |
+| CDN mainland acceleration requires ICP filing        | Unregistered domains cannot go live on CDN - check before stage 3. CDN create ALSO requires domain ownership verification first (`CDN.00010185 Verify domain ownership failed` - user must add a DNS record or upload a verification file)                                                                                                         |
+| CDN is a global service in KooCLI                    | CDN operations only accept `--cli-region=cn-north-1` or `ap-southeast-1` - never the resource region                                                                                                                                                                                                                                               |
+| OBS static website hosting has NO CLI path           | `chattri` only sets ACL/storage-class; obsutil has no website command. Options: console setup, or CDN OBS-origin with `--domain.sources.1.enable_obs_web_hosting=1`. Without website hosting, verify via direct object URLs (still public HTTP 200)                                                                                                |
+| DNS hosting location                                 | `hcloud DNS ListPublicZones` decides: hosted in Huawei Cloud → auto-create CNAME record set; hosted elsewhere → output the CNAME value for manual setup at the user's DNS provider                                                                                                                                                                 |
+| EIP bills when idle; stopped ECS still bills         | Include in cost estimate; destroy unattached EIPs                                                                                                                                                                                                                                                                                                  |
+| ECS delete defaults leak resources                   | `--delete_publicip` and `--delete_volume` are false by default - set `true` when tearing down                                                                                                                                                                                                                                                      |
+| EIP binding type is non-obvious                      | `--publicip.associate_instance_type=PORT` (not INSTANCE)                                                                                                                                                                                                                                                                                           |
+| State is session-only                                | Temp-dir file, dies with the session. Never promise cross-session deploy management                                                                                                                                                                                                                                                                |
+| State file must be UTF-8 WITHOUT BOM                 | PowerShell `Set-Content -Encoding utf8` adds a BOM that breaks JSON parsers - write state with Node or another BOM-less writer                                                                                                                                                                                                                     |
+| HTTPS needs a certificate                            | CDN serves plain HTTP by default; SSL cert (upload or SCM) required for HTTPS                                                                                                                                                                                                                                                                      |
+
+## MCP Tools
+
+- `huaweicloud_plan_cli_command` → classify and plan each write command
+- `huaweicloud_run_approved_command` → execute after explicit approval (approvedCommand must match the planned command exactly - use the `command` field verbatim, never retype it)
+- `huaweicloud_run_readonly_command` → discovery (flavors, images, zones, prices)
+- `huaweicloud_list_regions` / `huaweicloud_get_regional_availability` → region intent
+- `huaweicloud_hook_check_deploy_plan` → risk-check the plan before approval
+- Balance and pricing: `huawei-billing` skill. Balance operation (BSS is pinned to cn-north-1 in KooCLI): `hcloud BSS ShowCustomerAccountBalances --cli-region=cn-north-1 --cli-domain-id=<domain_id>`. Global services (BSS/IAM) require `--cli-domain-id` per call or in the profile - if unknown, extract it from any resource response's `tenant_id` field (e.g. a VPC create response), or from the profile's domainId once configured
+
+## Cross-Skill References
+
+- Per-resource commands: `huawei-vpc` (VPC / subnet / security group / EIP), `huawei-ecs`, `huawei-rds`, `huawei-gaussdb`, `huawei-dds-dcs`, `huawei-cce`, `huawei-obs`, `huawei-functiongraph`, `huawei-apig`, `huawei-smn-dms`, `huawei-cbr`, `huawei-cloud-eye`, `huawei-cts`, `huawei-dew`, `huawei-modelarts`, `huawei-waf-aad`, `huawei-iam`
+- **CDN and DNS have no dedicated skill** - discover operations with `hcloud CDN <Operation> --help` and `hcloud DNS <Operation> --help`
+- Full purchase catalog: `references/resource-catalog.md`
+- Architecture templates by scale: `references/architectures.md`
+- State file spec: `references/state-file.md`