Authorization / credential gate
Check AL_DEPLOY_AUTHORIZED, AL_DEPLOY_TOKEN_REF (reference name only), local secret resolution, DNS authorization and platform credentials; any gap forces dry-run.
Inputs and parameters
env— Env names / references (JSON, no values)opts— Authorization state (JSON, optional)
Real example
env={}, opts={}
→ authorized=false;mode="dry-run";message="未部署/待授权";missing 含 DNS 授权、平台账号凭据
Limits and failure handling
Does not read a real secret store; does not verify account existence.
FAQ
Can I paste a real token here?
Forbidden. Suspected credential values are rejected with CREDENTIAL_VALUE_FORBIDDEN.