@lark-apaas/miaoda-cli 0.1.5 → 0.1.6

package/dist/services/app/init/index.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installDependencies = exports.writeSparkMeta = exports.readSparkMeta = exports.TEMPLATE_PACKAGE_BY_STACK = exports.SUPPORTED_STACKS = exports.renderTemplate = void 0;
+var template_1 = require("./template");
+Object.defineProperty(exports, "renderTemplate", { enumerable: true, get: function () { return template_1.renderTemplate; } });
+Object.defineProperty(exports, "SUPPORTED_STACKS", { enumerable: true, get: function () { return template_1.SUPPORTED_STACKS; } });
+Object.defineProperty(exports, "TEMPLATE_PACKAGE_BY_STACK", { enumerable: true, get: function () { return template_1.TEMPLATE_PACKAGE_BY_STACK; } });
+var spark_meta_1 = require("../../../utils/spark-meta");
+Object.defineProperty(exports, "readSparkMeta", { enumerable: true, get: function () { return spark_meta_1.readSparkMeta; } });
+Object.defineProperty(exports, "writeSparkMeta", { enumerable: true, get: function () { return spark_meta_1.writeSparkMeta; } });
+var install_1 = require("./install");
+Object.defineProperty(exports, "installDependencies", { enumerable: true, get: function () { return install_1.installDependencies; } });

package/dist/services/app/init/install.js

@@ -0,0 +1,101 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installDependencies = installDependencies;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const error_1 = require("../../../utils/error");
+const logger_1 = require("../../../utils/logger");
+const DEP_CACHE_ENV = 'MIAODA_DEP_CACHE_DIR';
+/**
+ * 依赖安装。
+ *
+ * 优先级：
+ *   1. skip=true → 直接返回 source=skipped
+ *   2. MIAODA_DEP_CACHE_DIR 设了 + 目标目录有 package.json：
+ *        - 算 md5(package.json)（与 CI 生产端 dep-cache pipeline 一致）
+ *        - 若 ${cache}/${hash}.zip 存在 → unzip 到目标目录
+ *           - 校验 node_modules/ 非空：通过则 source=cache，否则 fallback npm install
+ *        - zip 不存在 → fallback npm install，但 hash 仍记录
+ *   3. `npm install --no-audit --no-fund`
+ *
+ * 不做 cache 回写（read-only）。
+ */
+function installDependencies(opts) {
+    if (opts.skip) {
+        (0, logger_1.log)('init', 'Skipping dependency install (--skip-install)');
+        return { installed: false, source: 'skipped' };
+    }
+    const childStdio = stdioFor(opts.quietStdout);
+    const cacheDir = process.env[DEP_CACHE_ENV];
+    const pkgJsonPath = node_path_1.default.join(opts.targetDir, 'package.json');
+    const hasPkg = node_fs_1.default.existsSync(pkgJsonPath);
+    if (cacheDir && hasPkg) {
+        const hash = md5File(pkgJsonPath);
+        const cacheZip = node_path_1.default.join(cacheDir, `${hash}.zip`);
+        if (node_fs_1.default.existsSync(cacheZip)) {
+            (0, logger_1.log)('init', `Cache hit: ${cacheZip}`);
+            extractZip(cacheZip, opts.targetDir, childStdio);
+            if (nodeModulesUsable(opts.targetDir)) {
+                return { installed: true, source: 'cache', hash, cacheZip };
+            }
+            (0, logger_1.log)('init', 'Cache zip extracted but node_modules/ missing or empty; falling back to npm install');
+            runNpmInstall(opts.targetDir, childStdio);
+            return { installed: true, source: 'npm', hash };
+        }
+        (0, logger_1.log)('init', `Cache miss for ${hash}.zip, falling back to npm install`);
+        runNpmInstall(opts.targetDir, childStdio);
+        return { installed: true, source: 'npm', hash };
+    }
+    if (cacheDir && !hasPkg) {
+        (0, logger_1.log)('init', `${DEP_CACHE_ENV} set but no package.json in target; running npm install`);
+    }
+    runNpmInstall(opts.targetDir, childStdio);
+    return { installed: true, source: 'npm' };
+}
+function nodeModulesUsable(targetDir) {
+    const nm = node_path_1.default.join(targetDir, 'node_modules');
+    if (!node_fs_1.default.existsSync(nm))
+        return false;
+    try {
+        return node_fs_1.default.readdirSync(nm).length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+function stdioFor(quietStdout) {
+    // quietStdout=true：子进程 stdout 重定向到 fd 2（父进程 stderr），
+    // 保留 stderr 直出 → 终端仍能看到 npm install 进度，但父进程 stdout 干净，
+    // 后续 emit(JSON) 不会被污染。
+    return quietStdout ? ['ignore', 2, 'inherit'] : ['ignore', 'inherit', 'inherit'];
+}
+function md5File(filePath) {
+    const buf = node_fs_1.default.readFileSync(filePath);
+    return node_crypto_1.default.createHash('md5').update(buf).digest('hex');
+}
+function extractZip(zipPath, targetDir, stdio) {
+    try {
+        (0, node_child_process_1.execFileSync)('unzip', ['-q', '-o', zipPath, '-d', targetDir], { stdio });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new error_1.AppError('DEP_CACHE_EXTRACT_FAILED', `解压依赖缓存失败 (${zipPath}): ${msg}`, {
+            next_actions: [`确认 ${zipPath} 是合法 zip`, `或 unset ${DEP_CACHE_ENV} 走 npm install`],
+        });
+    }
+}
+function runNpmInstall(targetDir, stdio) {
+    (0, logger_1.log)('init', `npm install in ${targetDir}...`);
+    try {
+        (0, node_child_process_1.execFileSync)('npm', ['install', '--no-audit', '--no-fund'], { cwd: targetDir, stdio });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new error_1.AppError('NPM_INSTALL_FAILED', `npm install 失败: ${msg}`);
+    }
+}

package/dist/services/app/init/template.js

@@ -0,0 +1,87 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SUPPORTED_STACKS = exports.TEMPLATE_PACKAGE_BY_STACK = void 0;
+exports.renderTemplate = renderTemplate;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const npm_pack_1 = require("../../../utils/npm-pack");
+const error_1 = require("../../../utils/error");
+const logger_1 = require("../../../utils/logger");
+/** 短名 → 包名映射。新增 stack 时改这里。archType 由 template 包自报，CLI 不维护。 */
+exports.TEMPLATE_PACKAGE_BY_STACK = {
+    'vite-react': '@lark-apaas/coding-template-vite-react',
+    html: '@lark-apaas/coding-template-html',
+};
+exports.SUPPORTED_STACKS = Object.keys(exports.TEMPLATE_PACKAGE_BY_STACK);
+// template/ 内以下划线开头的占位文件名在渲染时改名（npm publish 会把 .gitignore / .npmrc 吞掉，
+// 模板里用 _gitignore / _npmrc 提交，渲染时再改回）。
+const RENAME_FILES = {
+    _gitignore: '.gitignore',
+    '_env.local': '.env.local',
+    _npmrc: '.npmrc',
+};
+function renderTemplate(opts) {
+    const packageName = exports.TEMPLATE_PACKAGE_BY_STACK[opts.stack];
+    if (!packageName) {
+        throw new error_1.AppError('ARGS_INVALID', `不支持的 template: ${opts.stack}`, {
+            next_actions: [`可用 stack：${exports.SUPPORTED_STACKS.join(', ')}`],
+        });
+    }
+    (0, logger_1.log)('init', `Fetching ${packageName}@${opts.version ?? 'latest'}...`);
+    const fetched = (0, npm_pack_1.fetchNpmPackage)({ packageName, version: opts.version });
+    try {
+        const templateDir = node_path_1.default.join(fetched.extractDir, 'template');
+        if (!node_fs_1.default.existsSync(templateDir)) {
+            throw new error_1.AppError('TEMPLATE_INVALID', `包 ${packageName}@${fetched.version} 缺少 template/ 目录`);
+        }
+        const pkgJsonPath = node_path_1.default.join(fetched.extractDir, 'package.json');
+        let archType;
+        if (node_fs_1.default.existsSync(pkgJsonPath)) {
+            const pkgJson = JSON.parse(node_fs_1.default.readFileSync(pkgJsonPath, 'utf-8'));
+            archType = pkgJson.miaodaTemplate?.archType;
+        }
+        // 用显式 null/undefined/'' 判，避免把合法值 0 / false 当成"缺失"误抛
+        if (archType === undefined || archType === null || archType === '') {
+            throw new error_1.AppError('TEMPLATE_INVALID', `包 ${packageName}@${fetched.version} 缺少 package.json.miaodaTemplate.archType`);
+        }
+        (0, logger_1.log)('init', `Rendering template to ${opts.targetDir}...`);
+        copyDir(templateDir, opts.targetDir);
+        for (const [from, to] of Object.entries(RENAME_FILES)) {
+            const fromPath = node_path_1.default.join(opts.targetDir, from);
+            const toPath = node_path_1.default.join(opts.targetDir, to);
+            if (node_fs_1.default.existsSync(fromPath))
+                node_fs_1.default.renameSync(fromPath, toPath);
+        }
+        // 仅替换展示性文件；package.json 写固定 name，保证 md5(package.json) 跨渲染稳定，
+        // 可被 install 阶段直接当 MIAODA_DEP_CACHE_DIR 的 cache key。
+        for (const rel of ['index.html', 'README.md']) {
+            const p = node_path_1.default.join(opts.targetDir, rel);
+            if (node_fs_1.default.existsSync(p))
+                replaceInFile(p, '{{projectName}}', opts.projectName);
+        }
+        return { version: fetched.version, packageName, archType };
+    }
+    finally {
+        fetched.cleanup();
+    }
+}
+function copyDir(src, dest) {
+    node_fs_1.default.mkdirSync(dest, { recursive: true });
+    for (const entry of node_fs_1.default.readdirSync(src, { withFileTypes: true })) {
+        const srcPath = node_path_1.default.join(src, entry.name);
+        const destPath = node_path_1.default.join(dest, entry.name);
+        if (entry.isDirectory()) {
+            copyDir(srcPath, destPath);
+        }
+        else {
+            node_fs_1.default.copyFileSync(srcPath, destPath);
+        }
+    }
+}
+function replaceInFile(filePath, search, replace) {
+    const content = node_fs_1.default.readFileSync(filePath, 'utf-8');
+    node_fs_1.default.writeFileSync(filePath, content.replaceAll(search, replace), 'utf-8');
+}

package/dist/services/deploy/modern/atoms/build.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runBuild = runBuild;
+const node_child_process_1 = require("node:child_process");
+const error_1 = require("../../../../utils/error");
+const logger_1 = require("../../../../utils/logger");
+const protocol_1 = require("../protocol");
+/**
+ * 给 RESOURCE_CDN_PREFIX 补 https:// 协议头：
+ *   - 已带 http:// 或 https:// → 原样返回
+ *   - 以 / 开头（绝对路径）→ 原样返回
+ *   - 不含 dot（看起来不像域名，比如纯路径 app_xxx/2）→ 原样返回
+ *   - 其它（典型：lf-xxx.bytetos.com/...）→ 前缀 https://
+ *
+ * template 的 build script 直接拿来当 vite base / asset URL 用，必须是合法 URL。
+ * STATIC_CDN_PREFIX 由 runtime 同域提供（相对路径），不走这里。
+ */
+function ensureHttpsScheme(v) {
+    if (/^https?:\/\//i.test(v))
+        return v;
+    if (v.startsWith('/'))
+        return v;
+    if (!v.includes('.'))
+        return v;
+    return `https://${v}`;
+}
+/**
+ * 跑 `npm run build`，把 preRelease 下发的动态配置注入 env：
+ *   MIAODA_APP_ID / MIAODA_VERSION / MIAODA_STACK
+ *   MIAODA_RESOURCE_CDN_PREFIX / MIAODA_STATIC_CDN_PREFIX
+ *
+ * MIAODA_STATIC_CDN_PREFIX 取自 output_static_paas_storage_credential.downloadURLPrefix，
+ * 是 runtime 同域相对路径（例如 /app/<appId>/runtime/api/v1/storage/object/<bucket>/），
+ * 不补 https scheme，原样注入。顶层 static_cdn_prefix 不再下发。
+ *
+ * build 失败抛 AppError（execSync 自身会 throw，捕获后包一层加错误码）。
+ */
+function runBuild(opts) {
+    const staticCred = (0, protocol_1.parsePaasStorageCredential)((0, protocol_1.requireDataKey)(opts.data, protocol_1.DataKey.OUTPUT_STATIC_PAAS_STORAGE_CREDENTIAL), protocol_1.DataKey.OUTPUT_STATIC_PAAS_STORAGE_CREDENTIAL);
+    const buildEnv = {
+        ...process.env,
+        MIAODA_APP_ID: opts.appId,
+        MIAODA_VERSION: opts.version,
+        MIAODA_STACK: opts.templateKey,
+        MIAODA_RESOURCE_CDN_PREFIX: ensureHttpsScheme((0, protocol_1.requireDataKey)(opts.data, protocol_1.DataKey.RESOURCE_CDN_PREFIX)),
+        MIAODA_STATIC_CDN_PREFIX: staticCred.downloadURLPrefix,
+    };
+    (0, logger_1.log)('deploy', 'Building...');
+    try {
+        (0, node_child_process_1.execSync)('npm run build', {
+            cwd: opts.projectDir,
+            stdio: 'inherit',
+            env: buildEnv,
+        });
+    }
+    catch (err) {
+        throw new error_1.AppError('DEPLOY_BUILD_FAILED', `npm run build failed: ${err.message}`);
+    }
+}

package/dist/services/deploy/modern/atoms/context.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prepareDeployContext = prepareDeployContext;
+const error_1 = require("../../../../utils/error");
+const spark_meta_1 = require("../../../../utils/spark-meta");
+const check_1 = require("../check");
+const template_key_map_1 = require("../template-key-map");
+/**
+ * 准备 deploy 上下文：跑前置检查、读 .spark/meta.json 拿 stack，
+ * 并把 stack 短名映射成后端 templateKey。appId 由调用方从 env 解析后传入。
+ *
+ * 任何前置失败统一抛 AppError。返回值是后续 atom 唯一信任的入参源。
+ */
+function prepareDeployContext(projectDir, appId) {
+    (0, check_1.runDeployChecks)(projectDir);
+    const meta = (0, spark_meta_1.readSparkMeta)(projectDir);
+    if (meta.stack === undefined || meta.stack === '') {
+        throw new error_1.AppError('DEPLOY_META_INCOMPLETE', '.spark/meta.json missing stack — run `miaoda app init` first');
+    }
+    return {
+        projectDir,
+        appId,
+        stack: meta.stack,
+        templateKey: (0, template_key_map_1.resolveTemplateKey)(meta.stack),
+        meta,
+    };
+}

package/dist/services/deploy/modern/atoms/index.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.savePluginInstances = exports.LocalReleaseStatus = exports.finalizeLocalRelease = exports.createLocalRelease = exports.uploadArtifacts = exports.runBuild = exports.preRelease = exports.prepareDeployContext = void 0;
+var context_1 = require("./context");
+Object.defineProperty(exports, "prepareDeployContext", { enumerable: true, get: function () { return context_1.prepareDeployContext; } });
+var pre_release_1 = require("./pre-release");
+Object.defineProperty(exports, "preRelease", { enumerable: true, get: function () { return pre_release_1.preRelease; } });
+var build_1 = require("./build");
+Object.defineProperty(exports, "runBuild", { enumerable: true, get: function () { return build_1.runBuild; } });
+var upload_1 = require("./upload");
+Object.defineProperty(exports, "uploadArtifacts", { enumerable: true, get: function () { return upload_1.uploadArtifacts; } });
+var local_release_1 = require("./local-release");
+Object.defineProperty(exports, "createLocalRelease", { enumerable: true, get: function () { return local_release_1.createLocalRelease; } });
+Object.defineProperty(exports, "finalizeLocalRelease", { enumerable: true, get: function () { return local_release_1.finalizeLocalRelease; } });
+Object.defineProperty(exports, "LocalReleaseStatus", { enumerable: true, get: function () { return local_release_1.LocalReleaseStatus; } });
+var save_plugin_instances_1 = require("./save-plugin-instances");
+Object.defineProperty(exports, "savePluginInstances", { enumerable: true, get: function () { return save_plugin_instances_1.savePluginInstances; } });

package/dist/services/deploy/modern/atoms/local-release.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalReleaseStatus = void 0;
+exports.createLocalRelease = createLocalRelease;
+exports.finalizeLocalRelease = finalizeLocalRelease;
+const index_1 = require("../../../../api/deploy/index");
+Object.defineProperty(exports, "LocalReleaseStatus", { enumerable: true, get: function () { return index_1.LocalReleaseStatus; } });
+const logger_1 = require("../../../../utils/logger");
+/**
+ * 创建本地发布单（加锁；不挂 pipeline）。
+ * 返回的 releaseId 必须由 finalizeLocalRelease 翻为终态，否则发布单一直挂着。
+ */
+async function createLocalRelease(appId, version) {
+    return (0, index_1.createLocalRelease)({ appID: appId, version });
+}
+/**
+ * 把本地发布单翻为终态。Finished / Failed 由 pipeline 视上下游结果决定。
+ * 失败不抛（避免覆盖上游真错误），但记一行 stderr 让排查可定位。
+ */
+async function finalizeLocalRelease(appId, releaseId, status) {
+    try {
+        await (0, index_1.updateLocalRelease)({ appID: appId, releaseID: releaseId, status });
+    }
+    catch (err) {
+        (0, logger_1.log)('deploy', `finalize release(${releaseId}, status=${String(status)}) failed: ${err.message}`);
+    }
+}

package/dist/services/deploy/modern/atoms/pre-release.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.preRelease = preRelease;
+const index_1 = require("../../../../api/deploy/index");
+/**
+ * 调用 preRelease，拿到 pre_release_id、version 和动态配置 data。
+ *
+ * 失败由 api 层抛 HttpError / AppError 透传上去；atom 本身不再做语义包装，
+ * 让 pipeline 层决定怎么向 handler 报告。
+ */
+async function preRelease(appId, templateKey) {
+    return (0, index_1.preRelease)({ appID: appId, templateKey });
+}

package/dist/services/deploy/modern/atoms/save-plugin-instances.js

@@ -0,0 +1,72 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.savePluginInstances = savePluginInstances;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const index_1 = require("../../../../api/deploy/index");
+const logger_1 = require("../../../../utils/logger");
+const constants_1 = require("../constants");
+function isValidCapability(o) {
+    if (typeof o !== 'object' || o === null)
+        return false;
+    const id = o.id;
+    return typeof id === 'string' && id.length > 0;
+}
+/**
+ * 扫描 dist/output_capabilities/*.json，过滤出合法 capability，批量上报到 studio_server。
+ *
+ * 合法判定：能 JSON.parse + 顶层 id 是非空字符串。其它字段后端校验。
+ * 目录不存在 / 没有合法 capability → 直接返回 0，pipeline 当作 no-op。
+ * batchSave 调用失败 → 透传抛 AppError，pipeline 兜底 finalizeLocalRelease(Failed)。
+ */
+async function savePluginInstances(opts) {
+    const dir = node_path_1.default.join(opts.projectDir, constants_1.DIST_DIR, constants_1.OUTPUT_CAPABILITIES_DIR);
+    if (!node_fs_1.default.existsSync(dir)) {
+        (0, logger_1.debug)(`save-plugin-instances: ${dir} not present, skipping`);
+        return { saved: 0, skipped: 0 };
+    }
+    const files = node_fs_1.default.readdirSync(dir).filter((f) => f.endsWith('.json'));
+    const instances = [];
+    let skipped = 0;
+    for (const f of files) {
+        const full = node_path_1.default.join(dir, f);
+        let raw;
+        try {
+            raw = node_fs_1.default.readFileSync(full, 'utf-8');
+        }
+        catch (err) {
+            (0, logger_1.debug)(`save-plugin-instances: read ${f} failed: ${err.message}`);
+            skipped++;
+            continue;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            (0, logger_1.debug)(`save-plugin-instances: ${f} is not valid JSON, skipping`);
+            skipped++;
+            continue;
+        }
+        if (!isValidCapability(parsed)) {
+            (0, logger_1.debug)(`save-plugin-instances: ${f} missing 'id' string, skipping`);
+            skipped++;
+            continue;
+        }
+        instances.push({ id: parsed.id, content: JSON.stringify(parsed) });
+    }
+    if (instances.length === 0) {
+        (0, logger_1.log)('deploy', `No capability to register (${String(files.length)} files scanned, all skipped)`);
+        return { saved: 0, skipped };
+    }
+    (0, logger_1.log)('deploy', `Registering ${String(instances.length)} capability instance(s)...`);
+    await (0, index_1.batchSavePluginInstances)({
+        appID: opts.appId,
+        appVersion: opts.version,
+        pluginInstances: instances,
+    });
+    return { saved: instances.length, skipped };
+}

package/dist/services/deploy/modern/atoms/upload.js

@@ -0,0 +1,246 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.uploadArtifacts = uploadArtifacts;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_child_process_1 = require("node:child_process");
+const index_1 = require("../../../../api/deploy/index");
+const error_1 = require("../../../../utils/error");
+const logger_1 = require("../../../../utils/logger");
+const constants_1 = require("../constants");
+const protocol_1 = require("../protocol");
+const UPLOAD_PLAN = [
+    {
+        kind: 'tos',
+        dir: constants_1.OUTPUT_DIR,
+        dataKey: protocol_1.DataKey.OUTPUT_TOS_UPLOAD_CREDENTIAL,
+        required: true,
+    },
+    {
+        kind: 'tos',
+        dir: constants_1.OUTPUT_RESOURCE_DIR,
+        dataKey: protocol_1.DataKey.OUTPUT_RESOURCE_TOS_UPLOAD_CREDENTIAL,
+        required: false,
+    },
+    {
+        kind: 'paas_storage',
+        dir: constants_1.OUTPUT_STATIC_DIR,
+        dataKey: protocol_1.DataKey.OUTPUT_STATIC_PAAS_STORAGE_CREDENTIAL,
+    },
+];
+function resolveTosutilPath() {
+    try {
+        const resolved = (0, node_child_process_1.execFileSync)('which', ['tosutil'], { encoding: 'utf-8' }).trim();
+        if (resolved)
+            return resolved;
+    }
+    catch {
+        /* fallthrough */
+    }
+    throw new error_1.AppError('DEPLOY_TOSUTIL_MISSING', 'tosutil is not installed or not in PATH. modern deploy requires sandbox preinstalled tosutil.');
+}
+function tosutilUploadFromTos(cred) {
+    return {
+        accessKeyID: cred.accessKeyID,
+        secretAccessKey: cred.secretAccessKey,
+        sessionToken: cred.sessionToken,
+        endpoint: cred.endpoint,
+        region: cred.region,
+        bucket: cred.bucket,
+        prefix: cred.prefix,
+    };
+}
+function tosutilUploadFromPaasStorage(cred, dataKey) {
+    const { bucket, prefix } = (0, protocol_1.parseTosUploadPrefix)(cred.uploadPrefix, dataKey);
+    return {
+        accessKeyID: cred.accessKeyID,
+        secretAccessKey: cred.secretAccessKey,
+        sessionToken: cred.sessionToken,
+        endpoint: cred.endpoint,
+        region: cred.region,
+        bucket,
+        prefix,
+    };
+}
+/**
+ * 写一个 tosutil 临时 config 文件，注入 STS 凭证 + endpoint + region。
+ * 返回 config 路径，调用方负责清理。
+ */
+function writeTosutilConfig(tosutilPath, cred, label) {
+    const confPath = node_path_1.default.join(node_os_1.default.tmpdir(), `.tosutilconfig-miaoda-${label}-${String(process.pid)}-${String(Date.now())}`);
+    node_fs_1.default.writeFileSync(confPath, '');
+    (0, node_child_process_1.execFileSync)(tosutilPath, [
+        'config',
+        '-conf',
+        confPath,
+        '-e',
+        cred.endpoint,
+        '-i',
+        cred.accessKeyID,
+        '-k',
+        cred.secretAccessKey,
+        '-t',
+        cred.sessionToken,
+        '-re',
+        cred.region,
+    ], { stdio: 'pipe' });
+    return confPath;
+}
+/** 把 tosutil 进程的输出按行回放到 stderr，便于线上排查（沙箱里无法 attach 进程）。 */
+function streamTosutilOutput(output) {
+    if (!output)
+        return;
+    for (const line of output.split('\n')) {
+        if (line.length === 0)
+            continue;
+        process.stderr.write(`[tosutil] ${line}\n`);
+    }
+}
+function normalizeTosDest(bucket, prefix) {
+    const bucketPart = bucket.startsWith('tos://') ? bucket : `tos://${bucket}`;
+    const normalized = prefix.replace(/^\/+/, '');
+    return `${bucketPart.replace(/\/+$/, '')}/${normalized}`;
+}
+/**
+ * 用 tosutil 把目录批量上传到 tos://bucket/prefix（STS 凭证从 config 文件读取）。
+ */
+function uploadDirWithCredential(tosutilPath, sourceDir, cred, label) {
+    const entries = node_fs_1.default.readdirSync(sourceDir);
+    if (entries.length === 0) {
+        (0, logger_1.debug)(`upload: skip empty dir ${sourceDir}`);
+        return;
+    }
+    const dest = normalizeTosDest(cred.bucket, cred.prefix);
+    (0, logger_1.debug)(`upload: ${sourceDir} -> ${dest} (${String(entries.length)} entries)`);
+    const confPath = writeTosutilConfig(tosutilPath, cred, label);
+    let output;
+    try {
+        output = (0, node_child_process_1.execFileSync)(tosutilPath, [
+            'cp',
+            sourceDir,
+            dest,
+            '-r',
+            '-flat',
+            '-j',
+            '5',
+            '-p',
+            '3',
+            '-ps',
+            '10485760',
+            '-f',
+            '-conf',
+            confPath,
+        ], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+        streamTosutilOutput(output);
+    }
+    catch (err) {
+        const e = err;
+        const stderr = (e.stderr ?? '').trim();
+        const stdout = (e.stdout ?? '').trim();
+        streamTosutilOutput(stdout);
+        streamTosutilOutput(stderr);
+        throw new error_1.AppError('DEPLOY_UPLOAD_FAILED', `tosutil cp exited with status ${String(e.status ?? -1)} for ${sourceDir}\n` +
+            `  stderr: ${stderr || '(empty)'}\n` +
+            `  stdout: ${stdout.slice(0, 500) || '(empty)'}`);
+    }
+    finally {
+        try {
+            node_fs_1.default.unlinkSync(confPath);
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    const succeedMatch = /Succeed count is:\s*(\d+)/.exec(output);
+    const failedMatch = /Failed count is:\s*(\d+)/.exec(output);
+    const succeedCount = succeedMatch ? Number.parseInt(succeedMatch[1], 10) : 0;
+    const failedCount = failedMatch ? Number.parseInt(failedMatch[1], 10) : 0;
+    if (failedCount > 0) {
+        throw new error_1.AppError('DEPLOY_UPLOAD_FAILED', `Upload failed: ${String(failedCount)} files failed, ${String(succeedCount)} succeeded. source=${sourceDir}`);
+    }
+    if (succeedCount === 0) {
+        throw new error_1.AppError('DEPLOY_UPLOAD_EMPTY', `Upload failed: 0 files uploaded. source=${sourceDir}. Check tosutil credentials and bucket permissions.`);
+    }
+}
+function uploadTosTarget(tosutilPath, target, localPath, data) {
+    const credRaw = target.required
+        ? (0, protocol_1.requireDataKey)(data, target.dataKey)
+        : (0, protocol_1.optionalDataKey)(data, target.dataKey);
+    if (credRaw === undefined) {
+        (0, logger_1.debug)(`upload: ${target.dir} exists but no credential configured, skipping`);
+        return false;
+    }
+    const cred = (0, protocol_1.parseTosUploadCredential)(credRaw, target.dataKey);
+    (0, logger_1.log)('deploy', `Uploading ${target.dir}...`);
+    uploadDirWithCredential(tosutilPath, localPath, tosutilUploadFromTos(cred), target.dir);
+    return true;
+}
+function uploadPaasStorageTarget(tosutilPath, target, localPath, data) {
+    // 空目录：直接跳过；callbackStatic 也不能调，否则会让后端把"未发生的上传"
+    // 误以为已完成。凭证本身 build 阶段已经消费过 downloadURLPrefix，这里不重复要求。
+    if (node_fs_1.default.readdirSync(localPath).length === 0) {
+        (0, logger_1.debug)(`upload: ${target.dir} is empty, skipping`);
+        return undefined;
+    }
+    const cred = (0, protocol_1.parsePaasStorageCredential)((0, protocol_1.requireDataKey)(data, target.dataKey), target.dataKey);
+    (0, logger_1.log)('deploy', `Uploading ${target.dir}...`);
+    uploadDirWithCredential(tosutilPath, localPath, tosutilUploadFromPaasStorage(cred, target.dataKey), target.dir);
+    return cred;
+}
+/**
+ * 上传三类产物。output / output_resource 走 TOS STS 凭证；output_static 走 PaaS Storage
+ * 凭证（uploadPrefix 解出 tosutil cp 目的，上传完后再调 callbackStatic 把 uploadID
+ * 提交给后端核销）：
+ *   - dist/output            (必传) → OUTPUT_TOS_UPLOAD_CREDENTIAL
+ *   - dist/output_resource   (可选) → OUTPUT_RESOURCE_TOS_UPLOAD_CREDENTIAL
+ *   - dist/output_static     (可选) → OUTPUT_STATIC_PAAS_STORAGE_CREDENTIAL + callbackStatic
+ *
+ * 目录不存在的可选项跳过；output 不存在或凭证缺失抛错。
+ */
+async function uploadArtifacts(opts) {
+    const tosutilPath = resolveTosutilPath();
+    const distDir = node_path_1.default.join(opts.projectDir, constants_1.DIST_DIR);
+    const outcome = { uploaded: 0 };
+    for (const target of UPLOAD_PLAN) {
+        const localPath = node_path_1.default.join(distDir, target.dir);
+        const exists = node_fs_1.default.existsSync(localPath);
+        if (target.kind === 'tos') {
+            if (!exists) {
+                if (target.required) {
+                    throw new error_1.AppError('DEPLOY_NO_BUILD_OUTPUT', `Required directory missing: ${constants_1.DIST_DIR}/${target.dir}`);
+                }
+                (0, logger_1.debug)(`upload: dir not present, skipping ${target.dir}`);
+                continue;
+            }
+            if (uploadTosTarget(tosutilPath, target, localPath, opts.data)) {
+                outcome.uploaded++;
+            }
+            continue;
+        }
+        // PaaS Storage 分支
+        if (!exists) {
+            (0, logger_1.debug)(`upload: dir not present, skipping ${target.dir}`);
+            continue;
+        }
+        const cred = uploadPaasStorageTarget(tosutilPath, target, localPath, opts.data);
+        if (cred) {
+            outcome.staticUploaded = cred;
+            outcome.uploaded++;
+        }
+    }
+    if (outcome.uploaded === 0) {
+        throw new error_1.AppError('DEPLOY_UPLOAD_EMPTY', 'No artifacts uploaded — check build output.');
+    }
+    if (outcome.staticUploaded) {
+        (0, logger_1.log)('deploy', 'Callbacking static upload...');
+        await (0, index_1.callbackStatic)({
+            appID: opts.appId,
+            bucketID: outcome.staticUploaded.bucketID,
+            uploadID: outcome.staticUploaded.uploadID,
+        });
+    }
+}