@ranger1/dx 0.1.79 → 0.1.81

package/lib/backend-artifact-deploy/config.js

@@ -0,0 +1,138 @@
+import { isAbsolute } from 'node:path'
+import { resolveWithinBase } from './path-utils.js'
+
+function requireString(value, fieldPath) {
+  if (typeof value !== 'string' || value.trim() === '') {
+    throw new Error(`缺少必填配置: ${fieldPath}`)
+  }
+  return value.trim()
+}
+
+function requirePositiveInteger(value, fieldPath) {
+  const parsed = Number(value)
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new Error(`缺少必填配置: ${fieldPath}`)
+  }
+  return parsed
+}
+
+function resolveBuildCommand(buildConfig, environment) {
+  if (buildConfig?.commands && typeof buildConfig.commands === 'object') {
+    const selected = buildConfig.commands[environment]
+    if (!selected || typeof selected !== 'string' || selected.trim() === '') {
+      throw new Error(`缺少必填配置: build.commands.${environment}`)
+    }
+    return selected.trim()
+  }
+
+  return requireString(buildConfig?.command, 'build.command')
+}
+
+function resolveProjectPath(projectRoot, relativePath, fieldPath) {
+  return resolveWithinBase(projectRoot, requireString(relativePath, fieldPath), fieldPath)
+}
+
+function requireRemoteBaseDir(value, fieldPath) {
+  const baseDir = requireString(value, fieldPath)
+  if (!isAbsolute(baseDir)) {
+    throw new Error(`${fieldPath} 必须是绝对路径: ${baseDir}`)
+  }
+  if (!/^\/[A-Za-z0-9._/-]*$/.test(baseDir)) {
+    throw new Error(`${fieldPath} 包含非法字符: ${baseDir}`)
+  }
+  return baseDir.replace(/\/+$/, '') || '/'
+}
+
+export function resolveBackendDeployConfig({ cli, targetConfig, environment, flags = {} }) {
+  const deployConfig = targetConfig?.backendDeploy
+  if (!deployConfig || typeof deployConfig !== 'object') {
+    throw new Error('缺少必填配置: backendDeploy')
+  }
+
+  const buildConfig = deployConfig.build || {}
+  const runtimeConfig = deployConfig.runtime || {}
+  const artifactConfig = deployConfig.artifact || {}
+  const remoteConfig = deployConfig.remote || null
+  const startupConfig = deployConfig.startup || {}
+  const runConfig = deployConfig.deploy || {}
+  const buildOnly = Boolean(flags.buildOnly)
+  const startupMode = String(startupConfig.mode || 'pm2').trim()
+  const prismaGenerate = runConfig.prismaGenerate !== false
+  const prismaMigrateDeploy = runConfig.prismaMigrateDeploy !== false
+
+  const normalized = {
+    projectRoot: cli.projectRoot,
+    environment,
+    build: {
+      app: typeof buildConfig.app === 'string' && buildConfig.app.trim() ? buildConfig.app.trim() : null,
+      command: resolveBuildCommand(buildConfig, environment),
+      distDir: resolveProjectPath(cli.projectRoot, buildConfig.distDir, 'build.distDir'),
+      versionFile: resolveProjectPath(cli.projectRoot, buildConfig.versionFile, 'build.versionFile'),
+    },
+    runtime: {
+      appPackage: resolveProjectPath(cli.projectRoot, runtimeConfig.appPackage, 'runtime.appPackage'),
+      rootPackage: resolveProjectPath(cli.projectRoot, runtimeConfig.rootPackage, 'runtime.rootPackage'),
+      lockfile: resolveProjectPath(cli.projectRoot, runtimeConfig.lockfile, 'runtime.lockfile'),
+      prismaSchemaDir: runtimeConfig.prismaSchemaDir
+        ? resolveProjectPath(cli.projectRoot, runtimeConfig.prismaSchemaDir, 'runtime.prismaSchemaDir')
+        : null,
+      prismaConfig: runtimeConfig.prismaConfig
+        ? resolveProjectPath(cli.projectRoot, runtimeConfig.prismaConfig, 'runtime.prismaConfig')
+        : null,
+      ecosystemConfig: runtimeConfig.ecosystemConfig
+        ? resolveProjectPath(cli.projectRoot, runtimeConfig.ecosystemConfig, 'runtime.ecosystemConfig')
+        : null,
+    },
+    artifact: {
+      outputDir: resolveProjectPath(cli.projectRoot, artifactConfig.outputDir, 'artifact.outputDir'),
+      bundleName: requireString(artifactConfig.bundleName, 'artifact.bundleName'),
+    },
+    remote: buildOnly
+      ? null
+      : {
+          host: requireString(remoteConfig?.host, 'remote.host'),
+          port: remoteConfig?.port == null ? 22 : requirePositiveInteger(remoteConfig.port, 'remote.port'),
+          user: requireString(remoteConfig?.user, 'remote.user'),
+          baseDir: requireRemoteBaseDir(remoteConfig?.baseDir, 'remote.baseDir'),
+        },
+    startup: {
+      mode: startupMode,
+      serviceName:
+        typeof startupConfig.serviceName === 'string' && startupConfig.serviceName.trim()
+          ? startupConfig.serviceName.trim()
+          : null,
+      entry:
+        typeof startupConfig.entry === 'string' && startupConfig.entry.trim()
+          ? startupConfig.entry.trim()
+          : null,
+    },
+    deploy: {
+      keepReleases:
+        runConfig.keepReleases == null ? 5 : requirePositiveInteger(runConfig.keepReleases, 'deploy.keepReleases'),
+      installCommand: requireString(
+        runConfig.installCommand || 'pnpm install --prod --no-frozen-lockfile --ignore-workspace',
+        'deploy.installCommand',
+      ),
+      prismaGenerate,
+      prismaMigrateDeploy,
+      skipMigration: Boolean(flags.skipMigration),
+    },
+  }
+
+  if (!['pm2', 'direct'].includes(normalized.startup.mode)) {
+    throw new Error('缺少必填配置: startup.mode')
+  }
+  if (normalized.startup.mode === 'pm2') {
+    requireString(normalized.startup.serviceName, 'startup.serviceName')
+    requireString(normalized.runtime.ecosystemConfig, 'runtime.ecosystemConfig')
+  } else {
+    requireString(normalized.startup.entry, 'startup.entry')
+  }
+
+  if (normalized.deploy.prismaGenerate || normalized.deploy.prismaMigrateDeploy) {
+    requireString(normalized.runtime.prismaSchemaDir, 'runtime.prismaSchemaDir')
+    requireString(normalized.runtime.prismaConfig, 'runtime.prismaConfig')
+  }
+
+  return normalized
+}

package/lib/backend-artifact-deploy/path-utils.js

@@ -0,0 +1,18 @@
+import { basename, resolve, sep } from 'node:path'
+
+export function resolveWithinBase(baseDir, targetPath, label = 'path') {
+  const absoluteBase = resolve(baseDir)
+  const absoluteTarget = resolve(absoluteBase, targetPath)
+  if (absoluteTarget !== absoluteBase && !absoluteTarget.startsWith(`${absoluteBase}${sep}`)) {
+    throw new Error(`${label} 越界，已拒绝: ${absoluteTarget}`)
+  }
+  return absoluteTarget
+}
+
+export function basenameOrThrow(filePath, label = 'path') {
+  const name = basename(String(filePath || '').trim())
+  if (!name || name === '.' || name === '..') {
+    throw new Error(`无效的 ${label}: ${filePath}`)
+  }
+  return name
+}

package/lib/backend-artifact-deploy/remote-phases.js

@@ -0,0 +1,13 @@
+export function createRemotePhaseModel(payload) {
+  return [
+    { phase: 'lock', payload },
+    { phase: 'extract', payload },
+    { phase: 'env', payload },
+    { phase: 'install', payload },
+    { phase: 'prisma-generate', payload },
+    { phase: 'prisma-migrate', payload },
+    { phase: 'switch-current', payload },
+    { phase: 'startup', payload },
+    { phase: 'cleanup', payload },
+  ]
+}

package/lib/backend-artifact-deploy/remote-result.js

@@ -0,0 +1,42 @@
+function parseResultLine(line) {
+  if (!line.startsWith('DX_REMOTE_RESULT=')) return null
+  return JSON.parse(line.slice('DX_REMOTE_RESULT='.length))
+}
+
+function getLastPhase(output = '') {
+  const lines = String(output).split('\n')
+  let phase = 'cleanup'
+  for (const line of lines) {
+    if (line.startsWith('DX_REMOTE_PHASE=')) {
+      phase = line.slice('DX_REMOTE_PHASE='.length).trim() || phase
+    }
+  }
+  return phase
+}
+
+export function parseRemoteResult({ stdout = '', stderr = '', exitCode = 0 }) {
+  const allLines = `${stdout}\n${stderr}`.trim().split('\n').filter(Boolean)
+  for (let index = allLines.length - 1; index >= 0; index -= 1) {
+    const parsed = parseResultLine(allLines[index])
+    if (parsed) return parsed
+  }
+
+  if (exitCode === 0) {
+    return {
+      ok: true,
+      phase: getLastPhase(stdout),
+      message: 'ok',
+      rollbackAttempted: false,
+      rollbackSucceeded: null,
+    }
+  }
+
+  const message = [stderr, stdout].filter(Boolean).join('\n').trim() || 'remote execution failed'
+  return {
+    ok: false,
+    phase: getLastPhase(`${stdout}\n${stderr}`),
+    message,
+    rollbackAttempted: false,
+    rollbackSucceeded: null,
+  }
+}

package/lib/backend-artifact-deploy/remote-script.js

@@ -0,0 +1,337 @@
+function escapeShell(value) {
+  return `'${String(value).replace(/'/g, `'\\''`)}'`
+}
+
+export function buildRemoteDeployScript(phaseModel = []) {
+  const payload = phaseModel[0]?.payload || {}
+  const remote = payload.remote || {}
+  const runtime = payload.runtime || {}
+  const startup = payload.startup || {}
+  const deploy = payload.deploy || {}
+  const environment = String(payload.environment || 'production')
+  const baseDir = String(remote.baseDir || '.')
+  const releaseDir = `${baseDir}/releases/${payload.versionName || 'unknown'}`
+  const currentLink = `${baseDir}/current`
+  const uploadsDir = `${baseDir}/uploads`
+  const uploadedBundlePath = String(payload.uploadedBundlePath || '')
+  const envFileName = `.env.${environment}`
+  const envLocalFileName = `.env.${environment}.local`
+  const prismaSchema = runtime.prismaSchemaDir ? `./${runtime.prismaSchemaDir}` : ''
+  const prismaConfig = runtime.prismaConfig ? `./${runtime.prismaConfig}` : ''
+  const ecosystemConfig = runtime.ecosystemConfig ? `./${runtime.ecosystemConfig}` : './ecosystem.config.cjs'
+  const installCommand = String(deploy.installCommand || 'pnpm install --prod --no-frozen-lockfile --ignore-workspace')
+  const startupEntry = String(startup.entry || '')
+  const startupMode = String(startup.mode || 'pm2')
+  const serviceName = String(startup.serviceName || 'backend')
+  const keepReleases = Number(deploy.keepReleases || 5)
+  const shouldGenerate = deploy.prismaGenerate !== false
+  const shouldMigrate = deploy.prismaMigrateDeploy !== false && deploy.skipMigration !== true
+
+  return `#!/usr/bin/env bash
+set -euo pipefail
+
+APP_ROOT=${escapeShell(baseDir)}
+UPLOADS_DIR=${escapeShell(uploadsDir)}
+ARCHIVE=${escapeShell(uploadedBundlePath)}
+RELEASE_DIR=${escapeShell(releaseDir)}
+CURRENT_LINK=${escapeShell(currentLink)}
+ENV_NAME=${escapeShell(environment)}
+ENV_FILE_NAME=${escapeShell(envFileName)}
+ENV_LOCAL_FILE_NAME=${escapeShell(envLocalFileName)}
+PRISMA_SCHEMA=${escapeShell(prismaSchema)}
+PRISMA_CONFIG=${escapeShell(prismaConfig)}
+ECOSYSTEM_CONFIG=${escapeShell(ecosystemConfig)}
+INSTALL_COMMAND=${escapeShell(installCommand)}
+START_MODE=${escapeShell(startupMode)}
+SERVICE_NAME=${escapeShell(serviceName)}
+START_ENTRY=${escapeShell(startupEntry)}
+KEEP_RELEASES=${keepReleases}
+SHOULD_GENERATE=${shouldGenerate ? '1' : '0'}
+SHOULD_MIGRATE=${shouldMigrate ? '1' : '0'}
+
+LOCK_FILE="$APP_ROOT/.deploy.lock"
+LOCK_DIR="$APP_ROOT/.deploy.lock.d"
+SHARED_DIR="$APP_ROOT/shared"
+RELEASES_DIR="$APP_ROOT/releases"
+PREVIOUS_CURRENT_TARGET=""
+BUNDLE_TEMP_DIR=""
+INNER_ARCHIVE=""
+INNER_ARCHIVE_SHA256_FILE=""
+VERSION_NAME=""
+DOTENV_BIN=""
+PRISMA_BIN=""
+CURRENT_PHASE="init"
+RESULT_EMITTED=0
+ROLLBACK_ATTEMPTED=false
+ROLLBACK_SUCCEEDED=null
+MIGRATION_EXECUTED=0
+
+emit_result() {
+  local ok="$1"
+  local phase="$2"
+  local message="$3"
+  local rollback_attempted="$4"
+  local rollback_succeeded="$5"
+  if [[ "$RESULT_EMITTED" -eq 1 ]]; then
+    return
+  fi
+  RESULT_EMITTED=1
+  message="\${message//\\\\/\\\\\\\\}"
+  message="\${message//\"/\\\\\"}"
+  message="\${message//$'\\n'/\\\\n}"
+  printf 'DX_REMOTE_RESULT={"ok":%s,"phase":"%s","message":"%s","rollbackAttempted":%s,"rollbackSucceeded":%s}\\n' \\
+    "$ok" "$phase" "$message" "$rollback_attempted" "$rollback_succeeded"
+}
+
+cleanup() {
+  rm -rf "$BUNDLE_TEMP_DIR" 2>/dev/null || true
+  if [[ -n "$LOCK_DIR" ]]; then
+    rmdir "$LOCK_DIR" 2>/dev/null || true
+  fi
+}
+
+on_error() {
+  local code=$?
+  emit_result false "$CURRENT_PHASE" "phase failed (exit $code)" "$ROLLBACK_ATTEMPTED" "$ROLLBACK_SUCCEEDED"
+  exit "$code"
+}
+
+trap cleanup EXIT
+trap on_error ERR
+
+validate_path_within_base() {
+  local base="$1"
+  local target="$2"
+  case "$target" in
+    "$base"/*|"$base") ;;
+    *)
+      echo "目标路径越界: $target" >&2
+      exit 1
+      ;;
+  esac
+}
+
+validate_archive_entries() {
+  local archive="$1"
+  local entry
+  local tar_line
+  local link_target
+
+  while IFS= read -r entry; do
+    if [[ "$entry" == /* ]]; then
+      echo "包含绝对路径条目: $entry" >&2
+      exit 1
+    fi
+    if [[ "$entry" =~ (^|/)\\.\\.(/|$) || "$entry" =~ \\.\\.\\\\ ]]; then
+      echo "包含可疑路径条目: $entry" >&2
+      exit 1
+    fi
+  done < <(tar -tzf "$archive")
+
+  while IFS= read -r tar_line; do
+    if [[ "$tar_line" == *" -> "* ]]; then
+      link_target="\${tar_line##* -> }"
+      if [[ "$link_target" == /* ]]; then
+        echo "包含可疑链接目标: $link_target" >&2
+        exit 1
+      fi
+      if [[ "$link_target" =~ (^|/)\\.\\.(/|$) || "$link_target" =~ \\.\\.\\\\ ]]; then
+        echo "包含可疑链接目标: $link_target" >&2
+        exit 1
+      fi
+    fi
+  done < <(tar -tvzf "$archive")
+}
+
+find_single_bundle_file() {
+  local bundle_dir="$1"
+  local pattern="$2"
+  shopt -s nullglob
+  local matches=("$bundle_dir"/$pattern)
+  shopt -u nullglob
+  if [[ "\${#matches[@]}" -ne 1 ]]; then
+    return 1
+  fi
+  printf '%s\\n' "\${matches[0]}"
+}
+
+sha256_check() {
+  local checksum_file="$1"
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum -c "$checksum_file"
+    return
+  fi
+  local checksum expected file
+  checksum="$(awk '{print $1}' "$checksum_file")"
+  file="$(awk '{print $2}' "$checksum_file")"
+  expected="$(shasum -a 256 "$file" | awk '{print $1}')"
+  [[ "$checksum" == "$expected" ]]
+}
+
+run_with_env() {
+  local cwd="$1"
+  shift
+  (
+    cd "$cwd"
+    APP_ENV="$ENV_NAME" "$DOTENV_BIN" -o -e "$ENV_FILE_NAME" -e "$ENV_LOCAL_FILE_NAME" -- "$@"
+  )
+}
+
+attempt_pm2_restore() {
+  if [[ -z "$PREVIOUS_CURRENT_TARGET" || ! -e "$PREVIOUS_CURRENT_TARGET/$ECOSYSTEM_CONFIG" ]]; then
+    ROLLBACK_SUCCEEDED=false
+    return
+  fi
+  if (
+    cd "$PREVIOUS_CURRENT_TARGET"
+    APP_ENV="$ENV_NAME" "$DOTENV_BIN" -o -e "$ENV_FILE_NAME" -e "$ENV_LOCAL_FILE_NAME" -- \\
+      pm2 start "$ECOSYSTEM_CONFIG" --only "$SERVICE_NAME" --update-env
+    pm2 save
+  ); then
+    ROLLBACK_SUCCEEDED=true
+  else
+    ROLLBACK_SUCCEEDED=false
+  fi
+}
+
+CURRENT_PHASE="lock"
+echo "DX_REMOTE_PHASE=lock"
+mkdir -p "$RELEASES_DIR" "$SHARED_DIR" "$UPLOADS_DIR"
+validate_path_within_base "$APP_ROOT" "$ARCHIVE"
+validate_path_within_base "$APP_ROOT" "$RELEASE_DIR"
+
+PREVIOUS_CURRENT_TARGET="$(readlink "$CURRENT_LINK" 2>/dev/null || true)"
+
+if command -v flock >/dev/null 2>&1; then
+  exec 9>"$LOCK_FILE"
+  flock -n 9
+else
+  mkdir "$LOCK_DIR"
+fi
+
+CURRENT_PHASE="extract"
+echo "DX_REMOTE_PHASE=extract"
+validate_archive_entries "$ARCHIVE"
+BUNDLE_TEMP_DIR="$(mktemp -d "$APP_ROOT/.bundle-extract.XXXXXX")"
+tar -xzf "$ARCHIVE" -C "$BUNDLE_TEMP_DIR" --strip-components=1
+
+INNER_ARCHIVE="$(find_single_bundle_file "$BUNDLE_TEMP_DIR" 'backend-v*.tgz')"
+INNER_ARCHIVE_SHA256_FILE="$(find_single_bundle_file "$BUNDLE_TEMP_DIR" 'backend-v*.tgz.sha256')"
+VERSION_NAME="$(basename "$INNER_ARCHIVE" .tgz)"
+validate_path_within_base "$RELEASES_DIR" "$RELEASE_DIR"
+
+(cd "$BUNDLE_TEMP_DIR" && sha256_check "$(basename "$INNER_ARCHIVE_SHA256_FILE")")
+validate_archive_entries "$INNER_ARCHIVE"
+rm -rf "$RELEASE_DIR"
+mkdir -p "$RELEASE_DIR"
+tar -xzf "$INNER_ARCHIVE" -C "$RELEASE_DIR" --strip-components=1
+
+CURRENT_PHASE="env"
+echo "DX_REMOTE_PHASE=env"
+if [[ ! -f "$SHARED_DIR/$ENV_FILE_NAME" ]]; then
+  echo "未找到基础环境文件: $SHARED_DIR/$ENV_FILE_NAME" >&2
+  exit 1
+fi
+if [[ ! -f "$SHARED_DIR/$ENV_LOCAL_FILE_NAME" ]]; then
+  echo "未找到本地覆盖环境文件: $SHARED_DIR/$ENV_LOCAL_FILE_NAME" >&2
+  exit 1
+fi
+ln -sfn "$SHARED_DIR/$ENV_FILE_NAME" "$RELEASE_DIR/$ENV_FILE_NAME"
+ln -sfn "$SHARED_DIR/$ENV_LOCAL_FILE_NAME" "$RELEASE_DIR/$ENV_LOCAL_FILE_NAME"
+
+CURRENT_PHASE="install"
+echo "DX_REMOTE_PHASE=install"
+command -v node >/dev/null 2>&1
+command -v pnpm >/dev/null 2>&1
+if [[ "$START_MODE" == "pm2" ]]; then
+  command -v pm2 >/dev/null 2>&1
+fi
+(
+  cd "$RELEASE_DIR"
+  bash -lc "$INSTALL_COMMAND"
+)
+
+DOTENV_BIN="$RELEASE_DIR/node_modules/.bin/dotenv"
+if [[ ! -x "$DOTENV_BIN" ]]; then
+  echo "缺少可执行文件: $DOTENV_BIN" >&2
+  exit 1
+fi
+
+if [[ "$SHOULD_GENERATE" == "1" ]]; then
+  CURRENT_PHASE="prisma-generate"
+  echo "DX_REMOTE_PHASE=prisma-generate"
+  PRISMA_BIN="$RELEASE_DIR/node_modules/.bin/prisma"
+  if [[ ! -x "$PRISMA_BIN" ]]; then
+    echo "缺少可执行文件: $PRISMA_BIN" >&2
+    exit 1
+  fi
+  run_with_env "$RELEASE_DIR" "$PRISMA_BIN" generate --schema="$PRISMA_SCHEMA" --config="$PRISMA_CONFIG"
+fi
+
+if [[ "$SHOULD_MIGRATE" == "1" ]]; then
+  CURRENT_PHASE="prisma-migrate"
+  echo "DX_REMOTE_PHASE=prisma-migrate"
+  PRISMA_BIN="$RELEASE_DIR/node_modules/.bin/prisma"
+  if [[ ! -x "$PRISMA_BIN" ]]; then
+    echo "缺少可执行文件: $PRISMA_BIN" >&2
+    exit 1
+  fi
+  run_with_env "$RELEASE_DIR" "$PRISMA_BIN" migrate deploy --schema="$PRISMA_SCHEMA" --config="$PRISMA_CONFIG"
+  MIGRATION_EXECUTED=1
+fi
+
+CURRENT_PHASE="switch-current"
+echo "DX_REMOTE_PHASE=switch-current"
+ln -sfn "$RELEASE_DIR" "$CURRENT_LINK"
+
+CURRENT_PHASE="startup"
+echo "DX_REMOTE_PHASE=startup"
+if [[ "$START_MODE" == "pm2" ]]; then
+  if ! (
+    cd "$CURRENT_LINK"
+    pm2 delete "$SERVICE_NAME" || true
+    APP_ENV="$ENV_NAME" "$DOTENV_BIN" -o -e "$ENV_FILE_NAME" -e "$ENV_LOCAL_FILE_NAME" -- \\
+      pm2 start "$ECOSYSTEM_CONFIG" --only "$SERVICE_NAME" --update-env
+    pm2 save
+  ); then
+    if [[ "$MIGRATION_EXECUTED" -eq 0 && -n "$PREVIOUS_CURRENT_TARGET" ]]; then
+      ROLLBACK_ATTEMPTED=true
+      ln -sfn "$PREVIOUS_CURRENT_TARGET" "$CURRENT_LINK"
+      attempt_pm2_restore
+    fi
+    emit_result false "startup" "pm2 startup failed" "$ROLLBACK_ATTEMPTED" "$ROLLBACK_SUCCEEDED"
+    exit 1
+  fi
+else
+  if ! (
+    cd "$CURRENT_LINK"
+    APP_ENV="$ENV_NAME" "$DOTENV_BIN" -o -e "$ENV_FILE_NAME" -e "$ENV_LOCAL_FILE_NAME" -- \\
+      node "$START_ENTRY"
+  ); then
+    emit_result false "startup" "direct startup failed" false null
+    exit 1
+  fi
+  emit_result true "startup" "direct mode attached" false null
+  exit 0
+fi
+
+CURRENT_PHASE="cleanup"
+echo "DX_REMOTE_PHASE=cleanup"
+release_count=0
+shopt -s nullglob
+release_dirs=("$RELEASES_DIR"/*)
+shopt -u nullglob
+while IFS= read -r old_release; do
+  release_count=$((release_count + 1))
+  if [[ "$release_count" -gt "$KEEP_RELEASES" ]]; then
+    rm -rf "$old_release"
+  fi
+done < <(
+  if [[ "\${#release_dirs[@]}" -gt 0 ]]; then
+    ls -1dt "\${release_dirs[@]}"
+  fi
+)
+
+emit_result true "cleanup" "ok" false null
+`
+}

package/lib/backend-artifact-deploy/remote-transport.js

@@ -0,0 +1,118 @@
+import { spawn } from 'node:child_process'
+import { basename, relative } from 'node:path'
+import { buildRemoteDeployScript } from './remote-script.js'
+import { createRemotePhaseModel } from './remote-phases.js'
+import { parseRemoteResult } from './remote-result.js'
+
+function runProcess(command, args, options = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      stdio: ['pipe', 'pipe', 'pipe'],
+      ...options,
+    })
+
+    let stdout = ''
+    let stderr = ''
+    child.stdout.on('data', chunk => {
+      stdout += String(chunk)
+    })
+    child.stderr.on('data', chunk => {
+      stderr += String(chunk)
+    })
+    child.on('error', reject)
+    child.on('close', exitCode => resolve({ stdout, stderr, exitCode }))
+  })
+}
+
+function escapeShellArg(value) {
+  return `'${String(value).replace(/'/g, `'\\''`)}'`
+}
+
+function normalizeRemoteBaseDir(baseDir) {
+  return String(baseDir).replace(/\/+$/, '') || '/'
+}
+
+export function buildEnsureRemoteBaseDirsCommand(baseDir) {
+  const normalizedBaseDir = normalizeRemoteBaseDir(baseDir)
+  const directories = ['releases', 'shared', 'uploads'].map(name => `${normalizedBaseDir}/${name}`)
+  return `mkdir -p ${directories.map(escapeShellArg).join(' ')}`
+}
+
+async function defaultEnsureRemoteBaseDirs(remote) {
+  const target = `${remote.user}@${remote.host}`
+  const args = [
+    '-p',
+    String(remote.port || 22),
+    target,
+    buildEnsureRemoteBaseDirsCommand(remote.baseDir),
+  ]
+  const result = await runProcess('ssh', args)
+  if (result.exitCode !== 0) {
+    throw new Error(result.stderr || `ssh mkdir failed (${result.exitCode})`)
+  }
+}
+
+async function defaultUploadBundle(remote, bundlePath) {
+  const target = `${remote.user}@${remote.host}:${remote.baseDir}/uploads/${basename(bundlePath)}`
+  const result = await runProcess('scp', ['-P', String(remote.port || 22), bundlePath, target])
+  if (result.exitCode !== 0) {
+    throw new Error(result.stderr || `scp failed (${result.exitCode})`)
+  }
+}
+
+async function defaultRunRemoteScript(remote, script) {
+  const target = `${remote.user}@${remote.host}`
+  return new Promise((resolve, reject) => {
+    const child = spawn('ssh', ['-p', String(remote.port || 22), target, 'bash -s'], {
+      stdio: ['pipe', 'pipe', 'pipe'],
+    })
+    let stdout = ''
+    let stderr = ''
+    child.stdout.on('data', chunk => {
+      stdout += String(chunk)
+    })
+    child.stderr.on('data', chunk => {
+      stderr += String(chunk)
+    })
+    child.on('error', reject)
+    child.on('close', exitCode => resolve({ stdout, stderr, exitCode }))
+    child.stdin.write(script)
+    child.stdin.end()
+  })
+}
+
+function createRemotePayload(config, bundle) {
+  const toReleaseRelativePath = targetPath => {
+    if (!targetPath) return null
+    if (!config.projectRoot) return targetPath
+    return relative(config.projectRoot, targetPath).replace(/\\/g, '/')
+  }
+
+  return {
+    environment: config.environment,
+    versionName: bundle.versionName,
+    uploadedBundlePath: `${config.remote.baseDir}/uploads/${basename(bundle.bundlePath)}`,
+    remote: config.remote,
+    runtime: {
+      prismaSchemaDir: toReleaseRelativePath(config.runtime.prismaSchemaDir),
+      prismaConfig: toReleaseRelativePath(config.runtime.prismaConfig),
+      ecosystemConfig: config.runtime.ecosystemConfig ? basename(config.runtime.ecosystemConfig) : null,
+    },
+    startup: config.startup,
+    deploy: config.deploy,
+  }
+}
+
+export async function deployBackendArtifactRemotely(config, bundle, deps = {}) {
+  const ensureRemoteBaseDirs = deps.ensureRemoteBaseDirs || defaultEnsureRemoteBaseDirs
+  const uploadBundle = deps.uploadBundle || defaultUploadBundle
+  const runRemoteScript = deps.runRemoteScript || defaultRunRemoteScript
+
+  await ensureRemoteBaseDirs(config.remote)
+  await uploadBundle(config.remote, bundle.bundlePath)
+  const payload = createRemotePayload(config, bundle)
+  const phaseModel = createRemotePhaseModel(payload)
+  const script = buildRemoteDeployScript(phaseModel)
+  const commandResult = await runRemoteScript(config.remote, script)
+  return parseRemoteResult(commandResult)
+}

package/lib/backend-artifact-deploy/rollback.js

@@ -0,0 +1,5 @@
+export function shouldAttemptRollback({ migrationExecuted, startupMode }) {
+  if (migrationExecuted) return false
+  if (startupMode === 'direct') return false
+  return true
+}