@scemoon/cdh 1.0.8 → 1.0.9-beta.2

package/ai-dlc-skill/providers/aliyun/preview.yaml

@@ -0,0 +1,84 @@
+# Aliyun Stack Preview
+
+Preview deployment for the unified stack (backend + all clients: web, native, desktop, wxa, mya, tta). URL resolution is dynamic per platform; `BACKEND_URL` is injected into client builds at build time.
+
+## Overview
+
+`deploy_stack --preview --provider aliyun` deploys the full stack to an isolated preview environment and exports the stack URL. Used for per-component e2e AND cross-stack e2e verification before staging or production.
+
+## Preview Flow
+
+```
+git push feature branch
+  → deploy_stack --preview --provider aliyun
+  → STACK_URL = BACKEND_URL = https://{gateway}.{region}.fc.devs.com
+  → WEB_URL  = https://{bucket}.{region}.oss-website.aliyuncs.com
+  → NATIVE_DIST_URL = internal distribution URL
+  → DESKTOP_DIST_URL = internal distribution URL
+  → WXA_URL / MYA_URL / TTA_URL = mini-program preview QR
+  → Per-component e2e: pytest apps/{comp}/tests/e2e/ --base-url $URL
+  → Cross-stack e2e:  pytest aidlc/tests/cross-stack/ --stack-url $STACK_URL
+  → TTL: 24h → auto cleanup
+```
+
+## Configuration
+
+```yaml
+preview:
+  orchestrator: deploy_stack
+  strategy: unified
+  ttl: 24h
+  auto_cleanup: true
+  db_sandbox: true          # isolated DB per preview
+  url_pattern_backend: "https://{gateway}.{region}.fc.devs.com"
+  url_pattern_web:     "https://{bucket}.{region}.oss-website.aliyuncs.com"
+  build_env:
+    web:
+      - BACKEND_URL
+      - STACK_URL
+    native:
+      - BACKEND_URL
+    desktop:
+      - BACKEND_URL
+    wxa:
+      - BACKEND_URL
+    mya:
+      - BACKEND_URL
+    tta:
+      - BACKEND_URL
+  env:
+    - STACK_URL             # = BACKEND_URL (gateway)
+    - BACKEND_URL
+    - WEB_URL
+    - NATIVE_DIST_URL
+    - DESKTOP_DIST_URL
+    - WXA_URL
+    - MYA_URL
+    - TTA_URL
+    - DATABASE_URL (sandbox)
+```
+
+## BDD E2E Integration
+
+```bash
+# Deploy unified stack preview
+export STACK_URL=$(deploy_stack --preview --provider aliyun --output url)
+export BACKEND_URL=$STACK_URL
+export WEB_URL=$(deploy_stack --preview --provider aliyun --output web_url)
+export NATIVE_DIST_URL=$(deploy_stack --preview --provider aliyun --output native_url)
+export DESKTOP_DIST_URL=$(deploy_stack --preview --provider aliyun --output desktop_url)
+
+# Per-component e2e
+pytest apps/backend/tests/e2e/ --base-url $BACKEND_URL
+pytest apps/web/tests/e2e/ --base-url $WEB_URL --api-url $BACKEND_URL
+pytest apps/native/tests/e2e/ --backend-url $BACKEND_URL
+pytest apps/desktop/tests/e2e/ --backend-url $BACKEND_URL
+pytest apps/wxa/tests/e2e/ --backend-url $BACKEND_URL
+pytest apps/mya/tests/e2e/ --backend-url $BACKEND_URL
+pytest apps/tta/tests/e2e/ --backend-url $BACKEND_URL
+
+# Cross-stack e2e
+pytest aidlc/tests/cross-stack/ --stack-url $STACK_URL
+
+# Cleanup (automatic after TTL)
+```

package/ai-dlc-skill/providers/aliyun/provider.yaml

@@ -0,0 +1,160 @@
+# Aliyun Provider (Stack-aware)
+
+Aliyun (Alibaba Cloud) provider — secondary platform. Supports the unified stack deploy (backend + all clients: web, native, desktop, wxa, mya, tta) and per-component deploys (for isolated dev sandboxes only).
+
+## Metadata
+
+```yaml
+provider:
+  name: aliyun
+  display_name: Alibaba Cloud
+  default: false
+  version: 3.0.0
+  website: https://www.aliyun.com/
+
+stack:
+  components:
+    - id: backend
+      deploy_order: 1
+      exposes: BACKEND_URL
+    - id: web
+      deploy_order: 2
+      consumes: BACKEND_URL
+    - id: native
+      deploy_order: 2
+      consumes: BACKEND_URL
+    - id: desktop
+      deploy_order: 2
+      consumes: BACKEND_URL
+    - id: wxa
+      deploy_order: 2
+      consumes: BACKEND_URL
+    - id: mya
+      deploy_order: 2
+      consumes: BACKEND_URL
+    - id: tta
+      deploy_order: 2
+      consumes: BACKEND_URL
+
+regions:
+  - id: cn-shanghai
+    name: Shanghai
+  - id: cn-beijing
+    name: Beijing
+  - id: cn-hangzhou
+    name: Hangzhou
+  - id: ap-southeast-1
+    name: Singapore
+
+services:
+  - functions: function-compute
+  - database: rds + tablestore
+  - storage: oss
+  - hosting: static-website + cdn
+
+limits:
+  function_timeout: 600s
+  function_memory: 3072MB
+
+compute_modes:
+  - id: fc
+    type: faas
+    default: true
+    description: "Function Compute — event-driven functions"
+    limits:
+      timeout: 600s
+      memory: 3072MB
+  - id: sae
+    type: caas
+    description: "Serverless App Engine 2.0 — container/web app hosting"
+    limits:
+      timeout: 86400s
+      memory: 32768MB
+
+capabilities:
+  - function_compute
+  - serverless_app_engine
+  - oss_storage
+  - rds_database
+  - tablestore
+  - static_hosting
+  - cdn_acceleration
+  - preview_deploy
+  - ssl_cert
+  - stack_deploy
+  - build_env_injection
+```
+
+## Stack Deploy (recommended for shared environments)
+
+```bash
+# Unified stack preview
+deploy_stack --preview --provider aliyun
+# → backend:  fun deploy --env preview
+# → web:      oss + cdn deploy with build env BACKEND_URL=${STACK_URL}
+# → native:   build with BACKEND_URL injected; package
+# → desktop:  build with BACKEND_URL injected; package
+# → wxa:      build with BACKEND_URL injected; upload to mini-program platform
+# → mya:      build with BACKEND_URL injected; upload to mini-program platform
+# → tta:      build with BACKEND_URL injected; upload to mini-program platform
+# → STACK_URL = https://{gateway}.{region}.fc.devs.com
+
+deploy_stack --env staging --provider aliyun
+deploy_stack --env production --provider aliyun
+deploy_stack --rollback ${LAST_STABLE_STACK_VERSION} --provider aliyun
+```
+
+## Per-Component Deploy (dev sandboxes only)
+
+```bash
+# Functions
+fun deploy --function hello
+
+# Storage (OSS)
+oss cp ./file.txt oss://bucket/path/
+oss ls oss://bucket/
+
+# Database (RDS / TableStore)
+# RDS: standard MySQL/PostgreSQL CLI
+# TableStore: ots search
+
+# Hosting (web only, dev sandbox)
+oss cp -r ./dist oss://{dev-bucket}/ && cdn refresh
+
+# Environment
+fun config --account-id <id>
+fun config --region cn-shanghai
+```
+
+> Per-component deploys to shared environments are forbidden (STK-004). Use `deploy_stack`.
+
+## URL Resolution
+
+| Component | Pattern |
+|-----------|---------|
+| `STACK_URL` / `BACKEND_URL` | `https://{gateway}.{region}.fc.devs.com` |
+| `WEB_URL` | `https://{bucket}.{region}.oss-website.aliyuncs.com` |
+| `NATIVE_DIST_URL` | internal distribution URL |
+| `DESKTOP_DIST_URL` | internal distribution URL |
+| `WXA_URL` | mini-program preview QR |
+| `MYA_URL` | mini-program preview QR |
+| `TTA_URL` | mini-program preview QR |
+
+## Build Config Injection
+
+```bash
+BACKEND_URL=$STACK_URL pnpm --filter web build
+oss cp -r ./dist oss://{bucket}/ --update
+cdn refresh
+```
+
+## Environment Variables
+
+| Variable | Description |
+|----------|-------------|
+| ALICLOUD_ACCESS_KEY | Aliyun access key ID |
+| ALICLOUD_SECRET_KEY | Aliyun access key secret |
+| ALICLOUD_REGION | Default region |
+| FUNCTION_COMPUTE_SERVICE | FC service name |
+| BACKEND_URL | Stack URL injected at build time |
+| STACK_URL | Alias of BACKEND_URL (gateway) |

package/ai-dlc-skill/providers/aliyun/security/authentication.md

@@ -0,0 +1,254 @@
+# Aliyun Authentication & Credentials
+
+## Credential Types
+
+| Type | Security | Use Case |
+|------|----------|----------|
+| Access Key (AK/SK) | ⚠️ Medium | CLI, SDK, CI/CD |
+| RAM Role (STS) | ✅ Recommended | Temporary access, functions |
+| Assume Role | ✅✅ Best | CI/CD with least privilege |
+
+## Agent Decision Guide
+
+```
+Need to authenticate with Aliyun?
+├── From CI/CD pipeline → Environment variables (ALICLOUD_ACCESS_KEY/KEY)
+├── From local CLI → aliyun configure (interactive)
+├── From function code → Service credentials (automatic injection)
+├── From browser/client → STS token (temporary)
+└── Never commit credentials to git
+```
+
+## Environment Variables
+
+### For CLI and Server-Side
+
+```bash
+# Access Key
+export ALICLOUD_ACCESS_KEY=your-access-key-id
+export ALICLOUD_SECRET_KEY=your-access-key-secret
+
+# Region
+export ALICLOUD_REGION=cn-shanghai
+```
+
+### For Function Compute
+
+Functions automatically receive credentials via:
+- `ALIBABA_CLOUD_ACCESS_KEY_ID` (injected)
+- `ALIBABA_CLOUD_ACCESS_KEY_SECRET` (injected)
+- `ALIBABA_CLOUD_SECURITY_TOKEN` (for STS)
+
+## Creating Access Keys
+
+### 1. Create via RAM Console
+
+1. Go to [RAM Console](https://ram.console.aliyun.com/)
+2. Navigate to: Users → Create User
+3. Create AccessKey (or enable console password)
+4. Download CSV with AK/SK
+
+### 2. Create RAM Policy
+
+```json
+{
+  "Version": "1",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "fc:InvokeFunction",
+        "fc:CreateFunction",
+        "oss:GetObject",
+        "oss:PutObject"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+```
+
+## Temporary Credentials (STS)
+
+For short-lived access, use STS tokens:
+
+### Get STS Token
+
+```javascript
+const OSS = require('ali-oss');
+const STS = require('aliyun-sdk').STS;
+
+const sts = new STS({
+  accessKeyId: process.env.ALICLOUD_ACCESS_KEY,
+  accessKeySecret: process.env.ALICLOUD_SECRET_KEY
+});
+
+const result = await sts.assumeRole({
+  RoleArn: 'acs:ram::123456789:role/DeveloperRole',
+  RoleSessionName: 'dev-session'
+});
+```
+
+### STS Token Response
+
+```json
+{
+  "Credentials": {
+    "AccessKeyId": "STS.xxx",
+    "AccessKeySecret": "xxx",
+    "SecurityToken": "xxx",
+    "Expiration": "2024-01-01T12:00:00Z"
+  }
+}
+```
+
+### Use STS Token
+
+```javascript
+const client = new OSS({
+  region: process.env.ALICLOUD_REGION,
+  accessKeyId: credentials.AccessKeyId,
+  accessKeySecret: credentials.AccessKeySecret,
+  stsToken: credentials.SecurityToken,
+  bucket: 'my-bucket'
+});
+```
+
+## RAM Role for Functions
+
+### Create RAM Role
+
+1. Go to RAM Console → Roles → Create Role
+2. Select "Aliyun Service" trusted entity
+3. Attach policies (e.g., AliyunOSSFullAccess)
+
+### Function Use Role
+
+```yaml
+service:
+  name: my-service
+  role: acs:ram::123456789:role/FCServiceRole
+```
+
+Function will automatically receive temporary credentials.
+
+## Credential Security Best Practices
+
+### Do's ✅
+
+1. **Use environment variables** - Don't hardcode credentials
+2. **Use RAM roles** - Over direct AccessKeys
+3. **Use STS for temporary access** - Credentials expire
+4. **Rotate regularly** - Change AccessKeys periodically
+5. **Use least privilege** - Grant minimum required permissions
+6. **Store in secrets manager** - GitHub Secrets, KMS, etc.
+
+### Don'ts ❌
+
+1. **Commit credentials** - Never commit to git
+2. **Use root account** - Create dedicated RAM users
+3. **Share credentials** - Each user/service should have own key
+4. **Use same credentials everywhere** - Separate per environment
+
+## .gitignore for Credentials
+
+```
+# Aliyun credentials
+.env
+.env.*
+aliyun-cli-config.json
+ossutil-config.ini
+
+# Function compute
+.template.yml.bak
+
+# Build outputs
+dist/
+build/
+```
+
+## Function Authentication
+
+### How Functions Receive Credentials
+
+FC functions automatically have credentials injected:
+
+```javascript
+module.exports.handler = async (event, context) => {
+  // Available automatically in FC functions
+  const accessKeyId = process.env.ALIBABA_CLOUD_ACCESS_KEY_ID;
+  const accessKeySecret = process.env.ALIBABA_CLOUD_ACCESS_KEY_SECRET;
+  const securityToken = process.env.ALIBABA_CLOUD_SECURITY_TOKEN;
+
+  console.log(`Running with credentials for account`);
+};
+```
+
+### Calling Aliyun Services from Functions
+
+```javascript
+const OSS = require('ali-oss');
+
+module.exports.handler = async (event, context) => {
+  // Use injected credentials
+  const client = new OSS({
+    region: process.env.ALICLOUD_REGION,
+    accessKeyId: process.env.ALIBABA_CLOUD_ACCESS_KEY_ID,
+    accessKeySecret: process.env.ALIBABA_CLOUD_ACCESS_KEY_SECRET,
+    stsToken: process.env.ALIBABA_CLOUD_SECURITY_TOKEN,
+    bucket: 'my-bucket'
+  });
+
+  const result = await client.list();
+  return { buckets: result.buckets };
+};
+```
+
+## Permission Model (RAM)
+
+### Common Policies
+
+| Policy | Description |
+|--------|-------------|
+| `AliyunFCFullAccess` | Full Function Compute access |
+| `AliyunOSSFullAccess` | Full OSS access |
+| `AliyunRDSFullAccess` | Full RDS access |
+| `AliyunOTSFullAccess` | Full TableStore access |
+| `AliyunCDNFullAccess` | Full CDN access |
+
+### Custom Policy Example
+
+```json
+{
+  "Version": "1",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "oss:GetObject",
+        "oss:PutObject",
+        "oss:DeleteObject"
+      ],
+      "Resource": "acs:oss:*:*:my-bucket/*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "fc:InvokeFunction"
+      ],
+      "Resource": "acs:fc:*:*:services/my-service/functions/*"
+    }
+  ]
+}
+```
+
+## Troubleshooting
+
+| Issue | Cause | Solution |
+|-------|-------|----------|
+| `InvalidAccessKeyId` | Wrong or expired key | Verify AccessKey in RAM console |
+| `SignatureDoesNotMatch` | Key mismatch | Check AccessKey Secret |
+| `Permission denied` | Insufficient permissions | Attach more RAM policies |
+| `Token expired` | STS token too old | Refresh temporary credentials |
+
+For general troubleshooting → `../best-practices/troubleshooting.md`

package/ai-dlc-skill/providers/aliyun/services/cdn-hosting.md

@@ -0,0 +1,220 @@
+# CDN + Static Website Hosting
+
+## When to Use CDN Hosting
+
+**Use CDN + OSS when:**
+- Deploy static websites (SPA, static sites)
+- Host web assets with global acceleration
+- Serve content with low latency worldwide
+- Need automatic HTTPS and custom domains
+
+**Do NOT use CDN+OSS when:**
+- Need server-side business logic → Use Function Compute
+- Need real-time features → Use Function Compute + WebSocket
+- Complex dynamic content → Use SAE or ECS
+
+## Agent Decision Guide
+
+```
+Need to serve web content?
+├── Static site (HTML/CSS/JS) → OSS + CDN
+├── SPA with API backend → OSS + CDN + Function Compute
+└── Full web app with SSR → SAE
+```
+
+## Hosting Features
+
+| Feature | Description |
+|---------|-------------|
+| Global CDN | 200+ edge nodes worldwide |
+| Automatic HTTPS | Free SSL certificates via Alibaba Cloud CDN |
+| Custom Domain | Bring your own domain |
+| SPA Routing | Rewrites all 404s to index.html |
+| Cache Control | Per-file cache headers |
+| CI/CD Integration | Auto-deploy on git push |
+
+## Deployment
+
+### Basic Deployment
+
+```bash
+# Upload to OSS
+ossutil cp -r ./dist oss://my-bucket/ --update
+
+# Refresh CDN
+aliyun cdn RefreshObjectCaches --ObjectType File \
+  --ObjectPath http://my-bucket.oss-cn-shanghai.aliyuncs.com/
+```
+
+### Using serverless devs
+
+```yaml
+edition: 1.0.0
+services:
+  web:
+    component: website
+    props:
+      bucket: my-bucket
+      region: cn-shanghai
+      dist: ./dist
+      cacheControl: 31536000
+```
+
+```bash
+s deploy
+```
+
+## URL Structure
+
+| Environment | URL Pattern |
+|-------------|-------------|
+| OSS Origin | `https://{bucket}.{region}.aliyuncs.com` |
+| CDN Domain | `https://{cdn-domain}` |
+| Custom Domain | `https://{custom-domain}` |
+
+## SPA Configuration
+
+### How SPA Routing Works
+
+For Single Page Applications (Vue, React, Angular):
+
+1. All requests to non-file paths are rewritten to `index.html`
+2. Client-side router handles path rendering
+3. Direct links and refresh work correctly
+
+### CDN Cache Configuration
+
+```bash
+# Set cache rules
+aliyun cdn SetFileCacheConfig --CacheType 30 \
+  --CacheUrlPropertyList "*.js,*.css,*.png"
+```
+
+### Default Cache Behavior
+
+| File Type | Cache Duration |
+|-----------|----------------|
+| HTML | No cache (or short) |
+| JS/CSS | 1 year (immutable with hash) |
+| Images | 1 week |
+| Other | 1 day |
+
+## Custom Domain
+
+### Add CDN Domain
+
+```bash
+aliyun cdn AddCdnDomain \
+  --DomainName example.com \
+  --CdnType web \
+  --SourceType oss \
+  --SourceDomain my-bucket.oss-cn-shanghai.aliyuncs.com
+```
+
+### Configure DNS
+
+Add CNAME record:
+```
+Type: CNAME
+Host: example.com
+Value: example.com.w.kunlungr.com
+```
+
+### SSL Certificate
+
+```bash
+# Add SSL certificate
+aliyun cdn SetCdnDomainSSLCertificate \
+  --DomainName example.com \
+  --CertType upload \
+  --SSLProtocol true \
+  --CertFile /path/to/cert.pem \
+  --KeyFile /path/to/key.pem
+```
+
+## Build Environment Injection
+
+Inject environment-specific values at build time:
+
+```bash
+# Set environment variable during build
+BACKEND_URL=https://api.example.com pnpm --filter web build
+```
+
+This makes variables available during the build process (Vite, Webpack, etc.).
+
+## Integration with Backend
+
+### Pattern: Frontend + Function Compute API
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│                     Browser                                  │
+│   ┌──────────────────────────────────────────────────────┐  │
+│   │  Frontend App (OSS + CDN)                            │  │
+│   │  - Loads config from window.__ENV__                  │  │
+│   │  - Calls API via BACKEND_URL                         │  │
+│   └──────────────────────────────────────────────────────┘  │
+└─────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌─────────────────────────────────────────────────────────────┐
+│              Function Compute (API Gateway)                  │
+│   - /api/users → getUsers()                                 │
+│   - /api/orders → createOrder()                             │
+└─────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌─────────────────────────────────────────────────────────────┐
+│                   RDS + TableStore                          │
+└─────────────────────────────────────────────────────────────┘
+```
+
+### Build with Backend URL
+
+```bash
+# Deploy web with BACKEND_URL injected
+cd apps/web && BACKEND_URL=$STACK_URL pnpm build
+
+# Upload to OSS
+ossutil cp -r ./dist oss://my-bucket/ --update
+
+# Refresh CDN cache
+aliyun cdn RefreshObjectCaches --ObjectType directory \
+  --ObjectPath http://my-bucket.oss-cn-shanghai.aliyuncs.com/
+```
+
+## CLI Reference
+
+| Command | Description |
+|---------|-------------|
+| `ossutil cp -r ./dist oss://bucket/` | Upload static files |
+| `ossutil website oss://bucket --index index.html` | Set index page |
+| `aliyun cdn RefreshObjectCaches` | Refresh CDN cache |
+| `aliyun cdn DescribeCdnDomainDetail` | Get domain info |
+| `aliyun cdn AddCdnDomain` | Add CDN domain |
+| `aliyun cdn SetCdnDomainSSLCertificate` | Set SSL certificate |
+
+## Best Practices
+
+1. **Use build tools** - Don't deploy raw HTML, use Vite/Webpack
+2. **Enable gzip/brotli** - Configure in build tool for smaller assets
+3. **Use immutable hashes** - Filename hashes for cache busting
+4. **Optimize images** - Compress images, use WebP format
+5. **Set long cache for assets** - JS/CSS with content hash
+6. **SPA routing** - Ensure all routes serve index.html
+7. **CDN cache** - Use cache invalidation on deploy
+8. **Separate buckets** - Dev/staging/prod different buckets
+
+## Troubleshooting
+
+| Issue | Cause | Solution |
+|-------|-------|----------|
+| 404 on refresh (SPA) | CDN caching old routing | Refresh CDN after deploy |
+| Stale content | Cache not cleared | Refresh CDN or use versioned paths |
+| Slow first load | Large bundle | Code split, lazy load routes |
+| CORS errors | API not allowing origin | Configure CORS in Function Compute |
+| CDN not working | DNS not propagated | Wait for CNAME to propagate |
+| SSL not ready | Certificate provisioning | Wait 1-10 minutes |
+
+For detailed troubleshooting → `../best-practices/troubleshooting.md`