@scemoon/cdh 1.0.9 → 1.0.10-beta.1

package/ai-dlc-skill/providers/aliyun/preview.yaml

@@ -1,84 +0,0 @@
-# Aliyun Stack Preview
-
-Preview deployment for the unified stack (backend + all clients: web, native, desktop, wxa, mya, tta). URL resolution is dynamic per platform; `BACKEND_URL` is injected into client builds at build time.
-
-## Overview
-
-`deploy_stack --preview --provider aliyun` deploys the full stack to an isolated preview environment and exports the stack URL. Used for per-component e2e AND cross-stack e2e verification before staging or production.
-
-## Preview Flow
-
-```
-git push feature branch
-  → deploy_stack --preview --provider aliyun
-  → STACK_URL = BACKEND_URL = https://{gateway}.{region}.fc.devs.com
-  → WEB_URL  = https://{bucket}.{region}.oss-website.aliyuncs.com
-  → NATIVE_DIST_URL = internal distribution URL
-  → DESKTOP_DIST_URL = internal distribution URL
-  → WXA_URL / MYA_URL / TTA_URL = mini-program preview QR
-  → Per-component e2e: pytest apps/{comp}/tests/e2e/ --base-url $URL
-  → Cross-stack e2e:  pytest aidlc/tests/cross-stack/ --stack-url $STACK_URL
-  → TTL: 24h → auto cleanup
-```
-
-## Configuration
-
-```yaml
-preview:
-  orchestrator: deploy_stack
-  strategy: unified
-  ttl: 24h
-  auto_cleanup: true
-  db_sandbox: true          # isolated DB per preview
-  url_pattern_backend: "https://{gateway}.{region}.fc.devs.com"
-  url_pattern_web:     "https://{bucket}.{region}.oss-website.aliyuncs.com"
-  build_env:
-    web:
-      - BACKEND_URL
-      - STACK_URL
-    native:
-      - BACKEND_URL
-    desktop:
-      - BACKEND_URL
-    wxa:
-      - BACKEND_URL
-    mya:
-      - BACKEND_URL
-    tta:
-      - BACKEND_URL
-  env:
-    - STACK_URL             # = BACKEND_URL (gateway)
-    - BACKEND_URL
-    - WEB_URL
-    - NATIVE_DIST_URL
-    - DESKTOP_DIST_URL
-    - WXA_URL
-    - MYA_URL
-    - TTA_URL
-    - DATABASE_URL (sandbox)
-```
-
-## BDD E2E Integration
-
-```bash
-# Deploy unified stack preview
-export STACK_URL=$(deploy_stack --preview --provider aliyun --output url)
-export BACKEND_URL=$STACK_URL
-export WEB_URL=$(deploy_stack --preview --provider aliyun --output web_url)
-export NATIVE_DIST_URL=$(deploy_stack --preview --provider aliyun --output native_url)
-export DESKTOP_DIST_URL=$(deploy_stack --preview --provider aliyun --output desktop_url)
-
-# Per-component e2e
-pytest apps/backend/tests/e2e/ --base-url $BACKEND_URL
-pytest apps/web/tests/e2e/ --base-url $WEB_URL --api-url $BACKEND_URL
-pytest apps/native/tests/e2e/ --backend-url $BACKEND_URL
-pytest apps/desktop/tests/e2e/ --backend-url $BACKEND_URL
-pytest apps/wxa/tests/e2e/ --backend-url $BACKEND_URL
-pytest apps/mya/tests/e2e/ --backend-url $BACKEND_URL
-pytest apps/tta/tests/e2e/ --backend-url $BACKEND_URL
-
-# Cross-stack e2e
-pytest aidlc/tests/cross-stack/ --stack-url $STACK_URL
-
-# Cleanup (automatic after TTL)
-```

package/ai-dlc-skill/providers/aliyun/provider.yaml

@@ -1,160 +0,0 @@
-# Aliyun Provider (Stack-aware)
-
-Aliyun (Alibaba Cloud) provider — secondary platform. Supports the unified stack deploy (backend + all clients: web, native, desktop, wxa, mya, tta) and per-component deploys (for isolated dev sandboxes only).
-
-## Metadata
-
-```yaml
-provider:
-  name: aliyun
-  display_name: Alibaba Cloud
-  default: false
-  version: 3.0.0
-  website: https://www.aliyun.com/
-
-stack:
-  components:
-    - id: backend
-      deploy_order: 1
-      exposes: BACKEND_URL
-    - id: web
-      deploy_order: 2
-      consumes: BACKEND_URL
-    - id: native
-      deploy_order: 2
-      consumes: BACKEND_URL
-    - id: desktop
-      deploy_order: 2
-      consumes: BACKEND_URL
-    - id: wxa
-      deploy_order: 2
-      consumes: BACKEND_URL
-    - id: mya
-      deploy_order: 2
-      consumes: BACKEND_URL
-    - id: tta
-      deploy_order: 2
-      consumes: BACKEND_URL
-
-regions:
-  - id: cn-shanghai
-    name: Shanghai
-  - id: cn-beijing
-    name: Beijing
-  - id: cn-hangzhou
-    name: Hangzhou
-  - id: ap-southeast-1
-    name: Singapore
-
-services:
-  - functions: function-compute
-  - database: rds + tablestore
-  - storage: oss
-  - hosting: static-website + cdn
-
-limits:
-  function_timeout: 600s
-  function_memory: 3072MB
-
-compute_modes:
-  - id: fc
-    type: faas
-    default: true
-    description: "Function Compute — event-driven functions"
-    limits:
-      timeout: 600s
-      memory: 3072MB
-  - id: sae
-    type: caas
-    description: "Serverless App Engine 2.0 — container/web app hosting"
-    limits:
-      timeout: 86400s
-      memory: 32768MB
-
-capabilities:
-  - function_compute
-  - serverless_app_engine
-  - oss_storage
-  - rds_database
-  - tablestore
-  - static_hosting
-  - cdn_acceleration
-  - preview_deploy
-  - ssl_cert
-  - stack_deploy
-  - build_env_injection
-```
-
-## Stack Deploy (recommended for shared environments)
-
-```bash
-# Unified stack preview
-deploy_stack --preview --provider aliyun
-# → backend:  fun deploy --env preview
-# → web:      oss + cdn deploy with build env BACKEND_URL=${STACK_URL}
-# → native:   build with BACKEND_URL injected; package
-# → desktop:  build with BACKEND_URL injected; package
-# → wxa:      build with BACKEND_URL injected; upload to mini-program platform
-# → mya:      build with BACKEND_URL injected; upload to mini-program platform
-# → tta:      build with BACKEND_URL injected; upload to mini-program platform
-# → STACK_URL = https://{gateway}.{region}.fc.devs.com
-
-deploy_stack --env staging --provider aliyun
-deploy_stack --env production --provider aliyun
-deploy_stack --rollback ${LAST_STABLE_STACK_VERSION} --provider aliyun
-```
-
-## Per-Component Deploy (dev sandboxes only)
-
-```bash
-# Functions
-fun deploy --function hello
-
-# Storage (OSS)
-oss cp ./file.txt oss://bucket/path/
-oss ls oss://bucket/
-
-# Database (RDS / TableStore)
-# RDS: standard MySQL/PostgreSQL CLI
-# TableStore: ots search
-
-# Hosting (web only, dev sandbox)
-oss cp -r ./dist oss://{dev-bucket}/ && cdn refresh
-
-# Environment
-fun config --account-id <id>
-fun config --region cn-shanghai
-```
-
-> Per-component deploys to shared environments are forbidden (STK-004). Use `deploy_stack`.
-
-## URL Resolution
-
-| Component | Pattern |
-|-----------|---------|
-| `STACK_URL` / `BACKEND_URL` | `https://{gateway}.{region}.fc.devs.com` |
-| `WEB_URL` | `https://{bucket}.{region}.oss-website.aliyuncs.com` |
-| `NATIVE_DIST_URL` | internal distribution URL |
-| `DESKTOP_DIST_URL` | internal distribution URL |
-| `WXA_URL` | mini-program preview QR |
-| `MYA_URL` | mini-program preview QR |
-| `TTA_URL` | mini-program preview QR |
-
-## Build Config Injection
-
-```bash
-BACKEND_URL=$STACK_URL pnpm --filter web build
-oss cp -r ./dist oss://{bucket}/ --update
-cdn refresh
-```
-
-## Environment Variables
-
-| Variable | Description |
-|----------|-------------|
-| ALICLOUD_ACCESS_KEY | Aliyun access key ID |
-| ALICLOUD_SECRET_KEY | Aliyun access key secret |
-| ALICLOUD_REGION | Default region |
-| FUNCTION_COMPUTE_SERVICE | FC service name |
-| BACKEND_URL | Stack URL injected at build time |
-| STACK_URL | Alias of BACKEND_URL (gateway) |

package/ai-dlc-skill/providers/aliyun/security/authentication.md

@@ -1,254 +0,0 @@
-# Aliyun Authentication & Credentials
-
-## Credential Types
-
-| Type | Security | Use Case |
-|------|----------|----------|
-| Access Key (AK/SK) | ⚠️ Medium | CLI, SDK, CI/CD |
-| RAM Role (STS) | ✅ Recommended | Temporary access, functions |
-| Assume Role | ✅✅ Best | CI/CD with least privilege |
-
-## Agent Decision Guide
-
-```
-Need to authenticate with Aliyun?
-├── From CI/CD pipeline → Environment variables (ALICLOUD_ACCESS_KEY/KEY)
-├── From local CLI → aliyun configure (interactive)
-├── From function code → Service credentials (automatic injection)
-├── From browser/client → STS token (temporary)
-└── Never commit credentials to git
-```
-
-## Environment Variables
-
-### For CLI and Server-Side
-
-```bash
-# Access Key
-export ALICLOUD_ACCESS_KEY=your-access-key-id
-export ALICLOUD_SECRET_KEY=your-access-key-secret
-
-# Region
-export ALICLOUD_REGION=cn-shanghai
-```
-
-### For Function Compute
-
-Functions automatically receive credentials via:
-- `ALIBABA_CLOUD_ACCESS_KEY_ID` (injected)
-- `ALIBABA_CLOUD_ACCESS_KEY_SECRET` (injected)
-- `ALIBABA_CLOUD_SECURITY_TOKEN` (for STS)
-
-## Creating Access Keys
-
-### 1. Create via RAM Console
-
-1. Go to [RAM Console](https://ram.console.aliyun.com/)
-2. Navigate to: Users → Create User
-3. Create AccessKey (or enable console password)
-4. Download CSV with AK/SK
-
-### 2. Create RAM Policy
-
-```json
-{
-  "Version": "1",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": [
-        "fc:InvokeFunction",
-        "fc:CreateFunction",
-        "oss:GetObject",
-        "oss:PutObject"
-      ],
-      "Resource": "*"
-    }
-  ]
-}
-```
-
-## Temporary Credentials (STS)
-
-For short-lived access, use STS tokens:
-
-### Get STS Token
-
-```javascript
-const OSS = require('ali-oss');
-const STS = require('aliyun-sdk').STS;
-
-const sts = new STS({
-  accessKeyId: process.env.ALICLOUD_ACCESS_KEY,
-  accessKeySecret: process.env.ALICLOUD_SECRET_KEY
-});
-
-const result = await sts.assumeRole({
-  RoleArn: 'acs:ram::123456789:role/DeveloperRole',
-  RoleSessionName: 'dev-session'
-});
-```
-
-### STS Token Response
-
-```json
-{
-  "Credentials": {
-    "AccessKeyId": "STS.xxx",
-    "AccessKeySecret": "xxx",
-    "SecurityToken": "xxx",
-    "Expiration": "2024-01-01T12:00:00Z"
-  }
-}
-```
-
-### Use STS Token
-
-```javascript
-const client = new OSS({
-  region: process.env.ALICLOUD_REGION,
-  accessKeyId: credentials.AccessKeyId,
-  accessKeySecret: credentials.AccessKeySecret,
-  stsToken: credentials.SecurityToken,
-  bucket: 'my-bucket'
-});
-```
-
-## RAM Role for Functions
-
-### Create RAM Role
-
-1. Go to RAM Console → Roles → Create Role
-2. Select "Aliyun Service" trusted entity
-3. Attach policies (e.g., AliyunOSSFullAccess)
-
-### Function Use Role
-
-```yaml
-service:
-  name: my-service
-  role: acs:ram::123456789:role/FCServiceRole
-```
-
-Function will automatically receive temporary credentials.
-
-## Credential Security Best Practices
-
-### Do's ✅
-
-1. **Use environment variables** - Don't hardcode credentials
-2. **Use RAM roles** - Over direct AccessKeys
-3. **Use STS for temporary access** - Credentials expire
-4. **Rotate regularly** - Change AccessKeys periodically
-5. **Use least privilege** - Grant minimum required permissions
-6. **Store in secrets manager** - GitHub Secrets, KMS, etc.
-
-### Don'ts ❌
-
-1. **Commit credentials** - Never commit to git
-2. **Use root account** - Create dedicated RAM users
-3. **Share credentials** - Each user/service should have own key
-4. **Use same credentials everywhere** - Separate per environment
-
-## .gitignore for Credentials
-
-```
-# Aliyun credentials
-.env
-.env.*
-aliyun-cli-config.json
-ossutil-config.ini
-
-# Function compute
-.template.yml.bak
-
-# Build outputs
-dist/
-build/
-```
-
-## Function Authentication
-
-### How Functions Receive Credentials
-
-FC functions automatically have credentials injected:
-
-```javascript
-module.exports.handler = async (event, context) => {
-  // Available automatically in FC functions
-  const accessKeyId = process.env.ALIBABA_CLOUD_ACCESS_KEY_ID;
-  const accessKeySecret = process.env.ALIBABA_CLOUD_ACCESS_KEY_SECRET;
-  const securityToken = process.env.ALIBABA_CLOUD_SECURITY_TOKEN;
-
-  console.log(`Running with credentials for account`);
-};
-```
-
-### Calling Aliyun Services from Functions
-
-```javascript
-const OSS = require('ali-oss');
-
-module.exports.handler = async (event, context) => {
-  // Use injected credentials
-  const client = new OSS({
-    region: process.env.ALICLOUD_REGION,
-    accessKeyId: process.env.ALIBABA_CLOUD_ACCESS_KEY_ID,
-    accessKeySecret: process.env.ALIBABA_CLOUD_ACCESS_KEY_SECRET,
-    stsToken: process.env.ALIBABA_CLOUD_SECURITY_TOKEN,
-    bucket: 'my-bucket'
-  });
-
-  const result = await client.list();
-  return { buckets: result.buckets };
-};
-```
-
-## Permission Model (RAM)
-
-### Common Policies
-
-| Policy | Description |
-|--------|-------------|
-| `AliyunFCFullAccess` | Full Function Compute access |
-| `AliyunOSSFullAccess` | Full OSS access |
-| `AliyunRDSFullAccess` | Full RDS access |
-| `AliyunOTSFullAccess` | Full TableStore access |
-| `AliyunCDNFullAccess` | Full CDN access |
-
-### Custom Policy Example
-
-```json
-{
-  "Version": "1",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": [
-        "oss:GetObject",
-        "oss:PutObject",
-        "oss:DeleteObject"
-      ],
-      "Resource": "acs:oss:*:*:my-bucket/*"
-    },
-    {
-      "Effect": "Allow",
-      "Action": [
-        "fc:InvokeFunction"
-      ],
-      "Resource": "acs:fc:*:*:services/my-service/functions/*"
-    }
-  ]
-}
-```
-
-## Troubleshooting
-
-| Issue | Cause | Solution |
-|-------|-------|----------|
-| `InvalidAccessKeyId` | Wrong or expired key | Verify AccessKey in RAM console |
-| `SignatureDoesNotMatch` | Key mismatch | Check AccessKey Secret |
-| `Permission denied` | Insufficient permissions | Attach more RAM policies |
-| `Token expired` | STS token too old | Refresh temporary credentials |
-
-For general troubleshooting → `../best-practices/troubleshooting.md`

package/ai-dlc-skill/providers/aliyun/services/cdn-hosting.md

@@ -1,220 +0,0 @@
-# CDN + Static Website Hosting
-
-## When to Use CDN Hosting
-
-**Use CDN + OSS when:**
-- Deploy static websites (SPA, static sites)
-- Host web assets with global acceleration
-- Serve content with low latency worldwide
-- Need automatic HTTPS and custom domains
-
-**Do NOT use CDN+OSS when:**
-- Need server-side business logic → Use Function Compute
-- Need real-time features → Use Function Compute + WebSocket
-- Complex dynamic content → Use SAE or ECS
-
-## Agent Decision Guide
-
-```
-Need to serve web content?
-├── Static site (HTML/CSS/JS) → OSS + CDN
-├── SPA with API backend → OSS + CDN + Function Compute
-└── Full web app with SSR → SAE
-```
-
-## Hosting Features
-
-| Feature | Description |
-|---------|-------------|
-| Global CDN | 200+ edge nodes worldwide |
-| Automatic HTTPS | Free SSL certificates via Alibaba Cloud CDN |
-| Custom Domain | Bring your own domain |
-| SPA Routing | Rewrites all 404s to index.html |
-| Cache Control | Per-file cache headers |
-| CI/CD Integration | Auto-deploy on git push |
-
-## Deployment
-
-### Basic Deployment
-
-```bash
-# Upload to OSS
-ossutil cp -r ./dist oss://my-bucket/ --update
-
-# Refresh CDN
-aliyun cdn RefreshObjectCaches --ObjectType File \
-  --ObjectPath http://my-bucket.oss-cn-shanghai.aliyuncs.com/
-```
-
-### Using serverless devs
-
-```yaml
-edition: 1.0.0
-services:
-  web:
-    component: website
-    props:
-      bucket: my-bucket
-      region: cn-shanghai
-      dist: ./dist
-      cacheControl: 31536000
-```
-
-```bash
-s deploy
-```
-
-## URL Structure
-
-| Environment | URL Pattern |
-|-------------|-------------|
-| OSS Origin | `https://{bucket}.{region}.aliyuncs.com` |
-| CDN Domain | `https://{cdn-domain}` |
-| Custom Domain | `https://{custom-domain}` |
-
-## SPA Configuration
-
-### How SPA Routing Works
-
-For Single Page Applications (Vue, React, Angular):
-
-1. All requests to non-file paths are rewritten to `index.html`
-2. Client-side router handles path rendering
-3. Direct links and refresh work correctly
-
-### CDN Cache Configuration
-
-```bash
-# Set cache rules
-aliyun cdn SetFileCacheConfig --CacheType 30 \
-  --CacheUrlPropertyList "*.js,*.css,*.png"
-```
-
-### Default Cache Behavior
-
-| File Type | Cache Duration |
-|-----------|----------------|
-| HTML | No cache (or short) |
-| JS/CSS | 1 year (immutable with hash) |
-| Images | 1 week |
-| Other | 1 day |
-
-## Custom Domain
-
-### Add CDN Domain
-
-```bash
-aliyun cdn AddCdnDomain \
-  --DomainName example.com \
-  --CdnType web \
-  --SourceType oss \
-  --SourceDomain my-bucket.oss-cn-shanghai.aliyuncs.com
-```
-
-### Configure DNS
-
-Add CNAME record:
-```
-Type: CNAME
-Host: example.com
-Value: example.com.w.kunlungr.com
-```
-
-### SSL Certificate
-
-```bash
-# Add SSL certificate
-aliyun cdn SetCdnDomainSSLCertificate \
-  --DomainName example.com \
-  --CertType upload \
-  --SSLProtocol true \
-  --CertFile /path/to/cert.pem \
-  --KeyFile /path/to/key.pem
-```
-
-## Build Environment Injection
-
-Inject environment-specific values at build time:
-
-```bash
-# Set environment variable during build
-BACKEND_URL=https://api.example.com pnpm --filter web build
-```
-
-This makes variables available during the build process (Vite, Webpack, etc.).
-
-## Integration with Backend
-
-### Pattern: Frontend + Function Compute API
-
-```
-┌─────────────────────────────────────────────────────────────┐
-│                     Browser                                  │
-│   ┌──────────────────────────────────────────────────────┐  │
-│   │  Frontend App (OSS + CDN)                            │  │
-│   │  - Loads config from window.__ENV__                  │  │
-│   │  - Calls API via BACKEND_URL                         │  │
-│   └──────────────────────────────────────────────────────┘  │
-└─────────────────────────────────────────────────────────────┘
-                              │
-                              ▼
-┌─────────────────────────────────────────────────────────────┐
-│              Function Compute (API Gateway)                  │
-│   - /api/users → getUsers()                                 │
-│   - /api/orders → createOrder()                             │
-└─────────────────────────────────────────────────────────────┘
-                              │
-                              ▼
-┌─────────────────────────────────────────────────────────────┐
-│                   RDS + TableStore                          │
-└─────────────────────────────────────────────────────────────┘
-```
-
-### Build with Backend URL
-
-```bash
-# Deploy web with BACKEND_URL injected
-cd apps/web && BACKEND_URL=$STACK_URL pnpm build
-
-# Upload to OSS
-ossutil cp -r ./dist oss://my-bucket/ --update
-
-# Refresh CDN cache
-aliyun cdn RefreshObjectCaches --ObjectType directory \
-  --ObjectPath http://my-bucket.oss-cn-shanghai.aliyuncs.com/
-```
-
-## CLI Reference
-
-| Command | Description |
-|---------|-------------|
-| `ossutil cp -r ./dist oss://bucket/` | Upload static files |
-| `ossutil website oss://bucket --index index.html` | Set index page |
-| `aliyun cdn RefreshObjectCaches` | Refresh CDN cache |
-| `aliyun cdn DescribeCdnDomainDetail` | Get domain info |
-| `aliyun cdn AddCdnDomain` | Add CDN domain |
-| `aliyun cdn SetCdnDomainSSLCertificate` | Set SSL certificate |
-
-## Best Practices
-
-1. **Use build tools** - Don't deploy raw HTML, use Vite/Webpack
-2. **Enable gzip/brotli** - Configure in build tool for smaller assets
-3. **Use immutable hashes** - Filename hashes for cache busting
-4. **Optimize images** - Compress images, use WebP format
-5. **Set long cache for assets** - JS/CSS with content hash
-6. **SPA routing** - Ensure all routes serve index.html
-7. **CDN cache** - Use cache invalidation on deploy
-8. **Separate buckets** - Dev/staging/prod different buckets
-
-## Troubleshooting
-
-| Issue | Cause | Solution |
-|-------|-------|----------|
-| 404 on refresh (SPA) | CDN caching old routing | Refresh CDN after deploy |
-| Stale content | Cache not cleared | Refresh CDN or use versioned paths |
-| Slow first load | Large bundle | Code split, lazy load routes |
-| CORS errors | API not allowing origin | Configure CORS in Function Compute |
-| CDN not working | DNS not propagated | Wait for CNAME to propagate |
-| SSL not ready | Certificate provisioning | Wait 1-10 minutes |
-
-For detailed troubleshooting → `../best-practices/troubleshooting.md`