@wdyy/skills 0.1.10 → 0.1.12

package/.well-known/skills/wdyy-deployment-standard/scripts/validate-deployment-package.mjs

@@ -3,21 +3,21 @@ import { createHash } from 'node:crypto';
 import { lstat, readFile, readdir, stat } from 'node:fs/promises';
 import { basename, join, relative, resolve, sep } from 'node:path';
 
-const [deployPath, nginxPath, composePath, packageRoot] = process.argv.slice(2);
-if (!deployPath || !nginxPath || !composePath || !packageRoot) {
-  throw new Error('Pass deploy.sh, Nginx template, Compose file and generated deploy directory paths');
+const [deployPath, composePath, packageRoot] = process.argv.slice(2);
+if (!deployPath || !composePath || !packageRoot || process.argv.length !== 5) {
+  throw new Error('Pass deploy.sh, Compose file and generated deploy directory paths');
 }
 
-const [deploy, nginx, compose] = await Promise.all([
-  readFile(deployPath, 'utf8'),
-  readFile(nginxPath, 'utf8'),
-  readFile(composePath, 'utf8'),
-]);
+const [deploy, compose] = await Promise.all([readFile(deployPath, 'utf8'), readFile(composePath, 'utf8')]);
 
 function requirePattern(text, pattern, message) {
   if (!pattern.test(text)) throw new Error(message);
 }
 
+function assertDeepEqual(actual, expected, message) {
+  if (JSON.stringify(actual) !== JSON.stringify(expected)) throw new Error(`${message}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`);
+}
+
 function parseDotenv(text) {
   const values = new Map();
   for (const [index, raw] of text.replaceAll('\r\n', '\n').split('\n').entries()) {
@@ -26,154 +26,98 @@ function parseDotenv(text) {
     if (!match) throw new Error(`Invalid root .env line ${index + 1}`);
     if (values.has(match[1])) throw new Error(`Duplicate root .env key: ${match[1]}`);
     let value = match[2];
-    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
-      value = value.slice(1, -1);
-    } else if (value.startsWith('"') || value.startsWith("'")) {
-      throw new Error(`Unclosed root .env quote: ${match[1]}`);
-    }
+    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) value = value.slice(1, -1);
+    else if (value.startsWith('"') || value.startsWith("'")) throw new Error(`Unclosed root .env quote: ${match[1]}`);
     values.set(match[1], value);
   }
   return values;
 }
 
-const commands = ['build', 'start', 'replace', 'restart', 'stop', 'remove', 'status', 'rollback'];
-for (const command of commands) {
-  requirePattern(deploy, new RegExp(`^  ${command}\\)`, 'm'), `Missing deployment command: ${command}`);
-}
-for (const command of commands.filter((item) => item !== 'rollback')) {
-  requirePattern(
-    deploy,
-    new RegExp(`^  ${command}\\) \\[\\[ "\\$#" -eq 1 \\]\\] \\|\\| usage;`, 'm'),
-    `${command} must reject extra arguments`,
-  );
-}
-requirePattern(deploy, /^  rollback\) \[\[ "\$#" -eq 2 \]\] \|\| usage;/m, 'rollback must require exactly one version');
-
-const requiredDeploySemantics = [
-  /release_ledger next/,
-  /pnpm test/,
-  /pnpm lint/,
-  /pnpm typecheck/,
-  /pnpm build/,
-  /frontend_image="\$\{PROJECT_NAME\}_frontend:\$version"/,
-  /backend_image="\$\{PROJECT_NAME\}_backend:\$version"/,
-  /docker save -o "\$version_root\/frontend-image\.tar"/,
-  /docker save -o "\$version_root\/backend-image\.tar"/,
-  /load_dotenv "\$DEPLOY_ROOT\/\.env"/,
-  /endpoint_url "\$DOCKER_BIND_IP"/,
-  /server deploy root must be exactly/,
-  /assert_project_ports_isolated/,
-  /flock -x 9/,
-  /Nginx reload failed; old project configuration restored/,
-  /database migration was not executed/,
-  /docker ps -aq --filter "label=com\.docker\.compose\.project=\$PROJECT_NAME"/,
-  /\$1 == frontend \|\| \$1 == backend/,
-];
-for (const pattern of requiredDeploySemantics) requirePattern(deploy, pattern, `Missing deployment behavior: ${pattern}`);
-if (/\bsource\s+["']?[^\n]*(?:\.env|ACTIVE_STATE|PREVIOUS_STATE)/.test(deploy)) {
-  throw new Error('Environment and state files must be parsed as data, not sourced');
-}
+for (const [pattern, message] of [
+  [/if \[\[ "\$#" -eq 0 \]\]; then server_menu/, 'No-argument execution must open the server menu'],
+  [/elif \[\[ "\$#" -eq 1 && "\$1" == build \]\]; then build_release/, 'build must be the only command-line operation'],
+  [/'1\. 运行或替换前端'/, 'Missing frontend menu item'],
+  [/'2\. 运行或替换后端'/, 'Missing backend menu item'],
+  [/'3\. 运行或替换前后端'/, 'Missing dual-service menu item'],
+  [/'4\. 停止'/, 'Missing stop menu item'],
+  [/docker save -o "\$version_root\/frontend-image\.tar"/, 'Missing frontend image export'],
+  [/docker save -o "\$version_root\/backend-image\.tar"/, 'Missing backend image export'],
+  [/frontend_image="\$\{PROJECT_NAME\}_frontend:\$version"/, 'Missing versioned frontend image name'],
+  [/backend_image="\$\{PROJECT_NAME\}_backend:\$version"/, 'Missing versioned backend image name'],
+  [/compose up -d --force-recreate --no-deps frontend/, 'Frontend operation must only recreate frontend'],
+  [/compose up -d --force-recreate --no-deps backend/, 'Backend operation must only recreate backend'],
+  [/compose up -d --force-recreate frontend backend/, 'Combined operation must recreate both services'],
+  [/compose stop frontend backend/, 'Stop operation must stop both services'],
+  [/logs\/deploy\.log/, 'Server operations must write deploy.log'],
+  [/pnpm test/, 'Missing test release gate'],
+  [/pnpm lint/, 'Missing lint release gate'],
+  [/pnpm typecheck/, 'Missing typecheck release gate'],
+  [/pnpm build/, 'Missing build release gate'],
+]) requirePattern(deploy, pattern, message);
+
+if (/^\s*(?:start|replace|restart|remove|status|rollback)\)/m.test(deploy)) throw new Error('Legacy server commands are forbidden');
+if (/\bsource\s+["']?[^\n]*\.env/.test(deploy)) throw new Error('Environment files must be parsed as data, not sourced');
 if (/\beval\b/.test(deploy)) throw new Error('deploy.sh must not use eval');
 if (/\bpsql\b/.test(deploy)) throw new Error('deploy.sh must not execute database clients');
 if (/\b(?:scp|rsync)\b|\bgit\s+(?:pull|clone)\b/.test(deploy)) throw new Error('deploy.sh must not upload or pull artifacts');
-if (/(?:^|[\s"'])\/srv\//m.test(`${deploy}\n${nginx}\n${compose}`)) throw new Error('Fixed /srv deployment roots are forbidden');
+if (/(?:^|[\s"'])\/srv\//m.test(`${deploy}\n${compose}`)) throw new Error('Fixed /srv deployment roots are forbidden');
+if (/nginx\s+-(?:t|s)|active-upstreams|ACTIVE_COLOR|PREVIOUS_COLOR/.test(deploy)) throw new Error('Host Nginx and blue-green state are forbidden');
 
 const serviceNames = [...compose.matchAll(/^  ([a-z-]+):$/gm)].map((match) => match[1]);
-assertDeepEqual(serviceNames, ['frontend-blue', 'backend-blue', 'frontend-green', 'backend-green'], 'Compose must define exactly four ordered blue-green services');
+assertDeepEqual(serviceNames, ['frontend', 'backend'], 'Compose must define exactly two ordered services');
 if (compose.includes(':-') || compose.includes('not-configured')) throw new Error('Compose image fallback is forbidden');
-if ((compose.match(/image: \$\{FRONTEND_IMAGE:\?FRONTEND_IMAGE is required\}/g) ?? []).length !== 2) throw new Error('Both frontend services must require FRONTEND_IMAGE');
-if ((compose.match(/image: \$\{BACKEND_IMAGE:\?BACKEND_IMAGE is required\}/g) ?? []).length !== 2) throw new Error('Both backend services must require BACKEND_IMAGE');
-if ((compose.match(/env_file: \.\.\/\.\.\/\.env/g) ?? []).length !== 4) throw new Error('All four services must use root .env');
-const logMounts = compose.match(/^\s*- \.\.\/\.\.\/logs:\/app\/logs\s*$/gm) ?? [];
-if (logMounts.length !== 4) throw new Error('All four services must mount flat project-root logs');
-if (/LOG_DIR|HOST_LOG_DIR|logs\/(?:frontend|backend|blue|green)/.test(compose)) throw new Error('Configurable or nested log directories are forbidden');
-if (/container_name:/.test(compose)) throw new Error('container_name would weaken Compose project isolation');
-if (/FRONTEND_CONTAINER_PORT|BACKEND_CONTAINER_PORT|BACKEND_LISTEN_HOST|_HEALTH_URL|_VERSION_URL/.test(compose)) {
-  throw new Error('Compose contains legacy duplicate URL or port configuration');
-}
-for (const key of ['FRONTEND_PORT', 'BACKEND_PORT', 'FRONTEND_URL', 'BACKEND_URL']) {
-  if (!compose.includes(`\${${key}}`)) throw new Error(`Compose must use ${key}`);
-}
-
-for (const placeholder of ['__PROJECT_NAME__', '__PROJECT_HTTP_PORT__', '__DOCKER_HOST_PORTS__', '__DEPLOY_ROOT__', '__FRONTEND_UPSTREAM_NAME__', '__BACKEND_UPSTREAM_NAME__']) {
-  if (!nginx.includes(placeholder)) throw new Error(`Nginx template is missing ${placeholder}`);
-}
-if (!/^# wdyy-project: __PROJECT_NAME__$/m.test(nginx) || !/^# wdyy-port: __PROJECT_HTTP_PORT__$/m.test(nginx) || !/^# wdyy-docker-ports: __DOCKER_HOST_PORTS__$/m.test(nginx)) {
-  throw new Error('Nginx template must expose deterministic project and all port markers');
-}
-if (/listen\s+\d+/.test(nginx) || /proxy_pass\s+https?:\/\/(?!__)/.test(nginx)) throw new Error('Nginx URL or port is hardcoded');
+if ((compose.match(/image: \$\{FRONTEND_IMAGE:\?FRONTEND_IMAGE is required\}/g) ?? []).length !== 1) throw new Error('Frontend must require FRONTEND_IMAGE');
+if ((compose.match(/image: \$\{BACKEND_IMAGE:\?BACKEND_IMAGE is required\}/g) ?? []).length !== 1) throw new Error('Backend must require BACKEND_IMAGE');
+if ((compose.match(/env_file: \.\.\/\.\.\/\.env/g) ?? []).length !== 2) throw new Error('Both services must use root .env');
+if ((compose.match(/^\s*- \.\.\/\.\.\/logs:\/app\/logs\s*$/gm) ?? []).length !== 2) throw new Error('Both services must mount flat project-root logs');
+if (!compose.includes('"${DOCKER_BIND_IP}:${FRONTEND_PORT}:${FRONTEND_PORT}"')) throw new Error('Frontend must directly expose FRONTEND_PORT');
+if (!compose.includes('"${DOCKER_BIND_IP}:${BACKEND_PORT}:${BACKEND_PORT}"')) throw new Error('Backend must directly expose BACKEND_PORT');
+if (/LOG_DIR|HOST_LOG_DIR|logs\/(?:frontend|backend|blue|green)|container_name:/.test(compose)) throw new Error('Configurable, nested logs or container_name are forbidden');
+if (/frontend-(?:blue|green)|backend-(?:blue|green)|PROJECT_HTTP_PORT|_(?:BLUE|GREEN)_PORT|nginx\/site/.test(compose)) throw new Error('Blue-green or host Nginx Compose configuration is forbidden');
 
 const rootEnvPath = join(packageRoot, '.env');
 const rootEnvStat = await stat(rootEnvPath);
-if (!rootEnvStat.isFile() || (rootEnvStat.mode & 0o077) !== 0 || (rootEnvStat.mode & 0o400) === 0) {
-  throw new Error('Root .env must be a private owner-readable file');
-}
+if (!rootEnvStat.isFile() || (rootEnvStat.mode & 0o077) !== 0 || (rootEnvStat.mode & 0o400) === 0) throw new Error('Root .env must be a private owner-readable file');
 const rootEnvText = await readFile(rootEnvPath, 'utf8');
 const env = parseDotenv(rootEnvText);
 const sectionNames = [...rootEnvText.matchAll(/^# (前端|后端|数据库|API|部署)$/gm)].map((match) => match[1]);
 if (sectionNames.join('|') !== '前端|后端|数据库|API|部署') throw new Error('Root .env must use the five standard sections in order');
-const requiredEnv = [
-  'FRONTEND_URL', 'FRONTEND_PORT', 'BACKEND_URL', 'BACKEND_PORT', 'DB_PORT',
-  'PROJECT_NAME', 'SERVER_PROJECTS_ROOT', 'PROJECT_HTTP_PORT', 'DOCKER_BIND_IP',
-  'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT',
-  'FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE', 'DATABASE_MIGRATION_MODE',
-];
-for (const key of requiredEnv) if (!env.get(key)) throw new Error(`Root .env is missing ${key}`);
+for (const key of ['FRONTEND_URL', 'FRONTEND_PORT', 'BACKEND_URL', 'BACKEND_PORT', 'DB_PORT', 'PROJECT_NAME', 'DOCKER_BIND_IP', 'FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE']) {
+  if (!env.get(key)) throw new Error(`Root .env is missing ${key}`);
+}
 for (const key of env.keys()) {
-  if (['FRONTEND_CONTAINER_PORT', 'BACKEND_CONTAINER_PORT', 'BACKEND_LISTEN_HOST'].includes(key) || /_(?:HEALTH|VERSION)_URL$/.test(key)) {
-    throw new Error(`Root .env contains legacy duplicate configuration: ${key}`);
+  if (['PROJECT_HTTP_PORT', 'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT', 'SERVER_PROJECTS_ROOT', 'NGINX_SOURCE', 'LOG_DIR', 'HOST_LOG_DIR', 'FRONTEND_CONTAINER_PORT', 'BACKEND_CONTAINER_PORT', 'BACKEND_LISTEN_HOST', 'DATABASE_MIGRATION_MODE', 'MIGRATIONS_SOURCE', 'MIGRATION_RUNNER_SOURCE'].includes(key) || /_(?:HEALTH|VERSION)_URL$/.test(key)) {
+    throw new Error(`Root .env contains removed deployment configuration: ${key}`);
   }
 }
 if (!/^[a-z][a-z0-9_]*$/.test(env.get('PROJECT_NAME'))) throw new Error('Invalid PROJECT_NAME');
-if (!/^\/.+[^/]$/.test(env.get('SERVER_PROJECTS_ROOT'))) throw new Error('Invalid SERVER_PROJECTS_ROOT');
-for (const key of ['FRONTEND_URL', 'BACKEND_URL', 'DOCKER_BIND_IP']) {
-  if (!/^[A-Za-z0-9:.%-]+$/.test(env.get(key))) throw new Error(`${key} contains unsafe characters`);
-}
-const migrationMode = env.get('DATABASE_MIGRATION_MODE');
-if (!['manual', 'none'].includes(migrationMode)) throw new Error('DATABASE_MIGRATION_MODE must be manual or none');
-if (env.has('LOG_DIR') || env.has('HOST_LOG_DIR')) throw new Error('Root .env must not configure log directories');
-const allPortKeys = ['FRONTEND_PORT', 'BACKEND_PORT', 'DB_PORT', 'PROJECT_HTTP_PORT', 'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT'];
-for (const key of allPortKeys) {
+for (const key of ['FRONTEND_URL', 'BACKEND_URL', 'DOCKER_BIND_IP']) if (!/^[A-Za-z0-9:.%-]+$/.test(env.get(key))) throw new Error(`${key} contains unsafe characters`);
+for (const key of ['FRONTEND_PORT', 'BACKEND_PORT', 'DB_PORT']) {
   const port = Number(env.get(key));
   if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error(`${key} must be a valid port`);
 }
-const hostPortKeys = ['PROJECT_HTTP_PORT', 'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT'];
-const hostPorts = hostPortKeys.map((key) => Number(env.get(key)));
-if (hostPorts.some((port) => !Number.isInteger(port) || port < 1 || port > 65535) || new Set(hostPorts).size !== hostPorts.length) {
-  throw new Error('Project and host blue-green ports must be valid and unique');
-}
+if (env.get('FRONTEND_PORT') === env.get('BACKEND_PORT')) throw new Error('Frontend and backend host ports must differ');
 
 const releaseEnv = await readFile(join(packageRoot, 'release.env'), 'utf8');
 const releaseMatch = releaseEnv.match(/^RELEASE_VERSION=(\d{8}-\d{3})\n$/);
 if (!releaseMatch) throw new Error('release.env must contain exactly one release version');
 const version = releaseMatch[1];
-const expectedRootEntries = ['.env', version, 'deploy.sh', 'release.env'].sort();
-assertDeepEqual((await readdir(packageRoot)).sort(), expectedRootEntries, 'Generated deploy root has unexpected entries');
+assertDeepEqual((await readdir(packageRoot)).sort(), ['.env', version, 'deploy.sh', 'release.env'].sort(), 'Generated deploy root has unexpected entries');
 if (resolve(deployPath) !== resolve(packageRoot, 'deploy.sh')) throw new Error('deploy.sh must be the package root script');
-if (resolve(nginxPath) !== resolve(packageRoot, version, 'nginx/site.conf')) throw new Error('Nginx path must be inside the selected version');
-if (resolve(composePath) !== resolve(packageRoot, version, 'docker/docker-compose.blue-green.yml')) throw new Error('Compose path must be inside the selected version');
+if (resolve(composePath) !== resolve(packageRoot, version, 'docker/docker-compose.yml')) throw new Error('Compose path must be inside the selected version');
 
 const versionRoot = join(packageRoot, version);
-const requiredPaths = ['frontend-image.tar', 'backend-image.tar', 'manifest.sha256', 'docker/docker-compose.blue-green.yml', 'nginx/site.conf'];
-for (const path of requiredPaths) {
+for (const path of ['frontend-image.tar', 'backend-image.tar', 'manifest.sha256', 'docker/docker-compose.yml']) {
   const info = await stat(join(versionRoot, path));
   if (!info.isFile()) throw new Error(`Required release path is not a file: ${path}`);
 }
-if (migrationMode === 'manual') {
-  const runner = await stat(join(versionRoot, 'database/apply-migrations.sh'));
-  if (!runner.isFile() || (runner.mode & 0o111) === 0) throw new Error('Manual migration runner must be executable');
-  const migrations = await readdir(join(versionRoot, 'database/migrations'));
-  if (!migrations.some((item) => /^V\d{3}__[a-z0-9]+(?:_[a-z0-9]+)*\.sql$/.test(item))) throw new Error('Manual migration files are missing');
-} else {
-  await assertMissing(join(versionRoot, 'database'), 'none mode must not package database files');
-}
+await assertMissing(join(versionRoot, 'database'), 'Release package must not contain database migration files');
+await assertMissing(join(versionRoot, 'nginx'), 'Release package must not contain host Nginx files');
 
 const versionFiles = (await listFiles(versionRoot)).sort();
 for (const path of versionFiles) {
   const name = basename(path);
-  if (name === '.env' || name.startsWith('.env.') || /\.(?:pem|key)$/.test(name) || /^(?:id_rsa|id_ed25519|credentials(?:\..*)?)$/.test(name)) {
-    throw new Error(`Secret file must not enter version directory: ${path}`);
-  }
+  if (name === '.env' || name.startsWith('.env.') || /\.(?:pem|key)$/.test(name) || /^(?:id_rsa|id_ed25519|credentials(?:\..*)?)$/.test(name)) throw new Error(`Secret file must not enter version directory: ${path}`);
 }
 const manifest = await readFile(join(versionRoot, 'manifest.sha256'), 'utf8');
 const entries = new Map();
@@ -189,13 +133,7 @@ for (const [path, expected] of entries) {
   if (actual !== expected) throw new Error(`Checksum mismatch: ${path}`);
 }
 
-process.stdout.write(`valid dual-image deployment package ${version}\n`);
-
-function assertDeepEqual(actual, expected, message) {
-  if (JSON.stringify(actual) !== JSON.stringify(expected)) {
-    throw new Error(`${message}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`);
-  }
-}
+process.stdout.write(`valid direct dual-image deployment package ${version}\n`);
 
 async function assertMissing(path, message) {
   try { await lstat(path); } catch (error) { if (error.code === 'ENOENT') return; throw error; }