@wdyy/skills 0.1.11 → 0.1.13

package/.well-known/skills/wdyy-deployment-standard/scripts/generate-deployment-files.test.mjs

@@ -1,108 +1,120 @@
+import test from 'node:test';
 import assert from 'node:assert/strict';
-import { chmod, mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises';
+import { execFile } from 'node:child_process';
+import { chmod, mkdtemp, mkdir, readFile, rm, stat, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterEach, test } from 'node:test';
-import { spawnSync } from 'node:child_process';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
 
-const script = new URL('./generate-deployment-files.mjs', import.meta.url).pathname;
-const environmentTemplate = new URL('../templates/env.example.template', import.meta.url).pathname;
-const temporaryDirectories = [];
+const run = promisify(execFile);
+const script = join(dirname(fileURLToPath(import.meta.url)), 'generate-deployment-files.mjs');
+const created = [];
 
-afterEach(async () => {
-  await Promise.all(temporaryDirectories.splice(0).map((path) => rm(path, { recursive: true, force: true })));
-});
+const realEnv = `# 前端
+FRONTEND_URL=0.0.0.0
+FRONTEND_PORT=5173
+# 后端
+BACKEND_URL=0.0.0.0
+BACKEND_PORT=3000
+# 数据库
+DB_URL=db.internal
+DB_PORT=5432
+DB_USER=app
+DB_PASSWORD=secret
+DB_NAME=app
+DB_SCHEMA=public
+# API
+API_URL=
+# 部署
+`;
+const exampleEnv = `# 前端
+FRONTEND_URL=0.0.0.0
+FRONTEND_PORT=5173
+# 后端
+BACKEND_URL=0.0.0.0
+BACKEND_PORT=3000
+# 数据库
+DB_URL=
+DB_PORT=5432
+DB_USER=
+DB_PASSWORD=
+DB_NAME=
+DB_SCHEMA=
+# API
+API_URL=
+# 部署
+`;
 
-async function projectRoot() {
-  const root = await mkdtemp(join(tmpdir(), 'deployment-generator-'));
-  temporaryDirectories.push(root);
-  const template = await readFile(environmentTemplate, 'utf8');
-  const initializedEnvironment = `${template.slice(0, template.indexOf('# 部署') + '# 部署'.length)}\n`;
-  await writeFile(join(root, '.env'), initializedEnvironment, { mode: 0o600 });
-  await writeFile(join(root, '.env.example'), initializedEnvironment);
+async function fixture(env = realEnv, example = exampleEnv) {
+  const root = await mkdtemp(join(tmpdir(), 'wdyy-deploy-generator-'));
+  created.push(root);
+  await writeFile(join(root, '.env'), env, { mode: 0o600 });
+  await writeFile(join(root, '.env.example'), example, { mode: 0o644 });
   return root;
 }
 
-function run(root, ...args) {
-  return spawnSync(process.execPath, [script, '--target', root, ...args], { encoding: 'utf8' });
+async function invoke(root, ...args) {
+  return run(process.execPath, [script, '--target', root, ...args]);
 }
 
-test('确定性生成全部标准文件并通过 check', async () => {
-  const root = await projectRoot();
-  const generated = run(root, '--write');
-  assert.equal(generated.status, 0, generated.stderr);
-  const checked = run(root, '--check');
-  assert.equal(checked.status, 0, checked.stderr);
-  assert.match(checked.stdout, /verified deterministic deployment files/);
-  assert.match(await readFile(join(root, 'deploy.sh'), 'utf8'), /build\|start\|replace/);
-  const environment = await readFile(join(root, '.env'), 'utf8');
-  const example = await readFile(join(root, '.env.example'), 'utf8');
-  assert.match(environment, /^# 前端\nFRONTEND_URL=0\.0\.0\.0\nFRONTEND_PORT=5173$/m);
-  assert.match(environment, /^# 部署\nPROJECT_NAME=\nPROJECT_HTTP_PORT=/m);
-  assert.match(environment, /^FRONTEND_BASE_IMAGE=nginx:stable$/m);
-  assert.match(environment, /^BACKEND_BASE_IMAGE=node:24-alpine3\.24$/m);
-  assert.equal(example, environment);
-  if (process.platform !== 'win32') assert.equal((await stat(join(root, '.env'))).mode & 0o777, 0o600);
+test.after(async () => {
+  await Promise.all(created.map((path) => rm(path, { recursive: true, force: true })));
+});
+
+test('生成统一 Docker 交付文件并通过确定性检查', async () => {
+  const root = await fixture();
+  const result = await invoke(root, '--write');
+  assert.match(result.stdout, /generated unified Docker delivery files/);
+  for (const path of ['deploy.sh', '.dockerignore', 'src/frontend/Dockerfile', 'src/backend/Dockerfile', 'scripts/deployment/docker-compose.yml', 'scripts/deployment/frontend-container.conf.template']) {
+    assert.ok((await stat(join(root, path))).isFile(), path);
+  }
+  assert.equal((await stat(join(root, 'deploy.sh'))).mode & 0o777, 0o755);
+  assert.equal((await stat(join(root, '.env'))).mode & 0o777, 0o600);
+  assert.match(await readFile(join(root, '.env'), 'utf8'), /FRONTEND_BASE_IMAGE=nginx:stable/);
+  assert.match(await readFile(join(root, '.env.example'), 'utf8'), /BACKEND_BASE_IMAGE=node:24-alpine3\.24/);
+  const check = await invoke(root, '--check');
+  assert.match(check.stdout, /verified unified Docker delivery files/);
 });
 
-test('扩充部署段时保留 .env 的真实基础值', async () => {
-  const root = await projectRoot();
-  const envPath = join(root, '.env');
-  await writeFile(envPath, (await readFile(envPath, 'utf8')).replace('DB_PASSWORD=', 'DB_PASSWORD=private-value'), { mode: 0o600 });
-  const generated = run(root, '--write');
-  assert.equal(generated.status, 0, generated.stderr);
-  assert.match(await readFile(envPath, 'utf8'), /^DB_PASSWORD=private-value$/m);
+test('扩充部署段时完整保留真实环境值', async () => {
+  const root = await fixture();
+  await invoke(root, '--write');
+  const actual = await readFile(join(root, '.env'), 'utf8');
+  assert.match(actual, /DB_URL=db\.internal/);
+  assert.match(actual, /DB_PASSWORD=secret/);
+  assert.match(actual, /PROJECT_NAME=\nDOCKER_BIND_IP=\n/);
 });
 
 test('非标准环境文件被拒绝且不修改', async () => {
-  const root = await projectRoot();
-  const envPath = join(root, '.env');
-  await writeFile(envPath, (await readFile(envPath, 'utf8')).replace('# 数据库', '# 数据'), { mode: 0o600 });
-  const before = await readFile(envPath, 'utf8');
-  const generated = run(root, '--write');
-  assert.notEqual(generated.status, 0);
-  assert.match(generated.stderr, /section order/);
-  assert.equal(await readFile(envPath, 'utf8'), before);
+  const invalid = realEnv.replace('# 数据库\n', '');
+  const root = await fixture(invalid);
+  const before = await readFile(join(root, '.env'));
+  await assert.rejects(invoke(root, '--write'), /section order|inside a standard section/);
+  assert.deepEqual(await readFile(join(root, '.env')), before);
+  await assert.rejects(stat(join(root, 'deploy.sh')), { code: 'ENOENT' });
 });
 
-test('.env 与 .env.example 变量名不一致时拒绝修改', async () => {
-  const root = await projectRoot();
-  const examplePath = join(root, '.env.example');
-  await writeFile(examplePath, (await readFile(examplePath, 'utf8')).replace('# API\n', '# API\nAPI_URL=\n'));
-  const envBefore = await readFile(join(root, '.env'), 'utf8');
-  const exampleBefore = await readFile(examplePath, 'utf8');
-  const generated = run(root, '--write');
-  assert.notEqual(generated.status, 0);
-  assert.match(generated.stderr, /variable names must remain consistent/);
-  assert.equal(await readFile(join(root, '.env'), 'utf8'), envBefore);
-  assert.equal(await readFile(examplePath, 'utf8'), exampleBefore);
+test('环境变量集合不一致时拒绝修改', async () => {
+  const root = await fixture(realEnv, exampleEnv.replace('API_URL=', 'API_URL=\nAPI_TOKEN='));
+  await assert.rejects(invoke(root, '--write'), /variable names must remain consistent/);
+  await assert.rejects(stat(join(root, 'deploy.sh')), { code: 'ENOENT' });
 });
 
-test('差异文件默认拒绝覆盖，显式 force 后恢复一致', async () => {
-  const root = await projectRoot();
-  assert.equal(run(root, '--write').status, 0);
-  await writeFile(join(root, 'deploy.sh'), '# changed\n');
+test('差异生成文件默认拒绝覆盖，force 后恢复一致', async () => {
+  const root = await fixture();
+  await invoke(root, '--write');
+  await writeFile(join(root, 'deploy.sh'), '#!/bin/sh\nexit 9\n');
   await chmod(join(root, 'deploy.sh'), 0o755);
-  const refused = run(root, '--write');
-  assert.notEqual(refused.status, 0);
-  assert.match(refused.stderr, /Refusing to overwrite/);
-  assert.equal(await readFile(join(root, 'deploy.sh'), 'utf8'), '# changed\n');
-  const forced = run(root, '--write', '--force');
-  assert.equal(forced.status, 0, forced.stderr);
-  assert.equal(run(root, '--check').status, 0);
+  await assert.rejects(invoke(root, '--write'), /Refusing to overwrite differing deployment files/);
+  assert.equal(await readFile(join(root, 'deploy.sh'), 'utf8'), '#!/bin/sh\nexit 9\n');
+  await invoke(root, '--write', '--force');
+  await invoke(root, '--check');
 });
 
-test('重复或冲突参数被明确拒绝', async () => {
-  const root = await projectRoot();
-  const duplicateMode = run(root, '--write', '--check');
-  assert.notEqual(duplicateMode.status, 0);
-  assert.match(duplicateMode.stderr, /Exactly one of --write or --check is required/);
-
-  const duplicateTarget = spawnSync(
-    process.execPath,
-    [script, '--target', root, '--target', root, '--check'],
-    { encoding: 'utf8' },
-  );
-  assert.notEqual(duplicateTarget.status, 0);
-  assert.match(duplicateTarget.stderr, /Duplicate or missing --target argument/);
+test('非法参数和旧部署配置被明确拒绝', async () => {
+  const root = await fixture(realEnv.replace('# 部署\n', '# 部署\nRELEASE_VERSION=old\n'));
+  await assert.rejects(invoke(root, '--write'), /removed deployment configuration: RELEASE_VERSION/);
+  await assert.rejects(run(process.execPath, [script, '--target', root, '--write', '--check']), /Exactly one/);
+  await assert.rejects(run(process.execPath, [script, '--target', root, '--check', '--force']), /Usage/);
 });

package/.well-known/skills/wdyy-deployment-standard/scripts/validate-deployment-package.mjs

@@ -1,21 +1,18 @@
 #!/usr/bin/env node
 import { createHash } from 'node:crypto';
+import { execFile } from 'node:child_process';
 import { lstat, readFile, readdir, stat } from 'node:fs/promises';
-import { basename, join, relative, resolve, sep } from 'node:path';
+import { basename, join, resolve } from 'node:path';
+import { promisify } from 'node:util';
 
-const [deployPath, nginxPath, composePath, packageRoot] = process.argv.slice(2);
-if (!deployPath || !nginxPath || !composePath || !packageRoot) {
-  throw new Error('Pass deploy.sh, Nginx template, Compose file and generated deploy directory paths');
-}
-
-const [deploy, nginx, compose] = await Promise.all([
-  readFile(deployPath, 'utf8'),
-  readFile(nginxPath, 'utf8'),
-  readFile(composePath, 'utf8'),
-]);
+const run = promisify(execFile);
+const [packageArgument] = process.argv.slice(2);
+if (!packageArgument || process.argv.length !== 3) throw new Error('Usage: validate-deployment-package.mjs <extracted-package-root>');
+const packageRoot = resolve(packageArgument);
+const expectedFiles = ['.env', 'backend-image.tar', 'deploy.sh', 'docker-compose.yml', 'frontend-image.tar', 'manifest.sha256'];
 
-function requirePattern(text, pattern, message) {
-  if (!pattern.test(text)) throw new Error(message);
+function assert(condition, message) {
+  if (!condition) throw new Error(message);
 }
 
 function parseDotenv(text) {
@@ -26,176 +23,107 @@ function parseDotenv(text) {
     if (!match) throw new Error(`Invalid root .env line ${index + 1}`);
     if (values.has(match[1])) throw new Error(`Duplicate root .env key: ${match[1]}`);
     let value = match[2];
-    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
-      value = value.slice(1, -1);
-    } else if (value.startsWith('"') || value.startsWith("'")) {
-      throw new Error(`Unclosed root .env quote: ${match[1]}`);
-    }
+    if (value.includes('$(') || value.includes('`')) throw new Error(`Executable syntax is forbidden in root .env: ${match[1]}`);
+    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) value = value.slice(1, -1);
+    else if (value.startsWith('"') || value.startsWith("'")) throw new Error(`Unclosed root .env quote: ${match[1]}`);
     values.set(match[1], value);
   }
   return values;
 }
 
-const commands = ['build', 'start', 'replace', 'restart', 'stop', 'remove', 'status', 'rollback'];
-for (const command of commands) {
-  requirePattern(deploy, new RegExp(`^  ${command}\\)`, 'm'), `Missing deployment command: ${command}`);
-}
-for (const command of commands.filter((item) => item !== 'rollback')) {
-  requirePattern(
-    deploy,
-    new RegExp(`^  ${command}\\) \\[\\[ "\\$#" -eq 1 \\]\\] \\|\\| usage;`, 'm'),
-    `${command} must reject extra arguments`,
-  );
-}
-requirePattern(deploy, /^  rollback\) \[\[ "\$#" -eq 2 \]\] \|\| usage;/m, 'rollback must require exactly one version');
-
-const requiredDeploySemantics = [
-  /release_ledger next/,
-  /pnpm test/,
-  /pnpm lint/,
-  /pnpm typecheck/,
-  /pnpm build/,
-  /frontend_image="\$\{PROJECT_NAME\}_frontend:\$version"/,
-  /backend_image="\$\{PROJECT_NAME\}_backend:\$version"/,
-  /docker save -o "\$version_root\/frontend-image\.tar"/,
-  /docker save -o "\$version_root\/backend-image\.tar"/,
-  /load_dotenv "\$DEPLOY_ROOT\/\.env"/,
-  /endpoint_url "\$DOCKER_BIND_IP"/,
-  /flock -x 9/,
-  /Nginx reload failed; old project configuration restored/,
-  /docker ps -aq --filter "label=com\.docker\.compose\.project=\$PROJECT_NAME"/,
-  /\$1 == frontend \|\| \$1 == backend/,
-];
-for (const pattern of requiredDeploySemantics) requirePattern(deploy, pattern, `Missing deployment behavior: ${pattern}`);
-if (/\bsource\s+["']?[^\n]*(?:\.env|ACTIVE_STATE|PREVIOUS_STATE)/.test(deploy)) {
-  throw new Error('Environment and state files must be parsed as data, not sourced');
+async function requireRegular(path, label) {
+  const info = await lstat(path);
+  assert(info.isFile() && !info.isSymbolicLink(), `${label} must be a regular file`);
+  return info;
 }
-if (/\beval\b/.test(deploy)) throw new Error('deploy.sh must not use eval');
-if (/\bpsql\b/.test(deploy)) throw new Error('deploy.sh must not execute database clients');
-if (/\b(?:scp|rsync)\b|\bgit\s+(?:pull|clone)\b/.test(deploy)) throw new Error('deploy.sh must not upload or pull artifacts');
-if (/(?:^|[\s"'])\/srv\//m.test(`${deploy}\n${nginx}\n${compose}`)) throw new Error('Fixed /srv deployment roots are forbidden');
 
-const serviceNames = [...compose.matchAll(/^  ([a-z-]+):$/gm)].map((match) => match[1]);
-assertDeepEqual(serviceNames, ['frontend-blue', 'backend-blue', 'frontend-green', 'backend-green'], 'Compose must define exactly four ordered blue-green services');
-if (compose.includes(':-') || compose.includes('not-configured')) throw new Error('Compose image fallback is forbidden');
-if ((compose.match(/image: \$\{FRONTEND_IMAGE:\?FRONTEND_IMAGE is required\}/g) ?? []).length !== 2) throw new Error('Both frontend services must require FRONTEND_IMAGE');
-if ((compose.match(/image: \$\{BACKEND_IMAGE:\?BACKEND_IMAGE is required\}/g) ?? []).length !== 2) throw new Error('Both backend services must require BACKEND_IMAGE');
-if ((compose.match(/env_file: \.\.\/\.\.\/\.env/g) ?? []).length !== 4) throw new Error('All four services must use root .env');
-const logMounts = compose.match(/^\s*- \.\.\/\.\.\/logs:\/app\/logs\s*$/gm) ?? [];
-if (logMounts.length !== 4) throw new Error('All four services must mount flat project-root logs');
-if (/LOG_DIR|HOST_LOG_DIR|logs\/(?:frontend|backend|blue|green)/.test(compose)) throw new Error('Configurable or nested log directories are forbidden');
-if (/container_name:/.test(compose)) throw new Error('container_name would weaken Compose project isolation');
-if (/FRONTEND_CONTAINER_PORT|BACKEND_CONTAINER_PORT|BACKEND_LISTEN_HOST|_HEALTH_URL|_VERSION_URL/.test(compose)) {
-  throw new Error('Compose contains legacy duplicate URL or port configuration');
-}
-for (const key of ['FRONTEND_PORT', 'BACKEND_PORT', 'FRONTEND_URL', 'BACKEND_URL']) {
-  if (!compose.includes(`\${${key}}`)) throw new Error(`Compose must use ${key}`);
-}
-
-for (const placeholder of ['__PROJECT_NAME__', '__PROJECT_HTTP_PORT__', '__DEPLOY_ROOT__', '__FRONTEND_UPSTREAM_NAME__', '__BACKEND_UPSTREAM_NAME__']) {
-  if (!nginx.includes(placeholder)) throw new Error(`Nginx template is missing ${placeholder}`);
-}
-if (!/^# wdyy-project: __PROJECT_NAME__$/m.test(nginx) || !/^# wdyy-port: __PROJECT_HTTP_PORT__$/m.test(nginx)) {
-  throw new Error('Nginx template must expose deterministic project and port markers');
-}
-if (/listen\s+\d+/.test(nginx) || /proxy_pass\s+https?:\/\/(?!__)/.test(nginx)) throw new Error('Nginx URL or port is hardcoded');
-
-const rootEnvPath = join(packageRoot, '.env');
-const rootEnvStat = await stat(rootEnvPath);
-if (!rootEnvStat.isFile() || (rootEnvStat.mode & 0o077) !== 0 || (rootEnvStat.mode & 0o400) === 0) {
-  throw new Error('Root .env must be a private owner-readable file');
-}
-const rootEnvText = await readFile(rootEnvPath, 'utf8');
-const env = parseDotenv(rootEnvText);
-const sectionNames = [...rootEnvText.matchAll(/^# (前端|后端|数据库|API|部署)$/gm)].map((match) => match[1]);
-if (sectionNames.join('|') !== '前端|后端|数据库|API|部署') throw new Error('Root .env must use the five standard sections in order');
-const requiredEnv = [
-  'FRONTEND_URL', 'FRONTEND_PORT', 'BACKEND_URL', 'BACKEND_PORT', 'DB_PORT',
-  'PROJECT_NAME', 'PROJECT_HTTP_PORT', 'DOCKER_BIND_IP',
-  'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT',
-  'FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE',
-];
-for (const key of requiredEnv) if (!env.get(key)) throw new Error(`Root .env is missing ${key}`);
-for (const key of env.keys()) {
-  if (['FRONTEND_CONTAINER_PORT', 'BACKEND_CONTAINER_PORT', 'BACKEND_LISTEN_HOST', 'DATABASE_MIGRATION_MODE', 'MIGRATIONS_SOURCE', 'MIGRATION_RUNNER_SOURCE'].includes(key) || /_(?:HEALTH|VERSION)_URL$/.test(key)) {
-    throw new Error(`Root .env contains legacy duplicate configuration: ${key}`);
+const rootInfo = await stat(packageRoot);
+assert(rootInfo.isDirectory(), 'Package root must be a directory');
+const entries = await readdir(packageRoot, { withFileTypes: true });
+for (const entry of entries) {
+  if (entry.name === 'logs') {
+    assert(entry.isDirectory() && !entry.isSymbolicLink(), 'logs must be a regular directory');
+  } else {
+    assert(expectedFiles.includes(entry.name) && entry.isFile() && !entry.isSymbolicLink(), `Unexpected package entry: ${entry.name}`);
   }
 }
-if (!/^[a-z][a-z0-9_]*$/.test(env.get('PROJECT_NAME'))) throw new Error('Invalid PROJECT_NAME');
-for (const key of ['FRONTEND_URL', 'BACKEND_URL', 'DOCKER_BIND_IP']) {
-  if (!/^[A-Za-z0-9:.%-]+$/.test(env.get(key))) throw new Error(`${key} contains unsafe characters`);
-}
-if (env.has('LOG_DIR') || env.has('HOST_LOG_DIR')) throw new Error('Root .env must not configure log directories');
-const allPortKeys = ['FRONTEND_PORT', 'BACKEND_PORT', 'DB_PORT', 'PROJECT_HTTP_PORT', 'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT'];
-for (const key of allPortKeys) {
-  const port = Number(env.get(key));
-  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error(`${key} must be a valid port`);
-}
-const hostPortKeys = ['PROJECT_HTTP_PORT', 'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT'];
-const hostPorts = hostPortKeys.map((key) => Number(env.get(key)));
-if (hostPorts.some((port) => !Number.isInteger(port) || port < 1 || port > 65535) || new Set(hostPorts).size !== hostPorts.length) {
-  throw new Error('Project and host blue-green ports must be valid and unique');
-}
+for (const name of expectedFiles) await requireRegular(join(packageRoot, name), name);
 
-const releaseEnv = await readFile(join(packageRoot, 'release.env'), 'utf8');
-const releaseMatch = releaseEnv.match(/^RELEASE_VERSION=(\d{8}-\d{3})\n$/);
-if (!releaseMatch) throw new Error('release.env must contain exactly one release version');
-const version = releaseMatch[1];
-const expectedRootEntries = ['.env', version, 'deploy.sh', 'release.env'].sort();
-assertDeepEqual((await readdir(packageRoot)).sort(), expectedRootEntries, 'Generated deploy root has unexpected entries');
-if (resolve(deployPath) !== resolve(packageRoot, 'deploy.sh')) throw new Error('deploy.sh must be the package root script');
-if (resolve(nginxPath) !== resolve(packageRoot, version, 'nginx/site.conf')) throw new Error('Nginx path must be inside the selected version');
-if (resolve(composePath) !== resolve(packageRoot, version, 'docker/docker-compose.blue-green.yml')) throw new Error('Compose path must be inside the selected version');
-
-const versionRoot = join(packageRoot, version);
-const requiredPaths = ['frontend-image.tar', 'backend-image.tar', 'manifest.sha256', 'docker/docker-compose.blue-green.yml', 'nginx/site.conf'];
-for (const path of requiredPaths) {
-  const info = await stat(join(versionRoot, path));
-  if (!info.isFile()) throw new Error(`Required release path is not a file: ${path}`);
-}
-await assertMissing(join(versionRoot, 'database'), 'Release package must not contain database migration files');
-
-const versionFiles = (await listFiles(versionRoot)).sort();
-for (const path of versionFiles) {
-  const name = basename(path);
-  if (name === '.env' || name.startsWith('.env.') || /\.(?:pem|key)$/.test(name) || /^(?:id_rsa|id_ed25519|credentials(?:\..*)?)$/.test(name)) {
-    throw new Error(`Secret file must not enter version directory: ${path}`);
-  }
-}
-const manifest = await readFile(join(versionRoot, 'manifest.sha256'), 'utf8');
-const entries = new Map();
-for (const line of manifest.trimEnd().split('\n')) {
-  const match = line.match(/^([0-9a-f]{64})  ([^/].*)$/);
-  if (!match || match[2].split('/').includes('..')) throw new Error(`Invalid manifest entry: ${line}`);
-  if (entries.has(match[2])) throw new Error(`Duplicate manifest entry: ${match[2]}`);
-  entries.set(match[2], match[1]);
-}
-assertDeepEqual([...entries.keys()].sort(), versionFiles.filter((path) => path !== 'manifest.sha256'), 'Manifest coverage is incomplete');
-for (const [path, expected] of entries) {
-  const actual = createHash('sha256').update(await readFile(join(versionRoot, path))).digest('hex');
-  if (actual !== expected) throw new Error(`Checksum mismatch: ${path}`);
-}
-
-process.stdout.write(`valid dual-image deployment package ${version}\n`);
-
-function assertDeepEqual(actual, expected, message) {
-  if (JSON.stringify(actual) !== JSON.stringify(expected)) {
-    throw new Error(`${message}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`);
-  }
-}
-
-async function assertMissing(path, message) {
-  try { await lstat(path); } catch (error) { if (error.code === 'ENOENT') return; throw error; }
-  throw new Error(message);
+const envInfo = await requireRegular(join(packageRoot, '.env'), '.env');
+assert((envInfo.mode & 0o077) === 0 && (envInfo.mode & 0o400) !== 0, 'Root .env must be owner-readable with no group or other permissions');
+const envText = await readFile(join(packageRoot, '.env'), 'utf8');
+const env = parseDotenv(envText);
+const sections = [...envText.matchAll(/^# (前端|后端|数据库|API|部署)$/gm)].map((match) => match[1]);
+assert(sections.join('|') === '前端|后端|数据库|API|部署', 'Root .env must use the five standard sections in order');
+for (const key of ['FRONTEND_URL', 'FRONTEND_PORT', 'BACKEND_URL', 'BACKEND_PORT', 'DB_URL', 'DB_PORT', 'DB_USER', 'DB_PASSWORD', 'DB_NAME', 'DB_SCHEMA', 'PROJECT_NAME', 'DOCKER_BIND_IP', 'FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE']) {
+  assert(env.get(key), `Root .env is missing ${key}`);
 }
-
-async function listFiles(root, directory = root) {
-  const result = [];
-  for (const entry of await readdir(directory, { withFileTypes: true })) {
-    const path = join(directory, entry.name);
-    if (entry.isSymbolicLink()) throw new Error(`Release package must not contain symbolic links: ${relative(root, path)}`);
-    if (entry.isDirectory()) result.push(...await listFiles(root, path));
-    else if (entry.isFile()) result.push(relative(root, path).split(sep).join('/'));
-  }
-  return result;
+assert(/^[a-z][a-z0-9_]*$/.test(env.get('PROJECT_NAME')), 'Invalid PROJECT_NAME');
+for (const key of ['FRONTEND_PORT', 'BACKEND_PORT', 'DB_PORT']) {
+  const port = Number(env.get(key));
+  assert(Number.isInteger(port) && port >= 1 && port <= 65535, `${key} must be a valid port`);
 }
+assert(env.get('FRONTEND_PORT') !== env.get('BACKEND_PORT'), 'Frontend and backend ports must differ');
+for (const key of env.keys()) {
+  assert(!['PROJECT_HTTP_PORT', 'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT', 'SERVER_PROJECTS_ROOT', 'NGINX_SOURCE', 'LOG_DIR', 'HOST_LOG_DIR', 'FRONTEND_CONTAINER_PORT', 'BACKEND_CONTAINER_PORT', 'BACKEND_LISTEN_HOST', 'DATABASE_MIGRATION_MODE', 'MIGRATIONS_SOURCE', 'MIGRATION_RUNNER_SOURCE', 'RELEASE_VERSION'].includes(key) && !/_(?:HEALTH|VERSION)_URL$/.test(key), `Root .env contains removed configuration: ${key}`);
+}
+
+const deploy = await readFile(join(packageRoot, 'deploy.sh'), 'utf8');
+const compose = await readFile(join(packageRoot, 'docker-compose.yml'), 'utf8');
+for (const [pattern, message] of [
+  [/if \[\[ "\$#" -eq 0 \]\]; then server_deploy/, 'No-argument execution must deploy the complete stack'],
+  [/"\$1" == build/, 'Missing local build command'],
+  [/"\$1" == stop/, 'Missing stop command'],
+  [/"\$1" == status/, 'Missing status command'],
+  [/docker image inspect "\$FRONTEND_BASE_IMAGE"/, 'Frontend local base image must be checked'],
+  [/docker image inspect "\$BACKEND_BASE_IMAGE"/, 'Backend local base image must be checked'],
+  [/docker build --pull=false/g, 'Docker builds must disable pull'],
+  [/docker save -o "\$package_root\/frontend-image\.tar"/, 'Frontend image must be exported separately'],
+  [/docker save -o "\$package_root\/backend-image\.tar"/, 'Backend image must be exported separately'],
+  [/compose up -d --force-recreate --no-build --pull never --wait frontend backend/, 'Deploy must recreate and wait for both services without build or pull'],
+  [/compose stop frontend backend/, 'Stop must target both services'],
+  [/compose ps frontend backend/, 'Status must inspect both services'],
+]) assert(pattern.test(deploy), message);
+assert((deploy.match(/docker build --pull=false/g) ?? []).length === 2, 'Exactly two Docker builds must disable pull');
+assert(!/\bdocker\s+pull\b/.test(deploy), 'docker pull is forbidden');
+assert(!/\bsource\s+[^\n]*\.env|\beval\b/.test(deploy), 'Environment files must be parsed as data');
+assert(!/server_menu|运行或替换|read_release_pointer|release_ledger|AGENTS\.md/.test(deploy), 'Legacy menu or release ledger logic is forbidden');
+assert(!/\bpsql\b|\b(?:scp|rsync)\b|\bgit\s+(?:pull|clone)\b/.test(deploy), 'Database, upload or source-pull commands are forbidden');
+assert(!/(?:^|[\s"'])\/srv\//m.test(`${deploy}\n${compose}`), 'Fixed server roots are forbidden');
+
+const serviceNames = [...compose.matchAll(/^  ([a-z][a-z0-9_-]*):$/gm)].map((match) => match[1]);
+assert(JSON.stringify(serviceNames) === JSON.stringify(['frontend', 'backend']), `Compose must define only frontend and backend; got ${serviceNames.join(', ')}`);
+assert(compose.includes('image: "${PROJECT_NAME:?PROJECT_NAME is required}_frontend:latest"'), 'Compose frontend image is not fixed');
+assert(compose.includes('image: "${PROJECT_NAME:?PROJECT_NAME is required}_backend:latest"'), 'Compose backend image is not fixed');
+assert((compose.match(/env_file: \.\/\.env/g) ?? []).length === 2, 'Both services must use root .env');
+assert((compose.match(/^\s*- \.\/logs:\/app\/logs\s*$/gm) ?? []).length === 2, 'Both services must mount root logs');
+assert(compose.includes('"${DOCKER_BIND_IP}:${FRONTEND_PORT}:${FRONTEND_PORT}"'), 'Frontend port mapping is invalid');
+assert(compose.includes('"${DOCKER_BIND_IP}:${BACKEND_PORT}:${BACKEND_PORT}"'), 'Backend port mapping is invalid');
+assert(!/container_name:|\b(?:postgres|database|db):\s*$|postgres:\d|DATABASE_MIGRATION|MIGRATIONS_SOURCE|RELEASE_VERSION|blue|green/i.test(compose), 'Compose contains a database, migration, release or blue-green configuration');
+
+const manifestText = await readFile(join(packageRoot, 'manifest.sha256'), 'utf8');
+const manifestEntries = new Map();
+for (const line of manifestText.trimEnd().split('\n')) {
+  const match = line.match(/^([0-9a-f]{64})  ([^/]+)$/);
+  assert(match, `Invalid manifest entry: ${line}`);
+  assert(!manifestEntries.has(match[2]), `Duplicate manifest entry: ${match[2]}`);
+  manifestEntries.set(match[2], match[1]);
+}
+const expectedManifestFiles = expectedFiles.filter((name) => name !== 'manifest.sha256').sort();
+assert(JSON.stringify([...manifestEntries.keys()].sort()) === JSON.stringify(expectedManifestFiles), 'Manifest coverage is incomplete');
+for (const [name, expectedHash] of manifestEntries) {
+  const actualHash = createHash('sha256').update(await readFile(join(packageRoot, name))).digest('hex');
+  assert(actualHash === expectedHash, `Checksum mismatch: ${name}`);
+}
+
+async function assertImageArchive(name, expectedTag) {
+  const archive = join(packageRoot, name);
+  const { stdout } = await run('tar', ['-xOf', archive, 'manifest.json'], { encoding: 'utf8', maxBuffer: 2 * 1024 * 1024 });
+  const parsed = JSON.parse(stdout);
+  assert(Array.isArray(parsed) && parsed.length === 1, `${name} must contain exactly one image manifest`);
+  assert(JSON.stringify(parsed[0].RepoTags) === JSON.stringify([expectedTag]), `${name} must contain only ${expectedTag}`);
+}
+await assertImageArchive('frontend-image.tar', `${env.get('PROJECT_NAME')}_frontend:latest`);
+await assertImageArchive('backend-image.tar', `${env.get('PROJECT_NAME')}_backend:latest`);
+
+process.stdout.write(`valid unified Docker delivery package for ${env.get('PROJECT_NAME')}\n`);