@wdyy/skills 0.1.12 → 0.1.14

package/.well-known/skills/wdyy-deployment-standard/scripts/generate-deployment-files.test.mjs

@@ -1,120 +1,158 @@
+import test from 'node:test';
 import assert from 'node:assert/strict';
-import { chmod, mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises';
+import { execFile } from 'node:child_process';
+import { chmod, mkdtemp, mkdir, readFile, rm, stat, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterEach, test } from 'node:test';
-import { spawnSync } from 'node:child_process';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
 
-const script = new URL('./generate-deployment-files.mjs', import.meta.url).pathname;
-const environmentTemplate = new URL('../templates/env.example.template', import.meta.url).pathname;
-const temporaryDirectories = [];
+const run = promisify(execFile);
+const script = join(dirname(fileURLToPath(import.meta.url)), 'generate-deployment-files.mjs');
+const created = [];
 
-afterEach(async () => {
-  await Promise.all(temporaryDirectories.splice(0).map((path) => rm(path, { recursive: true, force: true })));
-});
+const realEnv = `# 前端
+FRONTEND_URL=0.0.0.0
+FRONTEND_PORT=5173
+# 后端
+BACKEND_URL=0.0.0.0
+BACKEND_PORT=3000
+# 数据库
+DB_URL=db.internal
+DB_PORT=5432
+DB_USER=app
+DB_PASSWORD=secret
+DB_NAME=app
+DB_SCHEMA=public
+# API
+API_URL=
+# 部署
+`;
+const exampleEnv = `# 前端
+FRONTEND_URL=0.0.0.0
+FRONTEND_PORT=5173
+# 后端
+BACKEND_URL=0.0.0.0
+BACKEND_PORT=3000
+# 数据库
+DB_URL=
+DB_PORT=5432
+DB_USER=
+DB_PASSWORD=
+DB_NAME=
+DB_SCHEMA=
+# API
+API_URL=
+# 部署
+`;
 
-async function projectRoot() {
-  const root = await mkdtemp(join(tmpdir(), 'deployment-generator-'));
-  temporaryDirectories.push(root);
-  const template = await readFile(environmentTemplate, 'utf8');
-  const initializedEnvironment = `${template.slice(0, template.indexOf('# 部署') + '# 部署'.length)}\n`;
-  await writeFile(join(root, '.env'), initializedEnvironment, { mode: 0o600 });
-  await writeFile(join(root, '.env.example'), initializedEnvironment);
+async function fixture(env = realEnv, example = exampleEnv) {
+  const root = await mkdtemp(join(tmpdir(), 'wdyy-deploy-generator-'));
+  created.push(root);
+  await writeFile(join(root, '.env'), env, { mode: 0o600 });
+  await writeFile(join(root, '.env.example'), example, { mode: 0o644 });
   return root;
 }
 
-function run(root, ...args) {
-  return spawnSync(process.execPath, [script, '--target', root, ...args], { encoding: 'utf8' });
+async function invoke(root, ...args) {
+  return run(process.execPath, [script, '--target', root, ...args]);
 }
 
-test('确定性生成全部标准文件并通过 check', async () => {
-  const root = await projectRoot();
-  const generated = run(root, '--write');
-  assert.equal(generated.status, 0, generated.stderr);
-  const checked = run(root, '--check');
-  assert.equal(checked.status, 0, checked.stderr);
-  assert.match(checked.stdout, /verified deterministic deployment files/);
-  assert.match(await readFile(join(root, 'deploy.sh'), 'utf8'), /server_menu/);
-  assert.match(await readFile(join(root, 'scripts/deployment/docker-compose.yml'), 'utf8'), /^  frontend:[\s\S]*^  backend:/m);
-  await assert.rejects(stat(join(root, 'scripts/deployment/docker-compose.blue-green.yml')));
+test.after(async () => {
+  await Promise.all(created.map((path) => rm(path, { recursive: true, force: true })));
+});
+
+test('生成统一 Docker 交付文件并通过确定性检查', async () => {
+  const root = await fixture();
+  const result = await invoke(root, '--write');
+  assert.match(result.stdout, /generated unified Docker delivery files/);
+  for (const path of ['deploy.sh', '.dockerignore', 'src/frontend/Dockerfile', 'src/backend/Dockerfile', 'scripts/deployment/docker-compose.yml', 'scripts/deployment/frontend-container.conf.template']) {
+    assert.ok((await stat(join(root, path))).isFile(), path);
+  }
+  assert.equal((await stat(join(root, 'deploy.sh'))).mode & 0o777, 0o755);
+  assert.equal((await stat(join(root, '.env'))).mode & 0o777, 0o600);
   const environment = await readFile(join(root, '.env'), 'utf8');
-  const example = await readFile(join(root, '.env.example'), 'utf8');
-  assert.match(environment, /^# 前端\nFRONTEND_URL=0\.0\.0\.0\nFRONTEND_PORT=5173$/m);
-  assert.match(environment, /^# 部署\nPROJECT_NAME=\nDOCKER_BIND_IP=/m);
-  assert.doesNotMatch(environment, /PROJECT_HTTP_PORT|BLUE_PORT|GREEN_PORT/);
-  assert.match(environment, /^FRONTEND_BASE_IMAGE=nginx:stable$/m);
-  assert.match(environment, /^BACKEND_BASE_IMAGE=node:24-alpine3\.24$/m);
-  assert.equal(example, environment);
-  if (process.platform !== 'win32') assert.equal((await stat(join(root, '.env'))).mode & 0o777, 0o600);
+  assert.match(environment, /API_URL=\nAPI_PREFIX=api\nVITE_API_BASE_URL=\/api\n\n# 部署/);
+  assert.match(environment, /FRONTEND_BASE_IMAGE=nginx:stable/);
+  assert.match(environment, /DOCKER_PLATFORM=linux\/amd64/);
+  assert.match(await readFile(join(root, '.env.example'), 'utf8'), /BACKEND_BASE_IMAGE=node:24-alpine3\.24/);
+  const nginx = await readFile(join(root, 'scripts/deployment/frontend-container.conf.template'), 'utf8');
+  assert.match(nginx, /location \$\{VITE_API_BASE_URL\}\/ \{/);
+  assert.match(nginx, /proxy_pass http:\/\/backend:\$\{BACKEND_PORT\};/);
+  const frontendDockerfile = await readFile(join(root, 'src/frontend/Dockerfile'), 'utf8');
+  assert.match(frontendDockerfile, /ARG VITE_API_BASE_URL/);
+  assert.doesNotMatch(frontendDockerfile, /COPY\s+\.env/);
+  const backendDockerfile = await readFile(join(root, 'src/backend/Dockerfile'), 'utf8');
+  assert.match(backendDockerfile, /pnpm --filter \.\/src\/backend deploy --prod --legacy \/runtime/);
+  assert.match(backendDockerfile, /WORKDIR \/app\n/);
+  assert.match(backendDockerfile, /COPY --from=build \/runtime \.\/src\/backend\//);
+  assert.match(backendDockerfile, /CMD \["node", "src\/backend\/dist\/main\.js"\]/);
+  const check = await invoke(root, '--check');
+  assert.match(check.stdout, /verified unified Docker delivery files/);
+  assert.match(await readFile(join(root, 'deploy.sh'), 'utf8'), /env COPYFILE_DISABLE=1 tar --no-xattrs -czf "\$candidate"/);
 });
 
-test('扩充部署段时保留 .env 的真实基础值', async () => {
-  const root = await projectRoot();
-  const envPath = join(root, '.env');
-  await writeFile(envPath, (await readFile(envPath, 'utf8')).replace('DB_PASSWORD=', 'DB_PASSWORD=private-value'), { mode: 0o600 });
-  const generated = run(root, '--write');
-  assert.equal(generated.status, 0, generated.stderr);
-  assert.match(await readFile(envPath, 'utf8'), /^DB_PASSWORD=private-value$/m);
+test('扩充部署段时完整保留真实环境值', async () => {
+  const root = await fixture();
+  await invoke(root, '--write');
+  const actual = await readFile(join(root, '.env'), 'utf8');
+  assert.match(actual, /DB_URL=db\.internal/);
+  assert.match(actual, /DB_PASSWORD=secret/);
+  assert.match(actual, /PROJECT_NAME=\nDOCKER_BIND_IP=\n/);
 });
 
-test('非标准环境文件被拒绝且不修改', async () => {
-  const root = await projectRoot();
-  const envPath = join(root, '.env');
-  await writeFile(envPath, (await readFile(envPath, 'utf8')).replace('# 数据库', '# 数据'), { mode: 0o600 });
-  const before = await readFile(envPath, 'utf8');
-  const generated = run(root, '--write');
-  assert.notEqual(generated.status, 0);
-  assert.match(generated.stderr, /section order/);
-  assert.equal(await readFile(envPath, 'utf8'), before);
+test('保留有效的自定义 API 路径', async () => {
+  const configuredReal = realEnv.replace('API_URL=\n', 'API_URL=\nAPI_PREFIX=service\nVITE_API_BASE_URL=/service\n');
+  const configuredExample = exampleEnv.replace('API_URL=\n', 'API_URL=\nAPI_PREFIX=service\nVITE_API_BASE_URL=/service\n');
+  const root = await fixture(configuredReal, configuredExample);
+  await invoke(root, '--write');
+  assert.match(await readFile(join(root, '.env'), 'utf8'), /API_PREFIX=service\nVITE_API_BASE_URL=\/service/);
+  await invoke(root, '--check');
 });
 
-test('.env 与 .env.example 变量名不一致时拒绝修改', async () => {
-  const root = await projectRoot();
-  const examplePath = join(root, '.env.example');
-  await writeFile(examplePath, (await readFile(examplePath, 'utf8')).replace('# API\n', '# API\nAPI_URL=\n'));
-  const envBefore = await readFile(join(root, '.env'), 'utf8');
-  const exampleBefore = await readFile(examplePath, 'utf8');
-  const generated = run(root, '--write');
-  assert.notEqual(generated.status, 0);
-  assert.match(generated.stderr, /variable names must remain consistent/);
-  assert.equal(await readFile(join(root, '.env'), 'utf8'), envBefore);
-  assert.equal(await readFile(examplePath, 'utf8'), exampleBefore);
+test('缺失、非法或冲突的 API 路径被明确拒绝', async () => {
+  const partialReal = realEnv.replace('API_URL=\n', 'API_URL=\nAPI_PREFIX=api\n');
+  const partialExample = exampleEnv.replace('API_URL=\n', 'API_URL=\nAPI_PREFIX=api\n');
+  await assert.rejects(invoke(await fixture(partialReal, partialExample), '--write'), /must contain both/);
+
+  const invalidReal = realEnv.replace('API_URL=\n', 'API_URL=\nAPI_PREFIX=api/path\nVITE_API_BASE_URL=/api\/path\n');
+  const invalidExample = exampleEnv.replace('API_URL=\n', 'API_URL=\nAPI_PREFIX=api/path\nVITE_API_BASE_URL=/api\/path\n');
+  await assert.rejects(invoke(await fixture(invalidReal, invalidExample), '--write'), /one safe path segment/);
+
+  const conflictReal = realEnv.replace('API_URL=\n', 'API_URL=\nAPI_PREFIX=api\nVITE_API_BASE_URL=/service\n');
+  const conflictExample = exampleEnv.replace('API_URL=\n', 'API_URL=\nAPI_PREFIX=api\nVITE_API_BASE_URL=/service\n');
+  await assert.rejects(invoke(await fixture(conflictReal, conflictExample), '--write'), /VITE_API_BASE_URL must equal \/api/);
 });
 
-test('差异文件默认拒绝覆盖，显式 force 后恢复一致', async () => {
-  const root = await projectRoot();
-  assert.equal(run(root, '--write').status, 0);
-  await writeFile(join(root, 'deploy.sh'), '# changed\n');
-  await chmod(join(root, 'deploy.sh'), 0o755);
-  const refused = run(root, '--write');
-  assert.notEqual(refused.status, 0);
-  assert.match(refused.stderr, /Refusing to overwrite/);
-  assert.equal(await readFile(join(root, 'deploy.sh'), 'utf8'), '# changed\n');
-  const forced = run(root, '--write', '--force');
-  assert.equal(forced.status, 0, forced.stderr);
-  assert.equal(run(root, '--check').status, 0);
+test('非标准环境文件被拒绝且不修改', async () => {
+  const invalid = realEnv.replace('# 数据库\n', '');
+  const root = await fixture(invalid);
+  const before = await readFile(join(root, '.env'));
+  await assert.rejects(invoke(root, '--write'), /section order|inside a standard section/);
+  assert.deepEqual(await readFile(join(root, '.env')), before);
+  await assert.rejects(stat(join(root, 'deploy.sh')), { code: 'ENOENT' });
 });
 
-test('重复或冲突参数被明确拒绝', async () => {
-  const root = await projectRoot();
-  const duplicateMode = run(root, '--write', '--check');
-  assert.notEqual(duplicateMode.status, 0);
-  assert.match(duplicateMode.stderr, /Exactly one of --write or --check is required/);
+test('环境变量集合不一致时拒绝修改', async () => {
+  const root = await fixture(realEnv, exampleEnv.replace('API_URL=', 'API_URL=\nAPI_TOKEN='));
+  await assert.rejects(invoke(root, '--write'), /variable names must remain consistent/);
+  await assert.rejects(stat(join(root, 'deploy.sh')), { code: 'ENOENT' });
+});
 
-  const duplicateTarget = spawnSync(
-    process.execPath,
-    [script, '--target', root, '--target', root, '--check'],
-    { encoding: 'utf8' },
-  );
-  assert.notEqual(duplicateTarget.status, 0);
-  assert.match(duplicateTarget.stderr, /Duplicate or missing --target argument/);
+test('差异生成文件默认拒绝覆盖，force 后恢复一致', async () => {
+  const root = await fixture();
+  await invoke(root, '--write');
+  await writeFile(join(root, 'deploy.sh'), '#!/bin/sh\nexit 9\n');
+  await chmod(join(root, 'deploy.sh'), 0o755);
+  await assert.rejects(invoke(root, '--write'), /Refusing to overwrite differing deployment files/);
+  assert.equal(await readFile(join(root, 'deploy.sh'), 'utf8'), '#!/bin/sh\nexit 9\n');
+  await invoke(root, '--write', '--force');
+  await invoke(root, '--check');
 });
 
-test('旧蓝绿和宿主机 Nginx 配置键被明确拒绝', async () => {
-  const root = await projectRoot();
-  const envPath = join(root, '.env');
-  await writeFile(envPath, (await readFile(envPath, 'utf8')).replace('# 部署\n', '# 部署\nPROJECT_HTTP_PORT=9099\n'), { mode: 0o600 });
-  const generated = run(root, '--write');
-  assert.notEqual(generated.status, 0);
-  assert.match(generated.stderr, /legacy duplicate configuration/);
+test('非法参数和旧部署配置被明确拒绝', async () => {
+  const root = await fixture(realEnv.replace('# 部署\n', '# 部署\nRELEASE_VERSION=old\n'));
+  await assert.rejects(invoke(root, '--write'), /removed deployment configuration: RELEASE_VERSION/);
+  await assert.rejects(run(process.execPath, [script, '--target', root, '--write', '--check']), /Exactly one/);
+  await assert.rejects(run(process.execPath, [script, '--target', root, '--check', '--force']), /Usage/);
 });

package/.well-known/skills/wdyy-deployment-standard/scripts/validate-deployment-package.mjs

@@ -1,21 +1,18 @@
 #!/usr/bin/env node
 import { createHash } from 'node:crypto';
+import { execFile } from 'node:child_process';
 import { lstat, readFile, readdir, stat } from 'node:fs/promises';
-import { basename, join, relative, resolve, sep } from 'node:path';
+import { basename, join, resolve } from 'node:path';
+import { promisify } from 'node:util';
 
-const [deployPath, composePath, packageRoot] = process.argv.slice(2);
-if (!deployPath || !composePath || !packageRoot || process.argv.length !== 5) {
-  throw new Error('Pass deploy.sh, Compose file and generated deploy directory paths');
-}
-
-const [deploy, compose] = await Promise.all([readFile(deployPath, 'utf8'), readFile(composePath, 'utf8')]);
+const run = promisify(execFile);
+const [packageArgument] = process.argv.slice(2);
+if (!packageArgument || process.argv.length !== 3) throw new Error('Usage: validate-deployment-package.mjs <extracted-package-root>');
+const packageRoot = resolve(packageArgument);
+const expectedFiles = ['.env', 'backend-image.tar', 'deploy.sh', 'docker-compose.yml', 'frontend-image.tar', 'manifest.sha256'];
 
-function requirePattern(text, pattern, message) {
-  if (!pattern.test(text)) throw new Error(message);
-}
-
-function assertDeepEqual(actual, expected, message) {
-  if (JSON.stringify(actual) !== JSON.stringify(expected)) throw new Error(`${message}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`);
+function assert(condition, message) {
+  if (!condition) throw new Error(message);
 }
 
 function parseDotenv(text) {
@@ -26,6 +23,7 @@ function parseDotenv(text) {
     if (!match) throw new Error(`Invalid root .env line ${index + 1}`);
     if (values.has(match[1])) throw new Error(`Duplicate root .env key: ${match[1]}`);
     let value = match[2];
+    if (value.includes('$(') || value.includes('`')) throw new Error(`Executable syntax is forbidden in root .env: ${match[1]}`);
     if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) value = value.slice(1, -1);
     else if (value.startsWith('"') || value.startsWith("'")) throw new Error(`Unclosed root .env quote: ${match[1]}`);
     values.set(match[1], value);
@@ -33,120 +31,115 @@ function parseDotenv(text) {
   return values;
 }
 
-for (const [pattern, message] of [
-  [/if \[\[ "\$#" -eq 0 \]\]; then server_menu/, 'No-argument execution must open the server menu'],
-  [/elif \[\[ "\$#" -eq 1 && "\$1" == build \]\]; then build_release/, 'build must be the only command-line operation'],
-  [/'1\. 运行或替换前端'/, 'Missing frontend menu item'],
-  [/'2\. 运行或替换后端'/, 'Missing backend menu item'],
-  [/'3\. 运行或替换前后端'/, 'Missing dual-service menu item'],
-  [/'4\. 停止'/, 'Missing stop menu item'],
-  [/docker save -o "\$version_root\/frontend-image\.tar"/, 'Missing frontend image export'],
-  [/docker save -o "\$version_root\/backend-image\.tar"/, 'Missing backend image export'],
-  [/frontend_image="\$\{PROJECT_NAME\}_frontend:\$version"/, 'Missing versioned frontend image name'],
-  [/backend_image="\$\{PROJECT_NAME\}_backend:\$version"/, 'Missing versioned backend image name'],
-  [/compose up -d --force-recreate --no-deps frontend/, 'Frontend operation must only recreate frontend'],
-  [/compose up -d --force-recreate --no-deps backend/, 'Backend operation must only recreate backend'],
-  [/compose up -d --force-recreate frontend backend/, 'Combined operation must recreate both services'],
-  [/compose stop frontend backend/, 'Stop operation must stop both services'],
-  [/logs\/deploy\.log/, 'Server operations must write deploy.log'],
-  [/pnpm test/, 'Missing test release gate'],
-  [/pnpm lint/, 'Missing lint release gate'],
-  [/pnpm typecheck/, 'Missing typecheck release gate'],
-  [/pnpm build/, 'Missing build release gate'],
-]) requirePattern(deploy, pattern, message);
-
-if (/^\s*(?:start|replace|restart|remove|status|rollback)\)/m.test(deploy)) throw new Error('Legacy server commands are forbidden');
-if (/\bsource\s+["']?[^\n]*\.env/.test(deploy)) throw new Error('Environment files must be parsed as data, not sourced');
-if (/\beval\b/.test(deploy)) throw new Error('deploy.sh must not use eval');
-if (/\bpsql\b/.test(deploy)) throw new Error('deploy.sh must not execute database clients');
-if (/\b(?:scp|rsync)\b|\bgit\s+(?:pull|clone)\b/.test(deploy)) throw new Error('deploy.sh must not upload or pull artifacts');
-if (/(?:^|[\s"'])\/srv\//m.test(`${deploy}\n${compose}`)) throw new Error('Fixed /srv deployment roots are forbidden');
-if (/nginx\s+-(?:t|s)|active-upstreams|ACTIVE_COLOR|PREVIOUS_COLOR/.test(deploy)) throw new Error('Host Nginx and blue-green state are forbidden');
-
-const serviceNames = [...compose.matchAll(/^  ([a-z-]+):$/gm)].map((match) => match[1]);
-assertDeepEqual(serviceNames, ['frontend', 'backend'], 'Compose must define exactly two ordered services');
-if (compose.includes(':-') || compose.includes('not-configured')) throw new Error('Compose image fallback is forbidden');
-if ((compose.match(/image: \$\{FRONTEND_IMAGE:\?FRONTEND_IMAGE is required\}/g) ?? []).length !== 1) throw new Error('Frontend must require FRONTEND_IMAGE');
-if ((compose.match(/image: \$\{BACKEND_IMAGE:\?BACKEND_IMAGE is required\}/g) ?? []).length !== 1) throw new Error('Backend must require BACKEND_IMAGE');
-if ((compose.match(/env_file: \.\.\/\.\.\/\.env/g) ?? []).length !== 2) throw new Error('Both services must use root .env');
-if ((compose.match(/^\s*- \.\.\/\.\.\/logs:\/app\/logs\s*$/gm) ?? []).length !== 2) throw new Error('Both services must mount flat project-root logs');
-if (!compose.includes('"${DOCKER_BIND_IP}:${FRONTEND_PORT}:${FRONTEND_PORT}"')) throw new Error('Frontend must directly expose FRONTEND_PORT');
-if (!compose.includes('"${DOCKER_BIND_IP}:${BACKEND_PORT}:${BACKEND_PORT}"')) throw new Error('Backend must directly expose BACKEND_PORT');
-if (/LOG_DIR|HOST_LOG_DIR|logs\/(?:frontend|backend|blue|green)|container_name:/.test(compose)) throw new Error('Configurable, nested logs or container_name are forbidden');
-if (/frontend-(?:blue|green)|backend-(?:blue|green)|PROJECT_HTTP_PORT|_(?:BLUE|GREEN)_PORT|nginx\/site/.test(compose)) throw new Error('Blue-green or host Nginx Compose configuration is forbidden');
-
-const rootEnvPath = join(packageRoot, '.env');
-const rootEnvStat = await stat(rootEnvPath);
-if (!rootEnvStat.isFile() || (rootEnvStat.mode & 0o077) !== 0 || (rootEnvStat.mode & 0o400) === 0) throw new Error('Root .env must be a private owner-readable file');
-const rootEnvText = await readFile(rootEnvPath, 'utf8');
-const env = parseDotenv(rootEnvText);
-const sectionNames = [...rootEnvText.matchAll(/^# (前端|后端|数据库|API|部署)$/gm)].map((match) => match[1]);
-if (sectionNames.join('|') !== '前端|后端|数据库|API|部署') throw new Error('Root .env must use the five standard sections in order');
-for (const key of ['FRONTEND_URL', 'FRONTEND_PORT', 'BACKEND_URL', 'BACKEND_PORT', 'DB_PORT', 'PROJECT_NAME', 'DOCKER_BIND_IP', 'FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE']) {
-  if (!env.get(key)) throw new Error(`Root .env is missing ${key}`);
+async function requireRegular(path, label) {
+  const info = await lstat(path);
+  assert(info.isFile() && !info.isSymbolicLink(), `${label} must be a regular file`);
+  return info;
 }
-for (const key of env.keys()) {
-  if (['PROJECT_HTTP_PORT', 'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT', 'SERVER_PROJECTS_ROOT', 'NGINX_SOURCE', 'LOG_DIR', 'HOST_LOG_DIR', 'FRONTEND_CONTAINER_PORT', 'BACKEND_CONTAINER_PORT', 'BACKEND_LISTEN_HOST', 'DATABASE_MIGRATION_MODE', 'MIGRATIONS_SOURCE', 'MIGRATION_RUNNER_SOURCE'].includes(key) || /_(?:HEALTH|VERSION)_URL$/.test(key)) {
-    throw new Error(`Root .env contains removed deployment configuration: ${key}`);
+
+const rootInfo = await stat(packageRoot);
+assert(rootInfo.isDirectory(), 'Package root must be a directory');
+const entries = await readdir(packageRoot, { withFileTypes: true });
+for (const entry of entries) {
+  if (entry.name === 'logs') {
+    assert(entry.isDirectory() && !entry.isSymbolicLink(), 'logs must be a regular directory');
+  } else {
+    assert(expectedFiles.includes(entry.name) && entry.isFile() && !entry.isSymbolicLink(), `Unexpected package entry: ${entry.name}`);
   }
 }
-if (!/^[a-z][a-z0-9_]*$/.test(env.get('PROJECT_NAME'))) throw new Error('Invalid PROJECT_NAME');
-for (const key of ['FRONTEND_URL', 'BACKEND_URL', 'DOCKER_BIND_IP']) if (!/^[A-Za-z0-9:.%-]+$/.test(env.get(key))) throw new Error(`${key} contains unsafe characters`);
+for (const name of expectedFiles) await requireRegular(join(packageRoot, name), name);
+
+const envInfo = await requireRegular(join(packageRoot, '.env'), '.env');
+assert((envInfo.mode & 0o077) === 0 && (envInfo.mode & 0o400) !== 0, 'Root .env must be owner-readable with no group or other permissions');
+const envText = await readFile(join(packageRoot, '.env'), 'utf8');
+const env = parseDotenv(envText);
+const sections = [...envText.matchAll(/^# (前端|后端|数据库|API|部署)$/gm)].map((match) => match[1]);
+assert(sections.join('|') === '前端|后端|数据库|API|部署', 'Root .env must use the five standard sections in order');
+for (const key of ['FRONTEND_URL', 'FRONTEND_PORT', 'BACKEND_URL', 'BACKEND_PORT', 'API_PREFIX', 'VITE_API_BASE_URL', 'DB_URL', 'DB_PORT', 'DB_USER', 'DB_PASSWORD', 'DB_NAME', 'DB_SCHEMA', 'PROJECT_NAME', 'DOCKER_BIND_IP', 'DOCKER_PLATFORM', 'FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE']) {
+  assert(env.get(key), `Root .env is missing ${key}`);
+}
+assert(/^[a-z][a-z0-9_]*$/.test(env.get('PROJECT_NAME')), 'Invalid PROJECT_NAME');
 for (const key of ['FRONTEND_PORT', 'BACKEND_PORT', 'DB_PORT']) {
   const port = Number(env.get(key));
-  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error(`${key} must be a valid port`);
+  assert(Number.isInteger(port) && port >= 1 && port <= 65535, `${key} must be a valid port`);
+}
+assert(env.get('FRONTEND_PORT') !== env.get('BACKEND_PORT'), 'Frontend and backend ports must differ');
+assert(/^[A-Za-z][A-Za-z0-9_-]*$/.test(env.get('API_PREFIX')), 'API_PREFIX must be one safe path segment');
+assert(env.get('VITE_API_BASE_URL') === `/${env.get('API_PREFIX')}`, 'VITE_API_BASE_URL must equal /API_PREFIX');
+assert(/^(?:linux\/amd64|linux\/arm64)$/.test(env.get('DOCKER_PLATFORM')), 'Invalid DOCKER_PLATFORM');
+for (const key of env.keys()) {
+  assert(!['PROJECT_HTTP_PORT', 'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT', 'SERVER_PROJECTS_ROOT', 'NGINX_SOURCE', 'LOG_DIR', 'HOST_LOG_DIR', 'FRONTEND_CONTAINER_PORT', 'BACKEND_CONTAINER_PORT', 'BACKEND_LISTEN_HOST', 'DATABASE_MIGRATION_MODE', 'MIGRATIONS_SOURCE', 'MIGRATION_RUNNER_SOURCE', 'RELEASE_VERSION'].includes(key) && !/_(?:HEALTH|VERSION)_URL$/.test(key), `Root .env contains removed configuration: ${key}`);
 }
-if (env.get('FRONTEND_PORT') === env.get('BACKEND_PORT')) throw new Error('Frontend and backend host ports must differ');
 
-const releaseEnv = await readFile(join(packageRoot, 'release.env'), 'utf8');
-const releaseMatch = releaseEnv.match(/^RELEASE_VERSION=(\d{8}-\d{3})\n$/);
-if (!releaseMatch) throw new Error('release.env must contain exactly one release version');
-const version = releaseMatch[1];
-assertDeepEqual((await readdir(packageRoot)).sort(), ['.env', version, 'deploy.sh', 'release.env'].sort(), 'Generated deploy root has unexpected entries');
-if (resolve(deployPath) !== resolve(packageRoot, 'deploy.sh')) throw new Error('deploy.sh must be the package root script');
-if (resolve(composePath) !== resolve(packageRoot, version, 'docker/docker-compose.yml')) throw new Error('Compose path must be inside the selected version');
+const deploy = await readFile(join(packageRoot, 'deploy.sh'), 'utf8');
+const compose = await readFile(join(packageRoot, 'docker-compose.yml'), 'utf8');
+for (const [pattern, message] of [
+  [/if \[\[ "\$#" -eq 0 \]\]; then server_deploy/, 'No-argument execution must deploy the complete stack'],
+  [/"\$1" == build/, 'Missing local build command'],
+  [/"\$1" == stop/, 'Missing stop command'],
+  [/"\$1" == status/, 'Missing status command'],
+  [/docker image inspect "\$FRONTEND_BASE_IMAGE"/, 'Frontend local base image must be checked'],
+  [/docker image inspect "\$BACKEND_BASE_IMAGE"/, 'Backend local base image must be checked'],
+  [/docker build --pull=false --platform "\$DOCKER_PLATFORM"/g, 'Docker builds must use the configured target platform and disable pull'],
+  [/docker save -o "\$package_root\/frontend-image\.tar"/, 'Frontend image must be exported separately'],
+  [/docker save -o "\$package_root\/backend-image\.tar"/, 'Backend image must be exported separately'],
+  [/env COPYFILE_DISABLE=1 tar --no-xattrs -czf "\$candidate"/, 'Delivery archive must exclude macOS metadata and extended attributes'],
+  [/docker version --format '\{\{\.Server\.Os\}\}\/\{\{\.Server\.Arch\}\}'/, 'Deploy must read the Docker Server platform'],
+  [/compose up -d --force-recreate --no-build --pull never --wait frontend backend/, 'Deploy must recreate and wait for both services without build or pull'],
+  [/compose stop frontend backend/, 'Stop must target both services'],
+  [/compose ps frontend backend/, 'Status must inspect both services'],
+]) assert(pattern.test(deploy), message);
+assert((deploy.match(/docker build --pull=false --platform "\$DOCKER_PLATFORM"/g) ?? []).length === 2, 'Exactly two Docker builds must use the configured target platform and disable pull');
+const deployStackIndex = deploy.indexOf('deploy_stack() {');
+const serverPlatformCheckIndex = deploy.indexOf('  assert_server_platform\n', deployStackIndex);
+const firstImageLoadIndex = deploy.indexOf('  docker load -i ', deployStackIndex);
+assert(deployStackIndex >= 0 && serverPlatformCheckIndex > deployStackIndex && firstImageLoadIndex > serverPlatformCheckIndex, 'Docker Server platform must be checked before loading images');
+assert(!/\bdocker\s+pull\b/.test(deploy), 'docker pull is forbidden');
+assert(!/\bsource\s+[^\n]*\.env|\beval\b/.test(deploy), 'Environment files must be parsed as data');
+assert(!/server_menu|运行或替换|read_release_pointer|release_ledger|AGENTS\.md/.test(deploy), 'Legacy menu or release ledger logic is forbidden');
+assert(!/\bpsql\b|\b(?:scp|rsync)\b|\bgit\s+(?:pull|clone)\b/.test(deploy), 'Database, upload or source-pull commands are forbidden');
+assert(!/(?:^|[\s"'])\/srv\//m.test(`${deploy}\n${compose}`), 'Fixed server roots are forbidden');
 
-const versionRoot = join(packageRoot, version);
-for (const path of ['frontend-image.tar', 'backend-image.tar', 'manifest.sha256', 'docker/docker-compose.yml']) {
-  const info = await stat(join(versionRoot, path));
-  if (!info.isFile()) throw new Error(`Required release path is not a file: ${path}`);
-}
-await assertMissing(join(versionRoot, 'database'), 'Release package must not contain database migration files');
-await assertMissing(join(versionRoot, 'nginx'), 'Release package must not contain host Nginx files');
+const serviceNames = [...compose.matchAll(/^  ([a-z][a-z0-9_-]*):$/gm)].map((match) => match[1]);
+assert(JSON.stringify(serviceNames) === JSON.stringify(['frontend', 'backend']), `Compose must define only frontend and backend; got ${serviceNames.join(', ')}`);
+assert(compose.includes('image: "${PROJECT_NAME:?PROJECT_NAME is required}_frontend:latest"'), 'Compose frontend image is not fixed');
+assert(compose.includes('image: "${PROJECT_NAME:?PROJECT_NAME is required}_backend:latest"'), 'Compose backend image is not fixed');
+assert((compose.match(/platform: "\$\{DOCKER_PLATFORM:\?DOCKER_PLATFORM is required\}"/g) ?? []).length === 2, 'Both services must use DOCKER_PLATFORM');
+assert((compose.match(/env_file: \.\/\.env/g) ?? []).length === 2, 'Both services must use root .env');
+assert((compose.match(/^\s*- \.\/logs:\/app\/logs\s*$/gm) ?? []).length === 2, 'Both services must mount root logs');
+assert(compose.includes('"${DOCKER_BIND_IP}:${FRONTEND_PORT}:${FRONTEND_PORT}"'), 'Frontend port mapping is invalid');
+assert(compose.includes('"${DOCKER_BIND_IP}:${BACKEND_PORT}:${BACKEND_PORT}"'), 'Backend port mapping is invalid');
+assert(compose.includes('VITE_API_BASE_URL: "${VITE_API_BASE_URL:?VITE_API_BASE_URL is required}"'), 'Frontend API path is not passed to Nginx');
+assert(compose.includes('BACKEND_PORT: "${BACKEND_PORT:?BACKEND_PORT is required}"'), 'Backend port is not passed to Nginx');
+assert(compose.includes('NGINX_ENVSUBST_FILTER: "^(FRONTEND_URL|FRONTEND_PORT|VITE_API_BASE_URL|BACKEND_PORT)$"'), 'Nginx envsubst filter does not cover the runtime API proxy');
+assert(!/container_name:|\b(?:postgres|database|db):\s*$|postgres:\d|DATABASE_MIGRATION|MIGRATIONS_SOURCE|RELEASE_VERSION|blue|green/i.test(compose), 'Compose contains a database, migration, release or blue-green configuration');
 
-const versionFiles = (await listFiles(versionRoot)).sort();
-for (const path of versionFiles) {
-  const name = basename(path);
-  if (name === '.env' || name.startsWith('.env.') || /\.(?:pem|key)$/.test(name) || /^(?:id_rsa|id_ed25519|credentials(?:\..*)?)$/.test(name)) throw new Error(`Secret file must not enter version directory: ${path}`);
-}
-const manifest = await readFile(join(versionRoot, 'manifest.sha256'), 'utf8');
-const entries = new Map();
-for (const line of manifest.trimEnd().split('\n')) {
-  const match = line.match(/^([0-9a-f]{64})  ([^/].*)$/);
-  if (!match || match[2].split('/').includes('..')) throw new Error(`Invalid manifest entry: ${line}`);
-  if (entries.has(match[2])) throw new Error(`Duplicate manifest entry: ${match[2]}`);
-  entries.set(match[2], match[1]);
+const manifestText = await readFile(join(packageRoot, 'manifest.sha256'), 'utf8');
+const manifestEntries = new Map();
+for (const line of manifestText.trimEnd().split('\n')) {
+  const match = line.match(/^([0-9a-f]{64})  ([^/]+)$/);
+  assert(match, `Invalid manifest entry: ${line}`);
+  assert(!manifestEntries.has(match[2]), `Duplicate manifest entry: ${match[2]}`);
+  manifestEntries.set(match[2], match[1]);
 }
-assertDeepEqual([...entries.keys()].sort(), versionFiles.filter((path) => path !== 'manifest.sha256'), 'Manifest coverage is incomplete');
-for (const [path, expected] of entries) {
-  const actual = createHash('sha256').update(await readFile(join(versionRoot, path))).digest('hex');
-  if (actual !== expected) throw new Error(`Checksum mismatch: ${path}`);
+const expectedManifestFiles = expectedFiles.filter((name) => name !== 'manifest.sha256').sort();
+assert(JSON.stringify([...manifestEntries.keys()].sort()) === JSON.stringify(expectedManifestFiles), 'Manifest coverage is incomplete');
+for (const [name, expectedHash] of manifestEntries) {
+  const actualHash = createHash('sha256').update(await readFile(join(packageRoot, name))).digest('hex');
+  assert(actualHash === expectedHash, `Checksum mismatch: ${name}`);
 }
 
-process.stdout.write(`valid direct dual-image deployment package ${version}\n`);
-
-async function assertMissing(path, message) {
-  try { await lstat(path); } catch (error) { if (error.code === 'ENOENT') return; throw error; }
-  throw new Error(message);
+async function assertImageArchive(name, expectedTag) {
+  const archive = join(packageRoot, name);
+  const { stdout } = await run('tar', ['-xOf', archive, 'manifest.json'], { encoding: 'utf8', maxBuffer: 2 * 1024 * 1024 });
+  const parsed = JSON.parse(stdout);
+  assert(Array.isArray(parsed) && parsed.length === 1, `${name} must contain exactly one image manifest`);
+  assert(JSON.stringify(parsed[0].RepoTags) === JSON.stringify([expectedTag]), `${name} must contain only ${expectedTag}`);
+  const { stdout: configText } = await run('tar', ['-xOf', archive, parsed[0].Config], { encoding: 'utf8', maxBuffer: 2 * 1024 * 1024 });
+  const config = JSON.parse(configText);
+  assert(`${config.os}/${config.architecture}` === env.get('DOCKER_PLATFORM'), `${name} platform must equal DOCKER_PLATFORM`);
 }
+await assertImageArchive('frontend-image.tar', `${env.get('PROJECT_NAME')}_frontend:latest`);
+await assertImageArchive('backend-image.tar', `${env.get('PROJECT_NAME')}_backend:latest`);
 
-async function listFiles(root, directory = root) {
-  const result = [];
-  for (const entry of await readdir(directory, { withFileTypes: true })) {
-    const path = join(directory, entry.name);
-    if (entry.isSymbolicLink()) throw new Error(`Release package must not contain symbolic links: ${relative(root, path)}`);
-    if (entry.isDirectory()) result.push(...await listFiles(root, path));
-    else if (entry.isFile()) result.push(relative(root, path).split(sep).join('/'));
-  }
-  return result;
-}
+process.stdout.write(`valid unified Docker delivery package for ${env.get('PROJECT_NAME')}\n`);