@wdyy/skills 0.1.28 → 0.1.30

package/.well-known/skills/wdyy-logging-standard/scripts/validate-log-entry.test.mjs

@@ -3,19 +3,25 @@ import { spawnSync } from 'node:child_process';
 import { mkdtemp, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { once } from 'node:events';
 import { afterEach, test } from 'node:test';
 import {
+  assertPinoRollStorageOptions,
   BusinessFunctionCatalog,
-  createLogFileName,
-  createLogFilePath,
+  createPinoRollTransportOptions,
+  createRolledLogFileName,
   createTraceContext,
+  ensureLogDirectory,
+  HashChainTransform,
   LOG_DIRECTORY,
+  LOG_FILE_MODE,
   MAX_LOG_FILE_SIZE_BYTES,
   MIN_NETWORK_LOG_RETENTION_MONTHS,
+  parseTraceParent,
   requireSourceIp,
   resolveActorContext,
+  ROTATION_SIZE,
   sanitizeLogValue,
-  SecureLogWriter,
   toLogEntry,
 } from '../templates/logger.template.ts';
 import {
@@ -26,7 +32,6 @@ import {
 process.env.TZ = 'Asia/Shanghai';
 
 const validator = new URL('./validate-log-entry.mjs', import.meta.url);
-const loggerTemplate = new URL('../templates/logger.template.ts', import.meta.url);
 const skillRoot = new URL('..', import.meta.url);
 const temporaryDirectories = [];
 const fixedDate = new Date('2026-07-09T08:00:00+08:00');
@@ -43,18 +48,21 @@ async function createTemporaryDirectory() {
   return directory;
 }
 
-async function validate(entry, stored = false) {
+async function validate(input, mode = 'entry') {
   const directory = await createTemporaryDirectory();
-  const input = join(directory, 'entry.log');
-  await writeFile(input, stored ? entry : JSON.stringify(entry));
+  const fileName = mode === 'stored' ? 'backend.2026-07-09.1.log' : 'entry.json';
+  const inputPath = join(directory, fileName);
+  await writeFile(inputPath, typeof input === 'string' ? input : JSON.stringify(input));
+  const flags = mode === 'stored' ? ['--stored'] : mode === 'storage-options' ? ['--storage-options'] : [];
   return spawnSync(
     process.execPath,
-    [...(stored ? ['--experimental-strip-types'] : []), validator.pathname, ...(stored ? ['--stored'] : []), input],
+    [validator.pathname, ...flags, inputPath],
     { encoding: 'utf8', env: { ...process.env, TZ: 'Asia/Shanghai' } },
   );
 }
 
-function validAccessEntry(overrides = {}) {
+function validRequestEntry(overrides = {}) {
+  const trace = createTraceContext();
   return {
     timestamp: '2026-07-09 08:00:00',
     timestampEpochMs: fixedDate.getTime(),
@@ -63,9 +71,10 @@ function validAccessEntry(overrides = {}) {
     service: 'backend',
     instanceId: 'blue',
     env: 'production',
-    logType: 'access',
-    message: 'request completed',
-    traceId: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+    logType: 'request',
+    message: 'incoming request',
+    traceId: trace.traceId,
+    spanId: trace.spanId,
     method: 'GET',
     route: '/patients/:patientId',
     sourceIp: '10.0.0.8',
@@ -74,59 +83,40 @@ function validAccessEntry(overrides = {}) {
     functionCode: 'patient.query',
     functionName: '患者信息查询',
     action: 'read',
-    statusCode: 200,
-    result: 'success',
-    durationMs: 12.5,
     ...overrides,
   };
 }
 
-function validSecurityEntry(overrides = {}) {
+function validResponseEntry(overrides = {}) {
+  const trace = createTraceContext();
   return {
     timestamp: '2026-07-09 08:00:00',
     timestampEpochMs: fixedDate.getTime(),
     timezone: '+08:00',
-    level: 'warn',
+    level: 'info',
     service: 'backend',
     instanceId: 'blue',
     env: 'production',
-    logType: 'security',
-    message: 'access denied',
-    eventId: 'event-1',
-    eventType: 'access.denied',
-    actorId: 'user-1',
-    actorType: 'employee',
-    action: 'patient.read',
-    targetType: 'patient',
-    targetId: 'patient-1',
-    result: 'failure',
-    reason: 'permission denied',
+    logType: 'response',
+    message: 'request completed',
+    traceId: trace.traceId,
+    method: 'GET',
+    route: '/patients/:patientId',
+    statusCode: 200,
+    result: 'success',
+    durationMs: 12.5,
     ...overrides,
   };
 }
 
-function runWriter(directory, body) {
-  const source = `
-    import { SecureLogWriter, toLogEntry } from ${JSON.stringify(loggerTemplate.href)};
-    process.env.TZ = 'Asia/Shanghai';
-    const fixedDate = new Date('2026-07-09T08:00:00+08:00');
-    const writer = new SecureLogWriter(() => fixedDate);
-    ${body}
-    await writer.close();
-  `;
-  return spawnSync(process.execPath, ['--experimental-strip-types', '--input-type=module', '--eval', source], {
-    cwd: directory,
-    encoding: 'utf8',
-    env: { ...process.env, TZ: 'Asia/Shanghai' },
-  });
-}
-
-test('固定根日志路径、2MB 阈值和六个月留存合同', () => {
+test('固定根日志路径、2MB 阈值、pino-roll 命名和留存合同', () => {
   assert.equal(LOG_DIRECTORY, './logs');
   assert.equal(MAX_LOG_FILE_SIZE_BYTES, 2 * 1024 * 1024);
+  assert.equal(ROTATION_SIZE, '2m');
+  assert.equal(LOG_FILE_MODE, 0o600);
   assert.equal(MIN_NETWORK_LOG_RETENTION_MONTHS, 6);
-  assert.equal(createLogFileName(fixedDate), '2026-07-09_08-00-00.log');
-  assert.equal(createLogFilePath(fixedDate, 2), './logs/2026-07-09_08-00-00_2.log');
+  assert.equal(createRolledLogFileName('backend', fixedDate, 1), 'backend.2026-07-09.1.log');
+  assert.equal(createRolledLogFileName('backend', fixedDate, 3), 'backend.2026-07-09.3.log');
 });
 
 test('完整业务结构保留但秘密和敏感个人信息被递归删除', () => {
@@ -154,302 +144,209 @@ test('项目确认的附加敏感字段也会被删除', () => {
   );
 });
 
-test('访问日志强制关键字段并映射 HTTP 结果', () => {
+test('请求日志强制关键字段并净化入参', () => {
   const trace = createTraceContext();
-  const entry = toLogEntry('info', 'request completed', {
-    logType: 'access',
+  const entry = toLogEntry('info', 'incoming request', {
+    logType: 'request',
     traceId: trace.traceId,
     spanId: trace.spanId,
     method: 'POST',
-    route: '/inventory/:inventoryId',
+    route: '/patients/:patientId',
     sourceIp: '10.0.0.8',
     actorId: 'user-1',
     actorType: 'employee',
-    functionCode: 'inventory.update',
-    functionName: '库存更新',
-    action: 'update',
-    statusCode: 422,
-    durationMs: 7,
+    functionCode: 'patient.create',
+    functionName: '患者信息建档',
+    action: 'create',
+    query: { token: 'secret-value', ward: 'cardiology' },
+    body: { patientName: '张三', password: 'not-allowed' },
   }, fixedDate);
 
-  assert.equal(entry.result, 'failure');
-  assert.equal(entry.timezone, '+08:00');
-  assert.throws(
-    () => toLogEntry('info', 'incomplete', { logType: 'access' }, fixedDate),
-    /Missing access log fields/,
-  );
+  assert.equal(entry.logType, 'request');
+  assert.deepEqual(entry.query, { ward: 'cardiology' });
+  assert.deepEqual(entry.body, { patientName: '张三' });
 });
 
-test('显式功能目录按 method 与路由解析且拒绝缺失或重复映射', () => {
-  const catalog = new BusinessFunctionCatalog([{
+test('响应日志强制关键字段并映射 HTTP 结果', async () => {
+  const trace = createTraceContext();
+  const success = toLogEntry('info', 'request completed', {
+    logType: 'response',
+    traceId: trace.traceId,
     method: 'GET',
     route: '/patients/:patientId',
-    functionCode: 'patient.query',
-    functionName: '患者信息查询',
-    action: 'read',
-  }]);
-  assert.deepEqual(catalog.resolve('get', '/patients/:patientId'), {
-    functionCode: 'patient.query',
-    functionName: '患者信息查询',
-    action: 'read',
-  });
-  assert.throws(() => catalog.resolve('POST', '/patients/:patientId'), /Missing business function mapping/);
-  assert.throws(() => new BusinessFunctionCatalog([
-    {
-      method: 'GET', route: '/patients', functionCode: 'patient.list', functionName: '患者列表', action: 'read',
-    },
-    {
-      method: 'get', route: '/patients', functionCode: 'patient.query', functionName: '患者查询', action: 'read',
-    },
-  ]), /Duplicate business function mapping/);
-});
-
-test('认证和匿名主体语义明确且不接受不完整身份', () => {
-  assert.deepEqual(resolveActorContext(), { actorId: 'anonymous', actorType: 'anonymous' });
-  assert.deepEqual(resolveActorContext({ id: 'user-1', type: 'employee' }), {
-    actorId: 'user-1', actorType: 'employee',
-  });
-  assert.throws(() => resolveActorContext({ id: 'user-1' }), /both id and type/);
-});
-
-test('访问日志拒绝无效 IP、未知功能和缺少主体', async () => {
-  for (const [overrides, expected] of [
-    [{ sourceIp: 'unknown' }, /valid IPv4 or IPv6/],
-    [{ functionCode: undefined }, /Missing access log fields.*functionCode/],
-    [{ functionCode: 'Patient Query' }, /stable lowercase business identifier/],
-    [{ functionCode: 'unknown' }, /stable lowercase business identifier/],
-    [{ functionName: '待确认' }, /resolved non-empty business name/],
-    [{ actorId: undefined }, /Missing access log fields.*actorId/],
-  ]) {
-    const result = await validate(validAccessEntry(overrides));
-    assert.notEqual(result.status, 0);
-    assert.match(result.stderr, expected);
-  }
-  assert.equal(requireSourceIp('2001:db8::1'), '2001:db8::1');
-  assert.throws(() => requireSourceIp('unknown'), /valid IPv4 or IPv6/);
-});
-
-test('访问日志拒绝原始查询 URL 和无效 traceId', async () => {
-  const rawRoute = await validate(validAccessEntry({ route: '/patients/1?token=secret' }));
-  assert.notEqual(rawRoute.status, 0);
-  assert.match(rawRoute.stderr, /route template/);
-
-  const invalidTrace = await validate(validAccessEntry({ traceId: '00000000000000000000000000000000' }));
-  assert.notEqual(invalidTrace.status, 0);
-  assert.match(invalidTrace.stderr, /traceId/);
-});
-
-test('有效 traceparent 延续 trace，无效值生成新上下文', () => {
-  const incoming = '00-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-bbbbbbbbbbbbbbbb-01';
-  const continued = createTraceContext(incoming);
-  assert.equal(continued.traceId, 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa');
-  assert.equal(continued.parentSpanId, 'bbbbbbbbbbbbbbbb');
-  assert.match(continued.traceparent, /^00-a{32}-[0-9a-f]{16}-01$/);
-
-  const replaced = createTraceContext('00-00000000000000000000000000000000-0000000000000000-01');
-  assert.match(replaced.traceparent, /^00-[0-9a-f]{32}-[0-9a-f]{16}-01$/);
-  assert.notEqual(replaced.traceId, '00000000000000000000000000000000');
-});
+    statusCode: 200,
+    durationMs: 12.5,
+  }, fixedDate);
+  const failure = toLogEntry('warn', 'request completed', {
+    logType: 'response',
+    traceId: trace.traceId,
+    method: 'GET',
+    route: '/patients/:patientId',
+    statusCode: 404,
+    durationMs: 8,
+  }, fixedDate);
 
-test('安全与审计失败事件必须包含原因', () => {
-  assert.doesNotThrow(() => toLogEntry('warn', 'denied', {
-    logType: 'security',
-    eventId: 'event-1',
-    eventType: 'access.denied',
-    actorId: 'user-1',
-    actorType: 'employee',
-    action: 'patient.read',
-    targetType: 'patient',
-    targetId: 'patient-1',
-    result: 'failure',
-    reason: 'permission denied',
-  }, fixedDate));
+  assert.equal(success.result, 'success');
+  assert.equal(failure.result, 'failure');
+  const mismatch = await validate(validResponseEntry({ statusCode: 404, result: 'success' }));
+  assert.notEqual(mismatch.status, 0);
+  assert.match(mismatch.stderr, /statusCode and result must match/);
   assert.throws(
-    () => toLogEntry('warn', 'denied', {
-      logType: 'security',
-      eventId: 'event-1',
-      eventType: 'access.denied',
-      actorId: 'user-1',
-      actorType: 'employee',
-      action: 'patient.read',
-      targetType: 'patient',
-      targetId: 'patient-1',
-      result: 'failure',
+    () => toLogEntry('info', 'bad', {
+      logType: 'response',
+      traceId: trace.traceId,
+      method: 'GET',
+      route: '/patients/:patientId',
+      statusCode: 200,
     }, fixedDate),
-    /require reason/,
+    /Missing response log fields/,
   );
-  const auditEntry = toLogEntry('info', 'permission changed', {
-    logType: 'audit',
-    eventId: 'event-2',
-    eventType: 'permission.changed',
-    actorId: 'admin-1',
-    actorType: 'employee',
-    action: 'permission.update',
-    targetType: 'role',
-    targetId: 'role-1',
-    result: 'success',
-    before: { permission: 'read' },
-    after: { permission: 'write', token: 'not-allowed' },
-  }, fixedDate);
-  assert.deepEqual(auditEntry.after, { permission: 'write' });
-});
-
-test('请求触发的安全审计日志要求完整功能和来源上下文', () => {
-  assert.doesNotThrow(() => toLogEntry('warn', 'denied', {
-    ...validSecurityEntry(),
-    traceId: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
-    sourceIp: '10.0.0.8',
-    route: '/patients/:patientId',
-    functionCode: 'patient.query',
-    functionName: '患者信息查询',
-  }, fixedDate));
-  assert.throws(() => toLogEntry('warn', 'denied', {
-    ...validSecurityEntry(),
-    traceId: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
-    sourceIp: '10.0.0.8',
-  }, fixedDate), /require traceId, sourceIp, route, functionCode and functionName/);
-});
-
-test('校验器拒绝绕过净化的秘密字段', async () => {
-  const result = await validate(validAccessEntry({ body: { password: 'not-allowed' } }));
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /Forbidden log field.*password/);
 });
 
-test('日志消息换行被编码而不是注入新日志行', () => {
-  const entry = toLogEntry('info', 'first\nsecond\rthird token=secret-value', {
-    logType: 'application',
-    params: { note: 'Bearer abc.def', orderId: 'order-1' },
-  }, fixedDate);
-  assert.equal(entry.message, 'first\\nsecond\\rthird token=[REMOVED]');
-  assert.deepEqual(entry.params, { note: 'Bearer [REMOVED]', orderId: 'order-1' });
-  assert.equal(JSON.stringify(entry).split('\n').length, 1);
+test('旧 access 与 application 类别被显式拒绝', async () => {
+  assert.throws(() => toLogEntry('info', 'legacy', { logType: 'access' }, fixedDate), /Deprecated logType/);
+  assert.throws(() => toLogEntry('info', 'legacy', { logType: 'application' }, fixedDate), /Deprecated logType/);
+  const legacy = validRequestEntry({ logType: 'access' });
+  const validation = await validate(legacy);
+  assert.notEqual(validation.status, 0);
+  assert.match(validation.stderr, /Deprecated logType/);
 });
 
-test('前端 trace 在缺少 Web Crypto 时仍有效且不会阻断请求', () => {
-  const descriptor = Object.getOwnPropertyDescriptor(globalThis, 'crypto');
-  Object.defineProperty(globalThis, 'crypto', { configurable: true, value: undefined });
-  try {
-    const trace = createFrontendTraceContext();
-    assert.match(trace.traceparent, /^00-[0-9a-f]{32}-[0-9a-f]{16}-01$/);
-  } finally {
-    if (descriptor) Object.defineProperty(globalThis, 'crypto', descriptor);
-    else delete globalThis.crypto;
-  }
+test('W3C trace 上下文有效延续、无效替换且不阻断请求', () => {
+  const valid = parseTraceParent('00-11111111111111111111111111111111-2222222222222222-01');
+  assert.equal(valid?.traceId, '11111111111111111111111111111111');
+  assert.notEqual(valid?.spanId, '2222222222222222');
+  assert.equal(parseTraceParent('bad'), undefined);
+  assert.equal(parseTraceParent('00-00000000000000000000000000000000-2222222222222222-01'), undefined);
+  const generated = createTraceContext(undefined);
+  assert.match(generated.traceId, /^[0-9a-f]{32}$/);
+  assert.match(generated.spanId, /^[0-9a-f]{16}$/);
+  const frontendTrace = createFrontendTraceContext();
+  assert.match(frontendTrace.traceId, /^[0-9a-f]{32}$/);
+  assert.deepEqual(
+    sanitizeFrontendErrorReport({ errorName: 'TypeError', message: 'password=abc', stack: 'Bearer abc', path: '/page?token=1' }),
+    { errorName: 'TypeError', message: 'password=[REMOVED]', stack: 'Bearer [REMOVED]', path: '/page' },
+  );
 });
 
-test('前端异常上报移除查询串和常见凭据', () => {
-  const report = sanitizeFrontendErrorReport({
-    errorName: 'FetchError',
-    message: 'authorization: Bearer abc.def password=hunter2',
-    stack: 'token=secret-value',
-    path: '/login?token=secret#fragment',
-    occurredAt: '2026-07-09T00:00:00.000Z',
+test('业务功能目录、主体和来源 IP 不接受猜测值', () => {
+  const catalog = new BusinessFunctionCatalog([
+    { method: 'GET', route: '/patients/:patientId', functionCode: 'patient.query', functionName: '患者信息查询', action: 'read' },
+  ]);
+  assert.deepEqual(catalog.resolve('get', '/patients/:patientId'), {
+    functionCode: 'patient.query',
+    functionName: '患者信息查询',
+    action: 'read',
   });
-  assert.equal(report.path, '/login');
-  assert.doesNotMatch(JSON.stringify(report), /hunter2|secret-value|abc\.def/);
+  assert.throws(() => catalog.resolve('GET', '/unknown'), /Missing business function mapping/);
+  assert.deepEqual(resolveActorContext(undefined), { actorId: 'anonymous', actorType: 'anonymous' });
+  assert.throws(() => resolveActorContext({ id: 'user-1' }), /both id and type/);
+  assert.throws(() => requireSourceIp('unknown'), /valid IPv4 or IPv6/);
 });
 
-test('真实写入使用最小权限、单行 JSON 和可验证哈希链', async () => {
-  const directory = await createTemporaryDirectory();
-  const result = runWriter(directory, `
-    await writer.write(toLogEntry('info', 'one', { logType: 'application' }, fixedDate));
-    await writer.write(toLogEntry('info', 'two', { logType: 'application' }, fixedDate));
-  `);
-  assert.equal(result.status, 0, result.stderr);
-
-  const logsDirectory = join(directory, 'logs');
-  const files = await readdir(logsDirectory);
-  assert.deepEqual(files, ['2026-07-09_08-00-00.log']);
-  assert.equal((await stat(logsDirectory)).mode & 0o777, 0o700);
-  const logPath = join(logsDirectory, files[0]);
-  assert.equal((await stat(logPath)).mode & 0o777, 0o600);
-  const source = await readFile(logPath, 'utf8');
-  assert.equal(source.trim().split('\n').length, 2);
-  const validation = await validate(source, true);
+test('哈希链 transport 输出单行 JSON 并可被完整校验', async () => {
+  const requestEntry = validRequestEntry();
+  const responseEntry = validResponseEntry({
+    traceId: requestEntry.traceId,
+    functionCode: 'patient.query',
+    functionName: '患者信息查询',
+    action: 'read',
+  });
+  const chain = new HashChainTransform();
+  const chunks = [];
+  chain.on('data', (chunk) => chunks.push(chunk.toString('utf8')));
+  chain.end(`${JSON.stringify(requestEntry)}\n${JSON.stringify(responseEntry)}\n`);
+  await once(chain, 'end');
+
+  const source = chunks.join('');
+  const lines = source.trim().split('\n');
+  assert.equal(lines.length, 2);
+  const first = JSON.parse(lines[0]);
+  const second = JSON.parse(lines[1]);
+  assert.equal(first.sequence, 1);
+  assert.equal(first.previousHash, null);
+  assert.equal(second.sequence, 2);
+  assert.equal(second.previousHash, first.entryHash);
+  assert.match(first.entryHash, /^[0-9a-f]{64}$/);
+
+  const validation = await validate(`${source}\n`, 'stored');
   assert.equal(validation.status, 0, validation.stderr);
-});
 
-test('多进程同秒排他创建且不覆盖既有文件', async () => {
-  const directory = await createTemporaryDirectory();
-  const body = "await writer.write(toLogEntry('info', 'entry', { logType: 'application' }, fixedDate));";
-  const first = runWriter(directory, body);
-  const second = runWriter(directory, body);
-  assert.equal(first.status, 0, first.stderr);
-  assert.equal(second.status, 0, second.stderr);
-  assert.deepEqual((await readdir(join(directory, 'logs'))).sort(), [
-    '2026-07-09_08-00-00.log',
-    '2026-07-09_08-00-00_1.log',
-  ]);
+  first.message = 'tampered';
+  const tampered = await validate(`${JSON.stringify(first)}\n${lines[1]}\n`, 'stored');
+  assert.notEqual(tampered.status, 0);
+  assert.match(tampered.stderr, /integrity verification/);
 });
 
-test('超过 2MB 时创建新文件并保留既有文件', async () => {
-  const directory = await createTemporaryDirectory();
-  const result = runWriter(directory, `
-    const payload = 'x'.repeat(1_200_000);
-    await writer.write(toLogEntry('info', 'first', { logType: 'application', body: { payload } }, fixedDate));
-    await writer.write(toLogEntry('info', 'second', { logType: 'application', body: { payload } }, fixedDate));
-  `);
-  assert.equal(result.status, 0, result.stderr);
-  assert.deepEqual((await readdir(join(directory, 'logs'))).sort(), [
-    '2026-07-09_08-00-00.log',
-    '2026-07-09_08-00-00_1.log',
-  ]);
-});
+test('pino-roll 存储选项固定为 2MB、0600 且禁止删除历史日志', async () => {
+  const options = createPinoRollTransportOptions();
+  assert.equal(options.target, 'pino-roll');
+  assert.equal(options.options.file, './logs/backend');
+  assert.equal(options.options.size, '2m');
+  assert.equal(options.options.mode, 0o600);
+  assert.equal(options.options.mkdir, false);
 
-test('跨秒轮转使用新的基础文件名而非沿用冲突后缀', async () => {
   const directory = await createTemporaryDirectory();
-  const source = `
-    import { SecureLogWriter, toLogEntry } from ${JSON.stringify(loggerTemplate.href)};
-    process.env.TZ = 'Asia/Shanghai';
-    const firstDate = new Date('2026-07-09T08:00:00+08:00');
-    const secondDate = new Date('2026-07-09T08:00:01+08:00');
-    const dates = [firstDate, secondDate];
-    const writer = new SecureLogWriter(() => dates.shift() ?? secondDate);
-    const payload = 'x'.repeat(1_200_000);
-    await writer.write(toLogEntry('info', 'first', { logType: 'application', body: { payload } }, firstDate));
-    await writer.write(toLogEntry('info', 'second', { logType: 'application', body: { payload } }, secondDate));
-    await writer.close();
-  `;
-  const result = spawnSync(process.execPath, ['--experimental-strip-types', '--input-type=module', '--eval', source], {
-    cwd: directory,
-    encoding: 'utf8',
-    env: { ...process.env, TZ: 'Asia/Shanghai' },
-  });
-  assert.equal(result.status, 0, result.stderr);
-  assert.deepEqual((await readdir(join(directory, 'logs'))).sort(), [
-    '2026-07-09_08-00-00.log',
-    '2026-07-09_08-00-01.log',
-  ]);
+  const validPath = join(directory, 'options.json');
+  await writeFile(validPath, JSON.stringify(options.options));
+  const validation = spawnSync(
+    process.execPath,
+    [validator.pathname, '--storage-options', validPath],
+    { encoding: 'utf8', env: { ...process.env, TZ: 'Asia/Shanghai' } },
+  );
+  assert.equal(validation.status, 0, validation.stderr);
+
+  for (const bad of [
+    { ...options.options, size: '10m' },
+    { ...options.options, mode: 0o644 },
+    { ...options.options, mkdir: true },
+    { ...options.options, file: './logs/audit/backend.log' },
+    { ...options.options, limit: { removeOtherLogFiles: true } },
+    { ...options.options, limit: { count: 3 } },
+  ]) {
+    assert.throws(() => assertPinoRollStorageOptions(bad));
+  }
 });
 
-test('篡改落盘记录后完整性验证失败', async () => {
+test('落盘日志目录必须预先以 0700 创建', async () => {
   const directory = await createTemporaryDirectory();
-  const result = runWriter(directory, `
-    await writer.write(toLogEntry('info', 'original', { logType: 'application' }, fixedDate));
-  `);
+  const template = new URL('../templates/logger.template.ts', import.meta.url);
+  const result = spawnSync(
+    process.execPath,
+    ['--experimental-strip-types', '--input-type=module', '--eval', `
+      import { ensureLogDirectory } from ${JSON.stringify(template.href)};
+      await ensureLogDirectory();
+    `],
+    { cwd: directory, encoding: 'utf8', env: { ...process.env, TZ: 'Asia/Shanghai' } },
+  );
   assert.equal(result.status, 0, result.stderr);
-  const logPath = join(directory, 'logs', '2026-07-09_08-00-00.log');
-  const entry = JSON.parse((await readFile(logPath, 'utf8')).trim());
-  entry.message = 'tampered';
-  const validation = await validate(`${JSON.stringify(entry)}\n`, true);
-  assert.notEqual(validation.status, 0);
-  assert.match(validation.stderr, /integrity verification/);
+  const logsDirectory = join(directory, 'logs');
+  assert.equal((await stat(logsDirectory)).mode & 0o777, 0o700);
+  assert.deepEqual(await readdir(logsDirectory), []);
 });
 
-test('HTTP 与安全审计模板包含真实事件入口且不记录原始 URL', async () => {
-  const middleware = await readFile(new URL('templates/nestjs-http-logging.middleware.template.ts', skillRoot), 'utf8');
+test('nestjs-pino 与安全审计模板包含真实接入入口且不记录原始 URL', async () => {
+  const http = await readFile(new URL('templates/nestjs-http-logging.middleware.template.ts', skillRoot), 'utf8');
   const securityLogger = await readFile(new URL('templates/security-audit-logger.template.ts', skillRoot), 'utf8');
-  assert.match(middleware, /response\.once\('finish'/);
-  assert.match(middleware, /traceparent/);
-  assert.match(middleware, /functionCatalog\.resolve/);
-  assert.match(middleware, /resolveActorContext/);
-  assert.match(middleware, /requireSourceIp/);
-  assert.doesNotMatch(middleware, /originalUrl/);
-  assert.doesNotMatch(middleware, /['"]unknown['"]/);
-  assert.match(securityLogger, /functionCode/);
-  assert.match(securityLogger, /functionName/);
+  const pinoLogger = await readFile(new URL('templates/pino-logger.template.ts', skillRoot), 'utf8');
+  assert.match(http, /LoggerModule\.forRoot/);
+  assert.match(http, /pinoHttp/);
+  assert.match(http, /customProps/);
+  assert.match(http, /logType: 'request'/);
+  assert.match(http, /logType: 'response'/);
+  assert.match(http, /traceparent/);
+  assert.match(http, /functionCatalog\.resolve/);
+  assert.match(http, /resolveActorContext/);
+  assert.match(http, /requireSourceIp/);
+  assert.doesNotMatch(http, /originalUrl/);
+  assert.doesNotMatch(http, /['"]unknown['"]/);
+  assert.match(securityLogger, /pino/);
+  assert.match(securityLogger, /assertSecurityAuditContext/);
   for (const eventName of ['auth.login.failure', 'access.denied', 'permission.changed', 'sensitive-data.export']) {
     assert.match(securityLogger, new RegExp(eventName.replaceAll('.', '\\.')));
   }
+  assert.match(pinoLogger, /pino\.transport/);
+  assert.match(pinoLogger, /HashChainTransform/);
+  assert.match(pinoLogger, /ensureLogDirectory/);
+  assert.match(pinoLogger, /createPinoRollTransportOptions/);
 });