@wdyy/skills 0.1.6 → 0.1.7

package/.well-known/skills/wdyy-deployment-standard/scripts/generate-deployment-files.test.mjs

@@ -0,0 +1,106 @@
+import assert from 'node:assert/strict';
+import { chmod, mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, test } from 'node:test';
+import { spawnSync } from 'node:child_process';
+
+const script = new URL('./generate-deployment-files.mjs', import.meta.url).pathname;
+const environmentTemplate = new URL('../templates/env.example.template', import.meta.url).pathname;
+const temporaryDirectories = [];
+
+afterEach(async () => {
+  await Promise.all(temporaryDirectories.splice(0).map((path) => rm(path, { recursive: true, force: true })));
+});
+
+async function projectRoot() {
+  const root = await mkdtemp(join(tmpdir(), 'deployment-generator-'));
+  temporaryDirectories.push(root);
+  const template = await readFile(environmentTemplate, 'utf8');
+  const initializedEnvironment = `${template.slice(0, template.indexOf('# 部署') + '# 部署'.length)}\n`;
+  await writeFile(join(root, '.env'), initializedEnvironment, { mode: 0o600 });
+  await writeFile(join(root, '.env.example'), initializedEnvironment);
+  return root;
+}
+
+function run(root, ...args) {
+  return spawnSync(process.execPath, [script, '--target', root, ...args], { encoding: 'utf8' });
+}
+
+test('确定性生成全部标准文件并通过 check', async () => {
+  const root = await projectRoot();
+  const generated = run(root, '--write');
+  assert.equal(generated.status, 0, generated.stderr);
+  const checked = run(root, '--check');
+  assert.equal(checked.status, 0, checked.stderr);
+  assert.match(checked.stdout, /verified deterministic deployment files/);
+  assert.match(await readFile(join(root, 'deploy.sh'), 'utf8'), /build\|start\|replace/);
+  const environment = await readFile(join(root, '.env'), 'utf8');
+  const example = await readFile(join(root, '.env.example'), 'utf8');
+  assert.match(environment, /^# 前端\nFRONTEND_URL=0\.0\.0\.0\nFRONTEND_PORT=5173$/m);
+  assert.match(environment, /^# 部署\nPROJECT_NAME=\nSERVER_PROJECTS_ROOT=/m);
+  assert.equal(example, environment);
+  if (process.platform !== 'win32') assert.equal((await stat(join(root, '.env'))).mode & 0o777, 0o600);
+});
+
+test('扩充部署段时保留 .env 的真实基础值', async () => {
+  const root = await projectRoot();
+  const envPath = join(root, '.env');
+  await writeFile(envPath, (await readFile(envPath, 'utf8')).replace('DB_PASSWORD=', 'DB_PASSWORD=private-value'), { mode: 0o600 });
+  const generated = run(root, '--write');
+  assert.equal(generated.status, 0, generated.stderr);
+  assert.match(await readFile(envPath, 'utf8'), /^DB_PASSWORD=private-value$/m);
+});
+
+test('非标准环境文件被拒绝且不修改', async () => {
+  const root = await projectRoot();
+  const envPath = join(root, '.env');
+  await writeFile(envPath, (await readFile(envPath, 'utf8')).replace('# 数据库', '# 数据'), { mode: 0o600 });
+  const before = await readFile(envPath, 'utf8');
+  const generated = run(root, '--write');
+  assert.notEqual(generated.status, 0);
+  assert.match(generated.stderr, /section order/);
+  assert.equal(await readFile(envPath, 'utf8'), before);
+});
+
+test('.env 与 .env.example 变量名不一致时拒绝修改', async () => {
+  const root = await projectRoot();
+  const examplePath = join(root, '.env.example');
+  await writeFile(examplePath, (await readFile(examplePath, 'utf8')).replace('# API\n', '# API\nAPI_URL=\n'));
+  const envBefore = await readFile(join(root, '.env'), 'utf8');
+  const exampleBefore = await readFile(examplePath, 'utf8');
+  const generated = run(root, '--write');
+  assert.notEqual(generated.status, 0);
+  assert.match(generated.stderr, /variable names must remain consistent/);
+  assert.equal(await readFile(join(root, '.env'), 'utf8'), envBefore);
+  assert.equal(await readFile(examplePath, 'utf8'), exampleBefore);
+});
+
+test('差异文件默认拒绝覆盖，显式 force 后恢复一致', async () => {
+  const root = await projectRoot();
+  assert.equal(run(root, '--write').status, 0);
+  await writeFile(join(root, 'deploy.sh'), '# changed\n');
+  await chmod(join(root, 'deploy.sh'), 0o755);
+  const refused = run(root, '--write');
+  assert.notEqual(refused.status, 0);
+  assert.match(refused.stderr, /Refusing to overwrite/);
+  assert.equal(await readFile(join(root, 'deploy.sh'), 'utf8'), '# changed\n');
+  const forced = run(root, '--write', '--force');
+  assert.equal(forced.status, 0, forced.stderr);
+  assert.equal(run(root, '--check').status, 0);
+});
+
+test('重复或冲突参数被明确拒绝', async () => {
+  const root = await projectRoot();
+  const duplicateMode = run(root, '--write', '--check');
+  assert.notEqual(duplicateMode.status, 0);
+  assert.match(duplicateMode.stderr, /Exactly one of --write or --check is required/);
+
+  const duplicateTarget = spawnSync(
+    process.execPath,
+    [script, '--target', root, '--target', root, '--check'],
+    { encoding: 'utf8' },
+  );
+  assert.notEqual(duplicateTarget.status, 0);
+  assert.match(duplicateTarget.stderr, /Duplicate or missing --target argument/);
+});

package/.well-known/skills/wdyy-deployment-standard/scripts/validate-deployment-package.mjs

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createHash } from 'node:crypto';
-import { readdir, readFile, stat } from 'node:fs/promises';
+import { lstat, readFile, readdir, stat } from 'node:fs/promises';
 import { basename, join, relative, resolve, sep } from 'node:path';
 
 const [deployPath, nginxPath, composePath, packageRoot] = process.argv.slice(2);
 if (!deployPath || !nginxPath || !composePath || !packageRoot) {
-  throw new Error('Pass deploy.sh, Nginx config, compose file and generated deploy directory paths');
+  throw new Error('Pass deploy.sh, Nginx template, Compose file and generated deploy directory paths');
 }
 
 const [deploy, nginx, compose] = await Promise.all([
@@ -14,183 +14,204 @@ const [deploy, nginx, compose] = await Promise.all([
   readFile(composePath, 'utf8'),
 ]);
 
-const deployRequirements = [
-  'build)',
-  'start)',
-  'stop)',
-  'restart)',
-  'status)',
-  'rollback)',
-  'AGENTS.md',
-  '## 发布记录',
-  '| 版本号 | 构建时间 |',
-  'release.env',
-  'RELEASE_VERSION',
-  'SCRIPT_DIR',
-  'manifest.sha256',
-  'pnpm test',
-  'pnpm lint',
-  'pnpm typecheck',
-  'pnpm build',
-  'docker build',
-  'docker save',
-  '.dockerignore',
-  'database/migrations',
-  'scripts/apply-migrations.sh',
-  'HEALTH_URL',
-  'VERSION_URL',
-  'BLUE_HEALTH_URL',
-  'GREEN_HEALTH_URL',
-  'BLUE_VERSION_URL',
-  'GREEN_VERSION_URL',
-  'BLUE_UPSTREAM',
-  'GREEN_UPSTREAM',
-  'BACKEND_PROXY_URL',
-];
-const nginxRequirements = [
-  '__DEPLOY_ROOT__',
-  '__BACKEND_PROXY_URL__',
-  'location /releases/',
-  '/current',
-];
-const projectRootLogMount = '../../logs:/app/logs';
-const composeRequirements = [
-  'backend-blue:',
-  'backend-green:',
-  'INSTANCE_ID',
-  'blue',
-  'green',
-];
-
-const missing = [
-  ...deployRequirements.filter((value) => !deploy.includes(value)),
-  ...nginxRequirements.filter((value) => !nginx.includes(value)),
-  ...composeRequirements.filter((value) => !compose.includes(value)),
-];
-if (missing.length) {
-  throw new Error(`Missing deployment requirements: ${missing.join(', ')}`);
+function requirePattern(text, pattern, message) {
+  if (!pattern.test(text)) throw new Error(message);
 }
 
-if (!/start\)\s*\n\s*\[\[ "\$#" -eq 1 \]\] \|\| usage/.test(deploy)) {
-  throw new Error('start must reject version arguments and read release.env');
-}
-if (/start\)[\s\S]{0,160}version="\$2"/.test(deploy) || deploy.includes('INCOMING_DIR')) {
-  throw new Error('Legacy start <version> and incoming/<version> layouts are forbidden');
-}
-if (/(?:^|[\s"'])\/srv\//m.test(`${deploy}\n${nginx}\n${compose}`)) {
-  throw new Error('Deployment root must come from deploy.sh physical location, not a fixed /srv path');
-}
-if (/(?:127\.0\.0\.1|\b3001\b|\b3002\b)/.test(`${deploy}\n${compose}`)) {
-  throw new Error('Deployment URLs, ports and IP addresses must come from environment files');
-}
-if (/proxy_pass\s+https?:\/\//.test(nginx)) {
-  throw new Error('Nginx proxy URL must come from BACKEND_PROXY_URL in .env.production');
-}
-if (/\b(?:scp|rsync)\b/.test(deploy)) {
-  throw new Error('deploy.sh must not upload artifacts; upload is a manual engineer action');
+function parseDotenv(text) {
+  const values = new Map();
+  for (const [index, raw] of text.replaceAll('\r\n', '\n').split('\n').entries()) {
+    if (!raw || /^\s*#/.test(raw)) continue;
+    const match = raw.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (!match) throw new Error(`Invalid root .env line ${index + 1}`);
+    if (values.has(match[1])) throw new Error(`Duplicate root .env key: ${match[1]}`);
+    let value = match[2];
+    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+      value = value.slice(1, -1);
+    } else if (value.startsWith('"') || value.startsWith("'")) {
+      throw new Error(`Unclosed root .env quote: ${match[1]}`);
+    }
+    values.set(match[1], value);
+  }
+  return values;
 }
 
-const forbiddenLogConfiguration = /\b(?:LOG_DIR|HOST_LOG_DIR)\b|backend\/(?:blue|green)|\/var\/log\/application/;
-if (forbiddenLogConfiguration.test(compose)) {
-  throw new Error(
-    'Logs must use the shared project-root ../../logs:/app/logs mount without configurable or per-instance directories',
+const commands = ['build', 'start', 'replace', 'restart', 'stop', 'remove', 'status', 'rollback'];
+for (const command of commands) {
+  requirePattern(deploy, new RegExp(`^  ${command}\\)`, 'm'), `Missing deployment command: ${command}`);
+}
+for (const command of commands.filter((item) => item !== 'rollback')) {
+  requirePattern(
+    deploy,
+    new RegExp(`^  ${command}\\) \\[\\[ "\\$#" -eq 1 \\]\\] \\|\\| usage;`, 'm'),
+    `${command} must reject extra arguments`,
   );
 }
-const logTargetMounts = compose.match(/^[ \t]*-[ \t]*[^#\n]+:\/app\/logs[ \t]*$/gm) ?? [];
-if (
-  logTargetMounts.length !== 2
-  || logTargetMounts.some((mount) => !mount.includes(projectRootLogMount))
-) {
-  throw new Error('Blue and green must both mount project-root ../../logs directly to /app/logs');
-}
+requirePattern(deploy, /^  rollback\) \[\[ "\$#" -eq 2 \]\] \|\| usage;/m, 'rollback must require exactly one version');
 
-const releaseEnvPath = join(packageRoot, 'release.env');
-const releaseEnv = await readFile(releaseEnvPath, 'utf8');
-const releaseMatch = releaseEnv.match(/^RELEASE_VERSION=(\d{8}-\d{3})\n$/);
-if (!releaseMatch) {
-  throw new Error('release.env must contain exactly one RELEASE_VERSION=YYYYMMDD-NNN line');
+const requiredDeploySemantics = [
+  /release_ledger next/,
+  /pnpm test/,
+  /pnpm lint/,
+  /pnpm typecheck/,
+  /pnpm build/,
+  /frontend_image="\$\{PROJECT_NAME\}_frontend:\$version"/,
+  /backend_image="\$\{PROJECT_NAME\}_backend:\$version"/,
+  /docker save -o "\$version_root\/frontend-image\.tar"/,
+  /docker save -o "\$version_root\/backend-image\.tar"/,
+  /load_dotenv "\$DEPLOY_ROOT\/\.env"/,
+  /endpoint_url "\$DOCKER_BIND_IP"/,
+  /server deploy root must be exactly/,
+  /assert_project_ports_isolated/,
+  /flock -x 9/,
+  /Nginx reload failed; old project configuration restored/,
+  /database migration was not executed/,
+  /docker ps -aq --filter "label=com\.docker\.compose\.project=\$PROJECT_NAME"/,
+  /\$1 == frontend \|\| \$1 == backend/,
+];
+for (const pattern of requiredDeploySemantics) requirePattern(deploy, pattern, `Missing deployment behavior: ${pattern}`);
+if (/\bsource\s+["']?[^\n]*(?:\.env|ACTIVE_STATE|PREVIOUS_STATE)/.test(deploy)) {
+  throw new Error('Environment and state files must be parsed as data, not sourced');
+}
+if (/\beval\b/.test(deploy)) throw new Error('deploy.sh must not use eval');
+if (/\bpsql\b/.test(deploy)) throw new Error('deploy.sh must not execute database clients');
+if (/\b(?:scp|rsync)\b|\bgit\s+(?:pull|clone)\b/.test(deploy)) throw new Error('deploy.sh must not upload or pull artifacts');
+if (/(?:^|[\s"'])\/srv\//m.test(`${deploy}\n${nginx}\n${compose}`)) throw new Error('Fixed /srv deployment roots are forbidden');
+
+const serviceNames = [...compose.matchAll(/^  ([a-z-]+):$/gm)].map((match) => match[1]);
+assertDeepEqual(serviceNames, ['frontend-blue', 'backend-blue', 'frontend-green', 'backend-green'], 'Compose must define exactly four ordered blue-green services');
+if (compose.includes(':-') || compose.includes('not-configured')) throw new Error('Compose image fallback is forbidden');
+if ((compose.match(/image: \$\{FRONTEND_IMAGE:\?FRONTEND_IMAGE is required\}/g) ?? []).length !== 2) throw new Error('Both frontend services must require FRONTEND_IMAGE');
+if ((compose.match(/image: \$\{BACKEND_IMAGE:\?BACKEND_IMAGE is required\}/g) ?? []).length !== 2) throw new Error('Both backend services must require BACKEND_IMAGE');
+if ((compose.match(/env_file: \.\.\/\.\.\/\.env/g) ?? []).length !== 4) throw new Error('All four services must use root .env');
+const logMounts = compose.match(/^\s*- \.\.\/\.\.\/logs:\/app\/logs\s*$/gm) ?? [];
+if (logMounts.length !== 4) throw new Error('All four services must mount flat project-root logs');
+if (/LOG_DIR|HOST_LOG_DIR|logs\/(?:frontend|backend|blue|green)/.test(compose)) throw new Error('Configurable or nested log directories are forbidden');
+if (/container_name:/.test(compose)) throw new Error('container_name would weaken Compose project isolation');
+if (/FRONTEND_CONTAINER_PORT|BACKEND_CONTAINER_PORT|BACKEND_LISTEN_HOST|_HEALTH_URL|_VERSION_URL/.test(compose)) {
+  throw new Error('Compose contains legacy duplicate URL or port configuration');
+}
+for (const key of ['FRONTEND_PORT', 'BACKEND_PORT', 'FRONTEND_URL', 'BACKEND_URL']) {
+  if (!compose.includes(`\${${key}}`)) throw new Error(`Compose must use ${key}`);
 }
-const version = releaseMatch[1];
-const rootEntries = (await readdir(packageRoot)).sort();
-const expectedRootEntries = [version, 'deploy.sh', 'release.env'].sort();
-if (JSON.stringify(rootEntries) !== JSON.stringify(expectedRootEntries)) {
-  throw new Error(`Generated deploy directory must contain only deploy.sh, release.env and ${version}`);
+
+for (const placeholder of ['__PROJECT_NAME__', '__PROJECT_HTTP_PORT__', '__DOCKER_HOST_PORTS__', '__DEPLOY_ROOT__', '__FRONTEND_UPSTREAM_NAME__', '__BACKEND_UPSTREAM_NAME__']) {
+  if (!nginx.includes(placeholder)) throw new Error(`Nginx template is missing ${placeholder}`);
 }
-if (resolve(deployPath) !== resolve(packageRoot, 'deploy.sh')) {
-  throw new Error('Validator deploy.sh path must be the generated deploy directory root script');
+if (!/^# wdyy-project: __PROJECT_NAME__$/m.test(nginx) || !/^# wdyy-port: __PROJECT_HTTP_PORT__$/m.test(nginx) || !/^# wdyy-docker-ports: __DOCKER_HOST_PORTS__$/m.test(nginx)) {
+  throw new Error('Nginx template must expose deterministic project and all port markers');
 }
+if (/listen\s+\d+/.test(nginx) || /proxy_pass\s+https?:\/\/(?!__)/.test(nginx)) throw new Error('Nginx URL or port is hardcoded');
 
-const versionRoot = join(packageRoot, version);
-const requiredPaths = [
-  'frontend.tar.gz',
-  'backend-image.tar',
-  'manifest.sha256',
-  'database/migrations',
-  'scripts/apply-migrations.sh',
-  'docker/docker-compose.blue-green.yml',
-  'nginx/site.conf',
+const rootEnvPath = join(packageRoot, '.env');
+const rootEnvStat = await stat(rootEnvPath);
+if (!rootEnvStat.isFile() || (rootEnvStat.mode & 0o077) !== 0 || (rootEnvStat.mode & 0o400) === 0) {
+  throw new Error('Root .env must be a private owner-readable file');
+}
+const rootEnvText = await readFile(rootEnvPath, 'utf8');
+const env = parseDotenv(rootEnvText);
+const sectionNames = [...rootEnvText.matchAll(/^# (前端|后端|数据库|API|部署)$/gm)].map((match) => match[1]);
+if (sectionNames.join('|') !== '前端|后端|数据库|API|部署') throw new Error('Root .env must use the five standard sections in order');
+const requiredEnv = [
+  'FRONTEND_URL', 'FRONTEND_PORT', 'BACKEND_URL', 'BACKEND_PORT', 'DB_PORT',
+  'PROJECT_NAME', 'SERVER_PROJECTS_ROOT', 'PROJECT_HTTP_PORT', 'DOCKER_BIND_IP',
+  'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT',
+  'FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE', 'DATABASE_MIGRATION_MODE',
 ];
-for (const requiredPath of requiredPaths) {
-  try {
-    await stat(join(versionRoot, requiredPath));
-  } catch {
-    throw new Error(`Missing generated release package path: ${requiredPath}`);
+for (const key of requiredEnv) if (!env.get(key)) throw new Error(`Root .env is missing ${key}`);
+for (const key of env.keys()) {
+  if (['FRONTEND_CONTAINER_PORT', 'BACKEND_CONTAINER_PORT', 'BACKEND_LISTEN_HOST'].includes(key) || /_(?:HEALTH|VERSION)_URL$/.test(key)) {
+    throw new Error(`Root .env contains legacy duplicate configuration: ${key}`);
   }
 }
-
-const runner = await stat(join(versionRoot, 'scripts/apply-migrations.sh'));
-if (!runner.isFile() || (runner.mode & 0o111) === 0) {
-  throw new Error('Generated migration runner must be an executable file');
+if (!/^[a-z][a-z0-9_]*$/.test(env.get('PROJECT_NAME'))) throw new Error('Invalid PROJECT_NAME');
+if (!/^\/.+[^/]$/.test(env.get('SERVER_PROJECTS_ROOT'))) throw new Error('Invalid SERVER_PROJECTS_ROOT');
+for (const key of ['FRONTEND_URL', 'BACKEND_URL', 'DOCKER_BIND_IP']) {
+  if (!/^[A-Za-z0-9:.%-]+$/.test(env.get(key))) throw new Error(`${key} contains unsafe characters`);
+}
+for (const key of ['FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE']) {
+  if (!/@sha256:[0-9a-f]{64}$/.test(env.get(key))) throw new Error(`${key} must be pinned by digest`);
 }
-const migrationEntries = await readdir(join(versionRoot, 'database/migrations'));
-if (!migrationEntries.some((entry) => /^V\d{3}__[a-z0-9]+(?:_[a-z0-9]+)*\.sql$/.test(entry))) {
-  throw new Error('Generated release package must include versioned database migrations');
+const migrationMode = env.get('DATABASE_MIGRATION_MODE');
+if (!['manual', 'none'].includes(migrationMode)) throw new Error('DATABASE_MIGRATION_MODE must be manual or none');
+if (env.has('LOG_DIR') || env.has('HOST_LOG_DIR')) throw new Error('Root .env must not configure log directories');
+const allPortKeys = ['FRONTEND_PORT', 'BACKEND_PORT', 'DB_PORT', 'PROJECT_HTTP_PORT', 'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT'];
+for (const key of allPortKeys) {
+  const port = Number(env.get(key));
+  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error(`${key} must be a valid port`);
+}
+const hostPortKeys = ['PROJECT_HTTP_PORT', 'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT'];
+const hostPorts = hostPortKeys.map((key) => Number(env.get(key)));
+if (hostPorts.some((port) => !Number.isInteger(port) || port < 1 || port > 65535) || new Set(hostPorts).size !== hostPorts.length) {
+  throw new Error('Project and host blue-green ports must be valid and unique');
 }
 
-async function listFiles(root, directory = root) {
-  const result = [];
-  for (const entry of await readdir(directory, { withFileTypes: true })) {
-    const path = join(directory, entry.name);
-    if (entry.isSymbolicLink()) {
-      throw new Error(`Generated release package must not contain symbolic links: ${relative(root, path)}`);
-    }
-    if (entry.isDirectory()) result.push(...await listFiles(root, path));
-    else if (entry.isFile()) result.push(relative(root, path).split(sep).join('/'));
-  }
-  return result;
+const releaseEnv = await readFile(join(packageRoot, 'release.env'), 'utf8');
+const releaseMatch = releaseEnv.match(/^RELEASE_VERSION=(\d{8}-\d{3})\n$/);
+if (!releaseMatch) throw new Error('release.env must contain exactly one release version');
+const version = releaseMatch[1];
+const expectedRootEntries = ['.env', version, 'deploy.sh', 'release.env'].sort();
+assertDeepEqual((await readdir(packageRoot)).sort(), expectedRootEntries, 'Generated deploy root has unexpected entries');
+if (resolve(deployPath) !== resolve(packageRoot, 'deploy.sh')) throw new Error('deploy.sh must be the package root script');
+if (resolve(nginxPath) !== resolve(packageRoot, version, 'nginx/site.conf')) throw new Error('Nginx path must be inside the selected version');
+if (resolve(composePath) !== resolve(packageRoot, version, 'docker/docker-compose.blue-green.yml')) throw new Error('Compose path must be inside the selected version');
+
+const versionRoot = join(packageRoot, version);
+const requiredPaths = ['frontend-image.tar', 'backend-image.tar', 'manifest.sha256', 'docker/docker-compose.blue-green.yml', 'nginx/site.conf'];
+for (const path of requiredPaths) {
+  const info = await stat(join(versionRoot, path));
+  if (!info.isFile()) throw new Error(`Required release path is not a file: ${path}`);
+}
+if (migrationMode === 'manual') {
+  const runner = await stat(join(versionRoot, 'database/apply-migrations.sh'));
+  if (!runner.isFile() || (runner.mode & 0o111) === 0) throw new Error('Manual migration runner must be executable');
+  const migrations = await readdir(join(versionRoot, 'database/migrations'));
+  if (!migrations.some((item) => /^V\d{3}__[a-z0-9]+(?:_[a-z0-9]+)*\.sql$/.test(item))) throw new Error('Manual migration files are missing');
+} else {
+  await assertMissing(join(versionRoot, 'database'), 'none mode must not package database files');
 }
 
 const versionFiles = (await listFiles(versionRoot)).sort();
 for (const path of versionFiles) {
   const name = basename(path);
-  if (
-    name === '.env'
-    || name.startsWith('.env.')
-    || /\.(?:pem|key)$/.test(name)
-    || /^(?:id_rsa|id_ed25519|credentials(?:\..*)?)$/.test(name)
-  ) {
-    throw new Error(`Production secret file must not be packaged: ${path}`);
+  if (name === '.env' || name.startsWith('.env.') || /\.(?:pem|key)$/.test(name) || /^(?:id_rsa|id_ed25519|credentials(?:\..*)?)$/.test(name)) {
+    throw new Error(`Secret file must not enter version directory: ${path}`);
   }
 }
-
-const manifestPath = join(versionRoot, 'manifest.sha256');
-const manifest = await readFile(manifestPath, 'utf8');
+const manifest = await readFile(join(versionRoot, 'manifest.sha256'), 'utf8');
 const entries = new Map();
 for (const line of manifest.trimEnd().split('\n')) {
   const match = line.match(/^([0-9a-f]{64})  ([^/].*)$/);
-  if (!match || match[2].split('/').includes('..')) {
-    throw new Error(`Invalid manifest entry: ${line}`);
-  }
+  if (!match || match[2].split('/').includes('..')) throw new Error(`Invalid manifest entry: ${line}`);
   if (entries.has(match[2])) throw new Error(`Duplicate manifest entry: ${match[2]}`);
   entries.set(match[2], match[1]);
 }
-const expectedManifestFiles = versionFiles.filter((path) => path !== 'manifest.sha256');
-if (JSON.stringify([...entries.keys()].sort()) !== JSON.stringify(expectedManifestFiles)) {
-  throw new Error('manifest.sha256 must cover every generated release file exactly once');
-}
+assertDeepEqual([...entries.keys()].sort(), versionFiles.filter((path) => path !== 'manifest.sha256'), 'Manifest coverage is incomplete');
 for (const [path, expected] of entries) {
   const actual = createHash('sha256').update(await readFile(join(versionRoot, path))).digest('hex');
   if (actual !== expected) throw new Error(`Checksum mismatch: ${path}`);
 }
 
-process.stdout.write(`valid deployment package ${version}\n`);
+process.stdout.write(`valid dual-image deployment package ${version}\n`);
+
+function assertDeepEqual(actual, expected, message) {
+  if (JSON.stringify(actual) !== JSON.stringify(expected)) {
+    throw new Error(`${message}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`);
+  }
+}
+
+async function assertMissing(path, message) {
+  try { await lstat(path); } catch (error) { if (error.code === 'ENOENT') return; throw error; }
+  throw new Error(message);
+}
+
+async function listFiles(root, directory = root) {
+  const result = [];
+  for (const entry of await readdir(directory, { withFileTypes: true })) {
+    const path = join(directory, entry.name);
+    if (entry.isSymbolicLink()) throw new Error(`Release package must not contain symbolic links: ${relative(root, path)}`);
+    if (entry.isDirectory()) result.push(...await listFiles(root, path));
+    else if (entry.isFile()) result.push(relative(root, path).split(sep).join('/'));
+  }
+  return result;
+}