@weotro/dx 0.1.19 → 0.2.0

package/bin/dx-with-version-env.js

@@ -1,8 +0,0 @@
-#!/usr/bin/env node
-
-import { runWithVersionEnv } from '../lib/run-with-version-env.js'
-
-runWithVersionEnv(process.argv.slice(2)).catch(error => {
-  console.error('[dx-with-version-env] failed:', error?.message || String(error))
-  process.exit(1)
-})

package/lib/artifact-deploy/artifact-builder.js

@@ -1,144 +0,0 @@
-import { execFile } from 'node:child_process'
-import { existsSync } from 'node:fs'
-import { cp, mkdir, readdir, readFile, rm, writeFile } from 'node:fs/promises'
-import { basename, dirname, join } from 'node:path'
-import { promisify } from 'node:util'
-import { execManager } from '../exec.js'
-import { resolveWithinBase } from '../backend-artifact-deploy/path-utils.js'
-
-const execFileAsync = promisify(execFile)
-const tarEnv = {
-  ...process.env,
-  COPYFILE_DISABLE: '1',
-  COPY_EXTENDED_ATTRIBUTES_DISABLE: '1',
-}
-
-function assertSafeNamePart(value, label) {
-  const text = String(value || '').trim()
-  if (!text || text.includes('/') || text.includes('\\') || text.includes('..')) {
-    throw new Error(`${label} 越界，已拒绝: ${text}`)
-  }
-  return text
-}
-
-function defaultNowTag() {
-  const now = new Date()
-  const pad = value => String(value).padStart(2, '0')
-  return `${now.getFullYear()}${pad(now.getMonth() + 1)}${pad(now.getDate())}-${pad(now.getHours())}${pad(now.getMinutes())}${pad(now.getSeconds())}`
-}
-
-async function defaultRunBuild(build, environment) {
-  await execManager.executeCommand(build.command, {
-    app: build.app || undefined,
-    skipEnvValidation: !build.app,
-    flags: environment === 'production'
-      ? { prod: true }
-      : environment === 'staging'
-        ? { staging: true }
-        : { dev: true },
-  })
-}
-
-async function defaultReadVersion(config) {
-  if (config.artifact.version) return config.artifact.version
-  if (config.build.versionCommand) {
-    const { stdout } = await execFileAsync('bash', ['-lc', config.build.versionCommand], {
-      cwd: config.projectRoot,
-      env: process.env,
-    })
-    return String(stdout).trim()
-  }
-
-  const parsed = JSON.parse(await readFile(config.build.versionFile, 'utf8'))
-  return String(parsed.version || '').trim()
-}
-
-async function defaultStageFiles(sourceDir, stageDir) {
-  if (!existsSync(sourceDir)) throw new Error(`缺少待打包目录: ${sourceDir}`)
-  await rm(stageDir, { recursive: true, force: true })
-  await mkdir(stageDir, { recursive: true })
-  for (const entry of await readdir(sourceDir)) {
-    await cp(join(sourceDir, entry), join(stageDir, entry), { recursive: true })
-  }
-}
-
-async function defaultAssertNoEnvFiles(stageDir) {
-  const queue = ['.']
-  const envFiles = []
-  while (queue.length > 0) {
-    const relativeDir = queue.shift()
-    const currentDir = relativeDir === '.' ? stageDir : join(stageDir, relativeDir)
-    for (const entry of await readdir(currentDir, { withFileTypes: true })) {
-      const relativePath = relativeDir === '.' ? entry.name : join(relativeDir, entry.name)
-      if (entry.name.startsWith('.env')) envFiles.push(relativePath.replace(/\\/g, '/'))
-      if (entry.isDirectory()) queue.push(relativePath)
-    }
-  }
-  if (envFiles.length > 0) throw new Error(`制品目录包含 .env* 文件: ${envFiles.join(', ')}`)
-}
-
-export function createArtifactNames({ version, timeTag, bundleName, releaseName }) {
-  const safeVersion = assertSafeNamePart(version, 'version')
-  const safeTimeTag = assertSafeNamePart(timeTag, 'timeTag')
-  const safeBundleName = assertSafeNamePart(bundleName, 'bundleName')
-  const safeReleaseName = assertSafeNamePart(releaseName, 'releaseName')
-  const versionName = `${safeReleaseName}-v${safeVersion}-${safeTimeTag}`
-  const innerArchiveName = `${versionName}.tgz`
-  return {
-    versionName,
-    innerArchiveName,
-    checksumName: `${innerArchiveName}.sha256`,
-    bundleName: `${safeBundleName}-v${safeVersion}-${safeTimeTag}.tgz`,
-  }
-}
-
-export async function buildArtifact(config, deps = {}) {
-  const runBuild = deps.runBuild || defaultRunBuild
-  const readVersion = deps.readVersion || defaultReadVersion
-  const nowTag = deps.nowTag || defaultNowTag
-  const stageFiles = deps.stageFiles || defaultStageFiles
-  const assertNoEnvFiles = deps.assertNoEnvFiles || defaultAssertNoEnvFiles
-  const version = await readVersion(config)
-  if (!version) throw new Error('无法解析制品版本')
-
-  const names = createArtifactNames({
-    version,
-    timeTag: nowTag(),
-    bundleName: config.artifact.bundleName,
-    releaseName: config.artifact.releaseName,
-  })
-  const outputDir = resolveWithinBase(config.artifact.outputDir, '.', 'artifact.outputDir')
-  const stageDir = resolveWithinBase(outputDir, names.versionName, 'stageDir')
-  const innerArchivePath = resolveWithinBase(outputDir, names.innerArchiveName, 'innerArchivePath')
-  const checksumPath = resolveWithinBase(outputDir, names.checksumName, 'checksumPath')
-  const bundlePath = resolveWithinBase(outputDir, names.bundleName, 'bundlePath')
-
-  await runBuild(config.build, config.environment)
-  await mkdir(outputDir, { recursive: true })
-  await stageFiles(config.build.sourceDir, stageDir)
-  await assertNoEnvFiles(stageDir)
-  await execFileAsync('tar', ['-czf', innerArchivePath, '.'], { cwd: stageDir, env: tarEnv })
-
-  const archiveName = basename(innerArchivePath)
-  let checksum
-  try {
-    checksum = await execFileAsync('sha256sum', [archiveName], { cwd: dirname(innerArchivePath) })
-  } catch {
-    checksum = await execFileAsync('shasum', ['-a', '256', archiveName], { cwd: dirname(innerArchivePath) })
-  }
-  await writeFile(checksumPath, checksum.stdout)
-  await execFileAsync('tar', ['-czf', bundlePath, archiveName, basename(checksumPath)], {
-    cwd: outputDir,
-    env: tarEnv,
-  })
-
-  return {
-    version,
-    versionName: names.versionName,
-    innerArchiveName: names.innerArchiveName,
-    checksumName: names.checksumName,
-    bundlePath,
-    innerArchivePath,
-    checksumPath,
-  }
-}

package/lib/artifact-deploy/config.js

@@ -1,180 +0,0 @@
-import { isAbsolute } from 'node:path'
-import { resolveWithinBase } from '../backend-artifact-deploy/path-utils.js'
-
-function requireString(value, fieldPath) {
-  if (typeof value !== 'string' || value.trim() === '') {
-    throw new Error(`缺少必填配置: ${fieldPath}`)
-  }
-  return value.trim()
-}
-
-function optionalString(value) {
-  return typeof value === 'string' && value.trim() ? value.trim() : null
-}
-
-function requireSafeName(value, fieldPath) {
-  const name = requireString(value, fieldPath)
-  if (!/^[A-Za-z0-9._-]+$/.test(name) || name.includes('..')) {
-    throw new Error(`${fieldPath} 包含非法字符: ${name}`)
-  }
-  return name
-}
-
-function requirePositiveInteger(value, fieldPath) {
-  const parsed = Number(value)
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    throw new Error(`缺少必填配置: ${fieldPath}`)
-  }
-  return parsed
-}
-
-function resolveProjectPath(projectRoot, value, fieldPath) {
-  return resolveWithinBase(projectRoot, requireString(value, fieldPath), fieldPath)
-}
-
-function requireRemoteBaseDir(value, fieldPath) {
-  const baseDir = requireString(value, fieldPath)
-  if (!isAbsolute(baseDir)) throw new Error(`${fieldPath} 必须是绝对路径: ${baseDir}`)
-  if (!/^\/[A-Za-z0-9._/-]*$/.test(baseDir)) {
-    throw new Error(`${fieldPath} 包含非法字符: ${baseDir}`)
-  }
-  return baseDir.replace(/\/+$/, '') || '/'
-}
-
-function resolveRemoteConfig(remoteConfig, environment) {
-  if (!remoteConfig || typeof remoteConfig !== 'object') return null
-  if (typeof remoteConfig.host === 'string') return remoteConfig
-
-  const selected = remoteConfig[environment]
-  if (!selected || typeof selected !== 'object') {
-    throw new Error(`缺少必填配置: remote.${environment}`)
-  }
-  return selected
-}
-
-function resolveBuildCommand(buildConfig, environment) {
-  if (buildConfig?.commands && typeof buildConfig.commands === 'object') {
-    return requireString(buildConfig.commands[environment], `build.commands.${environment}`)
-  }
-  return requireString(buildConfig?.command, 'build.command')
-}
-
-function resolveHealthCheck(healthCheckConfig) {
-  if (healthCheckConfig == null) return null
-  const url = requireString(healthCheckConfig.url, 'verify.healthCheck.url')
-  try {
-    new URL(url)
-  } catch {
-    throw new Error('缺少必填配置: verify.healthCheck.url')
-  }
-
-  return {
-    url,
-    timeoutSeconds: healthCheckConfig.timeoutSeconds == null
-      ? 10
-      : requirePositiveInteger(healthCheckConfig.timeoutSeconds, 'verify.healthCheck.timeoutSeconds'),
-    maxWaitSeconds: healthCheckConfig.maxWaitSeconds == null
-      ? 24
-      : requirePositiveInteger(healthCheckConfig.maxWaitSeconds, 'verify.healthCheck.maxWaitSeconds'),
-    retryIntervalSeconds: healthCheckConfig.retryIntervalSeconds == null
-      ? 2
-      : requirePositiveInteger(
-          healthCheckConfig.retryIntervalSeconds,
-          'verify.healthCheck.retryIntervalSeconds',
-        ),
-  }
-}
-
-export function resolveArtifactDeployConfig({ cli, target, targetConfig, environment, flags = {} }) {
-  const deployConfig = targetConfig?.artifactDeploy
-  if (!deployConfig || typeof deployConfig !== 'object') {
-    throw new Error('缺少必填配置: artifactDeploy')
-  }
-
-  const buildConfig = deployConfig.build || {}
-  const artifactConfig = deployConfig.artifact || {}
-  const startupConfig = deployConfig.startup || {}
-  const runConfig = deployConfig.deploy || {}
-  const verifyConfig = deployConfig.verify || {}
-  const buildOnly = Boolean(flags.buildOnly)
-  const remoteConfig = resolveRemoteConfig(deployConfig.remote, environment)
-  const startupMode = optionalString(startupConfig.mode) || 'command'
-
-  if (!['systemd', 'command'].includes(startupMode)) {
-    throw new Error('startup.mode 仅支持 systemd 或 command')
-  }
-
-  const versionFile = optionalString(buildConfig.versionFile)
-  const versionCommand = optionalString(buildConfig.versionCommand)
-  const version = optionalString(artifactConfig.version)
-  if (!versionFile && !versionCommand && !version) {
-    throw new Error('缺少必填配置: build.versionFile、build.versionCommand 或 artifact.version')
-  }
-
-  const serviceName = optionalString(startupConfig.serviceName)
-  const startupCommand = optionalString(startupConfig.command)
-  if (serviceName && !/^[A-Za-z0-9_.@-]+$/.test(serviceName)) {
-    throw new Error(`startup.serviceName 包含非法字符: ${serviceName}`)
-  }
-  if (startupMode === 'systemd' && !serviceName) {
-    throw new Error('缺少必填配置: startup.serviceName')
-  }
-  if (startupMode === 'command' && !startupCommand) {
-    throw new Error('缺少必填配置: startup.command')
-  }
-  const healthCheck = resolveHealthCheck(verifyConfig.healthCheck)
-
-  return {
-    projectRoot: cli.projectRoot,
-    target,
-    environment,
-    build: {
-      app: optionalString(buildConfig.app),
-      command: resolveBuildCommand(buildConfig, environment),
-      sourceDir: resolveProjectPath(cli.projectRoot, buildConfig.sourceDir, 'build.sourceDir'),
-      versionFile: versionFile
-        ? resolveProjectPath(cli.projectRoot, versionFile, 'build.versionFile')
-        : null,
-      versionCommand,
-    },
-    artifact: {
-      outputDir: resolveProjectPath(cli.projectRoot, artifactConfig.outputDir, 'artifact.outputDir'),
-      bundleName: requireSafeName(artifactConfig.bundleName, 'artifact.bundleName'),
-      releaseName: requireSafeName(
-        optionalString(artifactConfig.releaseName) || String(target),
-        'artifact.releaseName',
-      ),
-      version,
-    },
-    remote: buildOnly
-      ? null
-      : {
-          host: requireString(remoteConfig?.host, 'remote.host'),
-          port: remoteConfig?.port == null ? 22 : requirePositiveInteger(remoteConfig.port, 'remote.port'),
-          user: requireString(remoteConfig?.user, 'remote.user'),
-          baseDir: requireRemoteBaseDir(remoteConfig?.baseDir, 'remote.baseDir'),
-        },
-    startup: {
-      mode: startupMode,
-      serviceName,
-      command: startupCommand,
-      rollbackCommand: optionalString(startupConfig.rollbackCommand),
-    },
-    deploy: {
-      keepReleases: runConfig.keepReleases == null
-        ? 5
-        : requirePositiveInteger(runConfig.keepReleases, 'deploy.keepReleases'),
-      installCommand: optionalString(runConfig.installCommand),
-    },
-    verify: {
-      command: optionalString(verifyConfig.command),
-      maxWaitSeconds: verifyConfig.maxWaitSeconds == null
-        ? healthCheck?.maxWaitSeconds || 24
-        : requirePositiveInteger(verifyConfig.maxWaitSeconds, 'verify.maxWaitSeconds'),
-      retryIntervalSeconds: verifyConfig.retryIntervalSeconds == null
-        ? healthCheck?.retryIntervalSeconds || 2
-        : requirePositiveInteger(verifyConfig.retryIntervalSeconds, 'verify.retryIntervalSeconds'),
-      healthCheck,
-    },
-  }
-}

package/lib/artifact-deploy/remote-script.js

@@ -1,301 +0,0 @@
-function escapeShell(value) {
-  return `'${String(value).replace(/'/g, `'\\''`)}'`
-}
-
-export function buildRemoteDeployScript(payload = {}) {
-  const remote = payload.remote || {}
-  const artifact = payload.artifact || {}
-  const startup = payload.startup || {}
-  const deploy = payload.deploy || {}
-  const verify = payload.verify || {}
-  const healthCheck = verify.healthCheck || null
-  const baseDir = String(remote.baseDir || '.')
-  const versionName = String(payload.versionName || 'unknown')
-  const releaseDir = `${baseDir}/releases/${versionName}`
-  const currentLink = `${baseDir}/current`
-  const serviceName = String(startup.serviceName || '')
-  const startupMode = String(startup.mode || 'command')
-  const startupCommand = String(
-    startup.command || (startupMode === 'systemd' ? `sudo systemctl restart ${serviceName}` : ''),
-  )
-  const rollbackCommand = String(startup.rollbackCommand || startupCommand)
-  const verifyCommand = String(
-    verify.command || (startupMode === 'systemd' ? `sudo systemctl is-active --quiet ${serviceName}` : ''),
-  )
-  const installCommand = String(deploy.installCommand || '')
-  const healthCheckUrl = String(healthCheck?.url || '')
-  const healthCheckTimeoutSeconds = Number(healthCheck?.timeoutSeconds || 10)
-  const healthCheckMaxWaitSeconds = Number(verify.maxWaitSeconds || healthCheck?.maxWaitSeconds || 24)
-  const retryIntervalSeconds = Number(
-    verify.retryIntervalSeconds || healthCheck?.retryIntervalSeconds || 2,
-  )
-
-  return `#!/usr/bin/env bash
-set -euo pipefail
-
-APP_ROOT=${escapeShell(baseDir)}
-ARCHIVE=${escapeShell(payload.uploadedBundlePath || '')}
-RELEASE_DIR=${escapeShell(releaseDir)}
-CURRENT_LINK=${escapeShell(currentLink)}
-ENV_NAME=${escapeShell(payload.environment || 'production')}
-VERSION_NAME=${escapeShell(versionName)}
-INNER_ARCHIVE_NAME=${escapeShell(artifact.innerArchiveName || `${versionName}.tgz`)}
-CHECKSUM_NAME=${escapeShell(artifact.checksumName || `${versionName}.tgz.sha256`)}
-START_MODE=${escapeShell(startupMode)}
-SERVICE_NAME=${escapeShell(serviceName)}
-INSTALL_COMMAND=${escapeShell(installCommand)}
-START_COMMAND=${escapeShell(startupCommand)}
-ROLLBACK_COMMAND=${escapeShell(rollbackCommand)}
-VERIFY_COMMAND=${escapeShell(verifyCommand)}
-HEALTHCHECK_URL=${escapeShell(healthCheckUrl)}
-HEALTHCHECK_TIMEOUT_SECONDS=${healthCheckTimeoutSeconds}
-VERIFY_MAX_WAIT_SECONDS=${healthCheckMaxWaitSeconds}
-VERIFY_RETRY_DELAY_SECONDS=${retryIntervalSeconds}
-KEEP_RELEASES=${Number(deploy.keepReleases || 5)}
-
-LOCK_FILE="$APP_ROOT/.deploy.lock"
-LOCK_DIR="$APP_ROOT/.deploy.lock.d"
-SHARED_DIR="$APP_ROOT/shared"
-RELEASES_DIR="$APP_ROOT/releases"
-UPLOADS_DIR="$APP_ROOT/uploads"
-PREVIOUS_CURRENT_TARGET=""
-BUNDLE_TEMP_DIR=""
-CURRENT_PHASE="init"
-RESULT_EMITTED=0
-ROLLBACK_ATTEMPTED=false
-ROLLBACK_SUCCEEDED=null
-CURRENT_SWITCHED=0
-
-json_escape() {
-  local value="\${1-}"
-  value="\${value//\\\\/\\\\\\\\}"
-  value="\${value//\"/\\\\\"}"
-  value="\${value//$'\\n'/\\\\n}"
-  value="\${value//$'\\r'/\\\\r}"
-  value="\${value//$'\\t'/\\\\t}"
-  printf '%s' "$value"
-}
-
-build_summary_json() {
-  local current_release="$1"
-  printf '{"releaseName":"%s","currentRelease":"%s","serviceName":"%s","startupMode":"%s","healthUrl":"%s"}' \\
-    "$(json_escape "$VERSION_NAME")" \\
-    "$(json_escape "$current_release")" \\
-    "$(json_escape "$SERVICE_NAME")" \\
-    "$(json_escape "$START_MODE")" \\
-    "$(json_escape "$HEALTHCHECK_URL")"
-}
-
-emit_result() {
-  local ok="$1"
-  local phase="$2"
-  local message="$3"
-  local summary_json="\${4:-null}"
-  if [[ "$RESULT_EMITTED" -eq 1 ]]; then return; fi
-  RESULT_EMITTED=1
-  message="\${message//\\\\/\\\\\\\\}"
-  message="\${message//\"/\\\\\"}"
-  message="\${message//$'\\n'/\\\\n}"
-  printf 'DX_REMOTE_RESULT={"ok":%s,"phase":"%s","message":"%s","rollbackAttempted":%s,"rollbackSucceeded":%s,"summary":%s}\\n' \\
-    "$ok" "$phase" "$message" "$ROLLBACK_ATTEMPTED" "$ROLLBACK_SUCCEEDED" "$summary_json"
-}
-
-cleanup() {
-  rm -rf "$BUNDLE_TEMP_DIR" 2>/dev/null || true
-  rmdir "$LOCK_DIR" 2>/dev/null || true
-}
-
-run_command_at() {
-  local cwd="$1"
-  local command="$2"
-  if [[ -z "$command" ]]; then return 0; fi
-  (
-    cd "$cwd"
-    DX_RELEASE_DIR="$cwd" \\
-    DX_CURRENT_LINK="$CURRENT_LINK" \\
-    DX_PREVIOUS_RELEASE="$PREVIOUS_CURRENT_TARGET" \\
-    DX_ENVIRONMENT="$ENV_NAME" \\
-    DX_SERVICE_NAME="$SERVICE_NAME" \\
-      bash -lc "$command"
-  )
-}
-
-attempt_rollback() {
-  if [[ -z "$PREVIOUS_CURRENT_TARGET" || ! -d "$PREVIOUS_CURRENT_TARGET" ]]; then
-    return
-  fi
-  ROLLBACK_ATTEMPTED=true
-  if ln -sfn "$PREVIOUS_CURRENT_TARGET" "$CURRENT_LINK" && run_command_at "$CURRENT_LINK" "$ROLLBACK_COMMAND"; then
-    ROLLBACK_SUCCEEDED=true
-  else
-    ROLLBACK_SUCCEEDED=false
-  fi
-}
-
-fail_after_switch() {
-  local phase="$1"
-  local message="$2"
-  attempt_rollback
-  emit_result false "$phase" "$message"
-  exit 1
-}
-
-on_error() {
-  local code=$?
-  if [[ "$CURRENT_SWITCHED" -eq 1 && "$ROLLBACK_ATTEMPTED" == "false" ]]; then
-    attempt_rollback
-  fi
-  emit_result false "$CURRENT_PHASE" "phase failed (exit $code)"
-  exit "$code"
-}
-
-trap cleanup EXIT
-trap on_error ERR
-
-validate_path_within_base() {
-  local base="$1"
-  local target="$2"
-  case "$target" in
-    "$base"/*|"$base") ;;
-    *) echo "目标路径越界: $target" >&2; exit 1 ;;
-  esac
-}
-
-validate_archive_entries() {
-  local archive="$1"
-  local entry
-  local tar_line
-  local link_target
-  while IFS= read -r entry; do
-    if [[ "$entry" == /* || "$entry" =~ (^|/)\\.\\.(/|$) || "$entry" =~ \\.\\.\\\\ ]]; then
-      echo "包含可疑路径条目: $entry" >&2
-      exit 1
-    fi
-  done < <(tar -tzf "$archive")
-  while IFS= read -r tar_line; do
-    if [[ "$tar_line" == *" -> "* ]]; then
-      link_target="\${tar_line##* -> }"
-      if [[ "$link_target" == /* || "$link_target" =~ (^|/)\\.\\.(/|$) || "$link_target" =~ \\.\\.\\\\ ]]; then
-        echo "包含可疑链接目标: $link_target" >&2
-        exit 1
-      fi
-    fi
-  done < <(tar -tvzf "$archive")
-}
-
-sha256_check() {
-  local checksum_file="$1"
-  local expected actual file
-  expected="$(awk '{print $1}' "$checksum_file")"
-  file="$(basename "$(awk '{print $2}' "$checksum_file")")"
-  if command -v sha256sum >/dev/null 2>&1; then
-    actual="$(sha256sum "$file" | awk '{print $1}')"
-  else
-    actual="$(shasum -a 256 "$file" | awk '{print $1}')"
-  fi
-  [[ "$expected" == "$actual" ]]
-}
-
-retry_command() {
-  local command="$1"
-  local label="$2"
-  local started_at elapsed
-  if [[ -z "$command" ]]; then return 0; fi
-  started_at="$(date +%s)"
-  until run_command_at "$CURRENT_LINK" "$command"; do
-    elapsed=$(( $(date +%s) - started_at ))
-    if [[ "$elapsed" -ge "$VERIFY_MAX_WAIT_SECONDS" ]]; then
-      echo "$label failed within $VERIFY_MAX_WAIT_SECONDS seconds" >&2
-      return 1
-    fi
-    sleep "$VERIFY_RETRY_DELAY_SECONDS"
-  done
-}
-
-CURRENT_PHASE="lock"
-echo "DX_REMOTE_PHASE=lock"
-mkdir -p "$RELEASES_DIR" "$SHARED_DIR" "$UPLOADS_DIR"
-validate_path_within_base "$APP_ROOT" "$ARCHIVE"
-validate_path_within_base "$APP_ROOT" "$RELEASE_DIR"
-PREVIOUS_CURRENT_TARGET="$(readlink -f "$CURRENT_LINK" 2>/dev/null || true)"
-if command -v flock >/dev/null 2>&1; then
-  exec 9>"$LOCK_FILE"
-  flock -n 9
-else
-  mkdir "$LOCK_DIR"
-fi
-
-CURRENT_PHASE="extract"
-echo "DX_REMOTE_PHASE=extract"
-validate_archive_entries "$ARCHIVE"
-BUNDLE_TEMP_DIR="$(mktemp -d "$APP_ROOT/.bundle-extract.XXXXXX")"
-tar -xzf "$ARCHIVE" -C "$BUNDLE_TEMP_DIR"
-INNER_ARCHIVE="$BUNDLE_TEMP_DIR/$INNER_ARCHIVE_NAME"
-CHECKSUM_FILE="$BUNDLE_TEMP_DIR/$CHECKSUM_NAME"
-if [[ ! -f "$INNER_ARCHIVE" || ! -f "$CHECKSUM_FILE" ]]; then
-  echo "制品包缺少 $INNER_ARCHIVE_NAME 或 $CHECKSUM_NAME" >&2
-  exit 1
-fi
-(cd "$BUNDLE_TEMP_DIR" && sha256_check "$CHECKSUM_NAME")
-validate_archive_entries "$INNER_ARCHIVE"
-rm -rf "$RELEASE_DIR"
-mkdir -p "$RELEASE_DIR"
-tar -xzf "$INNER_ARCHIVE" -C "$RELEASE_DIR" --strip-components=1
-
-CURRENT_PHASE="install"
-echo "DX_REMOTE_PHASE=install"
-run_command_at "$RELEASE_DIR" "$INSTALL_COMMAND"
-
-CURRENT_PHASE="switch-current"
-echo "DX_REMOTE_PHASE=switch-current"
-ln -sfn "$RELEASE_DIR" "$CURRENT_LINK"
-CURRENT_SWITCHED=1
-
-CURRENT_PHASE="startup"
-echo "DX_REMOTE_PHASE=startup"
-if ! run_command_at "$CURRENT_LINK" "$START_COMMAND"; then
-  attempt_rollback
-  emit_result false "startup" "startup command failed"
-  exit 1
-fi
-
-CURRENT_PHASE="verify"
-echo "DX_REMOTE_PHASE=verify"
-current_release="$(readlink -f "$CURRENT_LINK")"
-expected_release="$(readlink -f "$RELEASE_DIR")"
-if [[ -z "$current_release" || "$current_release" != "$expected_release" ]]; then
-  echo "current 软链接未指向本次 release: expected=$expected_release actual=\${current_release:-<empty>}" >&2
-  fail_after_switch "verify" "current symlink verification failed"
-fi
-
-retry_command "$VERIFY_COMMAND" "verify command"
-if [[ -n "$HEALTHCHECK_URL" ]]; then
-  command -v curl >/dev/null 2>&1
-  healthcheck_started_at="$(date +%s)"
-  until curl -fsS --max-time "$HEALTHCHECK_TIMEOUT_SECONDS" "$HEALTHCHECK_URL" >/dev/null; do
-    healthcheck_elapsed_seconds=$(( $(date +%s) - healthcheck_started_at ))
-    if [[ "$healthcheck_elapsed_seconds" -ge "$VERIFY_MAX_WAIT_SECONDS" ]]; then
-      echo "health check failed within $VERIFY_MAX_WAIT_SECONDS seconds: $HEALTHCHECK_URL" >&2
-      fail_after_switch "verify" "health check failed"
-    fi
-    sleep "$VERIFY_RETRY_DELAY_SECONDS"
-  done
-fi
-
-CURRENT_PHASE="cleanup"
-echo "DX_REMOTE_PHASE=cleanup"
-release_count=0
-shopt -s nullglob
-release_dirs=("$RELEASES_DIR"/*)
-shopt -u nullglob
-while IFS= read -r old_release; do
-  release_count=$((release_count + 1))
-  if [[ "$release_count" -gt "$KEEP_RELEASES" ]]; then rm -rf "$old_release"; fi
-done < <(
-  if [[ "\${#release_dirs[@]}" -gt 0 ]]; then ls -1dt "\${release_dirs[@]}"; fi
-)
-
-summary_json="$(build_summary_json "$current_release")"
-emit_result true "cleanup" "ok" "$summary_json"
-`
-}