@xfe-repo/web-app 2.0.0-beta.3 → 2.0.0-beta.4

package/README.md

@@ -122,3 +122,35 @@ SSR `start` 使用与构建一致的隐藏工作目录，使官方 serve 正确
 构建会先加载 `react-app-polyfill/stable`，并在应用原有 browserslist 的基础上，补充 Edge 18、Chrome 64、Firefox 60、Safari/iOS 12 及以上的 JS 编译目标，业务代码和第三方依赖使用同一目标。
 
 这是 JS 兼容基线；具体组件样式和浏览器 Web API 仍需在目标浏览器验证。
+
+
+## 可选的项目部署模板
+
+已有项目保持默认 Node 22、集群选择、发布环境和无状态部署方式。设置 `deploy.managed: true` 后，`xfe-web config` 将框架模板生成到项目 `deploy/`，不修改 npm 包中的 Helm values；项目只维护配置，生成文件由框架管理。Drone 入口需提交仓库，安装后的流水线再通过同一命令生成模板。
+
+```json
+{
+  "deploy": {
+    "managed": true,
+    "droneConfigPath": "deploy/.drone.yml",
+    "targetK8s": "infra",
+    "targetNamespace": "deployment-prod",
+    "nodeVersion": "24.22.1",
+    "environments": ["prod"],
+    "hostsProd": ["app.example.com"],
+    "buildCommand": "pnpm check && pnpm build && pnpm prune --prod",
+    "values": {
+      "replicas": 1,
+      "strategy": {"type": "Recreate"},
+      "persistence": {"enabled": true, "size": "20Gi", "mountPath": "/data"},
+      "podSecurityContext": {"fsGroup": 1000},
+      "env": [{"name": "DATA_DIR", "value": "/data"}],
+      "envFrom": [{"secretRef": {"name": "application-env"}}]
+    }
+  }
+}
+```
+
+`values` 递归覆盖默认 Helm values；列表整体替换。可配置实例数、更新策略、容器资源、Pod/容器安全上下文、环境变量及来源、启动/就绪/存活探针、终止宽限期和 PVC。PVC 默认关闭，可指定 `existingClaim` 或 `storageClass`。应用负责声明自己的 `DATA_DIR` 等业务变量，框架不包含 OSS 或认证逻辑。
+
+`nodeVersion` 同时应用于安装、构建及运行镜像，省略时保留 22.22.0。`environments` 可选择 test/stage/prod/stable，省略时保持原流程；仅 prod 时不生成其他发布步骤。managed 正式发布使用 Helm 等待就绪，失败自动撤销资源变更。`virtualService.timeout` 可设置长连接超时，`corsPolicy: null` 可关闭默认跨域策略。密钥只通过运行环境提供，不放入 values 或构建命令。

package/deploy/Dockerfile

@@ -1,4 +1,5 @@
-FROM node:22.22.0-bookworm-slim
+ARG XFE_NODE_VERSION=22.22.0
+FROM node:${XFE_NODE_VERSION}-bookworm-slim
 
 WORKDIR /app
 

package/deploy/Dockerfile.dockerignore

@@ -0,0 +1,10 @@
+# 构建产物和 deploy/modules 是运行镜像输入，不能排除。
+node_modules/*
+.env*
+.git
+.idea
+.data
+.impeccable
+design
+coverage
+*.tsbuildinfo

package/deploy/helm/Chart.yaml

@@ -1,4 +1,4 @@
-apiVersion: v1
+apiVersion: v2
 name: deployment
 description: A Helm chart for xfe
 

package/deploy/helm/templates/deployment.yaml

@@ -7,11 +7,15 @@ metadata:
     kubernetes.io/change-cause: {{ or $.Values.tagContent $.Values.commitSHA }}
 spec:
   strategy:
+    {{- if .Values.strategy }}
+    {{- toYaml .Values.strategy | nindent 4 }}
+    {{- else }}
     type: RollingUpdate
     rollingUpdate:
       maxSurge: 2
       maxUnavailable: 50%
-  replicas: {{ if eq $.Values.envType "prod" }} 2 {{ else }} 1 {{ end }}
+    {{- end }}
+  replicas: {{ if hasKey .Values "replicas" }}{{ .Values.replicas }}{{ else if eq $.Values.envType "prod" }} 2 {{ else }} 1 {{ end }}
   selector:
     matchLabels:
       app: {{ $.Values.app }}
@@ -20,6 +24,13 @@ spec:
       labels:
         app: {{ $.Values.app }}
     spec:
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.terminationGracePeriodSeconds }}
+      terminationGracePeriodSeconds: {{ . }}
+      {{- end }}
       imagePullSecrets:
         - name: {{ $.Values.imagePullSecret }}
       containers:
@@ -27,9 +38,17 @@ spec:
           imagePullPolicy: Always
           image: "{{ $.Values.image }}"
           resources:
+            {{- if .Values.resources }}
+            {{- toYaml .Values.resources | nindent 12 }}
+            {{- else }}
             requests:
               cpu: "0.01"
               memory: "100Mi"
+            {{- end }}
+          {{- with .Values.containerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           env:
             - name: HOST
               value: "0.0.0.0"
@@ -39,9 +58,37 @@ spec:
             - name: HOST_PREFIX
               value: "{{ $.Values.hostPrefix }}"
           {{end}}
-          {{- if eq $.Values.targetK8s "saas" }}
+          {{- with .Values.env }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if hasKey .Values "envFrom" }}
+          envFrom:
+            {{- toYaml .Values.envFrom | nindent 12 }}
+          {{- else if eq $.Values.targetK8s "saas" }}
           envFrom:
             - configMapRef:
                 name: "app-common-config"
           {{- end }}
----
+          {{- with .Values.startupProbe }}
+          startupProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.livenessProbe }}
+          livenessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if .Values.persistence.enabled }}
+          volumeMounts:
+            - name: data
+              mountPath: {{ .Values.persistence.mountPath | quote }}
+          {{- end }}
+      {{- if .Values.persistence.enabled }}
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ default (printf "%s-data" .Values.app) .Values.persistence.existingClaim }}
+      {{- end }}

package/deploy/helm/templates/pvc.yaml

@@ -0,0 +1,17 @@
+{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ .Values.app }}-data
+  namespace: {{ include "template.namespace" . }}
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes: [ReadWriteOnce]
+  {{- with .Values.persistence.storageClass }}
+  storageClassName: {{ . | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size }}
+{{- end }}

package/deploy/helm/templates/virtualService.yaml

@@ -19,14 +19,16 @@ spec:
     - match:
         - uri:
             prefix: /
+      {{- with .Values.virtualService.timeout }}
+      timeout: {{ . }}
+      {{- end }}
       route:
         - destination:
             host: {{ .Values.app }}
             port:
               number: 80
+          {{- with .Values.virtualService.corsPolicy }}
           corsPolicy:
-            allowOrigin:
-              - "*"
-            allowMethods:
-              - "*"
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
 {{- end }}

package/deploy/helm/values.yaml

@@ -7,6 +7,9 @@ envType: '<<ENV_TYPE>>'
 hostPrefix: '<<HOST_PREFIX>>'
 namespace: ''
 virtualService:
+  corsPolicy:
+    allowOrigin: ['*']
+    allowMethods: ['*']
   enabled: true
   hosts:
     test:
@@ -18,3 +21,11 @@ virtualService:
   gateways:
     - 'common-gateway-eshetang'
 targetK8s: 'saas'
+
+# 可选持久卷；省略时保持现有无状态 Web 应用的部署行为。
+persistence:
+  enabled: false
+  mountPath: /data
+  size: 20Gi
+  existingClaim: ''
+  storageClass: ''

package/dist/cli.js

@@ -30,6 +30,71 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/config.ts
+function mergeDeployValues(base, overrides) {
+  const entries = Object.entries({ ...base, ...overrides }).map(
+    /** 只递归普通对象，列表保持调用方声明的顺序与完整内容。 */
+    ([key, value]) => {
+      const previous = base[key];
+      const mergeable = value && previous && typeof value === "object" && typeof previous === "object" && !Array.isArray(value) && !Array.isArray(previous);
+      return [key, mergeable ? mergeDeployValues(previous, value) : value];
+    }
+  );
+  return Object.fromEntries(entries);
+}
+function configureDeployPipeline(template, deployment) {
+  if (!deployment.managed && !deployment.nodeVersion && !deployment.environments && !deployment.buildCommand) return template;
+  const documents = import_yaml.default.parseAllDocuments(template).map(
+    /** 保留镜像和集群 Secret 定义。 */
+    (document) => document.toJSON()
+  );
+  const pipeline = documents[0];
+  const environments = deployment.environments;
+  const known = ["test", "stage", "prod", "stable"];
+  if (environments && (!Array.isArray(environments) || !environments.length || environments.some(
+    /** 拒绝未声明的发布环境名称。 */
+    (environment) => typeof environment !== "string" || !known.includes(environment)
+  ))) throw new Error("deploy.environments \u5FC5\u987B\u662F test/stage/prod/stable \u7684\u975E\u7A7A\u6570\u7EC4");
+  if (deployment.nodeVersion && !/^\d+\.\d+\.\d+$/.test(deployment.nodeVersion)) throw new Error("deploy.nodeVersion \u5FC5\u987B\u662F\u5B8C\u6574 Node \u7248\u672C\u53F7");
+  if (deployment.managed && deployment.targetNamespace && !/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/.test(deployment.targetNamespace)) throw new Error("deploy.targetNamespace \u5FC5\u987B\u662F\u6709\u6548 Kubernetes \u547D\u540D\u7A7A\u95F4");
+  const selected = environments ? new Set(environments) : void 0;
+  const stepEnvironments = /* @__PURE__ */ new Map([["deploy-to-test", "test"], ["deploy-to-stage", "stage"], ["deploy-to-prod", "prod"], ["deploy-to-stable", "stable"], ["push-helm-chart", "prod"]]);
+  pipeline.steps = pipeline.steps.filter(
+    /** 通用安装和构建步骤保留，发布步骤按显式环境选择。 */
+    (step) => !selected || !stepEnvironments.has(step.name) || selected.has(stepEnvironments.get(step.name))
+  );
+  for (const step of pipeline.steps) {
+    if (deployment.nodeVersion && ["install", "build"].includes(step.name)) step.image = `node:${deployment.nodeVersion}-bookworm`;
+    if (deployment.nodeVersion && step.name === "image-build") step.settings.build_args.push(`XFE_NODE_VERSION=${deployment.nodeVersion}`);
+    if (step.name === "build") step.commands = step.commands.map(
+      /** managed 构建复用配置生成器；应用自定义检查仍由应用命令负责。 */
+      (command2) => {
+        if (deployment.managed && command2 === "cp -r node_modules/@xfe-repo/web-app/deploy deploy") return "pnpm exec xfe-web config";
+        return command2 === "pnpm build" ? deployment.buildCommand || command2 : command2;
+      }
+    );
+    if (deployment.managed && deployment.targetK8s === "infra" && step.name === "pre-deploy") delete step.environment.SAAS_K8S_CONFIG;
+    if (deployment.managed && step.name === "deploy-to-prod") step.commands = step.commands.map(
+      /** 正式 Helm 部署等待探针并在失败时撤销资源变更。 */
+      (command2) => command2.includes("| kubectl") ? `helm upgrade --install "\${DRONE_REPO//\\//-}" deploy/helm --values deploy/helm/values.prod.yaml --namespace ${deployment.targetNamespace || "deployment-prod"} --create-namespace --kubeconfig=kube_config --atomic --wait --timeout 5m` : command2
+    );
+  }
+  if (selected && !selected.has("test")) {
+    pipeline.trigger.event = ["tag"];
+    const tags = [...new Set([...selected].map(
+      /** prod 与 stable 共用正式标签，其余使用各自的标签。 */
+      (environment) => environment === "stage" ? "refs/tags/stage-*" : "refs/tags/release-*"
+    ))];
+    pipeline.trigger.ref = { include: tags };
+  }
+  const result = deployment.managed && deployment.targetK8s === "infra" ? documents.filter(
+    /** infra 独立生成的流水线不要求额外的 saas kubeconfig。 */
+    (document) => document.kind !== "secret" || document.name !== "saas-k8s-config"
+  ) : documents;
+  return result.map(
+    /** 序列化多文档流水线，保留 Kubernetes Runner 的 Secret 引用。 */
+    (document) => import_yaml.default.stringify(document)
+  ).join("---\n");
+}
 var import_node_fs, import_node_path, import_node_url, import_yaml, import_meta, DEFAULT_BUILD_DIRECTORY, BUILD_DIRECTORY_ARGUMENT, protectedDirectories, loadXfeConfig, getBuildDirectory, getServerEntry, configDeploy, getJwtEnv;
 var init_config = __esm({
   "src/config.ts"() {
@@ -98,39 +163,33 @@ var init_config = __esm({
     };
     configDeploy = () => {
       const xfeConfig = loadXfeConfig();
-      if (!xfeConfig?.deploy) return;
+      const deployment = xfeConfig.deploy;
+      if (!deployment) return;
       const configDirectory = typeof __dirname === "string" ? __dirname : import_node_path.default.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
       const projectRoot = process.cwd();
+      const source = import_node_path.default.resolve(configDirectory, "../deploy");
+      const target = deployment.managed ? getBuildDirectory(projectRoot, { buildDirectory: "deploy" }) : source;
       const buildDirectory = import_node_path.default.relative(projectRoot, getBuildDirectory(projectRoot, xfeConfig.webapp)).replaceAll(import_node_path.default.sep, "/");
-      const droneConfigFilePath = import_node_path.default.resolve(configDirectory, "../deploy/.drone.yml");
-      const droneTarget = import_node_path.default.resolve(projectRoot, xfeConfig.deploy.droneConfigPath || "./.drone.yml");
-      const defaultArgument = JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`);
-      const configuredArgument = JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`);
-      const droneConfig = import_node_fs.default.readFileSync(droneConfigFilePath, "utf8").replace(defaultArgument, configuredArgument);
+      const droneTarget = import_node_path.default.resolve(projectRoot, deployment.droneConfigPath || "./.drone.yml");
+      const template = import_node_fs.default.readFileSync(import_node_path.default.join(source, ".drone.yml"), "utf8").replace(JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`), JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`));
+      const drone = configureDeployPipeline(template, deployment);
+      const values = import_yaml.default.parse(import_node_fs.default.readFileSync(import_node_path.default.join(source, "helm/values.yaml"), "utf8"));
+      const { virtualServiceEnabled = true, hostsProd = [], hostsStage = [], hostsTest = [], gateways = ["common-gateway-eshetang"] } = deployment;
+      values.virtualService = { ...values.virtualService, enabled: virtualServiceEnabled, hosts: { prod: hostsProd, stage: hostsStage, test: hostsTest }, gateways };
+      values.targetK8s = deployment.targetK8s || "saas";
+      values.namespace = deployment.targetNamespace || "";
+      const configuredValues = mergeDeployValues(values, deployment.values || {});
+      if (deployment.managed && deployment.environments) configuredValues.virtualService.hosts = Object.fromEntries(Object.entries(configuredValues.virtualService.hosts).filter(
+        /** 托管部署仅保留已选择环境的域名。 */
+        ([environment]) => deployment.environments.includes(environment) || environment === "test" && deployment.environments.includes("stable")
+      ));
+      if (deployment.managed) {
+        if (target === source) throw new Error("managed \u90E8\u7F72\u8F93\u51FA\u4E0D\u80FD\u8986\u76D6\u6846\u67B6\u6A21\u677F\u76EE\u5F55");
+        import_node_fs.default.cpSync(source, target, { recursive: true });
+      }
       import_node_fs.default.mkdirSync(import_node_path.default.dirname(droneTarget), { recursive: true });
-      import_node_fs.default.writeFileSync(droneTarget, droneConfig);
-      const valuesYamlFilePath = import_node_path.default.resolve(configDirectory, "../deploy/helm/values.yaml");
-      const valuesYamlFile = import_node_fs.default.readFileSync(valuesYamlFilePath, "utf8");
-      const valuesYaml = import_yaml.default.parse(valuesYamlFile);
-      if (!valuesYaml.virtualService) valuesYaml.virtualService = {};
-      if (!valuesYaml.virtualService.hosts) valuesYaml.virtualService.hosts = { test: [], stage: [], prod: [] };
-      const {
-        virtualServiceEnabled = true,
-        hostsProd = [],
-        hostsStage = [],
-        hostsTest = [],
-        gateways = ["common-gateway-eshetang"]
-      } = xfeConfig.deploy;
-      const { targetK8s = "saas", targetNamespace = "" } = xfeConfig.deploy;
-      valuesYaml.virtualService.enabled = virtualServiceEnabled;
-      valuesYaml.virtualService.gateways = gateways;
-      valuesYaml.virtualService.hosts.prod = hostsProd;
-      valuesYaml.virtualService.hosts.stage = hostsStage;
-      valuesYaml.virtualService.hosts.test = hostsTest;
-      valuesYaml.targetK8s = targetK8s;
-      valuesYaml.namespace = targetNamespace;
-      const valuesYamlStr = import_yaml.default.stringify(valuesYaml, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" });
-      import_node_fs.default.writeFileSync(valuesYamlFilePath, valuesYamlStr, "utf8");
+      import_node_fs.default.writeFileSync(import_node_path.default.join(target, "helm/values.yaml"), import_yaml.default.stringify(configuredValues, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" }));
+      import_node_fs.default.writeFileSync(droneTarget, drone);
     };
     getJwtEnv = async () => {
       const xfeConfig = loadXfeConfig();

package/dist/cli.mjs

@@ -19,6 +19,71 @@ import fs from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
 import yaml from "yaml";
+function mergeDeployValues(base, overrides) {
+  const entries = Object.entries({ ...base, ...overrides }).map(
+    /** 只递归普通对象，列表保持调用方声明的顺序与完整内容。 */
+    ([key, value]) => {
+      const previous = base[key];
+      const mergeable = value && previous && typeof value === "object" && typeof previous === "object" && !Array.isArray(value) && !Array.isArray(previous);
+      return [key, mergeable ? mergeDeployValues(previous, value) : value];
+    }
+  );
+  return Object.fromEntries(entries);
+}
+function configureDeployPipeline(template, deployment) {
+  if (!deployment.managed && !deployment.nodeVersion && !deployment.environments && !deployment.buildCommand) return template;
+  const documents = yaml.parseAllDocuments(template).map(
+    /** 保留镜像和集群 Secret 定义。 */
+    (document) => document.toJSON()
+  );
+  const pipeline = documents[0];
+  const environments = deployment.environments;
+  const known = ["test", "stage", "prod", "stable"];
+  if (environments && (!Array.isArray(environments) || !environments.length || environments.some(
+    /** 拒绝未声明的发布环境名称。 */
+    (environment) => typeof environment !== "string" || !known.includes(environment)
+  ))) throw new Error("deploy.environments \u5FC5\u987B\u662F test/stage/prod/stable \u7684\u975E\u7A7A\u6570\u7EC4");
+  if (deployment.nodeVersion && !/^\d+\.\d+\.\d+$/.test(deployment.nodeVersion)) throw new Error("deploy.nodeVersion \u5FC5\u987B\u662F\u5B8C\u6574 Node \u7248\u672C\u53F7");
+  if (deployment.managed && deployment.targetNamespace && !/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/.test(deployment.targetNamespace)) throw new Error("deploy.targetNamespace \u5FC5\u987B\u662F\u6709\u6548 Kubernetes \u547D\u540D\u7A7A\u95F4");
+  const selected = environments ? new Set(environments) : void 0;
+  const stepEnvironments = /* @__PURE__ */ new Map([["deploy-to-test", "test"], ["deploy-to-stage", "stage"], ["deploy-to-prod", "prod"], ["deploy-to-stable", "stable"], ["push-helm-chart", "prod"]]);
+  pipeline.steps = pipeline.steps.filter(
+    /** 通用安装和构建步骤保留，发布步骤按显式环境选择。 */
+    (step) => !selected || !stepEnvironments.has(step.name) || selected.has(stepEnvironments.get(step.name))
+  );
+  for (const step of pipeline.steps) {
+    if (deployment.nodeVersion && ["install", "build"].includes(step.name)) step.image = `node:${deployment.nodeVersion}-bookworm`;
+    if (deployment.nodeVersion && step.name === "image-build") step.settings.build_args.push(`XFE_NODE_VERSION=${deployment.nodeVersion}`);
+    if (step.name === "build") step.commands = step.commands.map(
+      /** managed 构建复用配置生成器；应用自定义检查仍由应用命令负责。 */
+      (command2) => {
+        if (deployment.managed && command2 === "cp -r node_modules/@xfe-repo/web-app/deploy deploy") return "pnpm exec xfe-web config";
+        return command2 === "pnpm build" ? deployment.buildCommand || command2 : command2;
+      }
+    );
+    if (deployment.managed && deployment.targetK8s === "infra" && step.name === "pre-deploy") delete step.environment.SAAS_K8S_CONFIG;
+    if (deployment.managed && step.name === "deploy-to-prod") step.commands = step.commands.map(
+      /** 正式 Helm 部署等待探针并在失败时撤销资源变更。 */
+      (command2) => command2.includes("| kubectl") ? `helm upgrade --install "\${DRONE_REPO//\\//-}" deploy/helm --values deploy/helm/values.prod.yaml --namespace ${deployment.targetNamespace || "deployment-prod"} --create-namespace --kubeconfig=kube_config --atomic --wait --timeout 5m` : command2
+    );
+  }
+  if (selected && !selected.has("test")) {
+    pipeline.trigger.event = ["tag"];
+    const tags = [...new Set([...selected].map(
+      /** prod 与 stable 共用正式标签，其余使用各自的标签。 */
+      (environment) => environment === "stage" ? "refs/tags/stage-*" : "refs/tags/release-*"
+    ))];
+    pipeline.trigger.ref = { include: tags };
+  }
+  const result = deployment.managed && deployment.targetK8s === "infra" ? documents.filter(
+    /** infra 独立生成的流水线不要求额外的 saas kubeconfig。 */
+    (document) => document.kind !== "secret" || document.name !== "saas-k8s-config"
+  ) : documents;
+  return result.map(
+    /** 序列化多文档流水线，保留 Kubernetes Runner 的 Secret 引用。 */
+    (document) => yaml.stringify(document)
+  ).join("---\n");
+}
 var DEFAULT_BUILD_DIRECTORY, BUILD_DIRECTORY_ARGUMENT, protectedDirectories, loadXfeConfig, getBuildDirectory, getServerEntry, configDeploy, getJwtEnv;
 var init_config = __esm({
   "src/config.ts"() {
@@ -82,39 +147,33 @@ var init_config = __esm({
     };
     configDeploy = () => {
       const xfeConfig = loadXfeConfig();
-      if (!xfeConfig?.deploy) return;
+      const deployment = xfeConfig.deploy;
+      if (!deployment) return;
       const configDirectory = typeof __dirname === "string" ? __dirname : path.dirname(fileURLToPath(import.meta.url));
       const projectRoot = process.cwd();
+      const source = path.resolve(configDirectory, "../deploy");
+      const target = deployment.managed ? getBuildDirectory(projectRoot, { buildDirectory: "deploy" }) : source;
       const buildDirectory = path.relative(projectRoot, getBuildDirectory(projectRoot, xfeConfig.webapp)).replaceAll(path.sep, "/");
-      const droneConfigFilePath = path.resolve(configDirectory, "../deploy/.drone.yml");
-      const droneTarget = path.resolve(projectRoot, xfeConfig.deploy.droneConfigPath || "./.drone.yml");
-      const defaultArgument = JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`);
-      const configuredArgument = JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`);
-      const droneConfig = fs.readFileSync(droneConfigFilePath, "utf8").replace(defaultArgument, configuredArgument);
+      const droneTarget = path.resolve(projectRoot, deployment.droneConfigPath || "./.drone.yml");
+      const template = fs.readFileSync(path.join(source, ".drone.yml"), "utf8").replace(JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`), JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`));
+      const drone = configureDeployPipeline(template, deployment);
+      const values = yaml.parse(fs.readFileSync(path.join(source, "helm/values.yaml"), "utf8"));
+      const { virtualServiceEnabled = true, hostsProd = [], hostsStage = [], hostsTest = [], gateways = ["common-gateway-eshetang"] } = deployment;
+      values.virtualService = { ...values.virtualService, enabled: virtualServiceEnabled, hosts: { prod: hostsProd, stage: hostsStage, test: hostsTest }, gateways };
+      values.targetK8s = deployment.targetK8s || "saas";
+      values.namespace = deployment.targetNamespace || "";
+      const configuredValues = mergeDeployValues(values, deployment.values || {});
+      if (deployment.managed && deployment.environments) configuredValues.virtualService.hosts = Object.fromEntries(Object.entries(configuredValues.virtualService.hosts).filter(
+        /** 托管部署仅保留已选择环境的域名。 */
+        ([environment]) => deployment.environments.includes(environment) || environment === "test" && deployment.environments.includes("stable")
+      ));
+      if (deployment.managed) {
+        if (target === source) throw new Error("managed \u90E8\u7F72\u8F93\u51FA\u4E0D\u80FD\u8986\u76D6\u6846\u67B6\u6A21\u677F\u76EE\u5F55");
+        fs.cpSync(source, target, { recursive: true });
+      }
       fs.mkdirSync(path.dirname(droneTarget), { recursive: true });
-      fs.writeFileSync(droneTarget, droneConfig);
-      const valuesYamlFilePath = path.resolve(configDirectory, "../deploy/helm/values.yaml");
-      const valuesYamlFile = fs.readFileSync(valuesYamlFilePath, "utf8");
-      const valuesYaml = yaml.parse(valuesYamlFile);
-      if (!valuesYaml.virtualService) valuesYaml.virtualService = {};
-      if (!valuesYaml.virtualService.hosts) valuesYaml.virtualService.hosts = { test: [], stage: [], prod: [] };
-      const {
-        virtualServiceEnabled = true,
-        hostsProd = [],
-        hostsStage = [],
-        hostsTest = [],
-        gateways = ["common-gateway-eshetang"]
-      } = xfeConfig.deploy;
-      const { targetK8s = "saas", targetNamespace = "" } = xfeConfig.deploy;
-      valuesYaml.virtualService.enabled = virtualServiceEnabled;
-      valuesYaml.virtualService.gateways = gateways;
-      valuesYaml.virtualService.hosts.prod = hostsProd;
-      valuesYaml.virtualService.hosts.stage = hostsStage;
-      valuesYaml.virtualService.hosts.test = hostsTest;
-      valuesYaml.targetK8s = targetK8s;
-      valuesYaml.namespace = targetNamespace;
-      const valuesYamlStr = yaml.stringify(valuesYaml, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" });
-      fs.writeFileSync(valuesYamlFilePath, valuesYamlStr, "utf8");
+      fs.writeFileSync(path.join(target, "helm/values.yaml"), yaml.stringify(configuredValues, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" }));
+      fs.writeFileSync(droneTarget, drone);
     };
     getJwtEnv = async () => {
       const xfeConfig = loadXfeConfig();

package/dist/config.d.mts

@@ -26,7 +26,7 @@ declare const loadXfeConfig: (root?: string) => XfeConfig;
 declare const getBuildDirectory: (projectRoot: string, webapp?: WebAppConfig) => string;
 /** 生产仅校验入口约定而不读取源码，构建阶段由编译器检查文件存在。 */
 declare const getServerEntry: (projectRoot: string, webapp?: WebAppConfig) => string | undefined;
-/** 将输出目录传给 Docker 构建，并沿用现有的集群、域名与 Helm 配置。 */
+/** 默认保留既有部署；managed 模式将公共模板和覆盖 values 生成到项目 deploy 目录。 */
 declare const configDeploy: () => void;
 declare const getJwtEnv: () => Promise<Partial<JwtEnv>>;
 

package/dist/config.d.ts

@@ -26,7 +26,7 @@ declare const loadXfeConfig: (root?: string) => XfeConfig;
 declare const getBuildDirectory: (projectRoot: string, webapp?: WebAppConfig) => string;
 /** 生产仅校验入口约定而不读取源码，构建阶段由编译器检查文件存在。 */
 declare const getServerEntry: (projectRoot: string, webapp?: WebAppConfig) => string | undefined;
-/** 将输出目录传给 Docker 构建，并沿用现有的集群、域名与 Helm 配置。 */
+/** 默认保留既有部署；managed 模式将公共模板和覆盖 values 生成到项目 deploy 目录。 */
 declare const configDeploy: () => void;
 declare const getJwtEnv: () => Promise<Partial<JwtEnv>>;
 

package/dist/config.js

@@ -101,40 +101,99 @@ var getServerEntry = (projectRoot, webapp = {}) => {
 };
 var configDeploy = () => {
   const xfeConfig = loadXfeConfig();
-  if (!xfeConfig?.deploy) return;
+  const deployment = xfeConfig.deploy;
+  if (!deployment) return;
   const configDirectory = typeof __dirname === "string" ? __dirname : import_node_path.default.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
   const projectRoot = process.cwd();
+  const source = import_node_path.default.resolve(configDirectory, "../deploy");
+  const target = deployment.managed ? getBuildDirectory(projectRoot, { buildDirectory: "deploy" }) : source;
   const buildDirectory = import_node_path.default.relative(projectRoot, getBuildDirectory(projectRoot, xfeConfig.webapp)).replaceAll(import_node_path.default.sep, "/");
-  const droneConfigFilePath = import_node_path.default.resolve(configDirectory, "../deploy/.drone.yml");
-  const droneTarget = import_node_path.default.resolve(projectRoot, xfeConfig.deploy.droneConfigPath || "./.drone.yml");
-  const defaultArgument = JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`);
-  const configuredArgument = JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`);
-  const droneConfig = import_node_fs.default.readFileSync(droneConfigFilePath, "utf8").replace(defaultArgument, configuredArgument);
+  const droneTarget = import_node_path.default.resolve(projectRoot, deployment.droneConfigPath || "./.drone.yml");
+  const template = import_node_fs.default.readFileSync(import_node_path.default.join(source, ".drone.yml"), "utf8").replace(JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`), JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`));
+  const drone = configureDeployPipeline(template, deployment);
+  const values = import_yaml.default.parse(import_node_fs.default.readFileSync(import_node_path.default.join(source, "helm/values.yaml"), "utf8"));
+  const { virtualServiceEnabled = true, hostsProd = [], hostsStage = [], hostsTest = [], gateways = ["common-gateway-eshetang"] } = deployment;
+  values.virtualService = { ...values.virtualService, enabled: virtualServiceEnabled, hosts: { prod: hostsProd, stage: hostsStage, test: hostsTest }, gateways };
+  values.targetK8s = deployment.targetK8s || "saas";
+  values.namespace = deployment.targetNamespace || "";
+  const configuredValues = mergeDeployValues(values, deployment.values || {});
+  if (deployment.managed && deployment.environments) configuredValues.virtualService.hosts = Object.fromEntries(Object.entries(configuredValues.virtualService.hosts).filter(
+    /** 托管部署仅保留已选择环境的域名。 */
+    ([environment]) => deployment.environments.includes(environment) || environment === "test" && deployment.environments.includes("stable")
+  ));
+  if (deployment.managed) {
+    if (target === source) throw new Error("managed \u90E8\u7F72\u8F93\u51FA\u4E0D\u80FD\u8986\u76D6\u6846\u67B6\u6A21\u677F\u76EE\u5F55");
+    import_node_fs.default.cpSync(source, target, { recursive: true });
+  }
   import_node_fs.default.mkdirSync(import_node_path.default.dirname(droneTarget), { recursive: true });
-  import_node_fs.default.writeFileSync(droneTarget, droneConfig);
-  const valuesYamlFilePath = import_node_path.default.resolve(configDirectory, "../deploy/helm/values.yaml");
-  const valuesYamlFile = import_node_fs.default.readFileSync(valuesYamlFilePath, "utf8");
-  const valuesYaml = import_yaml.default.parse(valuesYamlFile);
-  if (!valuesYaml.virtualService) valuesYaml.virtualService = {};
-  if (!valuesYaml.virtualService.hosts) valuesYaml.virtualService.hosts = { test: [], stage: [], prod: [] };
-  const {
-    virtualServiceEnabled = true,
-    hostsProd = [],
-    hostsStage = [],
-    hostsTest = [],
-    gateways = ["common-gateway-eshetang"]
-  } = xfeConfig.deploy;
-  const { targetK8s = "saas", targetNamespace = "" } = xfeConfig.deploy;
-  valuesYaml.virtualService.enabled = virtualServiceEnabled;
-  valuesYaml.virtualService.gateways = gateways;
-  valuesYaml.virtualService.hosts.prod = hostsProd;
-  valuesYaml.virtualService.hosts.stage = hostsStage;
-  valuesYaml.virtualService.hosts.test = hostsTest;
-  valuesYaml.targetK8s = targetK8s;
-  valuesYaml.namespace = targetNamespace;
-  const valuesYamlStr = import_yaml.default.stringify(valuesYaml, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" });
-  import_node_fs.default.writeFileSync(valuesYamlFilePath, valuesYamlStr, "utf8");
+  import_node_fs.default.writeFileSync(import_node_path.default.join(target, "helm/values.yaml"), import_yaml.default.stringify(configuredValues, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" }));
+  import_node_fs.default.writeFileSync(droneTarget, drone);
 };
+function mergeDeployValues(base, overrides) {
+  const entries = Object.entries({ ...base, ...overrides }).map(
+    /** 只递归普通对象，列表保持调用方声明的顺序与完整内容。 */
+    ([key, value]) => {
+      const previous = base[key];
+      const mergeable = value && previous && typeof value === "object" && typeof previous === "object" && !Array.isArray(value) && !Array.isArray(previous);
+      return [key, mergeable ? mergeDeployValues(previous, value) : value];
+    }
+  );
+  return Object.fromEntries(entries);
+}
+function configureDeployPipeline(template, deployment) {
+  if (!deployment.managed && !deployment.nodeVersion && !deployment.environments && !deployment.buildCommand) return template;
+  const documents = import_yaml.default.parseAllDocuments(template).map(
+    /** 保留镜像和集群 Secret 定义。 */
+    (document) => document.toJSON()
+  );
+  const pipeline = documents[0];
+  const environments = deployment.environments;
+  const known = ["test", "stage", "prod", "stable"];
+  if (environments && (!Array.isArray(environments) || !environments.length || environments.some(
+    /** 拒绝未声明的发布环境名称。 */
+    (environment) => typeof environment !== "string" || !known.includes(environment)
+  ))) throw new Error("deploy.environments \u5FC5\u987B\u662F test/stage/prod/stable \u7684\u975E\u7A7A\u6570\u7EC4");
+  if (deployment.nodeVersion && !/^\d+\.\d+\.\d+$/.test(deployment.nodeVersion)) throw new Error("deploy.nodeVersion \u5FC5\u987B\u662F\u5B8C\u6574 Node \u7248\u672C\u53F7");
+  if (deployment.managed && deployment.targetNamespace && !/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/.test(deployment.targetNamespace)) throw new Error("deploy.targetNamespace \u5FC5\u987B\u662F\u6709\u6548 Kubernetes \u547D\u540D\u7A7A\u95F4");
+  const selected = environments ? new Set(environments) : void 0;
+  const stepEnvironments = /* @__PURE__ */ new Map([["deploy-to-test", "test"], ["deploy-to-stage", "stage"], ["deploy-to-prod", "prod"], ["deploy-to-stable", "stable"], ["push-helm-chart", "prod"]]);
+  pipeline.steps = pipeline.steps.filter(
+    /** 通用安装和构建步骤保留，发布步骤按显式环境选择。 */
+    (step) => !selected || !stepEnvironments.has(step.name) || selected.has(stepEnvironments.get(step.name))
+  );
+  for (const step of pipeline.steps) {
+    if (deployment.nodeVersion && ["install", "build"].includes(step.name)) step.image = `node:${deployment.nodeVersion}-bookworm`;
+    if (deployment.nodeVersion && step.name === "image-build") step.settings.build_args.push(`XFE_NODE_VERSION=${deployment.nodeVersion}`);
+    if (step.name === "build") step.commands = step.commands.map(
+      /** managed 构建复用配置生成器；应用自定义检查仍由应用命令负责。 */
+      (command) => {
+        if (deployment.managed && command === "cp -r node_modules/@xfe-repo/web-app/deploy deploy") return "pnpm exec xfe-web config";
+        return command === "pnpm build" ? deployment.buildCommand || command : command;
+      }
+    );
+    if (deployment.managed && deployment.targetK8s === "infra" && step.name === "pre-deploy") delete step.environment.SAAS_K8S_CONFIG;
+    if (deployment.managed && step.name === "deploy-to-prod") step.commands = step.commands.map(
+      /** 正式 Helm 部署等待探针并在失败时撤销资源变更。 */
+      (command) => command.includes("| kubectl") ? `helm upgrade --install "\${DRONE_REPO//\\//-}" deploy/helm --values deploy/helm/values.prod.yaml --namespace ${deployment.targetNamespace || "deployment-prod"} --create-namespace --kubeconfig=kube_config --atomic --wait --timeout 5m` : command
+    );
+  }
+  if (selected && !selected.has("test")) {
+    pipeline.trigger.event = ["tag"];
+    const tags = [...new Set([...selected].map(
+      /** prod 与 stable 共用正式标签，其余使用各自的标签。 */
+      (environment) => environment === "stage" ? "refs/tags/stage-*" : "refs/tags/release-*"
+    ))];
+    pipeline.trigger.ref = { include: tags };
+  }
+  const result = deployment.managed && deployment.targetK8s === "infra" ? documents.filter(
+    /** infra 独立生成的流水线不要求额外的 saas kubeconfig。 */
+    (document) => document.kind !== "secret" || document.name !== "saas-k8s-config"
+  ) : documents;
+  return result.map(
+    /** 序列化多文档流水线，保留 Kubernetes Runner 的 Secret 引用。 */
+    (document) => import_yaml.default.stringify(document)
+  ).join("---\n");
+}
 var getJwtEnv = async () => {
   const xfeConfig = loadXfeConfig();
   if (!xfeConfig?.jwt) return {};

package/dist/config.mjs

@@ -62,40 +62,99 @@ var getServerEntry = (projectRoot, webapp = {}) => {
 };
 var configDeploy = () => {
   const xfeConfig = loadXfeConfig();
-  if (!xfeConfig?.deploy) return;
+  const deployment = xfeConfig.deploy;
+  if (!deployment) return;
   const configDirectory = typeof __dirname === "string" ? __dirname : path.dirname(fileURLToPath(import.meta.url));
   const projectRoot = process.cwd();
+  const source = path.resolve(configDirectory, "../deploy");
+  const target = deployment.managed ? getBuildDirectory(projectRoot, { buildDirectory: "deploy" }) : source;
   const buildDirectory = path.relative(projectRoot, getBuildDirectory(projectRoot, xfeConfig.webapp)).replaceAll(path.sep, "/");
-  const droneConfigFilePath = path.resolve(configDirectory, "../deploy/.drone.yml");
-  const droneTarget = path.resolve(projectRoot, xfeConfig.deploy.droneConfigPath || "./.drone.yml");
-  const defaultArgument = JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`);
-  const configuredArgument = JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`);
-  const droneConfig = fs.readFileSync(droneConfigFilePath, "utf8").replace(defaultArgument, configuredArgument);
+  const droneTarget = path.resolve(projectRoot, deployment.droneConfigPath || "./.drone.yml");
+  const template = fs.readFileSync(path.join(source, ".drone.yml"), "utf8").replace(JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`), JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`));
+  const drone = configureDeployPipeline(template, deployment);
+  const values = yaml.parse(fs.readFileSync(path.join(source, "helm/values.yaml"), "utf8"));
+  const { virtualServiceEnabled = true, hostsProd = [], hostsStage = [], hostsTest = [], gateways = ["common-gateway-eshetang"] } = deployment;
+  values.virtualService = { ...values.virtualService, enabled: virtualServiceEnabled, hosts: { prod: hostsProd, stage: hostsStage, test: hostsTest }, gateways };
+  values.targetK8s = deployment.targetK8s || "saas";
+  values.namespace = deployment.targetNamespace || "";
+  const configuredValues = mergeDeployValues(values, deployment.values || {});
+  if (deployment.managed && deployment.environments) configuredValues.virtualService.hosts = Object.fromEntries(Object.entries(configuredValues.virtualService.hosts).filter(
+    /** 托管部署仅保留已选择环境的域名。 */
+    ([environment]) => deployment.environments.includes(environment) || environment === "test" && deployment.environments.includes("stable")
+  ));
+  if (deployment.managed) {
+    if (target === source) throw new Error("managed \u90E8\u7F72\u8F93\u51FA\u4E0D\u80FD\u8986\u76D6\u6846\u67B6\u6A21\u677F\u76EE\u5F55");
+    fs.cpSync(source, target, { recursive: true });
+  }
   fs.mkdirSync(path.dirname(droneTarget), { recursive: true });
-  fs.writeFileSync(droneTarget, droneConfig);
-  const valuesYamlFilePath = path.resolve(configDirectory, "../deploy/helm/values.yaml");
-  const valuesYamlFile = fs.readFileSync(valuesYamlFilePath, "utf8");
-  const valuesYaml = yaml.parse(valuesYamlFile);
-  if (!valuesYaml.virtualService) valuesYaml.virtualService = {};
-  if (!valuesYaml.virtualService.hosts) valuesYaml.virtualService.hosts = { test: [], stage: [], prod: [] };
-  const {
-    virtualServiceEnabled = true,
-    hostsProd = [],
-    hostsStage = [],
-    hostsTest = [],
-    gateways = ["common-gateway-eshetang"]
-  } = xfeConfig.deploy;
-  const { targetK8s = "saas", targetNamespace = "" } = xfeConfig.deploy;
-  valuesYaml.virtualService.enabled = virtualServiceEnabled;
-  valuesYaml.virtualService.gateways = gateways;
-  valuesYaml.virtualService.hosts.prod = hostsProd;
-  valuesYaml.virtualService.hosts.stage = hostsStage;
-  valuesYaml.virtualService.hosts.test = hostsTest;
-  valuesYaml.targetK8s = targetK8s;
-  valuesYaml.namespace = targetNamespace;
-  const valuesYamlStr = yaml.stringify(valuesYaml, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" });
-  fs.writeFileSync(valuesYamlFilePath, valuesYamlStr, "utf8");
+  fs.writeFileSync(path.join(target, "helm/values.yaml"), yaml.stringify(configuredValues, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" }));
+  fs.writeFileSync(droneTarget, drone);
 };
+function mergeDeployValues(base, overrides) {
+  const entries = Object.entries({ ...base, ...overrides }).map(
+    /** 只递归普通对象，列表保持调用方声明的顺序与完整内容。 */
+    ([key, value]) => {
+      const previous = base[key];
+      const mergeable = value && previous && typeof value === "object" && typeof previous === "object" && !Array.isArray(value) && !Array.isArray(previous);
+      return [key, mergeable ? mergeDeployValues(previous, value) : value];
+    }
+  );
+  return Object.fromEntries(entries);
+}
+function configureDeployPipeline(template, deployment) {
+  if (!deployment.managed && !deployment.nodeVersion && !deployment.environments && !deployment.buildCommand) return template;
+  const documents = yaml.parseAllDocuments(template).map(
+    /** 保留镜像和集群 Secret 定义。 */
+    (document) => document.toJSON()
+  );
+  const pipeline = documents[0];
+  const environments = deployment.environments;
+  const known = ["test", "stage", "prod", "stable"];
+  if (environments && (!Array.isArray(environments) || !environments.length || environments.some(
+    /** 拒绝未声明的发布环境名称。 */
+    (environment) => typeof environment !== "string" || !known.includes(environment)
+  ))) throw new Error("deploy.environments \u5FC5\u987B\u662F test/stage/prod/stable \u7684\u975E\u7A7A\u6570\u7EC4");
+  if (deployment.nodeVersion && !/^\d+\.\d+\.\d+$/.test(deployment.nodeVersion)) throw new Error("deploy.nodeVersion \u5FC5\u987B\u662F\u5B8C\u6574 Node \u7248\u672C\u53F7");
+  if (deployment.managed && deployment.targetNamespace && !/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/.test(deployment.targetNamespace)) throw new Error("deploy.targetNamespace \u5FC5\u987B\u662F\u6709\u6548 Kubernetes \u547D\u540D\u7A7A\u95F4");
+  const selected = environments ? new Set(environments) : void 0;
+  const stepEnvironments = /* @__PURE__ */ new Map([["deploy-to-test", "test"], ["deploy-to-stage", "stage"], ["deploy-to-prod", "prod"], ["deploy-to-stable", "stable"], ["push-helm-chart", "prod"]]);
+  pipeline.steps = pipeline.steps.filter(
+    /** 通用安装和构建步骤保留，发布步骤按显式环境选择。 */
+    (step) => !selected || !stepEnvironments.has(step.name) || selected.has(stepEnvironments.get(step.name))
+  );
+  for (const step of pipeline.steps) {
+    if (deployment.nodeVersion && ["install", "build"].includes(step.name)) step.image = `node:${deployment.nodeVersion}-bookworm`;
+    if (deployment.nodeVersion && step.name === "image-build") step.settings.build_args.push(`XFE_NODE_VERSION=${deployment.nodeVersion}`);
+    if (step.name === "build") step.commands = step.commands.map(
+      /** managed 构建复用配置生成器；应用自定义检查仍由应用命令负责。 */
+      (command) => {
+        if (deployment.managed && command === "cp -r node_modules/@xfe-repo/web-app/deploy deploy") return "pnpm exec xfe-web config";
+        return command === "pnpm build" ? deployment.buildCommand || command : command;
+      }
+    );
+    if (deployment.managed && deployment.targetK8s === "infra" && step.name === "pre-deploy") delete step.environment.SAAS_K8S_CONFIG;
+    if (deployment.managed && step.name === "deploy-to-prod") step.commands = step.commands.map(
+      /** 正式 Helm 部署等待探针并在失败时撤销资源变更。 */
+      (command) => command.includes("| kubectl") ? `helm upgrade --install "\${DRONE_REPO//\\//-}" deploy/helm --values deploy/helm/values.prod.yaml --namespace ${deployment.targetNamespace || "deployment-prod"} --create-namespace --kubeconfig=kube_config --atomic --wait --timeout 5m` : command
+    );
+  }
+  if (selected && !selected.has("test")) {
+    pipeline.trigger.event = ["tag"];
+    const tags = [...new Set([...selected].map(
+      /** prod 与 stable 共用正式标签，其余使用各自的标签。 */
+      (environment) => environment === "stage" ? "refs/tags/stage-*" : "refs/tags/release-*"
+    ))];
+    pipeline.trigger.ref = { include: tags };
+  }
+  const result = deployment.managed && deployment.targetK8s === "infra" ? documents.filter(
+    /** infra 独立生成的流水线不要求额外的 saas kubeconfig。 */
+    (document) => document.kind !== "secret" || document.name !== "saas-k8s-config"
+  ) : documents;
+  return result.map(
+    /** 序列化多文档流水线，保留 Kubernetes Runner 的 Secret 引用。 */
+    (document) => yaml.stringify(document)
+  ).join("---\n");
+}
 var getJwtEnv = async () => {
   const xfeConfig = loadXfeConfig();
   if (!xfeConfig?.jwt) return {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xfe-repo/web-app",
-  "version": "2.0.0-beta.3",
+  "version": "2.0.0-beta.4",
   "bin": {
     "xfe-web": "./bin/index.js"
   },
@@ -30,8 +30,8 @@
     "yaml": "^2.4.2",
     "tsx": "4.23.15",
     "@xfe-repo/eslint-config": "2.0.0-beta.1",
-    "@xfe-repo/web-router": "2.0.0-beta.1",
-    "@xfe-repo/typescript-config": "2.0.0-beta.1"
+    "@xfe-repo/typescript-config": "2.0.0-beta.1",
+    "@xfe-repo/web-router": "2.0.0-beta.1"
   },
   "devDependencies": {
     "@types/express": "5.0.6"