@xfe-repo/web-app 2.0.0-beta.4 → 2.0.0-beta.5

package/README.md

@@ -126,7 +126,7 @@ SSR `start` 使用与构建一致的隐藏工作目录，使官方 serve 正确
 
 ## 可选的项目部署模板
 
-已有项目保持默认 Node 22、集群选择、发布环境和无状态部署方式。设置 `deploy.managed: true` 后，`xfe-web config` 将框架模板生成到项目 `deploy/`，不修改 npm 包中的 Helm values；项目只维护配置，生成文件由框架管理。Drone 入口需提交仓库，安装后的流水线再通过同一命令生成模板。
+`xfe-web config` 仅合并并写入 values、复制公共模板，不解析或重建 Drone 步骤。`managed: true` 时写到项目 `deploy/`，不修改共享 npm 包模板；未启用时保持原有行为。
 
 ```json
 {
@@ -135,11 +135,11 @@ SSR `start` 使用与构建一致的隐藏工作目录，使官方 serve 正确
     "droneConfigPath": "deploy/.drone.yml",
     "targetK8s": "infra",
     "targetNamespace": "deployment-prod",
-    "nodeVersion": "24.22.1",
-    "environments": ["prod"],
     "hostsProd": ["app.example.com"],
-    "buildCommand": "pnpm check && pnpm build && pnpm prune --prod",
     "values": {
+      "nodeVersion": "24.22.1",
+      "buildCommand": "pnpm check && pnpm build && pnpm prune --prod",
+      "environments": {"test": false, "stage": false, "prod": true, "stable": false},
       "replicas": 1,
       "strategy": {"type": "Recreate"},
       "persistence": {"enabled": true, "size": "20Gi", "mountPath": "/data"},
@@ -151,6 +151,8 @@ SSR `start` 使用与构建一致的隐藏工作目录，使官方 serve 正确
 }
 ```
 
-`values` 递归覆盖默认 Helm values；列表整体替换。可配置实例数、更新策略、容器资源、Pod/容器安全上下文、环境变量及来源、启动/就绪/存活探针、终止宽限期和 PVC。PVC 默认关闭，可指定 `existingClaim` 或 `storageClass`。应用负责声明自己的 `DATA_DIR` 等业务变量，框架不包含 OSS 或认证逻辑。
+`values` 中的对象递归合并，列表整体替换。默认 Node 22.22.0、`pnpm build` 和所有发布环境开启，保持既有应用行为。公共 Drone 保留固定步骤，每个发布步骤在运行时检查 `environments` 布尔开关，关闭时直接结束，不创建命名空间或发布资源。
 
-`nodeVersion` 同时应用于安装、构建及运行镜像，省略时保留 22.22.0。`environments` 可选择 test/stage/prod/stable，省略时保持原流程；仅 prod 时不生成其他发布步骤。managed 正式发布使用 Helm 等待就绪，失败自动撤销资源变更。`virtualService.timeout` 可设置长连接超时，`corsPolicy: null` 可关闭默认跨域策略。密钥只通过运行环境提供，不放入 values 或构建命令。
+构建命令与 Docker 的 Node 参数由 Drone 直接读取生成的 values；实例、更新策略、PVC、环境变量、安全上下文、探针和路由由 Helm 读取。只有运行前就必须确定的 Node 镜像、集群 Secret，以及原有构建目录参数使用简单占位替换，不再有配置脚本中的流水线遍历或筛选。
+
+PVC 默认关闭，支持 `existingClaim`、`storageClass`。`virtualService.timeout` 可配置长连接超时，`corsPolicy: null` 关闭默认跨域策略。应用负责自己的存储与认证业务变量，密钥通过环境来源注入，不写入 values 或构建命令。修改配置后重新生成并提交 Drone 入口。

package/deploy/.drone.yml

@@ -18,7 +18,7 @@ resources:
 steps:
   - name: install
     pull: if-not-exists
-    image: node:22.22.0-bookworm
+    image: node:<<NODE_VERSION>>-bookworm
     volumes:
       - name: node-modules
         path: /drone/src/node_modules
@@ -30,7 +30,7 @@ steps:
 
   - name: build
     pull: if-not-exists
-    image: node:22.22.0-bookworm
+    image: node:<<NODE_VERSION>>-bookworm
     resources:
       limits:
         memory: 8192MiB
@@ -40,13 +40,31 @@ steps:
     commands:
       - corepack enable
       - corepack prepare pnpm@10.30.3 --activate
-      - cp -r node_modules/@xfe-repo/web-app/deploy deploy
+      - |
+          if [ "$(node -p "Boolean(require('./xfe.json').deploy?.managed)")" = true ]; then
+            pnpm exec xfe-web config
+          else
+            cp -r node_modules/@xfe-repo/web-app/deploy deploy
+          fi
       - export NODE_OPTIONS="--max-old-space-size=8192"
-      - export XFE_RELEASE=$DRONE_REPO_NAME@${DRONE_TAG:CI_COMMIT_SHA}
+      - export XFE_RELEASE="$DRONE_REPO_NAME@$DRONE_COMMIT_SHA"
+      - if [ -n "$DRONE_TAG" ]; then export XFE_RELEASE="$DRONE_REPO_NAME@$DRONE_TAG"; fi
       - export REACT_APP_RELEASE=$XFE_RELEASE
       - printf '%s' "$XFE_RELEASE" > deploy/static/release
       - cp deploy/static/release deploy/static/check-update
-      - pnpm build
+      - |
+          node <<'NODE'
+          const fs = require('node:fs');
+          const {createRequire} = require('node:module');
+          const yaml = createRequire(require.resolve('@xfe-repo/web-app/package.json'))('yaml');
+          const values = yaml.parse(fs.readFileSync('deploy/helm/values.yaml', 'utf8'));
+          const dockerfile = fs.readFileSync('deploy/Dockerfile', 'utf8');
+          fs.writeFileSync('deploy/Dockerfile', dockerfile.replace(/^ARG XFE_NODE_VERSION=.*$/m, 'ARG XFE_NODE_VERSION=' + values.nodeVersion));
+          const {spawnSync} = require('node:child_process');
+          const result = spawnSync(values.buildCommand, {shell: true, stdio: 'inherit'});
+          if (result.error) throw result.error;
+          process.exit(result.status ?? 1);
+          NODE
       - cp -a node_modules deploy/modules
 
   - name: image-build
@@ -70,26 +88,31 @@ steps:
   - name: pre-deploy
     image: xhj-prod-registry-vpc.cn-hangzhou.cr.aliyuncs.com/xhj-image-common/deploy-helm:latest
     environment:
-      SAAS_K8S_CONFIG:
-        from_secret: saas-k8s-config
-      INFRA_K8S_CONFIG:
-        from_secret: infra-k8s-config
+      K8S_CONFIG:
+        from_secret: target-k8s-config
     commands:
-      # 判断values.yaml中的targetK8s字段，选择目标集群
-      - export TARGET_K8S=$(cat deploy/helm/values.yaml | grep targetK8s | awk '{print $2}' | sed 's/\"//g')
-      # 将$INFRA_K8S_CONFIG或$SAAS_K8S_CONFIG写入kube_config
-      - echo "$TARGET_K8S" | grep -q "infra" && echo "$INFRA_K8S_CONFIG" > kube_config || echo "$SAAS_K8S_CONFIG" > kube_config
+      # 集群凭据通过生成入口选定，运行流程不再注入其他集群的凭据。
+      - umask 077
+      - printf '%s' "$K8S_CONFIG" > kube_config
       # 将环境类型写入values.yaml
       - appName="`echo ${DRONE_REPO//\//-}`"
       - sed -i "s/<<APP_NAME>>/$appName/g" deploy/helm/values.yaml
       - sed -i "s/<<CI_COMMIT_SHA>>/$CI_COMMIT_SHA/g" deploy/helm/values.yaml
       - sed -i "s/<<TAG_CONTENT>>/$DRONE_TAG/g" deploy/helm/values.yaml
-      # 展示values.yaml 与 TARGET_K8S
-      - cat deploy/helm/values.yaml && echo $TARGET_K8S
+      # 展示非敏感部署配置
+      - cat deploy/helm/values.yaml
 
   - name: deploy-to-test
     image: xhj-prod-registry-vpc.cn-hangzhou.cr.aliyuncs.com/xhj-image-common/deploy-helm:latest
+    environment:
+      DEPLOY_ENV: test
     commands:
+      - &environmentEnabled |
+          test -f deploy/helm/values.yaml || exit 1
+          if ! sed -n '/^environments:/,/^[^ ]/p' deploy/helm/values.yaml | grep -q "^  $DEPLOY_ENV: true$"; then
+            echo "跳过未启用的发布环境：$DEPLOY_ENV"
+            exit 0
+          fi
       - export KUBECONFIG=$PWD/kube_config
       - cp deploy/helm/values.yaml deploy/helm/values.test.yaml
       - sed -i "s/<<ENV_TYPE>>/test/g" deploy/helm/values.test.yaml
@@ -106,7 +129,10 @@ steps:
 
   - name: deploy-to-stage
     image: xhj-prod-registry-vpc.cn-hangzhou.cr.aliyuncs.com/xhj-image-common/deploy-helm:latest
+    environment:
+      DEPLOY_ENV: stage
     commands:
+      - *environmentEnabled
       - cp deploy/helm/values.yaml deploy/helm/values.stage.yaml
       - sed -i "s/<<ENV_TYPE>>/stage/g" deploy/helm/values.stage.yaml
       - sed -i "s/<<APP_SUFFIX>>//g" deploy/helm/values.stage.yaml
@@ -120,13 +146,24 @@ steps:
 
   - name: deploy-to-prod
     image: xhj-prod-registry-vpc.cn-hangzhou.cr.aliyuncs.com/xhj-image-common/deploy-helm:latest
+    environment:
+      DEPLOY_ENV: prod
     commands:
+      - *environmentEnabled
       - cp deploy/helm/values.yaml deploy/helm/values.prod.yaml
       - sed -i "s/<<ENV_TYPE>>/prod/g" deploy/helm/values.prod.yaml
       - sed -i "s/<<APP_SUFFIX>>//g" deploy/helm/values.prod.yaml
       - sed -i "s/<<HOST_PREFIX>>//g" deploy/helm/values.prod.yaml
       - helm template deploy/helm --values deploy/helm/values.prod.yaml
-      - helm template deploy/helm --values deploy/helm/values.prod.yaml | kubectl --kubeconfig=kube_config apply -f -
+      - |
+          if grep -q '^managed: true$' deploy/helm/values.yaml; then
+            namespace=$(awk '$1 == "namespace:" { gsub(/[\047\042]/, "", $2); print $2 }' deploy/helm/values.yaml)
+            if [ -z "$namespace" ]; then namespace=deployment-prod; fi
+            chart_name=$(printf '%s' "$DRONE_REPO" | tr '/' '-')
+            helm upgrade --install "$chart_name" deploy/helm --values deploy/helm/values.prod.yaml --namespace "$namespace" --create-namespace --kubeconfig=kube_config --atomic --wait --timeout 5m
+          else
+            helm template deploy/helm --values deploy/helm/values.prod.yaml | kubectl --kubeconfig=kube_config apply -f -
+          fi
     when:
       ref:
         include:
@@ -135,7 +172,10 @@ steps:
   - name: deploy-to-stable
     image: xhj-prod-registry-vpc.cn-hangzhou.cr.aliyuncs.com/xhj-image-common/deploy-helm:latest
     failure: ignore
+    environment:
+      DEPLOY_ENV: stable
     commands:
+      - *environmentEnabled
       - cp deploy/helm/values.yaml deploy/helm/values.test.yaml
       - sed -i "s/<<ENV_TYPE>>/test/g" deploy/helm/values.test.yaml
       - sed -i "s/<<APP_SUFFIX>>/-stable/g" deploy/helm/values.test.yaml
@@ -150,11 +190,13 @@ steps:
   - name: push-helm-chart
     image: xhj-prod-registry-vpc.cn-hangzhou.cr.aliyuncs.com/xhj-image-common/deploy-helm:latest
     environment:
+      DEPLOY_ENV: prod
       USERNAME:
         from_secret: username
       PASSWORD:
         from_secret: password
     commands:
+      - *environmentEnabled
       - chartName="${DRONE_REPO//\//-}"
       - chartVersion="0.0.0-$DRONE_TAG"
       - cp deploy/helm/values.prod.yaml deploy/helm/values.yaml
@@ -183,15 +225,9 @@ image_pull_secrets:
 
 ---
 kind: secret
-name: saas-k8s-config
-get:
-  path: saas-k8s-config
-  name: config
----
-kind: secret
-name: infra-k8s-config
+name: target-k8s-config
 get:
-  path: infra-k8s-config
+  path: <<TARGET_K8S>>-k8s-config
   name: config
 ---
 kind: secret

package/deploy/helm/values.yaml

@@ -29,3 +29,13 @@ persistence:
   size: 20Gi
   existingClaim: ''
   storageClass: ''
+
+# 构建与发布配置由 Drone 在运行时读取，默认保持原有发布范围。
+managed: false
+nodeVersion: '22.22.0'
+buildCommand: pnpm build
+environments:
+  test: true
+  stage: true
+  prod: true
+  stable: true

package/dist/cli.js

@@ -31,69 +31,14 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 
 // src/config.ts
 function mergeDeployValues(base, overrides) {
-  const entries = Object.entries({ ...base, ...overrides }).map(
-    /** 只递归普通对象，列表保持调用方声明的顺序与完整内容。 */
+  return Object.fromEntries(Object.entries({ ...base, ...overrides }).map(
+    /** 仅合并普通对象，列表保持声明的顺序。 */
     ([key, value]) => {
       const previous = base[key];
       const mergeable = value && previous && typeof value === "object" && typeof previous === "object" && !Array.isArray(value) && !Array.isArray(previous);
       return [key, mergeable ? mergeDeployValues(previous, value) : value];
     }
-  );
-  return Object.fromEntries(entries);
-}
-function configureDeployPipeline(template, deployment) {
-  if (!deployment.managed && !deployment.nodeVersion && !deployment.environments && !deployment.buildCommand) return template;
-  const documents = import_yaml.default.parseAllDocuments(template).map(
-    /** 保留镜像和集群 Secret 定义。 */
-    (document) => document.toJSON()
-  );
-  const pipeline = documents[0];
-  const environments = deployment.environments;
-  const known = ["test", "stage", "prod", "stable"];
-  if (environments && (!Array.isArray(environments) || !environments.length || environments.some(
-    /** 拒绝未声明的发布环境名称。 */
-    (environment) => typeof environment !== "string" || !known.includes(environment)
-  ))) throw new Error("deploy.environments \u5FC5\u987B\u662F test/stage/prod/stable \u7684\u975E\u7A7A\u6570\u7EC4");
-  if (deployment.nodeVersion && !/^\d+\.\d+\.\d+$/.test(deployment.nodeVersion)) throw new Error("deploy.nodeVersion \u5FC5\u987B\u662F\u5B8C\u6574 Node \u7248\u672C\u53F7");
-  if (deployment.managed && deployment.targetNamespace && !/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/.test(deployment.targetNamespace)) throw new Error("deploy.targetNamespace \u5FC5\u987B\u662F\u6709\u6548 Kubernetes \u547D\u540D\u7A7A\u95F4");
-  const selected = environments ? new Set(environments) : void 0;
-  const stepEnvironments = /* @__PURE__ */ new Map([["deploy-to-test", "test"], ["deploy-to-stage", "stage"], ["deploy-to-prod", "prod"], ["deploy-to-stable", "stable"], ["push-helm-chart", "prod"]]);
-  pipeline.steps = pipeline.steps.filter(
-    /** 通用安装和构建步骤保留，发布步骤按显式环境选择。 */
-    (step) => !selected || !stepEnvironments.has(step.name) || selected.has(stepEnvironments.get(step.name))
-  );
-  for (const step of pipeline.steps) {
-    if (deployment.nodeVersion && ["install", "build"].includes(step.name)) step.image = `node:${deployment.nodeVersion}-bookworm`;
-    if (deployment.nodeVersion && step.name === "image-build") step.settings.build_args.push(`XFE_NODE_VERSION=${deployment.nodeVersion}`);
-    if (step.name === "build") step.commands = step.commands.map(
-      /** managed 构建复用配置生成器；应用自定义检查仍由应用命令负责。 */
-      (command2) => {
-        if (deployment.managed && command2 === "cp -r node_modules/@xfe-repo/web-app/deploy deploy") return "pnpm exec xfe-web config";
-        return command2 === "pnpm build" ? deployment.buildCommand || command2 : command2;
-      }
-    );
-    if (deployment.managed && deployment.targetK8s === "infra" && step.name === "pre-deploy") delete step.environment.SAAS_K8S_CONFIG;
-    if (deployment.managed && step.name === "deploy-to-prod") step.commands = step.commands.map(
-      /** 正式 Helm 部署等待探针并在失败时撤销资源变更。 */
-      (command2) => command2.includes("| kubectl") ? `helm upgrade --install "\${DRONE_REPO//\\//-}" deploy/helm --values deploy/helm/values.prod.yaml --namespace ${deployment.targetNamespace || "deployment-prod"} --create-namespace --kubeconfig=kube_config --atomic --wait --timeout 5m` : command2
-    );
-  }
-  if (selected && !selected.has("test")) {
-    pipeline.trigger.event = ["tag"];
-    const tags = [...new Set([...selected].map(
-      /** prod 与 stable 共用正式标签，其余使用各自的标签。 */
-      (environment) => environment === "stage" ? "refs/tags/stage-*" : "refs/tags/release-*"
-    ))];
-    pipeline.trigger.ref = { include: tags };
-  }
-  const result = deployment.managed && deployment.targetK8s === "infra" ? documents.filter(
-    /** infra 独立生成的流水线不要求额外的 saas kubeconfig。 */
-    (document) => document.kind !== "secret" || document.name !== "saas-k8s-config"
-  ) : documents;
-  return result.map(
-    /** 序列化多文档流水线，保留 Kubernetes Runner 的 Secret 引用。 */
-    (document) => import_yaml.default.stringify(document)
-  ).join("---\n");
+  ));
 }
 var import_node_fs, import_node_path, import_node_url, import_yaml, import_meta, DEFAULT_BUILD_DIRECTORY, BUILD_DIRECTORY_ARGUMENT, protectedDirectories, loadXfeConfig, getBuildDirectory, getServerEntry, configDeploy, getJwtEnv;
 var init_config = __esm({
@@ -171,24 +116,31 @@ var init_config = __esm({
       const target = deployment.managed ? getBuildDirectory(projectRoot, { buildDirectory: "deploy" }) : source;
       const buildDirectory = import_node_path.default.relative(projectRoot, getBuildDirectory(projectRoot, xfeConfig.webapp)).replaceAll(import_node_path.default.sep, "/");
       const droneTarget = import_node_path.default.resolve(projectRoot, deployment.droneConfigPath || "./.drone.yml");
-      const template = import_node_fs.default.readFileSync(import_node_path.default.join(source, ".drone.yml"), "utf8").replace(JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`), JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`));
-      const drone = configureDeployPipeline(template, deployment);
-      const values = import_yaml.default.parse(import_node_fs.default.readFileSync(import_node_path.default.join(source, "helm/values.yaml"), "utf8"));
+      const defaults = import_yaml.default.parse(import_node_fs.default.readFileSync(import_node_path.default.join(source, "helm/values.yaml"), "utf8"));
       const { virtualServiceEnabled = true, hostsProd = [], hostsStage = [], hostsTest = [], gateways = ["common-gateway-eshetang"] } = deployment;
-      values.virtualService = { ...values.virtualService, enabled: virtualServiceEnabled, hosts: { prod: hostsProd, stage: hostsStage, test: hostsTest }, gateways };
-      values.targetK8s = deployment.targetK8s || "saas";
-      values.namespace = deployment.targetNamespace || "";
-      const configuredValues = mergeDeployValues(values, deployment.values || {});
-      if (deployment.managed && deployment.environments) configuredValues.virtualService.hosts = Object.fromEntries(Object.entries(configuredValues.virtualService.hosts).filter(
-        /** 托管部署仅保留已选择环境的域名。 */
-        ([environment]) => deployment.environments.includes(environment) || environment === "test" && deployment.environments.includes("stable")
+      defaults.virtualService = { ...defaults.virtualService, enabled: virtualServiceEnabled, hosts: { prod: hostsProd, stage: hostsStage, test: hostsTest }, gateways };
+      defaults.targetK8s = deployment.targetK8s || "saas";
+      defaults.namespace = deployment.targetNamespace || "";
+      const values = mergeDeployValues(defaults, deployment.values || {});
+      values.managed = Boolean(deployment.managed);
+      values.nodeVersion = deployment.values?.nodeVersion || "22.22.0";
+      if (!/^\d+\.\d+\.\d+$/.test(values.nodeVersion)) throw new Error("deploy.values.nodeVersion \u5FC5\u987B\u662F\u5B8C\u6574 Node \u7248\u672C\u53F7");
+      if (!["saas", "infra"].includes(values.targetK8s)) throw new Error("deploy.targetK8s \u53EA\u80FD\u4E3A saas \u6216 infra");
+      if (!values.environments || typeof values.environments !== "object" || Array.isArray(values.environments) || Object.values(values.environments).some(
+        /** 发布开关必须是布尔值，避免误执行未启用环境。 */
+        (enabled) => typeof enabled !== "boolean"
+      )) throw new Error("deploy.values.environments \u5FC5\u987B\u662F\u5E03\u5C14\u5F00\u5173\u5BF9\u8C61");
+      if (deployment.managed) values.virtualService.hosts = Object.fromEntries(Object.entries(values.virtualService.hosts).filter(
+        /** 不生成没有配置域名的环境条目。 */
+        ([, hosts]) => Array.isArray(hosts) && hosts.length
       ));
+      const drone = import_node_fs.default.readFileSync(import_node_path.default.join(source, ".drone.yml"), "utf8").replaceAll("<<NODE_VERSION>>", values.nodeVersion).replaceAll("<<TARGET_K8S>>", values.targetK8s).replace(JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`), JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`));
       if (deployment.managed) {
         if (target === source) throw new Error("managed \u90E8\u7F72\u8F93\u51FA\u4E0D\u80FD\u8986\u76D6\u6846\u67B6\u6A21\u677F\u76EE\u5F55");
         import_node_fs.default.cpSync(source, target, { recursive: true });
       }
       import_node_fs.default.mkdirSync(import_node_path.default.dirname(droneTarget), { recursive: true });
-      import_node_fs.default.writeFileSync(import_node_path.default.join(target, "helm/values.yaml"), import_yaml.default.stringify(configuredValues, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" }));
+      import_node_fs.default.writeFileSync(import_node_path.default.join(target, "helm/values.yaml"), import_yaml.default.stringify(values, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" }));
       import_node_fs.default.writeFileSync(droneTarget, drone);
     };
     getJwtEnv = async () => {

package/dist/cli.mjs

@@ -20,69 +20,14 @@ import path from "path";
 import { fileURLToPath } from "url";
 import yaml from "yaml";
 function mergeDeployValues(base, overrides) {
-  const entries = Object.entries({ ...base, ...overrides }).map(
-    /** 只递归普通对象，列表保持调用方声明的顺序与完整内容。 */
+  return Object.fromEntries(Object.entries({ ...base, ...overrides }).map(
+    /** 仅合并普通对象，列表保持声明的顺序。 */
     ([key, value]) => {
       const previous = base[key];
       const mergeable = value && previous && typeof value === "object" && typeof previous === "object" && !Array.isArray(value) && !Array.isArray(previous);
       return [key, mergeable ? mergeDeployValues(previous, value) : value];
     }
-  );
-  return Object.fromEntries(entries);
-}
-function configureDeployPipeline(template, deployment) {
-  if (!deployment.managed && !deployment.nodeVersion && !deployment.environments && !deployment.buildCommand) return template;
-  const documents = yaml.parseAllDocuments(template).map(
-    /** 保留镜像和集群 Secret 定义。 */
-    (document) => document.toJSON()
-  );
-  const pipeline = documents[0];
-  const environments = deployment.environments;
-  const known = ["test", "stage", "prod", "stable"];
-  if (environments && (!Array.isArray(environments) || !environments.length || environments.some(
-    /** 拒绝未声明的发布环境名称。 */
-    (environment) => typeof environment !== "string" || !known.includes(environment)
-  ))) throw new Error("deploy.environments \u5FC5\u987B\u662F test/stage/prod/stable \u7684\u975E\u7A7A\u6570\u7EC4");
-  if (deployment.nodeVersion && !/^\d+\.\d+\.\d+$/.test(deployment.nodeVersion)) throw new Error("deploy.nodeVersion \u5FC5\u987B\u662F\u5B8C\u6574 Node \u7248\u672C\u53F7");
-  if (deployment.managed && deployment.targetNamespace && !/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/.test(deployment.targetNamespace)) throw new Error("deploy.targetNamespace \u5FC5\u987B\u662F\u6709\u6548 Kubernetes \u547D\u540D\u7A7A\u95F4");
-  const selected = environments ? new Set(environments) : void 0;
-  const stepEnvironments = /* @__PURE__ */ new Map([["deploy-to-test", "test"], ["deploy-to-stage", "stage"], ["deploy-to-prod", "prod"], ["deploy-to-stable", "stable"], ["push-helm-chart", "prod"]]);
-  pipeline.steps = pipeline.steps.filter(
-    /** 通用安装和构建步骤保留，发布步骤按显式环境选择。 */
-    (step) => !selected || !stepEnvironments.has(step.name) || selected.has(stepEnvironments.get(step.name))
-  );
-  for (const step of pipeline.steps) {
-    if (deployment.nodeVersion && ["install", "build"].includes(step.name)) step.image = `node:${deployment.nodeVersion}-bookworm`;
-    if (deployment.nodeVersion && step.name === "image-build") step.settings.build_args.push(`XFE_NODE_VERSION=${deployment.nodeVersion}`);
-    if (step.name === "build") step.commands = step.commands.map(
-      /** managed 构建复用配置生成器；应用自定义检查仍由应用命令负责。 */
-      (command2) => {
-        if (deployment.managed && command2 === "cp -r node_modules/@xfe-repo/web-app/deploy deploy") return "pnpm exec xfe-web config";
-        return command2 === "pnpm build" ? deployment.buildCommand || command2 : command2;
-      }
-    );
-    if (deployment.managed && deployment.targetK8s === "infra" && step.name === "pre-deploy") delete step.environment.SAAS_K8S_CONFIG;
-    if (deployment.managed && step.name === "deploy-to-prod") step.commands = step.commands.map(
-      /** 正式 Helm 部署等待探针并在失败时撤销资源变更。 */
-      (command2) => command2.includes("| kubectl") ? `helm upgrade --install "\${DRONE_REPO//\\//-}" deploy/helm --values deploy/helm/values.prod.yaml --namespace ${deployment.targetNamespace || "deployment-prod"} --create-namespace --kubeconfig=kube_config --atomic --wait --timeout 5m` : command2
-    );
-  }
-  if (selected && !selected.has("test")) {
-    pipeline.trigger.event = ["tag"];
-    const tags = [...new Set([...selected].map(
-      /** prod 与 stable 共用正式标签，其余使用各自的标签。 */
-      (environment) => environment === "stage" ? "refs/tags/stage-*" : "refs/tags/release-*"
-    ))];
-    pipeline.trigger.ref = { include: tags };
-  }
-  const result = deployment.managed && deployment.targetK8s === "infra" ? documents.filter(
-    /** infra 独立生成的流水线不要求额外的 saas kubeconfig。 */
-    (document) => document.kind !== "secret" || document.name !== "saas-k8s-config"
-  ) : documents;
-  return result.map(
-    /** 序列化多文档流水线，保留 Kubernetes Runner 的 Secret 引用。 */
-    (document) => yaml.stringify(document)
-  ).join("---\n");
+  ));
 }
 var DEFAULT_BUILD_DIRECTORY, BUILD_DIRECTORY_ARGUMENT, protectedDirectories, loadXfeConfig, getBuildDirectory, getServerEntry, configDeploy, getJwtEnv;
 var init_config = __esm({
@@ -155,24 +100,31 @@ var init_config = __esm({
       const target = deployment.managed ? getBuildDirectory(projectRoot, { buildDirectory: "deploy" }) : source;
       const buildDirectory = path.relative(projectRoot, getBuildDirectory(projectRoot, xfeConfig.webapp)).replaceAll(path.sep, "/");
       const droneTarget = path.resolve(projectRoot, deployment.droneConfigPath || "./.drone.yml");
-      const template = fs.readFileSync(path.join(source, ".drone.yml"), "utf8").replace(JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`), JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`));
-      const drone = configureDeployPipeline(template, deployment);
-      const values = yaml.parse(fs.readFileSync(path.join(source, "helm/values.yaml"), "utf8"));
+      const defaults = yaml.parse(fs.readFileSync(path.join(source, "helm/values.yaml"), "utf8"));
       const { virtualServiceEnabled = true, hostsProd = [], hostsStage = [], hostsTest = [], gateways = ["common-gateway-eshetang"] } = deployment;
-      values.virtualService = { ...values.virtualService, enabled: virtualServiceEnabled, hosts: { prod: hostsProd, stage: hostsStage, test: hostsTest }, gateways };
-      values.targetK8s = deployment.targetK8s || "saas";
-      values.namespace = deployment.targetNamespace || "";
-      const configuredValues = mergeDeployValues(values, deployment.values || {});
-      if (deployment.managed && deployment.environments) configuredValues.virtualService.hosts = Object.fromEntries(Object.entries(configuredValues.virtualService.hosts).filter(
-        /** 托管部署仅保留已选择环境的域名。 */
-        ([environment]) => deployment.environments.includes(environment) || environment === "test" && deployment.environments.includes("stable")
+      defaults.virtualService = { ...defaults.virtualService, enabled: virtualServiceEnabled, hosts: { prod: hostsProd, stage: hostsStage, test: hostsTest }, gateways };
+      defaults.targetK8s = deployment.targetK8s || "saas";
+      defaults.namespace = deployment.targetNamespace || "";
+      const values = mergeDeployValues(defaults, deployment.values || {});
+      values.managed = Boolean(deployment.managed);
+      values.nodeVersion = deployment.values?.nodeVersion || "22.22.0";
+      if (!/^\d+\.\d+\.\d+$/.test(values.nodeVersion)) throw new Error("deploy.values.nodeVersion \u5FC5\u987B\u662F\u5B8C\u6574 Node \u7248\u672C\u53F7");
+      if (!["saas", "infra"].includes(values.targetK8s)) throw new Error("deploy.targetK8s \u53EA\u80FD\u4E3A saas \u6216 infra");
+      if (!values.environments || typeof values.environments !== "object" || Array.isArray(values.environments) || Object.values(values.environments).some(
+        /** 发布开关必须是布尔值，避免误执行未启用环境。 */
+        (enabled) => typeof enabled !== "boolean"
+      )) throw new Error("deploy.values.environments \u5FC5\u987B\u662F\u5E03\u5C14\u5F00\u5173\u5BF9\u8C61");
+      if (deployment.managed) values.virtualService.hosts = Object.fromEntries(Object.entries(values.virtualService.hosts).filter(
+        /** 不生成没有配置域名的环境条目。 */
+        ([, hosts]) => Array.isArray(hosts) && hosts.length
       ));
+      const drone = fs.readFileSync(path.join(source, ".drone.yml"), "utf8").replaceAll("<<NODE_VERSION>>", values.nodeVersion).replaceAll("<<TARGET_K8S>>", values.targetK8s).replace(JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`), JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`));
       if (deployment.managed) {
         if (target === source) throw new Error("managed \u90E8\u7F72\u8F93\u51FA\u4E0D\u80FD\u8986\u76D6\u6846\u67B6\u6A21\u677F\u76EE\u5F55");
         fs.cpSync(source, target, { recursive: true });
       }
       fs.mkdirSync(path.dirname(droneTarget), { recursive: true });
-      fs.writeFileSync(path.join(target, "helm/values.yaml"), yaml.stringify(configuredValues, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" }));
+      fs.writeFileSync(path.join(target, "helm/values.yaml"), yaml.stringify(values, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" }));
       fs.writeFileSync(droneTarget, drone);
     };
     getJwtEnv = async () => {

package/dist/config.d.mts

@@ -26,7 +26,7 @@ declare const loadXfeConfig: (root?: string) => XfeConfig;
 declare const getBuildDirectory: (projectRoot: string, webapp?: WebAppConfig) => string;
 /** 生产仅校验入口约定而不读取源码，构建阶段由编译器检查文件存在。 */
 declare const getServerEntry: (projectRoot: string, webapp?: WebAppConfig) => string | undefined;
-/** 默认保留既有部署；managed 模式将公共模板和覆盖 values 生成到项目 deploy 目录。 */
+/** 合并部署 values 并生成公共模板，不改写流水线步骤或执行逻辑。 */
 declare const configDeploy: () => void;
 declare const getJwtEnv: () => Promise<Partial<JwtEnv>>;
 

package/dist/config.d.ts

@@ -26,7 +26,7 @@ declare const loadXfeConfig: (root?: string) => XfeConfig;
 declare const getBuildDirectory: (projectRoot: string, webapp?: WebAppConfig) => string;
 /** 生产仅校验入口约定而不读取源码，构建阶段由编译器检查文件存在。 */
 declare const getServerEntry: (projectRoot: string, webapp?: WebAppConfig) => string | undefined;
-/** 默认保留既有部署；managed 模式将公共模板和覆盖 values 生成到项目 deploy 目录。 */
+/** 合并部署 values 并生成公共模板，不改写流水线步骤或执行逻辑。 */
 declare const configDeploy: () => void;
 declare const getJwtEnv: () => Promise<Partial<JwtEnv>>;
 

package/dist/config.js

@@ -109,90 +109,42 @@ var configDeploy = () => {
   const target = deployment.managed ? getBuildDirectory(projectRoot, { buildDirectory: "deploy" }) : source;
   const buildDirectory = import_node_path.default.relative(projectRoot, getBuildDirectory(projectRoot, xfeConfig.webapp)).replaceAll(import_node_path.default.sep, "/");
   const droneTarget = import_node_path.default.resolve(projectRoot, deployment.droneConfigPath || "./.drone.yml");
-  const template = import_node_fs.default.readFileSync(import_node_path.default.join(source, ".drone.yml"), "utf8").replace(JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`), JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`));
-  const drone = configureDeployPipeline(template, deployment);
-  const values = import_yaml.default.parse(import_node_fs.default.readFileSync(import_node_path.default.join(source, "helm/values.yaml"), "utf8"));
+  const defaults = import_yaml.default.parse(import_node_fs.default.readFileSync(import_node_path.default.join(source, "helm/values.yaml"), "utf8"));
   const { virtualServiceEnabled = true, hostsProd = [], hostsStage = [], hostsTest = [], gateways = ["common-gateway-eshetang"] } = deployment;
-  values.virtualService = { ...values.virtualService, enabled: virtualServiceEnabled, hosts: { prod: hostsProd, stage: hostsStage, test: hostsTest }, gateways };
-  values.targetK8s = deployment.targetK8s || "saas";
-  values.namespace = deployment.targetNamespace || "";
-  const configuredValues = mergeDeployValues(values, deployment.values || {});
-  if (deployment.managed && deployment.environments) configuredValues.virtualService.hosts = Object.fromEntries(Object.entries(configuredValues.virtualService.hosts).filter(
-    /** 托管部署仅保留已选择环境的域名。 */
-    ([environment]) => deployment.environments.includes(environment) || environment === "test" && deployment.environments.includes("stable")
+  defaults.virtualService = { ...defaults.virtualService, enabled: virtualServiceEnabled, hosts: { prod: hostsProd, stage: hostsStage, test: hostsTest }, gateways };
+  defaults.targetK8s = deployment.targetK8s || "saas";
+  defaults.namespace = deployment.targetNamespace || "";
+  const values = mergeDeployValues(defaults, deployment.values || {});
+  values.managed = Boolean(deployment.managed);
+  values.nodeVersion = deployment.values?.nodeVersion || "22.22.0";
+  if (!/^\d+\.\d+\.\d+$/.test(values.nodeVersion)) throw new Error("deploy.values.nodeVersion \u5FC5\u987B\u662F\u5B8C\u6574 Node \u7248\u672C\u53F7");
+  if (!["saas", "infra"].includes(values.targetK8s)) throw new Error("deploy.targetK8s \u53EA\u80FD\u4E3A saas \u6216 infra");
+  if (!values.environments || typeof values.environments !== "object" || Array.isArray(values.environments) || Object.values(values.environments).some(
+    /** 发布开关必须是布尔值，避免误执行未启用环境。 */
+    (enabled) => typeof enabled !== "boolean"
+  )) throw new Error("deploy.values.environments \u5FC5\u987B\u662F\u5E03\u5C14\u5F00\u5173\u5BF9\u8C61");
+  if (deployment.managed) values.virtualService.hosts = Object.fromEntries(Object.entries(values.virtualService.hosts).filter(
+    /** 不生成没有配置域名的环境条目。 */
+    ([, hosts]) => Array.isArray(hosts) && hosts.length
   ));
+  const drone = import_node_fs.default.readFileSync(import_node_path.default.join(source, ".drone.yml"), "utf8").replaceAll("<<NODE_VERSION>>", values.nodeVersion).replaceAll("<<TARGET_K8S>>", values.targetK8s).replace(JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`), JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`));
   if (deployment.managed) {
     if (target === source) throw new Error("managed \u90E8\u7F72\u8F93\u51FA\u4E0D\u80FD\u8986\u76D6\u6846\u67B6\u6A21\u677F\u76EE\u5F55");
     import_node_fs.default.cpSync(source, target, { recursive: true });
   }
   import_node_fs.default.mkdirSync(import_node_path.default.dirname(droneTarget), { recursive: true });
-  import_node_fs.default.writeFileSync(import_node_path.default.join(target, "helm/values.yaml"), import_yaml.default.stringify(configuredValues, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" }));
+  import_node_fs.default.writeFileSync(import_node_path.default.join(target, "helm/values.yaml"), import_yaml.default.stringify(values, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" }));
   import_node_fs.default.writeFileSync(droneTarget, drone);
 };
 function mergeDeployValues(base, overrides) {
-  const entries = Object.entries({ ...base, ...overrides }).map(
-    /** 只递归普通对象，列表保持调用方声明的顺序与完整内容。 */
+  return Object.fromEntries(Object.entries({ ...base, ...overrides }).map(
+    /** 仅合并普通对象，列表保持声明的顺序。 */
     ([key, value]) => {
       const previous = base[key];
       const mergeable = value && previous && typeof value === "object" && typeof previous === "object" && !Array.isArray(value) && !Array.isArray(previous);
       return [key, mergeable ? mergeDeployValues(previous, value) : value];
     }
-  );
-  return Object.fromEntries(entries);
-}
-function configureDeployPipeline(template, deployment) {
-  if (!deployment.managed && !deployment.nodeVersion && !deployment.environments && !deployment.buildCommand) return template;
-  const documents = import_yaml.default.parseAllDocuments(template).map(
-    /** 保留镜像和集群 Secret 定义。 */
-    (document) => document.toJSON()
-  );
-  const pipeline = documents[0];
-  const environments = deployment.environments;
-  const known = ["test", "stage", "prod", "stable"];
-  if (environments && (!Array.isArray(environments) || !environments.length || environments.some(
-    /** 拒绝未声明的发布环境名称。 */
-    (environment) => typeof environment !== "string" || !known.includes(environment)
-  ))) throw new Error("deploy.environments \u5FC5\u987B\u662F test/stage/prod/stable \u7684\u975E\u7A7A\u6570\u7EC4");
-  if (deployment.nodeVersion && !/^\d+\.\d+\.\d+$/.test(deployment.nodeVersion)) throw new Error("deploy.nodeVersion \u5FC5\u987B\u662F\u5B8C\u6574 Node \u7248\u672C\u53F7");
-  if (deployment.managed && deployment.targetNamespace && !/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/.test(deployment.targetNamespace)) throw new Error("deploy.targetNamespace \u5FC5\u987B\u662F\u6709\u6548 Kubernetes \u547D\u540D\u7A7A\u95F4");
-  const selected = environments ? new Set(environments) : void 0;
-  const stepEnvironments = /* @__PURE__ */ new Map([["deploy-to-test", "test"], ["deploy-to-stage", "stage"], ["deploy-to-prod", "prod"], ["deploy-to-stable", "stable"], ["push-helm-chart", "prod"]]);
-  pipeline.steps = pipeline.steps.filter(
-    /** 通用安装和构建步骤保留，发布步骤按显式环境选择。 */
-    (step) => !selected || !stepEnvironments.has(step.name) || selected.has(stepEnvironments.get(step.name))
-  );
-  for (const step of pipeline.steps) {
-    if (deployment.nodeVersion && ["install", "build"].includes(step.name)) step.image = `node:${deployment.nodeVersion}-bookworm`;
-    if (deployment.nodeVersion && step.name === "image-build") step.settings.build_args.push(`XFE_NODE_VERSION=${deployment.nodeVersion}`);
-    if (step.name === "build") step.commands = step.commands.map(
-      /** managed 构建复用配置生成器；应用自定义检查仍由应用命令负责。 */
-      (command) => {
-        if (deployment.managed && command === "cp -r node_modules/@xfe-repo/web-app/deploy deploy") return "pnpm exec xfe-web config";
-        return command === "pnpm build" ? deployment.buildCommand || command : command;
-      }
-    );
-    if (deployment.managed && deployment.targetK8s === "infra" && step.name === "pre-deploy") delete step.environment.SAAS_K8S_CONFIG;
-    if (deployment.managed && step.name === "deploy-to-prod") step.commands = step.commands.map(
-      /** 正式 Helm 部署等待探针并在失败时撤销资源变更。 */
-      (command) => command.includes("| kubectl") ? `helm upgrade --install "\${DRONE_REPO//\\//-}" deploy/helm --values deploy/helm/values.prod.yaml --namespace ${deployment.targetNamespace || "deployment-prod"} --create-namespace --kubeconfig=kube_config --atomic --wait --timeout 5m` : command
-    );
-  }
-  if (selected && !selected.has("test")) {
-    pipeline.trigger.event = ["tag"];
-    const tags = [...new Set([...selected].map(
-      /** prod 与 stable 共用正式标签，其余使用各自的标签。 */
-      (environment) => environment === "stage" ? "refs/tags/stage-*" : "refs/tags/release-*"
-    ))];
-    pipeline.trigger.ref = { include: tags };
-  }
-  const result = deployment.managed && deployment.targetK8s === "infra" ? documents.filter(
-    /** infra 独立生成的流水线不要求额外的 saas kubeconfig。 */
-    (document) => document.kind !== "secret" || document.name !== "saas-k8s-config"
-  ) : documents;
-  return result.map(
-    /** 序列化多文档流水线，保留 Kubernetes Runner 的 Secret 引用。 */
-    (document) => import_yaml.default.stringify(document)
-  ).join("---\n");
+  ));
 }
 var getJwtEnv = async () => {
   const xfeConfig = loadXfeConfig();

package/dist/config.mjs

@@ -70,90 +70,42 @@ var configDeploy = () => {
   const target = deployment.managed ? getBuildDirectory(projectRoot, { buildDirectory: "deploy" }) : source;
   const buildDirectory = path.relative(projectRoot, getBuildDirectory(projectRoot, xfeConfig.webapp)).replaceAll(path.sep, "/");
   const droneTarget = path.resolve(projectRoot, deployment.droneConfigPath || "./.drone.yml");
-  const template = fs.readFileSync(path.join(source, ".drone.yml"), "utf8").replace(JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`), JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`));
-  const drone = configureDeployPipeline(template, deployment);
-  const values = yaml.parse(fs.readFileSync(path.join(source, "helm/values.yaml"), "utf8"));
+  const defaults = yaml.parse(fs.readFileSync(path.join(source, "helm/values.yaml"), "utf8"));
   const { virtualServiceEnabled = true, hostsProd = [], hostsStage = [], hostsTest = [], gateways = ["common-gateway-eshetang"] } = deployment;
-  values.virtualService = { ...values.virtualService, enabled: virtualServiceEnabled, hosts: { prod: hostsProd, stage: hostsStage, test: hostsTest }, gateways };
-  values.targetK8s = deployment.targetK8s || "saas";
-  values.namespace = deployment.targetNamespace || "";
-  const configuredValues = mergeDeployValues(values, deployment.values || {});
-  if (deployment.managed && deployment.environments) configuredValues.virtualService.hosts = Object.fromEntries(Object.entries(configuredValues.virtualService.hosts).filter(
-    /** 托管部署仅保留已选择环境的域名。 */
-    ([environment]) => deployment.environments.includes(environment) || environment === "test" && deployment.environments.includes("stable")
+  defaults.virtualService = { ...defaults.virtualService, enabled: virtualServiceEnabled, hosts: { prod: hostsProd, stage: hostsStage, test: hostsTest }, gateways };
+  defaults.targetK8s = deployment.targetK8s || "saas";
+  defaults.namespace = deployment.targetNamespace || "";
+  const values = mergeDeployValues(defaults, deployment.values || {});
+  values.managed = Boolean(deployment.managed);
+  values.nodeVersion = deployment.values?.nodeVersion || "22.22.0";
+  if (!/^\d+\.\d+\.\d+$/.test(values.nodeVersion)) throw new Error("deploy.values.nodeVersion \u5FC5\u987B\u662F\u5B8C\u6574 Node \u7248\u672C\u53F7");
+  if (!["saas", "infra"].includes(values.targetK8s)) throw new Error("deploy.targetK8s \u53EA\u80FD\u4E3A saas \u6216 infra");
+  if (!values.environments || typeof values.environments !== "object" || Array.isArray(values.environments) || Object.values(values.environments).some(
+    /** 发布开关必须是布尔值，避免误执行未启用环境。 */
+    (enabled) => typeof enabled !== "boolean"
+  )) throw new Error("deploy.values.environments \u5FC5\u987B\u662F\u5E03\u5C14\u5F00\u5173\u5BF9\u8C61");
+  if (deployment.managed) values.virtualService.hosts = Object.fromEntries(Object.entries(values.virtualService.hosts).filter(
+    /** 不生成没有配置域名的环境条目。 */
+    ([, hosts]) => Array.isArray(hosts) && hosts.length
   ));
+  const drone = fs.readFileSync(path.join(source, ".drone.yml"), "utf8").replaceAll("<<NODE_VERSION>>", values.nodeVersion).replaceAll("<<TARGET_K8S>>", values.targetK8s).replace(JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`), JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`));
   if (deployment.managed) {
     if (target === source) throw new Error("managed \u90E8\u7F72\u8F93\u51FA\u4E0D\u80FD\u8986\u76D6\u6846\u67B6\u6A21\u677F\u76EE\u5F55");
     fs.cpSync(source, target, { recursive: true });
   }
   fs.mkdirSync(path.dirname(droneTarget), { recursive: true });
-  fs.writeFileSync(path.join(target, "helm/values.yaml"), yaml.stringify(configuredValues, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" }));
+  fs.writeFileSync(path.join(target, "helm/values.yaml"), yaml.stringify(values, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" }));
   fs.writeFileSync(droneTarget, drone);
 };
 function mergeDeployValues(base, overrides) {
-  const entries = Object.entries({ ...base, ...overrides }).map(
-    /** 只递归普通对象，列表保持调用方声明的顺序与完整内容。 */
+  return Object.fromEntries(Object.entries({ ...base, ...overrides }).map(
+    /** 仅合并普通对象，列表保持声明的顺序。 */
     ([key, value]) => {
       const previous = base[key];
       const mergeable = value && previous && typeof value === "object" && typeof previous === "object" && !Array.isArray(value) && !Array.isArray(previous);
       return [key, mergeable ? mergeDeployValues(previous, value) : value];
     }
-  );
-  return Object.fromEntries(entries);
-}
-function configureDeployPipeline(template, deployment) {
-  if (!deployment.managed && !deployment.nodeVersion && !deployment.environments && !deployment.buildCommand) return template;
-  const documents = yaml.parseAllDocuments(template).map(
-    /** 保留镜像和集群 Secret 定义。 */
-    (document) => document.toJSON()
-  );
-  const pipeline = documents[0];
-  const environments = deployment.environments;
-  const known = ["test", "stage", "prod", "stable"];
-  if (environments && (!Array.isArray(environments) || !environments.length || environments.some(
-    /** 拒绝未声明的发布环境名称。 */
-    (environment) => typeof environment !== "string" || !known.includes(environment)
-  ))) throw new Error("deploy.environments \u5FC5\u987B\u662F test/stage/prod/stable \u7684\u975E\u7A7A\u6570\u7EC4");
-  if (deployment.nodeVersion && !/^\d+\.\d+\.\d+$/.test(deployment.nodeVersion)) throw new Error("deploy.nodeVersion \u5FC5\u987B\u662F\u5B8C\u6574 Node \u7248\u672C\u53F7");
-  if (deployment.managed && deployment.targetNamespace && !/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/.test(deployment.targetNamespace)) throw new Error("deploy.targetNamespace \u5FC5\u987B\u662F\u6709\u6548 Kubernetes \u547D\u540D\u7A7A\u95F4");
-  const selected = environments ? new Set(environments) : void 0;
-  const stepEnvironments = /* @__PURE__ */ new Map([["deploy-to-test", "test"], ["deploy-to-stage", "stage"], ["deploy-to-prod", "prod"], ["deploy-to-stable", "stable"], ["push-helm-chart", "prod"]]);
-  pipeline.steps = pipeline.steps.filter(
-    /** 通用安装和构建步骤保留，发布步骤按显式环境选择。 */
-    (step) => !selected || !stepEnvironments.has(step.name) || selected.has(stepEnvironments.get(step.name))
-  );
-  for (const step of pipeline.steps) {
-    if (deployment.nodeVersion && ["install", "build"].includes(step.name)) step.image = `node:${deployment.nodeVersion}-bookworm`;
-    if (deployment.nodeVersion && step.name === "image-build") step.settings.build_args.push(`XFE_NODE_VERSION=${deployment.nodeVersion}`);
-    if (step.name === "build") step.commands = step.commands.map(
-      /** managed 构建复用配置生成器；应用自定义检查仍由应用命令负责。 */
-      (command) => {
-        if (deployment.managed && command === "cp -r node_modules/@xfe-repo/web-app/deploy deploy") return "pnpm exec xfe-web config";
-        return command === "pnpm build" ? deployment.buildCommand || command : command;
-      }
-    );
-    if (deployment.managed && deployment.targetK8s === "infra" && step.name === "pre-deploy") delete step.environment.SAAS_K8S_CONFIG;
-    if (deployment.managed && step.name === "deploy-to-prod") step.commands = step.commands.map(
-      /** 正式 Helm 部署等待探针并在失败时撤销资源变更。 */
-      (command) => command.includes("| kubectl") ? `helm upgrade --install "\${DRONE_REPO//\\//-}" deploy/helm --values deploy/helm/values.prod.yaml --namespace ${deployment.targetNamespace || "deployment-prod"} --create-namespace --kubeconfig=kube_config --atomic --wait --timeout 5m` : command
-    );
-  }
-  if (selected && !selected.has("test")) {
-    pipeline.trigger.event = ["tag"];
-    const tags = [...new Set([...selected].map(
-      /** prod 与 stable 共用正式标签，其余使用各自的标签。 */
-      (environment) => environment === "stage" ? "refs/tags/stage-*" : "refs/tags/release-*"
-    ))];
-    pipeline.trigger.ref = { include: tags };
-  }
-  const result = deployment.managed && deployment.targetK8s === "infra" ? documents.filter(
-    /** infra 独立生成的流水线不要求额外的 saas kubeconfig。 */
-    (document) => document.kind !== "secret" || document.name !== "saas-k8s-config"
-  ) : documents;
-  return result.map(
-    /** 序列化多文档流水线，保留 Kubernetes Runner 的 Secret 引用。 */
-    (document) => yaml.stringify(document)
-  ).join("---\n");
+  ));
 }
 var getJwtEnv = async () => {
   const xfeConfig = loadXfeConfig();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xfe-repo/web-app",
-  "version": "2.0.0-beta.4",
+  "version": "2.0.0-beta.5",
   "bin": {
     "xfe-web": "./bin/index.js"
   },