direxio-deployer 0.1.0 → 0.1.1

package/README.md

@@ -21,6 +21,8 @@
 
 Install the deployer skill from npm, then place it into the current agent runtime's skill directory. Project-local installs are preferred because they keep the deployment skill scoped to the workspace that uses it.
 
+The GitHub repository keeps tests for maintainers and CI, but the published npm package and installed skill copy exclude `tests/` to keep user installs small.
+
 POSIX shells:
 
 ```bash
@@ -51,7 +53,7 @@ direxio-deployer skill install --agent codex --scope global
 The installer writes `.direxio-skill-install.json` into the target directory and refuses to overwrite unmanaged existing content unless `--force` is provided. To pin a version, install that package version first:
 
 ```bash
-npm install -g direxio-deployer@0.1.0
+npm install -g direxio-deployer@0.1.1
 direxio-deployer skill update --agent codex --scope project --project .
 ```
 

package/README_zh.md

@@ -19,6 +19,8 @@
 
 通过 npm 安装 deployer skill，再把它写入当前智能体运行时的 skill 目录。默认推荐 project-local 安装，让部署 skill 跟随当前 workspace。
 
+GitHub 仓库保留测试用于维护和 CI，但发布到 npm 的包以及安装到智能体 skill 目录的副本不包含 `tests/`，以减小用户安装体积。
+
 POSIX shell：
 
 ```bash
@@ -49,7 +51,7 @@ direxio-deployer skill install --agent codex --scope global
 安装器会在目标目录写入 `.direxio-skill-install.json`，并拒绝覆盖没有该 manifest 的既有目录，除非显式传入 `--force`。如需固定版本，先安装指定 npm 版本：
 
 ```bash
-npm install -g direxio-deployer@0.1.0
+npm install -g direxio-deployer@0.1.1
 direxio-deployer skill update --agent codex --scope project --project .
 ```
 

package/SKILL.md

@@ -439,7 +439,7 @@ NS nameservers before authoritative DNS can resolve. Never use temporary
 ## Deployment Flow
 
 1. Complete the Cloud Account And Domain Onboarding gate above for first-time users or whenever AWS credentials, domain ownership, or DNS authority are unclear.
-2. Read `references/tooling.md`; inspect the user OS and install or prepare missing `bash`, `aws`, `jq`, `ssh`, `scp`, `curl`, and DNS lookup capability only after approval.
+2. Read `references/tooling.md`; inspect the user OS and install or prepare missing `bash`, `node`, `aws`, `ssh`, `scp`, `curl`, and DNS lookup capability only after approval.
 3. Inspect DNS, AWS credentials, region defaults, local tooling, and existing deployment state before asking the user anything that can be discovered automatically.
    **DNS tool preflight:** Before any DNS propagation or Route53 delegation
    check, confirm the environment has at least one working DNS lookup path:
@@ -649,7 +649,7 @@ Ask once, plainly and in the user's language. The confirmation message must summ
 - AWS credentials source, including whether root access keys are being used.
 - AWS/domain onboarding status: active AWS account, real long-lived domain, access key CSV or AWS profile, DNS authority, and billing/deletion acknowledgement.
 - Existing state action: `continue`, `destroy`, or different `DOMAIN`/service directory.
-- Network/system installs: package managers, AWS CLI, jq, Git Bash/MSYS2/WSL, Homebrew, apt/dnf/yum/pacman/zypper.
+- Network/system installs: package managers, Node.js, AWS CLI, Git Bash/MSYS2/WSL, Homebrew, apt/dnf/yum/pacman/zypper.
 
 After the user confirms the summary, proceed without re-confirming individual fields. Ask again only when the configuration materially changes, an unapproved destructive action becomes necessary, or an external action such as DNS must be completed by the user.
 

package/bin/direxio-deployer.mjs

@@ -20,8 +20,7 @@ const skillFiles = [
   "bin",
   "package.json",
   "references",
-  "scripts",
-  "tests"
+  "scripts"
 ];
 
 const projectTargets = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "direxio-deployer",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Versioned Direxio deployer agent skill and portable deployment orchestration tools.",
   "type": "module",
   "bin": {
@@ -15,8 +15,7 @@
     "agents/",
     "bin/",
     "references/",
-    "scripts/",
-    "tests/"
+    "scripts/"
   ],
   "scripts": {
     "test": "bash tests/npm_skill_distribution_test.sh && bash tests/skill_structure_test.sh && bash tests/s6_wire_local_test.sh && bash tests/render_userdata_remote_nodes_test.sh"

package/references/deployment-lessons.md

@@ -39,7 +39,7 @@ Use a POSIX shell that actually runs the deployment scripts:
 
 ```powershell
 Get-Command bash.exe -All
-bash -lc 'echo ok; command -v aws; command -v jq; command -v ssh; command -v scp; command -v curl'
+bash -lc 'echo ok; command -v node; command -v aws; command -v ssh; command -v scp; command -v curl'
 ```
 
 If `bash` prints the Windows Subsystem for Linux installation prompt or exits
@@ -47,11 +47,9 @@ before running `echo ok`, it is only the Windows WSL launcher and cannot run ops
 until a WSL distro is installed. Use another POSIX shell such as Git Bash, MSYS2,
 Cygwin, or a working WSL distro.
 
-The orchestrator now prepends workspace-local `.tools/bin` when present. This
-directory is an optional local tool cache that may be downloaded by the operator
-or system; it is not assumed to come from the original repo or from the skill.
-When `.tools/bin/jq.exe` exists, compatible Windows POSIX shells can discover it
-without manual PATH surgery.
+The orchestrator uses the repository's Node.js JSON helper for local JSON
+processing, so the POSIX shell that runs deployment scripts must be able to run
+`node` against the same path style it passes to the scripts.
 
 Prefer the `ssh`/`scp` that belongs to the same POSIX environment used for
 `bash`. Windows OpenSSH can reject EC2 private keys because inherited ACLs make
@@ -132,7 +130,7 @@ Fix procedure:
 
 1. Read the created or reused zone details from `state.json`:
    ```bash
-   jq '.resources | {route53_zone_id, route53_zone_name, route53_name_servers}' ~/.direxio/nodes/<service_id>/state.json
+   node scripts/json.mjs get ~/.direxio/nodes/<service_id>/state.json resources
    ```
 2. Delegate those NS servers at the current registrar, or use the provider API
    if credentials are available.

package/references/deployment-workflow.md

@@ -282,7 +282,7 @@ If the domain is registered outside Route53, delegate the recorded nameservers
 at the current registrar or through a provider API:
 
 ```bash
-jq '.resources | {route53_zone_id, route53_zone_name, route53_name_servers}' ~/.direxio/nodes/<service_id>/state.json
+node scripts/json.mjs get ~/.direxio/nodes/<service_id>/state.json resources
 ```
 
 After authoritative DNS returns the new IP, continue with the same state:

package/references/tooling.md

@@ -1,21 +1,21 @@
 # Tooling By OS
 
-Prepare `bash`, `aws`, `jq`, `ssh`, `scp`, `curl`, and at least one DNS lookup
+Prepare `bash`, `node`, `aws`, `ssh`, `scp`, `curl`, and at least one DNS lookup
 tool. Always inspect first, then ask before installing or downloading.
 
 ## Detect
 
 ```bash
-command -v bash aws jq ssh scp curl
+command -v bash node aws ssh scp curl
 command -v dig nslookup getent
+node --version
 aws --version
-jq --version
 ```
 
 On Windows PowerShell:
 
 ```powershell
-Get-Command "C:\Program Files\Git\bin\bash.exe","C:\Program Files\Git\usr\bin\bash.exe",aws,jq,ssh,scp,curl,nslookup,Resolve-DnsName -ErrorAction SilentlyContinue
+Get-Command "C:\Program Files\Git\bin\bash.exe","C:\Program Files\Git\usr\bin\bash.exe",node,aws,ssh,scp,curl,nslookup,Resolve-DnsName -ErrorAction SilentlyContinue
 ```
 
 ## Windows
@@ -29,15 +29,14 @@ Common system installs:
 
 ```powershell
 winget install --id Git.Git --exact
+winget install --id OpenJS.NodeJS.LTS --exact
 winget install --id Amazon.AWSCLI --exact
-winget install --id jqlang.jq --exact
 ```
 
 Workspace-local fallback when package managers are unavailable:
 
 ```powershell
 New-Item -ItemType Directory -Force -Path .tools\bin | Out-Null
-Invoke-WebRequest -Uri https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-windows-amd64.exe -OutFile .tools\bin\jq.exe
 python -m venv .tools\awscli-venv
 .\.tools\awscli-venv\Scripts\python.exe -m pip install --upgrade pip awscli
 ```
@@ -61,7 +60,7 @@ Run ops from Git Bash:
 Preferred installs:
 
 ```bash
-brew install awscli jq
+brew install node awscli
 ```
 
 If Homebrew is unavailable, ask before using the official AWS CLI pkg installer.
@@ -72,11 +71,11 @@ macOS already includes `ssh`, `scp`, `curl`, and `dig`.
 Choose the detected package manager:
 
 ```bash
-sudo apt-get update && sudo apt-get install -y awscli jq openssh-client curl dnsutils
-sudo dnf install -y awscli jq openssh-clients curl bind-utils
-sudo yum install -y awscli jq openssh-clients curl bind-utils
-sudo pacman -Sy --needed aws-cli jq openssh curl bind-tools
-sudo zypper install -y aws-cli jq openssh-clients curl bind-utils
+sudo apt-get update && sudo apt-get install -y nodejs awscli openssh-client curl dnsutils
+sudo dnf install -y nodejs awscli openssh-clients curl bind-utils
+sudo yum install -y nodejs awscli openssh-clients curl bind-utils
+sudo pacman -Sy --needed nodejs aws-cli openssh curl bind-tools
+sudo zypper install -y nodejs aws-cli openssh-clients curl bind-utils
 ```
 
 If distro packages are too old or missing, ask before using the official AWS CLI zip installer.

package/references/user-journey.md

@@ -13,7 +13,7 @@ Confirm these items before calling `scripts/orchestrate.sh`:
 1. The final Matrix domain is selected, for example `__DOMAIN__`.
 2. The user understands that Matrix `server_name` is bound to that domain.
 3. The user has confirmed `CONFIRM_DOMAIN_BINDING=1`.
-4. AWS CLI v2, `jq`, `ssh`, `scp`, and `curl` are available.
+4. Node.js, AWS CLI v2, `ssh`, `scp`, and `curl` are available.
 5. AWS credentials are configured through `AWS_PROFILE` or environment variables.
 6. `AWS_DEFAULT_REGION` is explicit.
 7. `MESSAGE_SERVER_IMAGE` is selected, or the default `direxio/message-server:latest` is accepted.
@@ -23,7 +23,7 @@ On Windows, first verify that `bash` is a usable POSIX shell:
 
 ```powershell
 Get-Command bash.exe -All
-bash -lc 'echo ok; command -v aws; command -v jq; command -v ssh; command -v scp; command -v curl'
+bash -lc 'echo ok; command -v node; command -v aws; command -v ssh; command -v scp; command -v curl'
 ```
 
 ## Domain Modes

package/references/voip-turn-runbook.md

@@ -118,10 +118,10 @@ TURN 端口直连 coturn,Caddyfile **不加** TURN 反代。仅在文件头注
 新增一项(用 password/agent_token 换 access_token 后查 turnServer):
 ```bash
 # 换统一 access_token
-at=$(curl -sk -X POST "https://$domain/_p2p/command" -H 'Content-Type: application/json' -d "{\"action\":\"portal.auth\",\"params\":{\"password\":\"$password\"}}" | jq -r '.access_token')
+at=$(curl -sk -X POST "https://$domain/_p2p/command" -H 'Content-Type: application/json' -d "{\"action\":\"portal.auth\",\"params\":{\"password\":\"$password\"}}" | node scripts/json.mjs stdin-get access_token)
 # 查 turnServer 必须非空、有 turn: uris、有 username/password、ttl>0
 turn=$(curl -sk "https://$domain/_matrix/client/v3/voip/turnServer" -H "Authorization: Bearer $at")
-echo "$turn" | jq -e '.uris and (.uris|length>0) and (.uris[]|test("^turns?:")) and (.username!="") and (.password!="") and (.ttl>0)' >/dev/null \
+echo "$turn" | node scripts/json.mjs stdin-assert turn-credentials >/dev/null \
   && ok "  ✓ TURN turnServer 非空且有效" || { warn "  ✗ TURN turnServer 无效:$turn"; fails=$((fails+1)); }
 ```
 

package/references/windows-deployment-notes.md

@@ -30,7 +30,8 @@ When running `orchestrate.sh` as a background process, bash may buffer stdout be
 Poll progress with:
 
 ```bash
-cat ~/.direxio/nodes/<service_id>/state.json | jq '{phase, phases}'
+node scripts/json.mjs get ~/.direxio/nodes/<service_id>/state.json phase
+node scripts/json.mjs get ~/.direxio/nodes/<service_id>/state.json phases
 ```
 
 For real-time tailing, use `stdbuf` when available:

package/scripts/destroy.sh

@@ -27,20 +27,8 @@ destroy_now() {
 }
 
 destroy_evidence_set() {
-  local key=$1 status=$2 detail=${3:-} tmp
-  tmp="$SRC.tmp.destroy.$$"
-  if jq --arg key "$key" \
-        --arg status "$status" \
-        --arg detail "$detail" \
-        --arg checked_at "$(destroy_now)" \
-        '.destroy_evidence[$key] = {
-          status: $status,
-          detail: $detail,
-          checked_at: $checked_at
-        }' "$SRC" > "$tmp"; then
-    mv "$tmp" "$SRC"
-  else
-    rm -f "$tmp"
+  local key=$1 status=$2 detail=${3:-}
+  if ! json_mutate "$SRC" destroy-evidence "$key" "$status" "$detail" "$(destroy_now)"; then
     log "  (failed to record destroy evidence for $key)"
   fi
 }
@@ -48,13 +36,7 @@ destroy_evidence_set() {
 route53_a_record_present() {
   local zone_id=$1 domain=$2 public_ip=$3 rrsets present
   rrsets=$(aws route53 list-resource-record-sets --hosted-zone-id "$zone_id" --output json 2>/dev/null) || return 2
-  present=$(printf '%s\n' "$rrsets" | jq -r --arg name "$domain." --arg ip "$public_ip" '
-    any(.ResourceRecordSets[]?;
-      .Name == $name
-      and .Type == "A"
-      and any(.ResourceRecords[]?; .Value == $ip)
-    )
-  ' 2>/dev/null) || return 2
+  present=$(printf '%s\n' "$rrsets" | json_stdin_route53_a_present "$domain." "$public_ip" 2>/dev/null) || return 2
   [ "$present" = "true" ]
 }
 
@@ -187,26 +169,25 @@ fi
 [ -f "$SRC" ] || { echo "$SRC not found."; exit 1; }
 P2P_ROOT=$(cd "${DIREXIO_HOME:-$HOME/.direxio}" 2>/dev/null && pwd -P || printf '%s' "${DIREXIO_HOME:-$HOME/.direxio}")
 
-command -v jq >/dev/null 2>&1 || { echo "jq is required to parse state.json."; exit 1; }
-REGION=$(jq -r '.region // empty' "$SRC")
-INSTANCE_ID=$(jq -r '.resources.instance_id // empty' "$SRC")
-ROOT_VOLUME_ID=$(jq -r '.resources.root_volume_id // empty' "$SRC")
-EIP_ID=$(jq -r '.resources.eip_id // empty' "$SRC")
-SG_ID=$(jq -r '.resources.sg_id // empty' "$SRC")
-KEY_NAME=$(jq -r '.resources.key_name // empty' "$SRC")
-KEY_FILE=$(jq -r '.resources.key_file // empty' "$SRC")
-DOMAIN_MODE=$(jq -r '.domain_mode // empty' "$SRC")
-DOMAIN=$(jq -r '.domain // empty' "$SRC")
-AS_URL=$(jq -r '.as_url // empty' "$SRC")
-PUBLIC_IP=$(jq -r '.resources.public_ip // empty' "$SRC")
-ROUTE53_ZONE_ID=$(jq -r '.resources.route53_zone_id // empty' "$SRC")
-ROUTE53_ZONE_NAME=$(jq -r '.resources.route53_zone_name // empty' "$SRC")
-ROUTE53_ZONE_CREATED_BY_DEPLOYER=$(jq -r '.resources.route53_zone_created_by_deployer // empty' "$SRC")
-CC_CONNECT_CONFIG=$(jq -r '.cc_connect_config // empty' "$SRC")
-CC_CONNECT_BINARY=$(jq -r '.cc_connect_binary // empty' "$SRC")
-CC_CONNECT_RUNTIME_DIR=$(jq -r '.cc_connect_runtime_dir // empty' "$SRC")
-AGENT_SERVICE_DIR=$(jq -r '.agent_service_dir // empty' "$SRC")
-AGENT_SERVICE_ID=$(jq -r '.agent_service_id // empty' "$SRC")
+REGION=$(json_get "$SRC" region)
+INSTANCE_ID=$(json_get "$SRC" resources.instance_id)
+ROOT_VOLUME_ID=$(json_get "$SRC" resources.root_volume_id)
+EIP_ID=$(json_get "$SRC" resources.eip_id)
+SG_ID=$(json_get "$SRC" resources.sg_id)
+KEY_NAME=$(json_get "$SRC" resources.key_name)
+KEY_FILE=$(json_get "$SRC" resources.key_file)
+DOMAIN_MODE=$(json_get "$SRC" domain_mode)
+DOMAIN=$(json_get "$SRC" domain)
+AS_URL=$(json_get "$SRC" as_url)
+PUBLIC_IP=$(json_get "$SRC" resources.public_ip)
+ROUTE53_ZONE_ID=$(json_get "$SRC" resources.route53_zone_id)
+ROUTE53_ZONE_NAME=$(json_get "$SRC" resources.route53_zone_name)
+ROUTE53_ZONE_CREATED_BY_DEPLOYER=$(json_get "$SRC" resources.route53_zone_created_by_deployer)
+CC_CONNECT_CONFIG=$(json_get "$SRC" cc_connect_config)
+CC_CONNECT_BINARY=$(json_get "$SRC" cc_connect_binary)
+CC_CONNECT_RUNTIME_DIR=$(json_get "$SRC" cc_connect_runtime_dir)
+AGENT_SERVICE_DIR=$(json_get "$SRC" agent_service_dir)
+AGENT_SERVICE_ID=$(json_get "$SRC" agent_service_id)
 
 export NO_PROXY="*"; export no_proxy="*"
 unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy 2>/dev/null || true
@@ -240,7 +221,7 @@ find_route53_zone() {
         fi
         ;;
     esac
-  done < <(aws route53 list-hosted-zones --output json 2>/dev/null | jq -r '.HostedZones[] | [.Id, .Name] | @tsv')
+  done < <(aws route53 list-hosted-zones --output json 2>/dev/null | json_stdin_tsv HostedZones Id Name)
   [ -n "$best_id" ] && printf '%s\t%s\n' "$best_id" "$best_name"
 }
 
@@ -289,7 +270,7 @@ EOF
     || log "  (Route53 A record may already be absent or changed; check DNS manually)"
   rm -f "$change_file"
   if [ -n "${change_json:-}" ]; then
-    change_id=$(printf '%s\n' "$change_json" | jq -r '.ChangeInfo.Id // empty' 2>/dev/null)
+    change_id=$(printf '%s\n' "$change_json" | json_stdin_get ChangeInfo.Id 2>/dev/null)
     [ -n "$change_id" ] && aws route53 wait resource-record-sets-changed --id "$change_id" 2>/dev/null || true
   fi
   verify_route53_a_record_deleted "$zone_id" "$domain" "$public_ip"