rigjs 4.0.17 → 4.0.19

package/lib/classes/cicd/CICD.ts

@@ -38,6 +38,23 @@ export interface DeployTarget {
 		original_regexp?: string;
 		final?: string;
 	} | undefined;
+	/**
+	 * Edge provider for `rig publish` (回源改写 + 刷缓存).
+	 * - 'cdn' (default): traditional Aliyun CDN, BatchSetCdnDomainConfig.
+	 * - 'esa': Aliyun ESA (Edge Security Acceleration), site-scoped rewrite rules.
+	 */
+	edge_provider?: 'cdn' | 'esa';
+	/**
+	 * ESA OpenAPI endpoint. Only used when edge_provider === 'esa'.
+	 * Defaults to 'esa.cn-hangzhou.aliyuncs.com'.
+	 */
+	esa_endpoint?: string;
+	/**
+	 * ESA site name (registrable zone, e.g. 'terncloud.com'). Only used when
+	 * edge_provider === 'esa'. If omitted, derived from the endpoint domain's
+	 * last two labels.
+	 */
+	esa_site_name?: string;
 }
 
 /**

package/lib/classes/cicd/Deploy/CDN.ts

@@ -4,6 +4,7 @@ import crypto from 'crypto';
 import axios from 'axios';
 import * as uuid from 'uuid';
 import { DeployTarget } from '../CICD';
+import { redactCdnUrl } from '@/utils/redact';
 
 type TFlag = 'break' | 'enhance_break' | null;
 
@@ -64,7 +65,7 @@ class CDN {
     });
 
     const url = `http://cdn.ap-southeast-1.aliyuncs.com?${paramConfig}`;
-    console.log('cdn update url:', url);
+    console.log('cdn update url:', redactCdnUrl(url));
     const res = await axios.create().get(url);
     return res.data;
   }

package/lib/classes/cicd/Deploy/ESA.ts

@@ -0,0 +1,117 @@
+import ESAClient, {
+  ListSitesRequest,
+  CreateRewriteUrlRuleRequest,
+  PurgeCachesRequest,
+  PurgeCachesRequestContent,
+} from '@alicloud/esa20240910';
+import { $OpenApiUtil } from '@alicloud/openapi-core';
+import { DeployTarget } from '../CICD';
+
+/**
+ * ESA (Aliyun Edge Security Acceleration) deploy adapter — the ESA-flavoured
+ * counterpart of {@link ./CDN.ts}. Used by `rig publish` when the deploy target
+ * sets `edge_provider: 'esa'`.
+ *
+ * Differences from traditional CDN:
+ * - ESA config is **site-scoped**: every operation needs a numeric `siteId`,
+ *   resolved from the registrable zone (e.g. `terncloud.com`) via `ListSites`.
+ * - Back-to-origin rewrite uses `CreateRewriteUrlRule` (rule expression +
+ *   static/dynamic target URI), not CDN's regex `back_to_origin_url_rewrite`.
+ * - Cache refresh uses `PurgeCaches`, not `RefreshObjectCaches`.
+ *
+ * Credentials come from the DeployTarget (injected via `-p ak=...&as=...`),
+ * never hard-coded here.
+ */
+class ESA {
+  private client: ESAClient;
+  private siteIdCache: Map<string, number> = new Map();
+  private explicitSiteName?: string;
+
+  constructor(target: DeployTarget) {
+    const config = new $OpenApiUtil.Config({
+      accessKeyId: target.access_key,
+      accessKeySecret: target.access_secret,
+      endpoint: target.esa_endpoint || 'esa.cn-hangzhou.aliyuncs.com',
+    });
+    this.client = new ESAClient(config);
+    this.explicitSiteName = target.esa_site_name;
+  }
+
+  /**
+   * Registrable zone for a domain: `test-esa.terncloud.com` -> `terncloud.com`.
+   * (Good enough for normal `*.com` / `*.cn` zones; pass `esa_site_name`
+   * explicitly for multi-label public suffixes like `*.com.cn`.)
+   */
+  private siteNameFor(domain: string): string {
+    if (this.explicitSiteName) return this.explicitSiteName;
+    const parts = domain.split('.').filter(Boolean);
+    return parts.length <= 2 ? domain : parts.slice(-2).join('.');
+  }
+
+  /** Resolve (and cache) the numeric ESA siteId for a domain's zone. */
+  public async resolveSiteId(domain: string): Promise<number> {
+    const siteName = this.siteNameFor(domain);
+    const cached = this.siteIdCache.get(siteName);
+    if (cached) return cached;
+
+    const resp = await this.client.listSites(
+      new ListSitesRequest({ siteName, siteSearchType: 'exact' })
+    );
+    const sites = resp.body?.sites || [];
+    const site = sites.find((s) => s.siteName === siteName) || sites[0];
+    if (!site || site.siteId == null) {
+      throw new Error(
+        `ESA site not found for "${siteName}" (domain ${domain}). ` +
+          `Create the ESA site (zone) and bind the OSS origin in the ESA console/API first.`
+      );
+    }
+    this.siteIdCache.set(siteName, site.siteId);
+    return site.siteId;
+  }
+
+  /**
+   * Create a single back-to-origin URI rewrite rule.
+   * @param rule ESA rule expression. `true` matches all requests; otherwise a
+   *   conditional expression, e.g. `(http.request.uri.path.file_name ne "")`.
+   * @param rewriteUriType `static` (fixed `uri`) or `dynamic` (`uri` is an expression).
+   * @param uri target URI after rewrite (static path or dynamic expression).
+   * @param sequence rule priority (lower runs first).
+   */
+  public async setRewriteRule(
+    domain: string,
+    ruleName: string,
+    rule: string,
+    rewriteUriType: 'static' | 'dynamic',
+    uri: string,
+    sequence: number
+  ) {
+    const siteId = await this.resolveSiteId(domain);
+    const resp = await this.client.createRewriteUrlRule(
+      new CreateRewriteUrlRuleRequest({
+        siteId,
+        ruleName,
+        rule,
+        ruleEnable: 'on',
+        rewriteUriType,
+        uri,
+        sequence,
+      })
+    );
+    return resp.body;
+  }
+
+  /** Purge cached files by URL. */
+  public async purgeCache(domain: string, urls: string[]) {
+    const siteId = await this.resolveSiteId(domain);
+    const resp = await this.client.purgeCaches(
+      new PurgeCachesRequest({
+        siteId,
+        type: 'file',
+        content: new PurgeCachesRequestContent({ files: urls }),
+      })
+    );
+    return resp.body;
+  }
+}
+
+export default ESA;

package/lib/deploy/index.ts

@@ -3,6 +3,7 @@ import path from 'path';
 import CICD from '@/classes/cicd/CICD';
 import CICDCmd from '@/classes/cicd/CICDCmd';
 import AliOSS from '@/classes/cicd/Deploy/AliDeploy';
+import { redactTarget } from '@/utils/redact';
 
 let filesList: string[] = [];
 const traverseFolder = (url: string) => {
@@ -33,7 +34,7 @@ export default async (cmd: any) => {
     const target = Array.isArray(cicdCmd.cicd.target)
       ? cicdCmd.cicd.target[0]
       : cicdCmd.cicd.target;
-    console.log('oss tagert', target);
+    console.log('oss tagert', redactTarget(target));
     const aliOss = new AliOSS(target);
     console.log('Please Wait for Upload OSS...');
     if (!cicdCmd.endpoints || cicdCmd.endpoints.length === 0) {

package/lib/init/index.ts

@@ -6,7 +6,19 @@
  */
 import print from '../print';
 import fs from 'fs';
-import axios from 'axios';
+
+const PACKAGE_RIG_TEMPLATE = `{
+  // package.rig.json5 — rig configuration
+  // Field reference: see the rig-package / rig-cicd skills.
+  dependencies: {
+    // 'lib-name': {
+    //   source: 'git@github.com:org/repo.git', // git ssh url
+    //   version: '1.0.0',                      // git tag (semver)
+    //   dev: false                             // true => clone into rig_dev/ and develop locally
+    // }
+  }
+}
+`;
 
 export default async () => {
   try {
@@ -19,11 +31,9 @@ export default async () => {
     if (fs.existsSync('package.rig.json5')) {
       print.info('package.rig.json5 already exists~');
     } else {
-      //创建package.rig.json5
+      //创建package.rig.json5 — 本地模板,留空 dependencies,无示例库引用
       print.info('create package.rig.json5');
-      const resPackageRigJSON5 = await axios.get('https://gist.githubusercontent.com/FlashHand/ea156ac4930b05832ad7c568f7f00cdd/raw/48a4321ccf1b0339a15f6454336f289b8b5bad58/package.rig.json5');
-      const packageRigJSON5 = resPackageRigJSON5.data;
-      fs.writeFileSync('./package.rig.json5', packageRigJSON5);
+      fs.writeFileSync('./package.rig.json5', PACKAGE_RIG_TEMPLATE);
     }
     //检查是否存在rig_helper.js
     // if (fs.existsSync(`${process.cwd()}/rig_helper.js`)) {
@@ -95,8 +105,7 @@ export default async () => {
         postinstall: "rig postinstall",
       },
       devDependencies: {
-        json5: '2.2.1',
-        "rig-helper": '^1.0.2'
+        json5: '2.2.1'
       }
     }
     pkgJSON.private = inserted.private;
@@ -125,11 +134,9 @@ export default async () => {
     }
     if (pkgJSON.devDependencies) {
       pkgJSON.devDependencies.json5 = inserted.devDependencies.json5;
-      pkgJSON.devDependencies["rig-helper"] = inserted.devDependencies["rig-helper"];
     } else {
       pkgJSON.devDependencies = inserted.devDependencies;
     }
-    //检查是否存在rig-helper
     fs.writeFileSync('package.json', JSON.stringify(pkgJSON, null, 2));
     print.succeed('rig init succeed');
   } catch (e) {

package/lib/publish/index.ts

@@ -1,6 +1,7 @@
-import CICD from '@/classes/cicd/CICD';
+import CICD, { DeployTarget } from '@/classes/cicd/CICD';
 import CICDCmd from '@/classes/cicd/CICDCmd';
 import CDN from '@/classes/cicd/Deploy/CDN';
+import ESA from '@/classes/cicd/Deploy/ESA';
 
 const delay = async (ms: number) => {
   await new Promise((resolve) => {
@@ -69,6 +70,76 @@ const refreshCache = async (urls: string[], cdn: CDN) => {
   console.log('RefreshCache Done');
 };
 
+/**
+ * ESA publish path (edge_provider === 'esa'). Sets back-to-origin URI rewrite
+ * rules per domain, then purges the entry URLs.
+ *
+ * Mapping vs CDN: hash mode only needs the entry page rewritten to
+ * `/<deployDir>/index.html` (publicPath already carries deployDir so static
+ * files resolve at the OSS origin directly). history/mpa additionally prepend
+ * deployDir for static files and fall back to the entry for extension-less
+ * routes — those dynamic-rewrite expressions need validation on a live ESA site.
+ */
+const publishViaEsa = async (
+  cicd: CICD,
+  cicdCmd: CICDCmd,
+  target: DeployTarget
+) => {
+  const esa = new ESA(target);
+  if (!cicdCmd.endpoints || cicdCmd.endpoints.length === 0) {
+    throw new Error('Endpoints.length Can Not Be 0!');
+  }
+  const purgeByDomain: { [domain: string]: string[] } = {};
+  for (const endpoint of cicdCmd.endpoints) {
+    const deployDir = endpoint.deployDir.replace(/\\/g, '/');
+    const webEntryPath = endpoint.web_entry_path || target.web_entry_path || '/';
+    const ruleBase = `rig-${deployDir.replace(/[^\w]+/g, '-')}`.replace(
+      /-+/g,
+      '-'
+    );
+    for (const domain of endpoint.domains) {
+      if (cicd.web_type === 'hash') {
+        await esa.setRewriteRule(
+          domain,
+          `${ruleBase}-entry`,
+          `(http.request.uri.path eq "${webEntryPath}")`,
+          'static',
+          `/${deployDir}/index.html`,
+          1
+        );
+      } else {
+        await esa.setRewriteRule(
+          domain,
+          `${ruleBase}-file`,
+          `(http.request.uri.path.extension ne "")`,
+          'dynamic',
+          `concat("/${deployDir}", http.request.uri.path)`,
+          1
+        );
+        await esa.setRewriteRule(
+          domain,
+          `${ruleBase}-entry`,
+          'true',
+          cicd.web_type === 'mpa' ? 'dynamic' : 'static',
+          cicd.web_type === 'mpa'
+            ? `concat("/${deployDir}", http.request.uri.path, ".html")`
+            : `/${deployDir}/index.html`,
+          2
+        );
+      }
+      if (!purgeByDomain[domain]) {
+        purgeByDomain[domain] = [];
+      }
+      purgeByDomain[domain].push(`https://${domain}${webEntryPath}`);
+    }
+  }
+  for (const domain of Object.keys(purgeByDomain)) {
+    console.log(`ESA purge ${domain}:`, purgeByDomain[domain]);
+    await esa.purgeCache(domain, purgeByDomain[domain]);
+  }
+  console.log('ESA rewrite rules + purge done');
+};
+
 export default async (cmd: any) => {
   try {
     const rewriteConfigs: {
@@ -99,6 +170,12 @@ export default async (cmd: any) => {
       ? cicdCmd.cicd.target[0]
       : cicdCmd.cicd.target;
 
+    if (target.edge_provider === 'esa') {
+      await publishViaEsa(cicd, cicdCmd, target);
+      console.log('Publish Done-----');
+      return;
+    }
+
     const cdn = new CDN(target);
     const urls: string[] = [];
     if (!cicdCmd.endpoints || cicdCmd.endpoints.length === 0) {

package/lib/utils/redact.ts

@@ -0,0 +1,48 @@
+// Helpers to keep cloud credentials out of stdout.
+//
+// rig's deploy/publish flow prints (a) the resolved deploy target and
+// (b) every Aliyun CDN API URL. Both carry the AccessKeyId / AccessKeySecret
+// in clear, which makes the console output unsafe to copy/paste into issues,
+// CI logs, or chat.
+//
+// Use `maskSecret` for short identifiers (keeps a head+tail hint so two
+// different keys are still distinguishable in logs), `redactTarget` before
+// console-logging a DeployTarget, and `redactCdnUrl` before logging any
+// signed Aliyun OpenAPI URL.
+
+/** Mask a credential while keeping a short prefix + suffix for debuggability. */
+export function maskSecret(s: string | undefined | null): string {
+	if (!s) return '';
+	if (s.length <= 8) return '****';
+	return `${s.slice(0, 4)}…${s.slice(-4)}`;
+}
+
+/**
+ * Return a shallow copy of a DeployTarget-shaped object with `access_key`
+ * and `access_secret` masked. Unknown keys pass through unchanged.
+ */
+export function redactTarget<T extends Record<string, any>>(target: T): T {
+	if (!target || typeof target !== 'object') return target;
+	const out: Record<string, any> = { ...target };
+	if (typeof out.access_key === 'string') out.access_key = maskSecret(out.access_key);
+	if (typeof out.access_secret === 'string') out.access_secret = maskSecret(out.access_secret);
+	return out as T;
+}
+
+/**
+ * Redact `AccessKeyId` and `Signature` query parameters from an Aliyun
+ * OpenAPI URL so the URL can be safely logged. Leaves all other params
+ * (Action, Timestamp, etc.) intact for debugging.
+ */
+export function redactCdnUrl(url: string): string {
+	if (!url) return url;
+	return url
+		.replace(/([?&]AccessKeyId=)([^&]+)/i, (_m, p1, v) => `${p1}${maskSecret(v)}`)
+		.replace(/([?&]Signature=)([^&]+)/i, (_m, p1) => `${p1}REDACTED`);
+}
+
+export default {
+	maskSecret,
+	redactTarget,
+	redactCdnUrl,
+};

package/lib/wiki/lint.ts

@@ -42,6 +42,7 @@ interface Findings {
 const REQUIRED_KEYS = ['type', 'sources', 'ingested-at', 'last-updated'] as const;
 const SOURCE_EXTRA_KEYS = ['source-sha', 'source-path'] as const;
 const WIKI_SUBDIRS = ['sources', 'entities', 'concepts', 'synthesis', 'queries'] as const;
+const TOP_LEVEL_WIKILINK_TARGETS = ['index', 'overview', 'log', 'reviews', 'purpose', 'schema'] as const;
 
 export default async function wikiLint(opts: LintOpts): Promise<void> {
   const target = requireVault();
@@ -89,6 +90,10 @@ function lintOne(wiki: WikiEntry): Findings {
   }
 
   const slugToRel = new Map<string, string>();
+  for (const slug of TOP_LEVEL_WIKILINK_TARGETS) {
+    const rel = `${slug}.md`;
+    if (fs.existsSync(path.join(wiki.path, rel))) slugToRel.set(slug, rel);
+  }
   for (const p of pages) slugToRel.set(p.slug, p.rel);
 
   const linkedSlugs = new Set<string>();
@@ -103,7 +108,7 @@ function lintOne(wiki: WikiEntry): Findings {
       }
       const sourcePath = String(p.frontmatter['source-path'] || '');
       if (sourcePath) {
-        const abs = path.isAbsolute(sourcePath) ? sourcePath : path.resolve(wiki.path, sourcePath);
+        const abs = resolveSourcePath(wiki, sourcePath);
         if (!fs.existsSync(abs)) {
           f.missingRawSource.push({ rel: p.rel, sourcePath });
         } else {
@@ -188,6 +193,23 @@ function extractWikilinks(body: string): string[] {
   return out;
 }
 
+function resolveSourcePath(wiki: WikiEntry, sourcePath: string): string {
+  const obsidian = parseObsidianFilePath(sourcePath);
+  if (obsidian) return path.resolve(path.dirname(wiki.path), obsidian);
+  return path.isAbsolute(sourcePath) ? sourcePath : path.resolve(wiki.path, sourcePath);
+}
+
+function parseObsidianFilePath(sourcePath: string): string | null {
+  if (!sourcePath.startsWith('obsidian://open?')) return null;
+  try {
+    const url = new URL(sourcePath);
+    const file = url.searchParams.get('file');
+    return file && file.trim() ? file : null;
+  } catch {
+    return null;
+  }
+}
+
 function sha256(file: string): string {
   return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rigjs",
-  "version": "4.0.17",
-  "versionCode": 26052424,
+  "version": "4.0.19",
+  "versionCode": 26052701,
   "description": "A multi-repos dev tool based on yarn and git.Rigjs is intended to be the simplest way to develop,share and deliver codes between different developers or different projects.",
   "keywords": [
     "modular",
@@ -36,9 +36,13 @@
     "doc",
     "scripts",
     ".claude/skills/rig-wiki",
+    ".claude/skills/rig-package",
+    ".claude/skills/rig-cicd",
     ".claude-plugin",
     "RIG_WIKI_SKILL.md",
     "RIG_CREW_SKILL.md",
+    "RIG_PACKAGE_SKILL.md",
+    "RIG_CICD_SKILL.md",
     "skills.md",
     "index.js",
     "README.md",
@@ -56,13 +60,17 @@
     "t": "node lib/rig/index.js tag",
     "deliver": "node scripts/publish.mjs",
     "deliver:alpha": "rig tag && yarn build && node scripts/publish.mjs --tag alpha",
-    "build": "esbuild lib/rig/index.ts --platform=node --bundle --sourcemap=inline --minify --outfile=built/index.js --external:shelljs --external:better-sqlite3 --external:bindings --external:proxy-agent --external:@tobilu/qmd",
+    "build": "esbuild lib/rig/index.ts --platform=node --bundle --sourcemap=inline --minify --outfile=built/index.js --external:shelljs --external:better-sqlite3 --external:bindings --external:proxy-agent --external:@tobilu/qmd && yarn scan:built",
+    "scan:built": "GOMAXPROCS=2 gitleaks detect --source built --no-git --no-banner --redact --exit-code 1",
     "version:code": "node scripts/version-code.mjs",
     "version:code:peek": "node scripts/version-code.mjs --peek",
     "prepublishOnly": "node scripts/version-code.mjs && node scripts/sync-skill.mjs && yarn build",
     "postinstall": "node scripts/postinstall.mjs"
   },
   "dependencies": {
+    "@alicloud/esa20240910": "^3.1.2",
+    "@alicloud/openapi-client": "^0.4.15",
+    "@alicloud/tea-util": "^1.4.11",
     "@tobilu/qmd": "~2.5.2",
     "@types/ali-oss": "^6.16.3",
     "@types/json5": "^2.2.0",

package/scripts/sync-skill.mjs

@@ -14,6 +14,8 @@ const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'
 
 const skills = [
   ['RIG_WIKI_SKILL.md', '.claude/skills/rig-wiki/SKILL.md'],
+  ['RIG_PACKAGE_SKILL.md', '.claude/skills/rig-package/SKILL.md'],
+  ['RIG_CICD_SKILL.md', '.claude/skills/rig-cicd/SKILL.md'],
 ];
 
 for (const [srcRel, destRel] of skills) {

package/skills.md

@@ -8,6 +8,8 @@ This page is the skill index for the `rigjs` package. The root `README.md` keeps
 |---|---|---|---|---|
 | `rig-wiki` | [`RIG_WIKI_SKILL.md`](./RIG_WIKI_SKILL.md) | [`.claude/skills/rig-wiki/SKILL.md`](./.claude/skills/rig-wiki/SKILL.md) | `rig wiki *` | Karpathy-style LLM wiki operations: scan, fetch, ingest, query, lint, rebuild. |
 | `rig-crew` | [`RIG_CREW_SKILL.md`](./RIG_CREW_SKILL.md) | (none — vault-level guidance) | `rig crew *` | File-backed, Leader-first multi-agent coordination over an Obsidian vault. |
+| `rig-package` | [`RIG_PACKAGE_SKILL.md`](./RIG_PACKAGE_SKILL.md) | [`.claude/skills/rig-package/SKILL.md`](./.claude/skills/rig-package/SKILL.md) | `rig init` / `install` / `add` / `dev` / `tag` | Git-tag + ssh package manager that replaces a private npm registry; documents every `package.rig.json5#dependencies` field. |
+| `rig-cicd` | [`RIG_CICD_SKILL.md`](./RIG_CICD_SKILL.md) | [`.claude/skills/rig-cicd/SKILL.md`](./.claude/skills/rig-cicd/SKILL.md) | `rig build` / `deploy` / `publish` | Aliyun OSS + CDN static-site CI/CD; one bucket → many sites via CDN URI rewrites set during `rig publish`. Supports hash, history, mpa, pre-built HTML dirs. |
 
 `rig-crew` is intentionally not copied into the rigjs package's own `.claude/skills/`. Its instructions belong at the Vault level (the project that uses crew), not at the tool level (rigjs itself).
 
@@ -89,6 +91,8 @@ Canonical skill files live at the package root:
 
 - [`RIG_WIKI_SKILL.md`](./RIG_WIKI_SKILL.md)
 - [`RIG_CREW_SKILL.md`](./RIG_CREW_SKILL.md)
+- [`RIG_PACKAGE_SKILL.md`](./RIG_PACKAGE_SKILL.md)
+- [`RIG_CICD_SKILL.md`](./RIG_CICD_SKILL.md)
 
 A package-internal mirror lives under `.claude/skills/` so the rig package itself (when checked out by another agent) can read its own skills:
 
@@ -96,7 +100,7 @@ A package-internal mirror lives under `.claude/skills/` so the rig package itsel
 node scripts/sync-skill.mjs
 ```
 
-`prepublishOnly` runs the sync script before packaging. Today this plugin-copy set only includes `rig-wiki`; `rig-crew` remains Vault-level guidance and has no in-package `.claude/skills/` copy.
+`prepublishOnly` runs the sync script before packaging. The plugin-copy set covers `rig-wiki`, `rig-package`, and `rig-cicd`; `rig-crew` remains Vault-level guidance and has no in-package `.claude/skills/` copy.
 
 ## Documentation Policy