rigjs 4.0.18 → 4.1.0

package/lib/publish/index.ts

@@ -1,6 +1,7 @@
-import CICD from '@/classes/cicd/CICD';
+import CICD, { DeployTarget } from '@/classes/cicd/CICD';
 import CICDCmd from '@/classes/cicd/CICDCmd';
 import CDN from '@/classes/cicd/Deploy/CDN';
+import ESA from '@/classes/cicd/Deploy/ESA';
 
 const delay = async (ms: number) => {
   await new Promise((resolve) => {
@@ -69,6 +70,76 @@ const refreshCache = async (urls: string[], cdn: CDN) => {
   console.log('RefreshCache Done');
 };
 
+/**
+ * ESA publish path (edge_provider === 'esa'). Sets back-to-origin URI rewrite
+ * rules per domain, then purges the entry URLs.
+ *
+ * Mapping vs CDN: hash mode only needs the entry page rewritten to
+ * `/<deployDir>/index.html` (publicPath already carries deployDir so static
+ * files resolve at the OSS origin directly). history/mpa additionally prepend
+ * deployDir for static files and fall back to the entry for extension-less
+ * routes — those dynamic-rewrite expressions need validation on a live ESA site.
+ */
+const publishViaEsa = async (
+  cicd: CICD,
+  cicdCmd: CICDCmd,
+  target: DeployTarget
+) => {
+  const esa = new ESA(target);
+  if (!cicdCmd.endpoints || cicdCmd.endpoints.length === 0) {
+    throw new Error('Endpoints.length Can Not Be 0!');
+  }
+  const purgeByDomain: { [domain: string]: string[] } = {};
+  for (const endpoint of cicdCmd.endpoints) {
+    const deployDir = endpoint.deployDir.replace(/\\/g, '/');
+    const webEntryPath = endpoint.web_entry_path || target.web_entry_path || '/';
+    const ruleBase = `rig-${deployDir.replace(/[^\w]+/g, '-')}`.replace(
+      /-+/g,
+      '-'
+    );
+    for (const domain of endpoint.domains) {
+      if (cicd.web_type === 'hash') {
+        await esa.setRewriteRule(
+          domain,
+          `${ruleBase}-entry`,
+          `(http.request.uri.path eq "${webEntryPath}")`,
+          'static',
+          `/${deployDir}/index.html`,
+          1
+        );
+      } else {
+        await esa.setRewriteRule(
+          domain,
+          `${ruleBase}-file`,
+          `(http.request.uri.path.extension ne "")`,
+          'dynamic',
+          `concat("/${deployDir}", http.request.uri.path)`,
+          1
+        );
+        await esa.setRewriteRule(
+          domain,
+          `${ruleBase}-entry`,
+          'true',
+          cicd.web_type === 'mpa' ? 'dynamic' : 'static',
+          cicd.web_type === 'mpa'
+            ? `concat("/${deployDir}", http.request.uri.path, ".html")`
+            : `/${deployDir}/index.html`,
+          2
+        );
+      }
+      if (!purgeByDomain[domain]) {
+        purgeByDomain[domain] = [];
+      }
+      purgeByDomain[domain].push(`https://${domain}${webEntryPath}`);
+    }
+  }
+  for (const domain of Object.keys(purgeByDomain)) {
+    console.log(`ESA purge ${domain}:`, purgeByDomain[domain]);
+    await esa.purgeCache(domain, purgeByDomain[domain]);
+  }
+  console.log('ESA rewrite rules + purge done');
+};
+
 export default async (cmd: any) => {
   try {
     const rewriteConfigs: {
@@ -99,6 +170,12 @@ export default async (cmd: any) => {
       ? cicdCmd.cicd.target[0]
       : cicdCmd.cicd.target;
 
+    if (target.edge_provider === 'esa') {
+      await publishViaEsa(cicd, cicdCmd, target);
+      console.log('Publish Done-----');
+      return;
+    }
+
     const cdn = new CDN(target);
     const urls: string[] = [];
     if (!cicdCmd.endpoints || cicdCmd.endpoints.length === 0) {

package/lib/wiki/lint.ts

@@ -42,6 +42,7 @@ interface Findings {
 const REQUIRED_KEYS = ['type', 'sources', 'ingested-at', 'last-updated'] as const;
 const SOURCE_EXTRA_KEYS = ['source-sha', 'source-path'] as const;
 const WIKI_SUBDIRS = ['sources', 'entities', 'concepts', 'synthesis', 'queries'] as const;
+const TOP_LEVEL_WIKILINK_TARGETS = ['index', 'overview', 'log', 'reviews', 'purpose', 'schema'] as const;
 
 export default async function wikiLint(opts: LintOpts): Promise<void> {
   const target = requireVault();
@@ -89,6 +90,10 @@ function lintOne(wiki: WikiEntry): Findings {
   }
 
   const slugToRel = new Map<string, string>();
+  for (const slug of TOP_LEVEL_WIKILINK_TARGETS) {
+    const rel = `${slug}.md`;
+    if (fs.existsSync(path.join(wiki.path, rel))) slugToRel.set(slug, rel);
+  }
   for (const p of pages) slugToRel.set(p.slug, p.rel);
 
   const linkedSlugs = new Set<string>();
@@ -103,7 +108,7 @@ function lintOne(wiki: WikiEntry): Findings {
       }
       const sourcePath = String(p.frontmatter['source-path'] || '');
       if (sourcePath) {
-        const abs = path.isAbsolute(sourcePath) ? sourcePath : path.resolve(wiki.path, sourcePath);
+        const abs = resolveSourcePath(wiki, sourcePath);
         if (!fs.existsSync(abs)) {
           f.missingRawSource.push({ rel: p.rel, sourcePath });
         } else {
@@ -188,6 +193,23 @@ function extractWikilinks(body: string): string[] {
   return out;
 }
 
+function resolveSourcePath(wiki: WikiEntry, sourcePath: string): string {
+  const obsidian = parseObsidianFilePath(sourcePath);
+  if (obsidian) return path.resolve(path.dirname(wiki.path), obsidian);
+  return path.isAbsolute(sourcePath) ? sourcePath : path.resolve(wiki.path, sourcePath);
+}
+
+function parseObsidianFilePath(sourcePath: string): string | null {
+  if (!sourcePath.startsWith('obsidian://open?')) return null;
+  try {
+    const url = new URL(sourcePath);
+    const file = url.searchParams.get('file');
+    return file && file.trim() ? file : null;
+  } catch {
+    return null;
+  }
+}
+
 function sha256(file: string): string {
   return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rigjs",
-  "version": "4.0.18",
-  "versionCode": 26052501,
+  "version": "4.1.0",
+  "versionCode": 26053101,
   "description": "A multi-repos dev tool based on yarn and git.Rigjs is intended to be the simplest way to develop,share and deliver codes between different developers or different projects.",
   "keywords": [
     "modular",
@@ -36,9 +36,13 @@
     "doc",
     "scripts",
     ".claude/skills/rig-wiki",
+    ".claude/skills/rig-package",
+    ".claude/skills/rig-cicd",
     ".claude-plugin",
     "RIG_WIKI_SKILL.md",
     "RIG_CREW_SKILL.md",
+    "RIG_PACKAGE_SKILL.md",
+    "RIG_CICD_SKILL.md",
     "skills.md",
     "index.js",
     "README.md",
@@ -56,13 +60,17 @@
     "t": "node lib/rig/index.js tag",
     "deliver": "node scripts/publish.mjs",
     "deliver:alpha": "rig tag && yarn build && node scripts/publish.mjs --tag alpha",
-    "build": "esbuild lib/rig/index.ts --platform=node --bundle --sourcemap=inline --minify --outfile=built/index.js --external:shelljs --external:better-sqlite3 --external:bindings --external:proxy-agent --external:@tobilu/qmd",
+    "build": "esbuild lib/rig/index.ts --platform=node --bundle --sourcemap=inline --minify --outfile=built/index.js --external:shelljs --external:better-sqlite3 --external:bindings --external:proxy-agent --external:@tobilu/qmd && yarn scan:built",
+    "scan:built": "GOMAXPROCS=2 gitleaks detect --source built --no-git --no-banner --redact --exit-code 1",
     "version:code": "node scripts/version-code.mjs",
     "version:code:peek": "node scripts/version-code.mjs --peek",
     "prepublishOnly": "node scripts/version-code.mjs && node scripts/sync-skill.mjs && yarn build",
     "postinstall": "node scripts/postinstall.mjs"
   },
   "dependencies": {
+    "@alicloud/esa20240910": "^3.1.2",
+    "@alicloud/openapi-client": "^0.4.15",
+    "@alicloud/tea-util": "^1.4.11",
     "@tobilu/qmd": "~2.5.2",
     "@types/ali-oss": "^6.16.3",
     "@types/json5": "^2.2.0",

package/scripts/sync-skill.mjs

@@ -14,6 +14,8 @@ const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'
 
 const skills = [
   ['RIG_WIKI_SKILL.md', '.claude/skills/rig-wiki/SKILL.md'],
+  ['RIG_PACKAGE_SKILL.md', '.claude/skills/rig-package/SKILL.md'],
+  ['RIG_CICD_SKILL.md', '.claude/skills/rig-cicd/SKILL.md'],
 ];
 
 for (const [srcRel, destRel] of skills) {

package/skills.md

@@ -8,6 +8,8 @@ This page is the skill index for the `rigjs` package. The root `README.md` keeps
 |---|---|---|---|---|
 | `rig-wiki` | [`RIG_WIKI_SKILL.md`](./RIG_WIKI_SKILL.md) | [`.claude/skills/rig-wiki/SKILL.md`](./.claude/skills/rig-wiki/SKILL.md) | `rig wiki *` | Karpathy-style LLM wiki operations: scan, fetch, ingest, query, lint, rebuild. |
 | `rig-crew` | [`RIG_CREW_SKILL.md`](./RIG_CREW_SKILL.md) | (none — vault-level guidance) | `rig crew *` | File-backed, Leader-first multi-agent coordination over an Obsidian vault. |
+| `rig-package` | [`RIG_PACKAGE_SKILL.md`](./RIG_PACKAGE_SKILL.md) | [`.claude/skills/rig-package/SKILL.md`](./.claude/skills/rig-package/SKILL.md) | `rig init` / `install` / `add` / `dev` / `tag` | Git-tag + ssh package manager that replaces a private npm registry; documents every `package.rig.json5#dependencies` field. |
+| `rig-cicd` | [`RIG_CICD_SKILL.md`](./RIG_CICD_SKILL.md) | [`.claude/skills/rig-cicd/SKILL.md`](./.claude/skills/rig-cicd/SKILL.md) | `rig build` / `deploy` / `publish` | Aliyun OSS + CDN static-site CI/CD; one bucket → many sites via CDN URI rewrites set during `rig publish`. Supports hash, history, mpa, pre-built HTML dirs. |
 
 `rig-crew` is intentionally not copied into the rigjs package's own `.claude/skills/`. Its instructions belong at the Vault level (the project that uses crew), not at the tool level (rigjs itself).
 
@@ -89,6 +91,8 @@ Canonical skill files live at the package root:
 
 - [`RIG_WIKI_SKILL.md`](./RIG_WIKI_SKILL.md)
 - [`RIG_CREW_SKILL.md`](./RIG_CREW_SKILL.md)
+- [`RIG_PACKAGE_SKILL.md`](./RIG_PACKAGE_SKILL.md)
+- [`RIG_CICD_SKILL.md`](./RIG_CICD_SKILL.md)
 
 A package-internal mirror lives under `.claude/skills/` so the rig package itself (when checked out by another agent) can read its own skills:
 
@@ -96,7 +100,7 @@ A package-internal mirror lives under `.claude/skills/` so the rig package itsel
 node scripts/sync-skill.mjs
 ```
 
-`prepublishOnly` runs the sync script before packaging. Today this plugin-copy set only includes `rig-wiki`; `rig-crew` remains Vault-level guidance and has no in-package `.claude/skills/` copy.
+`prepublishOnly` runs the sync script before packaging. The plugin-copy set covers `rig-wiki`, `rig-package`, and `rig-cicd`; `rig-crew` remains Vault-level guidance and has no in-package `.claude/skills/` copy.
 
 ## Documentation Policy
 

package/lib/utils/redact.test.ts

@@ -1,43 +0,0 @@
-import { maskSecret, redactTarget, redactCdnUrl } from '@/utils/redact';
-
-test('maskSecret keeps a head+tail hint for long secrets', () => {
-	const ak = 'LTAI5t9GjXQc7itTohf68ZLq';
-	const masked = maskSecret(ak);
-	expect(masked).not.toContain('GjXQc7it'); // no middle bytes
-	expect(masked.startsWith('LTAI')).toBe(true);
-	expect(masked.endsWith('8ZLq')).toBe(true);
-});
-
-test('maskSecret returns plain mask for short / empty input', () => {
-	expect(maskSecret('')).toBe('');
-	expect(maskSecret(undefined)).toBe('');
-	expect(maskSecret('abc')).toBe('****');
-	expect(maskSecret('abcdefgh')).toBe('****');
-});
-
-test('redactTarget masks access_key / access_secret only', () => {
-	const out = redactTarget({
-		id: 'alicloud',
-		type: 'alicloud',
-		bucket: 'my-bucket',
-		region: 'oss-ap-southeast-1',
-		access_key: 'LTAI5t9GjXQc7itTohf68ZLq',
-		access_secret: '8jfykQQoK66RldfSo9YlfdLh423GXA',
-		root_path: '/',
-	});
-	expect(out.bucket).toBe('my-bucket');
-	expect(out.region).toBe('oss-ap-southeast-1');
-	expect(out.root_path).toBe('/');
-	expect(out.access_key).not.toContain('GjXQc7it');
-	expect(out.access_secret).not.toContain('QQoK66Rld');
-});
-
-test('redactCdnUrl masks AccessKeyId and Signature only', () => {
-	const url =
-		'http://cdn.ap-southeast-1.aliyuncs.com?AccessKeyId=LTAI5t9GjXQc7itTohf68ZLq&Action=BatchSetCdnDomainConfig&Signature=iUppVaZSIecVi3DhZZeBCf24Ag0%3D&Timestamp=2026-05-25T08%3A40%3A51.135Z';
-	const masked = redactCdnUrl(url);
-	expect(masked).not.toContain('LTAI5t9GjXQc7itTohf68ZLq');
-	expect(masked).not.toContain('iUppVaZSIecVi3DhZZeBCf24Ag0');
-	expect(masked).toContain('Action=BatchSetCdnDomainConfig');
-	expect(masked).toContain('Timestamp=2026-05-25');
-});