feat: initial public release

deploy/install.sh

@@ -0,0 +1,117 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+project_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+domain="approval.justconn.top"
+public_base_url="https://${domain}"
+gateway_url="${public_base_url}/mcp"
+download_base_url="${public_base_url}/downloads/dingmcp"
+release_dir="${project_root}/release"
+web_base="/var/www/${domain}"
+web_root="${web_base}/downloads/dingmcp"
+web_releases="${web_base}/releases"
+acme_root="${web_base}/acme"
+nginx_site="/etc/nginx/conf.d/${domain}.conf"
+certificate="/etc/letsencrypt/live/${domain}/fullchain.pem"
+npm_cache="${project_root}/.npm-cache"
+release_private_key="${project_root}/.secrets/release-signing-private.pem"
+release_public_key="${project_root}/distribution/release-signing-public.pem"
+
+for command_name in node npm curl systemctl sudo nginx certbot stat sha256sum tar find sort tail cut date; do
+  command -v "${command_name}" >/dev/null 2>&1 || {
+    echo "缺少部署命令：${command_name}" >&2
+    exit 1
+  }
+done
+
+if [[ ! -f "${project_root}/.runtime/dingtalk-mcp.env" ]]; then
+  echo "缺少 .runtime/dingtalk-mcp.env；首次部署前需先配置网关企业凭证。" >&2
+  exit 1
+fi
+
+if [[ ! -f "${release_private_key}" || ! -f "${release_public_key}" ]]; then
+  echo "缺少 Ed25519 发布密钥；首次部署请先执行 npm run release:keygen 并安全备份私钥。" >&2
+  exit 1
+fi
+if [[ "$(stat -c '%a' "${release_private_key}")" != "600" ]]; then
+  echo "发布私钥权限必须为 600：${release_private_key}" >&2
+  exit 1
+fi
+
+echo "[1/7] 测试并构建"
+cd "${project_root}"
+npm --cache "${npm_cache}" test
+
+echo "[2/7] 生成包含钉钉 OA 与薪福通的发行包"
+npm --cache "${npm_cache}" run release:build -- \
+  --gateway-url "${gateway_url}" \
+  --download-base-url "${download_base_url}" \
+  --out release
+npm run test-bundle:build -- \
+  --release-dir release \
+  --bundle release/dingmcp-test-bundle.tar.gz \
+  --bundle-url "${download_base_url}/dingmcp-test-bundle.tar.gz" \
+  --prompt release/agent-test-install.md
+(cd "${release_dir}" && sha256sum -c SHA256SUMS)
+npm run release:verify -- --release-dir release
+
+echo "[3/7] 安装并重启用户级网关服务"
+node dist/src/admin.js service start --project-root "${project_root}"
+
+echo "[4/7] 原子发布安装文件"
+release_version="$(node -p "require('./package.json').version")"
+release_digest="$(sha256sum "${release_dir}/manifest.json" | cut -c1-12)"
+release_name="${release_version}-${release_digest}"
+release_target="${web_releases}/${release_name}"
+release_staging="${web_releases}/.staging-${release_name}-$$"
+sudo install -d -m 0755 "${web_base}/downloads" "${web_releases}" "${acme_root}/.well-known/acme-challenge"
+sudo rm -rf "${release_staging}"
+sudo install -d -m 0755 "${release_staging}"
+sudo cp -a "${release_dir}/." "${release_staging}/"
+if ! sudo test -e "${release_target}"; then
+  sudo mv "${release_staging}" "${release_target}"
+else
+  sudo rm -rf "${release_staging}"
+fi
+if sudo test -d "${web_root}" && ! sudo test -L "${web_root}"; then
+  sudo mv "${web_root}" "${web_releases}/legacy-$(date -u +%Y%m%dT%H%M%SZ)"
+fi
+sudo ln -sfn "${release_target}" "${web_root}.next"
+sudo mv -Tf "${web_root}.next" "${web_root}"
+
+mapfile -t obsolete_releases < <(find "${web_releases}" -mindepth 1 -maxdepth 1 -type d -name '[0-9]*' ! -name "${release_name}" -printf '%T@ %f\n' | sort -nr | tail -n +3 | cut -d' ' -f2-)
+for obsolete in "${obsolete_releases[@]}"; do
+  [[ "${obsolete}" =~ ^[A-Za-z0-9._-]+$ ]] || continue
+  sudo rm -rf "${web_releases:?}/${obsolete}"
+done
+
+if ! sudo test -f "${certificate}"; then
+  echo "[5/7] 首次签发 HTTPS 证书"
+  sudo install -m 0644 "${project_root}/deploy/${domain}.bootstrap.nginx.conf" "${nginx_site}"
+  sudo nginx -t
+  sudo systemctl reload nginx
+  sudo certbot certonly --webroot -w "${acme_root}" -d "${domain}"
+else
+  echo "[5/7] 复用现有 HTTPS 证书"
+fi
+
+echo "[6/7] 安装正式 Nginx 配置"
+sudo install -m 0644 "${project_root}/deploy/${domain}.nginx.conf" "${nginx_site}"
+sudo nginx -t
+sudo systemctl reload nginx
+
+echo "[7/7] 验证公网服务"
+curl --fail --silent --show-error --retry 10 --retry-delay 1 --retry-all-errors \
+  "${public_base_url}/healthz" >/dev/null
+curl --fail --silent --show-error \
+  "${public_base_url}/.well-known/oauth-protected-resource/mcp" >/dev/null
+curl --fail --silent --show-error "${download_base_url}/install.md" >/dev/null
+curl --fail --silent --show-error "${download_base_url}/manifest.json" >/dev/null
+curl --fail --silent --show-error "${download_base_url}/manifest.sig" >/dev/null
+curl --fail --silent --show-error "${download_base_url}/dingtalk-approval-installer.mjs" >/dev/null
+curl --fail --silent --show-error "${download_base_url}/release-signing-public.pem" >/dev/null
+
+echo "部署完成。"
+echo "MCP：${gateway_url}"
+echo "用户安装链接：${download_base_url}/install.md"
+echo "黑盒测试提示词：${download_base_url}/agent-test-install.md"