chore(deno): migrate toolchain from Node 24 + pnpm to Deno 2.9.7 + TypeScript 7.0.2 (W1.5)

- root deno.json workspace (nodeModulesDir auto), npm versions registered once in imports, deno.lock;
  remove pnpm-lock/pnpm-workspace/root package.json; members keep minimal package.json (name/type/exports)
- tasks: dev, typecheck (tsc 7.0.2 per member + deno check), lint/fmt (biome, useImportExtensions),
  test (vitest via deno), check:tokens, build (web + deno compile), ci, db:migrate/reset, gen:types
- tsconfig base moved to config/ (no root tsconfig.json); deno types -> types/deno.d.ts; web drops baseUrl
- server: Deno.serve entry with graceful shutdown, --role migrate|preflight|probe, WEB_ROOT static SPA hosting;
  drop @hono/node-server, tsx, esbuild build.mjs
- logger: redact child() bindings and serialize err by message/stack; sync stdout destination; tests
- relative imports get explicit extensions (sites/mp-sync paths left for follow-up)
- crash-recovery tests spawn `deno run -A`; tasks tests use unique per-file schemas
- single-container Dockerfile + entrypoint (migrate -> preflight -> api+worker watchdog), docker-compose.yml
- docs: README, runbook, ADR-001 superseded, plan §1 validation row

Co-Authored-By: Claude Fable 5.1 <[email protected]>

apps/server/test/auth.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
-import { hasScope } from "../src/http/auth";
-import { DEV_KEY, json, memoryStore, testApp } from "./helpers";
+import { hasScope } from "../src/http/auth.ts";
+import { DEV_KEY, json, memoryStore, testApp } from "./helpers.ts";
 
 const store = memoryStore({
   "key-read": { id: "k1", scopes: ["read"] },

apps/server/test/health.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { json, testApp } from "./helpers";
+import { json, testApp } from "./helpers.ts";
 
 describe("GET /api/v1/health", () => {
   it("免鉴权返回 ok 信封", async () => {

apps/server/test/helpers.ts

@@ -1,8 +1,8 @@
 import { Writable } from "node:stream";
-import { createApp } from "../src/http/app";
-import { type ApiKeyStore, hashApiKey } from "../src/http/auth";
-import { EventBus } from "../src/http/sse";
-import { createLogger } from "../src/logger";
+import { createApp } from "../src/http/app.ts";
+import { type ApiKeyStore, hashApiKey } from "../src/http/auth.ts";
+import { EventBus } from "../src/http/sse.ts";
+import { createLogger } from "../src/logger.ts";
 
 export const DEV_KEY = "dev-admin-test-key";
 

apps/server/test/logger.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
-import { redact, redactString } from "../src/logger";
-import { memoryLogger } from "./helpers";
+import { redact, redactString } from "../src/logger.ts";
+import { memoryLogger } from "./helpers.ts";
 
 describe("日志脱敏", () => {
   it("URL query 中的 passkey/token 被替换", () => {
@@ -26,3 +26,37 @@ describe("日志脱敏", () => {
     for (const s of ["SECRET1", "SECRET2", "SECRET3", "SECRET4"]) expect(out).not.toContain(s);
   });
 });
+
+describe("日志脱敏:child 绑定与 Error 序列化", () => {
+  it("child() 绑定的敏感字段被脱敏", () => {
+    const { logger, lines } = memoryLogger();
+    logger.child({ component: "worker", password: "SECRET5", url: "https://x/?passkey=SECRET6" }).warn("child");
+    const out = lines.join("");
+    expect(out).not.toContain("SECRET5");
+    expect(out).not.toContain("SECRET6");
+    const line = JSON.parse(lines.at(-1)!);
+    expect(line.component).toBe("worker");
+    expect(line.password).toBe("[REDACTED]");
+  });
+
+  it("err 按 message/stack 序列化而不是 {},且内容脱敏", () => {
+    const { logger, lines } = memoryLogger();
+    const err = Object.assign(new Error("GET https://x/dl?passkey=SECRET7 failed", { cause: new Error("inner") }), {
+      code: "E_FETCH",
+      token: "SECRET8",
+    });
+    logger.error({ err }, "boom");
+    const line = JSON.parse(lines.at(-1)!);
+    expect(line.err.type).toBe("Error");
+    expect(line.err.message).toBe("GET https://x/dl?passkey=[REDACTED] failed");
+    expect(line.err.stack).toContain("Error: GET https://x/dl?passkey=[REDACTED] failed");
+    expect(line.err.code).toBe("E_FETCH");
+    expect(line.err.token).toBe("[REDACTED]");
+    expect(line.err.cause.message).toBe("inner");
+    expect(lines.join("")).not.toMatch(/SECRET7|SECRET8/);
+  });
+
+  it("redact() 直接处理 Error", () => {
+    expect(redact(new Error("x?token=abc"))).toMatchObject({ type: "Error", message: "x?token=[REDACTED]" });
+  });
+});

apps/server/test/preflight.test.ts

@@ -0,0 +1,47 @@
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { DB, Kysely } from "@umt/db";
+import { afterAll, describe, expect, it } from "vitest";
+import { type Config, ConfigSchema } from "../src/config.ts";
+import { runPreflight } from "../src/preflight.ts";
+
+const dir = mkdtempSync(join(tmpdir(), "umt-pre-"));
+afterAll(() => rmSync(dir, { recursive: true, force: true }));
+
+// 最小假 Kysely:只需要 sql`select 1`.execute(db) 走得通或失败
+const fakeDb = (ok: boolean) =>
+  ({
+    getExecutor: () => ({
+      transformQuery: (n: unknown) => n,
+      compileQuery: (n: unknown) => ({ sql: "select 1", parameters: [], query: n }),
+      executeQuery: async () => {
+        if (!ok) throw new Error("connect ECONNREFUSED");
+        return { rows: [{ "?column?": 1 }] };
+      },
+    }),
+  }) as unknown as Kysely<DB>;
+
+const cfg = (over: Record<string, string>): Config =>
+  ConfigSchema.parse({ DATABASE_URL: "postgres://x/y", SECRET_MASTER_KEY: "a-real-random-secret-value-123", ...over });
+
+describe("启动自检", () => {
+  it("开发环境、DB 可达 → 通过", async () => {
+    expect(await runPreflight({ config: cfg({}), db: fakeDb(true), uid: 0 })).toEqual([]);
+  });
+
+  it("生产环境:占位符密钥、root、DB 不可达、WEB_ROOT 缺 index.html 都报出", async () => {
+    const problems = await runPreflight({
+      config: cfg({ NODE_ENV: "production", SECRET_MASTER_KEY: "dev-only-change-me-dev-only", WEB_ROOT: dir }),
+      db: fakeDb(false),
+      uid: 0,
+    });
+    expect(problems.map((p) => p.check).sort()).toEqual(["db", "secret", "user", "web"]);
+  });
+
+  it("WEB_ROOT 有 index.html、非 root → 通过", async () => {
+    writeFileSync(join(dir, "index.html"), "<!doctype html>");
+    const config = cfg({ NODE_ENV: "production", WEB_ROOT: dir });
+    expect(await runPreflight({ config, db: fakeDb(true), uid: 1000 })).toEqual([]);
+  });
+});

apps/server/test/sse.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
-import { EventBus } from "../src/http/sse";
-import { DEV_KEY, testApp } from "./helpers";
+import { EventBus } from "../src/http/sse.ts";
+import { DEV_KEY, testApp } from "./helpers.ts";
 
 describe("EventBus", () => {
   it("序号自增并按 after 补读,淘汰后标记 gap", () => {

apps/server/test/static.test.ts

@@ -0,0 +1,49 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, describe, expect, it } from "vitest";
+import { createApp } from "../src/http/app.ts";
+import { EventBus } from "../src/http/sse.ts";
+import { json, memoryLogger } from "./helpers.ts";
+
+const root = mkdtempSync(join(tmpdir(), "umt-web-"));
+mkdirSync(join(root, "assets"));
+writeFileSync(join(root, "index.html"), "<!doctype html><title>SPA</title>");
+writeFileSync(join(root, "assets", "app.js"), "console.log(1)");
+afterAll(() => rmSync(root, { recursive: true, force: true }));
+
+function app() {
+  return createApp({
+    config: { NODE_ENV: "production" },
+    logger: memoryLogger().logger,
+    bus: new EventBus(5),
+    role: "all",
+    version: "0.0.0-test",
+    webRoot: root,
+  });
+}
+
+describe("单容器静态托管(WEB_ROOT)", () => {
+  it("存在的文件直接返回", async () => {
+    const res = await app().request("/assets/app.js");
+    expect(res.status).toBe(200);
+    expect(await res.text()).toBe("console.log(1)");
+  });
+
+  it("首页与前端路由回退 index.html", async () => {
+    for (const path of ["/", "/settings", "/library/123"]) {
+      const res = await app().request(path);
+      expect(res.status, path).toBe(200);
+      expect(res.headers.get("content-type")).toContain("text/html");
+      expect(await res.text()).toContain("<title>SPA</title>");
+    }
+  });
+
+  it("/api 下的未知路径不回退,仍是 JSON", async () => {
+    const health = await app().request("/api/v1/health");
+    expect((await json(health)).ok).toBe(true);
+    const res = await app().request("/api/nope");
+    expect(res.status).toBe(404);
+    expect((await json(res)).error.code).toBe("not_found");
+  });
+});