@hcmai/cli 0.3.5 → 0.3.6

package/dist/index.js

@@ -8651,7 +8651,7 @@ import { createReadStream as createReadStream2, promises as fs8 } from "fs";
 import path8 from "path";
 import { CliError as CliError22, CliErrorCode as CliErrorCode21, formatObject as formatObject20 } from "@hcmai/sdk";
 init_exit();
-var EXECUTION_CONTRACT_VERSION = "2026-08-28.controlled-v1";
+var EXECUTION_CONTRACT_VERSION = "2026-08-29.controlled-v2";
 var DEFAULT_TTL_SECONDS = 15 * 60;
 var MIN_TTL_SECONDS = 60;
 var MAX_TTL_SECONDS = 60 * 60;
@@ -8667,6 +8667,7 @@ async function prepareDeliveryExecution(input) {
   }
   const change = await bindDocument(project, input.changeRef, "\u53D8\u66F4\u8BF4\u660E");
   const rollback = await bindDocument(project, input.rollbackRef, "\u56DE\u6EDA\u8BF4\u660E");
+  const payloads = await bindPayloadFiles(project, input.argv);
   const evidence = await bindEvidenceDirectory(project, input.evidenceDir);
   const { bytes: lockBytes, runtime: lockedRuntime } = await readChironLock(project);
   const runtime = await (input.runtimeIdentity ?? currentRuntimeIdentity)();
@@ -8683,6 +8684,7 @@ async function prepareDeliveryExecution(input) {
     runtime,
     assessment,
     documents: { change, rollback },
+    payloads,
     evidenceDir: evidence.relative
   };
   const planId = sha2567(canonicalJson(core)).slice(0, 24);
@@ -8738,6 +8740,7 @@ async function executeDeliveryPlan(input) {
   }
   await assertDocumentUnchanged(project, plan.documents.change, "\u53D8\u66F4\u8BF4\u660E");
   await assertDocumentUnchanged(project, plan.documents.rollback, "\u56DE\u6EDA\u8BF4\u660E");
+  await assertPayloadsUnchanged(project, plan.payloads);
   const evidenceDir = await bindEvidenceDirectory(project, plan.evidenceDir);
   const receiptFile = path8.join(evidenceDir.absolute, `${plan.planId}.receipt.json`);
   if (await pathExists(receiptFile)) throw invalid4(`\u6267\u884C\u6536\u636E\u5DF2\u5B58\u5728\uFF0C\u62D2\u7EDD\u518D\u6B21\u6267\u884C\uFF1A${plan.planId}`);
@@ -8926,12 +8929,12 @@ function validateSupportedCommandShape(reasonCode, argv) {
     return;
   }
   if (reasonCode === "record-create") {
-    requireFlagValue(argv, "--data", "create \u5FC5\u987B\u5305\u542B --data <JSON>");
+    requireExactlyOnePayload(argv, "create");
     return;
   }
   if (reasonCode === "record-update") {
     requireFlagValue(argv, "--id", "update \u5FC5\u987B\u5305\u542B --id <id>");
-    requireFlagValue(argv, "--data", "update \u5FC5\u987B\u5305\u542B --data <JSON>");
+    requireExactlyOnePayload(argv, "update");
     return;
   }
   if (reasonCode === "cache-mutation") {
@@ -8962,6 +8965,40 @@ function optionalFlagValue(argv, flag) {
   }
   return void 0;
 }
+function requireExactlyOnePayload(argv, command) {
+  const inline = optionalFlagValue(argv, "--data") !== void 0;
+  const fromFile = optionalFlagValue(argv, "--data-file") !== void 0;
+  if (inline && fromFile) {
+    throw invalid4(`${command} \u7684 --data \u4E0E --data-file \u4E92\u65A5\uFF0C\u53EA\u80FD\u7ED9\u4E00\u4E2A`);
+  }
+  if (!inline && !fromFile) {
+    throw invalid4(`${command} \u5FC5\u987B\u5305\u542B --data <JSON> \u6216 --data-file <\u6587\u4EF6>`);
+  }
+}
+var PAYLOAD_FILE_FLAGS = ["--data-file", "--params-file"];
+async function bindPayloadFiles(project, argv) {
+  const bound = [];
+  for (const flag of PAYLOAD_FILE_FLAGS) {
+    const reference = optionalFlagValue(argv, flag);
+    if (reference === void 0) continue;
+    bound.push(await bindPayloadFile(project, reference, `${flag} \u8F7D\u8377`));
+  }
+  return bound;
+}
+async function bindPayloadFile(project, reference, label) {
+  const relative2 = safeRelative(reference, label);
+  const file = path8.join(project, relative2);
+  const bytes = await readSafeFile(project, file, label);
+  return { path: relative2, sha256: sha2567(bytes) };
+}
+async function assertPayloadsUnchanged(project, payloads) {
+  for (const payload of payloads) {
+    const current = await bindPayloadFile(project, payload.path, `\u8F7D\u8377 ${payload.path}`);
+    if (current.sha256 !== payload.sha256) {
+      throw invalid4(`\u8F7D\u8377\u6587\u4EF6 ${payload.path} \u7684\u5185\u5BB9\u5DF2\u53D8\u66F4\uFF0C\u8BF7\u91CD\u65B0 prepare`);
+    }
+  }
+}
 function requireFlagValue(argv, flag, message) {
   for (let index = 0; index < argv.length; index += 1) {
     const value = argv[index];
@@ -9100,7 +9137,7 @@ function isRuntimeIdentity(value) {
 }
 function isExecutionPlan(value) {
   if (!isRecord(value)) return false;
-  return value.schemaVersion === 1 && value.contractVersion === EXECUTION_CONTRACT_VERSION && typeof value.planId === "string" && PLAN_ID_PATTERN.test(value.planId) && typeof value.createdAt === "string" && typeof value.expiresAt === "string" && isSha(value.nonceSha256) && isSha(value.chironLockSha256) && isRuntimeIdentity(value.runtime) && isRecord(value.assessment) && isRecord(value.documents) && isBoundDocument(value.documents.change) && isBoundDocument(value.documents.rollback) && typeof value.evidenceDir === "string";
+  return value.schemaVersion === 1 && value.contractVersion === EXECUTION_CONTRACT_VERSION && typeof value.planId === "string" && PLAN_ID_PATTERN.test(value.planId) && typeof value.createdAt === "string" && typeof value.expiresAt === "string" && isSha(value.nonceSha256) && isSha(value.chironLockSha256) && isRuntimeIdentity(value.runtime) && isRecord(value.assessment) && isRecord(value.documents) && isBoundDocument(value.documents.change) && isBoundDocument(value.documents.rollback) && Array.isArray(value.payloads) && value.payloads.every(isBoundDocument) && typeof value.evidenceDir === "string";
 }
 function isBoundDocument(value) {
   return isRecord(value) && typeof value.path === "string" && isSha(value.sha256);