@hcmai/cli 0.3.5 → 0.3.7

package/dist/index.js

@@ -2286,9 +2286,9 @@ async function loginCommand(args) {
   } catch (e) {
     const err = e;
     if (err.isAxiosError) {
-      const { fromAxiosError: fromAxiosError19 } = await import("@hcmai/sdk");
+      const { fromAxiosError: fromAxiosError20 } = await import("@hcmai/sdk");
       exitWithError(
-        fromAxiosError19(
+        fromAxiosError20(
           e,
           envName
         )
@@ -8644,14 +8644,65 @@ async function deliveryDoctorCommand(args) {
   }
 }
 
+// src/commands/delivery-recon.ts
+init_auth_guard();
+init_exit();
+import {
+  HcmClient as HcmClient19,
+  ReconLayout,
+  ROUND_EXIT_CODES,
+  computeReconSourceKey,
+  formatObject as formatObject20,
+  fromAxiosError as fromAxiosError18,
+  httpProbe as httpProbe2,
+  inspectRound,
+  renderRound,
+  runRecon
+} from "@hcmai/sdk";
+var DEFAULT_CAPABILITIES2 = "default";
+async function deliveryReconCommand(args) {
+  try {
+    const ctx = await getActiveAuthContextFromCli(args);
+    const client3 = HcmClient19.fromAuthContext(ctx);
+    const probe = httpProbe2(client3.raw(), args.capabilities ?? DEFAULT_CAPABILITIES2);
+    const sourceKey = await computeReconSourceKey(probe);
+    const layout = new ReconLayout(args.out ?? ".", ctx.tenantId, sourceKey);
+    const summary = await runRecon(probe, layout, {
+      state: args.state ?? "",
+      onlyModel: args.model ?? null,
+      identity: ctx.tenantId ? { requestedTenantId: ctx.tenantId } : null
+    });
+    process.stdout.write(formatObject20(summary, { format: args.output ?? "json" }) + "\n");
+  } catch (e) {
+    const err = e;
+    if (err?.isAxiosError) exitWithError(fromAxiosError18(err, args.env));
+    exitWithError(e);
+    process.exit(1);
+  }
+}
+async function deliveryReconRoundCommand(args) {
+  let code;
+  try {
+    const result2 = inspectRound(args.dir ?? ".");
+    const fmt = args.output ?? "json";
+    if (fmt !== "json") process.stdout.write(renderRound(result2));
+    process.stdout.write(formatObject20(result2, { format: fmt }) + "\n");
+    code = ROUND_EXIT_CODES[result2.state];
+  } catch (e) {
+    exitWithError(e);
+    code = 1;
+  }
+  process.exit(code);
+}
+
 // src/commands/delivery-execution.ts
 import { createHash as createHash7, randomBytes as secureRandomBytes } from "crypto";
 import { spawn } from "child_process";
 import { createReadStream as createReadStream2, promises as fs8 } from "fs";
 import path8 from "path";
-import { CliError as CliError22, CliErrorCode as CliErrorCode21, formatObject as formatObject20 } from "@hcmai/sdk";
+import { CliError as CliError22, CliErrorCode as CliErrorCode21, formatObject as formatObject21 } from "@hcmai/sdk";
 init_exit();
-var EXECUTION_CONTRACT_VERSION = "2026-08-28.controlled-v1";
+var EXECUTION_CONTRACT_VERSION = "2026-08-29.controlled-v2";
 var DEFAULT_TTL_SECONDS = 15 * 60;
 var MIN_TTL_SECONDS = 60;
 var MAX_TTL_SECONDS = 60 * 60;
@@ -8667,6 +8718,7 @@ async function prepareDeliveryExecution(input) {
   }
   const change = await bindDocument(project, input.changeRef, "\u53D8\u66F4\u8BF4\u660E");
   const rollback = await bindDocument(project, input.rollbackRef, "\u56DE\u6EDA\u8BF4\u660E");
+  const payloads = await bindPayloadFiles(project, input.argv);
   const evidence = await bindEvidenceDirectory(project, input.evidenceDir);
   const { bytes: lockBytes, runtime: lockedRuntime } = await readChironLock(project);
   const runtime = await (input.runtimeIdentity ?? currentRuntimeIdentity)();
@@ -8683,6 +8735,7 @@ async function prepareDeliveryExecution(input) {
     runtime,
     assessment,
     documents: { change, rollback },
+    payloads,
     evidenceDir: evidence.relative
   };
   const planId = sha2567(canonicalJson(core)).slice(0, 24);
@@ -8738,6 +8791,7 @@ async function executeDeliveryPlan(input) {
   }
   await assertDocumentUnchanged(project, plan.documents.change, "\u53D8\u66F4\u8BF4\u660E");
   await assertDocumentUnchanged(project, plan.documents.rollback, "\u56DE\u6EDA\u8BF4\u660E");
+  await assertPayloadsUnchanged(project, plan.payloads);
   const evidenceDir = await bindEvidenceDirectory(project, plan.evidenceDir);
   const receiptFile = path8.join(evidenceDir.absolute, `${plan.planId}.receipt.json`);
   if (await pathExists(receiptFile)) throw invalid4(`\u6267\u884C\u6536\u636E\u5DF2\u5B58\u5728\uFF0C\u62D2\u7EDD\u518D\u6B21\u6267\u884C\uFF1A${plan.planId}`);
@@ -8802,7 +8856,7 @@ async function deliveryPrepareCommand(argv, args) {
       evidenceDir: args.evidenceDir,
       ...ttlSeconds === void 0 ? {} : { ttlSeconds }
     });
-    process.stdout.write(formatObject20(plan, { format: args.output ?? "json" }) + "\n");
+    process.stdout.write(formatObject21(plan, { format: args.output ?? "json" }) + "\n");
   } catch (cause) {
     exitWithError(cause);
   }
@@ -8814,7 +8868,7 @@ async function deliveryExecuteCommand(planId, argv, args) {
       planId,
       argv
     });
-    process.stdout.write(formatObject20(receipt, { format: args.output ?? "json" }) + "\n");
+    process.stdout.write(formatObject21(receipt, { format: args.output ?? "json" }) + "\n");
     process.exitCode = receipt.exitCode;
   } catch (cause) {
     exitWithError(cause);
@@ -8926,12 +8980,12 @@ function validateSupportedCommandShape(reasonCode, argv) {
     return;
   }
   if (reasonCode === "record-create") {
-    requireFlagValue(argv, "--data", "create \u5FC5\u987B\u5305\u542B --data <JSON>");
+    requireExactlyOnePayload(argv, "create");
     return;
   }
   if (reasonCode === "record-update") {
     requireFlagValue(argv, "--id", "update \u5FC5\u987B\u5305\u542B --id <id>");
-    requireFlagValue(argv, "--data", "update \u5FC5\u987B\u5305\u542B --data <JSON>");
+    requireExactlyOnePayload(argv, "update");
     return;
   }
   if (reasonCode === "cache-mutation") {
@@ -8962,6 +9016,40 @@ function optionalFlagValue(argv, flag) {
   }
   return void 0;
 }
+function requireExactlyOnePayload(argv, command) {
+  const inline = optionalFlagValue(argv, "--data") !== void 0;
+  const fromFile = optionalFlagValue(argv, "--data-file") !== void 0;
+  if (inline && fromFile) {
+    throw invalid4(`${command} \u7684 --data \u4E0E --data-file \u4E92\u65A5\uFF0C\u53EA\u80FD\u7ED9\u4E00\u4E2A`);
+  }
+  if (!inline && !fromFile) {
+    throw invalid4(`${command} \u5FC5\u987B\u5305\u542B --data <JSON> \u6216 --data-file <\u6587\u4EF6>`);
+  }
+}
+var PAYLOAD_FILE_FLAGS = ["--data-file", "--params-file"];
+async function bindPayloadFiles(project, argv) {
+  const bound = [];
+  for (const flag of PAYLOAD_FILE_FLAGS) {
+    const reference = optionalFlagValue(argv, flag);
+    if (reference === void 0) continue;
+    bound.push(await bindPayloadFile(project, reference, `${flag} \u8F7D\u8377`));
+  }
+  return bound;
+}
+async function bindPayloadFile(project, reference, label) {
+  const relative2 = safeRelative(reference, label);
+  const file = path8.join(project, relative2);
+  const bytes = await readSafeFile(project, file, label);
+  return { path: relative2, sha256: sha2567(bytes) };
+}
+async function assertPayloadsUnchanged(project, payloads) {
+  for (const payload of payloads) {
+    const current = await bindPayloadFile(project, payload.path, `\u8F7D\u8377 ${payload.path}`);
+    if (current.sha256 !== payload.sha256) {
+      throw invalid4(`\u8F7D\u8377\u6587\u4EF6 ${payload.path} \u7684\u5185\u5BB9\u5DF2\u53D8\u66F4\uFF0C\u8BF7\u91CD\u65B0 prepare`);
+    }
+  }
+}
 function requireFlagValue(argv, flag, message) {
   for (let index = 0; index < argv.length; index += 1) {
     const value = argv[index];
@@ -9100,7 +9188,7 @@ function isRuntimeIdentity(value) {
 }
 function isExecutionPlan(value) {
   if (!isRecord(value)) return false;
-  return value.schemaVersion === 1 && value.contractVersion === EXECUTION_CONTRACT_VERSION && typeof value.planId === "string" && PLAN_ID_PATTERN.test(value.planId) && typeof value.createdAt === "string" && typeof value.expiresAt === "string" && isSha(value.nonceSha256) && isSha(value.chironLockSha256) && isRuntimeIdentity(value.runtime) && isRecord(value.assessment) && isRecord(value.documents) && isBoundDocument(value.documents.change) && isBoundDocument(value.documents.rollback) && typeof value.evidenceDir === "string";
+  return value.schemaVersion === 1 && value.contractVersion === EXECUTION_CONTRACT_VERSION && typeof value.planId === "string" && PLAN_ID_PATTERN.test(value.planId) && typeof value.createdAt === "string" && typeof value.expiresAt === "string" && isSha(value.nonceSha256) && isSha(value.chironLockSha256) && isRuntimeIdentity(value.runtime) && isRecord(value.assessment) && isRecord(value.documents) && isBoundDocument(value.documents.change) && isBoundDocument(value.documents.rollback) && Array.isArray(value.payloads) && value.payloads.every(isBoundDocument) && typeof value.evidenceDir === "string";
 }
 function isBoundDocument(value) {
   return isRecord(value) && typeof value.path === "string" && isSha(value.sha256);
@@ -9144,10 +9232,10 @@ function invalid4(message, cause) {
 init_auth_guard();
 init_exit();
 import {
-  HcmClient as HcmClient19,
+  HcmClient as HcmClient20,
   adminResetPassword,
-  formatObject as formatObject21,
-  fromAxiosError as fromAxiosError18,
+  formatObject as formatObject22,
+  fromAxiosError as fromAxiosError19,
   CliError as CliError23,
   CliErrorCode as CliErrorCode22
 } from "@hcmai/sdk";
@@ -9178,12 +9266,12 @@ async function userResetPasswordCommand(args) {
   try {
     const password = args.passwordStdin ? await readSecretFromStdin() : await promptPasswordTwice();
     const request = buildAdminResetPasswordRequest(args, password);
-    const client3 = HcmClient19.fromAuthContext(await getActiveAuthContextFromCli(args));
+    const client3 = HcmClient20.fromAuthContext(await getActiveAuthContextFromCli(args));
     const result2 = await adminResetPassword(client3.raw(), request);
-    process.stdout.write(formatObject21(result2, { format: args.output ?? "json" }) + "\n");
+    process.stdout.write(formatObject22(result2, { format: args.output ?? "json" }) + "\n");
   } catch (cause) {
     const err = cause;
-    if (err?.isAxiosError) exitWithError(fromAxiosError18(err, args.env));
+    if (err?.isAxiosError) exitWithError(fromAxiosError19(err, args.env));
     exitWithError(cause);
   }
 }
@@ -9241,6 +9329,13 @@ user.command("reset-password").description("\u7531 admin.system \u5B89\u5168\u91
 var delivery = program.command("delivery").description("\u987E\u95EE\u4EA4\u4ED8\uFF1A\u73B0\u573A\u63A2\u6D3B\u3001\u98CE\u9669\u8BC4\u4F30\u4E0E\u4E00\u6B21\u6027\u53D7\u63A7\u6267\u884C\u5408\u540C");
 delivery.command("assess").description("\u8BC4\u4F30\u4E00\u6B21 HCM CLI argv\uFF1BAction \u98CE\u63A7\u58F0\u660E\u8BFB\u53D6\u81EA\u76EE\u6807 Core\uFF0C\u7528 -- \u5206\u9694\u88AB\u8BC4\u4F30\u547D\u4EE4").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").allowUnknownOption(true).argument("<command...>", "\u88AB\u8BC4\u4F30\u7684 HCM \u5B50\u547D\u4EE4\u4E0E\u53C2\u6570\uFF0C\u4E0D\u5305\u542B hcm \u672C\u8EAB").action((command, opts) => deliveryAssessCommand(command, opts));
 delivery.command("doctor").description("\u56DB\u6761\u951A\u70B9\u63A2\u6D3B\uFF1A\u8FDE\u901A / \u6211\u662F\u8C01 / configAdmin / \u7AD9\u5728\u54EA\u4E00\u5C42").option("--env <name>", "\u76EE\u6807\u73AF\u5883\u522B\u540D").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD").option("--capabilities <s>", "\u722C\u53D6\u65F6\u58F0\u660E\u7684 capability \u4E32\uFF08\u4F1A\u968F\u56DB\u5143\u7EC4\u7559\u6863\uFF09").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").action((opts) => deliveryDoctorCommand(opts));
+var recon = delivery.command("recon").description("\u722C\u4E00\u4EFD\u53EF\u5E26\u8D70\u7684\u57FA\u7EBF\uFF1A\u6A21\u578B / \u5B57\u6BB5 / \u53EA\u8BFB\u95F8 / \u4F9D\u8D56\u56FE / \u7801\u8868 / \u53EF\u5199\u6027\u753B\u50CF").option("--env <name>", "\u76EE\u6807\u73AF\u5883\u522B\u540D").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD").option("--out <dir>", "\u4EA7\u7269\u6839\u76EE\u5F55\uFF08\u4EA7\u7269\u843D\u5728 <out>/recon/<\u79DF\u6237\u6BB5>/<\u6765\u6E90\u6BB5>\uFF09", ".").option("--state <s>", "\u53EA\u8BFB\u95F8\u7684 state\uFF08\u4EA7\u54C1\u91CC state \u4E0D\u53EF\u679A\u4E3E\uFF0C\u95F8\u7684\u8986\u76D6\u9762\u6C38\u8FDC\u662F state-scoped\uFF09").option("--model <key>", "\u5B9A\u5411\u91CD\u722C\uFF1A\u53EA\u91CD\u722C\u8FD9\u4E00\u4E2A\u6A21\u578B\uFF0C\u5176\u4F59\u6CBF\u7528\u4E0A\u4E00\u8F6E\u4EA7\u7269").option("--capabilities <s>", "\u722C\u53D6\u65F6\u58F0\u660E\u7684 capability \u4E32\uFF08\u4F1A\u968F\u56DB\u5143\u7EC4\u7559\u6863\uFF09").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").action((opts) => deliveryReconCommand(opts));
+recon.command("round").description("\u96F6\u7F51\u7EDC\uFF1A\u8BFB\u4E00\u4EFD\u5DF2\u843D\u76D8\u7684\u57FA\u7EBF\uFF0C\u5224\u65AD\u5B83\u662F\u4E0D\u662F\u4E00\u8F6E\u5B8C\u6574\u8DD1\u51FA\u6765\u7684\uFF08complete/mixed/unknown\uFF09").option("--dir <dir>", "\u4EA7\u7269\u76EE\u5F55\uFF08<out>/recon/<\u79DF\u6237\u6BB5>/<\u6765\u6E90\u6BB5>\uFF09", ".").action(
+  (opts, cmd) => deliveryReconRoundCommand({
+    ...opts,
+    output: cmd.parent?.opts()?.output
+  })
+);
 delivery.command("prepare").description("\u628A\u53D7\u652F\u6301\u7684 R2 argv \u4E0E\u9501\u3001\u8FD0\u884C\u65F6\u548C\u53D8\u66F4/\u56DE\u6EDA\u8BF4\u660E\u7ED1\u5B9A\u4E3A\u77ED\u65F6\u6267\u884C\u8BA1\u5212").requiredOption("--change-ref <file>", "\u9879\u76EE work/ \u6216 decisions/ \u4E0B\u7684\u53D8\u66F4\u8BF4\u660E").requiredOption("--rollback-ref <file>", "\u9879\u76EE work/ \u6216 decisions/ \u4E0B\u7684\u56DE\u6EDA\u8BF4\u660E").requiredOption("--evidence-dir <dir>", "\u9879\u76EE evidence/ \u4E0B\u7684\u6536\u636E\u76EE\u5F55").option("--project <dir>", "HCM \u987E\u95EE\u9879\u76EE\u6839\u76EE\u5F55", ".").option("--ttl-seconds <n>", "\u6709\u6548\u671F\u79D2\u6570\uFF0860-3600\uFF09", "900").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").allowUnknownOption(true).argument("<command...>", "\u88AB\u7ED1\u5B9A\u7684 R2 HCM \u5B50\u547D\u4EE4\u4E0E\u53C2\u6570\uFF0C\u4E0D\u5305\u542B hcm \u672C\u8EAB").action((command, opts) => deliveryPrepareCommand(command, opts));
 delivery.command("execute <planId>").description("\u9010\u6B21\u6279\u51C6\u540E\u6D88\u8D39\u77ED\u65F6\u8BA1\u5212\uFF0C\u5E76\u6267\u884C\u4E00\u6B21\u4E0E\u8BA1\u5212\u5B8C\u5168\u76F8\u540C\u7684 R2 argv").option("--project <dir>", "HCM \u987E\u95EE\u9879\u76EE\u6839\u76EE\u5F55", ".").option("--output <fmt>", "\u6536\u636E\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").allowUnknownOption(true).argument("<command...>", "\u4E0E prepare \u5B8C\u5168\u76F8\u540C\u7684 R2 HCM \u5B50\u547D\u4EE4\u4E0E\u53C2\u6570").action((planId, command, opts) => deliveryExecuteCommand(planId, command, opts));
 program.command("query <Model>").description("\u67E5\u8BE2 Model \u5217\u8868\u6570\u636E\uFF08\u901A\u8FC7 ModelQueryDsl JSON \u8868\u8FBE\u8FC7\u6EE4/\u6392\u5E8F/\u5206\u9875\uFF09").option(