@stalfh233/omc-cli 0.0.0-stage → 0.4.10

package/dist/runtime-support.js

@@ -0,0 +1,134 @@
+import { wireCall, wireRows, WireError } from "./wire.js";
+import { ENDPOINTS } from "./endpoints.js";
+import { ToolRefusalError } from "./tool-types.js";
+import { resolveModelTreeNode } from "./lanes/model.js";
+/**
+ * Ticket 78 — map the two same-root-cause platform failures of an
+ * UNPUBLISHED application to the explicit `app-not-published` blocker:
+ * - data.save/data.submit: stable 50000 on unpublished-app models (the same
+ *   call succeeds on a published app);
+ * - datarule.create type2 CALCULATE: 305003, a FALSE dead-cycle verdict —
+ *   BizDataRuleFacadeImpl.checkCalculateRulesDeadCycle (decompiled :84-170)
+ *   falls back to `schemaCode.propertyCode` concatenation when
+ *   applicationFacade.getAppFunctionByCode(schemaCode) is null.
+ *
+ * Fail-closed corroboration: the mapping fires ONLY when the app face
+ * (apppackage/list) actually reports `published === false` for the model's
+ * application; anything unresolved rethrows the original wire error (an
+ * uncorroborated 50000 stays a generic failure). App publish itself is
+ * outside OMC's coverage — the refusal says so instead of retrying blindly.
+ *
+ * Lives at the src/ support seam (like form-support/rule-support) because it
+ * reads lane metadata; support.ts stays a leaf module.
+ */
+export async function mapUnpublishedAppFailure(session, schemaCode, errcode, rootCause, error) {
+    if (!(error instanceof WireError && error.kind === "business" && error.errcode === errcode))
+        throw error;
+    // Corroboration reads failing (transport etc.) rethrow the ORIGINAL error —
+    // the mapping must never mask the failure it is diagnosing.
+    let resolved;
+    let row;
+    try {
+        resolved = await resolveModelTreeNode(session, schemaCode);
+        if (!resolved.node)
+            throw error;
+        const apps = wireRows((await wireCall(session, { path: ENDPOINTS.applicationList, query: {} })).data);
+        row = apps.find((candidate) => String(candidate.appCode ?? candidate.code ?? "") === resolved.applicationCode);
+    }
+    catch {
+        throw error;
+    }
+    if (!row || row.published !== false)
+        throw error;
+    throw new ToolRefusalError({
+        status: "refused",
+        blocker: "app-not-published",
+        schemaCode,
+        applicationCode: resolved.applicationCode,
+        errcode,
+        message: `${rootCause}——根因：模型 ${schemaCode} 所在应用 ${resolved.applicationCode} 未发布（同调用在已发布应用模型上成功）。应用发布属 OMC 覆盖边界外（unsupported）：设计态验证可继续，运行时验证请在已发布应用的模型上进行；不要重复盲试`,
+    });
+}
+/**
+ * Ticket 78 convenience seam: run a runtime write and map its corroborated
+ * unpublished-app failure. Used by data.save/data.submit (errcode 50000) and
+ * datarule.create type2 (errcode 305003) so the try/catch wiring lives once.
+ */
+export async function runtimeWriteWithAppMapping(session, schemaCode, errcode, rootCause, call, formData) {
+    try {
+        return await call();
+    }
+    catch (error) {
+        let mapped;
+        try {
+            mapped = await mapUnpublishedAppFailure(session, schemaCode, errcode, rootCause, error);
+        }
+        catch (appMapped) {
+            // The app mapping either produced a refusal or rethrew the original; if a
+            // caller supplied the payload, also try the single-relation shape diagnosis
+            // (it passes refusals through untouched).
+            throw formData === undefined ? appMapped : await diagnoseRelationShapeFailure(session, schemaCode, errcode, appMapped, formData);
+        }
+        throw mapped;
+    }
+}
+/** WORK_SHEET single relation; a runtime value must NOT be an array. */
+export const SINGLE_RELATION_PROPERTY_TYPE = 9;
+/** CHILD_TABLE(8): a sub-table field; its rows carry the child schema's own field shapes. */
+export const CHILD_TABLE_PROPERTY_TYPE = 8;
+/**
+ * Dogfood 2026-09-24 (bench31): a SINGLE relation (WORK_SHEET, propertyType 9)
+ * given an ARRAY makes runtime/form/save answer an opaque 50000. `{id}`/`id`
+ * work, and multi relations (11) / staff-org fields (50/51) legitimately take
+ * arrays — so the SAME shape silently fails only for single relations.
+ *
+ * On a still-unexplained 50000 (the app-published mapping already passed),
+ * name the offending field(s) instead of leaving an opaque error. Metadata is
+ * read ONLY on failure (zero cost on the success path); when nothing matches,
+ * or the failure is a corroborated refusal, the ORIGINAL error is rethrown.
+ */
+export async function diagnoseRelationShapeFailure(session, schemaCode, errcode, error, formData) {
+    if (!(error instanceof WireError && error.kind === "business" && error.errcode === errcode))
+        throw error;
+    let rows;
+    try {
+        rows = wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode, isPublish: "true" } })).data);
+    }
+    catch {
+        throw error;
+    }
+    const culprits = [];
+    const typeOf = (row) => Number(row.propertyType ?? row.type);
+    for (const row of rows) {
+        const code = String(row.code ?? row.propertyCode ?? "");
+        const value = formData[code];
+        if (typeOf(row) === SINGLE_RELATION_PROPERTY_TYPE && Array.isArray(value) && value.length > 0) {
+            culprits.push(code);
+            continue;
+        }
+        if (typeOf(row) === CHILD_TABLE_PROPERTY_TYPE && Array.isArray(value)) {
+            const subSchema = row.subSchema;
+            const singleChildren = new Set((subSchema?.properties ?? []).filter((property) => typeOf(property) === SINGLE_RELATION_PROPERTY_TYPE).map((property) => String(property.code ?? property.propertyCode ?? "")));
+            for (const entry of value) {
+                if (!entry || typeof entry !== "object" || Array.isArray(entry))
+                    continue;
+                for (const childCode of singleChildren) {
+                    const childValue = entry[childCode];
+                    if (Array.isArray(childValue) && childValue.length > 0)
+                        culprits.push(`${code}.${childCode}`);
+                }
+            }
+        }
+    }
+    if (culprits.length === 0)
+        throw error;
+    throw new ToolRefusalError({
+        status: "refused",
+        blocker: "relation-single-array-shape",
+        schemaCode,
+        errcode,
+        fields: culprits,
+        message: `errcode ${errcode}——根因：单选关联字段 ${culprits.join(", ")} 传了数组（WORK_SHEET/propertyType 9 只接受 id 字符串或 {id}；数组会稳定 ${errcode}）。多选关联（11）与人员/组织（50/51）才用数组`,
+    });
+}
+//# sourceMappingURL=runtime-support.js.map

package/dist/server.js

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { randomBytes } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { buildToolRegistry, makeToolContext } from "./tools.js";
+import { SessionManager } from "./session-manager.js";
+import { redact, redactError } from "./redact.js";
+import { ConfigStore } from "./config-store.js";
+import { contractMarkdown, contractResourceUri, LANE_CONTRACTS, shortToolDescription } from "./contract-resources.js";
+import { listSkills, readSkill } from "./skills.js";
+export function createMcpServer(options = {}) {
+    const context = makeToolContext({
+        sessions: options.sessions ?? new SessionManager(new ConfigStore()),
+        artifactsDir: options.artifactsDir,
+        tokenKey: options.tokenKey ?? randomBytes(32).toString("base64"),
+        tokenTtlMs: options.tokenTtlMs,
+    });
+    const secrets = options.secrets ?? (() => []);
+    const server = new McpServer({ name: "omc-cli", version: "0.1.0" }, {
+        capabilities: { tools: {}, resources: {} },
+        instructions: "Governed CloudPivot 8.6 configuration server. Tool schemas are self-describing (field families, relation options, rule nodeGraph, workflow template, formData, and the two-step approval flow). Methodology is served as MCP resources under omc://skills/ (five-piece flow, tool selection, acceptance criteria, requirement analysis, capability scouting, glossary, config draft review); read them with resources/list + resources/read rather than reading repository source. Before ANY write, read omc://skills/omc-config-draft-review: present the design (exact names/codes/types, layout, rule graph, view) as a plain-language draft and get explicit human approval first — the conversational human gate (approval granularity is the enumerated change package; an interrupted package loses its approval and resuming needs a fresh draft and go-ahead). Then: call without approvalToken to preview the plan, approval.request to get a token (the machine gate — it carries no human check), re-call with it. Production environments refuse writes by default (dual-key grant). Deliver ONE closing report per run — never interrupt per step.",
+    });
+    const register = server.tool.bind(server);
+    for (const definition of buildToolRegistry()) {
+        register(definition.name, shortToolDescription(definition.name, definition.kind, definition.lane) ?? definition.description, definition.inputSchema, async (args) => {
+            try {
+                const result = await definition.handler(context, args, definition);
+                return { content: [{ type: "text", text: redact(result, secrets()) }] };
+            }
+            catch (error) {
+                const refusal = error.payload;
+                if (refusal)
+                    return { content: [{ type: "text", text: redact(refusal, secrets()) }] };
+                const redacted = redactError(error, secrets());
+                return { content: [{ type: "text", text: redact({ status: "error", message: redacted.message }, secrets()) }], isError: true };
+            }
+        });
+    }
+    registerSkillResources(server);
+    registerContractResources(server);
+    return { server, context };
+}
+/**
+ * Serve the package's methodology notes as MCP resources so any client can
+ * read them on demand (host-agnostic) instead of the agent globbing the
+ * filesystem for them. Each skill file's YAML frontmatter supplies its name
+ * and description.
+ */
+function registerSkillResources(server) {
+    for (const entry of listSkills()) {
+        const document = readSkill(entry.name);
+        if (document === undefined)
+            continue;
+        server.registerResource(entry.name, entry.uri, { title: entry.name, description: entry.description, mimeType: "text/markdown" }, async (uri) => ({ contents: [{ uri: uri.href, mimeType: "text/markdown", text: document.content }] }));
+    }
+}
+function registerContractResources(server) {
+    for (const contract of LANE_CONTRACTS) {
+        const text = contractMarkdown(contract);
+        server.registerResource(`contract-${contract.lane}`, contractResourceUri(contract), {
+            title: `${contract.lane} contract`,
+            description: `CloudPivot ${contract.family} contract for ${contract.lane}; reference ${contract.referenceVersion}`,
+            mimeType: "text/markdown",
+        }, async (uri) => ({ contents: [{ uri: uri.href, mimeType: "text/markdown", text }] }));
+    }
+}
+export async function runStdioServer(options = {}) {
+    const { server } = createMcpServer(options);
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+function isProcessEntryPoint() {
+    const entry = process.argv[1];
+    if (!entry)
+        return false;
+    try {
+        return realpathSync(entry) === fileURLToPath(import.meta.url);
+    }
+    catch {
+        return false;
+    }
+}
+if (isProcessEntryPoint()) {
+    runStdioServer().catch((error) => {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    });
+}
+export { buildToolRegistry, makeToolContext };
+//# sourceMappingURL=server.js.map

package/dist/session-manager.js

@@ -0,0 +1,30 @@
+import { CloudPivotSession } from "./session.js";
+/** Caches one logged-in session per named environment per process. */
+export class SessionManager {
+    store;
+    httpFactory;
+    systemConfigFactory;
+    sessions = new Map();
+    constructor(store, httpFactory, systemConfigFactory) {
+        this.store = store;
+        this.httpFactory = httpFactory;
+        this.systemConfigFactory = systemConfigFactory;
+    }
+    config() {
+        return this.store;
+    }
+    async session(environment) {
+        const resolved = this.store.resolveEnvironment(environment);
+        const profileKey = JSON.stringify(resolved.profile);
+        const cached = this.sessions.get(resolved.name);
+        let session = cached?.profileKey === profileKey ? cached.session : undefined;
+        if (!session) {
+            const credential = this.store.readCredential(resolved.name);
+            session = new CloudPivotSession(resolved.name, resolved.profile, credential, this.httpFactory?.(resolved.profile), this.systemConfigFactory?.(resolved.profile));
+            this.sessions.set(resolved.name, { profileKey, session });
+        }
+        await session.login();
+        return session;
+    }
+}
+//# sourceMappingURL=session-manager.js.map

package/dist/session.js

@@ -0,0 +1,149 @@
+import { CloudPivotAuthenticator, cloudPivotTenantHeaders, fetchCloudPivotHttp, resolveCloudPivotAuthoritativeOrigin, } from "omc-core";
+import { canonicalCloudPivotEnvironmentFingerprint } from "omc-core";
+/**
+ * An authenticated CloudPivot session for one named environment. Wraps the
+ * core authenticator; exposes a version-family probe used by the 8.6-only
+ * fail-closed write gate, and the canonical environment fingerprint that all
+ * plans/approvals/artifacts must carry.
+ */
+export class CloudPivotSession {
+    environmentName;
+    profile;
+    credential;
+    http;
+    systemConfig;
+    requestTimeoutMs;
+    loginResult;
+    version;
+    constructor(environmentName, profile, credential, http = fetchCloudPivotHttp(profile.baseUrl, undefined, fetch, cloudPivotTenantHeaders(profile.engineCode)), systemConfig = undefined, requestTimeoutMs = defaultRequestTimeoutMs()) {
+        this.environmentName = environmentName;
+        this.profile = profile;
+        this.credential = credential;
+        this.http = http;
+        this.systemConfig = systemConfig;
+        this.requestTimeoutMs = requestTimeoutMs;
+    }
+    async login() {
+        if (this.loginResult)
+            return this.loginResult;
+        const { systemConfig } = this.systemConfig
+            ? { systemConfig: this.systemConfig }
+            : await resolveCloudPivotAuthoritativeOrigin(this.profile.baseUrl, undefined, fetch, cloudPivotTenantHeaders(this.profile.engineCode)).then((r) => ({ systemConfig: r.systemConfig }), () => ({ systemConfig: undefined }));
+        const authenticator = new CloudPivotAuthenticator(this.http);
+        this.loginResult = await authenticator.login({
+            baseUrl: this.profile.baseUrl,
+            username: this.credential.username,
+            password: this.credential.password,
+            ...(systemConfig ? { systemConfig } : {}),
+        });
+        this.version = detectVersion(systemConfig);
+        return this.loginResult;
+    }
+    /** Version-family evidence; absent evidence returns undefined (fail closed upstream). */
+    detectedVersion() {
+        return this.version;
+    }
+    token() {
+        if (!this.loginResult)
+            throw new Error("session is not logged in");
+        return this.loginResult.token;
+    }
+    enterpriseId() {
+        if (!this.loginResult)
+            throw new Error("session is not logged in");
+        return this.loginResult.enterpriseId;
+    }
+    administrator() {
+        if (!this.loginResult)
+            throw new Error("session is not logged in");
+        return this.loginResult.administrator;
+    }
+    headers() {
+        return { Authorization: `Bearer ${this.token()}`, "X-LowCode-Corpid": this.enterpriseId() };
+    }
+    environmentFingerprint() {
+        if (!this.loginResult)
+            throw new Error("session is not logged in");
+        return canonicalCloudPivotEnvironmentFingerprint({
+            environment: this.environmentName,
+            authoritativeOrigin: new URL(this.profile.baseUrl).origin,
+            applicationCode: this.profile.applicationCode,
+            enterpriseId: this.loginResult.enterpriseId,
+        });
+    }
+    async request(input) {
+        const first = await this.send(input);
+        // A 401 means the cached token was invalidated out-of-band (e.g. the
+        // operator cleared Redis for a license recovery). Re-login once and retry;
+        // anything else is returned as-is for the wire layer to classify.
+        if (first.status !== 401)
+            return first;
+        this.loginResult = undefined;
+        this.version = undefined;
+        return this.send(input);
+    }
+    async send(input) {
+        if (!this.loginResult)
+            await this.login();
+        let timer;
+        try {
+            return await Promise.race([
+                this.http.request({
+                    path: input.path,
+                    method: input.method,
+                    ...(input.query ? { query: input.query } : {}),
+                    ...(input.body === undefined ? {} : { body: input.body }),
+                    ...(input.responseType === undefined ? {} : { responseType: input.responseType }),
+                    ...(input.multipart === undefined ? {} : { multipart: input.multipart }),
+                    headers: { ...this.headers(), ...(input.headers ?? {}) },
+                }),
+                new Promise((_, reject) => {
+                    timer = setTimeout(() => reject(new CloudPivotRequestTimeoutError(input.path, this.requestTimeoutMs)), this.requestTimeoutMs);
+                }),
+            ]);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+    get httpHandle() {
+        return this.http;
+    }
+}
+function detectVersion(systemConfig) {
+    if (!systemConfig)
+        return undefined;
+    for (const key of ["version", "sysVersion", "systemVersion", "productVersion", "serverVersion"]) {
+        const value = systemConfig[key];
+        if (typeof value !== "string")
+            continue;
+        // Accept a bare "8.6.26" and a product-prefixed string such as
+        // "AI-Platform-v1.1.22" (pull the first dotted numeric run).
+        const match = value.match(/(\d+\.\d+(?:\.\d+)?)/);
+        if (match)
+            return match[1];
+    }
+    return undefined;
+}
+/**
+ * A request that produced no response within the timeout. Without this, a
+ * stalled CloudPivot (e.g. mid-restart) would leave a write hanging forever and
+ * hold the per-environment write lease, blocking every later call.
+ */
+export class CloudPivotRequestTimeoutError extends Error {
+    path;
+    timeoutMs;
+    constructor(path, timeoutMs) {
+        super(`CloudPivot request timed out after ${timeoutMs}ms: ${path}`);
+        this.path = path;
+        this.timeoutMs = timeoutMs;
+        this.name = "CloudPivotRequestTimeoutError";
+    }
+}
+function defaultRequestTimeoutMs() {
+    const raw = process.env.OMC_HTTP_TIMEOUT_MS;
+    const parsed = raw ? Number(raw) : NaN;
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : 120_000;
+}
+//# sourceMappingURL=session.js.map

package/dist/skills.js

@@ -0,0 +1,112 @@
+import { readFileSync, readdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+/**
+ * The methodology layer is reachable from the CLI as `omc help <topic>`.
+ * These package files are the single source of truth for the shipped help
+ * topics.
+ *
+ * The files ship with the package (package-root `skills/`), not inside dist/,
+ * so the docs travel with the binary at the same version — the property that
+ * makes `git help <concept>` reliable and a docs-site link unreliable.
+ */
+const skillsDir = join(dirname(fileURLToPath(import.meta.url)), "..", "skills");
+function frontmatterDescription(text) {
+    const match = /^---\r?\n([\s\S]*?)\r?\n---/.exec(text);
+    const line = match?.[1]?.split(/\r?\n/).find((entry) => entry.startsWith("description:"));
+    return line?.slice("description:".length).trim() || undefined;
+}
+function skillFiles() {
+    try {
+        return readdirSync(skillsDir).filter((file) => file.endsWith(".md")).sort();
+    }
+    catch {
+        return [];
+    }
+}
+/** Every methodology topic exposed by `omc help`. */
+export function listSkills() {
+    return skillFiles().map((file) => {
+        const name = file.replace(/\.md$/, "");
+        let description = `OMC methodology: ${name}`;
+        try {
+            description = frontmatterDescription(readFileSync(join(skillsDir, file), "utf8")) ?? description;
+        }
+        catch {
+            // Unreadable file still lists by name; reading it reports the error.
+        }
+        return { name, description };
+    });
+}
+/** Read one methodology topic for `omc help <topic>`. */
+export function readSkill(name) {
+    if (!/^[a-z0-9-]+$/.test(name))
+        return undefined;
+    const entry = listSkills().find((skill) => skill.name === name);
+    if (entry === undefined)
+        return undefined;
+    try {
+        return { ...entry, content: readFileSync(join(skillsDir, `${name}.md`), "utf8") };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Return one Markdown heading and its nested content without loading the full topic into the envelope. */
+export function readSkillSection(name, requested) {
+    const document = readSkill(name);
+    if (!document)
+        return undefined;
+    const lines = document.content.split(/\r?\n/);
+    const headings = lines.flatMap((line) => {
+        const match = /^(#{1,6})\s+(.+?)\s*$/.exec(line);
+        return match ? [match[2]] : [];
+    });
+    const normalized = requested.trim().toLowerCase();
+    // A requested section may be given by its ordered number ("8") instead of the
+    // full heading ("8. Canonical configuration order（规范配置顺序）") — the
+    // route lists headings, but agents also number-jump. Match on the leading
+    // ordinal too, so a numeric request does not waste a retry.
+    const requestedOrdinal = /^(\d+)(?:[.\)、]|\s|$)/.exec(normalized)?.[1];
+    const matches = (heading) => {
+        if (heading === normalized)
+            return true;
+        if (heading.replace(/[^\p{L}\p{N}]+/gu, "-").toLowerCase() === normalized)
+            return true;
+        if (requestedOrdinal !== undefined) {
+            const headingOrdinal = /^(\d+)(?:[.\)、]|\s|$)/.exec(heading)?.[1];
+            if (headingOrdinal === requestedOrdinal)
+                return true;
+        }
+        return false;
+    };
+    let start = lines.findIndex((line) => {
+        const match = /^(#{1,6})\s+(.+?)\s*$/.exec(line);
+        return match !== null && matches(match[2].trim().toLowerCase());
+    });
+    // Forgiving fallback: a unique prefix/substring match ("流程" for "流程字段权限").
+    // A non-unique partial matches nothing (precision over recall) and the
+    // not-found error lists the real headings, so the caller can retry once.
+    if (start < 0 && normalized.length >= 2) {
+        const partial = lines.filter((line) => {
+            const match = /^(#{1,6})\s+(.+?)\s*$/.exec(line);
+            return match !== null && match[2].trim().toLowerCase().includes(normalized);
+        });
+        if (partial.length === 1)
+            start = lines.indexOf(partial[0]);
+    }
+    if (start < 0)
+        return { document, section: "", headings };
+    const startMatch = /^(#{1,6})\s+(.+?)\s*$/.exec(lines[start]);
+    const level = startMatch[1].length;
+    let end = lines.length;
+    for (let index = start + 1; index < lines.length; index += 1) {
+        const match = /^(#{1,6})\s+(.+?)\s*$/.exec(lines[index]);
+        if (match && match[1].length <= level) {
+            end = index;
+            break;
+        }
+    }
+    return { document, section: lines.slice(start, end).join("\n").trim() + "\n", headings };
+}
+//# sourceMappingURL=skills.js.map

package/dist/support.js

@@ -0,0 +1,98 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { createHash } from "node:crypto";
+import { wireCall, wireRows, WireError } from "./wire.js";
+import { ENDPOINTS } from "./endpoints.js";
+/**
+ * Cross-cutting primitives with no governance policy of their own: hashing,
+ * artifact writing, wire-error classification, the coverage refusal shape, and
+ * application-tree resolution. Every pipeline module (plan/read/write/package/
+ * context) leans on these; none of them may lean back.
+ */
+export function sha256(value) {
+    return createHash("sha256").update(JSON.stringify(sortForHash(value))).digest("hex");
+}
+function sortForHash(value) {
+    if (Array.isArray(value))
+        return value.map(sortForHash);
+    if (value && typeof value === "object")
+        return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, entry]) => [key, sortForHash(entry)]));
+    return value;
+}
+export function jsonBytes(value) {
+    return Buffer.byteLength(JSON.stringify(value) ?? "null");
+}
+/** Token-diet summary of an arbitrary value: arrays/objects/long strings become counts + hashes. */
+export function summarizeValue(value) {
+    if (Array.isArray(value))
+        return { count: value.length, sha256: sha256(value) };
+    if (value && typeof value === "object")
+        return { keys: Object.keys(value).sort(), sha256: sha256(value) };
+    if (typeof value === "string" && value.length > 160)
+        return { length: value.length, sha256: sha256(value) };
+    return value;
+}
+export function writeArtifact(ctx, name, body) {
+    mkdirSync(ctx.artifactsDir, { recursive: true });
+    const detailFile = join(ctx.artifactsDir, name).replaceAll("\\\\", "/");
+    const text = JSON.stringify(body, null, 2) + "\n";
+    writeFileSync(detailFile, text);
+    return { detailFile, detailSha256: createHash("sha256").update(text).digest("hex") };
+}
+export function isUncertainWireError(error) {
+    if (error instanceof WireError)
+        return error.kind === "transport" || error.kind === "http-status";
+    return error instanceof Error && /transport failed|transport outage|fetch failed|ENOTFOUND|ECONNREFUSED|timed? ?out|network/i.test(error.message);
+}
+export function wireErrorKind(error) {
+    return error instanceof WireError ? error.kind : "auth-transport";
+}
+export function refusalFromCoverage(error) {
+    const citation = error.citation;
+    // Ticket 84: surface the citation message at the top level too, so the
+    // self-correcting lane hints (closest lane id, valid values, omission
+    // default) are visible without opening the citation.
+    if (citation)
+        return { status: "refused", blocker: "capability-out-of-coverage", message: citation.message, citation };
+    throw error;
+}
+/**
+ * Resolve the application code for a call. Priority order (the user's
+ * directive, encoded end-to-end):
+ *   1. explicit argument (`args.applicationCode`)
+ *   2. project-environment binding (the env that OMC_ENV / .omc-env selects,
+ *      via `session.profile.applicationCode` — `resolveEnvironment` itself
+ *      honors the OMC_ENV > .omc-env > default priority chain, so this
+ *      field already reflects the project-env binding)
+ *   3. the tenant's first application (fallback when the configured env
+ *      leaves `applicationCode` blank — the agent can still operate across
+ *      applications via discover_environment)
+ * The configured applicationCode is a hint, never the only application —
+ * callers may operate across applications.
+ */
+export async function resolveApplicationCode(session, requested) {
+    if (typeof requested === "string" && requested.trim())
+        return requested.trim();
+    if (session.profile.applicationCode && session.profile.applicationCode.trim())
+        return session.profile.applicationCode;
+    const apps = wireRows((await wireCall(session, { path: ENDPOINTS.applicationList, query: {} })).data);
+    const first = apps.find((row) => typeof (row.appCode ?? row.code) === "string");
+    const code = first ? String(first.appCode ?? first.code) : "";
+    if (!code)
+        throw new WireError("business", "no application found for this environment", 302001);
+    return code;
+}
+export function flattenTreeRows(rows) {
+    const flat = [];
+    const visit = (row) => {
+        flat.push(row);
+        if (Array.isArray(row.children))
+            for (const child of row.children)
+                if (child && typeof child === "object")
+                    visit(child);
+    };
+    for (const row of rows)
+        visit(row);
+    return flat;
+}
+//# sourceMappingURL=support.js.map