@stalfh233/omc-cli 0.0.0-stage → 0.4.10

package/dist/tool-types.js

@@ -0,0 +1,127 @@
+import { z } from "zod";
+export class ToolRefusalError extends Error {
+    payload;
+    constructor(payload) {
+        super(String(payload["blocker"] ?? "tool refused"));
+        this.payload = payload;
+    }
+}
+/**
+ * The most informative message an error carries. `ToolRefusalError.message` is
+ * the BLOCKER code (its constructor sets it so), while the actionable human
+ * detail lives in `payload.message` — a refusal family whose detail is the
+ * platform shape (e.g. datarule options, bizservice config) must not lose it
+ * when an offline validator catches and re-serializes the error.
+ */
+export function errorDetail(error) {
+    if (error instanceof ToolRefusalError)
+        return String(error.payload["message"] ?? error.message);
+    return error instanceof Error ? error.message : String(error);
+}
+export class ToolUncertainError extends Error {
+    payload;
+    constructor(payload) {
+        super(String(payload["reason"] ?? "tool frozen uncertain"));
+        this.payload = payload;
+    }
+}
+export class ToolInputError extends Error {
+    payload;
+    constructor(payload) {
+        super(String(payload.message ?? "tool input is invalid"));
+        this.payload = payload;
+    }
+}
+/**
+ * Generic registration factory: the single place the untyped wire `args`
+ * (`Record<string, unknown>`, supplied by the CLI transport after schema
+ * validation) is re-typed to `z.infer<z.ZodObject<S>>`. Every lane handler
+ * receives fully typed args from its own inputSchema, so lane code never
+ * needs `args.x as T` assertions; the cast lives only at this boundary.
+ */
+export function defineTool(definition) {
+    return definition;
+}
+/**
+ * Same object, different key per tool family (round 4, from the live key-name
+ * confusion: `configure_form` answered `sheetCode: Required` while the caller
+ * passed the model's `schemaCode`). When a required key is missing but a known
+ * synonym was supplied, say so instead of only "Required".
+ */
+const KEY_SYNONYMS = Object.freeze({
+    sheetCode: ["schemaCode", "code"],
+    workflowCode: ["code", "schemaCode"],
+    schemaCode: ["code", "sheetCode", "workflowCode"],
+    code: ["schemaCode", "sheetCode", "workflowCode"],
+    ruleCode: ["code"],
+});
+/**
+ * Per-tool input aliases: a synonym the caller may send INSTEAD of the canonical
+ * key. Applied in `parseToolInput` BEFORE validation (fill canonical from an
+ * alias only when the canonical key is absent). Deliberately per-tool and NOT
+ * global: `code`'s synonyms (`schemaCode`/`workflowCode`) are NOT interchangeable
+ * on every tool (e.g. `workflow.create`'s `code` is the NEW workflow, while
+ * `workflowCode` is a different object), so a global mapping would silently
+ * misroute arguments. Only add an entry when the two keys name the SAME object.
+ *
+ * Round 10 (sandbox 47): an agent sent `workflowCode` to `workflow.update` and got
+ * `code: Required`; the read tools take `workflowCode`, the write tools take
+ * `code`, and they name the same workflow.
+ */
+const TOOL_INPUT_ALIASES = Object.freeze({
+    "workflow.create": Object.freeze({ code: ["workflowCode"] }),
+    "workflow.update": Object.freeze({ code: ["workflowCode"] }),
+    "workflow.publish": Object.freeze({ code: ["workflowCode"] }),
+    "workflow.delete": Object.freeze({ code: ["workflowCode"] }),
+    // field family: the platform's own column key is `propertyCode`; the tool's is
+    // `code`. Same field, so the alias is safe either direction.
+    "field.create": Object.freeze({ code: ["propertyCode"] }),
+    "field.update": Object.freeze({ code: ["propertyCode"] }),
+    "field.delete": Object.freeze({ code: ["propertyCode"] }),
+    // data.load's row id: callers habitually send `id` (bench67 wasted a round on
+    // `bizObjectId: Required`). On this tool `id` unambiguously names the same
+    // business object, so fill the canonical key rather than fail.
+    "data.load": Object.freeze({ bizObjectId: ["id"] }),
+});
+function applyInputAliases(tool, input) {
+    const aliases = TOOL_INPUT_ALIASES[tool.name];
+    if (!aliases)
+        return input;
+    let normalized;
+    for (const [canonical, synonyms] of Object.entries(aliases)) {
+        if (input[canonical] !== undefined)
+            continue;
+        const hit = synonyms.find((synonym) => input[synonym] !== undefined);
+        if (hit === undefined)
+            continue;
+        normalized ??= { ...input };
+        normalized[canonical] = input[hit];
+    }
+    return normalized ?? input;
+}
+function keyRenameHint(issuePath, input) {
+    const key = typeof issuePath[0] === "string" ? issuePath[0] : undefined;
+    if (!key)
+        return undefined;
+    const synonyms = (KEY_SYNONYMS[key] ?? []).filter((candidate) => input[candidate] !== undefined);
+    if (synonyms.length === 0)
+        return undefined;
+    // Round 10: list ALL synonyms the caller actually sent, not just the first — an
+    // agent that sent BOTH schemaCode and workflowCode for a `code` slot was told
+    // "你传的是 schemaCode", which pointed at the wrong key.
+    return `（该对象在本工具里的键是 ${key}，你传的是 ${synonyms.join("/")}；键名对照见 omc-tool-selection 的 Key-name table）`;
+}
+export function parseToolInput(tool, input) {
+    const normalized = applyInputAliases(tool, input);
+    const result = z.object(tool.inputSchema).safeParse(normalized);
+    if (result.success)
+        return result.data;
+    throw new ToolInputError({
+        status: "error",
+        blocker: "tool-input-invalid",
+        tool: tool.name,
+        message: result.error.issues.map((issue) => `${issue.path.join(".") || "args"}: ${issue.message}${keyRenameHint(issue.path, normalized) ?? ""}`).join("; "),
+        issues: result.error.issues.map((issue) => ({ path: issue.path, code: issue.code, message: issue.message, ...(keyRenameHint(issue.path, normalized) ? { hint: keyRenameHint(issue.path, normalized) } : {}) })),
+    });
+}
+//# sourceMappingURL=tool-types.js.map

package/dist/tools.js

@@ -0,0 +1,59 @@
+import { loadCoverageManifest } from "./coverage.js";
+import { makeToolContext } from "./context.js";
+import { registerMetaLane } from "./lanes/meta.js";
+import { registerEnvironmentLane } from "./lanes/environment.js";
+import { registerAppLane } from "./lanes/app.js";
+import { registerDictionaryLane } from "./lanes/dictionary.js";
+import { registerModelLane } from "./lanes/model.js";
+import { registerFieldLane } from "./lanes/field.js";
+import { registerDataRuleLane } from "./lanes/datarule.js";
+import { registerFormLane } from "./lanes/form.js";
+import { registerBusinessRuleLane } from "./lanes/businessrule.js";
+import { registerRuleLifecycleLane } from "./lanes/rule-lifecycle.js";
+import { registerRuntimeDataLane } from "./lanes/runtime-data.js";
+import { registerWorkflowLane } from "./lanes/workflow.js";
+import { registerOnlineJsLane } from "./lanes/online-js.js";
+import { registerB2Lane } from "./lanes/b2-registration.js";
+import { registerListViewLane } from "./lanes/list-view.js";
+import { registerReportLane } from "./lanes/report.js";
+import { registerApplyChangesLane } from "./lanes/apply-changes.js";
+import { executionMetadataFor } from "./execution-metadata.js";
+export { ToolRefusalError, ToolUncertainError } from "./tool-types.js";
+export { makeToolContext };
+/**
+ * Composition root: assemble the governed tool surface from one adapter
+ * module per configuration lane. The lane modules own their tool
+ * registration, wire DTO construction, readback decoding, and lane/scope
+ * declarations; the shared governance pipelines live in ./read.ts / ./write.ts
+ * / ./package.ts (planning in ./plan.ts, wiring in ./context.ts).
+ */
+export function buildToolRegistry() {
+    const tools = [];
+    registerMetaLane(tools);
+    registerEnvironmentLane(tools);
+    registerAppLane(tools);
+    registerDictionaryLane(tools);
+    registerModelLane(tools);
+    registerFieldLane(tools);
+    registerDataRuleLane(tools);
+    registerFormLane(tools);
+    registerBusinessRuleLane(tools);
+    registerRuleLifecycleLane(tools);
+    registerRuntimeDataLane(tools);
+    registerWorkflowLane(tools);
+    registerOnlineJsLane(tools);
+    registerB2Lane(tools);
+    registerListViewLane(tools);
+    registerReportLane(tools);
+    // LAST: apply_changes looks up sibling write tools at call time, so it must
+    // capture the fully-populated registry array.
+    registerApplyChangesLane(tools);
+    for (const tool of tools) {
+        const metadata = executionMetadataFor(tool);
+        if (metadata)
+            tool.executionMetadata = metadata;
+    }
+    return tools;
+}
+export { loadCoverageManifest };
+//# sourceMappingURL=tools.js.map

package/dist/usage-log.js

@@ -0,0 +1,197 @@
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { dirname, resolve } from "node:path";
+let pending;
+function logPath() {
+    const explicit = process.env.OMC_USAGE_LOG;
+    if (explicit)
+        return resolve(explicit);
+    const projectEnv = resolve(process.cwd(), ".omc-env");
+    return existsSync(projectEnv) ? resolve(process.cwd(), ".omc", "usage.jsonl") : undefined;
+}
+function commandOf(argv) {
+    const values = [];
+    for (let index = 2; index < argv.length && values.length < 2; index += 1) {
+        const token = argv[index];
+        if (token.startsWith("--")) {
+            if (["--out", "--max-output-bytes", "--args", "--args-file", "--env", "--environment", "--request-id", "--timeout-ms", "--wait", "--path"].includes(token))
+                index += 1;
+            continue;
+        }
+        values.push(token);
+    }
+    return values.join(" ") || "(none)";
+}
+function facesOf(argv) {
+    // `--json` is included: `commands` and `commands --json` differ by ~48 KB
+    // (bounded index vs full catalogue) but `commandOf` drops every flag, so
+    // without this they were indistinguishable in the log and byte attribution
+    // was ambiguous (round 10).
+    const faces = ["--full", "--compact", "--json", "--schema-only", "--param", "--example", "--section", "--sections", "--out", "--quiet"];
+    return faces.filter((face) => argv.includes(face));
+}
+const safeArgumentKeys = new Set(["schemaCode", "propertyCode", "code", "workflowCode", "ruleCode", "sheetCode", "id", "dataRuleType", "propertyType", "published", "handler"]);
+function summarizeArgs(argv) {
+    const summary = { argKeys: [] };
+    const argsIndex = argv.indexOf("--args");
+    if (argsIndex >= 0) {
+        try {
+            const parsed = JSON.parse(argv[argsIndex + 1] ?? "{}");
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                const keys = Object.keys(parsed).sort();
+                summary.argKeys = keys;
+                for (const key of keys)
+                    if (safeArgumentKeys.has(key)) {
+                        const value = parsed[key];
+                        if (typeof value === "string" || typeof value === "number" || typeof value === "boolean")
+                            summary[key] = value;
+                    }
+            }
+        }
+        catch {
+            summary.argKeys = ["<invalid-json>"];
+        }
+    }
+    const envIndex = argv.findIndex((token) => token === "--env" || token === "--environment");
+    if (envIndex >= 0 && argv[envIndex + 1])
+        summary.environment = argv[envIndex + 1];
+    const sectionIndex = argv.indexOf("--section");
+    if (sectionIndex >= 0 && argv[sectionIndex + 1])
+        summary.section = argv[sectionIndex + 1];
+    if (argv.includes("--sections"))
+        summary.sections = true;
+    return summary;
+}
+export function beginUsage(argv) {
+    const path = logPath();
+    if (!path)
+        return;
+    const raw = argv.slice(2).join("\u0000");
+    const argsDigest = createHash("sha256").update(raw).digest("hex");
+    pending = {
+        id: createHash("sha256").update(`${Date.now()}\u0000${raw}`).digest("hex").slice(0, 16),
+        startedAt: new Date().toISOString(),
+        startedMs: Date.now(),
+        command: commandOf(argv),
+        argsDigest,
+        argSummary: summarizeArgs(argv),
+        faces: facesOf(argv),
+        stdoutBytes: 0,
+        fileBytes: 0,
+        status: "no-envelope",
+    };
+}
+export function recordUsageOutput(value, stdoutBytes, fileBytes = 0) {
+    if (!pending)
+        return;
+    const envelope = value && typeof value === "object" ? value : {};
+    const error = envelope.error && typeof envelope.error === "object" ? envelope.error : undefined;
+    pending.stdoutBytes = stdoutBytes;
+    pending.fileBytes = fileBytes;
+    pending.status = String(envelope.status ?? "unknown");
+    if (typeof error?.code === "string")
+        pending.errorCode = error.code;
+}
+export function completeUsage(exitCode) {
+    if (!pending)
+        return;
+    const current = pending;
+    pending = undefined;
+    const path = logPath();
+    if (!path)
+        return;
+    mkdirSync(dirname(path), { recursive: true });
+    const record = {
+        kind: "invocation",
+        id: current.id,
+        startedAt: current.startedAt,
+        command: current.command,
+        argsDigest: current.argsDigest,
+        argSummary: current.argSummary,
+        faces: current.faces,
+        stdoutBytes: current.stdoutBytes,
+        fileBytes: current.fileBytes,
+        durationMs: Date.now() - current.startedMs,
+        status: current.status,
+        exitCode,
+        ...(current.errorCode ? { errorCode: current.errorCode } : {}),
+    };
+    appendFileSync(path, `${JSON.stringify(record)}\n`, "utf8");
+}
+function readUsage(path) {
+    if (!existsSync(path))
+        return [];
+    return readFileSync(path, "utf8").split(/\r?\n/).filter(Boolean).flatMap((line) => {
+        try {
+            const value = JSON.parse(line);
+            return value && typeof value === "object" ? [value] : [];
+        }
+        catch {
+            return [];
+        }
+    });
+}
+export function usageReport(pathArg) {
+    const path = pathArg ? resolve(pathArg) : logPath() ?? resolve(process.cwd(), ".omc", "usage.jsonl");
+    const records = readUsage(path);
+    const calls = records.filter((record) => record.kind === "invocation");
+    const commandCounts = new Map();
+    let stdoutBytes = 0;
+    let fileBytes = 0;
+    let fullCalls = 0;
+    for (const record of calls) {
+        const command = String(record.command ?? "(unknown)");
+        commandCounts.set(command, (commandCounts.get(command) ?? 0) + 1);
+        stdoutBytes += Number(record.stdoutBytes ?? 0);
+        fileBytes += Number(record.fileBytes ?? 0);
+        if (Array.isArray(record.faces) && record.faces.includes("--full"))
+            fullCalls += 1;
+    }
+    const repeated = [...commandCounts.entries()].filter(([, count]) => count > 1).map(([command, count]) => ({ command, count }));
+    const exactCounts = new Map();
+    const createdCodes = new Set();
+    const referencedCodes = new Set();
+    for (const record of calls) {
+        const summary = record.argSummary && typeof record.argSummary === "object" ? record.argSummary : {};
+        const command = String(record.command ?? "");
+        const digest = `${command}:${String(record.argsDigest ?? "")}`;
+        exactCounts.set(digest, (exactCounts.get(digest) ?? 0) + 1);
+        if (command === "call model.create" && typeof summary.code === "string")
+            createdCodes.add(summary.code);
+        for (const key of ["schemaCode", "workflowCode"])
+            if (typeof summary[key] === "string")
+                referencedCodes.add(summary[key]);
+    }
+    const exactRepeated = [...exactCounts.entries()].filter(([, count]) => count > 1).map(([digest, count]) => ({ digest: digest.slice(-16), count }));
+    const unseenTargetReferences = [...referencedCodes].filter((code) => !createdCodes.has(code));
+    // Round 4: attribute large reads. The complex benchmark showed `artifact get`
+    // at 56% of stdout; without this the next session cannot see the whale.
+    const artifactBytes = calls.filter((record) => String(record.command).startsWith("artifact get")).reduce((sum, record) => sum + Number(record.stdoutBytes ?? 0), 0);
+    const largestReads = calls
+        .filter((record) => Number(record.stdoutBytes ?? 0) >= 8192)
+        .map((record) => ({ command: String(record.command ?? ""), bytes: Number(record.stdoutBytes ?? 0), summary: record.argSummary ?? {} }))
+        .sort((left, right) => right.bytes - left.bytes)
+        .slice(0, 8);
+    const violations = [
+        ...(fullCalls > 3 ? [{ code: "batch-full-prefetch", message: `${fullCalls} calls used --full; prefer next/recipe/default describe` }] : []),
+        ...(calls.some((record) => String(record.command).startsWith("commands") && !Array.isArray(record.faces)) ? [{ code: "broad-command-catalog", message: "full commands inventory was requested" }] : []),
+        ...(artifactBytes > 32768 ? [{ code: "large-artifact-read", message: `artifact get pulled ${artifactBytes} B; prefer --summary/--keys/--jq or the projected workflow summary` }] : []),
+    ];
+    return {
+        status: "ok",
+        path,
+        calls: calls.length,
+        stdoutBytes,
+        fileBytes,
+        fullCalls,
+        repeated,
+        exactRepeated,
+        createdCodes: [...createdCodes],
+        unseenTargetReferences,
+        artifactBytes,
+        largestReads,
+        violations,
+        records,
+    };
+}
+//# sourceMappingURL=usage-log.js.map

package/dist/wire.js

@@ -0,0 +1,287 @@
+import { CloudPivotRequestTimeoutError } from "./session.js";
+import { ENDPOINTS } from "./endpoints.js";
+/**
+ * Generic governed wire driver. Decodes the CloudPivot envelope
+ * ({errcode, errmsg, data}) with Void-envelope semantics, and classifies
+ * failures: business errors are definitive refusals; transport failures are
+ * UNCERTAIN — callers must freeze, never assume success.
+ */
+export class WireError extends Error {
+    kind;
+    errcode;
+    diagnostic;
+    constructor(kind, message, errcode, 
+    /** Round-2 T-06: diagnosable context for malformed/http-status envelopes. */
+    diagnostic) {
+        super(message);
+        this.kind = kind;
+        this.errcode = errcode;
+        this.diagnostic = diagnostic;
+    }
+}
+/** Redact common secret keys and truncate — the malformed-envelope preview must be safe to log. */
+function redactedBodyPreview(body, limit = 200) {
+    let text;
+    try {
+        text = typeof body === "string" ? body : JSON.stringify(body);
+    }
+    catch {
+        return "<unserializable>";
+    }
+    if (text === undefined)
+        return "<empty>";
+    const redacted = text.replace(/("(?:token|password|passwd|secret|authorization|access[_-]?token|refresh[_-]?token|code|privateKey|clientSecret)"\s*:\s*)"[^"]*"/gi, '$1"***"');
+    return redacted.length > limit ? `${redacted.slice(0, limit)}…` : redacted;
+}
+/**
+ * Per-session read cache for DESIGN-TIME metadata GETs only (ticket 16).
+ *
+ * Cached faces (sheetGet / fieldList / applicationTree) change only through
+ * this session's design-surface POSTs, so every write invalidates exactly the
+ * entries its wire family can mutate — scoped by the schema code carried in
+ * the POST body. Rule-face and list-view query-face POSTs mutate none of the
+ * cached faces and therefore invalidate nothing. Runtime-data / workflow /
+ * auth POSTs never invalidate either: they cannot change a form schema, field
+ * metadata, or the app directory tree. Unknown /api/api/app/ writes still
+ * clear everything (fail safe). A 60s TTL bounds staleness against
+ * out-of-band mutations (e.g. a human designer in the same environment);
+ * failures are never cached; hits return a deep clone so callers cannot
+ * poison the cache by mutating the payload.
+ */
+const READ_CACHE_PATHS = new Set([ENDPOINTS.sheetGet, ENDPOINTS.fieldList, ENDPOINTS.applicationTree]);
+export const WIRE_READ_CACHE_TTL_MS = 60_000;
+const readCacheBySession = new WeakMap();
+let totalHits = 0;
+let totalMisses = 0;
+let clock = () => Date.now();
+/** Aggregated since the last reset (bench: one reset per harness). */
+export function wireReadCacheStats() {
+    return { hits: totalHits, misses: totalMisses };
+}
+export function resetWireReadCacheStats() {
+    totalHits = 0;
+    totalMisses = 0;
+}
+/** Test seam for TTL expiry. */
+export function __setWireCacheClockForTests(override) {
+    clock = override ?? (() => Date.now());
+}
+function cacheKey(path, query) {
+    const sorted = Object.keys(query)
+        .sort()
+        .map((key) => `${encodeURIComponent(key)}=${encodeURIComponent(query[key] ?? "")}`)
+        .join("&");
+    return sorted ? `${path}?${sorted}` : path;
+}
+function readCacheStateOf(session) {
+    let state = readCacheBySession.get(session);
+    if (!state) {
+        state = { entries: new Map() };
+        readCacheBySession.set(session, state);
+    }
+    return state;
+}
+/** Schema codes referenced by a write body (schemaCode / bizSchemaCode, plus BizModel array items' code). */
+function schemaCodesFromBody(body) {
+    const codes = new Set();
+    const visit = (value) => {
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                visit(item);
+                if (item && typeof item === "object" && item.type === "BizModel") {
+                    const code = item.code;
+                    if (typeof code === "string" && code)
+                        codes.add(code);
+                }
+            }
+            return;
+        }
+        if (value && typeof value === "object") {
+            const record = value;
+            for (const key of ["schemaCode", "bizSchemaCode"]) {
+                const code = record[key];
+                if (typeof code === "string" && code)
+                    codes.add(code);
+            }
+        }
+    };
+    visit(body);
+    return [...codes];
+}
+function invalidateReadCache(session, call) {
+    const state = readCacheBySession.get(session);
+    if (!state || state.entries.size === 0)
+        return;
+    const dropSchemaScoped = (paths, codes) => {
+        for (const [key, entry] of state.entries) {
+            if (!paths.includes(entry.result.path))
+                continue;
+            if (codes.length === 0 || codes.includes(entry.query.schemaCode ?? ""))
+                state.entries.delete(key);
+        }
+    };
+    const dropAll = (paths) => {
+        for (const [key, entry] of state.entries)
+            if (paths.includes(entry.result.path))
+                state.entries.delete(key);
+    };
+    const fieldPaths = [ENDPOINTS.fieldCreate, ENDPOINTS.fieldUpdate, ENDPOINTS.fieldPublish, ENDPOINTS.fieldDelete, ENDPOINTS.fieldForceDelete];
+    // Rule-face and list-view query-face POSTs never mutate the cached faces:
+    // rule metadata and query views are stored independently of the bizsheet
+    // layout JSONs, bizproperty field metadata, and the app directory tree
+    // (live evidence: ticket 14 rule save→enable→rule.get round-trip leaves the
+    // form readback unchanged). Everything else under /api/api/app/ stays in the
+    // fail-safe clear-all branch below.
+    const nonCachingDesignWrites = new Set([
+        ENDPOINTS.businessRuleCreate,
+        ENDPOINTS.businessRuleUpdate,
+        ENDPOINTS.businessRulePublish,
+        ENDPOINTS.businessRuleEnable,
+        ENDPOINTS.businessRuleDelete,
+        ENDPOINTS.listQueryCreate,
+        ENDPOINTS.listQueryUpdate,
+        ENDPOINTS.listQueryDelete,
+        // Field-level data rules live in their own metadata table and never
+        // rewrite the bizsheet layout, bizproperty field rows, or app tree
+        // (BizDataRuleController writes h_biz_data_rule only).
+        ENDPOINTS.dataRuleCreate,
+        ENDPOINTS.dataRuleUpdate,
+        ENDPOINTS.dataRuleDelete,
+    ]);
+    const path = call.path;
+    if (fieldPaths.includes(path)) {
+        // Field writes change the field faces; sheet metadata is dropped for the
+        // same schema as a conservative guard.
+        dropSchemaScoped([ENDPOINTS.fieldList, ENDPOINTS.sheetGet], schemaCodesFromBody(call.body));
+    }
+    else if (path === ENDPOINTS.sheetCreate || path === ENDPOINTS.sheetUpdate || path === ENDPOINTS.sheetPublish) {
+        dropSchemaScoped([ENDPOINTS.sheetGet], schemaCodesFromBody(call.body));
+        dropAll([ENDPOINTS.applicationTree]);
+    }
+    else if (path === ENDPOINTS.modelCreate || path === ENDPOINTS.appPackagePhysicallyDelete) {
+        // Model create/delete reshapes the app tree; cascade delete also removes
+        // the model's fields and forms.
+        dropSchemaScoped([ENDPOINTS.fieldList, ENDPOINTS.sheetGet], schemaCodesFromBody(call.body));
+        dropAll([ENDPOINTS.applicationTree]);
+    }
+    else if (nonCachingDesignWrites.has(path)) {
+        // Rule/query writes never mutate the cached faces — nothing to drop.
+    }
+    else if (path.startsWith("/api/api/app/")) {
+        // Unknown design-surface write — fail safe, drop everything cached.
+        state.entries.clear();
+    }
+    // runtime/workflow/auth/programming writes never mutate the cached faces.
+}
+export async function wireCall(session, call) {
+    const isPost = call.method === "POST";
+    if (isPost)
+        invalidateReadCache(session, call);
+    const cacheable = !isPost && READ_CACHE_PATHS.has(call.path);
+    const state = cacheable ? readCacheStateOf(session) : undefined;
+    const key = state ? cacheKey(call.path, call.query ?? {}) : "";
+    if (state) {
+        const entry = state.entries.get(key);
+        if (entry && clock() - entry.storedAt < WIRE_READ_CACHE_TTL_MS) {
+            totalHits += 1;
+            return structuredClone(entry.result);
+        }
+        if (entry)
+            state.entries.delete(key);
+        totalMisses += 1;
+    }
+    const response = await session.request({
+        path: call.path,
+        method: call.method ?? "GET",
+        ...(call.query ? { query: call.query } : {}),
+        ...(call.body === undefined ? {} : { body: call.body }),
+    }).catch((error) => {
+        // A timeout leaves the outcome unknown — classify it as a transport
+        // failure so the governance layer freezes instead of assuming success.
+        if (error instanceof CloudPivotRequestTimeoutError)
+            throw new WireError("transport", error.message);
+        throw error;
+    });
+    if (response.status < 200 || response.status >= 300)
+        throw new WireError("http-status", `HTTP ${response.status} for ${call.path} (${call.method ?? "GET"}); body: ${redactedBodyPreview(response.body)}`, undefined, {
+            httpStatus: response.status,
+            bodyPreview: redactedBodyPreview(response.body),
+        });
+    const body = response.body;
+    if (!body || typeof body !== "object")
+        throw new WireError("malformed-envelope", `non-object envelope for ${call.path} (${call.method ?? "GET"}); body: ${redactedBodyPreview(body)}`, undefined, { bodyPreview: redactedBodyPreview(body) });
+    const envelope = body;
+    if (typeof envelope.errcode !== "number")
+        // Round-2 T-06: a non-numeric errcode previously gave no clue WHICH
+        // business condition the platform meant (exists / validation / error). The
+        // message now carries the method, endpoint, and a redacted body preview.
+        throw new WireError("malformed-envelope", `envelope for ${call.path} (${call.method ?? "GET"}) has no numeric errcode; body: ${redactedBodyPreview(body)}`, undefined, { httpStatus: response.status, bodyPreview: redactedBodyPreview(body) });
+    if (envelope.errcode !== 0) {
+        const message = typeof envelope.errmsg === "string" ? envelope.errmsg : "CloudPivot rejected the request";
+        throw new WireError("business", `errcode ${envelope.errcode} for ${call.path}: ${message}`, envelope.errcode);
+    }
+    const result = {
+        path: call.path,
+        httpStatus: response.status,
+        errcode: envelope.errcode,
+        data: envelope.data ?? null,
+        readbackFingerprint: "",
+    };
+    if (state)
+        state.entries.set(key, { result: structuredClone(result), query: call.query ?? {}, storedAt: clock() });
+    return result;
+}
+/** List rows from the standard list envelope (array or {data:[]}). */
+export function wireRows(value) {
+    const rows = Array.isArray(value)
+        ? value
+        : value && typeof value === "object" && Array.isArray(value.data)
+            ? value.data
+            : undefined;
+    if (!rows || !rows.every((row) => row && typeof row === "object"))
+        throw new WireError("malformed-envelope", "expected row array in envelope data");
+    return rows;
+}
+/**
+ * Ticket 106 — binary POST download (the bizservice export answers a ZIP
+ * stream, not an envelope). Non-2xx is an http-status WireError (UNCERTAIN),
+ * same classification as the envelope path.
+ */
+export async function wireDownloadBuffer(session, call) {
+    const response = await session
+        .request({ path: call.path, method: "POST", ...(call.body === undefined ? {} : { body: call.body }), responseType: "buffer" })
+        .catch((error) => {
+        if (error instanceof CloudPivotRequestTimeoutError)
+            throw new WireError("transport", error.message);
+        throw error;
+    });
+    if (response.status < 200 || response.status >= 300)
+        throw new WireError("http-status", `HTTP ${response.status} for ${call.path} (POST)`, undefined, { httpStatus: response.status });
+    if (!Buffer.isBuffer(response.body) || response.body.length === 0)
+        throw new WireError("malformed-envelope", `empty or non-buffer body for ${call.path} (POST)`);
+    return response.body;
+}
+/**
+ * Ticket 106 — multipart file upload (POST /runtime/query/upload_file). The
+ * endpoint answers a PLAIN STRING refId (not an envelope;
+ * QueryRuntimeController.java:2414-2428). Each refId is ONE-SHOT: the
+ * consuming check/import download removes the refId→filename cache entry
+ * (FileOperateHelper2.java:43-57), so every check/import call uploads its own
+ * fresh copy.
+ */
+export async function wireUploadFile(session, path, filename, content) {
+    const response = await session
+        .request({ path, method: "POST", multipart: { filename, contentType: "application/zip", content }, responseType: "buffer" })
+        .catch((error) => {
+        if (error instanceof CloudPivotRequestTimeoutError)
+            throw new WireError("transport", error.message);
+        throw error;
+    });
+    if (response.status < 200 || response.status >= 300)
+        throw new WireError("http-status", `HTTP ${response.status} for ${path} (POST upload)`, undefined, { httpStatus: response.status });
+    const refId = (Buffer.isBuffer(response.body) ? response.body.toString("utf8") : String(response.body ?? "")).trim();
+    if (!refId)
+        throw new WireError("malformed-envelope", `empty upload refId for ${path}`);
+    return refId;
+}
+//# sourceMappingURL=wire.js.map