@stalfh233/omc-cli 0.4.102 → 0.5.1

package/docs/tool-surface-map.md

@@ -1,42 +1,42 @@
-# Tool Surface ↔ Coverage Manifest Correspondence
-
-Baseline: `coverage/m1-coverage-manifest-v1.json` (39 items, M1, 8.6-only).
-Every `executable` and `partial` item maps to at least one tool below;
-`blocked` / `static-only` / `unsupported` items are hard boundaries —
-requesting them refuses with the manifest citation (red-team tested).
-
-Methodology (how to operate the tools) is read with `omc help <topic>` — see
-`skills/`. The tool surface is the "what"; those topics are the "how".
-
-| # | Manifest item (lane) | Status | Tools that carry it |
-|---|---|---|---|
-| 1 | W1-list-view | partial | `listview.create`, `listview.delete` (forced defaults, header readback, exact absence) |
-| 3 | W5-S26-aggregation | partial | `field.create` with formula/EXPRESSION scope (same-model AGGREGATION semantics documented in the manifest entry; no separate wire face was live-proven) |
-| 10 | W7-S29-greenfield | executable | `workflow.create`, `workflow.delete` |
-| 11 | W7-S29-residual-OQs | partial | surfaced by `coverage.manifest` + `get_status` (residual OQs are documented unknowns — no tool may claim past them) |
-| 12 | S25-rule-lifecycle | executable | `rule.enable`, `rule.disable`, `rule.delete` (invoke via enable + effect readback) |
-| 12a | B1-businessrule | executable | `rule.list` (latest runtime versions with full business-field projection; agent filters client-side) |
-| 13 | S32-business-integration | executable | `service.register`, `service.get`, `service.delete` (RESTFUL face) |
-| 15 | M2-runtime-data (data-entry projection) | partial | `data.load` (projection boundary: `form/load` authoritative) |
-| 15a | M2-runtime-data (query/list) | executable | `data.list` (simplified filters -> queryCondition, pagination, field projection) |
-| 21 | field-families | executable | `field.create`, `field.publish`, `field.delete`, `field.list` |
-| 22 | field-families (numeric-logical/date-time) | partial | same field tools, family types constrained to the proven set |
-| 23 | model-management | executable | `model.create`, `model.update` (app-tree NODE rename patch: bizSchemaCode/id/name/parentId required, modelType refused — fixed at create), `model.setSummary`, `model.delete`, `model.deleteMany` (publish aspect = model-scoped publication via `field.publish`/`form.publish`, exactly the proven ladder; no separate model-publish wire call exists) |
-| 24 | form-publish-chain | executable | `form.draft`, `form.publish`, `form.get` (draft-first, explicit publishedHtmlJson, control-level layout readback) |
-| 25 | B1-businessrule | executable | `rule.save` (dead-state + B1.2 CRUD/conditional node graphs) |
-| 26 | C-workflow-template | executable | `workflow.create` (minimal template lifecycle) |
-| 27 | online-js (composer) | executable | `onlinejs.compose` (platform skeleton preserved, canonical customScript element with array attrs, publish + SHA-256 readback). The design-time 在线开发 face (`/api/api/programming` JAVA source) is authored via 二开扩展包 and exposes no CLI tool |
-| 28 | M2-runtime-data (write/readback) | executable | `data.save`, `data.load`, `data.delete`, `data.list` |
-| 29 | B2-registration | executable | `service.register` (+ method), `service.get`, `service.delete` |
-| 30 | environment-governance | executable | `discover_environment`, `environment.fingerprint`, `doctor`, `get_status` |
-| 31 | e2e-delivery | executable | the governed chain itself: write tools (DELIVERED + artifact) → read tools (VERIFIED) → delete tools with exact-absence proof (CLEANED) |
-| 32 | app-management | executable | `app.list`, `app.create`, `app.delete` (design-time application package lifecycle; production writes permanently refused) |
-
-High-level orchestrations compose the same lanes under one token:
-`configure_model` (23+21+24), `configure_form` (24), `configure_rule`
-(25+12), `discover_environment` (30).
-
-Blocked/static-only/unsupported boundaries (no tools, enforced by refusal):
-W2-permissions, W5-S26-cross-model, W6-S27-* (nested child tables, relation
-linkage, child-to-child), W6-S28-*, S32-custom-extension, boundary-unsupported
-(inline backend coding, app publish/environment release, OCR/ELECTRONIC_SIGN).
+# Tool Surface ↔ Coverage Manifest Correspondence
+
+Baseline: `coverage/m1-coverage-manifest-v1.json` (39 items, M1, 8.6-only).
+Every `executable` and `partial` item maps to at least one tool below;
+`blocked` / `static-only` / `unsupported` items are hard boundaries —
+requesting them refuses with the manifest citation (red-team tested).
+
+Methodology (how to operate the tools) is read with `omc help <topic>` — see
+`skills/`. The tool surface is the "what"; those topics are the "how".
+
+| # | Manifest item (lane) | Status | Tools that carry it |
+|---|---|---|---|
+| 1 | W1-list-view | partial | `listview.create`, `listview.delete` (forced defaults, header readback, exact absence) |
+| 3 | W5-S26-aggregation | partial | `field.create` with formula/EXPRESSION scope (same-model AGGREGATION semantics documented in the manifest entry; no separate wire face was live-proven) |
+| 10 | W7-S29-greenfield | executable | `workflow.create`, `workflow.delete` |
+| 11 | W7-S29-residual-OQs | partial | surfaced by `coverage.manifest` + `get_status` (residual OQs are documented unknowns — no tool may claim past them) |
+| 12 | S25-rule-lifecycle | executable | `rule.enable`, `rule.disable`, `rule.delete` (invoke via enable + effect readback) |
+| 12a | B1-businessrule | executable | `rule.list` (latest runtime versions with full business-field projection; agent filters client-side) |
+| 13 | S32-business-integration | executable | `service.register`, `service.get`, `service.delete` (RESTFUL face) |
+| 15 | M2-runtime-data (data-entry projection) | partial | `data.load` (projection boundary: `form/load` authoritative) |
+| 15a | M2-runtime-data (query/list) | executable | `data.list` (simplified filters -> queryCondition, pagination, field projection) |
+| 21 | field-families | executable | `field.create`, `field.publish`, `field.delete`, `field.list` |
+| 22 | field-families (numeric-logical/date-time) | partial | same field tools, family types constrained to the proven set |
+| 23 | model-management | executable | `model.create`, `model.update` (app-tree NODE rename patch: bizSchemaCode/id/name/parentId required, modelType refused — fixed at create), `model.setSummary`, `model.delete`, `model.deleteMany` (publish aspect = model-scoped publication via `field.publish`/`form.publish`, exactly the proven ladder; no separate model-publish wire call exists) |
+| 24 | form-publish-chain | executable | `form.draft`, `form.publish`, `form.get` (draft-first, explicit publishedHtmlJson, control-level layout readback) |
+| 25 | B1-businessrule | executable | `rule.save` (dead-state + B1.2 CRUD/conditional node graphs) |
+| 26 | C-workflow-template | executable | `workflow.create` (minimal template lifecycle) |
+| 27 | online-js (composer) | executable | `onlinejs.compose` (platform skeleton preserved, canonical customScript element with array attrs, publish + SHA-256 readback). The design-time 在线开发 face (`/api/api/programming` JAVA source) is authored via 二开扩展包 and exposes no CLI tool |
+| 28 | M2-runtime-data (write/readback) | executable | `data.save`, `data.load`, `data.delete`, `data.list` |
+| 29 | B2-registration | executable | `service.register` (+ method), `service.get`, `service.delete` |
+| 30 | environment-governance | executable | `discover_environment`, `environment.fingerprint`, `doctor`, `get_status` |
+| 31 | e2e-delivery | executable | the governed chain itself: write tools (DELIVERED + artifact) → read tools (VERIFIED) → delete tools with exact-absence proof (CLEANED) |
+| 32 | app-management | executable | `app.list`, `app.create`, `app.delete` (design-time application package lifecycle; production writes permanently refused) |
+
+High-level orchestrations compose the same lanes under one token:
+`configure_model` (23+21+24), `configure_form` (24), `configure_rule`
+(25+12), `discover_environment` (30).
+
+Blocked/static-only/unsupported boundaries (no tools, enforced by refusal):
+W2-permissions, W5-S26-cross-model, W6-S27-* (nested child tables, relation
+linkage, child-to-child), W6-S28-*, S32-custom-extension, boundary-unsupported
+(inline backend coding, app publish/environment release, OCR/ELECTRONIC_SIGN).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stalfh233/omc-cli",
-  "version": "0.4.102",
+  "version": "0.5.1",
   "description": "CloudPivot 8.6 configuration capability CLI — governed, fail-closed, coverage-manifest bounded.",
   "type": "module",
   "bin": {
@@ -26,7 +26,7 @@
     "typecheck": "tsc --noEmit",
     "coverage:manifest": "tsx scripts/coverage-manifest.ts --write",
     "coverage:check": "tsx scripts/coverage-manifest.ts --check",
-    "test": "npm run build && OMC_ASCII_STDOUT=0 node --test --import tsx test/*.test.ts",
+    "test": "npm run build && node scripts/run-tests.mjs",
     "verify": "npm run typecheck && npm run coverage:check && npm test",
     "eval:call-face": "node --import tsx scripts/run-call-face-eval.ts",
     "eval:intent-face": "node --import tsx scripts/run-intent-face-eval.ts",
@@ -41,7 +41,9 @@
     "test:live-permission": "node conformance/live-permission-acceptance.mjs",
     "sandbox:dogfood": "node conformance/setup-dogfood-sandbox.mjs",
     "payload:report": "tsx scripts/payload-report.ts",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build",
+    "build:fast": "tsc --project tsconfig.build.json --incremental",
+    "typecheck:fast": "tsc --noEmit --incremental --tsBuildInfoFile .typecheck.tsbuildinfo"
   },
   "engines": {
     "node": ">=20"
@@ -50,9 +52,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@stalfh233/omc-fake-platform": "0.4.102",
+    "@stalfh233/omc-fake-platform": "0.5.1",
     "commander": "14.0.3",
-    "omc-core": "0.4.102",
+    "omc-core": "0.5.1",
     "proper-lockfile": "4.1.2",
     "write-file-atomic": "6.0.0",
     "zod": "^3.23.8",

package/skills/omc-acceptance-criteria.md

@@ -1,50 +1,50 @@
----
-name: omc-acceptance-criteria
-description: Decide whether a CLI change is accepted. Use before claiming done: readback, delivery-state, zero-residue, and negative-test gates.
----
-
-# Acceptance Criteria (验收标准)
-
-A change is accepted only when every gate below holds.
-
-## Per-write
-
-1. **Environment permission** — `writable:true` admits the write; `writable:false` refuses before wire. A production write additionally carries `confirmProduction:true` and records `productionConfirmed:true`.
-2. **Authoritative readback** — prove the intended state from the authoritative face (`field.list`, `form.get`, `data.load`, `onlinejs.get` for Online JS, `model.inspect` for workflow/rules), pairing each write with its same-family reader (`onlinejs.compose`→`onlinejs.get`; `report.datasource.link`→`linkedCount>0`). "Called without error" is not acceptance.
-2a. **Judge must be decidable** — prove the field exists first; all-same values (`false`/`null`/`0`) mean a wrong judge, not a pass. `form.get` has no `customScript` key — use `onlinejs.get`.
-2b. **Reachable ≠ correct** — `method.test success:true` proves reachability only; without a contract report "接口连通，业务对接未验证（契约缺失）".
-2c. **Allowed ≠ advanced** — `data.submit` → `PROCESSING` only proves the instance exists. Prove the next task via `workitem.list` or a later submit; a stalled instance still answers `errCode 0`.
-3. **Delivery state recorded** — the `.omc/` artifact exists with `deliveryState: DELIVERED` and the environment fingerprint.
-4. **Zero residue** — fixtures removed and exact absence proven on every face (draft and published); final state CLEANED.
-
-## Per-session
-
-5. **`uncertain` resolved** — every uncertain outcome was re-discovered before any further write.
-6. **Secrets zero-echo** — no output, artifact, or error contains the credential or bearer token.
-7. **Boundaries respected** — every `capability-out-of-coverage` refusal was treated as a boundary, not retried through another tool.
-8. **Draft gate evidenced** — if the session performed any write, the report must attach each design draft it presented and the human's approval turn(s) (and every revision). A write with no preceding draft/approval record fails acceptance — read `omc-config-draft-review`.
-
-## Portal/DOM acceptance (opt-in, real platform)
-
-Storage readback is NOT platform consumption. When the change is a form/design
-artifact, the strongest acceptance is the opt-in live batteries — and they ARE
-the "open a browser" step; do not report "no portal acceptance entry point":
-
-- `npm run test:live` — designer canvas, condition panels **and the condition
-  dialog must render >=1 rule row** (a serialization can crash the formatter and
-  silently drop the row while the panel still says "Set"), portal fields (two
-  loads), list columns, list buttons, Online JS wrapper + `window.h3form` boot.
-- `npm run test:live-workflow` — two-stage workflow + rule write-back via
-  `data.save(workflowCode)` → `workitem.list` → `data.submit` → `data.load`.
-- `npm run test:live-permission` — node field permissions read from
-  `form/load.formPermission.dataPermissions` as a NON-admin participant (an
-  admin is force-granted `e:true`).
-
-## Negative baseline (must stay green)
-
-- Read-only environment → `environment-write-disabled`, zero wire calls.
-- Writable production without `confirmProduction:true` → `production-confirmation-required`, zero wire calls.
-- Concurrent writes → serialized by the write lease (max 1 in flight).
-- Blocked lane (e.g. `W2-permissions`) → refused with citation.
-- Transport outage during a write → `uncertain` + `frozen`, never `ok`.
-- Non-8.6 version (or missing version evidence) → writes fail closed.
+---
+name: omc-acceptance-criteria
+description: Decide whether a CLI change is accepted. Use before claiming done: readback, delivery-state, zero-residue, and negative-test gates.
+---
+
+# Acceptance Criteria (验收标准)
+
+A change is accepted only when every gate below holds.
+
+## Per-write
+
+1. **Environment permission** — `writable:true` admits the write; `writable:false` refuses before wire. A production write additionally carries `confirmProduction:true` and records `productionConfirmed:true`.
+2. **Authoritative readback** — prove the intended state from the authoritative face (`field.list`, `form.get`, `data.load`, `onlinejs.get` for Online JS, `model.inspect` for workflow/rules), pairing each write with its same-family reader (`onlinejs.compose`→`onlinejs.get`; `report.datasource.link`→`linkedCount>0`). "Called without error" is not acceptance.
+2a. **Judge must be decidable** — prove the field exists first; all-same values (`false`/`null`/`0`) mean a wrong judge, not a pass. `form.get` has no `customScript` key — use `onlinejs.get`.
+2b. **Reachable ≠ correct** — `method.test success:true` proves reachability only; without a contract report "接口连通，业务对接未验证（契约缺失）".
+2c. **Allowed ≠ advanced** — `data.submit` → `PROCESSING` only proves the instance exists. Prove the next task via `workitem.list` or a later submit; a stalled instance still answers `errCode 0`.
+3. **Delivery state recorded** — the `.omc/` artifact exists with `deliveryState: DELIVERED` and the environment fingerprint.
+4. **Zero residue** — fixtures removed and exact absence proven on every face (draft and published); final state CLEANED.
+
+## Per-session
+
+5. **`uncertain` resolved** — every uncertain outcome was re-discovered before any further write.
+6. **Secrets zero-echo** — no output, artifact, or error contains the credential or bearer token.
+7. **Boundaries respected** — every `capability-out-of-coverage` refusal was treated as a boundary, not retried through another tool.
+8. **Draft gate evidenced** — if the session performed any write, the report must attach each design draft it presented and the human's approval turn(s) (and every revision). A write with no preceding draft/approval record fails acceptance — read `omc-config-draft-review`.
+
+## Portal/DOM acceptance (opt-in, real platform)
+
+Storage readback is NOT platform consumption. When the change is a form/design
+artifact, the strongest acceptance is the opt-in live batteries — and they ARE
+the "open a browser" step; do not report "no portal acceptance entry point":
+
+- `npm run test:live` — designer canvas, condition panels **and the condition
+  dialog must render >=1 rule row** (a serialization can crash the formatter and
+  silently drop the row while the panel still says "Set"), portal fields (two
+  loads), list columns, list buttons, Online JS wrapper + `window.h3form` boot.
+- `npm run test:live-workflow` — two-stage workflow + rule write-back via
+  `data.save(workflowCode)` → `workitem.list` → `data.submit` → `data.load`.
+- `npm run test:live-permission` — node field permissions read from
+  `form/load.formPermission.dataPermissions` as a NON-admin participant (an
+  admin is force-granted `e:true`).
+
+## Negative baseline (must stay green)
+
+- Read-only environment → `environment-write-disabled`, zero wire calls.
+- Writable production without `confirmProduction:true` → `production-confirmation-required`, zero wire calls.
+- Concurrent writes → serialized by the write lease (max 1 in flight).
+- Blocked lane (e.g. `W2-permissions`) → refused with citation.
+- Transport outage during a write → `uncertain` + `frozen`, never `ok`.
+- Non-8.6 version (or missing version evidence) → writes fail closed.