@stalfh233/omc-cli 0.4.15 → 0.4.17

package/dist/online-js-source.js

@@ -15,34 +15,34 @@ import { ToolRefusalError } from "./tool-types.js";
  * to replace it.
  */
 export const PLATFORM_LIFECYCLE_WRAPPER_MARKER = "(function(form)";
-export const PLATFORM_DEFAULT_LIFECYCLE_SCRIPT = `/**
- * 用户自定义JS区域;
- * 注：外部链接的JS统一放置在HTML中，原有script标签下的js统一放置在当前编码区域
- * 使用环境变量，可通过"$env("唤醒提示框，并通过$env(分类名称.变量名称)的方式使用
- */
-(function(form){
-    /**
-     * 事件绑定，form.on
-     * @param eventType 事件类型
-     * @params function 事件
-     * @param  cover    true, false 是否覆盖root的生命周期 默认不覆盖 
-     */
-    //数据加载后，渲染之前，this为window
-    form.on('onLoad',function(data, dataPermission){},'cover');
-    //渲染完成后
-    form.on('onRendered',function(data){});
-    //内置校验完成后，返回false阻止提交
-    form.on('onValidate',function(action,data){});
-    //操作前（包含自定义按钮）执行，返回false阻止按钮操作
-    form.on('onPreAction',function(action,data){});
-    //自定义按钮执行
-    form.on('onCustomAction',function(action,data){});
-    //操作完成后执行
-    form.on('onActionDone',function(action,data,httpRes){});
-    //表单字段打印数据格式扩展，可自行定义调用打印模板时，表单字段对应所打印数据的内容
-    form.on('onPrintFormDataHandle',function(vm, printData, sourceData, formValues, key, locale, printTemplateCode, control, dataType, sheetData){});
-    //流程日志打印数据格式扩展，可自行定义调用打印模板时，流程日志对应所打印数据的内容
-    form.on('onPrintWorkflowLogDataHandle',function(vm, sourceData, printData, locale, printTemplateCode){});
+export const PLATFORM_DEFAULT_LIFECYCLE_SCRIPT = `/**
+ * 用户自定义JS区域;
+ * 注：外部链接的JS统一放置在HTML中，原有script标签下的js统一放置在当前编码区域
+ * 使用环境变量，可通过"$env("唤醒提示框，并通过$env(分类名称.变量名称)的方式使用
+ */
+(function(form){
+    /**
+     * 事件绑定，form.on
+     * @param eventType 事件类型
+     * @params function 事件
+     * @param  cover    true, false 是否覆盖root的生命周期 默认不覆盖 
+     */
+    //数据加载后，渲染之前，this为window
+    form.on('onLoad',function(data, dataPermission){},'cover');
+    //渲染完成后
+    form.on('onRendered',function(data){});
+    //内置校验完成后，返回false阻止提交
+    form.on('onValidate',function(action,data){});
+    //操作前（包含自定义按钮）执行，返回false阻止按钮操作
+    form.on('onPreAction',function(action,data){});
+    //自定义按钮执行
+    form.on('onCustomAction',function(action,data){});
+    //操作完成后执行
+    form.on('onActionDone',function(action,data,httpRes){});
+    //表单字段打印数据格式扩展，可自行定义调用打印模板时，表单字段对应所打印数据的内容
+    form.on('onPrintFormDataHandle',function(vm, printData, sourceData, formValues, key, locale, printTemplateCode, control, dataType, sheetData){});
+    //流程日志打印数据格式扩展，可自行定义调用打印模板时，流程日志对应所打印数据的内容
+    form.on('onPrintWorkflowLogDataHandle',function(vm, sourceData, printData, locale, printTemplateCode){});
 })`;
 /** The lifecycle events the platform dispatches; anything else is a typo the runtime silently drops (or throws on). */
 export const ONLINE_JS_EVENTS = new Set([

package/dist/plan.js

@@ -62,12 +62,22 @@ export async function planFor(ctx, environment, tool, args) {
     // The preview reads as a Chinese sentence produced by the SAME source as the
     // result summary (即将… / 已…), from the real arguments.
     const summary = writeSummary(tool, args, undefined, "plan");
+    // field.update cascadeRepublish: the plan previews the FULL cascade chain
+    // (the approver signs up for the form rebuild, not just the field write).
+    const actions = tool === "field.update" && args.cascadeRepublish === true
+        ? [
+            { tool, args: summarizedArgs(tool, args) },
+            { tool: "field.publish", args: { schemaCode: summarizeValue(args.schemaCode), code: summarizeValue(args.code), reason: "cascadeRepublish" } },
+            { tool: "form.draft", args: { schemaCode: summarizeValue(args.schemaCode), rebuild: true } },
+            { tool: "form.publish", args: { schemaCode: summarizeValue(args.schemaCode), force: true } },
+        ]
+        : [{ tool, args: summarizedArgs(tool, args) }];
     return {
         environment: session.environmentName,
         environmentFingerprint: session.environmentFingerprint(),
         summary,
         environmentNotice: environmentNotice(ctx.sessions.config().resolveEnvironment(environment).profile),
-        actions: [{ tool, args: summarizedArgs(tool, args) }],
+        actions,
     };
 }
 //# sourceMappingURL=plan.js.map

package/dist/service-doctor.js

@@ -0,0 +1,28 @@
+import { ENDPOINTS } from "./endpoints.js";
+import { wireCall, WireError } from "./wire.js";
+import { classifyAuthParameterlist } from "./bizservice-config.js";
+import { decodeJsonColumn, JSON_COLUMN_PASSTHROUGH } from "./json-column.js";
+export async function probeServiceCredentials(session, serviceCode) {
+    try {
+        // get_by_code answers a SINGLE row (not an array); an absent service
+        // answers the live 500001 业务服务不存在 business envelope.
+        const row = ((await wireCall(session, { path: ENDPOINTS.bizServiceGetByCode, query: { serviceCode } })).data ?? null);
+        if (row === null || Object.keys(row).length === 0)
+            return { status: "not-found", serviceCode };
+        const config = decodeJsonColumn(row.configJson, JSON_COLUMN_PASSTHROUGH);
+        const parameterlist = Array.isArray(config?.auth?.parameterlist) ? config.auth.parameterlist : [];
+        return {
+            status: "found",
+            serviceCode,
+            adapterCode: typeof row.adapterCode === "string" ? row.adapterCode : null,
+            parameterCount: parameterlist.length,
+            findings: classifyAuthParameterlist(parameterlist, String(row.adapterCode ?? "")),
+        };
+    }
+    catch (error) {
+        if (error instanceof WireError && error.kind === "business" && error.errcode === 500001)
+            return { status: "not-found", serviceCode };
+        return { status: "error", serviceCode, message: error instanceof Error ? error.message : String(error) };
+    }
+}
+//# sourceMappingURL=service-doctor.js.map

package/dist/session-manager.js

@@ -1,4 +1,5 @@
-import { CloudPivotSession } from "./session.js";
+import { CloudPivotSession, defaultRequestTimeoutMs } from "./session.js";
+import { TokenCache, loginFingerprint } from "./token-cache.js";
 /** Caches one logged-in session per named environment per process. */
 export class SessionManager {
     store;
@@ -20,7 +21,18 @@ export class SessionManager {
         let session = cached?.profileKey === profileKey ? cached.session : undefined;
         if (!session) {
             const credential = this.store.readCredential(resolved.name);
-            session = new CloudPivotSession(resolved.name, resolved.profile, credential, this.httpFactory?.(resolved.profile), this.systemConfigFactory?.(resolved.profile));
+            // F1: cross-process token cache — lives beside the credentials, keyed
+            // by the environment profile + credential fingerprint. Injected http
+            // factories (tests, fakes) still go through the same hooks; a fake
+            // accepts the cached token the same way it accepts a fresh one.
+            const cache = new TokenCache(this.store.configPaths.configPath);
+            const environmentName = resolved.name;
+            const fingerprint = loginFingerprint(resolved.profile, credential);
+            session = new CloudPivotSession(resolved.name, resolved.profile, credential, this.httpFactory?.(resolved.profile), this.systemConfigFactory?.(resolved.profile), defaultRequestTimeoutMs(), {
+                load: () => cache.load(environmentName, fingerprint),
+                save: (login) => cache.save(environmentName, fingerprint, login),
+                clear: () => cache.clear(environmentName),
+            });
             this.sessions.set(resolved.name, { profileKey, session });
         }
         await session.login();

package/dist/session.js

@@ -1,35 +1,77 @@
-import { CloudPivotAuthenticator, cloudPivotTenantHeaders, fetchCloudPivotHttp, resolveCloudPivotAuthoritativeOrigin, } from "omc-core";
-import { canonicalCloudPivotEnvironmentFingerprint } from "omc-core";
+import { omcCore } from "./omc-core-lazy.js";
 /**
  * An authenticated CloudPivot session for one named environment. Wraps the
  * core authenticator; exposes a version-family probe used by the 8.6-only
  * fail-closed write gate, and the canonical environment fingerprint that all
  * plans/approvals/artifacts must carry.
+ *
+ * T04: omc-core loads lazily. Its modules statically import `node:sqlite`,
+ * whose ExperimentalWarning fires during the ESM LINK phase — before any user
+ * code in a static graph can install a stderr filter. Keeping omc-core out of
+ * the CLI's static graph lets `sqlite-warning-filter` (cli.ts first import)
+ * intercept the warning when the dynamic import links later. All omc-core
+ * values are captured during `login()`; the sync accessors stay sync.
  */
 export class CloudPivotSession {
     environmentName;
     profile;
     credential;
-    http;
     systemConfig;
     requestTimeoutMs;
+    tokenCache;
     loginResult;
     version;
-    constructor(environmentName, profile, credential, http = fetchCloudPivotHttp(profile.baseUrl, undefined, fetch, cloudPivotTenantHeaders(profile.engineCode)), systemConfig = undefined, requestTimeoutMs = defaultRequestTimeoutMs()) {
+    httpAdapter;
+    fingerprintOf;
+    constructor(environmentName, profile, credential, http, systemConfig = undefined, requestTimeoutMs = defaultRequestTimeoutMs(), tokenCache) {
         this.environmentName = environmentName;
         this.profile = profile;
         this.credential = credential;
-        this.http = http;
         this.systemConfig = systemConfig;
         this.requestTimeoutMs = requestTimeoutMs;
+        this.tokenCache = tokenCache;
+        this.httpAdapter = http;
+    }
+    async http() {
+        if (this.httpAdapter)
+            return this.httpAdapter;
+        const core = await omcCore();
+        this.httpAdapter = core.fetchCloudPivotHttp(this.profile.baseUrl, undefined, fetch, core.cloudPivotTenantHeaders(this.profile.engineCode));
+        if (!this.fingerprintOf)
+            this.fingerprintOf = core.canonicalCloudPivotEnvironmentFingerprint;
+        return this.httpAdapter;
     }
     async login() {
         if (this.loginResult)
             return this.loginResult;
-        const { systemConfig } = this.systemConfig
-            ? { systemConfig: this.systemConfig }
-            : await resolveCloudPivotAuthoritativeOrigin(this.profile.baseUrl, undefined, fetch, cloudPivotTenantHeaders(this.profile.engineCode)).then((r) => ({ systemConfig: r.systemConfig }), () => ({ systemConfig: undefined }));
-        const authenticator = new CloudPivotAuthenticator(this.http);
+        // F1: a fresh-enough cached login (same environment profile + credential
+        // fingerprint) skips the six-round-trip handshake entirely. A 401
+        // mid-call clears the cache and re-logins (request() below).
+        const cached = this.tokenCache?.load();
+        if (cached) {
+            const core = await omcCore();
+            if (!this.fingerprintOf)
+                this.fingerprintOf = core.canonicalCloudPivotEnvironmentFingerprint;
+            this.loginResult = {
+                token: cached.token,
+                enterpriseId: cached.enterpriseId,
+                administrator: cached.administrator,
+                ...(cached.accountIdentity !== undefined ? { accountIdentity: cached.accountIdentity } : {}),
+            };
+            if (cached.version !== undefined)
+                this.version = cached.version;
+            return this.loginResult;
+        }
+        const core = await omcCore();
+        if (!this.fingerprintOf)
+            this.fingerprintOf = core.canonicalCloudPivotEnvironmentFingerprint;
+        let systemConfig = this.systemConfig;
+        if (!systemConfig) {
+            systemConfig = await core
+                .resolveCloudPivotAuthoritativeOrigin(this.profile.baseUrl, undefined, fetch, core.cloudPivotTenantHeaders(this.profile.engineCode))
+                .then((r) => r.systemConfig, () => undefined);
+        }
+        const authenticator = new core.CloudPivotAuthenticator(await this.http());
         this.loginResult = await authenticator.login({
             baseUrl: this.profile.baseUrl,
             username: this.credential.username,
@@ -37,6 +79,13 @@ export class CloudPivotSession {
             ...(systemConfig ? { systemConfig } : {}),
         });
         this.version = detectVersion(systemConfig);
+        this.tokenCache?.save({
+            token: this.loginResult.token,
+            enterpriseId: this.loginResult.enterpriseId,
+            administrator: this.loginResult.administrator,
+            ...(this.loginResult.accountIdentity !== undefined ? { accountIdentity: this.loginResult.accountIdentity } : {}),
+            ...(this.version !== undefined ? { version: this.version } : {}),
+        });
         return this.loginResult;
     }
     /** Version-family evidence; absent evidence returns undefined (fail closed upstream). */
@@ -64,7 +113,9 @@ export class CloudPivotSession {
     environmentFingerprint() {
         if (!this.loginResult)
             throw new Error("session is not logged in");
-        return canonicalCloudPivotEnvironmentFingerprint({
+        if (!this.fingerprintOf)
+            throw new Error("session fingerprint fn not captured (login first)");
+        return this.fingerprintOf({
             environment: this.environmentName,
             authoritativeOrigin: new URL(this.profile.baseUrl).origin,
             applicationCode: this.profile.applicationCode,
@@ -80,6 +131,8 @@ export class CloudPivotSession {
             return first;
         this.loginResult = undefined;
         this.version = undefined;
+        // The invalidated token must not be re-loaded by the re-login below.
+        this.tokenCache?.clear();
         return this.send(input);
     }
     async send(input) {
@@ -88,7 +141,7 @@ export class CloudPivotSession {
         let timer;
         try {
             return await Promise.race([
-                this.http.request({
+                (await this.http()).request({
                     path: input.path,
                     method: input.method,
                     ...(input.query ? { query: input.query } : {}),
@@ -108,7 +161,9 @@ export class CloudPivotSession {
         }
     }
     get httpHandle() {
-        return this.http;
+        if (!this.httpAdapter)
+            throw new Error("session http adapter not materialised (login first)");
+        return this.httpAdapter;
     }
 }
 function detectVersion(systemConfig) {
@@ -141,7 +196,7 @@ export class CloudPivotRequestTimeoutError extends Error {
         this.name = "CloudPivotRequestTimeoutError";
     }
 }
-function defaultRequestTimeoutMs() {
+export function defaultRequestTimeoutMs() {
     const raw = process.env.OMC_HTTP_TIMEOUT_MS;
     const parsed = raw ? Number(raw) : NaN;
     return Number.isFinite(parsed) && parsed > 0 ? parsed : 120_000;

package/dist/sqlite-warning-filter.js

@@ -0,0 +1,27 @@
+/**
+ * 0.4.16 T04 — suppress the `ExperimentalWarning: SQLite` stderr noise.
+ *
+ * omc-core statically imports `node:sqlite` (7 modules), so EVERY CLI start —
+ * including `--version` — prints the Node experimental-feature warning to
+ * stderr. Agents treat stderr noise as signal and quote it into reports.
+ *
+ * Empirically (Node 24): registering a `process.on('warning')` listener does
+ * NOT suppress the print; `node --no-warnings` works but requires caller-side
+ * flags we do not control. Pre-wrapping `process.stderr.write` BEFORE the
+ * sqlite module graph loads is the only zero-overhead, all-paths fix.
+ *
+ * This module must stay the FIRST import of cli.ts: ESM evaluates imports in
+ * order, so this wrapper installs before session.ts pulls omc-core.
+ * Only the SQLite-specific warning lines are dropped; everything else passes
+ * through untouched.
+ */
+const originalWrite = process.stderr.write.bind(process.stderr);
+const FILTER = /ExperimentalWarning: SQLite|^\(Use `node --trace-warnings/;
+process.stderr.write = ((chunk, encodingOrCb, maybeCb) => {
+    const text = typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8");
+    if (FILTER.test(text))
+        return true;
+    return originalWrite(chunk, encodingOrCb, maybeCb);
+});
+export {};
+//# sourceMappingURL=sqlite-warning-filter.js.map

package/dist/token-cache.js

@@ -0,0 +1,65 @@
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+export function loginFingerprint(profile, credential) {
+    return createHash("sha256")
+        .update(JSON.stringify({ baseUrl: profile.baseUrl, applicationCode: profile.applicationCode, engineCode: profile.engineCode ?? null, username: credential.username, password: credential.password }))
+        .digest("hex");
+}
+const DEFAULT_TTL_MS = 8 * 60 * 60 * 1000;
+export class TokenCache {
+    dir;
+    ttlMs;
+    constructor(configPath, ttlMs = Number(process.env.OMC_TOKEN_TTL_MS) > 0 ? Number(process.env.OMC_TOKEN_TTL_MS) : DEFAULT_TTL_MS) {
+        this.dir = join(dirname(configPath), "token-cache");
+        this.ttlMs = ttlMs;
+    }
+    load(environmentName, fingerprint) {
+        const file = join(this.dir, `${environmentName}.json`);
+        if (!existsSync(file))
+            return undefined;
+        let parsed;
+        try {
+            parsed = JSON.parse(readFileSync(file, "utf8"));
+        }
+        catch {
+            return undefined;
+        }
+        if (parsed.fingerprint !== fingerprint)
+            return undefined;
+        if (typeof parsed.storedAt !== "number" || Date.now() - parsed.storedAt > this.ttlMs)
+            return undefined;
+        if (typeof parsed.token !== "string" || typeof parsed.enterpriseId !== "string" || typeof parsed.administrator !== "boolean")
+            return undefined;
+        return {
+            token: parsed.token,
+            enterpriseId: parsed.enterpriseId,
+            administrator: parsed.administrator,
+            ...(parsed.accountIdentity !== undefined ? { accountIdentity: parsed.accountIdentity } : {}),
+            ...(parsed.version !== undefined ? { version: parsed.version } : {}),
+        };
+    }
+    save(environmentName, fingerprint, login) {
+        try {
+            mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+            const entry = { ...login, fingerprint, storedAt: Date.now() };
+            const file = join(this.dir, `${environmentName}.json`);
+            const tmp = `${file}.${process.pid}.tmp`;
+            writeFileSync(tmp, JSON.stringify(entry), { mode: 0o600 });
+            renameSync(tmp, file);
+        }
+        catch {
+            // The cache is an optimization, never a dependency: a failed write
+            // only means the next process logs in fresh.
+        }
+    }
+    clear(environmentName) {
+        try {
+            rmSync(join(this.dir, `${environmentName}.json`), { force: true });
+        }
+        catch {
+            // best effort
+        }
+    }
+}
+//# sourceMappingURL=token-cache.js.map

package/dist/usage-log.js

@@ -91,6 +91,9 @@ export function recordUsageOutput(value, stdoutBytes, fileBytes = 0) {
     pending.status = String(envelope.status ?? "unknown");
     if (typeof error?.code === "string")
         pending.errorCode = error.code;
+    // 0.4.16：requestId 落盘（信封瘦身把它从 stdout 移除后，排障关联的唯一落点）
+    if (typeof envelope.requestId === "string")
+        pending.requestId = envelope.requestId;
 }
 export function completeUsage(exitCode) {
     if (!pending)
@@ -115,6 +118,7 @@ export function completeUsage(exitCode) {
         status: current.status,
         exitCode,
         ...(current.errorCode ? { errorCode: current.errorCode } : {}),
+        ...(current.requestId ? { requestId: current.requestId } : {}),
     };
     appendFileSync(path, `${JSON.stringify(record)}\n`, "utf8");
 }

package/dist/write.js

@@ -12,6 +12,7 @@ function parseJsonOrUndefined(text) {
     }
 }
 import { admitGovernedWrite } from "./governed-execution.js";
+import { isPackageStopOutcome } from "./package.js";
 import { writeSummary } from "./human-summary.js";
 import { planFor } from "./plan.js";
 import { isUncertainWireError, sha256, wireErrorKind, writeArtifact } from "./support.js";
@@ -72,7 +73,27 @@ async function governedWrite(ctx, tool, args, execute, dryRunPayload) {
                 return { status: "refused", blocker: `wire-${error.kind}`, errcode: error.errcode, message: error.message, ...(error.diagnostic ? { diagnostic: error.diagnostic } : {}) };
             throw error;
         }
-        const { performed, readback } = executed;
+        // A write tool that runs a step chain (field.update cascadeRepublish) may
+        // RETURN its stop outcome instead of throwing: shape it exactly like the
+        // package stop (status/steps/failedStep/envelope, STOPPED artifact) so both
+        // layers report a mid-chain stop the same way.
+        if (isPackageStopOutcome(executed)) {
+            const artifact = {
+                tool: tool.name,
+                ...(args.requestId ? { requestId: args.requestId, requestFingerprint } : {}),
+                environment: session.environmentName,
+                environmentFingerprint: session.environmentFingerprint(),
+                steps: executed.steps,
+                failedStep: executed.failedStep,
+                stop: executed.envelope,
+                ...(productionConfirmed ? { productionConfirmed: true } : {}),
+                deliveryState: "STOPPED",
+                recordedAt: new Date().toISOString(),
+            };
+            const artifactRef = writeArtifact(ctx, `${tool.name}-${randomUUID().slice(0, 8)}.json`, artifact);
+            return { status: executed.status, steps: executed.steps, failedStep: executed.failedStep, ...executed.envelope, ...(args.requestId ? { requestId: args.requestId } : {}), artifactFingerprint: artifactRef.detailSha256 };
+        }
+        const { performed, readback, steps } = executed;
         // Every production write echoes the explicit acknowledgement into the audit
         // trail, so the record can always answer "was this a confirmed production
         // write?".
@@ -83,12 +104,13 @@ async function governedWrite(ctx, tool, args, execute, dryRunPayload) {
             environmentFingerprint: session.environmentFingerprint(),
             performed,
             readback,
+            ...(steps !== undefined ? { steps } : {}),
             ...(productionConfirmed ? { productionConfirmed: true } : {}),
             deliveryState: "DELIVERED",
             recordedAt: new Date().toISOString(),
         };
         const artifactRef = writeArtifact(ctx, `${tool.name}-${randomUUID().slice(0, 8)}.json`, artifact);
-        return { status: "ok", deliveryState: "DELIVERED", performed, readback, ...(args.requestId ? { requestId: args.requestId, idempotency: idempotencyDeclaration(tool.name) } : {}), ...(productionConfirmed ? { productionConfirmed: true } : {}), summary: writeSummary(tool.name, args, { performed, readback }, "done"), detailFile: artifactRef.detailFile, detailSha256: artifactRef.detailSha256, artifactFingerprint: artifactRef.detailSha256 };
+        return { status: "ok", deliveryState: "DELIVERED", performed, readback, ...(steps !== undefined ? { steps } : {}), ...(args.requestId ? { requestId: args.requestId, idempotency: idempotencyDeclaration(tool.name) } : {}), ...(productionConfirmed ? { productionConfirmed: true } : {}), summary: writeSummary(tool.name, args, { performed, readback }, "done"), detailFile: artifactRef.detailFile, detailSha256: artifactRef.detailSha256, artifactFingerprint: artifactRef.detailSha256 };
     });
 }
 function idempotencyDeclaration(tool) {

package/docs/tool-surface-map.md

@@ -1,42 +1,42 @@
-# Tool Surface ↔ Coverage Manifest Correspondence
-
-Baseline: `coverage/m1-coverage-manifest-v1.json` (39 items, M1, 8.6-only).
-Every `executable` and `partial` item maps to at least one tool below;
-`blocked` / `static-only` / `unsupported` items are hard boundaries —
-requesting them refuses with the manifest citation (red-team tested).
-
-Methodology (how to operate the tools) is read with `omc help <topic>` — see
-`skills/`. The tool surface is the "what"; those topics are the "how".
-
-| # | Manifest item (lane) | Status | Tools that carry it |
-|---|---|---|---|
-| 1 | W1-list-view | partial | `listview.create`, `listview.delete` (forced defaults, header readback, exact absence) |
-| 3 | W5-S26-aggregation | partial | `field.create` with formula/EXPRESSION scope (same-model AGGREGATION semantics documented in the manifest entry; no separate wire face was live-proven) |
-| 10 | W7-S29-greenfield | executable | `workflow.create`, `workflow.delete` |
-| 11 | W7-S29-residual-OQs | partial | surfaced by `coverage.manifest` + `get_status` (residual OQs are documented unknowns — no tool may claim past them) |
-| 12 | S25-rule-lifecycle | executable | `rule.enable`, `rule.disable`, `rule.delete` (invoke via enable + effect readback) |
-| 12a | B1-businessrule | executable | `rule.list` (latest runtime versions with full business-field projection; agent filters client-side) |
-| 13 | S32-business-integration | executable | `service.register`, `service.get`, `service.delete` (RESTFUL face) |
-| 15 | M2-runtime-data (data-entry projection) | partial | `data.load` (projection boundary: `form/load` authoritative) |
-| 15a | M2-runtime-data (query/list) | executable | `data.list` (simplified filters -> queryCondition, pagination, field projection) |
-| 21 | field-families | executable | `field.create`, `field.publish`, `field.delete`, `field.list` |
-| 22 | field-families (numeric-logical/date-time) | partial | same field tools, family types constrained to the proven set |
-| 23 | model-management | executable | `model.create`, `model.update` (app-tree NODE rename patch: bizSchemaCode/id/name/parentId required, modelType refused — fixed at create), `model.setSummary`, `model.delete`, `model.deleteMany` (publish aspect = model-scoped publication via `field.publish`/`form.publish`, exactly the proven ladder; no separate model-publish wire call exists) |
-| 24 | form-publish-chain | executable | `form.draft`, `form.publish`, `form.get` (draft-first, explicit publishedHtmlJson, control-level layout readback) |
-| 25 | B1-businessrule | executable | `rule.save` (dead-state + B1.2 CRUD/conditional node graphs) |
-| 26 | C-workflow-template | executable | `workflow.create` (minimal template lifecycle) |
-| 27 | online-js (composer) | executable | `onlinejs.compose` (platform skeleton preserved, canonical customScript element with array attrs, publish + SHA-256 readback). The design-time 在线开发 face (`/api/api/programming` JAVA source) is authored via 二开扩展包 and exposes no CLI tool |
-| 28 | M2-runtime-data (write/readback) | executable | `data.save`, `data.load`, `data.delete`, `data.list` |
-| 29 | B2-registration | executable | `service.register` (+ method), `service.get`, `service.delete` |
-| 30 | environment-governance | executable | `discover_environment`, `environment.fingerprint`, `doctor`, `get_status` |
-| 31 | e2e-delivery | executable | the governed chain itself: write tools (DELIVERED + artifact) → read tools (VERIFIED) → delete tools with exact-absence proof (CLEANED) |
-| 32 | app-management | executable | `app.list`, `app.create`, `app.delete` (design-time application package lifecycle; production writes permanently refused) |
-
-High-level orchestrations compose the same lanes under one token:
-`configure_model` (23+21+24), `configure_form` (24), `configure_rule`
-(25+12), `discover_environment` (30).
-
-Blocked/static-only/unsupported boundaries (no tools, enforced by refusal):
-W2-permissions, W5-S26-cross-model, W6-S27-* (nested child tables, relation
-linkage, child-to-child), W6-S28-*, S32-custom-extension, boundary-unsupported
-(inline backend coding, app publish/environment release, OCR/ELECTRONIC_SIGN).
+# Tool Surface ↔ Coverage Manifest Correspondence
+
+Baseline: `coverage/m1-coverage-manifest-v1.json` (39 items, M1, 8.6-only).
+Every `executable` and `partial` item maps to at least one tool below;
+`blocked` / `static-only` / `unsupported` items are hard boundaries —
+requesting them refuses with the manifest citation (red-team tested).
+
+Methodology (how to operate the tools) is read with `omc help <topic>` — see
+`skills/`. The tool surface is the "what"; those topics are the "how".
+
+| # | Manifest item (lane) | Status | Tools that carry it |
+|---|---|---|---|
+| 1 | W1-list-view | partial | `listview.create`, `listview.delete` (forced defaults, header readback, exact absence) |
+| 3 | W5-S26-aggregation | partial | `field.create` with formula/EXPRESSION scope (same-model AGGREGATION semantics documented in the manifest entry; no separate wire face was live-proven) |
+| 10 | W7-S29-greenfield | executable | `workflow.create`, `workflow.delete` |
+| 11 | W7-S29-residual-OQs | partial | surfaced by `coverage.manifest` + `get_status` (residual OQs are documented unknowns — no tool may claim past them) |
+| 12 | S25-rule-lifecycle | executable | `rule.enable`, `rule.disable`, `rule.delete` (invoke via enable + effect readback) |
+| 12a | B1-businessrule | executable | `rule.list` (latest runtime versions with full business-field projection; agent filters client-side) |
+| 13 | S32-business-integration | executable | `service.register`, `service.get`, `service.delete` (RESTFUL face) |
+| 15 | M2-runtime-data (data-entry projection) | partial | `data.load` (projection boundary: `form/load` authoritative) |
+| 15a | M2-runtime-data (query/list) | executable | `data.list` (simplified filters -> queryCondition, pagination, field projection) |
+| 21 | field-families | executable | `field.create`, `field.publish`, `field.delete`, `field.list` |
+| 22 | field-families (numeric-logical/date-time) | partial | same field tools, family types constrained to the proven set |
+| 23 | model-management | executable | `model.create`, `model.update` (app-tree NODE rename patch: bizSchemaCode/id/name/parentId required, modelType refused — fixed at create), `model.setSummary`, `model.delete`, `model.deleteMany` (publish aspect = model-scoped publication via `field.publish`/`form.publish`, exactly the proven ladder; no separate model-publish wire call exists) |
+| 24 | form-publish-chain | executable | `form.draft`, `form.publish`, `form.get` (draft-first, explicit publishedHtmlJson, control-level layout readback) |
+| 25 | B1-businessrule | executable | `rule.save` (dead-state + B1.2 CRUD/conditional node graphs) |
+| 26 | C-workflow-template | executable | `workflow.create` (minimal template lifecycle) |
+| 27 | online-js (composer) | executable | `onlinejs.compose` (platform skeleton preserved, canonical customScript element with array attrs, publish + SHA-256 readback). The design-time 在线开发 face (`/api/api/programming` JAVA source) is authored via 二开扩展包 and exposes no CLI tool |
+| 28 | M2-runtime-data (write/readback) | executable | `data.save`, `data.load`, `data.delete`, `data.list` |
+| 29 | B2-registration | executable | `service.register` (+ method), `service.get`, `service.delete` |
+| 30 | environment-governance | executable | `discover_environment`, `environment.fingerprint`, `doctor`, `get_status` |
+| 31 | e2e-delivery | executable | the governed chain itself: write tools (DELIVERED + artifact) → read tools (VERIFIED) → delete tools with exact-absence proof (CLEANED) |
+| 32 | app-management | executable | `app.list`, `app.create`, `app.delete` (design-time application package lifecycle; production writes permanently refused) |
+
+High-level orchestrations compose the same lanes under one token:
+`configure_model` (23+21+24), `configure_form` (24), `configure_rule`
+(25+12), `discover_environment` (30).
+
+Blocked/static-only/unsupported boundaries (no tools, enforced by refusal):
+W2-permissions, W5-S26-cross-model, W6-S27-* (nested child tables, relation
+linkage, child-to-child), W6-S28-*, S32-custom-extension, boundary-unsupported
+(inline backend coding, app publish/environment release, OCR/ELECTRONIC_SIGN).