@stalfh233/omc-cli 0.4.16 → 0.4.18

package/dist/bizservice-config.js

@@ -1,4 +1,5 @@
 import { ToolRefusalError } from "./tool-types.js";
+import { closestMatch } from "./closest-match.js";
 /**
  * Ticket 92 — business-integration write-face codec + preflight (pure functions,
  * zero DSH/wire dependencies). Reused by service.register (92), service.update
@@ -159,9 +160,13 @@ function commonlistValue(serviceConfig, code) {
 export function assertBizServiceAdapterWhitelisted(adapterCode) {
     if (typeof adapterCode !== "string" || !adapterCode)
         refuse(BIZSERVICE_CONFIG_BLOCKERS.adapterNotWhitelisted, "adapterCode 是必需的（结构化写面）", { adapterCode });
-    if (!BIZSERVICE_WRITE_ADAPTERS.includes(adapterCode))
-        refuse(BIZSERVICE_CONFIG_BLOCKERS.adapterNotWhitelisted, `adapterCode ${adapterCode} 不在写面支持范围内；本写面仅支持 ${BIZSERVICE_WRITE_ADAPTERS.join("/")}。` +
-            `**自定义 Java 方法体的常规做法是：在扩展模块写一个接口，然后用 RESTFUL 适配器注册一个服务指向它**（service.register，adapterCode:RESTFUL，methodConfig.url 指向扩展端点）；不要用 INTERNAL/custom_protocol 适配器（那是平台内部/自定义协议机制，不是二开接口的常规登记方式，也不是本工具的支持面）`, { adapterCode, supported: BIZSERVICE_WRITE_ADAPTERS });
+    if (!BIZSERVICE_WRITE_ADAPTERS.includes(adapterCode)) {
+        // F6: an off-by-one adapter guess gets a did-you-mean (same helper as the
+        // field families) before the prose.
+        const closest = closestMatch(adapterCode, BIZSERVICE_WRITE_ADAPTERS);
+        refuse(BIZSERVICE_CONFIG_BLOCKERS.adapterNotWhitelisted, `adapterCode ${adapterCode} 不在写面支持范围内；本写面仅支持 ${BIZSERVICE_WRITE_ADAPTERS.join("/")}。${closest !== undefined ? `你要找的可能是 ${closest}。` : ""}` +
+            `**自定义 Java 方法体的常规做法是：在扩展模块写一个接口，然后用 RESTFUL 适配器注册一个服务指向它**（service.register，adapterCode:RESTFUL，methodConfig.url 指向扩展端点）；不要用 INTERNAL/custom_protocol 适配器（那是平台内部/自定义协议机制，不是二开接口的常规登记方式，也不是本工具的支持面）`, { adapterCode, supported: BIZSERVICE_WRITE_ADAPTERS, ...(closest !== undefined ? { closestMatch: closest } : {}) });
+    }
     return adapterCode;
 }
 /** The AES boundary is not bypassable: a raw configJson string is refused before any wire call. */

package/dist/cli.js

@@ -185,6 +185,8 @@ async function cmdDoctor(store, environment, serviceCode) {
                 steps.push(`服务凭据  ok  ${serviceCode} 鉴权参数形状正常（${probe.parameterCount} 项；掩码/占位/全 0 均未检出）`);
             else
                 steps.push(`服务凭据  WARN ${serviceCode} ${probe.findings.length} 项问题（${probe.findings.map((finding) => `${finding.code}:${finding.valueKind}`).join("、")}）——掩码/占位值不可用于真实调用；真值从任务环境事实取，不要抄 service.get 读回`);
+            if (serviceCode !== undefined)
+                steps.push(`连通性    --  形状检查不能证明凭据有效；真实连通性用 method.test（平台侧发起调用）`);
         }
     }
     catch (error) {

package/dist/closest-match.js

@@ -0,0 +1,50 @@
+/**
+ * F6 (r10-friction): the shared did-you-mean closest-match helper. Born from
+ * the live-measured field-family case (NUMBER → correct name NUMERICAL cost a
+ * full extra round); the same off-by-one guesses hit every enum-like gate
+ * (adapter codes, …). Case/underscore-insensitive, three acceptance shapes:
+ * prefix containment, small edit distance, shared-prefix + proportional
+ * distance. Ambiguous short inputs (TEXT, BOOL) intentionally match nothing —
+ * a misleading suggestion is worse than the plain list.
+ */
+export function closestMatch(input, candidates) {
+    const wanted = input.toUpperCase().replace(/[\s_-]/g, "");
+    if (wanted.length < 2)
+        return undefined;
+    let best;
+    for (const name of candidates) {
+        const candidate = name.toUpperCase().replace(/[\s_-]/g, "");
+        // 1. prefix containment (STAFF→STAFF_SELECTOR, DATETIME→DATE)
+        const contained = (candidate.startsWith(wanted) || wanted.startsWith(candidate)) && Math.min(wanted.length, candidate.length) >= 4;
+        // 2. small edit distance (NUMERIC→NUMERICAL, SHORTTEXT→SHORT_TEXT)
+        const distance = editDistance(wanted, candidate);
+        const nearMiss = distance <= 2;
+        // 3. shared prefix + proportional distance (NUMBER→NUMERICAL, the live-measured case)
+        const sharedPrefix = commonPrefixLength(wanted, candidate);
+        const proportional = sharedPrefix >= 3 && wanted.length >= 5 && distance / Math.max(wanted.length, candidate.length) <= 0.58;
+        const accepted = contained || nearMiss || proportional;
+        if (accepted && (!best || distance < best.distance))
+            best = { name, distance };
+    }
+    return best?.name;
+}
+function commonPrefixLength(a, b) {
+    let index = 0;
+    while (index < a.length && index < b.length && a[index] === b[index])
+        index++;
+    return index;
+}
+function editDistance(a, b) {
+    const row = Array.from({ length: b.length + 1 }, (_, index) => index);
+    for (let i = 1; i <= a.length; i++) {
+        let previous = row[0];
+        row[0] = i;
+        for (let j = 1; j <= b.length; j++) {
+            const temp = row[j];
+            row[j] = Math.min(row[j] + 1, row[j - 1] + 1, previous + (a[i - 1] === b[j - 1] ? 0 : 1));
+            previous = temp;
+        }
+    }
+    return row[b.length];
+}
+//# sourceMappingURL=closest-match.js.map

package/dist/config-store.js

@@ -30,6 +30,10 @@ export class ConfigStore {
     constructor(paths = defaultPaths()) {
         this.paths = paths;
     }
+    /** Config root (config file's directory) — token-cache placement (F1). */
+    get configPaths() {
+        return this.paths;
+    }
     atomicWrite(path, text, mode) {
         mkdirSync(dirname(path), { recursive: true });
         if (existsSync(path)) {

package/dist/field-families.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { closestMatch } from "./closest-match.js";
 import { ToolRefusalError } from "./tool-types.js";
 import { decodeJsonObjectColumn } from "./json-column.js";
 import { FIELD_CONTROL_CODES, FIELD_DATE_DEFAULT_OPTIONS, FIELD_DATE_FORMATS, FIELD_FAMILY_LIST } from "./lanes/field-contract.js";
@@ -258,8 +259,18 @@ export function fieldTypeHint(type) {
     for (const [concept, family] of Object.entries(FIELD_TYPE_SYNONYMS))
         if (type.includes(concept) || concept.includes(type))
             return `「${type}」看起来是概念名而非族名；最接近的是 ${family}`;
+    // F2 (r10-friction): an off-by-one family guess (NUMBER→NUMERICAL measured
+    // live as a full extra round) deserves a did-you-mean, not just the full
+    // list. Closest match by edit distance over the normalized names.
+    const closest = closestFamilyName(type);
+    if (closest)
+        return `「${type}」不是族名；你要找的可能是 ${closest}`;
     return undefined;
 }
+/** Case/underscore-insensitive closest match over the family list (shared helper, see closest-match.ts). */
+function closestFamilyName(type) {
+    return closestMatch(type, Object.keys(FIELD_PROPERTY_TYPES));
+}
 /** wire propertyType (int) -> form controlType (type-matrix.md §3.1). */
 export const FIELD_CONTROL_TYPES = { ...CAPABILITY_CONTROL_TYPES };
 export const SYSTEM_FIELD_CODES = new Set([
@@ -781,7 +792,7 @@ function choiceOptionsError(type, options) {
     // No optionsSet: refuse the shapes that LOOK like choices but the platform ignores.
     for (const key of ["items", "labels", "custom", "dictionary", "businessModel", "options", "dictionaryData"]) {
         if (options[key] !== undefined)
-            return `选中控件（单选/复选/下拉）的选项必须放进 optionsSet（{optionsType:'custom',custom:[{code,value,name_i18n}]} 或 dictionary/businessModel）；裸的 options.${key} 平台不消费，门户会渲染成空控件。用 field.create 的 choices 参数，或 options.optionsSet`;
+            return `选中控件（单选/复选/下拉）的选项必须放进 optionsSet；裸的 options.${key} 平台不消费，门户会渲染成空控件。最小可抄样本 ${JSON.stringify({ options: { optionsSet: { optionsType: "custom", custom: [{ code: "opt1", value: "1" }, { code: "opt2", value: "2" }] } } })}，或 field.create 直接传 choices:["opt1","opt2"]`;
     }
     return null;
 }
@@ -805,7 +816,7 @@ export function assertFieldOptionsAllowed(type, options, schemaCode) {
             refuseFieldOptions("FORMULA options carried the legacy top-level resultType/expression keys, which the platform does not read", "rejected: FORMULA(100) options must use formulaConfig (nested JSON string) + persistent:true; top-level resultType/expression are not platform keys");
         const formulaConfig = options?.formulaConfig;
         if (!isNonEmptyString(formulaConfig))
-            refuseFieldOptions("FORMULA options are missing the required formulaConfig JSON string", "rejected: FORMULA(100) requires options.formulaConfig (a nested JSON string: resultType/formulaType/expression) — see field-contract");
+            refuseFieldOptions("FORMULA options are missing the required formulaConfig JSON string", "rejected: FORMULA(100) requires options.formulaConfig (a nested JSON string: resultType/formulaType/expression)。最小可抄样本 " + JSON.stringify({ options: { formulaConfig: JSON.stringify({ formulaType: "EXPRESSION", expression: "{amount}*2", resultType: 0 }), persistent: true } }) + "（resultType 0=SHORT_TEXT/2=NUMERICAL；expression 引用模型字段）");
         const config = parseOptionsObject(formulaConfig);
         if (!config)
             refuseFieldOptions("FORMULA formulaConfig is not a parseable JSON object string", "rejected: FORMULA(100) options.formulaConfig must be a JSON object string");

package/dist/goal-routes.js

@@ -231,13 +231,36 @@ function batchReadCommands(pointers) {
         byTopic.set(pointer.topic, [...(byTopic.get(pointer.topic) ?? []), pointer.section]);
     return [...byTopic.entries()].map(([topic, sections]) => `omc help ${topic} ${sections.map((section) => `--section "${section}"`).join(" ")}`);
 }
-/** The route's methodology-read surface: pointers (+ per-section bytes) + ready-to-run batched commands + hint. */
+/**
+ * The route's methodology-read surface: pointers (+ per-section bytes) +
+ * ready-to-run batched commands + hint.
+ *
+ * F9 (r10-friction): the most common task flow was `next` followed
+ * IMMEDIATELY by fetching the first readSection — one extra process +
+ * round-trip every task. The first section now rides inline when it fits the
+ * inline budget (~2 KB); larger sections stay pointer-only so `next` never
+ * balloons.
+ */
+const FIRST_SECTION_INLINE_BUDGET_BYTES = 2560;
 function routeReads(readSections) {
     // Per-section UTF-8 bytes ride each pointer (one field, not a parallel array)
     // so a caller can budget which sections to fetch — dogfood R1 found the
     // batched readCommands could exceed a window with no way to see sizes.
     const budgeted = readSections.map((pointer) => ({ ...pointer, bytes: sectionBytes(pointer) }));
-    return { readSections: budgeted, readCommands: batchReadCommands(readSections), readHint: READ_HINT };
+    // Inline the FIRST pointer that fits the budget (order = relevance); an
+    // oversized head section falls through to the next fitting one rather than
+    // dropping the inline content entirely.
+    let firstSection;
+    for (const pointer of budgeted.slice(0, 3)) {
+        if (pointer.bytes > 0 && pointer.bytes <= FIRST_SECTION_INLINE_BUDGET_BYTES) {
+            const resolved = readSkillSection(pointer.topic, pointer.section);
+            if (resolved) {
+                firstSection = { topic: pointer.topic, section: pointer.section, bytes: pointer.bytes, content: resolved.section };
+                break;
+            }
+        }
+    }
+    return { readSections: budgeted, readCommands: batchReadCommands(readSections), readHint: READ_HINT, ...(firstSection !== undefined ? { firstSection } : {}) };
 }
 /** UTF-8 byte length of one methodology section (best-effort; 0 when unreadable). */
 function sectionBytes(pointer) {

package/dist/lanes/meta.js

@@ -251,7 +251,7 @@ export function registerMetaLane(tools) {
                         ? { step: "服务凭据", ok: null, serviceCode: probe.serviceCode, note: "未找到（get_by_code 无行）" }
                         : probe.status === "error"
                             ? { step: "服务凭据", ok: null, serviceCode: probe.serviceCode, note: `探测失败：${probe.message}` }
-                            : { step: "服务凭据", ok: probe.findings.length === 0, serviceCode: probe.serviceCode, adapterCode: probe.adapterCode, parameterCount: probe.parameterCount, findings: probe.findings, note: probe.findings.length === 0 ? "掩码/占位/全 0 均未检出" : "掩码/占位值不可用于真实调用；真值从任务环境事实取，不要抄 service.get 读回" });
+                            : { step: "服务凭据", ok: probe.findings.length === 0, serviceCode: probe.serviceCode, adapterCode: probe.adapterCode, parameterCount: probe.parameterCount, findings: probe.findings, note: `${probe.findings.length === 0 ? "掩码/占位/全 0 均未检出" : "掩码/占位值不可用于真实调用；真值从任务环境事实取，不要抄 service.get 读回"}；形状检查不能证明凭据有效，真实连通性用 method.test` });
                 }
                 return { status: "ok", steps };
             }

package/dist/session-manager.js

@@ -1,4 +1,5 @@
-import { CloudPivotSession } from "./session.js";
+import { CloudPivotSession, defaultRequestTimeoutMs } from "./session.js";
+import { TokenCache, loginFingerprint } from "./token-cache.js";
 /** Caches one logged-in session per named environment per process. */
 export class SessionManager {
     store;
@@ -20,7 +21,18 @@ export class SessionManager {
         let session = cached?.profileKey === profileKey ? cached.session : undefined;
         if (!session) {
             const credential = this.store.readCredential(resolved.name);
-            session = new CloudPivotSession(resolved.name, resolved.profile, credential, this.httpFactory?.(resolved.profile), this.systemConfigFactory?.(resolved.profile));
+            // F1: cross-process token cache — lives beside the credentials, keyed
+            // by the environment profile + credential fingerprint. Injected http
+            // factories (tests, fakes) still go through the same hooks; a fake
+            // accepts the cached token the same way it accepts a fresh one.
+            const cache = new TokenCache(this.store.configPaths.configPath);
+            const environmentName = resolved.name;
+            const fingerprint = loginFingerprint(resolved.profile, credential);
+            session = new CloudPivotSession(resolved.name, resolved.profile, credential, this.httpFactory?.(resolved.profile), this.systemConfigFactory?.(resolved.profile), defaultRequestTimeoutMs(), {
+                load: () => cache.load(environmentName, fingerprint),
+                save: (login) => cache.save(environmentName, fingerprint, login),
+                clear: () => cache.clear(environmentName),
+            });
             this.sessions.set(resolved.name, { profileKey, session });
         }
         await session.login();

package/dist/session.js

@@ -18,16 +18,18 @@ export class CloudPivotSession {
     credential;
     systemConfig;
     requestTimeoutMs;
+    tokenCache;
     loginResult;
     version;
     httpAdapter;
     fingerprintOf;
-    constructor(environmentName, profile, credential, http, systemConfig = undefined, requestTimeoutMs = defaultRequestTimeoutMs()) {
+    constructor(environmentName, profile, credential, http, systemConfig = undefined, requestTimeoutMs = defaultRequestTimeoutMs(), tokenCache) {
         this.environmentName = environmentName;
         this.profile = profile;
         this.credential = credential;
         this.systemConfig = systemConfig;
         this.requestTimeoutMs = requestTimeoutMs;
+        this.tokenCache = tokenCache;
         this.httpAdapter = http;
     }
     async http() {
@@ -42,6 +44,24 @@ export class CloudPivotSession {
     async login() {
         if (this.loginResult)
             return this.loginResult;
+        // F1: a fresh-enough cached login (same environment profile + credential
+        // fingerprint) skips the six-round-trip handshake entirely. A 401
+        // mid-call clears the cache and re-logins (request() below).
+        const cached = this.tokenCache?.load();
+        if (cached) {
+            const core = await omcCore();
+            if (!this.fingerprintOf)
+                this.fingerprintOf = core.canonicalCloudPivotEnvironmentFingerprint;
+            this.loginResult = {
+                token: cached.token,
+                enterpriseId: cached.enterpriseId,
+                administrator: cached.administrator,
+                ...(cached.accountIdentity !== undefined ? { accountIdentity: cached.accountIdentity } : {}),
+            };
+            if (cached.version !== undefined)
+                this.version = cached.version;
+            return this.loginResult;
+        }
         const core = await omcCore();
         if (!this.fingerprintOf)
             this.fingerprintOf = core.canonicalCloudPivotEnvironmentFingerprint;
@@ -59,6 +79,13 @@ export class CloudPivotSession {
             ...(systemConfig ? { systemConfig } : {}),
         });
         this.version = detectVersion(systemConfig);
+        this.tokenCache?.save({
+            token: this.loginResult.token,
+            enterpriseId: this.loginResult.enterpriseId,
+            administrator: this.loginResult.administrator,
+            ...(this.loginResult.accountIdentity !== undefined ? { accountIdentity: this.loginResult.accountIdentity } : {}),
+            ...(this.version !== undefined ? { version: this.version } : {}),
+        });
         return this.loginResult;
     }
     /** Version-family evidence; absent evidence returns undefined (fail closed upstream). */
@@ -104,6 +131,8 @@ export class CloudPivotSession {
             return first;
         this.loginResult = undefined;
         this.version = undefined;
+        // The invalidated token must not be re-loaded by the re-login below.
+        this.tokenCache?.clear();
         return this.send(input);
     }
     async send(input) {
@@ -167,7 +196,7 @@ export class CloudPivotRequestTimeoutError extends Error {
         this.name = "CloudPivotRequestTimeoutError";
     }
 }
-function defaultRequestTimeoutMs() {
+export function defaultRequestTimeoutMs() {
     const raw = process.env.OMC_HTTP_TIMEOUT_MS;
     const parsed = raw ? Number(raw) : NaN;
     return Number.isFinite(parsed) && parsed > 0 ? parsed : 120_000;

package/dist/token-cache.js

@@ -0,0 +1,65 @@
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+export function loginFingerprint(profile, credential) {
+    return createHash("sha256")
+        .update(JSON.stringify({ baseUrl: profile.baseUrl, applicationCode: profile.applicationCode, engineCode: profile.engineCode ?? null, username: credential.username, password: credential.password }))
+        .digest("hex");
+}
+const DEFAULT_TTL_MS = 8 * 60 * 60 * 1000;
+export class TokenCache {
+    dir;
+    ttlMs;
+    constructor(configPath, ttlMs = Number(process.env.OMC_TOKEN_TTL_MS) > 0 ? Number(process.env.OMC_TOKEN_TTL_MS) : DEFAULT_TTL_MS) {
+        this.dir = join(dirname(configPath), "token-cache");
+        this.ttlMs = ttlMs;
+    }
+    load(environmentName, fingerprint) {
+        const file = join(this.dir, `${environmentName}.json`);
+        if (!existsSync(file))
+            return undefined;
+        let parsed;
+        try {
+            parsed = JSON.parse(readFileSync(file, "utf8"));
+        }
+        catch {
+            return undefined;
+        }
+        if (parsed.fingerprint !== fingerprint)
+            return undefined;
+        if (typeof parsed.storedAt !== "number" || Date.now() - parsed.storedAt > this.ttlMs)
+            return undefined;
+        if (typeof parsed.token !== "string" || typeof parsed.enterpriseId !== "string" || typeof parsed.administrator !== "boolean")
+            return undefined;
+        return {
+            token: parsed.token,
+            enterpriseId: parsed.enterpriseId,
+            administrator: parsed.administrator,
+            ...(parsed.accountIdentity !== undefined ? { accountIdentity: parsed.accountIdentity } : {}),
+            ...(parsed.version !== undefined ? { version: parsed.version } : {}),
+        };
+    }
+    save(environmentName, fingerprint, login) {
+        try {
+            mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+            const entry = { ...login, fingerprint, storedAt: Date.now() };
+            const file = join(this.dir, `${environmentName}.json`);
+            const tmp = `${file}.${process.pid}.tmp`;
+            writeFileSync(tmp, JSON.stringify(entry), { mode: 0o600 });
+            renameSync(tmp, file);
+        }
+        catch {
+            // The cache is an optimization, never a dependency: a failed write
+            // only means the next process logs in fresh.
+        }
+    }
+    clear(environmentName) {
+        try {
+            rmSync(join(this.dir, `${environmentName}.json`), { force: true });
+        }
+        catch {
+            // best effort
+        }
+    }
+}
+//# sourceMappingURL=token-cache.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stalfh233/omc-cli",
-  "version": "0.4.16",
+  "version": "0.4.18",
   "description": "CloudPivot 8.6 configuration capability CLI — governed, fail-closed, coverage-manifest bounded.",
   "type": "module",
   "bin": {
@@ -51,7 +51,7 @@
   },
   "dependencies": {
     "commander": "14.0.3",
-    "omc-core": "0.4.16",
+    "omc-core": "0.4.18",
     "proper-lockfile": "4.1.2",
     "write-file-atomic": "6.0.0",
     "zod": "^3.23.8",