@stalfh233/omc-cli 0.4.41 → 0.4.43

package/dist/lanes/workflow.js

@@ -253,7 +253,11 @@ function lintWorkflowTemplate(template, tool) {
         for (const activity of activities) {
             const record = activity;
             const type = record != null && typeof record === "object" ? (record.type ?? record.activityType) : undefined;
-            if (type === undefined || type === null || String(type).trim() === "")
+            // Permission/rename rows target an existing draft node and inherit its
+            // type at merge time (see validateCallerActivities) — only a bare new
+            // node must carry its own type here.
+            const targetsExistingNode = record != null && typeof record === "object" && (record.propertyPermissions !== undefined || record.subPropertyPermissions !== undefined || record.activityName !== undefined || record.name !== undefined || record.i18nMessage !== undefined || record.permittedAction !== undefined || record.buttonPermission !== undefined);
+            if ((type === undefined || type === null || String(type).trim() === "") && !targetsExistingNode)
                 throw new ToolRefusalError({
                     status: "refused",
                     blocker: "workflow-activity-type-missing",
@@ -286,8 +290,7 @@ function mapCallerActivities(callerActivities, draftActivities) {
     return callerActivities.map((entry) => {
         const record = (entry ?? {});
         const code = activityCodeOf(record);
-        const rawType = String(record.activityType ?? record.type ?? "");
-        const type = rawType === "APPROVAL" ? "PARTICIPANT" : rawType;
+        const type = activityTypeOf(record);
         const base = draftByCode.get(code) ??
             (type === "START" ? draftByType("START") : type === "END" ? draftByType("END") : type === "PARTICIPANT" ? draftByType("PARTICIPANT") : undefined) ??
             {};
@@ -300,13 +303,23 @@ function mapCallerActivities(callerActivities, draftActivities) {
             ...Object.fromEntries(Object.entries(record).filter(([key]) => !ACTIVITY_INPUT_ALIAS_KEYS.includes(key))),
             ...(record.participant !== undefined ? { participant: normalizeParticipantForWire(record.participant) } : {}),
         };
-        return {
+        const mapped = {
             ...base,
             activityCode: code,
             ...(type ? { activityType: type } : {}),
             ...(record.name !== undefined ? { activityName: record.name } : {}),
             ...wireRecord,
         };
+        // Replace path: a caller-only code with no type has no draft row to
+        // inherit from — refuse before the wire (same rule the merge path
+        // enforces for its appended nodes).
+        if (String(mapped.activityType ?? "") === "")
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "workflow-activity-type-missing",
+                message: `workflow: 新节点 ${code} 缺 type/activityType（省略类型仅当 activityCode 命中草稿既有节点——权限/改名编辑行）`,
+            });
+        return mapped;
     });
 }
 function validateCallerActivities(template, tool) {
@@ -323,9 +336,16 @@ function validateCallerActivities(template, tool) {
             throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-activity-code-invalid", message: `${tool}: activities[${index}] requires a non-empty activityCode/id` });
         if (codes.has(code))
             throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-activity-code-duplicate", message: `${tool}: duplicate activityCode ${code}` });
-        if (!rawType)
-            throw new ToolRefusalError({ status: "refused", blocker: "workflow-activity-type-missing", message: `${tool}: activities[${index}] requires type/activityType` });
-        if (!WORKFLOW_ACTIVITY_TYPES.has(type))
+        if (!rawType) {
+            // A permission-edit row `{activityCode, propertyPermissions}` targets an
+            // EXISTING draft node and inherits its type at merge time — demanding a
+            // type here forced agents to re-send identity fields, and any spelling
+            // drift then minted `_2` codes. Bare new nodes still need a type.
+            const targetsExistingNode = activity?.propertyPermissions !== undefined || activity?.subPropertyPermissions !== undefined || activity?.activityName !== undefined || activity?.name !== undefined || activity?.i18nMessage !== undefined || activity?.permittedAction !== undefined || activity?.buttonPermission !== undefined;
+            if (!targetsExistingNode)
+                throw new ToolRefusalError({ status: "refused", blocker: "workflow-activity-type-missing", message: `${tool}: activities[${index}] requires type/activityType（权限编辑行带 propertyPermissions 时可省——类型继承自草稿同名节点）` });
+        }
+        if (rawType !== "" && !WORKFLOW_ACTIVITY_TYPES.has(type))
             throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-activity-type-invalid", message: `${tool}: activities[${index}] has an illegal ActivityType` });
         codes.add(code);
     }
@@ -688,9 +708,9 @@ function completeWorkflowChain(rules, activities) {
     const byEdge = new Map(rules.map((rule) => [`${rule.preActivityCode}->${rule.postActivityCode}`, rule]));
     return codes.slice(0, -1).map((code, index) => byEdge.get(`${code}->${codes[index + 1]}`) ?? { preActivityCode: code, postActivityCode: codes[index + 1] });
 }
-/** Activity type resolution shared by the merge + code reconcile (APPROVAL is a legacy alias). */
+/** Activity type resolution shared by the merge + code reconcile (APPROVAL is a legacy alias; case-insensitive — "Participant"/"approval" are the same node type as the draft's "PARTICIPANT" and must not mint a fresh code). */
 function activityTypeOf(record) {
-    const rawType = String(record.activityType ?? record.type ?? "");
+    const rawType = String(record.activityType ?? record.type ?? "").trim().toUpperCase();
     return rawType === "APPROVAL" ? "PARTICIPANT" : rawType;
 }
 /** Display name the caller asked for, in any accepted spelling. */
@@ -747,9 +767,16 @@ function reconcileCallerActivityCodes(callerActivities, draftActivities) {
         const draft = draftByCode.get(original);
         let code = original;
         if (draft !== undefined) {
-            const draftType = String(draft.activityType ?? "");
+            const draftType = String(draft.activityType ?? "").trim().toUpperCase() === "APPROVAL" ? "PARTICIPANT" : String(draft.activityType ?? "").trim().toUpperCase();
             const draftName = activityNameOf(draft);
-            const changed = draftType !== type || (name !== undefined && draftName !== undefined && name !== draftName);
+            // Only a field the caller ACTUALLY supplied can constitute a change: a
+            // delta edit that re-sends `{activityCode, propertyPermissions}` (no
+            // type/name) inherits the draft's identity — minting `_2` codes for it
+            // churned the code on every edit (Activity3 → Activity3_2 →
+            // Activity3_2_2). An omitted type is "keep the stored one", not "changed
+            // to empty".
+            const callerHasType = record.activityType !== undefined || record.type !== undefined;
+            const changed = (callerHasType && draftType !== type) || (name !== undefined && draftName !== undefined && name !== draftName);
             if (changed) {
                 let suffix = 2;
                 while (used.has(`${original}_${suffix}`))
@@ -836,6 +863,152 @@ function deepMergeActivityRow(base, caller) {
         merged.propertyPermissions = mergePermissionsByCode(base.propertyPermissions, caller.propertyPermissions);
     return merged;
 }
+/**
+ * Live 2026-10-14 (designer-template parity): flows created/updated through
+ * the API miss three defaults the designer writes on its first save, and the
+ * node config visibly drifts in the UI:
+ *
+ *  1. the FILL node ({Originator}) carries an EMPTY buttonPermission
+ *     .childTableBtns — the designer pre-checks ADD/DELETE/IMPORT/EXPORT for
+ *     EVERY child-table container (BATCH_UPDATE stays disabled);
+ *  2. the fill node keeps the auto-draft showReject:true — the designer
+ *     default is false (the originator cannot reject their own submission);
+ *  3. approval nodes keep rejectToStart:false — the designer default is true
+ *     (reject goes back to the originator node).
+ *
+ * Backfill applies ONLY to keys the caller did not explicitly send for that
+ * node in this update, so an explicit permittedAction/buttonPermission always
+ * wins.
+ */
+/**
+ * Child-table fields of a schema, draft face first (the field lane's own
+ * draft-else-published semantics: after field.publish the draft face may be
+ * empty while the published face carries the row).
+ */
+async function childTableFieldsOf(session, schemaCode) {
+    const read = async (isPublish) => {
+        try {
+            return wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode, isPublish } })).data);
+        }
+        catch {
+            return [];
+        }
+    };
+    const rows = (await read("false")).length > 0 ? await read("false") : await read("true");
+    return rows
+        .map((row) => ({ code: String(row.code ?? row.propertyCode ?? ""), name: String(row.name ?? row.code ?? ""), isChild: Number(row.type ?? row.propertyType ?? 0) === 8 || String(row.type ?? row.propertyType ?? "").toUpperCase() === "CHILD_TABLE" || row.subSchema !== undefined }))
+        .filter((row) => row.isChild && row.code !== "");
+}
+const CHILD_TABLE_LIST_BUTTONS = [
+    { code: "ADD", name: "新增", enabled: true },
+    { code: "DELETE", name: "删除", enabled: true },
+    { code: "IMPORT", name: "导入", enabled: true },
+    { code: "EXPORT", name: "导出", enabled: true },
+    { code: "BATCH_UPDATE", name: "批量编辑", enabled: false },
+];
+function isOriginatorFillNode(activity) {
+    return /\{originator\}/i.test(String(activity.participant ?? ""));
+}
+async function backfillDesignerDefaults(session, schemaCode, body, callerTemplate) {
+    const activities = Array.isArray(body.activities) ? body.activities : [];
+    const participants = activities.filter((activity) => String(activity.activityType ?? "") === "PARTICIPANT");
+    if (participants.length === 0)
+        return;
+    // Caller rows by FINAL activityCode: keys the caller explicitly sent for a
+    // node must not be overwritten by the backfill.
+    const callerRows = new Map();
+    for (const row of (callerActivities(callerTemplate) ?? [])) {
+        const code = activityCodeOf(row);
+        if (code)
+            callerRows.set(code, row);
+    }
+    const childTables = await childTableFieldsOf(session, schemaCode);
+    for (const activity of participants) {
+        const code = String(activity.activityCode ?? "");
+        const callerRow = callerRows.get(code);
+        const fill = isOriginatorFillNode(activity);
+        // 2/3: reject-action designer defaults (fill: cannot reject self;
+        // approval: reject returns to the originator node).
+        // The auto-draft PRESENCE of these keys is not designer intent — it ships
+        // showReject:true / rejectToStart:false everywhere. Overwrite toward the
+        // designer default unless THIS update explicitly sent permittedAction for
+        // the node.
+        const action = (activity.permittedAction ?? {});
+        if (callerRow?.permittedAction === undefined) {
+            if (fill)
+                activity.permittedAction = { ...action, showReject: false, rejectToStart: false };
+            else
+                activity.permittedAction = { ...action, rejectToStart: true };
+        }
+        // 1: child-table list buttons on the fill node only (designer parity:
+        // approval nodes keep childTableBtns empty).
+        if (fill && !(callerRow?.buttonPermission !== undefined) && childTables.length > 0) {
+            const buttonPermission = (activity.buttonPermission ?? {});
+            const existing = Array.isArray(buttonPermission.childTableBtns) ? buttonPermission.childTableBtns : [];
+            if (existing.length === 0) {
+                activity.buttonPermission = {
+                    ...buttonPermission,
+                    containerCode: buttonPermission.containerCode ?? schemaCode,
+                    customBtns: buttonPermission.customBtns ?? [],
+                    childTableBtns: childTables.map((table) => ({
+                        containerCode: table.code,
+                        containerName: table.name,
+                        customBtns: CHILD_TABLE_LIST_BUTTONS.map((button) => ({
+                            code: button.code,
+                            name: button.name,
+                            name_i18n: { zh: button.name, zh_TW: button.name, en: button.name },
+                            disabled: !button.enabled,
+                            type: "list",
+                            enabled: button.enabled,
+                        })),
+                    })),
+                };
+            }
+        }
+    }
+}
+/**
+ * Rename pairs surfaced in the readback (live r51 2026-10-14): a rename mints
+ * `<original>_<n>` and DROPS the original code — re-sending the OLD code then
+ * reads as a brand-new node and APPENDS it, silently growing the flow. The
+ * readback names the pairs so the caller switches to the new code.
+ */
+function renamedActivityPairs(template, data) {
+    const callerCodes = new Set((callerActivities(template) ?? []).map((row) => activityCodeOf(row)).filter((code) => code !== ""));
+    const bodyCodes = new Set((Array.isArray(data.activities) ? data.activities : []).map((row) => String(row.activityCode ?? "")));
+    const pairs = [];
+    for (const code of bodyCodes) {
+        const match = /^(.+)_\d+$/.exec(code);
+        if (match && callerCodes.has(match[1]) && !bodyCodes.has(match[1]))
+            pairs.push({ from: match[1], to: code });
+    }
+    return pairs;
+}
+/**
+ * Live 2026-10-14: a workflow node's propertyPermissions ACCEPTS
+ * `required:true` on a CHILD_TABLE (子表) property at the wire level, but the
+ * designer refuses that shape — the node's field config cannot render/必填 a
+ * sub-table control. Fail closed BEFORE the write (we never store a shape the
+ * designer cannot represent); only CALLER-supplied rows are inspected, so an
+ * inherited draft row never blocks an unrelated edit. The field-list read is
+ * lazy: it fires only when the caller actually sets required somewhere.
+ */
+async function refuseRequiredOnChildTableFields(session, schemaCode, template, tool) {
+    const rows = (callerActivities(template) ?? []).flatMap((activity) => (Array.isArray(activity.propertyPermissions) ? activity.propertyPermissions : []));
+    const requiredCodes = [...new Set(rows.filter((row) => row?.required === true).map((row) => String(row.propertyCode ?? "")))].filter((code) => code !== "");
+    if (requiredCodes.length === 0)
+        return;
+    const childTables = await childTableFieldsOf(session, schemaCode);
+    const hits = requiredCodes.filter((code) => childTables.some((table) => table.code === code));
+    if (hits.length > 0)
+        throw new ToolRefusalError({
+            status: "refused",
+            blocker: "workflow-child-table-not-required",
+            schemaCode,
+            propertyCodes: hits,
+            message: `${tool}: 子表字段不能配置为必填（propertyPermissions.required）——接口形状接受但设计器节点字段配置不支持（子表控件无必填语义），存入后节点配置无法正常渲染。命中的子表字段：${hits.join("、")}。子表行只配置 visible/editable（summary 工具自动补）；字段级必填请配到子表内部字段所在节点或改数据规则校验`,
+        });
+}
 /**
  * Incremental (`merge:true`) workflow edit: the caller sends ONLY the activities/
  * routes it adds or changes; the draft is the base. Draft activities survive
@@ -896,6 +1069,18 @@ function mergeCallerDelta(template, draft) {
         return { ...activity, ...override };
     });
     const newActivities = [...callerByOriginal.values()];
+    // A caller-only code that arrived WITHOUT a type has no draft row to inherit
+    // from — refuse it here (the lint allows type-less permission-shape rows
+    // precisely because they are expected to match an existing node).
+    for (const activity of newActivities) {
+        const type = activityTypeOf(activity);
+        if (type === "")
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "workflow-activity-type-missing",
+                message: `workflow.update: 新节点 ${String(activity.activityCode ?? "")} 缺 type/activityType（权限编辑行可省类型仅当 activityCode 命中草稿既有节点）`,
+            });
+    }
     // Insert added nodes BEFORE the terminal END, so the auto-chain reads
     // START → …existing… → new → END (appending after END produced a chain that
     // ended on the new node instead of END).
@@ -1021,6 +1206,53 @@ function normalizeWorkflowTemplate(template, draft) {
  * 50000 (live incident). Caller keys override; everything else echoes the
  * draft verbatim (the same merge pattern workflow.bindRule uses).
  */
+/**
+ * Rollback specs (git-revert semantics): before-state = the full draft row
+ * captured via get_draft; the restore replays workflow.update with the
+ * before template as a full-row replace (mergedTemplateBody echoes the draft
+ * verbatim when the caller template IS the draft row).
+ */
+function workflowRollbackSpec(toolName) {
+    return {
+        target: (args) => `workflow:${String(args.schemaCode ?? "")}/${String(args.code ?? args.workflowCode ?? "")}`,
+        read: async (session, args) => {
+            const code = String(args.code ?? args.workflowCode ?? "") || (await resolveWorkflowArg(session, { workflowCode: undefined, schemaCode: args.schemaCode }) ?? undefined);
+            if (!code)
+                return null;
+            return getWorkflowDraftOrNull(session, code);
+        },
+        inverse: ({ before, args, readback }) => {
+            const schemaCode = String(args.schemaCode ?? "");
+            const code = String(args.code ?? args.workflowCode ?? "");
+            if (toolName === "workflow.create") {
+                if (readback.alreadyPresent === true)
+                    return { kind: "calls", calls: [], notes: ["create 时已存在（幂等跳过），未写入，无需回滚"] };
+                return { kind: "calls", calls: [{ tool: "workflow.delete", args: { schemaCode, code } }] };
+            }
+            if (toolName === "workflow.delete") {
+                if (before == null)
+                    return { kind: "calls", calls: [], notes: ["delete 前目标已缺席（幂等），无需回滚"] };
+                const row = before;
+                return {
+                    kind: "calls",
+                    calls: [
+                        { tool: "workflow.create", args: { schemaCode, code, name: String(row.workflowName ?? row.name ?? code) } },
+                        { tool: "workflow.update", args: { schemaCode, code, template: row, merge: false } },
+                    ],
+                };
+            }
+            if (toolName === "workflow.publish")
+                return {
+                    kind: "irreversible",
+                    reason: "平台无 unpublish：发布是生命周期推进（workflowVersion 递增），不可参数重放撤销。内容回退路径：对该流程前一 workflow.update/bindRule 的 before 执行 rollback plan/apply 恢复草稿内容后，重新 workflow.publish",
+                };
+            // update / bindRule：整模板替换回 before 草稿
+            if (before == null)
+                return { kind: "irreversible", reason: "before 快照为空（流程不存在），无内容可恢复" };
+            return { kind: "calls", calls: [{ tool: "workflow.update", args: { schemaCode, code, template: before, merge: false } }] };
+        },
+    };
+}
 async function mergedTemplateBody(session, schemaCode, code, template, merge = false) {
     const draft = await getWorkflowDraftOrNull(session, code);
     if (draft == null)
@@ -1391,13 +1623,14 @@ export function registerWorkflowLane(tools) {
             performed: { errcode: performed.errcode },
             readback: { workflowCode: args.code, headerPresent: true, draftPresent: draft != null, templateId: draft?.id ?? null },
         };
-    });
+    }, undefined, undefined, workflowRollbackSpec("workflow.create"));
     writeTool(tools, "workflow.update", WORKFLOW_LANE, WORKFLOW_TOOLS["workflow.update"].scope, WORKFLOW_TOOLS["workflow.update"].description, { schemaCode: z.string().min(1), code: z.string().min(1), template: workflowTemplateArg, merge: z.boolean().optional().describe("增量：只发改动/新增的活动与路由，工具按 activityCode 合并到草稿（草稿为基；新增节点自动接链），不必先读回整模板再重发。默认自动：模板缺 START 或 END 时按增量 merge（部分模板），给了完整 START..END 才整模板替换；显式 true 强制增量、false 强制替换") }, async (session, args) => {
         const template = args.template ?? {};
         validateCallerActivities(template, "workflow.update");
         validateWorkflowRouteConditions(template, "workflow.update");
         assertTemplateNotMinimal(template, "workflow.update");
         lintWorkflowTemplate(template, "workflow.update");
+        await refuseRequiredOnChildTableFields(session, args.schemaCode, template, "workflow.update");
         // Ticket 112: merge onto the full draft row — a verbatim minimal post
         // leaves converter holes and answers errcode 50000 on the platform.
         // Delta semantics: explicit `true` forces merge, explicit `false` forces
@@ -1405,6 +1638,7 @@ export function registerWorkflowLane(tools) {
         // START/END) as a delta — see activitiesLackBoundaries.
         const merge = args.merge === true || (args.merge !== false && activitiesLackBoundaries(template));
         const body = await mergedTemplateBody(session, args.schemaCode, args.code, template, merge);
+        await backfillDesignerDefaults(session, args.schemaCode, body, template);
         validateWorkflowRender(body, "workflow.update");
         // Live: workflow/update does NOT run the template validator — it stores a
         // refused participant silently and only /publish answers the
@@ -1416,8 +1650,13 @@ export function registerWorkflowLane(tools) {
             throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-readback-invalid", message: "workflow.update returned no draft" });
         validateWorkflowRender(data, "workflow.update readback");
         const participantWarnings = participantReferenceWarnings(data);
-        return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, activities: Array.isArray(data.activities) ? data.activities.length : 0, templateType: data.templateType ?? null, ...(participantWarnings.length ? { participantWarnings } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
-    });
+        const renamedActivities = renamedActivityPairs(template, data);
+        return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, activities: Array.isArray(data.activities) ? data.activities.length : 0, templateType: data.templateType ?? null, ...(participantWarnings.length ? { participantWarnings } : {}), ...(renamedActivities.length ? { renamedActivities, renamedHint: "改名会铸新码（上表 from→to）且旧码已失效——后续读写一律用 to；再用旧码 from 会被当作新节点追加" } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
+    }, (args) => {
+        // Zero-wire refusal (ticket 77): fires in semanticGate BEFORE the
+        // governed pipeline — including the rollback before-capture read.
+        assertTemplateNotMinimal(args.template ?? {}, "workflow.update");
+    }, undefined, workflowRollbackSpec("workflow.update"));
     writeTool(tools, "workflow.publish", WORKFLOW_LANE, WORKFLOW_TOOLS["workflow.publish"].scope, WORKFLOW_TOOLS["workflow.publish"].description, { schemaCode: z.string().min(1), code: z.string().min(1), template: workflowTemplateArg.optional() }, async (session, args) => {
         // An absent template publishes the stored draft as-is — the platform's own
         // path. The schema is optional so the contract no longer contradicts it.
@@ -1425,10 +1664,12 @@ export function registerWorkflowLane(tools) {
         validateCallerActivities(template, "workflow.publish");
         validateWorkflowRouteConditions(template, "workflow.publish");
         assertTemplateNotMinimal(template, "workflow.publish");
+        await refuseRequiredOnChildTableFields(session, args.schemaCode, template, "workflow.publish");
         lintWorkflowTemplate(template, "workflow.publish");
         // Ticket 112: same merge-before-write as update. A template without both
         // boundaries is a partial edit → delta merge (see activitiesLackBoundaries).
         const body = await mergedTemplateBody(session, args.schemaCode, args.code, template, activitiesLackBoundaries(template));
+        await backfillDesignerDefaults(session, args.schemaCode, body, template);
         validateWorkflowRender(body, "workflow.publish");
         const performed = await wireCall(session, { path: ENDPOINTS.workflowPublish, method: "POST", body });
         // A refused publish answers errcode 0 — the ValidateMessage[] is the truth.
@@ -1454,7 +1695,9 @@ export function registerWorkflowLane(tools) {
         validateWorkflowRender(data, "workflow.publish readback");
         const participantWarnings = participantReferenceWarnings(data);
         return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, published: isPublished, workflowVersion: data.workflowVersion ?? null, ...(warnings.length ? { warnings } : {}), ...(participantWarnings.length ? { participantWarnings } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
-    });
+    }, (args) => {
+        assertTemplateNotMinimal(args.template ?? {}, "workflow.publish");
+    }, undefined, workflowRollbackSpec("workflow.publish"));
     writeTool(tools, "workflow.bindRule", WORKFLOW_LANE, WORKFLOW_TOOLS["workflow.bindRule"].scope, WORKFLOW_TOOLS["workflow.bindRule"].description, {
         schemaCode: z.string().min(1),
         workflowCode: z.string().min(1),
@@ -1577,7 +1820,7 @@ export function registerWorkflowLane(tools) {
             if (codes.length === 0 || new Set(codes.map(String)).size !== codes.length || codes.some((code) => typeof code !== "string" || code.length === 0))
                 throw new ToolRefusalError({ status: "refused", blocker: "workflow-bindrule-codes-invalid", message: "ruleCodes 必须是非空、去重的规则 code 数组" });
         }
-    });
+    }, undefined, workflowRollbackSpec("workflow.bindRule"));
     writeTool(tools, "workflow.delete", WORKFLOW_LANE, WORKFLOW_TOOLS["workflow.delete"].scope, WORKFLOW_TOOLS["workflow.delete"].description, { schemaCode: z.string().min(1), code: z.string().min(1) }, async (session, args) => {
         const performed = await wireCall(session, {
             path: ENDPOINTS.workflowDelete,
@@ -1586,7 +1829,7 @@ export function registerWorkflowLane(tools) {
         });
         const header = await wireCall(session, { path: ENDPOINTS.workflowGetHeader, query: { workflowCode: args.code } }).catch(() => ({ data: null }));
         return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, absent: header.data === null || header.data === undefined } };
-    });
+    }, undefined, undefined, workflowRollbackSpec("workflow.delete"));
     // ---- high-level greenfield orchestration (round 10 ergonomics) --------
     // The survey's write-face gap: a first workflow took create → update →
     // publish (+ bindRule for rules), 3–4 separate CLI calls. configure_workflow

package/dist/online-js-source.js

@@ -245,12 +245,49 @@ export function composeCustomScript(existing, incoming, mode) {
     // Merge into a lifecycle body: seed one when the existing script has none.
     let base = hasLifecycleWrapper(trimmedExisting) ? existing : wrapInLifecycle(existing);
     for (const block of splitRegistrations(incoming)) {
-        if (block.event !== null)
+        if (block.event !== null) {
             base = removeRegistration(base, block.event);
+            base = insertIntoLifecycleBody(base, block.text);
+            continue;
+        }
+        // Idempotent re-send (live 2026-10-14 中冶): re-composing the same file
+        // used to stack a SECOND copy of the header comment + var preamble on
+        // every pass. A non-registration block that already lives in the script
+        // verbatim is a no-op, not another append.
+        if (base.includes(block.text))
+            continue;
+        // A block that OPENS with the same header comment as the existing script
+        // but differs elsewhere is a whole-file REVISION: appending would
+        // duplicate the preamble AND leave the old body active. Fail closed and
+        // route to the replace path instead of guessing a textual merge.
+        const header = leadingCommentOf(block.text);
+        if (header !== null && header.length >= 16 && base.includes(header))
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "onlinejs-revision-replace-required",
+                message: "传入源与既有脚本同头注释（同一份脚本文件的修订版）——merge 会把注释/变量块重复追加且旧逻辑仍生效。整文件修订请：onlinejs.get 取回现脚本 → 修改 → onlinejs.compose replace:true 传完整 (function(form){…}) 脚本；只追加新逻辑则去掉与既有脚本重复的头注释/变量块后再发",
+            });
         base = insertIntoLifecycleBody(base, block.text);
     }
     return base;
 }
+/** The first /** … *\/ or leading // comment run of `text`, verbatim; null when the text does not open with one. */
+function leadingCommentOf(text) {
+    const trimmed = text.trimStart();
+    if (trimmed.startsWith("/*")) {
+        const end = trimmed.indexOf("*/");
+        if (end > 0)
+            return trimmed.slice(0, end + 2);
+    }
+    const lines = [];
+    for (const line of trimmed.split("\n")) {
+        if (line.trimStart().startsWith("//"))
+            lines.push(line);
+        else
+            break;
+    }
+    return lines.length > 0 ? lines.join("\n") : null;
+}
 export function assertPlatformOnlineJsComposition() {
     const source = "form.on('onLoad', function(){});";
     const composed = composeCustomScript("", source, "merge");

package/dist/recipes/online-js.js

@@ -8,12 +8,12 @@ const onlinejsHighlightScript = Object.freeze({
         environment,
         schemaCode: model,
         sheetCode: "<默认表单 code == 模型 code>",
-        mode: "replace",
+        replace: true,
         source: "(function(form){ var amt = form.getControl('amountCode'); var party = form.getControl('targetCode'); function refresh(v){ party.options.style = Number(v) > 100000 ? 'color: red;' : ''; } form.on('onRendered', function(){ refresh(amt.getValue()); amt.valueChange.subscribe(function(change){ refresh(change.value); }); }); })",
     },
     preconditions: [
         "控件编码先 model.inspect/field.list 确认（示例 amountCode/targetCode 换成真实字段 code）",
-        "完整 `(function(form){…})` 生命周期外壳必须 mode:'replace'（merge 模式收外壳会被拒并指路 replace——r38 实证）",
+        "完整 `(function(form){…})` 生命周期外壳必须配 `replace:true`（默认 INCREMENTAL merge 收外壳会被拒并指路 replace——r38 实证）",
     ],
     conditionalRequirements: [
         "事件模型：`form.on('onRendered', …)` 初始化 + `<控件>.valueChange.subscribe(function(change){ change.value })` 监听；改样式用 `control.options.style`",
@@ -23,7 +23,7 @@ const onlinejsHighlightScript = Object.freeze({
     priorToolReferences: [{ tool: "form.get", args: { environment, schemaCode: model }, purpose: "确认表单已发布与控件编码" }],
     dryRun: { supported: true, command: `omc call onlinejs.compose --env ${environment} --dry-run --args-file compose.json`, notes: "dry-run 校验外壳/合并模式，不写平台" },
     expectedReadback: { readback: { deliveryState: "DELIVERED", published: true, scriptElementPresent: true, htmlRenderCompat: { draft: { ok: true }, published: { ok: true } } } },
-    refusalRecovery: [{ code: "merge-mode-requires-shell", action: "完整外壳改 mode:'replace'（六元素模板保留，仅整体替换 customScript）" }],
+    refusalRecovery: [{ code: "onlinejs-source-invalid", action: "完整外壳改 `replace:true`（六元素模板保留，仅整体替换 customScript）" }],
     requiresEnvironmentDerivedIds: false,
 });
 export const ONLINEJS_METADATA = Object.freeze({

package/dist/rollback-spec.js

@@ -0,0 +1,143 @@
+/**
+ * Field-level deep diff for the plan surface. Returns at most `limit`
+ * changed paths plus the total count; arrays are compared by index
+ * (length change is reported on the array path itself).
+ */
+export function deepDiff(before, current, path = "", limit = 40, acc = []) {
+    const walk = (b, c, p) => {
+        if (acc.length >= limit)
+            return;
+        if (b === null && c === null)
+            return;
+        const bothObject = b !== null && c !== null && typeof b === "object" && typeof c === "object";
+        if (!bothObject) {
+            if (b !== c && !(Number.isNaN(b) && Number.isNaN(c))) {
+                if (typeof b === "string" || typeof c === "string") {
+                    const bp = tryParseJson(b);
+                    const cp = tryParseJson(c);
+                    if (bp.ok && cp.ok)
+                        return walk(bp.value, cp.value, p);
+                }
+                acc.push({ path: p, before: b, current: c });
+            }
+            return;
+        }
+        const bArr = Array.isArray(b);
+        const cArr = Array.isArray(c);
+        if (bArr || cArr) {
+            if (!bArr || !cArr) {
+                acc.push({ path: p, before: b, current: c });
+                return;
+            }
+            const bA = b;
+            const cA = c;
+            if (bA.length !== cA.length)
+                acc.push({ path: p, before: `<array×${bA.length}>`, current: `<array×${cA.length}>` });
+            const shared = Math.min(bA.length, cA.length);
+            for (let i = 0; i < shared && acc.length < limit; i += 1)
+                walk(bA[i], cA[i], `${p}[${i}]`);
+            return;
+        }
+        const bRec = b;
+        const cRec = c;
+        for (const key of new Set([...Object.keys(bRec), ...Object.keys(cRec)])) {
+            if (acc.length >= limit)
+                return;
+            const inB = key in bRec;
+            const inC = key in cRec;
+            if (!inB || !inC) {
+                acc.push({
+                    path: joinPath(p, key),
+                    before: inB ? bRec[key] : "<absent>",
+                    current: inC ? cRec[key] : "<absent>",
+                });
+                continue;
+            }
+            walk(bRec[key], cRec[key], joinPath(p, key));
+        }
+    };
+    walk(before, current, path);
+    return { changes: acc, total: acc.length };
+}
+/**
+ * Drop null/undefined values from inverse-call args, recursively (live r55
+ * 2026-10-14): the wire rows carry explicit nulls (`relativeCode:null`) and
+ * `!== undefined` guards let them through — the target tool's input schema then
+ * rejects the replay as input-invalid (exit 10) and the restore stops. A null
+ * in the before row means "no value", and for every replayable config tool an
+ * ABSENT key is the same meaning with a schema the tool accepts.
+ */
+export function pruneNullish(value) {
+    if (Array.isArray(value))
+        return value.map(pruneNullish);
+    if (value !== null && typeof value === "object") {
+        const out = {};
+        for (const [key, item] of Object.entries(value)) {
+            if (item === null || item === undefined)
+                continue;
+            out[key] = pruneNullish(item);
+        }
+        return out;
+    }
+    return value;
+}
+/**
+ * Canonical projection for restore verification: a replayed restore will
+ * NEVER be byte-equal to the before snapshot — the platform stamps
+ * modifiedTime/workflowVersion, geometry and selection state live on
+ * activities/rules, and a delete→recreate cycle mints fresh ids. Verification
+ * therefore compares the durable CONFIG content with these volatile keys
+ * dropped at every depth.
+ */
+const VOLATILE_VERIFY_KEYS = new Set([
+    "id",
+    "modifiedTime",
+    "createdTime",
+    "createdBy",
+    "modifiedBy",
+    "deleted",
+    "workflowVersion",
+    "published",
+    "isSelected",
+    "icon",
+    "x",
+    "y",
+    "width",
+    "height",
+    "points",
+    "textPosition",
+    "fixedPoint",
+    "shortCode",
+]);
+export function canonicalForVerify(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalForVerify);
+    if (value !== null && typeof value === "object") {
+        const record = value;
+        const out = {};
+        for (const key of Object.keys(record).sort()) {
+            if (VOLATILE_VERIFY_KEYS.has(key))
+                continue;
+            out[key] = canonicalForVerify(record[key]);
+        }
+        return out;
+    }
+    return value;
+}
+function joinPath(base, key) {
+    return base === "" ? key : `${base}.${key}`;
+}
+function tryParseJson(value) {
+    if (typeof value !== "string")
+        return { ok: false };
+    const trimmed = value.trim();
+    if (!trimmed.startsWith("{") && !trimmed.startsWith("["))
+        return { ok: false };
+    try {
+        return { ok: true, value: JSON.parse(trimmed) };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+//# sourceMappingURL=rollback-spec.js.map