@stalfh233/omc-cli 0.4.72 → 0.4.74

package/coverage/m1-coverage-manifest-v1.json

@@ -339,10 +339,50 @@
         "workflow.bindRule",
         "workflow.delete",
         "configure_workflow",
-        "workflow.validate"
+        "workflow.validate",
+        "org.role.users",
+        "org.role.userScope",
+        "org.roleGroup.create",
+        "org.role.create",
+        "org.role.update",
+        "org.role.addUsers",
+        "org.role.removeUsers",
+        "org.role.setUserScope",
+        "org.role.delete",
+        "org.roleGroup.delete",
+        "org.user.transferDepartment",
+        "org.department.create",
+        "org.department.update",
+        "org.department.delete",
+        "org.department.users",
+        "org.user.create",
+        "org.user.update",
+        "org.user.delete",
+        "org.user.info",
+        "org.user.departments"
       ],
       "scopes": [
-        "greenfield workflow authoring"
+        "greenfield workflow authoring",
+        "organization role member read (role/users)",
+        "organization role member management scope read (role/get_ouscope)",
+        "organization role group create (role/add_role_group)",
+        "organization role create (role/add_role)",
+        "organization role update (role/modify_role)",
+        "organization role member add (role/add_role_user)",
+        "organization role member remove (role/strike_out_role_user)",
+        "organization role member scope update (role/update_ouscope)",
+        "organization role delete (role/strike_out_role)",
+        "organization role group delete (role/strike_out_role_group)",
+        "organization user department transfer (user/dept_transfer)",
+        "organization department create (department/add)",
+        "organization department update (department/modefied)",
+        "organization department delete (department/strike_out)",
+        "organization department member read (department/list_user)",
+        "organization user create (user/add)",
+        "organization user update (user/modify)",
+        "organization user delete (user/strike_out)",
+        "organization user read (user/info)",
+        "organization user department read (user/departments)"
       ]
     },
     {

package/dist/cli.js

@@ -28,6 +28,7 @@ import { cmdFormDefault } from "./form-default.js";
 if (process.argv.includes("--utf8"))
     process.env.OMC_ASCII_STDOUT = "0";
 import { commandIndex, commandInventory, describeContract, describeContractFull, describeContractTool, describeExample, describeParam, describeSchemaOnly, describeTool, describeToolFull } from "./discovery.js";
+import { repeatFullDescribe } from "./describe-cache.js";
 import { buildCapabilityOverview, capabilityDetail, compactCapabilities, executableCapabilityBundle, resolveCapabilityId, DISCOVERY_AUTHORITY } from "./capability-overview.js";
 import { goalRoute } from "./goal-routes.js";
 import { absencePointer } from "./capability-absences.js";
@@ -630,8 +631,13 @@ function cmdDiscovery(kind, transport, value, options = {}) {
         result = describeParam(registry, value ?? "", options.param);
     else if (options.example !== undefined)
         result = describeExample(registry, value ?? "", typeof options.example === "string" ? options.example : undefined);
-    else if (options.full)
-        result = describeToolFull(registry, value ?? "");
+    else if (options.full) {
+        const full = describeToolFull(registry, value ?? "");
+        // r9: the same `--full` contract was re-shipped 8 times (134 KB) while the
+        // caller only wanted to re-check a shape. Within a project session the
+        // second identical read returns an artifact reference instead of the body.
+        result = full ? (repeatFullDescribe(value ?? "", full) ?? full) : full;
+    }
     else
         result = describeTool(registry, value ?? "");
     if (!result) {

package/dist/describe-cache.js

@@ -0,0 +1,91 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { createHash } from "node:crypto";
+import { artifactRoot, joinConfigRoot } from "./command-transport.js";
+import { createArtifact, readArtifact } from "./artifacts.js";
+import { projectSessionActive } from "./usage-log.js";
+/**
+ * Repeat-read suppression for `describe <tool> --full`.
+ *
+ * r9 (2026-10-22) spent 134 KB on EIGHT `describe rule.save --full` calls: the
+ * same contract, unchanged, re-shipped every time the caller re-checked a shape.
+ * The hint at the bottom of the response ("先试 --example/--param") did not help
+ * because a caller editing a graph wants the authoritative schema again, and
+ * `--full` had no memory.
+ *
+ * The first `--full` in a project still returns the whole contract and spills a
+ * copy to an artifact. A later identical read returns `{artifactId, sha256,
+ * bytes, fetch}` instead: the caller can project the one key it needs with
+ * `omc artifact get <id> --jq <path>` instead of paying for the whole body
+ * again. Identity is the CONTENT hash, so a changed contract (new version, new
+ * field) always returns the full body again.
+ *
+ * Scoped to a project session by construction: the cache only exists where the
+ * usage log does (`.omc-env` in the working directory, or OMC_USAGE_LOG). Repo
+ * tests and the golden master run without it, so their bytes stay stable.
+ */
+const CACHE_FILE = "describe-full-cache.json";
+const CACHE_TTL_MS = 6 * 60 * 60 * 1000;
+function cachePath() {
+    return resolve(joinConfigRoot(), ".omc", CACHE_FILE);
+}
+function readCache() {
+    try {
+        const parsed = JSON.parse(readFileSync(cachePath(), "utf8"));
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+function writeCache(cache) {
+    try {
+        const path = cachePath();
+        mkdirSync(join(path, ".."), { recursive: true });
+        writeFileSync(path, `${JSON.stringify(cache)}\n`, { mode: 0o600 });
+    }
+    catch {
+        // Best-effort: a cache write must never fail the command.
+    }
+}
+/**
+ * Return the compact repeat-read face for `tool`, or `undefined` when this is
+ * the first read (or the contract changed). Records the new entry as a side
+ * effect so the NEXT read is compact.
+ */
+export function repeatFullDescribe(tool, result) {
+    // No project session (repo tests, golden master, one-off runs) ⇒ no cache:
+    // those callers need byte-stable output, and a cache write would be litter.
+    if (!projectSessionActive())
+        return undefined;
+    const body = `${JSON.stringify(result, null, 2)}\n`;
+    const bytes = Buffer.byteLength(body, "utf8");
+    const digest = createHash("sha256").update(body).digest("hex");
+    const cache = readCache();
+    const previous = cache[tool];
+    if (previous && previous.sha256 === digest && Date.now() - previous.at < CACHE_TTL_MS) {
+        // A pruned artifact would turn the summary into a dead end; re-ship instead.
+        if (existsSync(join(artifactRoot(), `${previous.artifactId}.artifact`))) {
+            try {
+                readArtifact(artifactRoot(), previous.artifactId);
+                return {
+                    name: tool,
+                    repeated: true,
+                    artifactId: previous.artifactId,
+                    sha256: digest,
+                    bytes,
+                    fetch: `omc artifact get ${previous.artifactId} --summary（再 --keys/--jq 取需要的键）`,
+                    note: `本项目的会话里已读过同一个契约（${bytes}B，内容 sha256 未变），本次不再重发全文；用 fetch 里的命令按需投影`,
+                };
+            }
+            catch {
+                // fall through to a full re-ship
+            }
+        }
+    }
+    const artifact = createArtifact(artifactRoot(), body);
+    cache[tool] = { tool, sha256: digest, bytes, artifactId: artifact.artifactId, at: Date.now() };
+    writeCache(cache);
+    return undefined;
+}
+//# sourceMappingURL=describe-cache.js.map

package/dist/endpoints.js

@@ -120,6 +120,28 @@ export const ENDPOINTS = {
     organizationRoleList: "/api/api/organization/role/list",
     organizationDepartmentTree: "/api/api/organization/department/tree",
     organizationUserSearch: "/api/api/organization/user/search",
+    organizationRoleUsers: "/api/api/organization/role/users",
+    organizationRoleGetOuScope: "/api/api/organization/role/get_ouscope",
+    organizationRoleUpdateOuScope: "/api/api/organization/role/update_ouscope",
+    organizationRoleAddGroup: "/api/api/organization/role/add_role_group",
+    organizationRoleAdd: "/api/api/organization/role/add_role",
+    organizationRoleModify: "/api/api/organization/role/modify_role",
+    organizationRoleGet: "/api/api/organization/role/get",
+    organizationDepartmentAdd: "/api/api/organization/department/add",
+    organizationDepartmentModify: "/api/api/organization/department/modefied",
+    organizationDepartmentDelete: "/api/api/organization/department/strike_out",
+    organizationDepartmentGet: "/api/api/organization/department/get_dept_info",
+    organizationDepartmentUsers: "/api/api/organization/department/list_user",
+    organizationUserAdd: "/api/api/organization/user/add",
+    organizationUserModify: "/api/api/organization/user/modify",
+    organizationUserDelete: "/api/api/organization/user/strike_out",
+    organizationUserInfo: "/api/api/organization/user/info",
+    organizationUserDepartments: "/api/api/organization/user/departments",
+    organizationRoleAddUser: "/api/api/organization/role/add_role_user",
+    organizationRoleRemoveUser: "/api/api/organization/role/strike_out_role_user",
+    organizationRoleDelete: "/api/api/organization/role/strike_out_role",
+    organizationRoleGroupDelete: "/api/api/organization/role/strike_out_role_group",
+    organizationUserDeptTransfer: "/api/api/organization/user/dept_transfer",
     listQueryCreate: "/api/api/app/query/create",
     listQueryGet: "/api/api/app/query/get",
     listQueryUpdate: "/api/api/app/query/update",

package/dist/field-families.js

@@ -672,6 +672,59 @@ function refuseFieldOptions(reason, message) {
     };
     throw new ToolRefusalError({ status: "refused", blocker: "capability-out-of-coverage", citation });
 }
+/**
+ * Aggregation query conditions are deserialized by Jackson into Java enums that
+ * are FIXED-ORDINAL (`BizPropertyType`, `OperatorType`): both must be written as
+ * their INTEGER code. A name (“NUMERICAL”/“GTEQ”) makes bizproperty/publish
+ * answer 50000 with `InvalidFormatException: Cannot deserialize value of type
+ * int from String` (live 2026-10-22, 1.1.25 scratch model). The portal UI writes
+ * ints, so accept the readable names and normalize them to the wire code —
+ * exactly the kind of adapter this lane already performs for `name_i18n`.
+ */
+const AGGREGATION_OPERATOR_CODES = Object.freeze({
+    EQ: 1, NEQ: 2, GT: 3, IT: 4, GTEQ: 5, ITEQ: 6,
+    CONTAINS: 7, NOT_CONTAINS: 8, IS_NULL: 9, IS_NOT_NULL: 10,
+    OF: 11, NOT_OF: 12, HAVE: 13, NOT_HAVE: 14,
+    IN: 15, NOT_IN: 16, BETWEEN: 17, NOT_BETWEEN: 18,
+    CONTAINS_ALL: 19, NOT_CONTAINS_ALL: 20, CONTAINS_ANY: 21,
+    NOT_CONTAINS_ANY: 22, EQ_ANY: 23, NOT_EQ_ANY: 24,
+});
+function normalizeAggregationFormula(agg) {
+    const groups = agg.queryConditions;
+    if (groups === undefined)
+        return agg;
+    if (!Array.isArray(groups) || groups.some((group) => !Array.isArray(group)))
+        refuseFieldOptions("AGGREGATION aggregation.queryConditions is not an array of arrays", "rejected: aggregation.queryConditions 形状必须是 [[{propertyCode,propertyType(int),operatorType(int),propertyValue,valueType}],…]（条件组）");
+    const normalized = groups.map((group) => group.map((leaf) => {
+        if (!leaf || typeof leaf !== "object" || Array.isArray(leaf))
+            refuseFieldOptions("AGGREGATION queryConditions leaf is not an object", "rejected: aggregation.queryConditions 每个条件必须是对​象");
+        const record = { ...leaf };
+        for (const key of ["propertyType", "currentPropertyType"]) {
+            const value = record[key];
+            if (value === undefined || value === null)
+                continue;
+            const code = typeof value === "number" ? value : FIELD_PROPERTY_TYPES[String(value).toUpperCase()];
+            if (typeof code !== "number" || !Number.isInteger(code))
+                refuseFieldOptions(`AGGREGATION queryConditions.${key} ${JSON.stringify(value)} is not a numeric BizPropertyType code`, `rejected: 聚合条件的 ${key} 必须是**整数**属性类型编码（Jackson 按 int 反序列化，传 "NUMERICAL" 会让 publish 50000）；可用名字：${Object.keys(FIELD_PROPERTY_TYPES).join("、")}`);
+            record[key] = code;
+        }
+        const operator = record.operatorType;
+        if (operator !== undefined && operator !== null) {
+            const code = typeof operator === "number" ? operator : AGGREGATION_OPERATOR_CODES[String(operator).toUpperCase()];
+            if (typeof code !== "number" || !Number.isInteger(code) || code < 1 || code > 24)
+                refuseFieldOptions(`AGGREGATION queryConditions.operatorType ${JSON.stringify(operator)} is not an OperatorType code`, `rejected: 聚合条件的 operatorType 必须是整数 1–24（或名字：${Object.keys(AGGREGATION_OPERATOR_CODES).join("、")}）；传 "GTEQ" 会让 publish 50000`);
+            record.operatorType = code;
+        }
+        if (record.valueType === undefined)
+            record.valueType = "FIXED";
+        if (!["FIXED", "DYNAMIC"].includes(String(record.valueType)))
+            refuseFieldOptions(`AGGREGATION queryConditions.valueType ${JSON.stringify(record.valueType)} is not FIXED/DYNAMIC`, 'rejected: 聚合条件的 valueType 只能是 "FIXED" 或 "DYNAMIC"');
+        if (record.propertyValue !== undefined && typeof record.propertyValue !== "string")
+            record.propertyValue = String(record.propertyValue);
+        return record;
+    }));
+    return { ...agg, queryConditions: normalized };
+}
 /** FORMULA formulaConfig decode; policy: string-only face, must parse to a non-array object. */
 function parseOptionsObject(value) {
     return decodeJsonObjectColumn(value, { invalid: "undefined", array: "reject", object: "reject" });
@@ -843,7 +896,12 @@ export function assertFieldOptionsAllowed(type, options, schemaCode) {
             else {
                 const agg = parseOptionsObject(config.aggregation);
                 if (!agg || !isNonEmptyString(agg.schemaCode) || !isNonEmptyString(agg.dataItemCode) || !isNonEmptyString(agg.formula))
-                    refuseFieldOptions("AGGREGATION aggregation is missing schemaCode/dataItemCode/formula", 'rejected: aggregation 形状 {schemaCode:"<子表schemaCode>", dataItemCode:"<子表字段code>", formula:"SUM({<子表schemaCode>.<子表字段code>})", calculateType?:.., queryConditions?:[]}（FormulaProcessor.executeMainAggregation + AggregationFormula）');
+                    refuseFieldOptions("AGGREGATION aggregation is missing schemaCode/dataItemCode/formula", 'rejected: aggregation 形状 {schemaCode:"<目标模型schemaCode>", dataItemCode:"<目标字段code>", formula:"SUM({<目标模型>.<字段>})", calculateType:"SUM", queryConditions:[[…]]}（FormulaProcessor.executeMainAggregation + AggregationFormula）');
+                const normalizedAgg = normalizeAggregationFormula(agg);
+                if (normalizedAgg !== agg) {
+                    config.aggregation = JSON.stringify(normalizedAgg);
+                    options.formulaConfig = JSON.stringify(config);
+                }
             }
         }
         else if (!isNonEmptyString(config.expression)) {

package/dist/lanes/organization-coverage.js

@@ -0,0 +1,27 @@
+import { claim, declareLaneCoverage } from "./coverage-declaration.js";
+import { LANES } from "./lane-ids.js";
+/**
+ * Organization writes (role group / role / members / management scope) sit on
+ * the same live-proven template lane; the scopes below are claimed here so the
+ * runtime gate can resolve them without a second manifest item.
+ */
+export const ORGANIZATION_COVERAGE = declareLaneCoverage(LANES.workflow, [
+    {
+        capability: "W7 S29 greenfield workflow authoring",
+        evidence: [
+            "packages/omc-cli/src/lanes/organization.ts",
+            "OpenAPI /api/v3/api-docs (1.1.25): organization/role/add_role, add_role_user, update_ouscope",
+        ],
+        tools: [
+            claim("org.role.users", "organization role member read (role/users)"),
+            claim("org.role.userScope", "organization role member management scope read (role/get_ouscope)"),
+            claim("org.roleGroup.create", "organization role group create (role/add_role_group)"),
+            claim("org.role.create", "organization role create (role/add_role)"),
+            claim("org.role.update", "organization role update (role/modify_role)"),
+            claim("org.role.addUsers", "organization role member add (role/add_role_user)"),
+            claim("org.role.removeUsers", "organization role member remove (role/strike_out_role_user)"),
+            claim("org.role.setUserScope", "organization role member scope update (role/update_ouscope)"),
+        ],
+    },
+]);
+//# sourceMappingURL=organization-coverage.js.map