@stalfh233/omc-cli 0.6.7 → 0.6.10

package/dist/lanes/online-js-contract.js

@@ -78,7 +78,7 @@ export const ONLINE_JS_LANE_CONTRACT = Object.freeze({
         }),
         "onlinejs.compose": Object.freeze({
             scope: ONLINE_JS_SCOPE,
-            description: `Compose the Online JS source as the customScript element into the form's draftHtmlJson layout array (then publish, promoting it verbatim to publishedHtmlJson). Core contract: preserve the platform template and only extend customScript.innerHTML — the six-element skeleton includes the ${PLATFORM_LIFECYCLE_WRAPPER_MARKER} lifecycle wrapper; the style, toolbar, template, beforeCustomScript, customScript, and afterCustomScript elements are kept or synthesized with platform defaults, while every layout/control element is preserved. customScript is rebuilt canonically as {tagName:'script', id:'customScript', innerHTML:<platform lifecycle wrapper containing source>, attrs:[]} because the designer requires an ARRAY attrs (e.attrs.some) and tagName, else the Online JS editor fails with t.some is not a function. Drives bizsheet/update + bizsheet/publish; publishedHtmlJson is read back verbatim and SHA-256-fingerprinted so the caller can verify byte equality. Read the EXISTING script first with onlinejs.get (decide replace vs INCREMENTAL from what is actually stored). Never overwrites the layout with a standalone script object or a partial [customScript]-only array (regression for issue 11's root cause). summary:true answers "did it land?" without any HTML/JS body (sha + byte counts + draftPublishedInSync); the default readback dedupes the composed draft and the script when they equal the published face, so the same script is never returned three times.`,
+            description: `**本调用 = 改 JS + 立即发布整张表单（等同 form.publish，含布局与按钮）**：它把 source 写进 customScript，然后无条件下一次 bizsheet/publish 把整份草稿提拔成发布面（内部 force:true，即使表单此前已发布也会重推）。所以改完 JS **不需要**再单独 form.publish；反过来，form.publish 只提拔布局草稿、**不碰**在线 JS。要只改不发布必须显式传 publish:false。Compose the Online JS source as the customScript element into the form's draftHtmlJson layout array (then publish, promoting it verbatim to publishedHtmlJson). Core contract: preserve the platform template and only extend customScript.innerHTML — the six-element skeleton includes the ${PLATFORM_LIFECYCLE_WRAPPER_MARKER} lifecycle wrapper; the style, toolbar, template, beforeCustomScript, customScript, and afterCustomScript elements are kept or synthesized with platform defaults, while every layout/control element is preserved. customScript is rebuilt canonically as {tagName:'script', id:'customScript', innerHTML:<platform lifecycle wrapper containing source>, attrs:[]} because the designer requires an ARRAY attrs (e.attrs.some) and tagName, else the Online JS editor fails with t.some is not a function. Drives bizsheet/update + bizsheet/publish; publishedHtmlJson is read back verbatim and SHA-256-fingerprinted so the caller can verify byte equality. Read the EXISTING script first with onlinejs.get (decide replace vs INCREMENTAL from what is actually stored). Never overwrites the layout with a standalone script object or a partial [customScript]-only array (regression for issue 11's root cause). summary:true answers "did it land?" without any HTML/JS body (sha + byte counts + draftPublishedInSync); the default readback dedupes the composed draft and the script when they equal the published face, so the same script is never returned three times.`,
         }),
     }),
 });

package/dist/lanes/online-js.js

@@ -95,167 +95,181 @@ export function registerOnlineJsLane(tools) {
             compact: (result) => result,
         }),
     }));
-    writeTool(tools, "onlinejs.compose", ONLINE_JS_LANE, ONLINE_JS_TOOLS["onlinejs.compose"].scope, ONLINE_JS_TOOLS["onlinejs.compose"].description, {
-        schemaCode: z.string().min(1),
-        sheetCode: z.string().min(1),
-        source: z.string().min(1).describe("在线 JS 代码。默认 INCREMENTAL：并入平台 (function(form){…}) 模板的既有脚本，模板与既有注册全部保留；配 replace:true 才是整段替换。脚本不得使用 export/import；事件名必须是平台事件（onLoad/onRendered/onValidate/onPreAction/onCustomAction/onActionDone/onPrintFormDataHandle/onPrintWorkflowLogDataHandle）"),
-        replace: z.boolean().optional().describe("true = 以 source 整体替换 customScript（含完整 (function(form){…}) 脚本）。默认 false = 增量并入既有脚本，保留平台模板与既有逻辑"),
-        publish: z.boolean().optional(),
-        summary: z.boolean().optional().describe("true = 只回同步状态（sha/字节数/是否同步/渲染兼容），不回任何 HTML/JS 原文。确认「改动是否生效」用这个；要看原文用 onlinejs.get"),
-    }, async (session, args) => {
-        const shouldPublish = args.publish !== false;
-        // 1. Read the existing draftHtmlJson.
-        const current = await wireCall(session, { path: ENDPOINTS.sheetGet, query: { schemaCode: args.schemaCode, sheetCode: args.sheetCode } });
-        const existingSheet = (current.data ?? null);
-        const existingRaw = typeof existingSheet?.draftHtmlJson === "string" ? existingSheet.draftHtmlJson : undefined;
-        const existingCompat = validateHtmlRender(existingRaw);
-        // A persisted legacy face may contain an object or malformed elements.
-        // Do not pass any of it through: discard the unproven face and rebuild
-        // only the canonical platform skeleton below.
-        const existingElements = existingCompat.ok ? parseLayoutElements(existingRaw) : [];
-        // 2. Script-level INCREMENTAL merge. The layout read-modify-write above
-        //    preserved the element skeleton, but the customScript innerHTML was
-        //    being replaced wholesale — that is how a bare `form.on(...)` (or an
-        //    `export function`) landed as the ENTIRE script, leaving `form`
-        //    undefined / a SyntaxError and rendering the form BLANK. Read the
-        //    existing script and merge the caller's code into it; the platform
-        //    default (an empty script) is seeded with the lifecycle scaffold.
-        const existingScript = String(existingElements.find((element) => element.id === "customScript")?.innerHTML ?? "");
-        const composedScript = composeCustomScript(existingScript, args.source, args.replace === true ? "replace" : "merge");
-        // 3. Preserve the platform template read-modify-write: keep the
-        //    style/beforeCustomScript/afterCustomScript skeleton and every
-        //    layout/control element; customScript carries the MERGED script.
-        const composedElements = composeLayoutElements(existingElements, composedScript);
-        assertHtmlRender(JSON.stringify(composedElements), { schemaCode: args.schemaCode, sheetCode: args.sheetCode, face: "composedDraftHtmlJson" }, true);
-        // 4. Stringify the COMPLETE element array (never partial).
-        const composedDraftHtml = JSON.stringify(composedElements);
-        // 5. bizsheet/update with the new draftHtmlJson (delegated to the
-        //    shared form.draft write body so view/attributes scaffolds stay
-        //    intact when present).
-        await executeFormDraftWrite(session, {
-            schemaCode: args.schemaCode,
-            sheetCode: args.sheetCode,
-            draftHtmlJson: composedDraftHtml,
-        });
-        // 6. publish promotes the FULL layout (including customScript). Use
-        //    force:true so compose re-promotes even when the form was
-        //    previously published — otherwise onlinejs.compose would
-        //    leave the stale publishedHtmlJson in place after the user
-        //    already published once.
-        let published = false;
-        if (shouldPublish) {
-            const publishOutcome = await executeFormPublishWrite(session, {
+    writeTool({
+        tools,
+        name: "onlinejs.compose",
+        lane: ONLINE_JS_LANE,
+        scope: ONLINE_JS_TOOLS["onlinejs.compose"].scope,
+        description: ONLINE_JS_TOOLS["onlinejs.compose"].description,
+        inputSchema: {
+            schemaCode: z.string().min(1),
+            // r28e F9：本 lane 其它工具（form.draft/form.publish/form.get/onlinejs.get）
+            // 的 sheetCode 都是 optional（省略 = schemaCode）。此前只有这里必填，
+            // dry-run 与真写都拒——同一个 lane 两套约定，调用方要白撞一轮才知道。
+            sheetCode: z.string().min(1).optional().describe("表单槽位码；省略时默认 = schemaCode（与 form.draft/form.publish 同口径）"),
+            source: z.string().min(1).describe("在线 JS 代码。默认 INCREMENTAL：并入平台 (function(form){…}) 模板的既有脚本，模板与既有注册全部保留；配 replace:true 才是整段替换。脚本不得使用 export/import；事件名必须是平台事件（onLoad/onRendered/onValidate/onPreAction/onCustomAction/onActionDone/onPrintFormDataHandle/onPrintWorkflowLogDataHandle）"),
+            replace: z.boolean().optional().describe("true = 以 source 整体替换 customScript（含完整 (function(form){…}) 脚本）。默认 false = 增量并入既有脚本，保留平台模板与既有逻辑"),
+            publish: z.boolean().optional(),
+            summary: z.boolean().optional().describe("true = 只回同步状态（sha/字节数/是否同步/渲染兼容），不回任何 HTML/JS 原文。确认「改动是否生效」用这个；要看原文用 onlinejs.get"),
+        },
+        execute: async (session, args) => {
+            const shouldPublish = args.publish !== false;
+            // r28e F9：和同 lane 其它工具一致——省略 sheetCode 即模型码槽位。
+            const targetSheetCode = args.sheetCode ?? args.schemaCode;
+            // 1. Read the existing draftHtmlJson.
+            const current = await wireCall(session, { path: ENDPOINTS.sheetGet, query: { schemaCode: args.schemaCode, sheetCode: targetSheetCode } });
+            const existingSheet = (current.data ?? null);
+            const existingRaw = typeof existingSheet?.draftHtmlJson === "string" ? existingSheet.draftHtmlJson : undefined;
+            const existingCompat = validateHtmlRender(existingRaw);
+            // A persisted legacy face may contain an object or malformed elements.
+            // Do not pass any of it through: discard the unproven face and rebuild
+            // only the canonical platform skeleton below.
+            const existingElements = existingCompat.ok ? parseLayoutElements(existingRaw) : [];
+            // 2. Script-level INCREMENTAL merge. The layout read-modify-write above
+            //    preserved the element skeleton, but the customScript innerHTML was
+            //    being replaced wholesale — that is how a bare `form.on(...)` (or an
+            //    `export function`) landed as the ENTIRE script, leaving `form`
+            //    undefined / a SyntaxError and rendering the form BLANK. Read the
+            //    existing script and merge the caller's code into it; the platform
+            //    default (an empty script) is seeded with the lifecycle scaffold.
+            const existingScript = String(existingElements.find((element) => element.id === "customScript")?.innerHTML ?? "");
+            const composedScript = composeCustomScript(existingScript, args.source, args.replace === true ? "replace" : "merge");
+            // 3. Preserve the platform template read-modify-write: keep the
+            //    style/beforeCustomScript/afterCustomScript skeleton and every
+            //    layout/control element; customScript carries the MERGED script.
+            const composedElements = composeLayoutElements(existingElements, composedScript);
+            assertHtmlRender(JSON.stringify(composedElements), { schemaCode: args.schemaCode, sheetCode: targetSheetCode, face: "composedDraftHtmlJson" }, true);
+            // 4. Stringify the COMPLETE element array (never partial).
+            const composedDraftHtml = JSON.stringify(composedElements);
+            // 5. bizsheet/update with the new draftHtmlJson (delegated to the
+            //    shared form.draft write body so view/attributes scaffolds stay
+            //    intact when present).
+            await executeFormDraftWrite(session, {
                 schemaCode: args.schemaCode,
-                sheetCode: args.sheetCode,
-                force: true,
+                sheetCode: targetSheetCode,
+                draftHtmlJson: composedDraftHtml,
             });
-            published = publishOutcome.readback.published === true;
-        }
-        // 7. Readback publishedHtmlJson VERBATIM.
-        const readback = await wireCall(session, { path: ENDPOINTS.sheetGet, query: { schemaCode: args.schemaCode, sheetCode: args.sheetCode } });
-        const publishedSheet = (readback.data ?? {});
-        const publishedRaw = typeof publishedSheet.publishedHtmlJson === "string" ? publishedSheet.publishedHtmlJson : "";
-        if (publishedRaw !== "")
-            assertHtmlRender(publishedRaw, { schemaCode: args.schemaCode, sheetCode: args.sheetCode, face: "publishedHtmlJson" }, true);
-        const publishedElements = parseLayoutElements(publishedRaw);
-        // 8. SHA-256 of the verbatim content.
-        const publishedSha256 = createHash("sha256").update(publishedRaw).digest("hex");
-        const draftSha256 = createHash("sha256").update(composedDraftHtml).digest("hex");
-        const publishedScript = readCustomScriptSource(publishedRaw).script;
-        const customScriptSha256 = createHash("sha256").update(composedScript, "utf8").digest("hex");
-        const draftPublishedInSync = publishedScript !== null && publishedScript === composedScript;
-        const htmlRenderCompat = { draft: validateHtmlRender(composedDraftHtml, true), published: validateHtmlRender(publishedRaw, true) };
-        // Live 2026-10-21 (customer): this readback shipped the same ~10KB script
-        // three times (composedDraftHtmlJson + publishedHtmlJson + customScript),
-        // ~45KB for a call whose only question was "did publish land?" — the
-        // session's single largest context amplification. Answer that question
-        // directly and keep 原文 opt-in.
-        if (args.summary === true) {
+            // 6. publish promotes the FULL layout (including customScript). Use
+            //    force:true so compose re-promotes even when the form was
+            //    previously published — otherwise onlinejs.compose would
+            //    leave the stale publishedHtmlJson in place after the user
+            //    already published once.
+            let published = false;
+            if (shouldPublish) {
+                const publishOutcome = await executeFormPublishWrite(session, {
+                    schemaCode: args.schemaCode,
+                    sheetCode: targetSheetCode,
+                    force: true,
+                });
+                published = publishOutcome.readback.published === true;
+            }
+            // 7. Readback publishedHtmlJson VERBATIM.
+            const readback = await wireCall(session, { path: ENDPOINTS.sheetGet, query: { schemaCode: args.schemaCode, sheetCode: targetSheetCode } });
+            const publishedSheet = (readback.data ?? {});
+            const publishedRaw = typeof publishedSheet.publishedHtmlJson === "string" ? publishedSheet.publishedHtmlJson : "";
+            if (publishedRaw !== "")
+                assertHtmlRender(publishedRaw, { schemaCode: args.schemaCode, sheetCode: targetSheetCode, face: "publishedHtmlJson" }, true);
+            const publishedElements = parseLayoutElements(publishedRaw);
+            // 8. SHA-256 of the verbatim content.
+            const publishedSha256 = createHash("sha256").update(publishedRaw).digest("hex");
+            const draftSha256 = createHash("sha256").update(composedDraftHtml).digest("hex");
+            const publishedScript = readCustomScriptSource(publishedRaw).script;
+            const customScriptSha256 = createHash("sha256").update(composedScript, "utf8").digest("hex");
+            const draftPublishedInSync = publishedScript !== null && publishedScript === composedScript;
+            const htmlRenderCompat = { draft: validateHtmlRender(composedDraftHtml, true), published: validateHtmlRender(publishedRaw, true) };
+            // Live 2026-10-21 (customer): this readback shipped the same ~10KB script
+            // three times (composedDraftHtmlJson + publishedHtmlJson + customScript),
+            // ~45KB for a call whose only question was "did publish land?" — the
+            // session's single largest context amplification. Answer that question
+            // directly and keep 原文 opt-in.
+            if (args.summary === true) {
+                return {
+                    performed: { errcode: 0, published },
+                    readback: {
+                        publishedSha256,
+                        draftSha256,
+                        draftPublishedInSync,
+                        publishedElementCount: publishedElements.length,
+                        scriptElementPresent: publishedElements.some((element) => element.id === "customScript"),
+                        customScriptMerged: args.replace !== true,
+                        customScriptSha256,
+                        customScriptBytes: Buffer.byteLength(composedScript, "utf8"),
+                        composedDraftBytes: Buffer.byteLength(composedDraftHtml, "utf8"),
+                        publishedHtmlBytes: Buffer.byteLength(publishedRaw, "utf8"),
+                        htmlRenderCompat,
+                        hint: "summary 模式不回原文；要脚本原文用 onlinejs.get，要完整布局用 artifact 或 form.get --full",
+                    },
+                };
+            }
             return {
                 performed: { errcode: 0, published },
                 readback: {
+                    // Dedupe: after a successful publish the draft and the published
+                    // face are the same bytes, and the script also rides inside them.
+                    // Return the composed payload ONCE (composedDraftHtmlJson keeps the
+                    // field every consumer already reads) and state the equality instead
+                    // of repeating ~11KB + ~10KB.
+                    ...(composedDraftHtml === publishedRaw
+                        ? { draftEqualsPublished: true }
+                        : { publishedHtmlJson: publishedRaw }),
+                    composedDraftHtmlJson: composedDraftHtml,
                     publishedSha256,
                     draftSha256,
                     draftPublishedInSync,
                     publishedElementCount: publishedElements.length,
                     scriptElementPresent: publishedElements.some((element) => element.id === "customScript"),
+                    customScript: composedScript,
+                    customScriptMatchesPublished: draftPublishedInSync,
                     customScriptMerged: args.replace !== true,
-                    customScriptSha256,
-                    customScriptBytes: Buffer.byteLength(composedScript, "utf8"),
-                    composedDraftBytes: Buffer.byteLength(composedDraftHtml, "utf8"),
-                    publishedHtmlBytes: Buffer.byteLength(publishedRaw, "utf8"),
                     htmlRenderCompat,
-                    hint: "summary 模式不回原文；要脚本原文用 onlinejs.get，要完整布局用 artifact 或 form.get --full",
                 },
             };
-        }
-        return {
-            performed: { errcode: 0, published },
-            readback: {
-                // Dedupe: after a successful publish the draft and the published
-                // face are the same bytes, and the script also rides inside them.
-                // Return the composed payload ONCE (composedDraftHtmlJson keeps the
-                // field every consumer already reads) and state the equality instead
-                // of repeating ~11KB + ~10KB.
-                ...(composedDraftHtml === publishedRaw
-                    ? { draftEqualsPublished: true }
-                    : { publishedHtmlJson: publishedRaw }),
-                composedDraftHtmlJson: composedDraftHtml,
-                publishedSha256,
-                draftSha256,
-                draftPublishedInSync,
-                publishedElementCount: publishedElements.length,
-                scriptElementPresent: publishedElements.some((element) => element.id === "customScript"),
-                customScript: composedScript,
-                customScriptMatchesPublished: draftPublishedInSync,
-                customScriptMerged: args.replace !== true,
-                htmlRenderCompat,
-            },
-        };
-    }, 
-    // Refuse a source that cannot run in the script slot (export/import, unknown
-    // form.on event) BEFORE the write permission gate. This is the exact
-    // class of mistake that blanked a live form page with no harness signal.
-    (args) => lintOnlineJsSource(args.source), 
-    // r23 F4：dry-run 必须走与真写相同的 compose 校验路径（含 replace/merge 的
-    // wrapper 判定），否则 dry-run 过、真写拒——探针按 dry-run 绿灯写正式调用被拒。
-    async (session, args) => {
-        const current = await wireCall(session, { path: ENDPOINTS.sheetGet, query: { schemaCode: args.schemaCode, sheetCode: args.sheetCode ?? args.schemaCode } });
-        const sheet = (current.data ?? null);
-        const raw = typeof sheet?.draftHtmlJson === "string" ? sheet.draftHtmlJson : "";
-        const compat = validateHtmlRender(raw);
-        const elements = compat.ok ? parseLayoutElements(raw) : [];
-        const existingScript = String(elements.find((element) => element.id === "customScript")?.innerHTML ?? "");
-        const composed = composeCustomScript(existingScript, args.source, args.replace === true ? "replace" : "merge");
-        return {
-            mode: args.replace === true ? "replace" : "merge",
-            wouldChange: composed !== existingScript,
-            composedSha256: createHash("sha256").update(composed, "utf8").digest("hex"),
-            composedBytes: Buffer.byteLength(composed, "utf8"),
-            hint: "dry-run 已执行与真写一致的 compose 校验；该结果即正式调用将落库的脚本形状",
-        };
-    }, {
-        target: (args) => `onlinejs:${String(args.schemaCode ?? "")}/${String(args.sheetCode ?? args.schemaCode ?? "")}`,
-        read: async (session, args) => {
-            const sheet = await readFormOrNull(session, String(args.schemaCode), String(args.sheetCode ?? args.schemaCode));
-            if (!sheet)
-                return null;
-            const raw = typeof sheet.draftHtmlJson === "string" ? sheet.draftHtmlJson : "";
-            let elements = [];
-            try {
-                const parsed = JSON.parse(raw);
-                if (Array.isArray(parsed))
-                    elements = parsed;
-            }
-            catch { }
-            const script = elements.find((element) => element && typeof element === "object" && element.id === "customScript");
-            return { customScript: typeof script?.innerHTML === "string" ? script.innerHTML : null };
         },
-        inverse: ({ before, args }) => {
-            const source = before?.customScript;
-            if (typeof source !== "string")
-                return { kind: "irreversible", reason: "before 表单没有可识别的 customScript element，无法构造清空脚本的等价 compose 调用" };
-            return { kind: "calls", calls: [{ tool: "onlinejs.compose", args: { schemaCode: String(args.schemaCode), sheetCode: String(args.sheetCode ?? args.schemaCode), source, replace: true, publish: args.publish } }] };
+        preflight: // Refuse a source that cannot run in the script slot (export/import, unknown
+        // form.on event) BEFORE the write permission gate. This is the exact
+        // class of mistake that blanked a live form page with no harness signal.
+        (args) => lintOnlineJsSource(args.source),
+        dryRunPayload: // r23 F4：dry-run 必须走与真写相同的 compose 校验路径（含 replace/merge 的
+        // wrapper 判定），否则 dry-run 过、真写拒——探针按 dry-run 绿灯写正式调用被拒。
+        async (session, args) => {
+            const current = await wireCall(session, { path: ENDPOINTS.sheetGet, query: { schemaCode: args.schemaCode, sheetCode: args.sheetCode ?? args.schemaCode } });
+            const sheet = (current.data ?? null);
+            const raw = typeof sheet?.draftHtmlJson === "string" ? sheet.draftHtmlJson : "";
+            const compat = validateHtmlRender(raw);
+            const elements = compat.ok ? parseLayoutElements(raw) : [];
+            const existingScript = String(elements.find((element) => element.id === "customScript")?.innerHTML ?? "");
+            const composed = composeCustomScript(existingScript, args.source, args.replace === true ? "replace" : "merge");
+            return {
+                mode: args.replace === true ? "replace" : "merge",
+                wouldChange: composed !== existingScript,
+                composedSha256: createHash("sha256").update(composed, "utf8").digest("hex"),
+                composedBytes: Buffer.byteLength(composed, "utf8"),
+                hint: "dry-run 已执行与真写一致的 compose 校验；该结果即正式调用将落库的脚本形状",
+            };
+        },
+        rollback: {
+            target: (args) => `onlinejs:${String(args.schemaCode ?? "")}/${String(args.sheetCode ?? args.schemaCode ?? "")}`,
+            read: async (session, args) => {
+                const sheet = await readFormOrNull(session, String(args.schemaCode), String(args.sheetCode ?? args.schemaCode));
+                if (!sheet)
+                    return null;
+                const raw = typeof sheet.draftHtmlJson === "string" ? sheet.draftHtmlJson : "";
+                let elements = [];
+                try {
+                    const parsed = JSON.parse(raw);
+                    if (Array.isArray(parsed))
+                        elements = parsed;
+                }
+                catch { }
+                const script = elements.find((element) => element && typeof element === "object" && element.id === "customScript");
+                return { customScript: typeof script?.innerHTML === "string" ? script.innerHTML : null };
+            },
+            inverse: ({ before, args }) => {
+                const source = before?.customScript;
+                if (typeof source !== "string")
+                    return { kind: "irreversible", reason: "before 表单没有可识别的 customScript element，无法构造清空脚本的等价 compose 调用" };
+                return { kind: "calls", calls: [{ tool: "onlinejs.compose", args: { schemaCode: String(args.schemaCode), sheetCode: String(args.sheetCode ?? args.schemaCode), source, replace: true, publish: args.publish } }] };
+            },
         },
     });
 }