omc-core 0.4.35 → 0.4.37

package/dist/childtable-sheet201-contract.js

@@ -1,5 +1,5 @@
 import { buildChildTableDeleteRequest, buildSheetControlBinding } from "./childtable-field-contract.js";
-import { ticket11ScaffoldControlKeys, buildTicket11ScaffoldControls, ticket11DraftLayoutIsEmpty } from "./ticket11-test-form-draft.js";
+import { ticket11ScaffoldControlKeys, buildTicket11ScaffoldControls, ticket11DraftLayoutIsEmpty } from "./form-scaffold-contract.js";
 export const CHILD_TABLE_SHEET201_ENDPOINTS = Object.freeze({
     fieldPublish: "/api/api/app/bizproperty/publish",
     formGet: "/api/api/app/bizsheet/get",

package/dist/field-probe-runner-contract.js

@@ -1,6 +1,6 @@
 import { CHILD_TABLE_CONTRACT } from "./childtable-field-contract.js";
 import { FORMULA_FIELD_CONTRACT } from "./formula-field-contract.js";
-import { ticket08TargetSchemaCode, isTicket08TargetSchema } from "./ticket08-test-model-mutation.js";
+import { ticket08TargetSchemaCode, isTicket08TargetSchema } from "./field-probe-schema.js";
 export const FIELD_PROBE_MODES = Object.freeze(["rehearsal", "execute"]);
 export const FIELD_PROBE_KINDS = Object.freeze(["formula", "childtable"]);
 export const FIELD_PROBE_PHASES = Object.freeze(["field-create", "publish", "controls"]);

package/dist/field-probe-schema.js

@@ -0,0 +1,19 @@
+/**
+ * 字段探针目标模型 schema 契约（生产）：omc_t08_<16hex> 生成/识别/断言。
+ * 原实现住在 ticket08 测试编排内；C2-lite 拆分——field-probe-runner 与测试岛屿共用。
+ */
+import { randomUUID } from "node:crypto";
+export const TICKET08_TARGET_SCHEMA_PATTERN = /^omc_t08_[0-9a-f]{16}$/;
+const TICKET08_SCHEMA_CODE_PREFIX = "omc_t08_";
+export function ticket08TargetSchemaCode() {
+    return `${TICKET08_SCHEMA_CODE_PREFIX}${randomUUID().replaceAll("-", "").slice(0, 16)}`;
+}
+export function isTicket08TargetSchema(targetSchemaCode) {
+    return TICKET08_TARGET_SCHEMA_PATTERN.test(targetSchemaCode);
+}
+export function assertTicket08TargetSchema(targetSchemaCode) {
+    if (!isTicket08TargetSchema(targetSchemaCode))
+        throw new Error("Ticket 08 targetSchemaCode must be a host-scoped omc_t08_<16-hex> schema within the CloudPivot 8.6.26 26-character code contract.");
+    return targetSchemaCode;
+}
+//# sourceMappingURL=field-probe-schema.js.map

package/dist/form-scaffold-contract.js

@@ -0,0 +1,126 @@
+/**
+ * 表单脚手架契约（生产）：默认表单 Title/系统行/Group 三行脚手架的构建与解码。
+ * 原实现住在 ticket11 测试编排内；C2-lite 拆分——生产消费者
+ * （formula-controls / childtable-sheet201 契约）与测试岛屿共用此唯一事实源。
+ */
+export const TICKET11_SCAFFOLD_SYSTEM_ROW = Object.freeze(["creater", "createdTime", "sequenceNo"]);
+export const TICKET11_SCAFFOLD_SYSTEM_CONTROL_TYPES = Object.freeze({ creater: 101, createdTime: 104, sequenceNo: 100 });
+/** The UID rule value is a designer/composer constant, not a per-model scheme reference (research §13.2). */
+export const TICKET11_SCAFFOLD_SEQNO_UID_VALUE = "aa860e64ff2e4f86851a661d663ae358";
+export const TICKET11_SCAFFOLD_GROUP_NAME = "业务标题";
+export const TICKET11_SCAFFOLD_DATE_FORMAT = "YYYY-MM-DD HH:mm:ss";
+/** One shared timestamp per composition mirrors the designer's Title<ts>/Group<ts> pattern (research §13.4). */
+export function ticket11ScaffoldControlKeys(capturedAt) {
+    const epochMs = Date.parse(capturedAt);
+    if (!Number.isFinite(epochMs) || epochMs <= 0)
+        throw new Error("Ticket 11 scaffold composition requires the evidence capture clock; nothing ships on guessed layout keys.");
+    return Object.freeze({ titleKey: `Title${epochMs}`, groupKey: `Group${epochMs}` });
+}
+function deepFrozen(value) {
+    if (Array.isArray(value))
+        return Object.freeze(value.map(deepFrozen));
+    if (value && typeof value === "object")
+        return Object.freeze(Object.fromEntries(Object.entries(value).map(([key, item]) => [key, deepFrozen(item)])));
+    return value;
+}
+/** The designer-standard scaffolding control map entries, mirroring the live agent_test_customer sample member-for-member (research §13.1). Deep-frozen: the composition is an immutable contract value. */
+export function buildTicket11ScaffoldControls(input) {
+    return deepFrozen({
+        [input.titleKey]: {
+            key: input.titleKey,
+            type: 203,
+            options: {
+                name: input.formName,
+                name_i18n: { en: input.formName, zh: input.formName },
+                visible: true,
+                labelVisible: true,
+                span: 24,
+                labelAlign: "",
+                style: "",
+                tips: "",
+                dataItemName: "",
+                useDataTitle: true,
+                styleInfo: { height: 1, bgColor: "#ffffff", bgImg: "", textAlign: "center", fontSize: 28, textColor: "#111218", blod: true, italic: false, textCss: "", textCssSwitch: false },
+            },
+        },
+        creater: {
+            key: "creater",
+            type: TICKET11_SCAFFOLD_SYSTEM_CONTROL_TYPES.creater,
+            options: { name: "创建人", name_i18n: "", visible: true, labelVisible: true, span: 8, labelAlign: "", style: "", tips: "", dataItemName: "", widgetType: "", dataItemType: "", mappings: "", verifyFormula: "", defaultValue: "" },
+        },
+        createdTime: {
+            key: "createdTime",
+            type: TICKET11_SCAFFOLD_SYSTEM_CONTROL_TYPES.createdTime,
+            options: { name: "创建时间", name_i18n: "", visible: true, labelVisible: true, span: 8, labelAlign: "", style: "", tips: "", dataItemName: "", widgetType: "", dataItemType: "", format1: TICKET11_SCAFFOLD_DATE_FORMAT, format: TICKET11_SCAFFOLD_DATE_FORMAT, syncFormate: true, verifyFormula: "", defaultValue: "" },
+        },
+        sequenceNo: {
+            key: "sequenceNo",
+            type: TICKET11_SCAFFOLD_SYSTEM_CONTROL_TYPES.sequenceNo,
+            options: { name: "单据号", name_i18n: "", visible: true, labelVisible: true, span: 8, labelAlign: "", style: "", tips: "", dataItemName: "", widgetType: "", dataItemType: "", seqNoSetting: [{ type: "UID", value: TICKET11_SCAFFOLD_SEQNO_UID_VALUE }], formPropertyType: 100, verifyFormula: "", displayFormula: "", defaultValue: "" },
+        },
+        [input.groupKey]: {
+            key: input.groupKey,
+            type: 200,
+            options: { name: TICKET11_SCAFFOLD_GROUP_NAME, tips: "", expand: true, align: "", style: "", styleInfo: { fontSize: 18, textColor: "#111218", blod: true, italic: false, textCss: "", textCssSwitch: false }, span: 24 },
+        },
+    });
+}
+/** An auto-created default form decodes with an empty draft layout (research §2): draftViewJson null/[] and draftAttributesJson null/{}. */
+export function ticket11DraftLayoutIsEmpty(form) {
+    let view = null;
+    let attributes = null;
+    try {
+        view = form.draftViewJson === null ? [] : JSON.parse(form.draftViewJson);
+        attributes = form.draftAttributesJson === null ? {} : JSON.parse(form.draftAttributesJson);
+    }
+    catch {
+        return false;
+    }
+    return Array.isArray(view) && view.length === 0 && typeof attributes === "object" && attributes !== null && !Array.isArray(attributes) && Object.keys(attributes).length === 0;
+}
+export function decodeTicket11ScaffoldPresence(form) {
+    if (form.draftViewJson === null || form.draftAttributesJson === null)
+        return { decodable: false, rowOrderMatchesContract: false };
+    let view;
+    let attributes;
+    try {
+        view = JSON.parse(form.draftViewJson);
+        attributes = JSON.parse(form.draftAttributesJson);
+    }
+    catch {
+        return { decodable: false, rowOrderMatchesContract: false };
+    }
+    if (!Array.isArray(view) || view.some((row) => !Array.isArray(row) || row.some((key) => typeof key !== "string")) || !attributes || typeof attributes !== "object" || Array.isArray(attributes))
+        return { decodable: false, rowOrderMatchesContract: false };
+    const rows = view;
+    const map = attributes;
+    const entry = (key) => {
+        const value = map[key];
+        return value && typeof value === "object" && !Array.isArray(value) && typeof value.type === "number" && value.options && typeof value.options === "object"
+            ? value
+            : undefined;
+    };
+    // The row contract is positional (research §13.5): row 0 is the single-key
+    // Title row, row 1 is exactly the system row, row 2 is the single-key Group
+    // row. Extra or duplicated scaffold rows decode as non-contract.
+    const isTitleKey = (key) => /^Title\d+$/.test(key);
+    const isGroupKey = (key) => /^Group\d+$/.test(key);
+    const titleShaped = rows.length >= 3 && rows[0].length === 1 && isTitleKey(rows[0][0]) && entry(rows[0][0]) !== undefined;
+    const systemShaped = rows.length >= 3 && rows[1].length === 3 && rows[1][0] === "creater" && rows[1][1] === "createdTime" && rows[1][2] === "sequenceNo";
+    const groupShaped = rows.length >= 3 && rows[2].length === 1 && isGroupKey(rows[2][0]) && entry(rows[2][0]) !== undefined;
+    if (!titleShaped || !systemShaped || !groupShaped)
+        return { decodable: false, rowOrderMatchesContract: false };
+    const title = entry(rows[0][0]);
+    const group = entry(rows[2][0]);
+    const systemTypes = rows[1].map((key) => entry(key)?.type ?? -1);
+    const scaffoldRowsOnly = rows.slice(0, 3).every((row, index) => index === 0 ? row.length === 1 && isTitleKey(row[0] ?? "") : index === 1 ? row.length === 3 : row.length === 1 && isGroupKey(row[0] ?? "")) && rows.slice(3).every((row) => row.length === 0 || (!isTitleKey(row[0] ?? "") && !isGroupKey(row[0] ?? "") && row[0] !== "creater" && row[0] !== "createdTime" && row[0] !== "sequenceNo"));
+    return Object.freeze({
+        decodable: true,
+        title: Object.freeze({ key: rows[0][0], type: title.type, useDataTitle: title.options.useDataTitle === true, name: title.options.name }),
+        systemRow: Object.freeze({ keys: Object.freeze([...rows[1]]), types: Object.freeze(systemTypes) }),
+        group: Object.freeze({ key: rows[2][0], type: group.type }),
+        rowOrder: Object.freeze(rows.map((row) => row.join("+"))),
+        rowOrderMatchesContract: scaffoldRowsOnly,
+    });
+}
+//# sourceMappingURL=form-scaffold-contract.js.map

package/dist/formula-controls-contract.js

@@ -1,6 +1,6 @@
 import { decodeDraftControl } from "./cloudpivot-low-code.js";
 import { buildFormulaFieldDeleteRequest } from "./formula-field-contract.js";
-import { buildTicket11ScaffoldControls, decodeTicket11ScaffoldPresence, ticket11DraftLayoutIsEmpty, ticket11ScaffoldControlKeys } from "./ticket11-test-form-draft.js";
+import { buildTicket11ScaffoldControls, decodeTicket11ScaffoldPresence, ticket11DraftLayoutIsEmpty, ticket11ScaffoldControlKeys } from "./form-scaffold-contract.js";
 export const FORMULA_CONTROL_TYPE = 89;
 export const FORMULA_FORM_DRAFT_ENDPOINT = "/api/api/app/bizsheet/update";
 export const FORMULA_FORM_PUBLISH_ENDPOINT = "/api/api/app/bizsheet/publish";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omc-core",
-  "version": "0.4.35",
+  "version": "0.4.37",
   "description": "Shared OMC capability kernel: capability contracts, governance, and decoders. Zero DSH dependencies.",
   "type": "module",
   "files": [

package/dist/master-plan-approval.js

@@ -1,443 +0,0 @@
-// Ticket 16 (approval-readability issue 02): the conversational plan-of-record
-// with a single master approval for the standard Ticket 08→12 composite chain.
-//
-// Phase-0 mechanism decisions (recorded in the issue file):
-//
-// 1. HOW ONE APPROVAL BINDS MANY PACKAGES. Later-stage packages cannot exist
-//    before earlier stages execute (each stage's evidence consumes the prior
-//    stage's completed, behavior-validated execution report; package hashes
-//    embed live baseline fingerprints), so literal pre-execution enumeration of
-//    all five package ids/hashes is impossible without weakening the serial
-//    evidence discipline. The master approval therefore binds the chain by its
-//    DETERMINISTIC DERIVED IDENTITY, pre-minted by the Host at compose time:
-//    one testRunId for the whole run plus the exact target identities
-//    (omc_t08_<16-hex> schema, omc_t09_<16-hex> field, default sheet), the
-//    routes, the pinned 8.6.26 capability contract hashes, the Knowledge Pack
-//    digests, the exact scopes, and the declared staged-cleanup contracts. The
-//    sha256 over that canonical enumeration is the single hash anchor carried
-//    by the master approval frame. Every concrete package must then match its
-//    enumerated slot EXACTLY to consume the grant, and each consumption binds
-//    the concrete packageId/packageHash into the master record — so the
-//    acceptance record shows the literal package id/hash per stage after the
-//    fact. A package that is not enumerated refuses the grant: it can only
-//    execute through its own per-package DSH approval frame (the unchanged
-//    legacy/emergency path).
-//
-// 2. PLAN-TEXT PROVENANCE. The conversational plan-of-record is HOST-DERIVED:
-//    it is rendered by this module from the immutable master plan record and
-//    surfaced as the omc_master_plan_compose tool output (visible in the DSH
-//    chat history). It is never accepted as an input anywhere; the approval
-//    binds to the record and its hash anchor, not to any displayed text, so
-//    model paraphrasing has no effect. The omc_master_plan_approve tool
-//    re-renders both the plan text and the approval frame from the record and
-//    byte-compares (verifyConversationalMasterPlan /
-//    verifyMasterApprovalFrameHumanBlock) — the binding lives in the
-//    structure, not in the display text.
-//
-// Ticket 17 (issue 03, grill 2026-09-05) — presentation-only format polish:
-// the plan-of-record renders as the approved markdown table (| # | 操作 |
-// 目标 | 说明 | with the staged cleanups as rows 6-7; boundary promises in
-// one header line; scope strings and per-stage contract hashes only in the
-// machine receipt below the plan text), with the approved compact-list
-// fallback for plain-text tool-output rendering; the master approval frame
-// is exactly three host-derived lines with the machine prefix deleted (new
-// contract, no archived-replay obligation — the legacy per-stage frames stay
-// byte-identical); stage results report one line per success with full
-// verbatim disclosure on failure/blocked/uncertain. Governance mechanics are
-// untouched.
-import { createHash, randomUUID } from "node:crypto";
-import { assertMasterApprovalFrameHumanBlock, renderMasterApprovalFrame, verifyMasterApprovalFrameHumanBlock } from "./approval-frame-readability.js";
-import { activeFieldFamily, fieldFamilyMembers } from "./families/registry.js";
-/** The DSH tool that carries the single master approval frame. */
-export const MASTER_APPROVAL_TOOL_NAME = "omc_master_plan_approve";
-/**
- * Byte-stable line prefix the maintainer runner matches for the single master
- * frame (Ticket 17: the machine prefix line was deleted — the frame's first
- * line IS the approval summary, so this prefix anchors it).
- */
-export const MASTER_APPROVAL_REASON_PREFIX = "批准执行 ";
-const HEX64 = /^[a-f0-9]{64}$/i;
-const UUID_V4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
-const TARGET_SCHEMA = /^omc_t08_[0-9a-f]{16}$/;
-const TARGET_FIELD = /^omc_t09_[0-9a-f]{16}$/;
-const FOLDER_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{7,63}$/;
-/**
- * Composes the immutable master plan record: pre-mints the whole chain's
- * derived identity (one testRunId, fixture schema/field codes, default sheet)
- * and derives the single hash anchor over the canonical enumeration.
- */
-export function composeMasterPlan(input) {
-    if (input.environmentName !== "test" || input.applicationCode !== "test")
-        throw new Error("The master delivery plan is restricted to the named test environment and its dedicated test application.");
-    if (!FOLDER_ID.test(input.folder.id) || typeof input.folder.name !== "string" || !input.folder.name.trim())
-        throw new Error("The master delivery plan requires the exact discovered folder identity.");
-    const testRunId = input.ids?.testRunId ?? randomUUID();
-    const targetSchemaCode = input.ids?.targetSchemaCode ?? `omc_t08_${randomUUID().replaceAll("-", "").slice(0, 16)}`;
-    // Ticket 25: stage 2 creates the ACTIVE family's typed fields (one code
-    // per registered member, in governed order) and every later stage binds the
-    // same ordered set.
-    const memberCount = fieldFamilyMembers().length;
-    const targetFieldCodes = input.ids?.targetFieldCodes ?? Array.from({ length: memberCount }, () => `omc_t09_${randomUUID().replaceAll("-", "").slice(0, 16)}`);
-    if (!UUID_V4.test(testRunId) || !TARGET_SCHEMA.test(targetSchemaCode) || targetFieldCodes.length !== memberCount || targetFieldCodes.some((code) => !TARGET_FIELD.test(code)) || new Set(targetFieldCodes).size !== memberCount)
-        throw new Error("The master delivery plan identities must be the host-scoped testRunId, omc_t08 schema code, and one distinct omc_t09 family field code per active family member.");
-    const stageOrder = ["ticket08-test-model-mutation", "ticket09-test-field-mutation", "ticket10-test-field-publish", "ticket11-test-form-draft", "ticket20-test-data-rule", "ticket12-test-form-publish"];
-    const humanCapabilities = {
-        "ticket08-test-model-mutation": "ticket08-model-create",
-        "ticket09-test-field-mutation": "ticket09-field-create",
-        "ticket10-test-field-publish": "ticket10-field-publish",
-        "ticket11-test-form-draft": "ticket11-form-draft",
-        "ticket20-test-data-rule": "ticket20-data-rule",
-        "ticket12-test-form-publish": "ticket12-form-publish",
-    };
-    const stages = stageOrder.map((route, index) => {
-        const pin = input.stagePins[route];
-        if (!pin || pin.route !== route || !pin.capabilityId || !HEX64.test(pin.contractHash) || !HEX64.test(pin.knowledgePackDigest))
-            throw new Error(`The master delivery plan requires the pinned capability, contract hash, and Knowledge Pack digest for ${route}.`);
-        const slot = {
-            stage: (index + 1),
-            route,
-            capabilityId: pin.capabilityId,
-            humanCapability: humanCapabilities[route],
-            targetSchemaCode,
-            targetFieldCodes: index >= 1 ? targetFieldCodes : undefined,
-            targetSheetCode: index >= 3 ? targetSchemaCode : undefined,
-            scope: index === 0 ? `cloudpivot:model:${targetSchemaCode}` : index <= 2 ? `cloudpivot:fields:${targetSchemaCode}/${targetFieldCodes.join("+")}` : index === 4 ? `cloudpivot:rule:${targetSchemaCode}/${targetFieldCodes[activeFieldFamily().ruleDemoTargetPosition - 1]}` : `cloudpivot:form:${targetSchemaCode}/${targetSchemaCode}`,
-            contractHash: pin.contractHash,
-            knowledgePackDigest: pin.knowledgePackDigest,
-        };
-        return slot;
-    });
-    const fieldCleanupPin = input.cleanupPins["ticket10-test-field-cleanup"];
-    const modelCleanupPin = input.cleanupPins["ticket08-test-model-cleanup"];
-    if (!fieldCleanupPin || !modelCleanupPin)
-        throw new Error("The master delivery plan requires both declared staged-cleanup pins.");
-    const cleanups = [
-        { route: "ticket10-test-field-cleanup", followsStage: 3, capabilityId: fieldCleanupPin.capabilityId, contractHash: fieldCleanupPin.contractHash },
-        { route: "ticket08-test-model-cleanup", followsStage: 1, capabilityId: modelCleanupPin.capabilityId, contractHash: modelCleanupPin.contractHash },
-    ];
-    for (const cleanup of cleanups) {
-        if (!cleanup.capabilityId || !HEX64.test(cleanup.contractHash))
-            throw new Error(`The master delivery plan requires the pinned cleanup capability and contract hash for ${cleanup.route}.`);
-    }
-    const createdAt = (input.now ?? (() => new Date()))().toISOString();
-    const record = {
-        masterPlanId: `master-${createHash("sha256").update(`${createdAt}:${testRunId}:${targetSchemaCode}:${targetFieldCodes.join("+")}`).digest("hex").slice(0, 24)}`,
-        createdAt,
-        environmentName: input.environmentName,
-        applicationCode: input.applicationCode,
-        folder: { id: input.folder.id, name: input.folder.name },
-        testRunId,
-        stages,
-        cleanups,
-        masterHash: "",
-        status: "proposed",
-        consumed: [],
-        ledgerHash: "",
-    };
-    const sealed = { ...record, masterHash: masterPlanHash(record) };
-    return { ...sealed, ledgerHash: masterLedgerHash(sealed.approval, sealed.consumed) };
-}
-function canonical(value) {
-    return JSON.stringify(sort(value));
-}
-function sort(value) {
-    if (Array.isArray(value))
-        return value.map(sort);
-    if (value && typeof value === "object")
-        return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => [key, sort(item)]));
-    return value;
-}
-/** The hash anchor is computed over the canonical enumeration only — never over display text. */
-function masterPlanHash(record) {
-    return createHash("sha256").update(canonical({
-        testRunId: record.testRunId,
-        folder: record.folder,
-        stages: record.stages.map((slot) => ({ stage: slot.stage, route: slot.route, capabilityId: slot.capabilityId, targetSchemaCode: slot.targetSchemaCode, targetFieldCodes: slot.targetFieldCodes ?? null, targetSheetCode: slot.targetSheetCode ?? null, scope: slot.scope, contractHash: slot.contractHash, knowledgePackDigest: slot.knowledgePackDigest })),
-        cleanups: record.cleanups.map((cleanup) => ({ route: cleanup.route, followsStage: cleanup.followsStage, capabilityId: cleanup.capabilityId, contractHash: cleanup.contractHash })),
-    })).digest("hex");
-}
-/** Integrity root over the approval binding plus the consumption ledger (the masterHash stays fixed at approval time). */
-function masterLedgerHash(approval, consumed) {
-    return createHash("sha256").update(canonical({
-        approval: approval ? { callId: approval.callId, approvedAt: approval.approvedAt } : null,
-        consumed: consumed.map((item) => ({ kind: item.kind, route: item.route, stage: item.stage, planApprovalId: item.planApprovalId, packageId: item.packageId ?? null, packageHash: item.packageHash ?? null, consumedAt: item.consumedAt })),
-    })).digest("hex");
-}
-/** Re-derives both roots and fails any record whose enumeration or approval/consumption ledger diverges. */
-export function verifyMasterPlanRecord(record) {
-    if (!record || !Array.isArray(record.stages) || record.stages.length !== 6 || !Array.isArray(record.cleanups) || !Array.isArray(record.consumed))
-        throw new Error("Master plan record is malformed.");
-    if (record.masterHash !== masterPlanHash(record))
-        throw new Error("Master plan record diverges from its own hash anchor.");
-    if (record.ledgerHash !== masterLedgerHash(record.approval, record.consumed))
-        throw new Error("Master plan record approval or consumption ledger diverges from its integrity root.");
-    if (!UUID_V4.test(record.testRunId))
-        throw new Error("Master plan record testRunId is malformed.");
-    if (record.status !== "proposed" && record.status !== "approved")
-        throw new Error("Master plan record status is malformed.");
-    if (record.status === "approved" && (!record.approval || !record.approval.callId || !Number.isFinite(Date.parse(record.approval.approvedAt))))
-        throw new Error("Approved master plan record is missing its approval binding.");
-    if (/(password|token|cookie|client[_-]?secret|authorization|api[_-]?key|private[_-]?key|bearer\s|-----begin|raw[_-]?(request|response|log))/i.test(canonical(record)))
-        throw new Error("Master plan record contains prohibited sensitive data.");
-}
-/** Marks the master plan approved under the one DSH approval call. */
-export function approveMasterPlan(record, approval) {
-    verifyMasterPlanRecord(record);
-    if (record.status === "approved")
-        throw new Error("Master plan is already approved.");
-    if (!approval.callId)
-        throw new Error("Master plan approval requires the DSH call ID provenance.");
-    const approved = { ...record, status: "approved", approval: { callId: approval.callId, approvedAt: approval.approvedAt ?? new Date().toISOString() } };
-    if (approved.masterHash !== masterPlanHash(approved))
-        throw new Error("Approved master plan diverges from its hash anchor.");
-    return { ...approved, ledgerHash: masterLedgerHash(approved.approval, approved.consumed) };
-}
-function candidateMatchesSlot(slot, candidate) {
-    return slot.route === candidate.route
-        && slot.targetSchemaCode === candidate.targetSchemaCode
-        && (slot.targetFieldCodes ? slot.targetFieldCodes.join("+") : undefined) === (candidate.targetFieldCodes ? candidate.targetFieldCodes.join("+") : undefined)
-        && (slot.targetSheetCode ?? undefined) === (candidate.targetSheetCode ?? undefined);
-}
-/** Exact plan-membership: an approved master plan's slot matches only the identical derived identity. */
-export function matchMasterStageSlot(record, candidate) {
-    verifyMasterPlanRecord(record);
-    if (record.status !== "approved")
-        return undefined;
-    if (record.testRunId !== candidate.testRunId)
-        return undefined;
-    return record.stages.find((slot) => candidateMatchesSlot(slot, candidate));
-}
-/** Exact plan-membership for the declared staged cleanups (lineage: same testRunId + the followed stage's exact targets). */
-export function matchMasterCleanupSlot(record, candidate) {
-    verifyMasterPlanRecord(record);
-    if (record.status !== "approved")
-        return undefined;
-    if (record.testRunId !== candidate.testRunId)
-        return undefined;
-    for (const cleanup of record.cleanups) {
-        if (cleanup.route !== candidate.route)
-            continue;
-        const slot = record.stages.find((stage) => stage.stage === cleanup.followsStage);
-        if (!slot)
-            continue;
-        if (slot.targetSchemaCode === candidate.targetSchemaCode
-            && (slot.targetFieldCodes ? slot.targetFieldCodes.join("+") : undefined) === (candidate.targetFieldCodes ? candidate.targetFieldCodes.join("+") : undefined)
-            && (slot.targetSheetCode === undefined || candidate.targetSheetCode === undefined || slot.targetSheetCode === candidate.targetSheetCode))
-            return { slot, cleanup };
-    }
-    return undefined;
-}
-/** Records one grant consumption; identical re-consumption is a no-op, divergent re-consumption is refused. */
-export function recordMasterPlanConsumption(record, consumption) {
-    verifyMasterPlanRecord(record);
-    if (record.status !== "approved")
-        throw new Error("Master plan consumption requires the approved master plan.");
-    if (!consumption.planApprovalId || !Number.isFinite(Date.parse(consumption.consumedAt)))
-        throw new Error("Master plan consumption is malformed.");
-    if (consumption.packageHash && !HEX64.test(consumption.packageHash))
-        throw new Error("Master plan consumption package hash is malformed.");
-    const existing = record.consumed.find((item) => item.kind === consumption.kind && item.route === consumption.route && item.stage === consumption.stage);
-    if (existing) {
-        if (existing.planApprovalId !== consumption.planApprovalId || (existing.packageId ?? undefined) !== (consumption.packageId ?? undefined))
-            throw new Error("Master plan grant was already consumed by a different approval or package; operator reconcile is required.");
-        return record;
-    }
-    const consumed = [...record.consumed, consumption];
-    return { ...record, consumed, ledgerHash: masterLedgerHash(record.approval, consumed) };
-}
-/** The human block input derived from the immutable record — the only source both renderers share. */
-export function masterApprovalHumanBlockInput(record) {
-    verifyMasterPlanRecord(record);
-    return {
-        stages: record.stages.map((slot) => ({
-            capability: slot.humanCapability,
-            identities: [
-                slot.targetSchemaCode,
-                ...(slot.humanCapability === "ticket20-data-rule"
-                    ? [slot.targetFieldCodes?.[activeFieldFamily().ruleDemoTargetPosition - 1]]
-                    : slot.targetFieldCodes ?? []),
-                ...(slot.targetSheetCode && (slot.humanCapability === "ticket11-form-draft" || slot.humanCapability === "ticket12-form-publish") ? [slot.targetSheetCode] : []),
-            ],
-            scope: slot.scope,
-        })),
-        cleanupCount: record.cleanups.length,
-        environment: record.environmentName,
-        application: record.applicationCode,
-        folderId: record.folder.id,
-        folderName: record.folder.name,
-        anchorHash: record.masterHash,
-        testRunId: record.testRunId,
-    };
-}
-// --- Ticket 17 (issue 03): the plan-of-record's approved reading shapes ------
-/**
- * Stage-0 render decision (grill decision 3): VERIFIED 2026-09-05 with
- * screenshot evidence (research/stage0-broken-markdown-table*.png) that the
- * DSH web UI renders tool-output text blocks as PLAIN TEXT — the markdown
- * table's pipes and divider row appear verbatim inline (no table/grid
- * element is created), so the table shape would ship broken. The plan
- * therefore ships as the approved compact indented list (divider + indented
- * `N 操作 目标 说明` lines). If a future DSH build renders markdown in tool
- * outputs, flip this to "markdown-table" for the table shape.
- */
-export const MASTER_PLAN_RENDER_MODE = "compact-list";
-/** Reading-shortening helper: fixture codes keep a cross-checkable prefix; the full codes live in the machine receipt below the plan. */
-function fixtureCodeDisplayPrefix(code) {
-    return `${code.slice(0, code.indexOf("_", 4) + 5)}…`;
-}
-/**
- * ONE Host-owned registry per stage: the plan table/list row AND the stage
- * result line both derive from it, so the two surfaces can never drift.
- * Ticket 03b: the family-varying cells (the field-create row's short label
- * and qualifiers, the form-draft row's control kinds, the rule row's demo
- * target) derive from the ACTIVE family registration
- * (src/families/<family>.ts) — a future family rung never edits this
- * table.
- */
-const FAMILY_PLAN_ROW = activeFieldFamily().planRow;
-const FIELD_CREATE_NOTE = [FAMILY_PLAN_ROW.familyShortLabel, ...FAMILY_PLAN_ROW.fieldCreateQualifiers].join("·");
-const FIELD_CREATE_DECODE = `${FAMILY_PLAN_ROW.familyShortLabel}·${FAMILY_PLAN_ROW.fieldSetLabel}`;
-const FORM_DRAFT_NOTE = `脚手架+${FAMILY_PLAN_ROW.formDraftControlKinds}`;
-const RULE_NOTE = `设计器规则面·${FAMILY_PLAN_ROW.ruleTargetLabel}`;
-const MASTER_STAGE_ROWS = {
-    "ticket08-model-create": { operation: "创建模型", note: "LIST 测试夹具", decode: "LIST 测试夹具", readback: "权威回读通过" },
-    "ticket09-field-create": { operation: "创建字段", note: FIELD_CREATE_NOTE, decode: FIELD_CREATE_DECODE, readback: "两态读回通过" },
-    "ticket10-field-publish": { operation: "发布字段", note: `模型级发布·${FAMILY_PLAN_ROW.fieldSetLabel}`, decode: "模型级发布", readback: "两态读回通过" },
-    "ticket11-form-draft": { operation: "表单草稿", note: FORM_DRAFT_NOTE, decode: "脚手架+类型化控件", readback: "草稿保存·发布态不变" },
-    "ticket20-data-rule": { operation: "配置必填规则", note: RULE_NOTE, decode: "必填规则行(dataRuleType=4)", readback: "规则列表解码通过" },
-    "ticket12-form-publish": { operation: "发布表单", note: "模型级发布", decode: "模型级发布", readback: "发布历史解码通过" },
-};
-const MASTER_CLEANUP_ROWS = {
-    "ticket10-test-field-cleanup": { operation: "清理·删除字段", note: "自动,两态回读确认", decode: "自动", readback: "两态精确缺失" },
-    "ticket08-test-model-cleanup": { operation: "清理·删除模型", note: "自动,级联+精确缺失", decode: "自动", readback: "级联+精确缺失" },
-};
-function masterStageRow(capability) {
-    const row = MASTER_STAGE_ROWS[capability];
-    if (!row)
-        throw new Error(`The conversational plan has no Host-owned stage row for ${capability}.`);
-    return row;
-}
-/** The fixed step sequence of the authorized chain: stages 1-6 then the two declared cleanups. */
-const MASTER_RESULT_SEQUENCE = [
-    ...Object.values(MASTER_STAGE_ROWS),
-    MASTER_CLEANUP_ROWS["ticket10-test-field-cleanup"],
-    MASTER_CLEANUP_ROWS["ticket08-test-model-cleanup"],
-];
-/** The eight step labels, exported for the maintainer runner's prompt legend (single source with the plan rows). */
-export const MASTER_STAGE_RESULT_TITLES = MASTER_RESULT_SEQUENCE.map((row) => row.operation);
-/** Derives the eight approved plan rows from the immutable record (host-owned fixed texts + truncated codes). */
-function masterPlanTableRows(record) {
-    const rows = [];
-    record.stages.forEach((slot, index) => {
-        const row = masterStageRow(slot.humanCapability);
-        rows.push({
-            number: index + 1,
-            operation: row.operation,
-            target: index === 0 ? fixtureCodeDisplayPrefix(slot.targetSchemaCode) : index === 1 ? FAMILY_PLAN_ROW.fieldSetLabel : index === 2 ? `同上${FAMILY_PLAN_ROW.fieldSetLabel}` : index === 4 ? `同上${FAMILY_PLAN_ROW.fieldSetLabel}` : "默认表单",
-            note: row.note,
-        });
-    });
-    const fieldCleanup = record.cleanups.find((cleanup) => cleanup.route === "ticket10-test-field-cleanup");
-    const modelCleanup = record.cleanups.find((cleanup) => cleanup.route === "ticket08-test-model-cleanup");
-    const fieldCode = record.stages[1].targetFieldCodes?.[0] ?? "";
-    const schemaCode = record.stages[0].targetSchemaCode;
-    if (fieldCleanup)
-        rows.push({ number: 7, operation: MASTER_CLEANUP_ROWS[fieldCleanup.route].operation, target: FAMILY_PLAN_ROW.fieldSetLabel, note: MASTER_CLEANUP_ROWS[fieldCleanup.route].note });
-    if (modelCleanup)
-        rows.push({ number: 8, operation: MASTER_CLEANUP_ROWS[modelCleanup.route].operation, target: fixtureCodeDisplayPrefix(schemaCode), note: MASTER_CLEANUP_ROWS[modelCleanup.route].note });
-    return rows;
-}
-/** Renders the conversational plan-of-record displayed in the DSH chat (host output; never an input). */
-export function renderConversationalMasterPlan(record) {
-    verifyMasterPlanRecord(record);
-    const header = [
-        `交付方案 · ${record.environmentName} 环境 · ${record.folder.name} · 方案编号 ${record.masterPlanId} · testRunId ${record.testRunId.slice(0, 8)}…`,
-        "全程绝不 app publish、绝不 Environment release;结果逐档在对话内汇报",
-    ];
-    const rows = masterPlanTableRows(record);
-    if (MASTER_PLAN_RENDER_MODE === "markdown-table") {
-        return [
-            ...header,
-            "",
-            "| # | 操作 | 目标 | 说明 |",
-            "|---|------|------|------|",
-            ...rows.map((row) => `| ${row.number} | ${row.operation} | ${row.target} | ${row.note} |`),
-        ].join("\n");
-    }
-    return [
-        ...header,
-        "──────────────────────────────",
-        ...rows.map((row) => `  ${row.number} ${row.operation} ${row.target} ${row.note}`),
-    ].join("\n");
-}
-/** Byte-exact gate for plan text surfaced in the conversation (mismatch is rejected). */
-export function verifyConversationalMasterPlan(text, record) {
-    if (typeof text !== "string" || text !== renderConversationalMasterPlan(record))
-        throw new Error("Conversational plan text diverges from the immutable master plan record.");
-}
-/**
- * The single master approval frame: exactly three host-derived lines (summary
- * / impact+boundary / anchor+guidance). The machine prefix was deleted
- * (Ticket 17, grill decision 6) — the binding is structural (this approve
- * tool call plus the plan hash sealed in the record), so the frame is pure
- * display; the 8-hex anchor prefix stays for human cross-check.
- */
-export function formatMasterPlanApprovalFrame(record) {
-    verifyMasterPlanRecord(record);
-    if (record.status !== "proposed")
-        throw new Error("The master approval frame is rendered from a proposed master plan record.");
-    const input = masterApprovalHumanBlockInput(record);
-    const frame = renderMasterApprovalFrame(input);
-    assertMasterApprovalFrameHumanBlock(frame);
-    verifyMasterApprovalFrameHumanBlock(frame, input);
-    if (/(payload|credential|password|token|authorization|api[_-]?key|private[_-]?key|raw[_-]?(request|response|log))/i.test(frame))
-        throw new Error("Master approval frame contains prohibited sensitive data.");
-    return frame;
-}
-/**
- * The machine receipt: the full binding payload (identities, scopes, per-stage
- * contract hashes, cleanup declarations, consumption ledger) that used to ride
- * as a JSON tail on the compose tool output. Ticket 19 folds the
- * plan-json-tail-to-receipt backlog seed: the compose surface renders the
- * plan-of-record list ONLY, and this receipt travels on the master approval
- * result (and the acceptance report). The binding stays structural — the
- * approve tool call plus the record's hash anchor — regardless of where the
- * JSON renders.
- */
-export function masterPlanReceipt(record) {
-    verifyMasterPlanRecord(record);
-    return {
-        masterPlanId: record.masterPlanId,
-        masterHash: record.masterHash,
-        status: record.status,
-        testRunId: record.testRunId,
-        environment: record.environmentName,
-        application: record.applicationCode,
-        folder: record.folder,
-        targetSchemaCode: record.stages[0].targetSchemaCode,
-        targetFieldCodes: record.stages[1].targetFieldCodes,
-        targetSheetCode: record.stages[3].targetSheetCode,
-        stages: record.stages.map((slot) => ({ stage: slot.stage, route: slot.route, capabilityId: slot.capabilityId, scope: slot.scope, contractHash: slot.contractHash, knowledgePackDigest: slot.knowledgePackDigest })),
-        cleanups: record.cleanups.map((cleanup) => ({ route: cleanup.route, followsStage: cleanup.followsStage, capabilityId: cleanup.capabilityId, contractHash: cleanup.contractHash })),
-        ...(record.approval ? { approval: record.approval } : {}),
-        consumed: record.consumed,
-    };
-}
-/**
- * Grill decision 7: a successful stage reports exactly one line
- * (✓ n/8 操作 · 关键解码 · 回读通过); a failed/blocked/uncertain stage
- * reports the ✗ headline AND returns the complete result for verbatim
- * disclosure. The operation/decode/readback texts derive from the same
- * Host-owned row registry as the plan rows, so the plan and the result
- * lines can never drift.
- */
-export function summarizeMasterStageResult(stage, result) {
-    const row = MASTER_RESULT_SEQUENCE[stage - 1];
-    const value = (result ?? {});
-    const ok = value.status === "completed" && (!value.behavior || value.behavior.status === undefined || value.behavior.status === "validated");
-    if (ok)
-        return { ok: true, line: `✓ ${stage}/8 ${row.operation} · ${row.decode} · ${row.readback}` };
-    const shortReason = typeof value.status === "string" && value.status ? value.status : "结果异常";
-    return { ok: false, line: `✗ ${stage}/8 ${row.operation} · ${shortReason} → 完整结果与停工说明全文贴出`, fullDisclosure: JSON.stringify(result ?? null, null, 2) };
-}
-//# sourceMappingURL=master-plan-approval.js.map