openxiangda-devkit-core 2.0.0-alpha.16 → 2.0.0-alpha.19

package/dist/application-services.js

@@ -1,10 +1,11 @@
-import { spawn, spawnSync } from "node:child_process";
+import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync, } from "node:fs";
 import { dirname, join, relative } from "node:path";
 import { SCHEMA_VERSIONS, canonicalJson, } from "openxiangda-contracts";
 import { compileApplicationSources, compileAppPackage, sha256Bytes, validateAppConfig, } from "openxiangda-compiler";
 import { OpenXiangdaControlPlaneClient, } from "./control-plane-client.js";
 import { normalizePlatformBaseUrl, OpenXiangdaDeveloperSession, } from "./session.js";
+import { localDevelopmentStatus, localDevelopmentSession, resetLocalDevelopmentData, runLocalDevelopment, stopLocalDevelopment, } from "./local-development.js";
 import { OPENXIANGDA_TOOLCHAIN_VERSION } from "./version.js";
 import { git, loadWorkspace, } from "./workspace-loader.js";
 export class OpenXiangdaApplicationServices {
@@ -18,19 +19,21 @@ export class OpenXiangdaApplicationServices {
     }
     async contractDescribe(root) {
         const workspace = await this.workspace(root);
-        const sources = compileApplicationSources(workspace.config);
+        const sources = compileApplicationSources(workspace.config, this.toolchainVersion);
         return this.ok("contract.describe", workspace.context.workspace, {
             configDigest: sources.config.digest,
             contractDigest: sources.contracts.digest,
             contract: sources.contracts.value,
             counts: {
-                backendSecrets: sources.config.value.backendSecrets.length,
-                dataResources: sources.config.value.dataResources.length,
-                eventSubscriptions: sources.config.value.eventSubscriptions.length,
-                timerSubscriptions: sources.config.value.timerSubscriptions?.length || 0,
-                workflowDefinitions: sources.config.value.workflowDefinitions.length,
-                workflowBindings: sources.config.value.workflowBindings.length,
-                workflowProviders: sources.config.value.workflowProviders?.length || 0,
+                backendSecrets: sources.config.value.backend.secrets.length,
+                backendOperations: sources.config.value.backend.operations.length,
+                frontendRoutes: sources.config.value.frontend.routes.length,
+                dataResources: sources.config.value.data.resources.length,
+                eventSubscriptions: sources.config.value.events.subscriptions.length,
+                timerSubscriptions: sources.config.value.events.timers.length,
+                workflowDefinitions: sources.config.value.workflows.definitions.length,
+                workflowBindings: sources.config.value.workflows.bindings.length,
+                workflowProviders: sources.config.value.workflows.providers.length,
             },
         });
     }
@@ -56,28 +59,30 @@ export class OpenXiangdaApplicationServices {
     }
     async runtimeOAuthCredentialStatus(root, environmentKey) {
         const workspace = await this.workspace(root);
-        const data = await (await this.client(workspace.root)).runtimeOAuthCredentialStatus(workspace.config.app.code, environmentKey);
+        const environment = this.deploymentEnvironment(environmentKey);
+        const data = await (await this.client(workspace.root)).runtimeOAuthCredentialStatus(workspace.config.app.code, environment);
         return this.ok("oauth.runtime.status", workspace.context.workspace, data);
     }
     async rotateRuntimeOAuthCredential(root, input) {
         const workspace = await this.workspace(root);
         const client = await this.client(workspace.root);
-        const status = await client.runtimeOAuthCredentialStatus(workspace.config.app.code, input.environmentKey);
+        const environment = this.deploymentEnvironment(input.environmentKey);
+        const status = await client.runtimeOAuthCredentialStatus(workspace.config.app.code, environment);
         if (!status.configured || !status.client) {
             throw new Error("OAUTH2_RUNTIME_CLIENT_NOT_PROVISIONED");
         }
-        const rotation = await client.stageRuntimeOAuthCredentialRotation(workspace.config.app.code, input.environmentKey, {
+        const rotation = await client.stageRuntimeOAuthCredentialRotation(workspace.config.app.code, environment, {
             expectedCredentialVersion: status.client.credentialVersion,
             ...(input.gracePeriodSeconds === undefined
                 ? {}
                 : { gracePeriodSeconds: input.gracePeriodSeconds }),
             idempotencyKey: input.idempotencyKey,
         });
-        const head = await client.environmentHead(workspace.config.app.code, input.environmentKey);
+        const head = await client.environmentHead(workspace.config.app.code, environment);
         if (!head.activeAppVersionId) {
             throw new Error("OAUTH2_RUNTIME_ROTATION_ACTIVE_VERSION_REQUIRED");
         }
-        const deployment = await client.promote({
+        const deployment = await client.redeploy({
             appCode: workspace.config.app.code,
             appVersionId: head.activeAppVersionId,
             ...(head.environmentId ? { environmentId: head.environmentId } : {}),
@@ -96,12 +101,22 @@ export class OpenXiangdaApplicationServices {
     }
     async createOAuthClient(root, input) {
         const workspace = await this.workspace(root);
-        const data = await (await this.client(workspace.root)).createOAuthClient(workspace.config.app.code, input);
+        const environmentKey = this.deploymentEnvironment(input.environmentKey);
+        const data = await (await this.client(workspace.root)).createOAuthClient(workspace.config.app.code, {
+            ...input,
+            environmentKey,
+        });
         return this.ok("oauth.client.create", workspace.context.workspace, data);
     }
     async updateOAuthClient(root, clientId, input) {
         const workspace = await this.workspace(root);
-        const data = await (await this.client(workspace.root)).updateOAuthClient(workspace.config.app.code, clientId, input);
+        const environmentKey = input.environmentKey
+            ? this.deploymentEnvironment(input.environmentKey)
+            : undefined;
+        const data = await (await this.client(workspace.root)).updateOAuthClient(workspace.config.app.code, clientId, {
+            ...input,
+            ...(environmentKey ? { environmentKey } : {}),
+        });
         return this.ok("oauth.client.update", workspace.context.workspace, data);
     }
     async rotateOAuthClientSecret(root, clientId, gracePeriodSeconds = 600) {
@@ -116,39 +131,129 @@ export class OpenXiangdaApplicationServices {
     }
     async oauthAuditEvents(root, input = {}) {
         const workspace = await this.workspace(root);
-        const data = await (await this.client(workspace.root)).oauthAuditEvents(workspace.config.app.code, input);
+        const environmentKey = input.environmentKey
+            ? this.deploymentEnvironment(input.environmentKey)
+            : undefined;
+        const data = await (await this.client(workspace.root)).oauthAuditEvents(workspace.config.app.code, {
+            ...input,
+            ...(environmentKey ? { environmentKey } : {}),
+        });
         return this.ok("oauth.audit.list", workspace.context.workspace, data);
     }
     async applicationSecrets(root, environmentKey) {
         const workspace = await this.workspace(root);
-        const data = await (await this.client(workspace.root)).applicationSecrets(workspace.config.app.code, environmentKey);
+        const environment = this.deploymentEnvironment(environmentKey);
+        const data = await (await this.client(workspace.root)).applicationSecrets(workspace.config.app.code, environment);
         return this.ok("secret.list", workspace.context.workspace, data);
     }
     async createApplicationSecret(root, environmentKey, input) {
         const workspace = await this.workspace(root);
-        const data = await (await this.client(workspace.root)).createApplicationSecret(workspace.config.app.code, environmentKey, input);
+        const environment = this.deploymentEnvironment(environmentKey);
+        const data = await (await this.client(workspace.root)).createApplicationSecret(workspace.config.app.code, environment, input);
         return this.ok("secret.create", workspace.context.workspace, data);
     }
     async updateApplicationSecret(root, environmentKey, name, input) {
         const workspace = await this.workspace(root);
-        const data = await (await this.client(workspace.root)).updateApplicationSecret(workspace.config.app.code, environmentKey, name, input);
+        const environment = this.deploymentEnvironment(environmentKey);
+        const data = await (await this.client(workspace.root)).updateApplicationSecret(workspace.config.app.code, environment, name, input);
         return this.ok("secret.update", workspace.context.workspace, data);
     }
     async rotateApplicationSecret(root, environmentKey, name, input) {
         const workspace = await this.workspace(root);
-        const data = await (await this.client(workspace.root)).rotateApplicationSecret(workspace.config.app.code, environmentKey, name, input);
+        const environment = this.deploymentEnvironment(environmentKey);
+        const data = await (await this.client(workspace.root)).rotateApplicationSecret(workspace.config.app.code, environment, name, input);
         return this.ok("secret.rotate", workspace.context.workspace, data);
     }
     async deleteApplicationSecret(root, environmentKey, name, input) {
         const workspace = await this.workspace(root);
-        const data = await (await this.client(workspace.root)).deleteApplicationSecret(workspace.config.app.code, environmentKey, name, input);
+        const environment = this.deploymentEnvironment(environmentKey);
+        const data = await (await this.client(workspace.root)).deleteApplicationSecret(workspace.config.app.code, environment, name, input);
         return this.ok("secret.delete", workspace.context.workspace, data);
     }
     async applicationSecretAuditEvents(root, environmentKey, name, limit = 100) {
         const workspace = await this.workspace(root);
-        const data = await (await this.client(workspace.root)).applicationSecretAuditEvents(workspace.config.app.code, environmentKey, name, limit);
+        const environment = this.deploymentEnvironment(environmentKey);
+        const data = await (await this.client(workspace.root)).applicationSecretAuditEvents(workspace.config.app.code, environment, name, limit);
         return this.ok("secret.audit.list", workspace.context.workspace, data);
     }
+    async nativeRoleMemberships(root, environmentKey, input = {}) {
+        const workspace = await this.workspace(root);
+        const environment = this.deploymentEnvironment(environmentKey);
+        const client = await this.client(workspace.root);
+        const request = await this.nativeManagementRequest(client, workspace.config.app.code, environment);
+        const data = await client.nativeRoleMemberships(workspace.config.app.code, { ...input, environmentKey: environment }, request);
+        return this.ok("authz.membership.list", workspace.context.workspace, data);
+    }
+    async createNativeRoleMembership(root, input) {
+        const workspace = await this.workspace(root);
+        const environment = this.deploymentEnvironment(input.environmentKey);
+        const client = await this.client(workspace.root);
+        const data = await client.createNativeRoleMembership(workspace.config.app.code, { ...input, environmentKey: environment }, await this.nativeManagementRequest(client, workspace.config.app.code, environment));
+        return this.ok("authz.membership.create", workspace.context.workspace, data);
+    }
+    async updateNativeRoleMembership(root, membershipId, input) {
+        const workspace = await this.workspace(root);
+        const environment = this.deploymentEnvironment(input.environmentKey);
+        const client = await this.client(workspace.root);
+        const data = await client.updateNativeRoleMembership(workspace.config.app.code, membershipId, { ...input, environmentKey: environment }, await this.nativeManagementRequest(client, workspace.config.app.code, environment));
+        return this.ok("authz.membership.update", workspace.context.workspace, data);
+    }
+    async revokeNativeRoleMembership(root, membershipId, input) {
+        const workspace = await this.workspace(root);
+        const environment = this.deploymentEnvironment(input.environmentKey);
+        const client = await this.client(workspace.root);
+        const data = await client.revokeNativeRoleMembership(workspace.config.app.code, membershipId, { ...input, environmentKey: environment }, await this.nativeManagementRequest(client, workspace.config.app.code, environment));
+        return this.ok("authz.membership.revoke", workspace.context.workspace, data);
+    }
+    async nativeSuperAdmins(root, environmentKey, input = {}) {
+        const workspace = await this.workspace(root);
+        const environment = this.deploymentEnvironment(environmentKey);
+        const client = await this.client(workspace.root);
+        const data = await client.nativeSuperAdmins(workspace.config.app.code, input, await this.nativeManagementRequest(client, workspace.config.app.code, environment));
+        return this.ok("authz.super-admin.list", workspace.context.workspace, data);
+    }
+    async grantNativeSuperAdmin(root, environmentKey, input) {
+        const workspace = await this.workspace(root);
+        const environment = this.deploymentEnvironment(environmentKey);
+        const client = await this.client(workspace.root);
+        const data = await client.grantNativeSuperAdmin(workspace.config.app.code, input, await this.nativeManagementRequest(client, workspace.config.app.code, environment));
+        return this.ok("authz.super-admin.grant", workspace.context.workspace, data);
+    }
+    async revokeNativeSuperAdmin(root, environmentKey, grantId, input) {
+        const workspace = await this.workspace(root);
+        const environment = this.deploymentEnvironment(environmentKey);
+        const client = await this.client(workspace.root);
+        const data = await client.revokeNativeSuperAdmin(workspace.config.app.code, grantId, input, await this.nativeManagementRequest(client, workspace.config.app.code, environment));
+        return this.ok("authz.super-admin.revoke", workspace.context.workspace, data);
+    }
+    async nativeRelationshipGrants(root, environmentKey, input = {}) {
+        const workspace = await this.workspace(root);
+        const environment = this.deploymentEnvironment(environmentKey);
+        const client = await this.client(workspace.root);
+        const data = await client.nativeRelationshipGrants(workspace.config.app.code, { ...input, environmentKey: environment }, await this.nativeManagementRequest(client, workspace.config.app.code, environment));
+        return this.ok("authz.relationship.list", workspace.context.workspace, data);
+    }
+    async createNativeRelationshipGrant(root, input) {
+        const workspace = await this.workspace(root);
+        const environment = this.deploymentEnvironment(input.environmentKey);
+        const client = await this.client(workspace.root);
+        const data = await client.createNativeRelationshipGrant(workspace.config.app.code, { ...input, environmentKey: environment }, await this.nativeManagementRequest(client, workspace.config.app.code, environment));
+        return this.ok("authz.relationship.create", workspace.context.workspace, data);
+    }
+    async updateNativeRelationshipGrant(root, grantId, input) {
+        const workspace = await this.workspace(root);
+        const environment = this.deploymentEnvironment(input.environmentKey);
+        const client = await this.client(workspace.root);
+        const data = await client.updateNativeRelationshipGrant(workspace.config.app.code, grantId, { ...input, environmentKey: environment }, await this.nativeManagementRequest(client, workspace.config.app.code, environment));
+        return this.ok("authz.relationship.update", workspace.context.workspace, data);
+    }
+    async revokeNativeRelationshipGrant(root, grantId, input) {
+        const workspace = await this.workspace(root);
+        const environment = this.deploymentEnvironment(input.environmentKey);
+        const client = await this.client(workspace.root);
+        const data = await client.revokeNativeRelationshipGrant(workspace.config.app.code, grantId, { ...input, environmentKey: environment }, await this.nativeManagementRequest(client, workspace.config.app.code, environment));
+        return this.ok("authz.relationship.revoke", workspace.context.workspace, data);
+    }
     async eventSubscriptions(root) {
         const workspace = await this.workspace(root);
         const data = await (await this.client(workspace.root)).eventSubscriptions(workspace.config.app.code);
@@ -184,32 +289,59 @@ export class OpenXiangdaApplicationServices {
         const data = await (await this.client(workspace.root)).setTimerSubscriptionStatus(workspace.config.app.code, timerId, input);
         return this.ok("event.timer.status", workspace.context.workspace, data);
     }
+    async fireLocalTimer(root, timerId) {
+        const workspace = await this.workspace(root);
+        const session = localDevelopmentSession(workspace.root);
+        if (!session || session.status !== "ready" || session.uiOnly) {
+            throw new Error("OPENXIANGDA_LOCAL_DEV_SESSION_REQUIRED");
+        }
+        const response = await fetch(`${session.urls.platform}/__openxiangda-local/timers/${encodeURIComponent(timerId)}/fire`, {
+            method: "POST",
+            headers: {
+                Accept: "application/json",
+                "X-OpenXiangda-Local-Control": "v1",
+            },
+        });
+        const envelope = (await response.json());
+        if (!response.ok || Number(envelope.code) >= 400) {
+            throw new Error(String(envelope.errorCode ||
+                envelope.message ||
+                `OPENXIANGDA_LOCAL_TIMER_FIRE_FAILED:${response.status}`));
+        }
+        return this.ok("event.timer.fire-local", workspace.context.workspace, envelope.data);
+    }
     async workflowAssigneeProviders(root, environmentKey) {
         const workspace = await this.workspace(root);
-        const data = await (await this.client(workspace.root)).workflowAssigneeProviders(workspace.config.app.code, environmentKey);
+        const environment = this.deploymentEnvironment(environmentKey);
+        const data = await (await this.client(workspace.root)).workflowAssigneeProviders(workspace.config.app.code, environment);
         return this.ok("workflow.provider.list", workspace.context.workspace, data);
     }
     async rotateWorkflowAssigneeProviderSecret(root, providerCode, input) {
         const workspace = await this.workspace(root);
-        const data = await (await this.client(workspace.root)).rotateWorkflowAssigneeProviderSecret(workspace.config.app.code, providerCode, input);
+        const environmentKey = this.deploymentEnvironment(input.environmentKey);
+        const data = await (await this.client(workspace.root)).rotateWorkflowAssigneeProviderSecret(workspace.config.app.code, providerCode, { ...input, environmentKey });
         return this.ok("workflow.provider.rotate", workspace.context.workspace, data);
     }
     async linkApplication(root, input) {
         const workspace = await this.workspace(root);
         const path = join(workspace.root, ".openxiangda", "link.json");
+        const environments = (input.environments || []).map((environment) => ({
+            ...environment,
+            kind: this.deploymentEnvironment(environment.kind),
+        }));
         mkdirSync(dirname(path), { recursive: true });
         const value = {
             schemaVersion: 2,
             appCode: workspace.config.app.code,
             baseUrl: normalizePlatformBaseUrl(input.baseUrl),
-            environments: input.environments || [],
+            environments,
         };
         writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`, "utf8");
         return this.ok("app.link", workspace.context.workspace, { path, ...value });
     }
     async generate(input = {}) {
         const workspace = await this.workspace(input.root);
-        const sources = compileApplicationSources(workspace.config);
+        const sources = compileApplicationSources(workspace.config, this.toolchainVersion);
         const output = join(workspace.root, "packages/contracts/src/generated.ts");
         const current = existsSync(output) ? readFileSync(output, "utf8") : "";
         const changed = current !== sources.contracts.typescript;
@@ -296,7 +428,7 @@ export class OpenXiangdaApplicationServices {
             diagnostics.push(this.diagnostic("BACKEND_IMAGE_NOT_IMMUTABLE", "后端镜像必须使用不可变 sha256 digest，不能使用可变 tag", "backend.image", "将镜像引用改为 <registry/repository@sha256:64位摘要>"));
             return this.result("build", workspace.context.workspace, undefined, diagnostics);
         }
-        const sources = compileApplicationSources(workspace.config);
+        const sources = compileApplicationSources(workspace.config, this.toolchainVersion);
         const frontendContent = this.directoryBundle(join(workspace.root, workspace.config.frontend.root, "dist"));
         const frontendDigest = sha256Bytes(frontendContent);
         const backendContent = canonicalJson({ image: backendImage });
@@ -342,7 +474,7 @@ export class OpenXiangdaApplicationServices {
                 config: sources.config.digest,
                 dataContract: sources.contracts.digest,
             },
-            minimumPlatformVersion: "2.0.0-alpha.1",
+            minimumPlatformVersion: "2.0.0-alpha.2",
             metadata: {
                 runtimeProfile: workspace.config.backend.runMode || "shared",
             },
@@ -392,9 +524,9 @@ export class OpenXiangdaApplicationServices {
     }
     async deploy(input) {
         const workspace = await this.workspace(input.root);
-        if (input.environment === "production") {
+        if (String(input.environment) !== "preproduction") {
             return this.result("deploy", workspace.context.workspace, undefined, [
-                this.diagnostic("PRODUCTION_PROMOTION_REQUIRED", "生产环境不接受本地重新构建的 AppPackage", "production", "先执行 openxiangda deploy preproduction，成功后使用 openxiangda promote <deploymentId> production"),
+                this.diagnostic("DEPLOY_PREPRODUCTION_ONLY", "Native 2.0 只允许直接部署到预发环境", String(input.environment), "使用 openxiangda deploy preproduction；生产环境必须晋级同一 AppVersion"),
             ]);
         }
         const built = await this.buildSealed({ ...input, root: workspace.root });
@@ -455,16 +587,17 @@ export class OpenXiangdaApplicationServices {
     }
     async promote(root, deploymentId, environment) {
         const workspace = await this.workspace(root);
+        if (String(environment) !== "production") {
+            throw new Error(`OPENXIANGDA_PROMOTION_ENVIRONMENT_INVALID: ${String(environment)}`);
+        }
         const client = await this.client(workspace.root);
         const source = await client.deployment(workspace.config.app.code, deploymentId);
         const appVersionId = String(source.result?.applicationVersionId || "");
         if (!appVersionId)
             throw new Error("DEPLOYMENT_APP_VERSION_NOT_AVAILABLE");
-        if (environment === "production") {
-            const diagnostics = await this.productionPromotionDiagnostics(workspace, client, source, appVersionId);
-            if (diagnostics.length > 0) {
-                return this.result("promote", workspace.context.workspace, undefined, diagnostics);
-            }
+        const diagnostics = await this.productionPromotionDiagnostics(workspace, client, source, appVersionId);
+        if (diagnostics.length > 0) {
+            return this.result("promote", workspace.context.workspace, undefined, diagnostics);
         }
         const deployment = await client.promote({
             appCode: workspace.config.app.code,
@@ -523,14 +656,22 @@ export class OpenXiangdaApplicationServices {
     }
     async rollback(root, environment, appVersionId) {
         const workspace = await this.workspace(root);
+        const targetEnvironment = this.deploymentEnvironment(environment);
         const deployment = await (await this.client(workspace.root)).rollback({
             appCode: workspace.config.app.code,
             appVersionId,
-            environmentKind: environment,
-            idempotencyKey: `rollback:${appVersionId}:${environment}`,
+            environmentKind: targetEnvironment,
+            idempotencyKey: `rollback:${appVersionId}:${targetEnvironment}`,
         });
         return this.ok("rollback", workspace.context.workspace, deployment);
     }
+    deploymentEnvironment(value) {
+        const normalized = String(value || "").trim();
+        if (normalized === "preproduction" || normalized === "production") {
+            return normalized;
+        }
+        throw new Error(`OPENXIANGDA_REMOTE_ENVIRONMENT_INVALID: ${normalized || "<empty>"}`);
+    }
     async doctor(root) {
         const workspace = await this.workspace(root);
         const commands = ["git", "node", "pnpm", "docker"].map((command) => {
@@ -541,6 +682,16 @@ export class OpenXiangdaApplicationServices {
                 version: String(result.stdout || result.stderr || "").trim(),
             };
         });
+        const dockerInfo = spawnSync("docker", ["info", "--format", "{{.ServerVersion}}"], { encoding: "utf8" });
+        const containerRuntime = {
+            requiredFor: "openxiangda dev",
+            ok: dockerInfo.status === 0,
+            serverVersion: String(dockerInfo.stdout || "").trim() || null,
+            message: dockerInfo.status === 0
+                ? null
+                : String(dockerInfo.stderr || dockerInfo.stdout || "").trim() ||
+                    "Docker daemon is unavailable",
+        };
         let platform;
         try {
             platform = (await (await this.client(workspace.root)).capabilities());
@@ -549,23 +700,86 @@ export class OpenXiangdaApplicationServices {
             platform = { ok: false, message: error.message };
         }
         const diagnostics = commands
-            .filter((item) => !item.ok && item.command !== "docker")
+            .filter((item) => !item.ok)
             .map((item) => this.diagnostic("TOOLCHAIN_COMMAND_MISSING", `缺少必需命令: ${item.command}`, item.command));
-        return this.result("doctor", workspace.context.workspace, { commands, platform }, diagnostics);
+        if (!containerRuntime.ok &&
+            commands.find(item => item.command === "docker")?.ok) {
+            diagnostics.push(this.diagnostic("LOCAL_CONTAINER_RUNTIME_UNAVAILABLE", "Docker 已安装但容器运行时不可用，完整本地开发无法启动 PostgreSQL", "docker.info", "启动 Docker Desktop（或兼容 Docker daemon）后重新执行 openxiangda doctor"));
+        }
+        return this.result("doctor", workspace.context.workspace, {
+            commands,
+            containerRuntime,
+            localDevelopment: localDevelopmentStatus(workspace.root),
+            platform,
+        }, diagnostics);
     }
-    async dev(root) {
+    async devStatus(root) {
         const workspace = await this.workspace(root);
-        return await new Promise((resolve) => {
-            const child = spawn("pnpm", ["run", "dev"], {
-                cwd: workspace.root,
-                stdio: "inherit",
-            });
-            child.on("exit", (code) => resolve(this.result("dev", workspace.context.workspace, { exitCode: code ?? 1 }, code === 0
-                ? []
-                : [
-                    this.diagnostic("DEV_PROCESS_FAILED", "开发进程异常退出", "dev"),
-                ])));
+        return this.ok("dev.status", workspace.context.workspace, localDevelopmentStatus(workspace.root));
+    }
+    async devStop(root) {
+        const workspace = await this.workspace(root);
+        return this.ok("dev.stop", workspace.context.workspace, await stopLocalDevelopment(workspace.root));
+    }
+    async devResetData(root) {
+        const workspace = await this.workspace(root);
+        return this.ok("dev.reset", workspace.context.workspace, await resetLocalDevelopmentData(workspace.root));
+    }
+    async dev(root, input = {}) {
+        const workspace = await this.workspace(root);
+        const generated = await this.generate({
+            root: workspace.root,
         });
+        if (!generated.ok) {
+            return this.result("dev", workspace.context.workspace, undefined, generated.diagnostics, generated.nextActions);
+        }
+        const localFixturePath = join(workspace.root, "openxiangda.local.json");
+        let localFixture;
+        if (existsSync(localFixturePath)) {
+            try {
+                localFixture = JSON.parse(readFileSync(localFixturePath, "utf8"));
+            }
+            catch (error) {
+                return this.result("dev", workspace.context.workspace, undefined, [
+                    this.diagnostic("LOCAL_DEVELOPMENT_FIXTURE_INVALID", `本地开发夹具不是有效 JSON: ${error.message}`, localFixturePath, "修复 openxiangda.local.json 后重试"),
+                ]);
+            }
+        }
+        const local = await runLocalDevelopment({
+            root: workspace.root,
+            appCode: workspace.config.app.code,
+            runtimeOAuthScopes: [
+                ...new Set((workspace.config.authz?.roles || []).flatMap(role => role.capabilities || [])),
+            ],
+            eventSubscriptionCodes: (workspace.config.events?.subscriptions || []).map(subscription => subscription.code),
+            localManifest: {
+                schemaVersion: 1,
+                appCode: workspace.config.app.code,
+                resources: workspace.config.data?.resources || [],
+                roles: workspace.config.authz?.roles || [],
+                scopeDimensions: workspace.config.authz?.scopeDimensions || [],
+                dataPolicies: workspace.config.authz?.dataPolicies || [],
+                backendSecrets: workspace.config.backend?.secrets || [],
+                eventSubscriptions: workspace.config.events?.subscriptions || [],
+                timerSubscriptions: workspace.config.events?.timers || [],
+                workflowDefinitions: workspace.config.workflows?.definitions || [],
+                workflowBindings: workspace.config.workflows?.bindings || [],
+                workflowActivations: workspace.config.workflows?.activations || [],
+                workflowProviders: workspace.config.workflows?.providers || [],
+                ...(localFixture ? { fixture: localFixture } : {}),
+            },
+            ...(input.noOpen === undefined ? {} : { noOpen: input.noOpen }),
+            ...(input.reset === undefined ? {} : { reset: input.reset }),
+            ...(input.uiOnly === undefined ? {} : { uiOnly: input.uiOnly }),
+            ...(input.webPort === undefined ? {} : { webPort: input.webPort }),
+            ...(input.onStatus ? { onStatus: input.onStatus } : {}),
+        });
+        const diagnostics = local.exitCode === 0
+            ? []
+            : [
+                this.diagnostic("DEV_PROCESS_FAILED", "本地开发进程异常退出", local.logPath, "查看本地诊断和日志后重试", { diagnosticsPath: local.diagnosticsPath }),
+            ];
+        return this.result("dev", workspace.context.workspace, local, diagnostics);
     }
     async workspace(root) {
         return await loadWorkspace(root, this.toolchainVersion);
@@ -592,6 +806,27 @@ export class OpenXiangdaApplicationServices {
             tokenProvider: session,
         });
     }
+    async nativeManagementRequest(client, appCode, environmentKey) {
+        const context = await client.roleSessionContext(appCode, environmentKey);
+        if (context.currentRoleSubject?.subjectKind === "super_admin" &&
+            context.roleSession) {
+            return { roleSessionId: context.roleSession.id };
+        }
+        const superAdmin = context.roleSubjectPage.items.find((item) => item.subjectKind === "super_admin");
+        if (superAdmin) {
+            const selected = await client.switchRoleSessionContext(appCode, {
+                targetRoleSubjectKey: superAdmin.subjectKey,
+                expectedRoleSessionId: context.roleSession?.id || null,
+                environmentKey,
+            });
+            if (selected.roleSession) {
+                return { roleSessionId: selected.roleSession.id };
+            }
+        }
+        if (context.roleSession)
+            return { roleSessionId: context.roleSession.id };
+        throw new Error("OPENXIANGDA_NATIVE_AUTHZ_MANAGEMENT_ROLE_REQUIRED");
+    }
     get toolchainVersion() {
         return this.options.toolchainVersion || OPENXIANGDA_TOOLCHAIN_VERSION;
     }