openxiangda 1.0.131 → 1.0.133

package/lib/cli.js

@@ -86,6 +86,7 @@ async function main(argv) {
   if (command === 'function') return appFunction(rest);
   if (command === 'connector') return connector(rest);
   if (command === 'notification') return notification(rest);
+  if (command === 'organization') return organization(rest);
   if (command === 'permission') return permission(rest);
   if (command === 'settings') return settings(rest);
   if (command === 'resource') return resource(rest);
@@ -150,6 +151,7 @@ Usage:
   openxiangda function list|get|create|update|upsert|delete|invoke [--json-file file]
   openxiangda connector list|get|create|update|upsert|delete|invoke|download-test [--json-file file]
   openxiangda notification template-list|template-get|template-upsert|template-delete|type-list|type-get|type-upsert|type-delete|preview|send|batch-send
+  openxiangda organization capabilities|department-list|department-get|department-create|department-update|account-list|account-get|account-create|account-update|account-reset-password
   openxiangda permission role-list|role-create|role-update|role-delete|role-bind|snapshot|audit
   openxiangda permission page-group-list|page-group-create|page-group-update|page-group-delete|page-group-bind
   openxiangda permission form-group-list|form-group-create|form-group-update|form-group-delete|form-group-bind
@@ -1952,8 +1954,10 @@ async function menu(args) {
     const data = await requestWithAuth(
       config,
       target.profileName,
-      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/menus/${encodeURIComponent(menuId)}`,
-      { method: 'DELETE' }
+      apiPathWithPostDeleteAction(
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/menus/${encodeURIComponent(menuId)}`
+      ),
+      { method: 'POST' }
     );
     if (target.bound.resources?.menus?.[menuKey]) {
       delete target.bound.resources.menus[menuKey];
@@ -1973,7 +1977,7 @@ async function menu(args) {
     const menuId = resolveMenuId(target.bound, menuCode, flags);
     const desired = normalizeMenuDirectBody(target.bound, { ...body, code: body.code || menuCode });
     const data = await runDirectRequest(config, target, flags, {
-      method: 'PUT',
+      method: 'POST',
       path: `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/menus/${encodeURIComponent(menuId)}`,
       body: desired,
     }, { returnData: true });
@@ -2180,8 +2184,10 @@ async function workflow(args) {
     const data = await requestWithAuth(
       config,
       target.profileName,
-      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows/${encodeURIComponent(workflowId)}`,
-      { method: 'DELETE' }
+      apiPathWithPostDeleteAction(
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows/${encodeURIComponent(workflowId)}`
+      ),
+      { method: 'POST' }
     );
     if (target.bound.resources?.workflows?.[workflowKey]) {
       delete target.bound.resources.workflows[workflowKey];
@@ -2485,8 +2491,10 @@ async function automation(args) {
     const data = await requestWithAuth(
       config,
       target.profileName,
-      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations/${encodeURIComponent(automationId)}`,
-      { method: 'DELETE' }
+      apiPathWithPostDeleteAction(
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations/${encodeURIComponent(automationId)}`
+      ),
+      { method: 'POST' }
     );
     if (target.bound.resources?.automations?.[automationKey]) {
       delete target.bound.resources.automations[automationKey];
@@ -2949,10 +2957,13 @@ async function notification(args) {
   const { flags, positional } = parseArgs(rest);
   if (wantsSubcommandHelp(subcommand, flags)) {
     print([
-      '用法: openxiangda notification template-list|template-get|template-upsert|template-delete|type-list|type-get|type-upsert|type-delete|preview|send|batch-send',
+      '用法: openxiangda notification template-list|template-get|template-upsert|template-delete|type-list|type-get|type-upsert|type-delete|preview|send|batch-send|capabilities|dingding-preview|dingding-send',
       '  preview <notificationType|templateCode> [--form-code code|--form-uuid FORM_XXX] --body-json \'{"payload":{"title":"测试"}}\'',
       '  send <notificationType> --body-json \'{"recipientId":"USER_ID","payload":{"title":"测试"}}\' --force',
       '  batch-send <notificationType> --body-json \'{"recipients":[{"recipientId":"USER_ID","payload":{}}]}\' --force',
+      '  capabilities --json',
+      '  dingding-preview <notificationType> [--template-code code|--template-id id] --body-json \'{"payload":{"title":"测试"}}\'',
+      '  dingding-send <notificationType> --body-json \'{"recipientId":"USER_ID","payload":{"title":"测试"}}\' --force',
     ].join('\n'));
     return;
   }
@@ -2981,7 +2992,7 @@ async function notification(args) {
     if (!code) fail('notification template-upsert 缺少 template code');
     const normalized = normalizeNotificationTemplateManifest(target.bound, { ...body, ...template, code });
     const data = await runDirectRequest(config, target, flags, {
-      method: 'PUT',
+      method: 'POST',
       path: `${appPrefix}/templates/${encodeURIComponent(code)}`,
       body: normalized,
     }, { returnData: true });
@@ -2998,8 +3009,8 @@ async function notification(args) {
     const code = positional[0] || flags.code;
     if (!code || !flags.force) fail('用法: openxiangda notification template-delete <templateCode> --force');
     return runDirectRequest(config, target, flags, {
-      method: 'DELETE',
-      path: `${appPrefix}/templates/${encodeURIComponent(code)}`,
+      method: 'POST',
+      path: apiPathWithPostDeleteAction(`${appPrefix}/templates/${encodeURIComponent(code)}`),
     });
   }
   if (subcommand === 'type-list') {
@@ -3023,7 +3034,7 @@ async function notification(args) {
     if (!code) fail('notification type-upsert 缺少 notificationType');
     const normalized = normalizeNotificationTypeConfigManifest(target.bound, { ...body, ...configBody, notificationType: code });
     const data = await runDirectRequest(config, target, flags, {
-      method: 'PUT',
+      method: 'POST',
       path: `${appPrefix}/type-configs/${encodeURIComponent(code)}`,
       body: normalized,
     }, { returnData: true });
@@ -3043,8 +3054,29 @@ async function notification(args) {
     const code = positional[0] || flags.code;
     if (!code || !flags.force) fail('用法: openxiangda notification type-delete <notificationType> --force');
     return runDirectRequest(config, target, flags, {
-      method: 'DELETE',
-      path: `${appPrefix}/type-configs/${encodeURIComponent(code)}`,
+      method: 'POST',
+      path: apiPathWithPostDeleteAction(`${appPrefix}/type-configs/${encodeURIComponent(code)}`),
+    });
+  }
+  if (subcommand === 'capabilities') {
+    return runDirectRequest(config, target, flags, {
+      method: 'GET',
+      path: `${appPrefix}/dingtalk/capabilities`,
+      strictEnvelope: true,
+    });
+  }
+  if (subcommand === 'dingding-preview' || subcommand === 'dingding-send') {
+    if (subcommand === 'dingding-send' && !flags.force) {
+      fail('openxiangda notification dingding-send 是发送动作，必须加 --force');
+    }
+    const code = positional[0] || flags.code;
+    const rawBody = readDirectJsonBody(flags, `notification ${subcommand}`, { optional: true });
+    const body = buildDingTalkNotificationActionBody(target, code, rawBody, flags);
+    return runDirectRequest(config, target, flags, {
+      method: 'POST',
+      path: `${appPrefix}/dingtalk/${subcommand === 'dingding-send' ? 'send' : 'preview'}`,
+      body,
+      strictEnvelope: true,
     });
   }
   if (['preview', 'send', 'batch-send'].includes(subcommand)) {
@@ -3071,7 +3103,170 @@ async function notification(args) {
     });
   }
 
-  fail('用法: openxiangda notification template-list|template-get|template-upsert|template-delete|type-list|type-get|type-upsert|type-delete|preview|send|batch-send');
+  fail('用法: openxiangda notification template-list|template-get|template-upsert|template-delete|type-list|type-get|type-upsert|type-delete|preview|send|batch-send|capabilities|dingding-preview|dingding-send');
+}
+
+async function organization(args) {
+  const { subcommand, rest } = parseSubcommandArgs(args);
+  const { flags, positional } = parseArgs(rest);
+  if (wantsSubcommandHelp(subcommand, flags)) {
+    print([
+      '用法: openxiangda organization capabilities|department-list|department-get|department-create|department-update|account-list|account-get|account-create|account-update|account-reset-password',
+      '  capabilities --json',
+      '  department-list --json',
+      '  department-get <departmentId> --json',
+      '  department-create --body-json \'{"name":"销售部"}\' --force',
+      '  department-update <departmentId> --body-json \'{"name":"华东销售"}\' --force',
+      '  account-list [--keyword text|--department-ids id1,id2] --json',
+      '  account-get <userId> --json',
+      '  account-create --body-json \'{"username":"u1","password":"P@ssw0rd","name":"张三"}\' --force',
+      '  account-update <userId> --body-json \'{"name":"张三"}\' --force',
+      '  account-reset-password <userId> --body-json \'{"newPassword":"P@ssw0rd"}\' --force',
+    ].join('\n'));
+    return;
+  }
+
+  const config = loadConfig();
+  const target = getWorkspaceTarget(config, flags.profile || config.currentProfile, flags);
+  const appPrefix = `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/organization`;
+
+  if (subcommand === 'capabilities') {
+    return runDirectRequest(config, target, flags, {
+      method: 'GET',
+      path: `${appPrefix}/capabilities`,
+      strictEnvelope: true,
+    });
+  }
+
+  if (subcommand === 'department-list') {
+    return runDirectRequest(config, target, flags, {
+      method: 'GET',
+      path: `${appPrefix}/departments`,
+      strictEnvelope: true,
+    });
+  }
+
+  if (subcommand === 'department-get') {
+    const departmentId = positional[0] || flags['department-id'] || flags.id;
+    if (!departmentId) fail('用法: openxiangda organization department-get <departmentId>');
+    return runDirectRequest(config, target, flags, {
+      method: 'GET',
+      path: `${appPrefix}/departments/${encodeURIComponent(departmentId)}`,
+      strictEnvelope: true,
+    });
+  }
+
+  if (subcommand === 'department-create') {
+    if (!flags.force) fail('openxiangda organization department-create 是写操作，必须加 --force');
+    const body = readDirectJsonBody(flags, 'organization department-create');
+    return runDirectRequest(config, target, flags, {
+      method: 'POST',
+      path: `${appPrefix}/departments`,
+      body,
+      strictEnvelope: true,
+    });
+  }
+
+  if (subcommand === 'department-update') {
+    if (!flags.force) fail('openxiangda organization department-update 是写操作，必须加 --force');
+    const departmentId = positional[0] || flags['department-id'] || flags.id;
+    if (!departmentId) fail('用法: openxiangda organization department-update <departmentId> --body-json ... --force');
+    const body = readDirectJsonBody(flags, 'organization department-update');
+    return runDirectRequest(config, target, flags, {
+      method: 'POST',
+      path: `${appPrefix}/departments/${encodeURIComponent(departmentId)}`,
+      body,
+      strictEnvelope: true,
+    });
+  }
+
+  if (subcommand === 'account-list') {
+    return runDirectRequest(config, target, flags, {
+      method: 'GET',
+      path: apiPathWithQuery(`${appPrefix}/accounts`, {
+        ids: flags.ids,
+        departmentIds: flags['department-ids'],
+        keyword: flags.keyword,
+        name: flags.name,
+        username: flags.username,
+        phone: flags.phone,
+        email: flags.email,
+        jobNumber: flags['job-number'],
+        page: flags.page,
+        pageSize: flags['page-size'] || flags.limit,
+      }),
+      strictEnvelope: true,
+    });
+  }
+
+  if (subcommand === 'account-get') {
+    const userId = positional[0] || flags['user-id'] || flags.id;
+    if (!userId) fail('用法: openxiangda organization account-get <userId>');
+    return runDirectRequest(config, target, flags, {
+      method: 'GET',
+      path: `${appPrefix}/accounts/${encodeURIComponent(userId)}`,
+      strictEnvelope: true,
+    });
+  }
+
+  if (subcommand === 'account-create') {
+    if (!flags.force) fail('openxiangda organization account-create 是写操作，必须加 --force');
+    const body = readDirectJsonBody(flags, 'organization account-create');
+    return runDirectRequest(config, target, flags, {
+      method: 'POST',
+      path: `${appPrefix}/accounts`,
+      body,
+      strictEnvelope: true,
+    });
+  }
+
+  if (subcommand === 'account-update') {
+    if (!flags.force) fail('openxiangda organization account-update 是写操作，必须加 --force');
+    const userId = positional[0] || flags['user-id'] || flags.id;
+    if (!userId) fail('用法: openxiangda organization account-update <userId> --body-json ... --force');
+    const body = readDirectJsonBody(flags, 'organization account-update');
+    if (Object.prototype.hasOwnProperty.call(body || {}, 'password')) {
+      fail('account-update 不允许包含 password，请使用 account-reset-password');
+    }
+    return runDirectRequest(config, target, flags, {
+      method: 'POST',
+      path: `${appPrefix}/accounts/${encodeURIComponent(userId)}`,
+      body,
+      strictEnvelope: true,
+    });
+  }
+
+  if (subcommand === 'account-reset-password') {
+    if (!flags.force) fail('openxiangda organization account-reset-password 是密码写操作，必须加 --force');
+    const userId = positional[0] || flags['user-id'] || flags.id;
+    if (!userId) fail('用法: openxiangda organization account-reset-password <userId> --body-json ... --force');
+    const body = readDirectJsonBody(flags, 'organization account-reset-password');
+    if (!body.newPassword) fail('account-reset-password body 缺少 newPassword');
+    return runDirectRequest(config, target, flags, {
+      method: 'POST',
+      path: `${appPrefix}/accounts/${encodeURIComponent(userId)}/password/reset`,
+      body,
+      strictEnvelope: true,
+    });
+  }
+
+  fail('用法: openxiangda organization capabilities|department-list|department-get|department-create|department-update|account-list|account-get|account-create|account-update|account-reset-password');
+}
+
+function buildDingTalkNotificationActionBody(target, code, rawBody = {}, flags = {}) {
+  const body = { ...(rawBody || {}) };
+  if (flags['template-code'] && !body.templateCode) body.templateCode = flags['template-code'];
+  if (flags['template-id'] && !body.templateId) body.templateId = flags['template-id'];
+  if (code && !body.notificationType && !body.templateCode && !body.templateId && !body.code) {
+    body.notificationType = code;
+  }
+  const formUuid =
+    body.formUuid ||
+    flags['form-uuid'] ||
+    resolveOptionalFormUuid(target.bound, body.formCode || flags['form-code']);
+  if (formUuid) body.formUuid = formUuid;
+  delete body.formCode;
+  return body;
 }
 
 async function normalizeNotificationPreviewBody(config, target, code, rawBody = {}, flags = {}) {
@@ -3213,7 +3408,7 @@ async function permission(args) {
     const target = getWorkspaceTarget(config, profileName, flags);
     const roleId = resolveRoleId(target.bound, roleCode, flags);
     const data = await runDirectRequest(config, target, flags, {
-      method: 'PUT',
+      method: 'POST',
       path: `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/roles/${encodeURIComponent(roleId)}`,
       body: {
         code: body.code || roleCode,
@@ -3235,8 +3430,10 @@ async function permission(args) {
     const target = getWorkspaceTarget(config, profileName, flags);
     const roleId = resolveRoleId(target.bound, roleKey, flags);
     const data = await runDirectRequest(config, target, flags, {
-      method: 'DELETE',
-      path: `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/roles/${encodeURIComponent(roleId)}`,
+      method: 'POST',
+      path: apiPathWithPostDeleteAction(
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/roles/${encodeURIComponent(roleId)}`
+      ),
     }, { returnData: true });
     if (!flags['dry-run'] && target.bound.resources?.roles?.[roleKey]) {
       delete target.bound.resources.roles[roleKey];
@@ -3391,7 +3588,7 @@ async function permission(args) {
     const groupId = flags['group-id'] || target.bound.resources?.pagePermissionGroups?.[groupCode]?.groupId || groupCode;
     const normalized = normalizePagePermissionGroupDirectBody(target.bound, { ...body, code: body.code || groupCode });
     const data = await runDirectRequest(config, target, flags, {
-      method: 'PUT',
+      method: 'POST',
       path: `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/page-permission-groups/${encodeURIComponent(groupId)}`,
       body: normalized,
     }, { returnData: true });
@@ -3408,8 +3605,10 @@ async function permission(args) {
     const target = getWorkspaceTarget(config, profileName, flags);
     const groupId = flags['group-id'] || target.bound.resources?.pagePermissionGroups?.[groupKey]?.groupId || groupKey;
     const data = await runDirectRequest(config, target, flags, {
-      method: 'DELETE',
-      path: `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/page-permission-groups/${encodeURIComponent(groupId)}`,
+      method: 'POST',
+      path: apiPathWithPostDeleteAction(
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/page-permission-groups/${encodeURIComponent(groupId)}`
+      ),
     }, { returnData: true });
     if (!flags['dry-run'] && target.bound.resources?.pagePermissionGroups?.[groupKey]) {
       delete target.bound.resources.pagePermissionGroups[groupKey];
@@ -3525,7 +3724,7 @@ async function permission(args) {
     const groupId = flags['group-id'] || target.bound.resources?.formPermissionGroups?.[groupCode]?.groupId || groupCode;
     const normalized = normalizeFormPermissionGroupManifest(target.bound, { ...body, code: body.code || groupCode, formUuid });
     const data = await runDirectRequest(config, target, flags, {
-      method: 'PUT',
+      method: 'POST',
       path: `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/permission-groups/${encodeURIComponent(groupId)}`,
       body: normalized,
     }, { returnData: true });
@@ -3543,8 +3742,10 @@ async function permission(args) {
     if (!groupKey || !formUuid || !flags.force) fail('用法: openxiangda permission form-group-delete <groupCode|groupId> --form-code code|--form-uuid FORM --force');
     const groupId = flags['group-id'] || target.bound.resources?.formPermissionGroups?.[groupKey]?.groupId || groupKey;
     const data = await runDirectRequest(config, target, flags, {
-      method: 'DELETE',
-      path: `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/permission-groups/${encodeURIComponent(groupId)}`,
+      method: 'POST',
+      path: apiPathWithPostDeleteAction(
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/permission-groups/${encodeURIComponent(groupId)}`
+      ),
     }, { returnData: true });
     if (!flags['dry-run'] && target.bound.resources?.formPermissionGroups?.[groupKey]) {
       delete target.bound.resources.formPermissionGroups[groupKey];
@@ -3659,7 +3860,7 @@ async function settings(args) {
       target.profileName,
       `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/settings`,
       {
-        method: 'PUT',
+        method: 'POST',
         body: {
           settings: readJsonArg(flags['settings-json'], 'settings-json'),
         },
@@ -3694,7 +3895,7 @@ async function settings(args) {
       target.profileName,
       `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/field-indexes`,
       {
-        method: 'PUT',
+        method: 'POST',
         body: {
           indexes: readJsonArg(flags['indexes-json'], 'indexes-json'),
         },
@@ -3729,7 +3930,7 @@ async function settings(args) {
       target.profileName,
       `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/data-management`,
       {
-        method: 'PUT',
+        method: 'POST',
         body: {
           config: readJsonArg(flags['config-json'], 'config-json'),
         },
@@ -3761,7 +3962,7 @@ async function settings(args) {
       target.profileName,
       `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/public-access`,
       {
-        method: 'PUT',
+        method: 'POST',
         body: {
           isPublic: flags.public === undefined ? true : String(flags.public) !== 'false',
           description: flags.description || '',
@@ -3779,8 +3980,10 @@ async function settings(args) {
     const data = await requestWithAuth(
       config,
       target.profileName,
-      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/public-access`,
-      { method: 'DELETE' }
+      apiPathWithPostDeleteAction(
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/public-access`
+      ),
+      { method: 'POST' }
     );
     if (flags.json) return writeJson(data);
     print(JSON.stringify(data, null, 2));
@@ -4556,6 +4759,7 @@ async function commands(args) {
       'function list|get|create|update|upsert|delete|invoke',
       'connector list|get|create|update|upsert|delete|invoke|download-test',
       'notification template-list|template-get|template-upsert|template-delete|type-list|type-get|type-upsert|type-delete|preview|send|batch-send',
+      'organization capabilities|department-list|department-get|department-create|department-update|account-list|account-get|account-create|account-update|account-reset-password',
       'permission role-list|role-create|role-update|role-delete|role-bind|role-users|role-add-users|snapshot|audit',
       'permission page-group-list|page-group-create|page-group-update|page-group-delete|page-group-bind',
       'permission form-group-list|form-group-create|form-group-update|form-group-delete|form-group-bind|form-summary|menu-permissions',
@@ -4773,8 +4977,8 @@ async function directResourceCrud(config, target, spec) {
     const code = positional[0] || flags.code;
     if (!code || !flags.force) fail(`用法: openxiangda ${spec.commandName} delete <code> --force`);
     const data = await runDirectRequest(config, target, flags, {
-      method: 'DELETE',
-      path: `${basePath}/${encodeURIComponent(code)}`,
+      method: 'POST',
+      path: apiPathWithPostDeleteAction(`${basePath}/${encodeURIComponent(code)}`),
     }, { returnData: true });
     if (!flags['dry-run']) removeDirectStateResource(target, spec.resourceType, code);
     return outputDirectResult(data, flags);
@@ -4797,7 +5001,7 @@ async function directResourceCrud(config, target, spec) {
       ? spec.normalizeBody(rawBody)
       : rawBody;
 
-  let method = subcommand === 'create' ? (spec.createMethod || 'POST') : (spec.updateMethod || 'PUT');
+  let method = subcommand === 'create' ? (spec.createMethod || 'POST') : (spec.updateMethod || 'POST');
   let requestPath = subcommand === 'create'
     ? (spec.createPath || basePath)
     : (spec.updatePath || `${basePath}/${encodeURIComponent(code)}`);
@@ -4818,7 +5022,7 @@ async function directResourceCrud(config, target, spec) {
           body: spec.createBody ? spec.createBody(rawBody, normalizedBody) : normalizedBody,
         },
         update: {
-          method: spec.updateMethod || 'PUT',
+          method: spec.updateMethod || 'POST',
           path: spec.updatePath || `${basePath}/${encodeURIComponent(code)}`,
           body: spec.updateBody ? spec.updateBody(rawBody, normalizedBody) : normalizedBody,
         },
@@ -4830,7 +5034,7 @@ async function directResourceCrud(config, target, spec) {
       `${basePath}/${encodeURIComponent(code)}`
     );
     action = existing ? 'update' : 'create';
-    method = existing ? (spec.updateMethod || 'PUT') : (spec.createMethod || 'POST');
+    method = existing ? (spec.updateMethod || 'POST') : (spec.createMethod || 'POST');
     requestPath = existing
       ? (spec.updatePath || `${basePath}/${encodeURIComponent(code)}`)
       : (spec.createPath || basePath);
@@ -6368,6 +6572,13 @@ function validateNotificationChannels(label, channelsConfig, errors) {
       errors.push(`${label}: 不支持的通知渠道 ${channel}`);
     }
     validateNoSensitiveNotificationConfig(`${label}.channelsConfig.${channel}`, config, errors);
+    if (channel === 'dingding') {
+      validateDingTalkNotificationConfig(
+        `${label}.channelsConfig.${channel}`,
+        config,
+        errors
+      );
+    }
   }
 }
 
@@ -6382,6 +6593,62 @@ function validateNoSensitiveNotificationConfig(label, value, errors) {
   }
 }
 
+function validateDingTalkNotificationConfig(label, value, errors) {
+  const config = value?.config || {};
+  if (!config || typeof config !== 'object' || Array.isArray(config)) return;
+  if (
+    config.deliveryMode !== undefined &&
+    !['card_preferred', 'card_only', 'work_notice_only'].includes(
+      String(config.deliveryMode)
+    )
+  ) {
+    errors.push(`${label}.config.deliveryMode: 只能是 card_preferred、card_only 或 work_notice_only`);
+  }
+  const card = config.card || {};
+  if (card && typeof card === 'object' && !Array.isArray(card)) {
+    if (
+      card.mode !== undefined &&
+      !['standard', 'custom'].includes(String(card.mode))
+    ) {
+      errors.push(`${label}.config.card.mode: 只能是 standard 或 custom`);
+    }
+    if (
+      card.mode === 'custom' &&
+      card.paramMap !== undefined &&
+      (!card.paramMap ||
+        typeof card.paramMap !== 'object' ||
+        Array.isArray(card.paramMap))
+    ) {
+      errors.push(`${label}.config.card.paramMap: custom 卡片 paramMap 必须是对象`);
+    }
+    if (
+      card.fieldConfigs !== undefined &&
+      !Array.isArray(card.fieldConfigs)
+    ) {
+      errors.push(`${label}.config.card.fieldConfigs: 必须是数组`);
+    }
+  }
+}
+
+function resolveNotificationChannelEnvReferences(value) {
+  if (!value || typeof value !== 'object') return value;
+  if (Array.isArray(value)) {
+    return value.map(item => resolveNotificationChannelEnvReferences(item));
+  }
+  const next = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (
+      ['cardTemplateId', 'dingTalkTemplateId'].includes(key) &&
+      isEnvReference(item)
+    ) {
+      next[key] = resolveEnvReference(item, `DingTalk ${key}`);
+    } else {
+      next[key] = resolveNotificationChannelEnvReferences(item);
+    }
+  }
+  return next;
+}
+
 function resourceLabel(kind, item) {
   return `${kind}:${item.code || item.__source || item.__index || '?'}`;
 }
@@ -7178,7 +7445,7 @@ async function publishRoleResources(config, target, roles, result, options = {})
           config,
           target.profileName,
           `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/roles/${encodeURIComponent(existing.id)}`,
-          { method: 'PUT', body }
+          { method: 'POST', body }
         )
       : await requestWithAuth(
           config,
@@ -7236,7 +7503,7 @@ async function publishFormSettingsResources(config, target, settingsItems, resul
         config,
         target.profileName,
         `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/settings`,
-        { method: 'PUT', body: { settings: item.settings } }
+        { method: 'POST', body: { settings: item.settings } }
       );
     }
     if (item.indexes !== undefined) {
@@ -7244,7 +7511,7 @@ async function publishFormSettingsResources(config, target, settingsItems, resul
         config,
         target.profileName,
         `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/field-indexes`,
-        { method: 'PUT', body: { indexes: item.indexes } }
+        { method: 'POST', body: { indexes: item.indexes } }
       );
     }
     if (item.dataManagement !== undefined) {
@@ -7252,7 +7519,7 @@ async function publishFormSettingsResources(config, target, settingsItems, resul
         config,
         target.profileName,
         `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/data-management`,
-        { method: 'PUT', body: { config: item.dataManagement } }
+        { method: 'POST', body: { config: item.dataManagement } }
       );
     }
     if (item.publicAccess !== undefined) {
@@ -7260,12 +7527,15 @@ async function publishFormSettingsResources(config, target, settingsItems, resul
         typeof item.publicAccess === 'object'
           ? item.publicAccess
           : { isPublic: Boolean(item.publicAccess) };
+      const publicAccessPath = `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/public-access`;
       await requestWithAuth(
         config,
         target.profileName,
-        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/public-access`,
+        publicAccess.isPublic === false
+          ? apiPathWithPostDeleteAction(publicAccessPath)
+          : publicAccessPath,
         {
-          method: publicAccess.isPublic === false ? 'DELETE' : 'PUT',
+          method: 'POST',
           body: {
             isPublic: publicAccess.isPublic !== false,
             description: publicAccess.description || '',
@@ -7309,7 +7579,7 @@ async function publishMenuResources(config, target, menus, result, options = {})
           config,
           target.profileName,
           `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/menus/${encodeURIComponent(existing.id)}`,
-          { method: 'PUT', body }
+          { method: 'POST', body }
         )
       : await requestWithAuth(
           config,
@@ -7401,7 +7671,7 @@ async function publishNotificationResources(config, target, notifications, resul
       config,
       target.profileName,
       `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/notifications/templates/${encodeURIComponent(template.code)}`,
-      { method: 'PUT', body }
+      { method: 'POST', body }
     );
     if (data?.id) {
       saveNotificationTemplateResource(target, template.code, data.id, {
@@ -7428,7 +7698,7 @@ async function publishNotificationResources(config, target, notifications, resul
       config,
       target.profileName,
       `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/notifications/type-configs/${encodeURIComponent(configItem.notificationType)}`,
-      { method: 'PUT', body }
+      { method: 'POST', body }
     );
     const stateCode = configItem.code || notificationTypeConfigDesiredKey(target.bound, configItem);
     if (data?.id) {
@@ -7494,7 +7764,7 @@ async function publishWorkflowResources(config, target, workflows, result, optio
           config,
           target.profileName,
           `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows/${encodeURIComponent(existing.id)}`,
-          { method: 'PUT', body }
+          { method: 'POST', body }
         )
       : await requestWithAuth(
           config,
@@ -7586,7 +7856,7 @@ async function publishAutomationResources(config, target, automations, result, o
           config,
           target.profileName,
           `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations/${encodeURIComponent(existing.id)}`,
-          { method: 'PUT', body }
+          { method: 'POST', body }
         )
       : await requestWithAuth(
           config,
@@ -7649,7 +7919,7 @@ async function publishFunctionResources(config, target, functions, result, optio
           config,
           target.profileName,
           `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/functions/${encodeURIComponent(code)}`,
-          { method: 'PUT', body }
+          { method: 'POST', body }
         )
       : await requestWithAuth(
           config,
@@ -7685,7 +7955,7 @@ async function publishAuthConfigResources(config, target, authConfigs, result, o
           config,
           target.profileName,
           `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/auth/configs/${encodeURIComponent(code)}`,
-          { method: 'PUT', body }
+          { method: 'POST', body }
         )
       : await requestWithAuth(
           config,
@@ -7720,7 +7990,7 @@ async function publishDataViewResources(config, target, dataViews, result, optio
           config,
           target.profileName,
           `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/data-views/${encodeURIComponent(dataViewItem.code)}`,
-          { method: 'PUT', body }
+          { method: 'POST', body }
         )
       : await requestWithAuth(
           config,
@@ -7766,7 +8036,7 @@ async function publishStorageConfigResources(config, target, storageConfigs, res
           config,
           target.profileName,
           `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/storage-configs/${encodeURIComponent(code)}`,
-          { method: 'PUT', body }
+          { method: 'POST', body }
         )
       : await requestWithAuth(
           config,
@@ -7796,7 +8066,7 @@ async function publishDataViewPermissionGroups(config, target, dataViewCode, per
     target.profileName,
     `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/data-views/${encodeURIComponent(dataViewCode)}/permission-groups`,
     {
-      method: 'PUT',
+      method: 'POST',
       body: {
         groups: permissionGroups,
       },
@@ -7818,7 +8088,7 @@ async function publishRouteResources(config, target, routes, result, options = {
           config,
           target.profileName,
           `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/routes/${encodeURIComponent(code)}`,
-          { method: 'PUT', body }
+          { method: 'POST', body }
         )
       : await requestWithAuth(
           config,
@@ -7856,7 +8126,7 @@ async function publishPublicAccessPolicyResources(config, target, policies, resu
           config,
           target.profileName,
           `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/public-access/policies/${encodeURIComponent(code)}`,
-          { method: 'PUT', body }
+          { method: 'POST', body }
         )
       : await requestWithAuth(
           config,
@@ -7997,7 +8267,7 @@ async function publishPagePermissionGroupResources(config, target, groups, resul
           config,
           target.profileName,
           `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/page-permission-groups/${encodeURIComponent(existing.id)}`,
-          { method: 'PUT', body }
+          { method: 'POST', body }
         )
       : await requestWithAuth(
           config,
@@ -8056,7 +8326,7 @@ async function publishFormPermissionGroupResources(config, target, groups, resul
           config,
           target.profileName,
           `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/permission-groups/${encodeURIComponent(existing.id)}`,
-          { method: 'PUT', body }
+          { method: 'POST', body }
         )
       : await requestWithAuth(
           config,
@@ -8146,8 +8416,10 @@ async function pruneRoles(config, target, desired, result) {
       await requestWithAuth(
         config,
         target.profileName,
-        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/roles/${encodeURIComponent(role.id)}`,
-        { method: 'DELETE' }
+        apiPathWithPostDeleteAction(
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/roles/${encodeURIComponent(role.id)}`
+        ),
+        { method: 'POST' }
       );
     });
   }
@@ -8166,8 +8438,10 @@ async function pruneConnectors(config, target, desired, result) {
       await requestWithAuth(
         config,
         target.profileName,
-        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/connectors/${encodeURIComponent(code)}`,
-        { method: 'DELETE' }
+        apiPathWithPostDeleteAction(
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/connectors/${encodeURIComponent(code)}`
+        ),
+        { method: 'POST' }
       );
     });
   }
@@ -8187,8 +8461,10 @@ async function pruneMenus(config, target, desired, result) {
       await requestWithAuth(
         config,
         target.profileName,
-        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/menus/${encodeURIComponent(menu.id)}`,
-        { method: 'DELETE' }
+        apiPathWithPostDeleteAction(
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/menus/${encodeURIComponent(menu.id)}`
+        ),
+        { method: 'POST' }
       );
     });
   }
@@ -8218,8 +8494,10 @@ async function pruneWorkflows(config, target, desired, result) {
       await requestWithAuth(
         config,
         target.profileName,
-        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows/${encodeURIComponent(workflow.id)}`,
-        { method: 'DELETE' }
+        apiPathWithPostDeleteAction(
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows/${encodeURIComponent(workflow.id)}`
+        ),
+        { method: 'POST' }
       );
     });
   }
@@ -8249,8 +8527,10 @@ async function pruneAutomations(config, target, desired, result) {
       await requestWithAuth(
         config,
         target.profileName,
-        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations/${encodeURIComponent(automation.id)}`,
-        { method: 'DELETE' }
+        apiPathWithPostDeleteAction(
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations/${encodeURIComponent(automation.id)}`
+        ),
+        { method: 'POST' }
       );
     });
   }
@@ -8272,8 +8552,10 @@ async function pruneDataViews(config, target, desired, result) {
       await requestWithAuth(
         config,
         target.profileName,
-        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/data-views/${encodeURIComponent(code)}`,
-        { method: 'DELETE' }
+        apiPathWithPostDeleteAction(
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/data-views/${encodeURIComponent(code)}`
+        ),
+        { method: 'POST' }
       );
     });
   }
@@ -8295,8 +8577,10 @@ async function pruneStorageConfigs(config, target, desired, result) {
       await requestWithAuth(
         config,
         target.profileName,
-        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/storage-configs/${encodeURIComponent(code)}`,
-        { method: 'DELETE' }
+        apiPathWithPostDeleteAction(
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/storage-configs/${encodeURIComponent(code)}`
+        ),
+        { method: 'POST' }
       );
     });
   }
@@ -8318,8 +8602,10 @@ async function pruneFunctions(config, target, desired, result) {
       await requestWithAuth(
         config,
         target.profileName,
-        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/functions/${encodeURIComponent(code)}`,
-        { method: 'DELETE' }
+        apiPathWithPostDeleteAction(
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/functions/${encodeURIComponent(code)}`
+        ),
+        { method: 'POST' }
       );
     });
   }
@@ -8341,8 +8627,10 @@ async function pruneAuthConfigs(config, target, desired, result) {
       await requestWithAuth(
         config,
         target.profileName,
-        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/auth/configs/${encodeURIComponent(code)}`,
-        { method: 'DELETE' }
+        apiPathWithPostDeleteAction(
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/auth/configs/${encodeURIComponent(code)}`
+        ),
+        { method: 'POST' }
       );
     });
   }
@@ -8364,8 +8652,10 @@ async function pruneRoutes(config, target, desired, result) {
       await requestWithAuth(
         config,
         target.profileName,
-        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/routes/${encodeURIComponent(code)}`,
-        { method: 'DELETE' }
+        apiPathWithPostDeleteAction(
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/routes/${encodeURIComponent(code)}`
+        ),
+        { method: 'POST' }
       );
     });
   }
@@ -8387,8 +8677,10 @@ async function prunePublicAccessPolicies(config, target, desired, result) {
       await requestWithAuth(
         config,
         target.profileName,
-        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/public-access/policies/${encodeURIComponent(code)}`,
-        { method: 'DELETE' }
+        apiPathWithPostDeleteAction(
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/public-access/policies/${encodeURIComponent(code)}`
+        ),
+        { method: 'POST' }
       );
     });
   }
@@ -8410,8 +8702,10 @@ async function prunePagePermissionGroups(config, target, desired, result) {
       await requestWithAuth(
         config,
         target.profileName,
-        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/page-permission-groups/${encodeURIComponent(group.id)}`,
-        { method: 'DELETE' }
+        apiPathWithPostDeleteAction(
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/page-permission-groups/${encodeURIComponent(group.id)}`
+        ),
+        { method: 'POST' }
       );
     });
   }
@@ -8441,8 +8735,10 @@ async function pruneFormPermissionGroups(config, target, desired, result) {
         await requestWithAuth(
           config,
           target.profileName,
-          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/permission-groups/${encodeURIComponent(group.id)}`,
-          { method: 'DELETE' }
+          apiPathWithPostDeleteAction(
+            `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/permission-groups/${encodeURIComponent(group.id)}`
+          ),
+          { method: 'POST' }
         );
       });
     }
@@ -9146,7 +9442,9 @@ function normalizeNotificationTemplateManifest(bound, template) {
     name: template.name || template.code,
     content: template.content || '',
     description: template.description || '',
-    channelsConfig: template.channelsConfig,
+    channelsConfig: resolveNotificationChannelEnvReferences(
+      template.channelsConfig
+    ),
     level,
     formUuid,
     priority: template.priority,
@@ -10529,6 +10827,16 @@ function findWorkspaceRoot(startPath) {
   return process.cwd();
 }
 
+function apiPathWithPostDeleteAction(apiPath) {
+  const value = String(apiPath || '');
+  const queryIndex = value.indexOf('?');
+  const base = queryIndex >= 0 ? value.slice(0, queryIndex) : value;
+  const suffix = queryIndex >= 0 ? value.slice(queryIndex) : '';
+  if (!base || base === '/') return '/delete' + suffix;
+  if (/(^|\/)delete(\/|$)/.test(base)) return value;
+  return base.replace(/\/$/, '') + '/delete' + suffix;
+}
+
 function apiPathWithQuery(apiPath, query) {
   const params = new URLSearchParams();
   for (const [key, value] of Object.entries(query || {})) {