openxiangda 1.0.165 → 1.0.166

package/lib/cli.js

@@ -990,6 +990,7 @@ async function release(args) {
       );
     }
     const pendingBaseline = getStoredChangeBaseline(target);
+    const newReleaseLifecycle = !stored && !pendingBaseline;
     const clientSessionId =
       existing?.clientSessionId ||
       (pendingBaseline?.changeId === changeId &&
@@ -1018,12 +1019,16 @@ async function release(args) {
       throw error;
     }
     const finalizedBaseline = finalizeReleaseBaseline(target, baseline);
+    const stagedResourcesFile = newReleaseLifecycle
+      ? initializeStagedAppReleaseResources(target, changeId)
+      : null;
     const result = {
       ...lease,
       baselineId: finalizedBaseline?.baselineId,
       baselineHeadDigest: finalizedBaseline?.headDigest,
       sourceBase: finalizedBaseline?.sourceBase,
       releaseSourceRevision: finalizedBaseline?.releaseSourceRevision,
+      ...(stagedResourcesFile ? { stagedResourcesFile } : {}),
     };
     if (flags.json) return writeJson(result);
     print(
@@ -1562,6 +1567,270 @@ function readStagedAppReleaseResources(flags = {}) {
   );
 }
 
+function stagedResourcesFileForChange(changeId) {
+  const normalized = String(changeId || '').trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(normalized)) {
+    fail('APP_RELEASE_STAGED_RESOURCES_CHANGE_INVALID: 自动聚合 staged resources 需要有效 --change');
+  }
+  return path.join(
+    process.cwd(),
+    '.openxiangda',
+    'releases',
+    normalized,
+    'staged-resources.json'
+  );
+}
+
+function stagedResourcesContextFileForChange(changeId) {
+  return stagedResourcesFileForChange(changeId).replace(
+    /staged-resources\.json$/,
+    'staged-resources.context.json'
+  );
+}
+
+function currentStagedResourcesContext(target, changeId) {
+  const baseline = getStoredChangeBaseline(target);
+  if (!baseline?.baselineId || baseline.changeId !== changeId) {
+    fail(
+      `APP_RELEASE_STAGED_CONTEXT_REQUIRED: change ${changeId} 缺少当前发布基线`
+    );
+  }
+  return {
+    contractVersion: 'staged_resources_context_v1',
+    appType: target.appType,
+    profile: target.profileName,
+    changeId,
+    baselineId: baseline.baselineId,
+    clientSessionId: baseline.clientSessionId || null,
+  };
+}
+
+function writeStagedResourcesFiles(changeId, resources, context) {
+  const file = stagedResourcesFileForChange(changeId);
+  const contextFile = stagedResourcesContextFileForChange(changeId);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  for (const [targetFile, value] of [
+    [file, resources],
+    [contextFile, context],
+  ]) {
+    const temporary = `${targetFile}.${process.pid}.tmp`;
+    fs.writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, {
+      mode: 0o600,
+    });
+    fs.renameSync(temporary, targetFile);
+  }
+  return path.relative(process.cwd(), file).replace(/\\/g, '/');
+}
+
+function initializeStagedAppReleaseResources(target, changeId) {
+  const context = currentStagedResourcesContext(target, changeId);
+  return writeStagedResourcesFiles(changeId, [], {
+    ...context,
+    initializedAt: new Date().toISOString(),
+  });
+}
+
+function assertStagedResourcesContext(target, changeId) {
+  const expected = currentStagedResourcesContext(target, changeId);
+  const contextFile = stagedResourcesContextFileForChange(changeId);
+  if (!fs.existsSync(contextFile)) {
+    if (!fs.existsSync(stagedResourcesFileForChange(changeId))) {
+      initializeStagedAppReleaseResources(target, changeId);
+    }
+  }
+  if (!fs.existsSync(contextFile)) {
+    fail(
+      'APP_RELEASE_STAGED_CONTEXT_REQUIRED: staged resources 缺少当前 release begin 生成的 context；请重新暂存本次 change 的 child releases'
+    );
+  }
+  const actual = JSON.parse(fs.readFileSync(contextFile, 'utf8'));
+  for (const field of [
+    'contractVersion',
+    'appType',
+    'profile',
+    'changeId',
+    'baselineId',
+    'clientSessionId',
+  ]) {
+    if ((actual?.[field] ?? null) !== (expected[field] ?? null)) {
+      fail(
+        `APP_RELEASE_STAGED_CONTEXT_MISMATCH: ${field} 不属于当前 change/baseline/session，请重新暂存 child releases`
+      );
+    }
+  }
+  return actual;
+}
+
+function recordStagedAppReleaseResources(
+  changeId,
+  resources,
+  target
+) {
+  if (!changeId || !Array.isArray(resources) || resources.length === 0) {
+    return null;
+  }
+  const file = stagedResourcesFileForChange(changeId);
+  const context = assertStagedResourcesContext(target, changeId);
+  let existing = [];
+  if (fs.existsSync(file)) {
+    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+    existing = Array.isArray(parsed) && parsed.length === 0
+      ? []
+      : normalizeStagedAppReleaseResources(parsed);
+  }
+  const incoming = normalizeStagedAppReleaseResources(resources);
+  const merged = new Map();
+  for (const resource of [...existing, ...incoming]) {
+    const described = describeAppReleaseResource(resource, 0, 'stagedResources');
+    merged.set(described.stableKey, resource);
+  }
+  const output = Array.from(merged.values()).sort((left, right) => {
+    const leftKey = describeAppReleaseResource(left, 0, 'stagedResources').stableKey;
+    const rightKey = describeAppReleaseResource(right, 0, 'stagedResources').stableKey;
+    return leftKey.localeCompare(rightKey);
+  });
+  return writeStagedResourcesFiles(changeId, output, context);
+}
+
+function exactStringSet(left, right) {
+  const normalize = values =>
+    Array.from(
+      new Set((values || []).map(value => String(value || '').trim()).filter(Boolean))
+    ).sort();
+  const a = normalize(left);
+  const b = normalize(right);
+  return a.length === b.length && a.every((value, index) => value === b[index]);
+}
+
+function stagedFormCode(target, resource) {
+  const explicit = String(resource?.metadata?.formCode || '').trim();
+  if (explicit) return explicit;
+  const formUuid = String(resource?.identity?.formUuid || '').trim();
+  for (const bucketName of ['formSettings', 'forms']) {
+    for (const [code, entry] of Object.entries(
+      target.bound.resources?.[bucketName] || {}
+    )) {
+      if (String(entry?.formUuid || '').trim() === formUuid) return code;
+    }
+  }
+  return formUuid;
+}
+
+function assertStagedAppReleaseScope(target, flags, resources) {
+  const changeId = readStringFlag(flags, 'change');
+  if (!changeId) {
+    fail(
+      'APP_RELEASE_STAGED_SCOPE_REQUIRED: staged child activation 必须显式提供 --change'
+    );
+  }
+  assertStagedResourcesContext(target, changeId);
+  let scope;
+  try {
+    scope = getSddChangeScope({
+      cwd: process.cwd(),
+      configText: readWorkspaceConfigText(),
+      changeId,
+    });
+  } catch (error) {
+    if (/SDD 未初始化|change 不存在|ENOENT/i.test(String(error?.message || ''))) {
+      return {
+        changeId,
+        scope: null,
+        resources: normalizeStagedAppReleaseResources(resources),
+        compatibility: 'unmanaged_sdd_scope',
+      };
+    }
+    throw error;
+  }
+  const targets = scope.targets || {};
+  const normalized = normalizeStagedAppReleaseResources(resources);
+  const byKind = kind => normalized.filter(resource => resource.kind === kind);
+  const expectedBackendSelectors = [
+    ...(targets.functions || []).map(code => `function:${code}`),
+    ...(targets.automations || []).map(code => `automation:${code}`),
+  ].sort();
+  const backend = byKind('BackendRelease');
+  if (expectedBackendSelectors.length > 0) {
+    if (
+      backend.length !== 1 ||
+      !exactStringSet(
+        backend[0]?.metadata?.handledSelectors,
+        expectedBackendSelectors
+      )
+    ) {
+      fail(
+        `APP_RELEASE_STAGED_SCOPE_MISMATCH: Backend handledSelectors 必须精确为 ${expectedBackendSelectors.join(',')}`
+      );
+    }
+  } else if (backend.length > 0) {
+    fail('APP_RELEASE_STAGED_SCOPE_MISMATCH: SDD 未授权 BackendRelease child');
+  }
+
+  const expectedForms = (targets.forms || []).map(String).sort();
+  const actualForms = byKind('FormRelease')
+    .map(resource => stagedFormCode(target, resource))
+    .sort();
+  if (!exactStringSet(actualForms, expectedForms)) {
+    fail(
+      `APP_RELEASE_STAGED_SCOPE_MISMATCH: FormRelease 必须精确覆盖 ${expectedForms.join(',') || '(none)'}`
+    );
+  }
+
+  const runtimeCount = byKind('RuntimeRelease').length;
+  if (runtimeCount !== (targets.runtime ? 1 : 0)) {
+    fail(
+      `APP_RELEASE_STAGED_SCOPE_MISMATCH: RuntimeRelease 期望 ${targets.runtime ? 1 : 0} 个，实际 ${runtimeCount} 个`
+    );
+  }
+  const pageCount = byKind('PageRelease').length;
+  const expectsPageRelease = (targets.pages || []).length > 0;
+  if (pageCount !== (expectsPageRelease ? 1 : 0)) {
+    fail(
+      `APP_RELEASE_STAGED_SCOPE_MISMATCH: PageRelease 期望 ${expectsPageRelease ? 1 : 0} 个，实际 ${pageCount} 个`
+    );
+  }
+  return { changeId, scope, resources: normalized };
+}
+
+function changedAppReleaseResources(detailResources, captureResources) {
+  const captured = new Map(
+    (captureResources || []).map((resource, index) => {
+      const described = describeAppReleaseResource(
+        resource,
+        index,
+        'capture.resources'
+      );
+      return [described.stableKey, described];
+    })
+  );
+  return (detailResources || []).filter((resource, index) => {
+    const described = describeAppReleaseResource(
+      resource,
+      index,
+      'release.resources'
+    );
+    const active = captured.get(described.stableKey);
+    return (
+      !active ||
+      active.releaseId !== described.releaseId ||
+      active.hash !== described.hash
+    );
+  });
+}
+
+function assertAppReleaseActualGate(target, flags, scope, command) {
+  assertSddReleaseGate(
+    buildExplicitSddReleasePlan(scope.targets, {
+      files: scope.changedFiles || [],
+      commands: [command],
+      changeId: scope.changeId,
+      actualCommands: true,
+    }),
+    flags,
+    command
+  );
+}
+
 function stagedAppReleaseProtocolVersion(stagedResources) {
   const hasBackendReleaseV2 = (stagedResources || []).some(
     resource =>
@@ -1767,6 +2036,9 @@ async function runAppReleaseCommand(
     );
   } else if (subcommand === 'app-prepare') {
     const stagedResources = readStagedAppReleaseResources(flags);
+    if (stagedResources) {
+      assertStagedAppReleaseScope(target, flags, stagedResources);
+    }
     const protocolVersion = stagedAppReleaseProtocolVersion(stagedResources);
     if (protocolVersion) {
       assertAppFunctionSecretCapabilities(
@@ -1803,6 +2075,15 @@ async function runAppReleaseCommand(
       target.profileName,
       appReleaseApiPath(target, `/${encodeURIComponent(releaseId)}`)
     );
+    const detailResources = appReleaseManifestResources(detail);
+    const capture = await fetchAppReleaseCapture(config, target, flags);
+    const changedResources = changedAppReleaseResources(
+      detailResources,
+      capture.resources
+    );
+    if (changedResources.length > 0) {
+      assertStagedAppReleaseScope(target, flags, changedResources);
+    }
     const protocolVersion = String(detail?.protocolVersion || '');
     if (protocolVersion === APP_FUNCTION_SECRET_CAPABILITIES.atomicActivation) {
       assertAppFunctionSecretCapabilities(
@@ -1820,7 +2101,7 @@ async function runAppReleaseCommand(
       target,
       releaseContext,
       detail,
-      appReleaseManifestResources(detail),
+      detailResources,
       { protocolVersion: protocolVersion || undefined }
     );
   } else if (subcommand === 'app-activate') {
@@ -1835,6 +2116,18 @@ async function runAppReleaseCommand(
     const protocolVersion = String(detail?.protocolVersion || '');
     const atomicV2 =
       protocolVersion === APP_FUNCTION_SECRET_CAPABILITIES.atomicActivation;
+    const activatesStagedChildren =
+      atomicV2 ||
+      flags['activate-staged-children'] === true ||
+      String(flags['activate-staged-children'] || '').toLowerCase() === 'true';
+    if (activatesStagedChildren) {
+      const capture = await fetchAppReleaseCapture(config, target, flags);
+      const changedResources = changedAppReleaseResources(
+        appReleaseManifestResources(detail),
+        capture.resources
+      );
+      assertStagedAppReleaseScope(target, flags, changedResources);
+    }
     if (atomicV2) {
       assertAppFunctionSecretCapabilities(
         await fetchAppFunctionSecretCapabilities(config, target)
@@ -1853,15 +2146,30 @@ async function runAppReleaseCommand(
       releaseId,
       {
         activateStagedChildren:
-          atomicV2 ||
-          flags['activate-staged-children'] === true ||
-          String(flags['activate-staged-children'] || '').toLowerCase() ===
-            'true',
+          activatesStagedChildren,
         protocolVersion: protocolVersion || undefined,
       }
     );
   } else if (subcommand === 'app-finalize') {
     const stagedResources = readStagedAppReleaseResources(flags);
+    let stagedScope = null;
+    if (stagedResources) {
+      stagedScope = assertStagedAppReleaseScope(
+        target,
+        flags,
+        stagedResources
+      );
+      if (stagedScope.scope) {
+        assertAppReleaseActualGate(
+          target,
+          flags,
+          stagedScope.scope,
+          `openxiangda release app-finalize --staged-resources-json ${String(
+            flags['staged-resources-json']
+          )} --profile ${target.profileName} --change ${stagedScope.changeId}`
+        );
+      }
+    }
     const protocolVersion = stagedAppReleaseProtocolVersion(stagedResources);
     if (protocolVersion) {
       assertAppFunctionSecretCapabilities(
@@ -1914,6 +2222,16 @@ async function runAppReleaseCommand(
         protocolVersion,
       }
     );
+    let stateReconcileWarning = null;
+    try {
+      const appHead = await loadRuntimeHeadApp(config, target);
+      saveRuntimeHeadState(target, appHead);
+    } catch (error) {
+      stateReconcileWarning = {
+        component: 'RuntimeStateReadback',
+        message: error?.message || String(error),
+      };
+    }
     data = {
       activationModel: stagedResources
         ? protocolVersion || 'atomic_staged_children_v1'
@@ -1923,6 +2241,7 @@ async function runAppReleaseCommand(
       prepared,
       verified,
       activated,
+      ...(stateReconcileWarning ? { stateReconcileWarning } : {}),
     };
   } else if (subcommand === 'app-rollback') {
     if (!releaseId) {
@@ -3962,7 +4281,19 @@ async function workspace(args) {
     if (publishOptions.dryRun) {
       printWorkspaceReleasePlan(sddPlan);
     } else {
-      assertSddReleaseGate(sddPlan, flags, 'openxiangda workspace publish');
+      const actualSddPlan = buildExplicitSddReleasePlan(sddPlan.targets, {
+        files: sddPlan.changedFiles || [],
+        commands: [
+          buildWorkspacePublishCommand(flags, profileName),
+        ],
+        changeId: publishOptions.changeId,
+        actualCommands: true,
+      });
+      assertSddReleaseGate(
+        actualSddPlan,
+        flags,
+        'openxiangda workspace publish'
+      );
     }
     await requestWithAuth(
       config,
@@ -6341,6 +6672,7 @@ const SECRET_RESPONSE_FORBIDDEN_KEYS = new Set([
   'cipher',
   'encryptedvalue',
   'encrypteddek',
+  'wrappeddek',
   'valuehash',
   'cipherhash',
   'valuedigest',
@@ -6350,6 +6682,7 @@ const SECRET_RESPONSE_FORBIDDEN_KEYS = new Set([
   'plaintextlength',
   'iv',
   'nonce',
+  'authtag',
   'tag',
 ]);
 
@@ -8477,8 +8810,16 @@ async function resource(args) {
           resourceTargets,
           {
             files: scopedFiles,
-            commands: [buildResourcePublishCommand(typeFilters, codeFilters, profileName)],
+            commands: [
+              buildResourcePublishCommand(
+                typeFilters,
+                codeFilters,
+                profileName,
+                flags
+              ),
+            ],
             changeId: flags.change,
+            actualCommands: true,
           }
         ),
         flags,
@@ -8528,6 +8869,21 @@ async function resource(args) {
     if (changeBaselinePreflight) {
       result.changeBaselinePreflight = changeBaselinePreflight;
     }
+    const stagedResources =
+      Array.isArray(result.stagedResources) && result.stagedResources.length > 0
+        ? result.stagedResources
+        : result.stagedResource
+          ? [result.stagedResource]
+          : [];
+    const stagedChangeId =
+      flags.change || getStoredChangeBaseline(target)?.changeId;
+    if (stagedResources.length > 0 && stagedChangeId) {
+      result.stagedResourcesFile = recordStagedAppReleaseResources(
+        stagedChangeId,
+        stagedResources,
+        target
+      );
+    }
     result.timings = telemetry.stop();
     if (flags.json) return writeJson(result);
     printResourceResult(result);
@@ -8584,7 +8940,12 @@ function buildResourceManifestSddTargets(manifest, planActions = []) {
         .map(action => action.code)
         .filter(Boolean)
     ).sort();
-  const codeResourceKeys = new Set(['functions', 'automations', 'workflows']);
+  const codeResourceKeys = new Set([
+    'functions',
+    'automations',
+    'workflows',
+    'formSettings',
+  ]);
   const hasGenericResources = RESOURCE_SPECS.some(
     spec => !codeResourceKeys.has(spec.key) && (manifest[spec.key] || []).length > 0
   ) || (planActions || []).some(
@@ -8593,7 +8954,7 @@ function buildResourceManifestSddTargets(manifest, planActions = []) {
       !['function', 'automation', 'workflow'].includes(action.kind)
   );
   return {
-    forms: [],
+    forms: codes('formSettings'),
     pages: [],
     functions: unique([...codes('functions'), ...deletedCodes('function')]).sort(),
     automations: unique([
@@ -8608,20 +8969,51 @@ function buildResourceManifestSddTargets(manifest, planActions = []) {
   };
 }
 
-function buildResourcePublishCommand(typeFilters, codeFilters, profileName) {
+function buildResourcePublishCommand(
+  typeFilters,
+  codeFilters,
+  profileName,
+  flags = {}
+) {
   const args = ['openxiangda resource publish'];
-  if (typeFilters?.size === 1) {
-    args.push(Array.from(typeFilters)[0]);
+  if (typeFilters?.size > 0) {
+    args.push(Array.from(typeFilters).sort().join(','));
   }
   if (codeFilters?.length) {
+    const qualifierAliases = {
+      functions: 'function',
+      automations: 'automation',
+      workflows: 'workflow',
+      formSettings: 'form-setting',
+    };
     const selectors = codeFilters.map(selector =>
       (selector.key || selector.qualifier) && (!typeFilters || typeFilters.size !== 1)
-        ? `${selector.key || selector.qualifier}:${selector.code}`
+        ? `${
+            qualifierAliases[selector.key || selector.qualifier] ||
+            selector.key ||
+            selector.qualifier
+          }:${selector.code}`
         : selector.code
     );
     args.push(`--only ${Array.from(new Set(selectors)).join(',')}`);
   }
   args.push(`--profile ${profileName}`);
+  if (flags.change) args.push(`--change ${flags.change}`);
+  if (flags['stage-only']) args.push('--stage-only');
+  if (flags.activate) args.push('--activate');
+  if (flags['replace-manifest']) args.push('--replace-manifest');
+  if (flags.reason) args.push(`--reason ${JSON.stringify(String(flags.reason))}`);
+  return args.join(' ');
+}
+
+function buildWorkspacePublishCommand(flags = {}, profileName) {
+  const args = ['openxiangda workspace publish', `--profile ${profileName}`];
+  if (flags.change) args.push(`--change ${flags.change}`);
+  if (flags.form) args.push(`--form ${flags.form}`);
+  if (flags.page) args.push(`--page ${flags.page}`);
+  if (flags.only) args.push(`--only ${flags.only}`);
+  if (flags.changed) args.push('--changed');
+  if (flags['include-resources']) args.push('--include-resources');
   return args.join(' ');
 }
 
@@ -8729,9 +9121,10 @@ async function runtime(args) {
           commands: [
             `openxiangda runtime deploy --profile ${target.profileName}${
               flags.change ? ` --change ${flags.change}` : ''
-            }`,
+            }${flags['no-activate'] ? ' --no-activate' : ''}`,
           ],
           changeId: flags.change,
+          actualCommands: true,
         }
       ),
       flags,
@@ -8968,7 +9361,46 @@ async function runtime(args) {
           }
         )
     );
-    saveRuntimeReleaseState(target, data);
+    const runtimeContentHash = String(data?.contentHash || '')
+      .trim()
+      .toLowerCase();
+    const stagedResource = flags['no-activate']
+      ? stripUndefinedValues({
+          kind: 'RuntimeRelease',
+          identity: { releaseId: data?.id },
+          action: 'update',
+          hash: runtimeContentHash,
+          revision: {
+            parentReleaseId:
+              data?.parentReleaseId || runtimeLineage.parentReleaseId || null,
+          },
+          metadata: {
+            buildId: data?.buildId || buildId,
+            releaseStatus: data?.status || 'staged',
+          },
+        })
+      : null;
+    if (
+      flags['no-activate'] &&
+      (!data?.id || !/^[a-f0-9]{64}$/.test(runtimeContentHash))
+    ) {
+      fail(
+        'RUNTIME_RELEASE_STAGED_RESOURCE_INVALID: --no-activate 响应缺少 releaseId 或 64 位 contentHash'
+      );
+    }
+    if (!flags['no-activate']) {
+      saveRuntimeReleaseState(target, data);
+    }
+    const stagedChangeId =
+      flags.change || getStoredChangeBaseline(target)?.changeId;
+    const stagedResourcesFile =
+      stagedResource && stagedChangeId
+        ? recordStagedAppReleaseResources(
+            stagedChangeId,
+            [stagedResource],
+            target
+          )
+        : null;
     const releaseAssetBaseUrl = data?.assetBaseUrl || assetBaseUrl;
     const result = {
       appType: target.appType,
@@ -8990,6 +9422,8 @@ async function runtime(args) {
         releaseFiles.find(file => file.storageProvider)?.storageProvider ||
         null,
       traceId,
+      ...(stagedResource ? { stagedResource } : {}),
+      ...(stagedResourcesFile ? { stagedResourcesFile } : {}),
       timings: telemetry.stop(),
     };
     if (flags.json) return writeJson(result);
@@ -9002,6 +9436,9 @@ async function runtime(args) {
         `traceId: ${traceId}`,
         `assetBase: ${releaseAssetBaseUrl}`,
         `active: ${result.activated ? 'yes' : 'no'}`,
+        ...(stagedResourcesFile
+          ? [`staged resources: ${stagedResourcesFile}`]
+          : []),
       ].join('\n')
     );
     return;
@@ -9482,6 +9919,21 @@ function saveRuntimeReleaseState(target, release) {
   saveProjectState(target.state);
 }
 
+function saveRuntimeHeadState(target, app) {
+  const activeReleaseId =
+    app?.activeRuntimeReleaseId || app?.activeRuntime?.releaseId || null;
+  const activeBuildId =
+    app?.activeRuntimeBuildId || app?.activeRuntime?.buildId || null;
+  if (!activeReleaseId && !activeBuildId) return false;
+  saveRuntimeReleaseState(target, {
+    id: activeReleaseId,
+    buildId: activeBuildId,
+    assetBaseUrl:
+      app?.runtimeAssetBaseUrl || app?.activeRuntime?.assetBaseUrl || null,
+  });
+  return true;
+}
+
 function formatBytes(value) {
   const bytes = Number(value || 0);
   if (bytes < 1024) return `${bytes}B`;
@@ -12926,22 +13378,18 @@ function collectBackendReleaseCandidates(manifest, options = {}) {
       const code = item.code || item.functionCode || item.resourceCode;
       const action = getPlannedResourceAction(options, planKind, code);
       if (!action || !['create', 'update', 'noop'].includes(action.action)) continue;
-      const secretRefsDeclared =
-        kind === 'Function' && functionManifestDeclaresSecretRefs(item);
-      if (action.action === 'create' && !secretRefsDeclared) continue;
       if (action.action === 'noop' && options.skipNoop !== false) continue;
-      if (
-        shouldReplaceResourceManifestItem(
-          item,
-          resourceKey,
-          code,
-          options
-        ) &&
-        !secretRefsDeclared
-      ) {
-        continue;
-      }
-      candidates.push({ kind, code, item, plannedAction: action.action });
+      const replaceManifest =
+        action.action !== 'create' &&
+        shouldReplaceResourceManifestItem(item, resourceKey, code, options);
+      candidates.push({
+        kind,
+        code,
+        item,
+        plannedAction: action.action,
+        operation: action.action === 'create' ? 'create' : 'update',
+        mode: replaceManifest ? 'manifest_replacement' : 'source_only',
+      });
     }
   };
   append('Function', 'functions', manifest.functions);
@@ -13116,6 +13564,28 @@ async function buildBackendReleaseResourceInput(
     const secretRefsDeclared = functionManifestDeclaresSecretRefs(
       candidate.item
     );
+    const common = {
+      kind: 'Function',
+      code: candidate.code,
+      mode: candidate.mode,
+      operation: candidate.operation,
+      ...(secretRefsDeclared
+        ? {
+            secretRefs: normalizeFunctionSecretRefs(
+              candidate.item.secretRefs
+            ),
+          }
+        : {}),
+    };
+    if (candidate.mode === 'manifest_replacement') {
+      return {
+        ...common,
+        replacement: buildBackendReleaseFunctionReplacementInput(
+          candidate.item,
+          definitionJson
+        ),
+      };
+    }
     const source = backendSourcePlane(
       definitionJson,
       `Function:${candidate.code}`
@@ -13124,36 +13594,71 @@ async function buildBackendReleaseResourceInput(
       source.version = definitionJson.version;
       source.runtimeContractVersion = definitionJson.runtimeContractVersion;
     }
-    const resource = {
-      kind: 'Function',
-      code: candidate.code,
-      ...(candidate.plannedAction === 'create'
+    return {
+      ...common,
+      ...(candidate.operation === 'create'
         ? {
-            operation: 'create',
             create: buildBackendReleaseFunctionCreateInput(
               candidate.item,
               definitionJson
             ),
           }
-        : { operation: 'update' }),
-      source,
-      ...(secretRefsDeclared
-        ? {
-            secretRefs: normalizeFunctionSecretRefs(
-              candidate.item.secretRefs
-            ),
-          }
         : {}),
+      source,
     };
-    return resource;
   }
-  return {
+  const viewJson =
+    (await resolveManifestJson(
+      config,
+      target.profileName,
+      candidate.item,
+      'viewJson',
+      'viewFile',
+      true,
+      uploadCache
+    )) ??
+    (await resolveManifestJson(
+      config,
+      target.profileName,
+      candidate.item,
+      'previewJson',
+      'previewFile',
+      true,
+      uploadCache
+    ));
+  const common = {
     kind: 'Automation',
     code: candidate.code,
+    mode: candidate.mode,
+    operation: candidate.operation,
+  };
+  if (candidate.mode === 'manifest_replacement') {
+    return {
+      ...common,
+      replacement: buildBackendReleaseAutomationMetadata(
+        target,
+        candidate.item,
+        definitionJson,
+        viewJson
+      ),
+    };
+  }
+  return {
+    ...common,
     sources: buildAutomationBackendReleaseSources(
       definitionJson,
       `Automation:${candidate.code}`
     ),
+    ...(candidate.operation === 'create'
+      ? {
+          create: buildBackendReleaseAutomationMetadata(
+            target,
+            candidate.item,
+            withoutBackendSourcePlanes(definitionJson),
+            viewJson
+          ),
+        }
+      : {}),
   };
 }
 
@@ -13187,6 +13692,75 @@ function buildBackendReleaseFunctionCreateInput(functionItem, definitionJson) {
   });
 }
 
+function buildBackendReleaseFunctionReplacementInput(
+  functionItem,
+  definitionJson
+) {
+  const code =
+    functionItem.code || functionItem.functionCode || functionItem.resourceCode;
+  return stripUndefinedValues({
+    name: functionItem.name || definitionJson.name || code,
+    description:
+      functionItem.description !== undefined
+        ? functionItem.description
+        : definitionJson.description || '',
+    definitionJson: clonePlainJson(definitionJson),
+    resourceBindings: clonePlainJson(definitionJson.resourceBindings || {}),
+    inputSchema: clonePlainJson(
+      functionItem.inputSchema || definitionJson.inputSchema
+    ),
+    outputSchema: clonePlainJson(
+      functionItem.outputSchema || definitionJson.outputSchema
+    ),
+    status: functionItem.status || 'active',
+  });
+}
+
+function buildBackendReleaseAutomationMetadata(
+  target,
+  automationItem,
+  definitionJson,
+  viewJson
+) {
+  const payload = resolveAutomationManifestPayload(target, automationItem);
+  const enabled =
+    automationItem.enable !== undefined
+      ? Boolean(automationItem.enable)
+      : automationItem.isEnabled !== undefined
+        ? Boolean(automationItem.isEnabled)
+        : true;
+  return stripUndefinedValues({
+    name: automationItem.name || automationItem.code,
+    description: automationItem.description || '',
+    formUuid: payload.formUuid,
+    triggerConfig: clonePlainJson(payload.triggerConfig),
+    definitionJson: clonePlainJson(definitionJson),
+    ...(viewJson !== undefined ? { viewJson: clonePlainJson(viewJson) } : {}),
+    isPublished: Boolean(automationItem.publish || automationItem.isPublished),
+    isEnabled: enabled,
+    ...(automationItem.tags !== undefined
+      ? {
+          tags: Array.isArray(automationItem.tags)
+            ? automationItem.tags.join(',')
+            : automationItem.tags,
+        }
+      : {}),
+  });
+}
+
+function withoutBackendSourcePlanes(value) {
+  if (Array.isArray(value)) return value.map(withoutBackendSourcePlanes);
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(
+    Object.entries(value)
+      .filter(
+        ([key]) =>
+          !['sourceFile', 'sourceType', 'sourceProvenance'].includes(key)
+      )
+      .map(([key, item]) => [key, withoutBackendSourcePlanes(item)])
+  );
+}
+
 function indexCurrentAutomationStates(items, codes) {
   const codeSet = new Set(codes);
   const groups = new Map();
@@ -13273,6 +13847,9 @@ async function applyBackendAutomationStateTransitions(
       if (!current?.id) {
         fail(`Backend Release 激活后缺少 Automation:${candidate.code} 当前版本`);
       }
+      if (candidate.mode === 'manifest_replacement') {
+        return { code: candidate.code, transitions: [] };
+      }
       const plan = getPlannedResourceAction(
         options,
         'automation',
@@ -13389,7 +13966,8 @@ function saveBackendReleaseResourceStates(
 function backendReleaseResultSummary(
   release,
   stateTransitions = new Map(),
-  protocolVersion = null
+  protocolVersion = null,
+  handledSelectors = []
 ) {
   const resources = release.resources || [];
   const resolvedProtocolVersion =
@@ -13400,8 +13978,17 @@ function backendReleaseResultSummary(
     action: 'update',
     hash: release.verificationHash || release.manifestHash,
     metadata: resolvedProtocolVersion
-      ? { protocolVersion: resolvedProtocolVersion }
-      : {},
+      ? {
+          protocolVersion: resolvedProtocolVersion,
+          mode: release.mode,
+          parentReleaseId: release.parentReleaseId || null,
+          handledSelectors,
+        }
+      : {
+          mode: release.mode,
+          parentReleaseId: release.parentReleaseId || null,
+          handledSelectors,
+        },
   };
   const isStaged = ['prepared', 'verified'].includes(
     String(release.status || '').toLowerCase()
@@ -13412,6 +13999,8 @@ function backendReleaseResultSummary(
     manifestHash: release.manifestHash,
     verificationHash: release.verificationHash,
     parentReleaseId: release.parentReleaseId || null,
+    mode: release.mode,
+    handledSelectors,
     resourceCount: resources.length,
     updateCount: resources.filter(resource => resource.action === 'update').length,
     noopCount: resources.filter(resource => resource.action === 'noop').length,
@@ -13444,13 +14033,20 @@ async function publishBackendReleaseResources(
     }
     return;
   }
-  const protocolVersion = candidates.some(
-    candidate =>
-      candidate.kind === 'Function' &&
-      functionManifestDeclaresSecretRefs(candidate.item)
-  )
-    ? APP_FUNCTION_SECRET_CAPABILITIES.backendRelease
-    : null;
+  const protocolVersion = APP_FUNCTION_SECRET_CAPABILITIES.backendRelease;
+  const handledSelectors = candidates
+    .map(candidate =>
+      `${candidate.kind === 'Function' ? 'function' : 'automation'}:${candidate.code}`
+    )
+    .sort();
+  const resourceModes = unique(candidates.map(candidate => candidate.mode));
+  const releaseMode =
+    resourceModes.length > 1 ? 'mixed' : resourceModes[0] || 'source_only';
+  const replacementReason = String(
+    options.publishLeaseFlags?.reason ||
+      options.publishLeaseFlags?.['replace-reason'] ||
+      ''
+  ).trim();
 
   let head;
   try {
@@ -13460,19 +14056,26 @@ async function publishBackendReleaseResources(
       backendReleaseApiPath(target, '/head')
     );
   } catch (error) {
-    if (protocolVersion && isBackendReleaseFeatureAbsent(error)) {
+    if (isBackendReleaseFeatureAbsent(error)) {
+      const secretRefsRequired = candidates.some(
+        candidate =>
+          candidate.kind === 'Function' &&
+          functionManifestDeclaresSecretRefs(candidate.item)
+      );
+      if (!options.stageBackendReleaseOnly && !secretRefsRequired) {
+        const message =
+          '当前平台未提供 Backend Release API（head=404）；非 stage-only 发布兼容降级为逐项写入。升级平台后会自动使用 Backend Release v2。';
+        result.warnings.push(message);
+        warn(message);
+        return;
+      }
       const missing = new Error(
-        'APP_FUNCTION_SECRET_CAPABILITY_REQUIRED: 带 secretRefs 的 Function 禁止降级为逐项 PATCH；平台必须支持 Backend Release v2'
+        'BACKEND_RELEASE_V2_REQUIRED: 本次 Function/Automation 发布包含 v2 operation/mode，平台必须支持 Backend Release v2，禁止降级为逐项写入'
       );
-      missing.code = 'APP_FUNCTION_SECRET_CAPABILITY_REQUIRED';
+      missing.code = 'BACKEND_RELEASE_V2_REQUIRED';
       throw missing;
     }
-    if (!isBackendReleaseFeatureAbsent(error)) throw error;
-    const message =
-      '当前平台未提供 Backend Release API（head=404）；本次兼容降级为逐项 source PATCH。升级平台后会自动启用 Function + Automation 单事务发布。';
-    result.warnings.push(message);
-    warn(message);
-    return;
+    throw error;
   }
 
   const releaseContext = await ensureBackendReleasePublishContext(
@@ -13506,7 +14109,10 @@ async function publishBackendReleaseResources(
         ...releaseContext.control,
         ...(protocolVersion ? { protocolVersion } : {}),
         parentReleaseId: head?.activeBackendReleaseId || null,
-        mode: 'source_only',
+        mode: releaseMode,
+        ...(releaseMode !== 'source_only'
+          ? { replacementReason }
+          : {}),
         sourceRepositoryId: releaseContext.sourceRepositoryId,
         sourceRevision: releaseContext.sourceRevision,
         resources,
@@ -13575,11 +14181,14 @@ async function publishBackendReleaseResources(
     result.backendRelease = backendReleaseResultSummary(
       stagedRelease,
       new Map(),
-      protocolVersion
+      protocolVersion,
+      handledSelectors
     );
     if (!result.backendRelease.stagedResource) {
       fail('Backend Release stage-only 响应缺少 verified stagedResource');
     }
+    result.stagedResource = result.backendRelease.stagedResource;
+    result.handledSelectors = handledSelectors;
     return;
   }
   const activated = await requestWithAuth(
@@ -13660,8 +14269,10 @@ async function publishBackendReleaseResources(
   result.backendRelease = backendReleaseResultSummary(
     activated,
     stateTransitions,
-    protocolVersion
+    protocolVersion,
+    handledSelectors
   );
+  result.handledSelectors = handledSelectors;
 }
 
 async function publishResourceManifest(config, target, manifest, options = {}) {
@@ -14111,9 +14722,15 @@ async function runResourceChangeBaselinePreflight(
     const artifactCache = { ...(baseline.localBaseArtifactHashes || {}) };
     const missingArtifactTargets = targets.filter(targetItem => {
       const frozen = baseline.resourceHeads?.[targetItem.kind]?.[targetItem.code];
+      const cached = artifactCache[
+        resourceBaselineTargetKey(targetItem.kind, targetItem.code)
+      ];
+      const hasStableLineage =
+        frozen?.fields?.sourceLineageHash &&
+        frozen.fields.sourceLineageHash !== canonicalJsonSha256(null);
       return (
         frozen?.fields?.sourceArtifactHash &&
-        !artifactCache[resourceBaselineTargetKey(targetItem.kind, targetItem.code)]
+        (!cached || (hasStableLineage && !cached.sourceHash))
       );
     });
     if (missingArtifactTargets.length > 0) {
@@ -14144,7 +14761,26 @@ async function runResourceChangeBaselinePreflight(
       const artifact = artifactCache[
         resourceBaselineTargetKey(targetItem.kind, targetItem.code)
       ];
-      if (artifact?.artifactHash && fields.sourceArtifactHash) {
+      const hasStableLineage =
+        fields.sourceLineageHash &&
+        fields.sourceLineageHash !== canonicalJsonSha256(null);
+      if (hasStableLineage) {
+        if (!artifact?.sourceHash) {
+          throwSourceBaseDiverged(
+            `Git 基线构建未生成稳定源码血缘: ${targetItem.kind}:${targetItem.code}`,
+            [targetItem]
+          );
+        }
+        fields.sourceLineageHash =
+          targetItem.kind === 'Automation'
+            ? canonicalJsonSha256([
+                {
+                  nodeId: '$definition',
+                  sha256: String(artifact.sourceHash).toLowerCase(),
+                },
+              ])
+            : String(artifact.sourceHash).toLowerCase();
+      } else if (artifact?.artifactHash && fields.sourceArtifactHash) {
         fields.sourceArtifactHash =
           targetItem.kind === 'Automation'
             ? canonicalJsonSha256([
@@ -15030,6 +15666,54 @@ async function publishFormSettingsResources(
       { frozen, artifactId }
     );
     saveResourceEntry(target, 'formSettings', code, { formUuid });
+    const releaseId = data?.release?.id;
+    const contentHash = String(
+      data?.release?.contentHash || data?.contentHash || ''
+    ).toLowerCase();
+    const stagedResource =
+      data?.staged && !data?.active && releaseId
+        ? {
+            kind: 'FormRelease',
+            identity: { releaseId, formUuid },
+            action: 'update',
+            hash: contentHash,
+            revision: stripUndefinedValues({
+              parentReleaseId:
+                data?.release?.parentReleaseId ||
+                frozen.expectedParent?.releaseId ||
+                null,
+              baseRevision:
+                data?.release?.baseRevision ?? frozen.expectedParent?.revision,
+            }),
+            metadata: {
+              releaseStatus: data?.releaseStatus || 'staged',
+              formCode: code,
+            },
+          }
+        : null;
+    if (
+      !activate &&
+      !data?.noop &&
+      (!data?.staged || data?.active || !releaseId || !stagedResource)
+    ) {
+      fail(
+        `FORM_RELEASE_STAGE_REQUIRED: ${code} 的非激活 bundle 响应必须返回 staged=true、active=false、releaseId 和 contentHash`
+      );
+    }
+    if (stagedResource && !/^[a-f0-9]{64}$/.test(contentHash)) {
+      fail(
+        `FORM_RELEASE_STAGED_RESOURCE_INVALID: ${code} 的 staged FormRelease 缺少 64 位 contentHash`
+      );
+    }
+    if (stagedResource) {
+      result.stagedResources = result.stagedResources || [];
+      result.stagedResources.push(stagedResource);
+      if (result.stagedResources.length === 1) {
+        result.stagedResource = stagedResource;
+      } else {
+        delete result.stagedResource;
+      }
+    }
     result.published.push({
       kind: 'formSetting',
       code,
@@ -15040,7 +15724,9 @@ async function publishFormSettingsResources(
       staged: Boolean(data?.staged),
       active: Boolean(data?.active),
       releaseStatus: data?.releaseStatus,
-      releaseId: data?.release?.id,
+      releaseId,
+      contentHash: contentHash || undefined,
+      ...(stagedResource ? { stagedResource } : {}),
     });
   }
 }
@@ -19013,11 +19699,37 @@ function normalizeJsonForPlan(value, baseDir, keyName) {
     result.code = result.code === undefined ? '' : result.code;
     result.runtimeMode = result.runtimeMode || 'trusted_node';
     result.sourceType = result.sourceType || 'file_snapshot';
+    const sourceProvenance = resolveLocalSourceProvenanceForPlan(
+      value.sourceFile.localPath,
+      baseDir
+    );
+    if (sourceProvenance) {
+      result.sourceProvenance = {
+        ...(result.sourceProvenance || {}),
+        ...sourceProvenance,
+      };
+    }
   }
   if (result.code === '') delete result.code;
   return sortObjectForStableJson(result);
 }
 
+function resolveLocalSourceProvenanceForPlan(localPath, baseDir) {
+  const rawLocalPath = String(localPath);
+  const baseResolvedPath = path.resolve(baseDir || process.cwd(), rawLocalPath);
+  const cwdResolvedPath = path.resolve(process.cwd(), rawLocalPath);
+  const resolvedLocalPath = fs.existsSync(baseResolvedPath)
+    ? baseResolvedPath
+    : cwdResolvedPath;
+  const sourceInfo = getJsCodeSourceInfoForPlan(resolvedLocalPath);
+  if (!sourceInfo) return null;
+  return readJsCodeSourceProvenance(
+    sourceInfo.workspaceRoot,
+    sourceInfo.sourceKind,
+    sourceInfo.scriptCode
+  );
+}
+
 function normalizeLocalSourceFileForPlan(localPath, baseDir) {
   const rawLocalPath = String(localPath);
   const baseResolvedPath = path.resolve(baseDir || process.cwd(), rawLocalPath);
@@ -19239,7 +19951,7 @@ async function resolveJsCodeSnapshotFiles(config, profileName, value, baseDir, u
     typeof value.sourceFile === 'object' &&
     value.sourceFile.localPath
   ) {
-    const sourceFile = await uploadJsCodeSnapshotFile(
+    const snapshot = await uploadJsCodeSnapshotFile(
       config,
       profileName,
       value.sourceFile.localPath,
@@ -19249,7 +19961,13 @@ async function resolveJsCodeSnapshotFiles(config, profileName, value, baseDir, u
     );
     value.runtimeMode = value.runtimeMode || 'trusted_node';
     value.sourceType = 'file_snapshot';
-    value.sourceFile = sourceFile;
+    value.sourceFile = snapshot.sourceFile;
+    if (snapshot.sourceProvenance) {
+      value.sourceProvenance = {
+        ...(value.sourceProvenance || {}),
+        ...snapshot.sourceProvenance,
+      };
+    }
     value.code = value.code || '';
   }
 
@@ -19284,6 +20002,14 @@ async function uploadJsCodeSnapshotFile(
   if (uploadCache.has(cacheKey)) return await uploadCache.get(cacheKey);
 
   const buffer = fs.readFileSync(bundlePath);
+  const sourceInfo = getJsCodeSourceInfoForPlan(resolvedLocalPath);
+  const sourceProvenance = sourceInfo
+    ? readJsCodeSourceProvenance(
+        sourceInfo.workspaceRoot,
+        sourceInfo.sourceKind,
+        sourceInfo.scriptCode
+      )
+    : null;
   const pending = requestFormWithAuth(
     config,
     profileName,
@@ -19303,10 +20029,14 @@ async function uploadJsCodeSnapshotFile(
       originalName: uploaded.originalName,
       contentType: uploaded.contentType,
     };
-    uploadCache.set(cacheKey, sourceFile);
+    const snapshot = {
+      sourceFile,
+      ...(sourceProvenance ? { sourceProvenance } : {}),
+    };
+    uploadCache.set(cacheKey, snapshot);
     // Progress belongs on stderr so `--json` keeps stdout machine-readable.
     warn(`已上传JS_CODE快照: ${path.relative(process.cwd(), bundlePath)} (${sourceFile.sha256})`);
-    return sourceFile;
+    return snapshot;
   });
   uploadCache.set(cacheKey, pending);
   try {
@@ -19317,6 +20047,38 @@ async function uploadJsCodeSnapshotFile(
   }
 }
 
+function readJsCodeSourceProvenance(workspaceRoot, sourceKind, scriptCode) {
+  const key = `${sourceKind}/${scriptCode}`;
+  for (const filename of [
+    'build-cache.json',
+    'build-cache.cli-v4.json',
+    'build-cache.cli-v3.json',
+  ]) {
+    try {
+      const cache = JSON.parse(
+        fs.readFileSync(
+          path.join(workspaceRoot, '.openxiangda', filename),
+          'utf8'
+        )
+      );
+      const metadata = cache?.targets?.[key];
+      const sourceHash = String(metadata?.sourceHash || '').toLowerCase();
+      if (!/^[a-f0-9]{64}$/.test(sourceHash)) continue;
+      return {
+        contractVersion: 'source_lineage_v1',
+        sourceHash,
+        entryPath: `src/${sourceKind}/${scriptCode}/index.ts`,
+        dependencies: Array.isArray(metadata.dependencies)
+          ? metadata.dependencies.slice().sort()
+          : [],
+      };
+    } catch {
+      // Custom workspace builders are compatible but may not emit lineage.
+    }
+  }
+  return null;
+}
+
 async function resolveJsCodeBundlePath(localPath, scriptCode) {
   const extension = path.extname(localPath).toLowerCase();
   if (['.js', '.cjs', '.mjs'].includes(extension)) {
@@ -19378,10 +20140,10 @@ async function resolveJsCodeBundlePath(localPath, scriptCode) {
 }
 
 function runWorkspaceJsCodeBuild(workspaceRoot, resolvedScriptCode, sourceKind) {
-  return spawnSync('pnpm', ['build-js-code', '--script', resolvedScriptCode, '--source', sourceKind], {
-    cwd: workspaceRoot,
-    encoding: 'utf8',
-  });
+  return runWorkspaceJsCodeBuildBatch(
+    workspaceRoot,
+    [{ sourceKind, scriptCode: resolvedScriptCode }]
+  );
 }
 
 function isUnsupportedFunctionsBuildScript(result) {
@@ -19695,26 +20457,7 @@ function getChangedManifestResourceCodes(file, resourceKey, baseRef = 'HEAD') {
 }
 
 function shouldReplaceResourceManifestItem(item, resourceKey, code, options = {}) {
-  if (options.replaceManifest) return true;
-  if (!item?.__source) return false;
-  const relativeFile = normalizeWorkspaceRelativePath(
-    path.relative(process.cwd(), path.resolve(item.__source))
-  );
-  const scopedFiles = new Set(
-    (options.scopedFiles || []).map(normalizeWorkspaceRelativePath)
-  );
-  if (!scopedFiles.has(relativeFile)) return false;
-  const changedCodes = getChangedManifestResourceCodes(
-    relativeFile,
-    resourceKey,
-    options.baseRef || 'HEAD'
-  );
-  if (changedCodes.length === 0) {
-    // The SDD/change scope may refer to a committed manifest change that no
-    // longer differs from HEAD inside the release worktree.
-    return true;
-  }
-  return changedCodes.includes(String(code));
+  return options.replaceManifest === true;
 }
 
 function buildAutomationSourcePatchSources(existingDefinition, desiredDefinition) {
@@ -20068,19 +20811,27 @@ function scanWorkspaceReliabilityIssues(files) {
 
 function buildTargetedResourceReleaseCommands(targets, profileArg, changeId) {
   const changeArg = changeId ? ` --change ${changeId}` : '';
-  if (targets.resources || (targets.jsCodeNodes || []).length > 0) {
-    return [`openxiangda resource publish --profile ${profileArg}${changeArg}`];
-  }
   const commands = [];
-  for (const [targetKey, resourceType] of [
-    ['functions', 'function'],
-    ['automations', 'automation'],
-    ['workflows', 'workflow'],
-  ]) {
-    const codes = targets[targetKey] || [];
-    if (codes.length === 0) continue;
+  const functions = targets.functions || [];
+  const automations = targets.automations || [];
+  if (functions.length > 0 || automations.length > 0) {
+    const resourceTypes = [
+      ...(functions.length > 0 ? ['function'] : []),
+      ...(automations.length > 0 ? ['automation'] : []),
+    ];
+    const qualify = resourceTypes.length > 1;
+    const selectors = [
+      ...functions.map(code => (qualify ? `function:${code}` : code)),
+      ...automations.map(code => (qualify ? `automation:${code}` : code)),
+    ];
+    commands.push(
+      `openxiangda resource publish ${resourceTypes.join(',')} --only ${selectors.join(',')} --stage-only --profile ${profileArg}${changeArg}`
+    );
+  }
+  const workflows = targets.workflows || [];
+  if (workflows.length > 0) {
     commands.push(
-      `openxiangda resource publish ${resourceType} --only ${codes.join(',')} --profile ${profileArg}${changeArg}`
+      `openxiangda resource publish workflow --only ${workflows.join(',')} --profile ${profileArg}${changeArg}`
     );
   }
   return commands;
@@ -20096,9 +20847,9 @@ function buildWorkspaceReleaseCommands(targets, runtimeMode, profile, changeId)
     (targets.workflows || []).length > 0 ||
     (targets.jsCodeNodes || []).length > 0;
   if (runtimeMode === 'react-spa') {
-    for (const formCode of targets.forms) {
+    if (targets.forms.length > 0) {
       commands.push(
-        `openxiangda workspace publish --profile ${profileArg} --form ${formCode}${changeId ? ` --change ${changeId}` : ''}`
+        `openxiangda resource publish form-setting --only ${targets.forms.join(',')} --profile ${profileArg}${changeId ? ` --change ${changeId}` : ''}`
       );
     }
     if (hasResourceTargets) {
@@ -20106,7 +20857,17 @@ function buildWorkspaceReleaseCommands(targets, runtimeMode, profile, changeId)
     }
     if (targets.runtime) {
       commands.push(
-        `openxiangda runtime deploy --profile ${profileArg}${changeId ? ` --change ${changeId}` : ''}`
+        `openxiangda runtime deploy --no-activate --profile ${profileArg}${changeId ? ` --change ${changeId}` : ''}`
+      );
+    }
+    if (
+      targets.forms.length > 0 ||
+      (targets.functions || []).length > 0 ||
+      (targets.automations || []).length > 0 ||
+      targets.runtime
+    ) {
+      commands.push(
+        `openxiangda release app-finalize --staged-resources-json .openxiangda/releases/${changeId || 'change'}/staged-resources.json --profile ${profileArg}${changeId ? ` --change ${changeId}` : ''}`
       );
     }
     return commands;
@@ -20170,12 +20931,35 @@ function buildWorkspaceReleasePlan(options = {}) {
       name: issue.rule,
       message: `${issue.file}:${issue.line} ${issue.message}`,
     }));
-  const commands = buildWorkspaceReleaseCommands(
+  const generatedCommands = buildWorkspaceReleaseCommands(
     targets,
     runtimeMode,
     options.profile,
     changeScope?.changeId
   );
+  const commands =
+    changeScope?.commands?.length > 0
+      ? [...changeScope.commands]
+      : generatedCommands;
+  if (!changeScope?.commands?.length && targets.resources) {
+    errors.push({
+      name: 'sdd-release-generic-resource-selector-required',
+      message:
+        '变更包含尚未归一化为 code 的通用资源；已保留可确定的 Function/Automation/Workflow 命令，请在 release.json.commands 中补一条精确 --only/--code 命令覆盖剩余资源。',
+    });
+  }
+  if (
+    !changeScope?.commands?.length &&
+    (targets.jsCodeNodes || []).length > 0 &&
+    (targets.functions || []).length === 0 &&
+    (targets.automations || []).length === 0 &&
+    (targets.workflows || []).length === 0
+  ) {
+    errors.push({
+      name: 'sdd-release-js-code-owner-required',
+      message: `JS_CODE 源码尚未映射到可发布资源: ${targets.jsCodeNodes.join(', ')}；请在 coverage/release 中声明所属 Function、Automation 或 Workflow。`,
+    });
+  }
   const sdd = options.skipSdd
     ? null
       : buildSddGovernanceReport({
@@ -20290,6 +21074,7 @@ function buildExplicitSddReleasePlan(targets, options = {}) {
     commands,
     changeId: options.changeId,
     verifyStage: options.verifyStage || 'prepublish',
+    actualCommands: options.actualCommands === true,
   });
   return {
     targets,
@@ -20301,6 +21086,21 @@ function buildExplicitSddReleasePlan(targets, options = {}) {
 
 function assertSddReleaseGate(plan, flags, command) {
   if (!plan?.sdd || plan.sdd.errors.length === 0) return;
+  const nonBypassable = new Set([
+    'sdd-release-direct-form-schema-forbidden',
+    'sdd-release-direct-form-activation-forbidden',
+    'sdd-release-resource-scope-missing',
+    'sdd-release-runtime-direct-activation-forbidden',
+    'sdd-release-backend-direct-activation-forbidden',
+    'sdd-release-backend-scope-inexact',
+    'sdd-release-form-scope-inexact',
+  ]);
+  const hardFailure = plan.sdd.errors.find(error =>
+    nonBypassable.has(error.name)
+  );
+  if (hardFailure) {
+    fail(`${hardFailure.message}\n该原子发布安全门禁不可通过 --sdd-bypass 绕过。`);
+  }
   if (flags['sdd-bypass']) {
     const bypass = appendBypassLog({
       cwd: process.cwd(),