openxiangda 1.0.170 → 1.0.172

package/lib/sdd.js

@@ -155,6 +155,9 @@ function getSddGovernanceConfig(options = {}) {
     configured && /strictHighRisk\s*:\s*false/.test(block)
       ? false
       : enabled;
+  const strictDocumentation = Boolean(
+    configured && /strictDocumentation\s*:\s*true/.test(block)
+  );
   const pathMatch = block.match(/path\s*:\s*['"]([^'"]+)['"]/);
   const schemaMatch = block.match(/schemaVersion\s*:\s*['"]([^'"]+)['"]/);
   const sddPath = normalizeRelPath(pathMatch?.[1] || DEFAULT_SDD_DIR);
@@ -170,6 +173,7 @@ function getSddGovernanceConfig(options = {}) {
   return {
     enabled,
     strictHighRisk,
+    strictDocumentation,
     path: sddPath,
     rootDir,
     initialized,
@@ -196,7 +200,9 @@ function buildDefaultConfigYaml() {
     '  requireApprovalForHighRisk: true',
     '  requireAffectedCoverage: true',
     '  requireCoverageManifest: true',
-    '  requireScenarioEvidence: true',
+    '  requireScenarioEvidence: false',
+    '  requireChecklistCompletion: false',
+    '  releaseModel: publish-from-main-v1',
     '  archiveMergesDeltaSpecs: true',
     '',
   ].join('\n');
@@ -821,6 +827,146 @@ function proposeSddChange(options = {}) {
   };
 }
 
+function createMainlineSddBundle(options = {}) {
+  const governance = getSddGovernanceConfig(options);
+  if (!governance.initialized) {
+    throw new Error('SDD 尚未初始化，不能创建 mainline bundle');
+  }
+  const changeId = normalizeChangeId(options.changeId);
+  const sourceIds = Array.from(
+    new Set(splitList(options.changes || options.changeIds).map(normalizeChangeId))
+  ).filter(id => id !== changeId);
+  if (sourceIds.length === 0) {
+    throw new Error('mainline bundle 至少需要一个 --changes <change-a,change-b>');
+  }
+  const sourceChanges = sourceIds.map(id =>
+    loadSddChange({ cwd: options.cwd, configText: options.configText, changeId: id })
+  );
+  const invalid = sourceChanges.find(
+    item => item.meta.status !== 'approved' || !item.meta.approvedAt
+  );
+  if (invalid) {
+    const error = new Error(
+      `SDD_MAINLINE_BUNDLE_CHANGE_NOT_APPROVED: ${invalid.changeId} 尚未 approved`
+    );
+    error.code = 'SDD_MAINLINE_BUNDLE_CHANGE_NOT_APPROVED';
+    throw error;
+  }
+  const nested = sourceChanges.find(item => item.meta.changeMode === 'mainline-bundle');
+  if (nested) {
+    throw new Error(`mainline bundle 不允许嵌套: ${nested.changeId}`);
+  }
+
+  const affected = mergeAffectedScopes(
+    ...sourceChanges.flatMap(item => [
+      item.meta.affected,
+      normalizeCoverageResources(item.coverage, {}),
+      item.release?.targets,
+      { files: item.release?.changedFiles || [] },
+    ])
+  );
+  if (affected.functions.length > 0 || affected.automations.length > 0) {
+    affected.backend = true;
+  }
+  const createdAt = nowIso();
+  const meta = {
+    ...createChangeMetadata(changeId, {
+      title: options.title || `Mainline release: ${sourceIds.join(', ')}`,
+      affected,
+      changeMode: 'mainline-bundle',
+      riskLevel: 'medium',
+    }),
+    status: 'approved',
+    approvedAt: createdAt,
+    approvedBy: 'mainline-release-coordinator',
+    approvalSummary: `Aggregate approved changes on authoritative mainline: ${sourceIds.join(', ')}`,
+    bundledChanges: sourceIds,
+    createdAt,
+    updatedAt: createdAt,
+  };
+  const coverage = {
+    schemaVersion: SDD_SCHEMA_VERSION,
+    changeId,
+    generatedAt: createdAt,
+    resources: affected,
+    requirements: sourceChanges.map(item => ({
+      id: `bundle-${slug(item.changeId, 'change')}`,
+      title: item.meta.title || item.changeId,
+      spec: 'specs/app/spec.md',
+      scenarios: [
+        {
+          id: `${slug(item.changeId, 'change')}-merged`,
+          title: `${item.changeId} is included in the mainline release`,
+          evidence: [],
+        },
+      ],
+      covers: mergeAffectedScopes(
+        item.meta.affected,
+        normalizeCoverageResources(item.coverage, {}),
+        item.release?.targets,
+        { files: item.release?.changedFiles || [] }
+      ),
+    })),
+  };
+  const release = {
+    schemaVersion: SDD_SCHEMA_VERSION,
+    changeId,
+    mainlinePolicy: 'publish-from-main-v1',
+    bundledChanges: sourceIds,
+    targets: {
+      forms: affected.forms,
+      pages: affected.pages,
+      functions: affected.functions,
+      automations: affected.automations,
+      workflows: affected.workflows,
+      jsCodeNodes: affected.jsCodeNodes,
+      resources: affected.resources,
+      runtime: affected.runtime,
+      other: [],
+    },
+    changedFiles: affected.files,
+    commands: [],
+    verifiedAt: null,
+  };
+  const changeDir = path.join(governance.rootDir, 'changes', changeId);
+  if (fs.existsSync(changeDir) && !options.force) {
+    throw new Error(`change 已存在: ${changeId}`);
+  }
+  if (fs.existsSync(changeDir)) fs.rmSync(changeDir, { recursive: true, force: true });
+  ensureDir(path.join(changeDir, 'specs', 'app'));
+  writeJsonFile(path.join(changeDir, CHANGE_META_FILE), meta);
+  writeJsonFile(path.join(changeDir, COVERAGE_FILE), coverage);
+  writeJsonFile(path.join(changeDir, RELEASE_FILE), release);
+  fs.writeFileSync(
+    path.join(changeDir, 'proposal.md'),
+    `# Mainline Release Bundle: ${changeId}\n\nApproved changes: ${sourceIds.join(', ')}.\n\nThe exact structured scope in coverage.json is authoritative.\n`
+  );
+  fs.writeFileSync(
+    path.join(changeDir, 'design.md'),
+    '# Design\n\nAll bundled changes are merged and pushed before one staged, atomic application activation.\n'
+  );
+  fs.writeFileSync(
+    path.join(changeDir, 'tasks.md'),
+    '# Tasks\n\n## Implementation\n\n- [x] Aggregate approved changes\n\n## Prepublish\n\n- [x] Generate exact structured release scope\n\n## Postpublish\n\n- [ ] Record publish result\n'
+  );
+  fs.writeFileSync(
+    path.join(changeDir, 'evidence.md'),
+    '# Evidence\n\n## Verification\n\n- [x] Source changes were approved before bundling\n\n## Release\n\n- [ ] Record atomic activation result\n'
+  );
+  fs.writeFileSync(
+    path.join(changeDir, 'specs', 'app', 'spec.md'),
+    `# Mainline Bundle Spec\n\n## ADDED Requirements\n\n### Requirement: Publish ${sourceIds.length} approved changes together\nThe application SHALL activate the exact bundled scope from one authoritative mainline commit.\n\n#### Scenario: Atomic mainline activation\n- **Given** all bundled changes are approved and merged to the remote default branch\n- **When** the release coordinator publishes bundle ${changeId}\n- **Then** changed child releases activate together and unrelated resources remain unchanged\n`
+  );
+  return {
+    schemaVersion: SDD_SCHEMA_VERSION,
+    change: meta,
+    coverage,
+    release,
+    bundledChanges: sourceIds,
+    dir: path.relative(options.cwd || process.cwd(), changeDir).replace(/\\/g, '/'),
+  };
+}
+
 function loadSddChange(options = {}) {
   const governance = getSddGovernanceConfig(options);
   const changeId = normalizeChangeId(options.changeId);
@@ -1527,9 +1673,20 @@ function readUncheckedTasks(changeDir, stagePolicy = getSddVerifyStagePolicy('de
   });
 }
 
-function validateCoverageManifest(coverage, meta, targets, highRiskFiles, legacyMode = false) {
+function validateCoverageManifest(
+  coverage,
+  meta,
+  targets,
+  highRiskFiles,
+  legacyMode = false,
+  options = {}
+) {
   const errors = [];
   const warnings = [];
+  const addDocumentationIssue = issue => {
+    if (options.strictDocumentation) errors.push(issue);
+    else warnings.push(issue);
+  };
   if (!coverage || coverage.__invalid) {
     const message = coverage?.__invalid
       ? `coverage.json 无效: ${coverage.error}`
@@ -1545,15 +1702,24 @@ function validateCoverageManifest(coverage, meta, targets, highRiskFiles, legacy
     });
   }
   if (!Array.isArray(coverage.requirements) || coverage.requirements.length === 0) {
-    errors.push({ name: 'sdd-coverage-empty', message: 'coverage.json 必须包含 requirements 映射' });
+    addDocumentationIssue({
+      name: 'sdd-coverage-empty',
+      message: 'coverage.json 建议包含 requirements 映射；streamlined 模式仅以精确资源和文件范围作为发布硬门禁',
+    });
   } else {
     for (const requirement of coverage.requirements) {
       if (!requirement.id || !requirement.title || !requirement.spec) {
-        errors.push({ name: 'sdd-coverage-requirement-invalid', message: 'coverage requirement 缺少 id/title/spec' });
+        addDocumentationIssue({
+          name: 'sdd-coverage-requirement-invalid',
+          message: 'coverage requirement 缺少 id/title/spec',
+        });
         break;
       }
       if (!Array.isArray(requirement.scenarios) || requirement.scenarios.length === 0) {
-        errors.push({ name: 'sdd-coverage-scenarios-missing', message: `coverage requirement ${requirement.id} 缺少 scenarios` });
+        addDocumentationIssue({
+          name: 'sdd-coverage-scenarios-missing',
+          message: `coverage requirement ${requirement.id} 缺少 scenarios`,
+        });
         break;
       }
     }
@@ -1678,6 +1844,9 @@ function buildUpdatedReleaseManifest(loaded, releasePlan, verificationStage = 'd
   const reviewedCommands = Array.isArray(loaded.release?.commands)
     ? loaded.release.commands.filter(command => String(command || '').trim())
     : [];
+  const canonicalCommands = Array.isArray(releasePlan?.commands)
+    ? releasePlan.commands.filter(command => String(command || '').trim())
+    : [];
   return {
     schemaVersion: SDD_SCHEMA_VERSION,
     changeId: loaded.changeId,
@@ -1685,9 +1854,9 @@ function buildUpdatedReleaseManifest(loaded, releasePlan, verificationStage = 'd
     targets: releasePlan?.targets || loaded.release?.targets || {},
     changedFiles: releasePlan?.changedFiles || loaded.release?.changedFiles || [],
     commands:
-      reviewedCommands.length > 0
-        ? reviewedCommands
-        : releasePlan?.commands || [],
+      canonicalCommands.length > 0
+        ? canonicalCommands
+        : reviewedCommands,
     verifiedAt,
     verificationStage,
     verificationStages: {
@@ -1752,7 +1921,7 @@ function recordSddReleaseSourceRevision(options = {}) {
     ...(loaded.release && !loaded.release.__invalid ? loaded.release : {}),
     schemaVersion: SDD_SCHEMA_VERSION,
     changeId: loaded.changeId,
-    mainlinePolicy: 'merge-after-publish-v1',
+    mainlinePolicy: 'publish-from-main-v1',
     releaseSourceRevision,
   };
   if (JSON.stringify(release) !== JSON.stringify(loaded.release)) {
@@ -2079,19 +2248,30 @@ function verifySddChange(options = {}) {
       message: `affected 未覆盖高风险文件: ${fileCoverage.missing.join(', ')}`,
     });
   }
-  const coverageValidation = validateCoverageManifest(loaded.coverage, loaded.meta, targets, highRiskFiles, legacyMode);
+  const strictDocumentation = Boolean(loaded.governance.strictDocumentation);
+  const coverageValidation = validateCoverageManifest(
+    loaded.coverage,
+    loaded.meta,
+    targets,
+    highRiskFiles,
+    legacyMode,
+    { strictDocumentation }
+  );
   errors.push(...coverageValidation.errors);
   warnings.push(...coverageValidation.warnings);
   const deltaValidation = validateDeltaSpecs(loaded.changeDir);
-  errors.push(...deltaValidation.errors);
+  if (strictDocumentation) errors.push(...deltaValidation.errors);
+  else warnings.push(...deltaValidation.errors);
   warnings.push(...deltaValidation.warnings);
   const uncheckedTasks = readUncheckedTasks(loaded.changeDir, stagePolicy);
   if (uncheckedTasks.length > 0) {
-    errors.push({
+    const issue = {
       name: 'sdd-unfinished-tasks',
-      message: `${uncheckedTasks.length} 个 tasks.md 任务未完成`,
+      message: `${uncheckedTasks.length} 个 tasks.md 任务未完成；streamlined 模式不阻断主线发布`,
       details: uncheckedTasks,
-    });
+    };
+    if (strictDocumentation) errors.push(issue);
+    else warnings.push(issue);
   }
   const evidenceFile = path.join(loaded.changeDir, 'evidence.md');
   const uncheckedEvidence = readUncheckedChecklistForStages(evidenceFile, {
@@ -2100,14 +2280,16 @@ function verifySddChange(options = {}) {
     missingMessage: 'evidence.md 缺失',
   });
   if (uncheckedEvidence.length > 0) {
-    errors.push({
+    const issue = {
       name: 'sdd-evidence-incomplete',
-      message: `${uncheckedEvidence.length} 个 evidence.md 证据项未完成`,
+      message: `${uncheckedEvidence.length} 个 evidence.md 证据项未完成；streamlined 模式不阻断主线发布`,
       details: uncheckedEvidence,
-    });
+    };
+    if (strictDocumentation) errors.push(issue);
+    else warnings.push(issue);
   }
   const release =
-    options.writeMetadata && options.releasePlan && loaded.release && !loaded.release.__invalid
+    options.releasePlan && loaded.release && !loaded.release.__invalid
       ? buildUpdatedReleaseManifest(loaded, options.releasePlan, verificationStage)
       : loaded.release;
   if (stagePolicy.requireRelease) {
@@ -2116,6 +2298,7 @@ function verifySddChange(options = {}) {
     warnings.push(...releaseValidation.warnings);
     const reviewedPlannedCommands = loaded.meta?.release?.plannedCommands;
     if (
+      strictDocumentation &&
       !legacyMode &&
       Array.isArray(reviewedPlannedCommands) &&
       reviewedPlannedCommands.length > 0
@@ -2151,10 +2334,7 @@ function verifySddChange(options = {}) {
     release: {
       ...(loaded.meta.release || {}),
       plannedCommands:
-        Array.isArray(loaded.meta.release?.plannedCommands) &&
-        loaded.meta.release.plannedCommands.length > 0
-          ? loaded.meta.release.plannedCommands
-          : release?.commands || options.releasePlan?.commands || [],
+        release?.commands || options.releasePlan?.commands || [],
       lastVerifiedAt: verifiedAt,
     },
     verification: {
@@ -2474,6 +2654,7 @@ module.exports = {
   buildSddGovernanceReport,
   buildSddStatus,
   createQuickSddChange,
+  createMainlineSddBundle,
   getSddGovernanceConfig,
   getSddChangeScope,
   getSddVerifyStagePolicy,

package/lib/workspace-init.js

@@ -185,13 +185,23 @@ function buildNextSteps(targetDir, installedDependencies, bound, runtime) {
   steps.push(`openxiangda env --profile ${profileArg}`);
   steps.push('git switch -c codex/<change>');
   steps.push('openxiangda sdd propose <change>');
+  steps.push('完成开发、测试、approve 并提交 codex/<change>，不要从 feature worktree 发布');
+  steps.push(
+    'git switch <main-branch> && git merge --no-ff codex/<change> && git push origin <main-branch>'
+  );
+  steps.push(
+    'openxiangda sdd bundle <release-change> --changes <change-a,change-b>'
+  );
+  steps.push(
+    'git add openspec/changes/<release-change> && git commit -m "chore: prepare <release-change>" && git push origin <main-branch>'
+  );
   steps.push(
     runtime === 'react-spa'
-      ? `openxiangda runtime deploy --no-activate --change <change> --profile ${profileArg}`
-      : `openxiangda workspace publish --dry-run --only <exact-codes> --change <change> --profile ${profileArg}`
+      ? `openxiangda runtime deploy --no-activate --change <release-change> --profile ${profileArg}`
+      : `openxiangda workspace publish --dry-run --only <exact-codes> --change <release-change> --profile ${profileArg}`
   );
   steps.push(
-    `发布后将冻结提交 merge/fast-forward 并 push 到主分支，再运行 openxiangda release end --profile ${profileArg}`
+    `原子激活后运行 openxiangda release integration-status --profile ${profileArg}，再运行 openxiangda release end --profile ${profileArg}`
   );
   return steps;
 }

package/openxiangda-skills/SKILL.md

@@ -26,7 +26,7 @@ This file is a router and safety card. Read only the one or two subskills select
 ## Scope before work
 
 1. Work from the app workspace root and pass `--profile <name>` to every write or release command.
-2. In a shared or dirty checkout, use an isolated Git worktree/branch. `sdd propose|quick|context` automatically claims the current worktree for `CODEX_THREAD_ID`; if another task owns it, stop and move to a separate worktree instead of taking over its files. A release is not closed until its exact frozen commit has been merged (without squash/rebase) and pushed to the authoritative default branch.
+2. In a shared or dirty checkout, use an isolated Git worktree/branch for development. Merge approved task commits into the authoritative remote default branch before any live release. Formal publish runs once from a clean local `main`/`master` that exactly equals the remote tip; feature worktrees never publish.
 3. Give the task one stable SDD change id. Use `--change <id>` on context, plan, check, verify, publish, and archive commands when supported.
 4. Plan and publish exact resource codes with `--only <codes>` or `--code <code>`; a type-only or full-resource publish is allowed only when the dependency closure intentionally contains the whole type/application.
 5. A React SPA page change rebuilds one application runtime. Commit the complete build input first, upload/preview with `runtime deploy --no-activate`, and promote only from a clean merged release head that descends from the online Runtime source revision.
@@ -60,9 +60,9 @@ openxiangda sdd quick <change> --kind copy --pages <page> --files <file> --summa
 
 Function quick changes require the complete `--risk-json` assessment; Automation, Workflow, schema, permissions, auth/public access, migrations, destructive and cross-resource changes cannot use quick mode. Before release run `--stage prepublish`; use `postpublish` only after promotion and `archive` only when all evidence exists.
 
-Keep development lightweight: `sdd verify --stage implementation` checks scope/contracts but does not block on unfinished task/evidence prose. Plain `sdd verify` means prepublish, not all future stages. Do not manufacture postpublish/archive evidence during coding; the strict gates belong at stage/finalize.
+Keep development lightweight: structured approval plus exact resource/file scope are authoritative. By default, unfinished tasks/evidence/spec prose produces warnings at every stage and does not block release; set `strictDocumentation: true` only for a workspace that intentionally wants prose as a gate. Actual publish argv, mainline identity, CAS, lease, destructive scope, and atomic activation remain hard gates.
 
-`sdd verify/sync` preserves non-empty, reviewed `release.json.commands` and `change.json.release.plannedCommands` independently; it must not regenerate either into broader or directly activating commands. The prepublish gate also validates the actual argv, so a safe recorded plan cannot authorize a direct Backend/Form/Runtime activation. Generated React SPA plans use exact Form bundles, one mixed Backend `--stage-only` command, Runtime `--no-activate`, and Root `app-finalize`, with explicit `--profile` and `--change` on every publish command. Each staged command automatically merges its canonical child entry into `.openxiangda/releases/<change>/staged-resources.json`.
+The CLI regenerates one canonical command set from structured coverage instead of asking agents to maintain two command copies. A single Function uses `resource publish function --only <code>`; qualified selectors are used only when Function and Automation are mixed. Generated React SPA plans use exact Form bundles, one Backend `--stage-only` command, Runtime `--no-activate`, and Root `app-finalize`. Actual argv is validated again at write time.
 
 ## Safe release recipes
 
@@ -78,24 +78,22 @@ openxiangda workspace publish --change <change> --profile <name> --only pages/a,
 React SPA resources/runtime:
 
 ```bash
-openxiangda resource validate <type> --only <codes> --profile <name>
-openxiangda resource plan <type> --only <codes> --profile <name> --json
-openxiangda runtime deploy --change <change> --profile <name> --no-activate --json
-openxiangda sdd verify <change> --changed --stage prepublish --profile <name>
-openxiangda release begin --change <change> --profile <name>
-openxiangda resource publish function,automation --only <qualified-codes> --stage-only --change <change> --profile <name>
-openxiangda resource publish form-setting --only <form-codes> --change <change> --profile <name>
-openxiangda release app-finalize --change <change> --staged-resources-json <JSON|file> --profile <name>
-# Merge/fast-forward the frozen release commit into the remote default branch.
+# In task worktrees: implement, test, commit, then merge/fast-forward and push all approved changes.
+# In the clean main checkout:
+openxiangda sdd bundle <release-change> --changes <change-a,change-b>
+# Commit and push the generated bundle on main, then:
+openxiangda sdd verify <release-change> --changed --stage prepublish --profile <name>
+openxiangda release begin --change <release-change> --profile <name>
+# Execute the canonical exact commands printed by workspace plan/verify.
 openxiangda release integration-status --profile <name>
 openxiangda release end --profile <name>
 ```
 
 `resource plan` and publish dry-runs are strictly GET/HEAD-only. `READ_ONLY_AUTH_REQUIRED` means the access token expired; run `openxiangda auth refresh --profile <name>` or log in again before retrying. Never add an automatic refresh POST inside a plan.
 
-`release begin --change` separately freezes the change base and the actual publish source: a clean committed `HEAD` on a named branch that already contains the current authoritative remote default branch. Before any live write, the CLI preflights the complete target set and rejects source changes during the release. A worktree based on obsolete source fails with `SOURCE_BASE_DIVERGED`/`RELEASE_SOURCE_BEHIND_MAIN`; a selected remote field changed after the baseline fails with `RESOURCE_FIELD_CONFLICT`. Resolve/merge, rebuild, and re-plan instead of forcing the old release. For a one-time historical catch-up only—approved code already merged to main while live resources come from several older release lineages—an exact non-delete publish may add `--adopt-online-baseline --adoption-reason "..."` under the same change/lease. It adopts the server-frozen heads and keeps lease, remote preflight, staged release, and CAS protection; it rejects `--all`, `--force`, `--prune`, and deletes.
+`release begin --change` freezes a clean committed `HEAD` only when the current branch is the authoritative default `main`/`master` and its commit exactly equals the live remote tip. Before any live write, the CLI preflights the complete target set and rejects source changes during the release. A feature worktree or unpushed main receives `RELEASE_SOURCE_MAINLINE_REQUIRED` / `RELEASE_SOURCE_MAINLINE_NOT_PUSHED`; merge, test, push, and start the one mainline release instead of forcing it.
 
-After promotion, immediately merge or fast-forward the exact frozen publish commit into the authoritative remote default branch and push it. `release integration-status` reports the result; normal `release end` refuses with `RELEASE_MAIN_MERGE_PENDING` until the remote mainline contains that exact SHA, so squash/rebase merges do not count. The authoritative target comes only from the live remote default `main`/`master`; local-only refs, overrides, and lease expiry cannot clear this obligation. Archive the SDD change from the updated mainline.
+Because promotion begins from the already-pushed authoritative mainline, `release integration-status` should pass immediately after activation. Run it, then `release end`; no post-release branch merge is required.
 
 `runtime deploy` separately freezes the clean committed `HEAD` as `sourceRevision` together with the current active Runtime parent before any build or upload. Any deploy whose source does not descend from the online Runtime fails with `RUNTIME_SOURCE_BASE_DIVERGED`, including `--no-activate`; this prevents staging an old preview for later activation. `--no-build` does not bypass this guard. Only an intentional audited rollback may use `--allow-runtime-rollback --reason "<at least 8 characters>"`, and that flag never permits dirty or non-Git input. SDD evidence under `openspec/` and generated/state paths do not make Runtime source dirty.
 
@@ -105,7 +103,7 @@ When a Function or Automation is selected because its TypeScript source changed,
 
 An App Function may declare metadata-only top-level `secretRefs: [{ name, required }]` only with `function_v2` + `trusted_node_v2`; source resolves values with `await ctx.secrets.get(name)` and uses `ctx.utils.http` for controlled public HTTPS. Create/rotate values through hidden TTY or `openxiangda secret ... --value-stdin --change <change> --profile <name>`. Never put values in arguments, files, manifests, state, plans, logs, errors, or chat. Secret bindings require `backend_release_v2` and whole-app `atomic_staged_children_v2`; a missing capability is fail-closed and never uses the legacy source PATCH. For whole-app activation use exact-scope `resource publish <type> --only <code> --stage-only`, then pass the returned verified `stagedResource` to `release app-finalize`; an active Backend Release is never labeled staged.
 
-The lease is app-level promotion ownership, while worktree ownership prevents two Codex tasks from editing/publishing through the same source directory. Different worktrees may keep developing and validating. After promotion, merge/push the frozen SHA and run normal `release end`; an expired lease still retains reconciliation evidence. Use full resource/runtime publish only when the approved dependency closure is app-wide.
+The lease is app-level promotion ownership, while worktree ownership prevents two Codex tasks from editing through the same source directory. Different worktrees may keep developing and validating; only the clean synchronized main checkout publishes. Use full resource/runtime publish only when the approved bundle intentionally covers the whole dependency closure.
 
 ## Always
 

package/openxiangda-skills/skills/openxiangda-core/SKILL.md

@@ -24,9 +24,9 @@ openxiangda sdd context --change <change> --changed --json
 
 Run `openxiangda update check --json` once per substantial task, on a suspected mismatch, or when the cached check is older than one day. If an update is installed, refresh skills once with `openxiangda skill install --force`.
 
-Every write/release command must include `--profile <name>`. In a shared checkout, create an isolated Git worktree and named feature branch before editing. `sdd propose|quick|context` claims `.openxiangda/worktree-owner.json` for the current `CODEX_THREAD_ID`; a foreign owner is a hard stop. `.openxiangda/state.json` maps profile-local IDs; it is not a collaboration lock. The task is not complete until the exact frozen publish SHA is merged without squash/rebase and pushed to the authoritative default branch.
+Every write/release command must include `--profile <name>`. Parallel tasks develop in isolated Git worktrees/branches, but do not publish there. Merge approved commits into the authoritative remote default branch, create one `sdd bundle` for the intended changes, commit/push it, and publish once from a clean local `main`/`master` that exactly equals the remote tip.
 
-SDD is permissive during coding and strict at release: `sdd verify --stage implementation` does not require unfinished checklist/evidence prose, and an omitted stage means prepublish rather than postpublish/archive. Exact command, child scope, and mainline gates apply only when staging or activating writes.
+SDD is streamlined by default: unfinished checklist/evidence/spec prose is a warning, while approval, exact structured scope, actual argv, mainline identity, child CAS, lease, and atomic activation remain hard gates. Set `strictDocumentation: true` only when prose completion must intentionally block a workspace.
 
 First-class direct configuration writes (form/page/menu/role/permission/workflow/connector/notification/auth/route/public-access/scope/data-view/storage/settings) also require `--change <id>` or a complete stored session created by `openxiangda release begin --change <id>`. Missing context fails locally with `PUBLISH_CONTEXT_REQUIRED` before any HTTP write. Dry-run, schema planning, validation, query/invoke/export/submit/execution/upload, and other data-plane actions do not acquire a lease. Direct Workflow publish/unpublish/delete additionally requires the frozen `--expected-revision`; never fetch the latest revision merely to replay an older payload.
 
@@ -87,19 +87,16 @@ Do not call `lowcode-workspace publish-all`, `pnpm publish:all`, `pnpm publish:o
 Forms, Backend resources, and frontend Runtime are staged children of one Root App release:
 
 ```bash
-openxiangda resource publish form-setting --only <formCode> --change <change> --profile <name>
-openxiangda resource plan <type> --only <codes> --profile <name>
-openxiangda runtime deploy --change <change> --profile <name> --no-activate --json
-openxiangda sdd verify <change> --changed --stage prepublish --profile <name>
-openxiangda release begin --change <change> --profile <name>
-openxiangda resource publish function,automation --only function:<code>,automation:<code> --stage-only --change <change> --profile <name>
-openxiangda release app-finalize --staged-resources-json .openxiangda/releases/<change>/staged-resources.json --change <change> --profile <name>
-# Merge/fast-forward the frozen release SHA to the remote default branch.
+openxiangda sdd bundle <release-change> --changes <change-a,change-b>
+# Commit and push the bundle on main/master.
+openxiangda sdd verify <release-change> --changed --stage prepublish --profile <name>
+openxiangda release begin --change <release-change> --profile <name>
+# Run the canonical exact staged commands emitted by the release plan.
 openxiangda release integration-status --profile <name>
 openxiangda release end --profile <name>
 ```
 
-`runtime deploy --no-activate` uploads an immutable preview release from a clean committed `HEAD`. Before any build/upload, every Runtime deploy acquires the app publish lease and freezes that `sourceRevision` plus the current active Runtime parent. Both staged and activating deploys are rejected when the local source does not descend from the online source revision, including with `--no-build`; an intentional rollback requires `--allow-runtime-rollback --reason "<at least 8 characters>"` and remains auditable. SDD evidence in `openspec/` and generated/state directories are excluded from the source-clean check. `release begin --change` obtains app-level promotion ownership, freezes the actual clean publish `HEAD` independently from the earlier change base, and requires it to contain the current remote default branch. Before the first live write, one preflight validates the complete target set. Long asynchronous publish phases run a 30-second lease heartbeat; `PUBLISH_LEASE_LOST` is a hard stop and no later write may run. Synchronous Runtime builds first extend to the platform maximum TTL and must renew successfully before the next write. Do not move Runtime build ahead of lease/upload-plan: direct-storage releases compile the provider-specific `assetBaseUrl` returned by that protected plan, and silently substituting the gateway URL changes chunk/publicPath behavior. Parallel development remains available in other worktrees. After promotion, merge/fast-forward and push the frozen SHA to the authoritative default branch, check `release integration-status`, then run normal `release end`. The target is frozen from the live remote default `main`/`master`; overrides, local-only refs, and lease expiry cannot clear the pending-mainline evidence.
+`runtime deploy --no-activate` uploads an immutable preview release from a clean committed mainline `HEAD`. Before acquiring a lease, the CLI confirms `package.json#scripts.build` and existing dependencies; it uses `npm run build` to execute the declared script so pnpm worktree symlinks do not trigger a reinstall. The protected upload plan still runs before the actual build because its provider-specific `assetBaseUrl` is compiled into the bundle. `release begin` requires local main/master and the live remote default tip to be identical, so `integration-status` is already satisfied after activation and `release end` does not wait for a later merge.
 
 `resource plan`, `resource publish`, and `runtime deploy` report coarse phases on stderr and emit a heartbeat after 15 seconds without completion. JSON stdout stays machine-readable and includes `timings`; use it to identify whether time is spent in plan, preflight, build, upload, write, or activate instead of rerunning an opaque command.
 
@@ -137,8 +134,8 @@ openxiangda workspace bind --profile dev --app-type APP_XXXX
 - `RUNTIME_SOURCE_DIRTY` or `RUNTIME_SOURCE_LINEAGE_REQUIRED`: commit all build inputs in an auditable Git repository; generated `dist/` and `.openxiangda/` state do not count, and `--no-build` is not an escape hatch.
 - `PUBLISH_LEASE_HELD`: another change owns promotion; keep developing/testing locally or wait for its release/expiry. Never bypass it with an unleased write.
 - `PUBLISH_LEASE_LOST`: heartbeat renewal failed or the lease expired during a long phase; stop immediately, inspect the active head, re-plan, and start a new release. Never replay the remaining writes with a newly fetched revision.
-- `RELEASE_SOURCE_DIRTY`, `RELEASE_SOURCE_BEHIND_MAIN`, or `RELEASE_PUBLISH_REVISION_CHANGED`: commit all build inputs, merge the current remote mainline into the feature branch, and restart the release from the tested SHA.
-- `RELEASE_MAIN_MERGE_PENDING`: the live release SHA is not yet contained in the authoritative remote default branch. Merge without squash/rebase, push, rerun `release integration-status`, then `release end`.
+- `RELEASE_SOURCE_DIRTY` or `RELEASE_PUBLISH_REVISION_CHANGED`: commit all build inputs and restart from a stable mainline SHA.
+- `RELEASE_SOURCE_MAINLINE_REQUIRED` or `RELEASE_SOURCE_MAINLINE_NOT_PUSHED`: merge approved task commits and the generated bundle into the remote default branch, switch to the synchronized local main/master, then begin the release.
 - `WORKTREE_OWNED_BY_ANOTHER_TASK`: another Codex task owns this source directory; switch to an isolated worktree. Only force-claim with an explicit reason after confirming the original task ended.
 - Plan unexpectedly includes unrelated resources: do not publish; correct `--change`/`--only` or dependency closure.
 - A write updates state: let the CLI use its lock/atomic merge; do not hand-edit state or run conflicting legacy clients.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.170",
+  "version": "1.0.172",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {

package/packages/sdk/dist/build/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/build/index.ts"],"sourcesContent":["export type CssIsolation = 'namespace' | 'shadow' | 'none';\nexport type WorkspaceRuntimeMode = 'legacy' | 'react-spa';\n\nexport interface AppWorkspaceConfig {\n  appType?: string;\n  appName?: string;\n  runtimeMode?: WorkspaceRuntimeMode;\n  platformUrl?: string;\n  servicePrefix?: string;\n  appKey?: string;\n  appSecret?: string;\n  userId?: string;\n  version?: string;\n  buildId?: string;\n  oss?: {\n    region?: string;\n    bucket?: string;\n    accessKeyId?: string;\n    accessKeySecret?: string;\n    pathPrefix?: string;\n    corsOrigins?: string[];\n    skipCors?: boolean;\n  };\n  defaults?: {\n    protocolVersion?: string;\n    frameworkVersion?: string;\n    cssIsolation?: CssIsolation;\n    formMenuParentId?: string;\n    formMenuIcon?: string;\n    pageMenuParentId?: string;\n    pageMenuIcon?: string;\n    formBuilderVersion?: string;\n  };\n  forms?: { dir?: string; publishLegacyBundle?: boolean };\n  pages?: { dir?: string };\n  governance?: {\n    sdd?: {\n      enabled?: boolean;\n      strictHighRisk?: boolean;\n      path?: string;\n    };\n  };\n}\n\nexport function defineAppWorkspaceConfig<T extends AppWorkspaceConfig>(config: T): T {\n  return config;\n}\n\nconst DEFAULT_NAMESPACE_PREFIX = '.sy-app-workspace';\n\nfunction splitCssSelectors(selector: string) {\n  const selectors: string[] = [];\n  let depth = 0;\n  let quote = '';\n  let current = '';\n  for (const char of selector) {\n    if (quote) {\n      current += char;\n      if (char === quote) quote = '';\n      continue;\n    }\n    if (char === '\"' || char === \"'\") {\n      quote = char;\n      current += char;\n      continue;\n    }\n    if (char === '(' || char === '[') depth += 1;\n    if (char === ')' || char === ']') depth -= 1;\n    if (char === ',' && depth === 0) {\n      selectors.push(current.trim());\n      current = '';\n      continue;\n    }\n    current += char;\n  }\n  if (current.trim()) selectors.push(current.trim());\n  return selectors;\n}\n\nfunction shouldSkipNamespace(selector: string, prefix: string) {\n  if (!selector || selector.includes(prefix)) return true;\n  if (/^(html|body|:root)(\\b|:|\\[|$)/.test(selector)) return true;\n  if (/^(@|from\\b|to\\b|\\d+%)/.test(selector)) return true;\n  if (/^\\.(ant|sy-ant|anticon|adm)-/.test(selector)) return true;\n  return false;\n}\n\nfunction createAntdSelectorAlias(selector: string) {\n  const aliased = selector\n    .replace(/(^|[^A-Za-z0-9_-])\\.ant-/g, '$1.sy-ant-')\n    .replace(/(^|[^A-Za-z0-9_-])\\.anticon-/g, '$1.sy-anticon-')\n    .replace(/(^|[^A-Za-z0-9_-])\\.anticon(?=$|[^A-Za-z0-9_-])/g, '$1.sy-anticon');\n  return aliased === selector ? null : aliased;\n}\n\nexport function createOpenXiangdaNamespaceCssPlugin(\n  prefix = DEFAULT_NAMESPACE_PREFIX,\n) {\n  return {\n    postcssPlugin: 'openxiangda-namespace-css',\n    Rule(rule: { selector?: string; parent?: any }) {\n      if (!rule.selector) return;\n      let parent = rule.parent;\n      while (parent) {\n        if (parent.type === 'atrule' && /keyframes$/i.test(parent.name)) {\n          return;\n        }\n        parent = parent.parent;\n      }\n      rule.selector = Array.from(\n        new Set(\n          splitCssSelectors(rule.selector).flatMap((selector) => {\n            const scopedSelector = shouldSkipNamespace(selector, prefix)\n              ? selector\n              : `${prefix} ${selector}`;\n            const antdAlias = createAntdSelectorAlias(scopedSelector);\n            return antdAlias ? [scopedSelector, antdAlias] : [scopedSelector];\n          }),\n        ),\n      ).join(', ');\n    },\n  };\n}\n\n(createOpenXiangdaNamespaceCssPlugin as any).postcss = true;\n\nexport const createNamespaceCssPlugin = createOpenXiangdaNamespaceCssPlugin;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4CO,SAAS,yBAAuD,QAAc;AACnF,SAAO;AACT;AAEA,IAAM,2BAA2B;AAEjC,SAAS,kBAAkB,UAAkB;AAC3C,QAAM,YAAsB,CAAC;AAC7B,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,MAAI,UAAU;AACd,aAAW,QAAQ,UAAU;AAC3B,QAAI,OAAO;AACT,iBAAW;AACX,UAAI,SAAS,MAAO,SAAQ;AAC5B;AAAA,IACF;AACA,QAAI,SAAS,OAAO,SAAS,KAAK;AAChC,cAAQ;AACR,iBAAW;AACX;AAAA,IACF;AACA,QAAI,SAAS,OAAO,SAAS,IAAK,UAAS;AAC3C,QAAI,SAAS,OAAO,SAAS,IAAK,UAAS;AAC3C,QAAI,SAAS,OAAO,UAAU,GAAG;AAC/B,gBAAU,KAAK,QAAQ,KAAK,CAAC;AAC7B,gBAAU;AACV;AAAA,IACF;AACA,eAAW;AAAA,EACb;AACA,MAAI,QAAQ,KAAK,EAAG,WAAU,KAAK,QAAQ,KAAK,CAAC;AACjD,SAAO;AACT;AAEA,SAAS,oBAAoB,UAAkB,QAAgB;AAC7D,MAAI,CAAC,YAAY,SAAS,SAAS,MAAM,EAAG,QAAO;AACnD,MAAI,gCAAgC,KAAK,QAAQ,EAAG,QAAO;AAC3D,MAAI,wBAAwB,KAAK,QAAQ,EAAG,QAAO;AACnD,MAAI,+BAA+B,KAAK,QAAQ,EAAG,QAAO;AAC1D,SAAO;AACT;AAEA,SAAS,wBAAwB,UAAkB;AACjD,QAAM,UAAU,SACb,QAAQ,6BAA6B,YAAY,EACjD,QAAQ,iCAAiC,gBAAgB,EACzD,QAAQ,oDAAoD,eAAe;AAC9E,SAAO,YAAY,WAAW,OAAO;AACvC;AAEO,SAAS,oCACd,SAAS,0BACT;AACA,SAAO;AAAA,IACL,eAAe;AAAA,IACf,KAAK,MAA2C;AAC9C,UAAI,CAAC,KAAK,SAAU;AACpB,UAAI,SAAS,KAAK;AAClB,aAAO,QAAQ;AACb,YAAI,OAAO,SAAS,YAAY,cAAc,KAAK,OAAO,IAAI,GAAG;AAC/D;AAAA,QACF;AACA,iBAAS,OAAO;AAAA,MAClB;AACA,WAAK,WAAW,MAAM;AAAA,QACpB,IAAI;AAAA,UACF,kBAAkB,KAAK,QAAQ,EAAE,QAAQ,CAAC,aAAa;AACrD,kBAAM,iBAAiB,oBAAoB,UAAU,MAAM,IACvD,WACA,GAAG,MAAM,IAAI,QAAQ;AACzB,kBAAM,YAAY,wBAAwB,cAAc;AACxD,mBAAO,YAAY,CAAC,gBAAgB,SAAS,IAAI,CAAC,cAAc;AAAA,UAClE,CAAC;AAAA,QACH;AAAA,MACF,EAAE,KAAK,IAAI;AAAA,IACb;AAAA,EACF;AACF;AAEC,oCAA4C,UAAU;AAEhD,IAAM,2BAA2B;","names":[]}
+{"version":3,"sources":["../../src/build/index.ts"],"sourcesContent":["export type CssIsolation = 'namespace' | 'shadow' | 'none';\nexport type WorkspaceRuntimeMode = 'legacy' | 'react-spa';\n\nexport interface AppWorkspaceConfig {\n  appType?: string;\n  appName?: string;\n  runtimeMode?: WorkspaceRuntimeMode;\n  platformUrl?: string;\n  servicePrefix?: string;\n  appKey?: string;\n  appSecret?: string;\n  userId?: string;\n  version?: string;\n  buildId?: string;\n  oss?: {\n    region?: string;\n    bucket?: string;\n    accessKeyId?: string;\n    accessKeySecret?: string;\n    pathPrefix?: string;\n    corsOrigins?: string[];\n    skipCors?: boolean;\n  };\n  defaults?: {\n    protocolVersion?: string;\n    frameworkVersion?: string;\n    cssIsolation?: CssIsolation;\n    formMenuParentId?: string;\n    formMenuIcon?: string;\n    pageMenuParentId?: string;\n    pageMenuIcon?: string;\n    formBuilderVersion?: string;\n  };\n  forms?: { dir?: string; publishLegacyBundle?: boolean };\n  pages?: { dir?: string };\n  governance?: {\n    sdd?: {\n      enabled?: boolean;\n      strictHighRisk?: boolean;\n      strictDocumentation?: boolean;\n      path?: string;\n    };\n  };\n}\n\nexport function defineAppWorkspaceConfig<T extends AppWorkspaceConfig>(config: T): T {\n  return config;\n}\n\nconst DEFAULT_NAMESPACE_PREFIX = '.sy-app-workspace';\n\nfunction splitCssSelectors(selector: string) {\n  const selectors: string[] = [];\n  let depth = 0;\n  let quote = '';\n  let current = '';\n  for (const char of selector) {\n    if (quote) {\n      current += char;\n      if (char === quote) quote = '';\n      continue;\n    }\n    if (char === '\"' || char === \"'\") {\n      quote = char;\n      current += char;\n      continue;\n    }\n    if (char === '(' || char === '[') depth += 1;\n    if (char === ')' || char === ']') depth -= 1;\n    if (char === ',' && depth === 0) {\n      selectors.push(current.trim());\n      current = '';\n      continue;\n    }\n    current += char;\n  }\n  if (current.trim()) selectors.push(current.trim());\n  return selectors;\n}\n\nfunction shouldSkipNamespace(selector: string, prefix: string) {\n  if (!selector || selector.includes(prefix)) return true;\n  if (/^(html|body|:root)(\\b|:|\\[|$)/.test(selector)) return true;\n  if (/^(@|from\\b|to\\b|\\d+%)/.test(selector)) return true;\n  if (/^\\.(ant|sy-ant|anticon|adm)-/.test(selector)) return true;\n  return false;\n}\n\nfunction createAntdSelectorAlias(selector: string) {\n  const aliased = selector\n    .replace(/(^|[^A-Za-z0-9_-])\\.ant-/g, '$1.sy-ant-')\n    .replace(/(^|[^A-Za-z0-9_-])\\.anticon-/g, '$1.sy-anticon-')\n    .replace(/(^|[^A-Za-z0-9_-])\\.anticon(?=$|[^A-Za-z0-9_-])/g, '$1.sy-anticon');\n  return aliased === selector ? null : aliased;\n}\n\nexport function createOpenXiangdaNamespaceCssPlugin(\n  prefix = DEFAULT_NAMESPACE_PREFIX,\n) {\n  return {\n    postcssPlugin: 'openxiangda-namespace-css',\n    Rule(rule: { selector?: string; parent?: any }) {\n      if (!rule.selector) return;\n      let parent = rule.parent;\n      while (parent) {\n        if (parent.type === 'atrule' && /keyframes$/i.test(parent.name)) {\n          return;\n        }\n        parent = parent.parent;\n      }\n      rule.selector = Array.from(\n        new Set(\n          splitCssSelectors(rule.selector).flatMap((selector) => {\n            const scopedSelector = shouldSkipNamespace(selector, prefix)\n              ? selector\n              : `${prefix} ${selector}`;\n            const antdAlias = createAntdSelectorAlias(scopedSelector);\n            return antdAlias ? [scopedSelector, antdAlias] : [scopedSelector];\n          }),\n        ),\n      ).join(', ');\n    },\n  };\n}\n\n(createOpenXiangdaNamespaceCssPlugin as any).postcss = true;\n\nexport const createNamespaceCssPlugin = createOpenXiangdaNamespaceCssPlugin;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA6CO,SAAS,yBAAuD,QAAc;AACnF,SAAO;AACT;AAEA,IAAM,2BAA2B;AAEjC,SAAS,kBAAkB,UAAkB;AAC3C,QAAM,YAAsB,CAAC;AAC7B,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,MAAI,UAAU;AACd,aAAW,QAAQ,UAAU;AAC3B,QAAI,OAAO;AACT,iBAAW;AACX,UAAI,SAAS,MAAO,SAAQ;AAC5B;AAAA,IACF;AACA,QAAI,SAAS,OAAO,SAAS,KAAK;AAChC,cAAQ;AACR,iBAAW;AACX;AAAA,IACF;AACA,QAAI,SAAS,OAAO,SAAS,IAAK,UAAS;AAC3C,QAAI,SAAS,OAAO,SAAS,IAAK,UAAS;AAC3C,QAAI,SAAS,OAAO,UAAU,GAAG;AAC/B,gBAAU,KAAK,QAAQ,KAAK,CAAC;AAC7B,gBAAU;AACV;AAAA,IACF;AACA,eAAW;AAAA,EACb;AACA,MAAI,QAAQ,KAAK,EAAG,WAAU,KAAK,QAAQ,KAAK,CAAC;AACjD,SAAO;AACT;AAEA,SAAS,oBAAoB,UAAkB,QAAgB;AAC7D,MAAI,CAAC,YAAY,SAAS,SAAS,MAAM,EAAG,QAAO;AACnD,MAAI,gCAAgC,KAAK,QAAQ,EAAG,QAAO;AAC3D,MAAI,wBAAwB,KAAK,QAAQ,EAAG,QAAO;AACnD,MAAI,+BAA+B,KAAK,QAAQ,EAAG,QAAO;AAC1D,SAAO;AACT;AAEA,SAAS,wBAAwB,UAAkB;AACjD,QAAM,UAAU,SACb,QAAQ,6BAA6B,YAAY,EACjD,QAAQ,iCAAiC,gBAAgB,EACzD,QAAQ,oDAAoD,eAAe;AAC9E,SAAO,YAAY,WAAW,OAAO;AACvC;AAEO,SAAS,oCACd,SAAS,0BACT;AACA,SAAO;AAAA,IACL,eAAe;AAAA,IACf,KAAK,MAA2C;AAC9C,UAAI,CAAC,KAAK,SAAU;AACpB,UAAI,SAAS,KAAK;AAClB,aAAO,QAAQ;AACb,YAAI,OAAO,SAAS,YAAY,cAAc,KAAK,OAAO,IAAI,GAAG;AAC/D;AAAA,QACF;AACA,iBAAS,OAAO;AAAA,MAClB;AACA,WAAK,WAAW,MAAM;AAAA,QACpB,IAAI;AAAA,UACF,kBAAkB,KAAK,QAAQ,EAAE,QAAQ,CAAC,aAAa;AACrD,kBAAM,iBAAiB,oBAAoB,UAAU,MAAM,IACvD,WACA,GAAG,MAAM,IAAI,QAAQ;AACzB,kBAAM,YAAY,wBAAwB,cAAc;AACxD,mBAAO,YAAY,CAAC,gBAAgB,SAAS,IAAI,CAAC,cAAc;AAAA,UAClE,CAAC;AAAA,QACH;AAAA,MACF,EAAE,KAAK,IAAI;AAAA,IACb;AAAA,EACF;AACF;AAEC,oCAA4C,UAAU;AAEhD,IAAM,2BAA2B;","names":[]}

package/packages/sdk/dist/build/index.d.mts

@@ -41,6 +41,7 @@ interface AppWorkspaceConfig {
         sdd?: {
             enabled?: boolean;
             strictHighRisk?: boolean;
+            strictDocumentation?: boolean;
             path?: string;
         };
     };

package/packages/sdk/dist/build/index.d.ts

@@ -41,6 +41,7 @@ interface AppWorkspaceConfig {
         sdd?: {
             enabled?: boolean;
             strictHighRisk?: boolean;
+            strictDocumentation?: boolean;
             path?: string;
         };
     };

package/packages/sdk/dist/build/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/build/index.ts"],"sourcesContent":["export type CssIsolation = 'namespace' | 'shadow' | 'none';\nexport type WorkspaceRuntimeMode = 'legacy' | 'react-spa';\n\nexport interface AppWorkspaceConfig {\n  appType?: string;\n  appName?: string;\n  runtimeMode?: WorkspaceRuntimeMode;\n  platformUrl?: string;\n  servicePrefix?: string;\n  appKey?: string;\n  appSecret?: string;\n  userId?: string;\n  version?: string;\n  buildId?: string;\n  oss?: {\n    region?: string;\n    bucket?: string;\n    accessKeyId?: string;\n    accessKeySecret?: string;\n    pathPrefix?: string;\n    corsOrigins?: string[];\n    skipCors?: boolean;\n  };\n  defaults?: {\n    protocolVersion?: string;\n    frameworkVersion?: string;\n    cssIsolation?: CssIsolation;\n    formMenuParentId?: string;\n    formMenuIcon?: string;\n    pageMenuParentId?: string;\n    pageMenuIcon?: string;\n    formBuilderVersion?: string;\n  };\n  forms?: { dir?: string; publishLegacyBundle?: boolean };\n  pages?: { dir?: string };\n  governance?: {\n    sdd?: {\n      enabled?: boolean;\n      strictHighRisk?: boolean;\n      path?: string;\n    };\n  };\n}\n\nexport function defineAppWorkspaceConfig<T extends AppWorkspaceConfig>(config: T): T {\n  return config;\n}\n\nconst DEFAULT_NAMESPACE_PREFIX = '.sy-app-workspace';\n\nfunction splitCssSelectors(selector: string) {\n  const selectors: string[] = [];\n  let depth = 0;\n  let quote = '';\n  let current = '';\n  for (const char of selector) {\n    if (quote) {\n      current += char;\n      if (char === quote) quote = '';\n      continue;\n    }\n    if (char === '\"' || char === \"'\") {\n      quote = char;\n      current += char;\n      continue;\n    }\n    if (char === '(' || char === '[') depth += 1;\n    if (char === ')' || char === ']') depth -= 1;\n    if (char === ',' && depth === 0) {\n      selectors.push(current.trim());\n      current = '';\n      continue;\n    }\n    current += char;\n  }\n  if (current.trim()) selectors.push(current.trim());\n  return selectors;\n}\n\nfunction shouldSkipNamespace(selector: string, prefix: string) {\n  if (!selector || selector.includes(prefix)) return true;\n  if (/^(html|body|:root)(\\b|:|\\[|$)/.test(selector)) return true;\n  if (/^(@|from\\b|to\\b|\\d+%)/.test(selector)) return true;\n  if (/^\\.(ant|sy-ant|anticon|adm)-/.test(selector)) return true;\n  return false;\n}\n\nfunction createAntdSelectorAlias(selector: string) {\n  const aliased = selector\n    .replace(/(^|[^A-Za-z0-9_-])\\.ant-/g, '$1.sy-ant-')\n    .replace(/(^|[^A-Za-z0-9_-])\\.anticon-/g, '$1.sy-anticon-')\n    .replace(/(^|[^A-Za-z0-9_-])\\.anticon(?=$|[^A-Za-z0-9_-])/g, '$1.sy-anticon');\n  return aliased === selector ? null : aliased;\n}\n\nexport function createOpenXiangdaNamespaceCssPlugin(\n  prefix = DEFAULT_NAMESPACE_PREFIX,\n) {\n  return {\n    postcssPlugin: 'openxiangda-namespace-css',\n    Rule(rule: { selector?: string; parent?: any }) {\n      if (!rule.selector) return;\n      let parent = rule.parent;\n      while (parent) {\n        if (parent.type === 'atrule' && /keyframes$/i.test(parent.name)) {\n          return;\n        }\n        parent = parent.parent;\n      }\n      rule.selector = Array.from(\n        new Set(\n          splitCssSelectors(rule.selector).flatMap((selector) => {\n            const scopedSelector = shouldSkipNamespace(selector, prefix)\n              ? selector\n              : `${prefix} ${selector}`;\n            const antdAlias = createAntdSelectorAlias(scopedSelector);\n            return antdAlias ? [scopedSelector, antdAlias] : [scopedSelector];\n          }),\n        ),\n      ).join(', ');\n    },\n  };\n}\n\n(createOpenXiangdaNamespaceCssPlugin as any).postcss = true;\n\nexport const createNamespaceCssPlugin = createOpenXiangdaNamespaceCssPlugin;\n"],"mappings":";AA4CO,SAAS,yBAAuD,QAAc;AACnF,SAAO;AACT;AAEA,IAAM,2BAA2B;AAEjC,SAAS,kBAAkB,UAAkB;AAC3C,QAAM,YAAsB,CAAC;AAC7B,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,MAAI,UAAU;AACd,aAAW,QAAQ,UAAU;AAC3B,QAAI,OAAO;AACT,iBAAW;AACX,UAAI,SAAS,MAAO,SAAQ;AAC5B;AAAA,IACF;AACA,QAAI,SAAS,OAAO,SAAS,KAAK;AAChC,cAAQ;AACR,iBAAW;AACX;AAAA,IACF;AACA,QAAI,SAAS,OAAO,SAAS,IAAK,UAAS;AAC3C,QAAI,SAAS,OAAO,SAAS,IAAK,UAAS;AAC3C,QAAI,SAAS,OAAO,UAAU,GAAG;AAC/B,gBAAU,KAAK,QAAQ,KAAK,CAAC;AAC7B,gBAAU;AACV;AAAA,IACF;AACA,eAAW;AAAA,EACb;AACA,MAAI,QAAQ,KAAK,EAAG,WAAU,KAAK,QAAQ,KAAK,CAAC;AACjD,SAAO;AACT;AAEA,SAAS,oBAAoB,UAAkB,QAAgB;AAC7D,MAAI,CAAC,YAAY,SAAS,SAAS,MAAM,EAAG,QAAO;AACnD,MAAI,gCAAgC,KAAK,QAAQ,EAAG,QAAO;AAC3D,MAAI,wBAAwB,KAAK,QAAQ,EAAG,QAAO;AACnD,MAAI,+BAA+B,KAAK,QAAQ,EAAG,QAAO;AAC1D,SAAO;AACT;AAEA,SAAS,wBAAwB,UAAkB;AACjD,QAAM,UAAU,SACb,QAAQ,6BAA6B,YAAY,EACjD,QAAQ,iCAAiC,gBAAgB,EACzD,QAAQ,oDAAoD,eAAe;AAC9E,SAAO,YAAY,WAAW,OAAO;AACvC;AAEO,SAAS,oCACd,SAAS,0BACT;AACA,SAAO;AAAA,IACL,eAAe;AAAA,IACf,KAAK,MAA2C;AAC9C,UAAI,CAAC,KAAK,SAAU;AACpB,UAAI,SAAS,KAAK;AAClB,aAAO,QAAQ;AACb,YAAI,OAAO,SAAS,YAAY,cAAc,KAAK,OAAO,IAAI,GAAG;AAC/D;AAAA,QACF;AACA,iBAAS,OAAO;AAAA,MAClB;AACA,WAAK,WAAW,MAAM;AAAA,QACpB,IAAI;AAAA,UACF,kBAAkB,KAAK,QAAQ,EAAE,QAAQ,CAAC,aAAa;AACrD,kBAAM,iBAAiB,oBAAoB,UAAU,MAAM,IACvD,WACA,GAAG,MAAM,IAAI,QAAQ;AACzB,kBAAM,YAAY,wBAAwB,cAAc;AACxD,mBAAO,YAAY,CAAC,gBAAgB,SAAS,IAAI,CAAC,cAAc;AAAA,UAClE,CAAC;AAAA,QACH;AAAA,MACF,EAAE,KAAK,IAAI;AAAA,IACb;AAAA,EACF;AACF;AAEC,oCAA4C,UAAU;AAEhD,IAAM,2BAA2B;","names":[]}
+{"version":3,"sources":["../../src/build/index.ts"],"sourcesContent":["export type CssIsolation = 'namespace' | 'shadow' | 'none';\nexport type WorkspaceRuntimeMode = 'legacy' | 'react-spa';\n\nexport interface AppWorkspaceConfig {\n  appType?: string;\n  appName?: string;\n  runtimeMode?: WorkspaceRuntimeMode;\n  platformUrl?: string;\n  servicePrefix?: string;\n  appKey?: string;\n  appSecret?: string;\n  userId?: string;\n  version?: string;\n  buildId?: string;\n  oss?: {\n    region?: string;\n    bucket?: string;\n    accessKeyId?: string;\n    accessKeySecret?: string;\n    pathPrefix?: string;\n    corsOrigins?: string[];\n    skipCors?: boolean;\n  };\n  defaults?: {\n    protocolVersion?: string;\n    frameworkVersion?: string;\n    cssIsolation?: CssIsolation;\n    formMenuParentId?: string;\n    formMenuIcon?: string;\n    pageMenuParentId?: string;\n    pageMenuIcon?: string;\n    formBuilderVersion?: string;\n  };\n  forms?: { dir?: string; publishLegacyBundle?: boolean };\n  pages?: { dir?: string };\n  governance?: {\n    sdd?: {\n      enabled?: boolean;\n      strictHighRisk?: boolean;\n      strictDocumentation?: boolean;\n      path?: string;\n    };\n  };\n}\n\nexport function defineAppWorkspaceConfig<T extends AppWorkspaceConfig>(config: T): T {\n  return config;\n}\n\nconst DEFAULT_NAMESPACE_PREFIX = '.sy-app-workspace';\n\nfunction splitCssSelectors(selector: string) {\n  const selectors: string[] = [];\n  let depth = 0;\n  let quote = '';\n  let current = '';\n  for (const char of selector) {\n    if (quote) {\n      current += char;\n      if (char === quote) quote = '';\n      continue;\n    }\n    if (char === '\"' || char === \"'\") {\n      quote = char;\n      current += char;\n      continue;\n    }\n    if (char === '(' || char === '[') depth += 1;\n    if (char === ')' || char === ']') depth -= 1;\n    if (char === ',' && depth === 0) {\n      selectors.push(current.trim());\n      current = '';\n      continue;\n    }\n    current += char;\n  }\n  if (current.trim()) selectors.push(current.trim());\n  return selectors;\n}\n\nfunction shouldSkipNamespace(selector: string, prefix: string) {\n  if (!selector || selector.includes(prefix)) return true;\n  if (/^(html|body|:root)(\\b|:|\\[|$)/.test(selector)) return true;\n  if (/^(@|from\\b|to\\b|\\d+%)/.test(selector)) return true;\n  if (/^\\.(ant|sy-ant|anticon|adm)-/.test(selector)) return true;\n  return false;\n}\n\nfunction createAntdSelectorAlias(selector: string) {\n  const aliased = selector\n    .replace(/(^|[^A-Za-z0-9_-])\\.ant-/g, '$1.sy-ant-')\n    .replace(/(^|[^A-Za-z0-9_-])\\.anticon-/g, '$1.sy-anticon-')\n    .replace(/(^|[^A-Za-z0-9_-])\\.anticon(?=$|[^A-Za-z0-9_-])/g, '$1.sy-anticon');\n  return aliased === selector ? null : aliased;\n}\n\nexport function createOpenXiangdaNamespaceCssPlugin(\n  prefix = DEFAULT_NAMESPACE_PREFIX,\n) {\n  return {\n    postcssPlugin: 'openxiangda-namespace-css',\n    Rule(rule: { selector?: string; parent?: any }) {\n      if (!rule.selector) return;\n      let parent = rule.parent;\n      while (parent) {\n        if (parent.type === 'atrule' && /keyframes$/i.test(parent.name)) {\n          return;\n        }\n        parent = parent.parent;\n      }\n      rule.selector = Array.from(\n        new Set(\n          splitCssSelectors(rule.selector).flatMap((selector) => {\n            const scopedSelector = shouldSkipNamespace(selector, prefix)\n              ? selector\n              : `${prefix} ${selector}`;\n            const antdAlias = createAntdSelectorAlias(scopedSelector);\n            return antdAlias ? [scopedSelector, antdAlias] : [scopedSelector];\n          }),\n        ),\n      ).join(', ');\n    },\n  };\n}\n\n(createOpenXiangdaNamespaceCssPlugin as any).postcss = true;\n\nexport const createNamespaceCssPlugin = createOpenXiangdaNamespaceCssPlugin;\n"],"mappings":";AA6CO,SAAS,yBAAuD,QAAc;AACnF,SAAO;AACT;AAEA,IAAM,2BAA2B;AAEjC,SAAS,kBAAkB,UAAkB;AAC3C,QAAM,YAAsB,CAAC;AAC7B,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,MAAI,UAAU;AACd,aAAW,QAAQ,UAAU;AAC3B,QAAI,OAAO;AACT,iBAAW;AACX,UAAI,SAAS,MAAO,SAAQ;AAC5B;AAAA,IACF;AACA,QAAI,SAAS,OAAO,SAAS,KAAK;AAChC,cAAQ;AACR,iBAAW;AACX;AAAA,IACF;AACA,QAAI,SAAS,OAAO,SAAS,IAAK,UAAS;AAC3C,QAAI,SAAS,OAAO,SAAS,IAAK,UAAS;AAC3C,QAAI,SAAS,OAAO,UAAU,GAAG;AAC/B,gBAAU,KAAK,QAAQ,KAAK,CAAC;AAC7B,gBAAU;AACV;AAAA,IACF;AACA,eAAW;AAAA,EACb;AACA,MAAI,QAAQ,KAAK,EAAG,WAAU,KAAK,QAAQ,KAAK,CAAC;AACjD,SAAO;AACT;AAEA,SAAS,oBAAoB,UAAkB,QAAgB;AAC7D,MAAI,CAAC,YAAY,SAAS,SAAS,MAAM,EAAG,QAAO;AACnD,MAAI,gCAAgC,KAAK,QAAQ,EAAG,QAAO;AAC3D,MAAI,wBAAwB,KAAK,QAAQ,EAAG,QAAO;AACnD,MAAI,+BAA+B,KAAK,QAAQ,EAAG,QAAO;AAC1D,SAAO;AACT;AAEA,SAAS,wBAAwB,UAAkB;AACjD,QAAM,UAAU,SACb,QAAQ,6BAA6B,YAAY,EACjD,QAAQ,iCAAiC,gBAAgB,EACzD,QAAQ,oDAAoD,eAAe;AAC9E,SAAO,YAAY,WAAW,OAAO;AACvC;AAEO,SAAS,oCACd,SAAS,0BACT;AACA,SAAO;AAAA,IACL,eAAe;AAAA,IACf,KAAK,MAA2C;AAC9C,UAAI,CAAC,KAAK,SAAU;AACpB,UAAI,SAAS,KAAK;AAClB,aAAO,QAAQ;AACb,YAAI,OAAO,SAAS,YAAY,cAAc,KAAK,OAAO,IAAI,GAAG;AAC/D;AAAA,QACF;AACA,iBAAS,OAAO;AAAA,MAClB;AACA,WAAK,WAAW,MAAM;AAAA,QACpB,IAAI;AAAA,UACF,kBAAkB,KAAK,QAAQ,EAAE,QAAQ,CAAC,aAAa;AACrD,kBAAM,iBAAiB,oBAAoB,UAAU,MAAM,IACvD,WACA,GAAG,MAAM,IAAI,QAAQ;AACzB,kBAAM,YAAY,wBAAwB,cAAc;AACxD,mBAAO,YAAY,CAAC,gBAAgB,SAAS,IAAI,CAAC,cAAc;AAAA,UAClE,CAAC;AAAA,QACH;AAAA,MACF,EAAE,KAAK,IAAI;AAAA,IACb;AAAA,EACF;AACF;AAEC,oCAA4C,UAAU;AAEhD,IAAM,2BAA2B;","names":[]}