openxiangda 1.0.197 → 1.0.199

package/README.md

@@ -55,12 +55,20 @@ openxiangda environment attach --logical-app example-app --preproduction-target
 openxiangda environment status --json
 # 仅限投产前环境角色重分类：原子交换两个既有应用的角色，应用数据和 Release Head 不移动
 openxiangda environment swap --reason "投产前将现有业务应用调整为正式应用" --confirm-production --profile dev
+# 单独调整一个环境的副作用策略：先只读预览，再按当前 revision 审计式更新；不会交换环境角色
+openxiangda environment policy update preproduction \
+  --side-effect-policy-json '{"organizationWrites":"explicit_capability_only"}' \
+  --reason "为预发真实 UAT 开放受权限保护的组织写入" --dry-run --profile dev
+openxiangda environment policy update preproduction \
+  --side-effect-policy-json '{"organizationWrites":"explicit_capability_only"}' \
+  --reason "为预发真实 UAT 开放受权限保护的组织写入" --profile dev
 openxiangda studio
-# 环境托管应用日常发布：冻结候选 → 预发 → 测试证据 → 同候选晋级正式
-openxiangda release candidate --change mainline-release --environment preproduction
-openxiangda release deploy --candidate <candidate-id> --environment preproduction
-openxiangda release test --deployment <deployment-id> --environment preproduction --evidence-json ./test-evidence.json
-openxiangda release promote --candidate <candidate-id> --environment production --confirm-production
+# 环境托管应用日常发布：首次命令只部署预发并停止
+openxiangda release ship --change mainline-release --profile dev
+
+# 确认预发结果后，再以同一 candidate 晋级正式；验收备注可选
+openxiangda release ship --change mainline-release --profile dev \
+  --confirm-production
 openxiangda policy check
 openxiangda resource explain public-access --json
 openxiangda inspect app --profile dev --json
@@ -69,12 +77,16 @@ openxiangda app snapshot APP_XXXX --profile dev --json
 
 User tokens are stored in `~/.openxiangda/profiles.json` with `0600` permissions. Shared workspace environment values, including `APP_OSS_*`, can live in `~/.openxiangda/.env` and are inherited by new workspaces. Project `.env` files still work and override the global defaults. Project state is stored in `.openxiangda/state.json` and contains only profile-specific resource IDs; CLI writes use a workspace lock plus atomic merge/rename so concurrent processes do not truncate another profile's state.
 
-An environment-managed workspace keeps one logical application with independent `preproduction` and `production` targets. Each target owns its own `appType`, resource IDs, release heads, data, and side-effect policy; IDs must never be copied across targets. `release candidate` seals the clean authoritative Git revision, exact changed files, resource targets, SDD change, and test plan into an immutable candidate. `release deploy` can only deploy it to preproduction. `release test` attaches deployment-bound, hash-verified evidence. `release promote` can only promote that exact candidate to production after the platform verifies fresh passing preproduction evidence and zero candidate drift. Direct `release publish` is retained only for legacy, unmanaged workspaces and fails closed for either target of an environment-managed application.
+An environment-managed workspace keeps one logical application with independent `preproduction` and `production` targets. Each target owns its own `appType`, resource IDs, release heads, data, and side-effect policy; IDs must never be copied across targets. `release ship` is deliberately two-phase: the first invocation seals the clean authoritative Git revision and deploys one immutable candidate only to preproduction; it always stops at `awaiting_production_confirmation`. A later invocation includes `--confirm-production` and promotes that exact candidate to production without rebuilding it. Real human acceptance is the recommended default; an optional `--acceptance-note` records it in the deployment evidence, but the platform does not force every low-risk or emergency release through a rigid approval gate. It is impossible to prepare and promote in one invocation. The lower-level `candidate/deploy/test/promote` commands remain available for recovery and diagnostics. Direct `release publish` is retained only for legacy, unmanaged workspaces and fails closed for either target of an environment-managed application.
+
+Exact, non-destructive configuration selectors such as Data Views and permission groups are now sequenced automatically inside the same ship journal instead of requiring separate SDD changes. New forms are idempotently ensured per environment before their immutable FormRelease is staged. Unscoped resources and destructive configuration deletes remain fail-closed.
 
 Existing workspaces connect to a server-side environment set with `environment attach`. If the legacy `profiles.<profile>` binding has the same `appType` as one environment, its resource mappings are copied only into that matching target (normally preproduction). Production starts with an empty mapping, and later writes update only the selected target even when both targets reuse one login profile.
 
 `environment swap` is a commissioning/reclassification operation, not a release shortcut. It requires `--confirm-production` and a reason, atomically exchanges the two existing environment roles, preserves each application's data and Release Heads, and remaps local resource IDs by appType. Existing side-effect policies remain restricted unless explicit replacement policy JSON is supplied.
 
+Use `environment policy update <kind|id>` when only one environment's side-effect policy must change. The CLI reads the current revision and shows the exact before/after diff; `--dry-run` performs GET only. The write uses CAS, increments only that environment revision, writes a durable before/after audit, and preserves unspecified fields unless `--full-replace` is explicit. Production writes additionally require `--confirm-production`. `organizationWrites=explicit_capability_only` removes the environment-level deny but still requires `app:organization:manage`; there is no unrestricted bypass mode.
+
 `openxiangda studio` starts a loopback-only local Developer Center with a random session token. It shows target bindings, candidate/deployment status, Git state, test evidence, drift, and the next safe action. Its buttons invoke only registered OpenXiangda operations; it does not expose arbitrary shell execution. Production promotion and rollback still require an explicit production confirmation.
 
 `resource plan` and `resource publish --dry-run` run behind a strict GET/HEAD-only HTTP guard. If a read receives HTTP 401, the command fails with `READ_ONLY_AUTH_REQUIRED` and never calls the token refresh POST from inside the plan. Run `openxiangda auth refresh --profile <name>` (or log in again) before retrying; a plan must not mutate auth state or platform resources.

package/lib/application-environments.js

@@ -3,6 +3,20 @@ const fs = require('fs');
 const path = require('path');
 
 const ENVIRONMENT_KINDS = new Set(['preproduction', 'production']);
+const SIDE_EFFECT_POLICY_ENUMS = Object.freeze({
+  notifications: ['disabled', 'tester_allowlist', 'enabled', 'real'],
+  organizationWrites: ['deny', 'explicit_capability_only'],
+  scheduledAutomations: ['disabled', 'enabled'],
+  externalWrites: ['deny', 'allowlist', 'configured', 'sandbox'],
+  payments: ['deny', 'configured', 'sandbox'],
+  publicIndexing: ['deny', 'configured', 'enabled'],
+});
+const SIDE_EFFECT_POLICY_FIELDS = new Set([
+  ...Object.keys(SIDE_EFFECT_POLICY_ENUMS),
+  'notificationAllowlist',
+  'environmentBanner',
+  'externalDingTalkDepartmentRootId',
+]);
 
 function canonicalJson(value) {
   if (Array.isArray(value)) {
@@ -45,6 +59,114 @@ function cloneJsonValue(value) {
     : JSON.parse(JSON.stringify(value));
 }
 
+function normalizeSideEffectPolicyInput(value, label = 'sideEffectPolicy') {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error(`${label} 必须是对象`);
+  }
+  for (const key of Object.keys(value)) {
+    if (!SIDE_EFFECT_POLICY_FIELDS.has(key)) {
+      throw new Error(`${label}.${key} 不是允许的副作用策略字段`);
+    }
+  }
+  const result = {};
+  for (const [key, allowed] of Object.entries(SIDE_EFFECT_POLICY_ENUMS)) {
+    if (!Object.prototype.hasOwnProperty.call(value, key)) continue;
+    const normalized = String(value[key] || '').trim();
+    if (!allowed.includes(normalized)) {
+      throw new Error(`${label}.${key} 必须是 ${allowed.join('、')} 之一`);
+    }
+    result[key] = normalized;
+  }
+  if (Object.prototype.hasOwnProperty.call(value, 'notificationAllowlist')) {
+    if (!Array.isArray(value.notificationAllowlist)) {
+      throw new Error(`${label}.notificationAllowlist 必须是数组`);
+    }
+    if (value.notificationAllowlist.length > 500) {
+      throw new Error(`${label}.notificationAllowlist 最多包含 500 项`);
+    }
+    result.notificationAllowlist = Array.from(
+      new Set(
+        value.notificationAllowlist.map((item, index) => {
+          const normalized = String(item ?? '').trim();
+          if (!normalized || normalized.length > 255) {
+            throw new Error(
+              `${label}.notificationAllowlist[${index}] 必须是 1-255 字符的字符串`,
+            );
+          }
+          return normalized;
+        }),
+      ),
+    );
+  }
+  if (Object.prototype.hasOwnProperty.call(value, 'environmentBanner')) {
+    if (typeof value.environmentBanner !== 'boolean') {
+      throw new Error(`${label}.environmentBanner 必须是布尔值`);
+    }
+    result.environmentBanner = value.environmentBanner;
+  }
+  if (
+    Object.prototype.hasOwnProperty.call(
+      value,
+      'externalDingTalkDepartmentRootId',
+    )
+  ) {
+    const raw = value.externalDingTalkDepartmentRootId;
+    if (
+      !['string', 'number'].includes(typeof raw) ||
+      (typeof raw === 'number' && !Number.isSafeInteger(raw))
+    ) {
+      throw new Error(
+        `${label}.externalDingTalkDepartmentRootId 必须是字符串或安全整数`,
+      );
+    }
+    const normalized = String(raw).trim();
+    if (!/^\d{1,64}$/.test(normalized)) {
+      throw new Error(
+        `${label}.externalDingTalkDepartmentRootId 必须是数字型钉钉部门 ID`,
+      );
+    }
+    result.externalDingTalkDepartmentRootId = normalized;
+  }
+  return result;
+}
+
+function buildSideEffectPolicyDiff(beforeInput, updateInput, options = {}) {
+  const before = normalizeSideEffectPolicyInput(
+    beforeInput || {},
+    'currentSideEffectPolicy',
+  );
+  const update = normalizeSideEffectPolicyInput(
+    updateInput,
+    'sideEffectPolicy',
+  );
+  const fullReplace = options.fullReplace === true;
+  const after = normalizeSideEffectPolicyInput(
+    fullReplace ? update : { ...before, ...update },
+    'nextSideEffectPolicy',
+  );
+  const fields = Array.from(
+    new Set([...Object.keys(before), ...Object.keys(after)]),
+  ).sort();
+  const changes = fields
+    .filter(key => canonicalJson(before[key]) !== canonicalJson(after[key]))
+    .map(key => ({
+      field: key,
+      before: Object.prototype.hasOwnProperty.call(before, key)
+        ? cloneJsonValue(before[key])
+        : null,
+      after: Object.prototype.hasOwnProperty.call(after, key)
+        ? cloneJsonValue(after[key])
+        : null,
+    }));
+  return {
+    fullReplace,
+    changed: changes.length > 0,
+    before,
+    after,
+    changes,
+  };
+}
+
 function normalizeIdentityList(values) {
   return Array.from(
     new Set(
@@ -203,6 +325,10 @@ function bindEnvironmentTarget(state, input) {
       input.sideEffectPolicy === undefined
         ? previous.sideEffectPolicy || {}
         : input.sideEffectPolicy,
+    revision:
+      input.revision === undefined
+        ? previous.revision || null
+        : Number(input.revision),
     resources,
     updatedAt: new Date().toISOString(),
   };
@@ -359,6 +485,8 @@ function buildCandidateBundle(input) {
     targets: input.targets,
     files,
     testPlanHash: sha256Canonical(testPlan),
+    prepublishVerificationHash:
+      input.prepublishVerificationHash || null,
     openxiangdaVersion: input.openxiangdaVersion,
   };
   return {
@@ -447,12 +575,14 @@ function isRecoverablePostActivationDeploymentError(error, deployment) {
 
 module.exports = {
   bindEnvironmentTarget,
+  buildSideEffectPolicyDiff,
   buildCandidateBundle,
   canonicalJson,
   isRecoverablePostActivationDeploymentError,
   normalizeEnvironmentKind,
   normalizeManagedChangeSourceBase,
   normalizeManagedReleaseSourceRevision,
+  normalizeSideEffectPolicyInput,
   normalizeTargetName,
   hasStateResourceMappings,
   readCandidate,