openxiangda 1.0.231 → 1.0.232

package/lib/delivery-v2-package.js

@@ -0,0 +1,681 @@
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const { spawn } = require('child_process');
+
+const PACKAGE_SCHEMA_VERSION = 'openxiangda-app-package-v2';
+const COMPILER_VERSION = 'delivery-v2.0';
+const MAX_RUNTIME_BYTES = 25 * 1024 * 1024;
+
+const ROOT_SOURCE_FILES = new Set([
+  'app-workspace.config.ts',
+  'index.html',
+  'package.json',
+  'package-lock.json',
+  'pnpm-lock.yaml',
+  'yarn.lock',
+  'postcss.config.cjs',
+  'postcss.config.js',
+  'tailwind.config.cjs',
+  'tailwind.config.js',
+  'tsconfig.app.json',
+  'tsconfig.json',
+  'tsconfig.node.json',
+  'vite.config.js',
+  'vite.config.mjs',
+  'vite.config.ts',
+]);
+
+const IGNORED_SEGMENTS = new Set([
+  '.git',
+  '.openxiangda',
+  '.turbo',
+  'coverage',
+  'dist',
+  'node_modules',
+  'openspec',
+]);
+
+const LAYER_ORDER = [
+  'source',
+  'form',
+  'configuration',
+  'backend',
+  'workflow',
+  'runtime',
+];
+
+const CONFIG_RESOURCE_TYPES = Object.freeze({
+  'src/resources/roles/': 'role',
+  'src/resources/connectors/': 'connector',
+  'src/resources/notifications/': 'notification',
+  'src/resources/menus/': 'menu',
+  'src/resources/data-views/': 'data-view',
+  'src/resources/storage/': 'storage',
+  'src/resources/auth/': 'auth-config',
+  'src/resources/routes/': 'route',
+  'src/resources/public-access/': 'public-access',
+  'src/resources/permissions/page-groups/': 'page-permission-group',
+  'src/resources/permissions/form-groups/': 'form-permission-group',
+  'src/resources/permissions/scope-dimensions/': 'scope-dimension',
+  'src/resources/permissions/scope-grant-sources/': 'scope-grant-source',
+  'src/resources/permissions/data-scope-policies/': 'data-scope-policy',
+});
+
+function canonicalize(value) {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (value && typeof value === 'object') {
+    return Object.keys(value)
+      .sort()
+      .reduce((result, key) => {
+        if (value[key] !== undefined) result[key] = canonicalize(value[key]);
+        return result;
+      }, {});
+  }
+  if (typeof value === 'number' && !Number.isFinite(value)) {
+    return String(value);
+  }
+  return value;
+}
+
+function canonicalJson(value) {
+  return JSON.stringify(canonicalize(value));
+}
+
+function sha256(buffer) {
+  return crypto.createHash('sha256').update(buffer).digest('hex');
+}
+
+function sha256Canonical(value) {
+  return sha256(Buffer.from(canonicalJson(value)));
+}
+
+function normalizePath(value) {
+  return String(value || '').replace(/\\/g, '/').replace(/^\.\/+/, '');
+}
+
+function isSecretFile(relativePath) {
+  const normalized = normalizePath(relativePath);
+  const base = path.posix.basename(normalized);
+  if (base === '.env.example') return false;
+  return (
+    base === '.env' ||
+    base.startsWith('.env.') ||
+    /\.(pem|p12|pfx|key)$/i.test(base)
+  );
+}
+
+function shouldIncludeSourceFile(relativePath) {
+  const normalized = normalizePath(relativePath);
+  if (!normalized || isSecretFile(normalized)) return false;
+  const segments = normalized.split('/');
+  if (segments.some(segment => IGNORED_SEGMENTS.has(segment))) return false;
+  if (ROOT_SOURCE_FILES.has(normalized)) return true;
+  return (
+    normalized.startsWith('src/') ||
+    normalized.startsWith('public/') ||
+    normalized === 'scripts/build-js-code.mjs'
+  );
+}
+
+function walkFiles(rootDir, currentDir = rootDir, result = []) {
+  const entries = fs
+    .readdirSync(currentDir, { withFileTypes: true })
+    .sort((left, right) => left.name.localeCompare(right.name));
+  for (const entry of entries) {
+    const absolute = path.join(currentDir, entry.name);
+    const relative = normalizePath(path.relative(rootDir, absolute));
+    if (entry.isDirectory()) {
+      if (IGNORED_SEGMENTS.has(entry.name)) continue;
+      walkFiles(rootDir, absolute, result);
+      continue;
+    }
+    if (!entry.isFile() || !shouldIncludeSourceFile(relative)) continue;
+    result.push(relative);
+  }
+  return result;
+}
+
+function layerForSourceFile(relativePath) {
+  const file = normalizePath(relativePath);
+  if (
+    file.startsWith('src/forms/') ||
+    file.startsWith('src/resources/forms/')
+  ) {
+    return 'form';
+  }
+  if (
+    file.startsWith('src/functions/') ||
+    file.startsWith('src/automations/') ||
+    file.startsWith('src/js-code-nodes/') ||
+    file.startsWith('src/resources/functions/') ||
+    file.startsWith('src/resources/automations/')
+  ) {
+    return 'backend';
+  }
+  if (
+    file.startsWith('src/workflows/') ||
+    file.startsWith('src/resources/workflows/')
+  ) {
+    return 'workflow';
+  }
+  if (file.startsWith('src/resources/')) return 'configuration';
+  return 'runtime';
+}
+
+function artifactFromBuffer(kind, buffer, metadata = {}) {
+  return {
+    digest: sha256(buffer),
+    kind,
+    contentType: metadata.contentType || 'application/octet-stream',
+    size: buffer.length,
+    buffer,
+    metadata: {
+      ...metadata,
+      contentType: undefined,
+    },
+  };
+}
+
+function fileDescriptor(artifact, relativePath) {
+  return {
+    path: normalizePath(relativePath),
+    digest: artifact.digest,
+    size: artifact.size,
+    contentType: artifact.contentType,
+  };
+}
+
+function sourceArtifacts(workspaceRoot) {
+  return walkFiles(workspaceRoot).map(relativePath => {
+    const buffer = fs.readFileSync(path.join(workspaceRoot, relativePath));
+    const artifact = artifactFromBuffer('source', buffer, {
+      path: relativePath,
+      contentType: inferContentType(relativePath),
+    });
+    return {
+      relativePath,
+      category: layerForSourceFile(relativePath),
+      artifact,
+      descriptor: fileDescriptor(artifact, relativePath),
+    };
+  });
+}
+
+function sourceHashForCategory(files, category) {
+  return sha256Canonical(
+    files
+      .filter(file => category === 'source' || file.category === category)
+      .map(file => ({
+        path: file.relativePath,
+        digest: file.artifact.digest,
+        size: file.artifact.size,
+      }))
+  );
+}
+
+function discoverResourceInventory(workspaceRoot, files) {
+  const inventory = {
+    forms: new Set(),
+    functions: new Set(),
+    automations: new Set(),
+    workflows: new Set(),
+    configuration: new Map(),
+  };
+  const addConfiguration = (type, code) => {
+    if (!type || !code) return;
+    if (!inventory.configuration.has(type)) {
+      inventory.configuration.set(type, new Set());
+    }
+    inventory.configuration.get(type).add(code);
+  };
+  for (const file of files) {
+    const relative = file.relativePath;
+    for (const [prefix, bucket] of [
+      ['src/forms/', inventory.forms],
+      ['src/functions/', inventory.functions],
+      ['src/automations/', inventory.automations],
+      ['src/workflows/', inventory.workflows],
+    ]) {
+      if (relative.startsWith(prefix)) {
+        const code = relative.slice(prefix.length).split('/')[0];
+        if (code && !code.startsWith('.')) bucket.add(code);
+      }
+    }
+    if (!relative.endsWith('.json')) continue;
+    const absolute = path.join(workspaceRoot, relative);
+    let value;
+    try {
+      value = JSON.parse(fs.readFileSync(absolute, 'utf8'));
+    } catch {
+      continue;
+    }
+    const codes = collectManifestCodes(value);
+    if (relative.startsWith('src/resources/forms/')) {
+      for (const code of codes) inventory.forms.add(code);
+      continue;
+    }
+    if (relative.startsWith('src/resources/functions/')) {
+      for (const code of codes) inventory.functions.add(code);
+      continue;
+    }
+    if (relative.startsWith('src/resources/automations/')) {
+      for (const code of codes) inventory.automations.add(code);
+      continue;
+    }
+    if (relative.startsWith('src/resources/workflows/')) {
+      for (const code of codes) inventory.workflows.add(code);
+      continue;
+    }
+    const matched = Object.entries(CONFIG_RESOURCE_TYPES).find(([prefix]) =>
+      relative.startsWith(prefix)
+    );
+    if (matched) {
+      for (const code of codes) addConfiguration(matched[1], code);
+    }
+  }
+  return {
+    forms: [...inventory.forms].sort(),
+    functions: [...inventory.functions].sort(),
+    automations: [...inventory.automations].sort(),
+    workflows: [...inventory.workflows].sort(),
+    configuration: Object.fromEntries(
+      [...inventory.configuration.entries()]
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([type, codes]) => [type, [...codes].sort()])
+    ),
+  };
+}
+
+function collectManifestCodes(value, result = new Set()) {
+  if (Array.isArray(value)) {
+    for (const item of value) collectManifestCodes(item, result);
+    return [...result];
+  }
+  if (!value || typeof value !== 'object') return [...result];
+  const code = String(
+    value.code ||
+      value.resourceCode ||
+      value.formCode ||
+      value.notificationType ||
+      ''
+  ).trim();
+  if (code) result.add(code);
+  for (const [key, child] of Object.entries(value)) {
+    if (
+      [
+        'definitionJson',
+        'schema',
+        'components',
+        'configJson',
+        'settings',
+        'grants',
+      ].includes(key)
+    ) {
+      continue;
+    }
+    if (Array.isArray(child)) collectManifestCodes(child, result);
+  }
+  return [...result];
+}
+
+function buildAuthoredLayer(kind, files, previousLayer) {
+  const selected =
+    kind === 'source'
+      ? files
+      : files.filter(file => file.category === kind);
+  if (selected.length === 0 && kind !== 'source') return null;
+  const sourceHash = sourceHashForCategory(files, kind);
+  if (
+    previousLayer &&
+    previousLayer.sourceHash === sourceHash &&
+    previousLayer.digest
+  ) {
+    return {
+      descriptor: previousLayer,
+      artifacts: [],
+      reused: true,
+    };
+  }
+  const manifest = {
+    schemaVersion: 'openxiangda-app-layer-v2',
+    kind,
+    sourceHash,
+    files: selected.map(file => file.descriptor),
+  };
+  const manifestBuffer = Buffer.from(canonicalJson(manifest));
+  const layerArtifact = artifactFromBuffer(kind, manifestBuffer, {
+    layer: kind,
+    contentType: 'application/json',
+  });
+  return {
+    descriptor: {
+      kind,
+      digest: layerArtifact.digest,
+      sourceHash,
+      fileCount: selected.length,
+      size: selected.reduce((sum, file) => sum + file.artifact.size, 0),
+      files: manifest.files,
+    },
+    artifacts: [
+      ...selected.map(file => file.artifact),
+      layerArtifact,
+    ],
+    reused: false,
+  };
+}
+
+async function buildRuntimeLayer(options, files, previousLayer) {
+  const sourceHash = sourceHashForCategory(files, 'runtime');
+  if (
+    previousLayer &&
+    previousLayer.sourceHash === sourceHash &&
+    previousLayer.digest
+  ) {
+    return {
+      descriptor: previousLayer,
+      artifacts: [],
+      reused: true,
+      built: false,
+    };
+  }
+  if (!options.skipBuild) {
+    await runBuild({
+      workspaceRoot: options.workspaceRoot,
+      command: options.buildCommand || 'npm run build',
+      env: {
+        OPENXIANGDA_APP_TYPE: '__OPENXIANGDA_APP_TYPE__',
+        APP_TYPE: '__OPENXIANGDA_APP_TYPE__',
+        OPENXIANGDA_BUILD_ID: `pkg-${sourceHash.slice(0, 20)}`,
+        OPENXIANGDA_RUNTIME_ASSET_BASE: './',
+      },
+      onOutput: options.onBuildOutput,
+    });
+  }
+  const distDir = path.resolve(
+    options.workspaceRoot,
+    options.distDir || 'dist'
+  );
+  const runtimeFiles = collectRuntimeFiles(distDir);
+  const runtimeArtifacts = runtimeFiles.map(file =>
+    artifactFromBuffer('runtime', file.buffer, {
+      path: file.path,
+      contentType: file.contentType,
+    })
+  );
+  const descriptors = runtimeArtifacts.map((artifact, index) =>
+    fileDescriptor(artifact, runtimeFiles[index].path)
+  );
+  const manifest = {
+    schemaVersion: 'openxiangda-app-layer-v2',
+    kind: 'runtime',
+    sourceHash,
+    assetBaseMode: 'relative',
+    files: descriptors,
+  };
+  const layerArtifact = artifactFromBuffer(
+    'runtime',
+    Buffer.from(canonicalJson(manifest)),
+    {
+      layer: 'runtime',
+      contentType: 'application/json',
+    }
+  );
+  return {
+    descriptor: {
+      kind: 'runtime',
+      digest: layerArtifact.digest,
+      sourceHash,
+      assetBaseMode: 'relative',
+      fileCount: descriptors.length,
+      size: runtimeArtifacts.reduce((sum, artifact) => sum + artifact.size, 0),
+      files: descriptors,
+    },
+    artifacts: [...runtimeArtifacts, layerArtifact],
+    reused: false,
+    built: !options.skipBuild,
+  };
+}
+
+async function compileAppPackage(options = {}) {
+  const workspaceRoot = path.resolve(options.workspaceRoot || process.cwd());
+  const configFile = path.join(workspaceRoot, 'app-workspace.config.ts');
+  if (!fs.existsSync(configFile)) {
+    throw createCompilerError(
+      'DELIVERY_WORKSPACE_CONFIG_MISSING',
+      `未发现 ${configFile}`
+    );
+  }
+  const configText = fs.readFileSync(configFile, 'utf8');
+  if (!/deliveryVersion\s*:\s*2\b/.test(configText)) {
+    throw createCompilerError(
+      'DELIVERY_V2_NOT_ENABLED',
+      'app-workspace.config.ts 必须显式声明 deliveryVersion: 2'
+    );
+  }
+  const runtimeEnabled =
+    /runtimeMode\s*:\s*['"]react-spa['"]/.test(configText);
+  const files = sourceArtifacts(workspaceRoot);
+  const previousManifest = options.previousManifest || null;
+  const previousLayers = new Map(
+    (previousManifest?.layers || []).map(layer => [layer.kind, layer])
+  );
+  const artifacts = [];
+  const layerResults = [];
+  const resources = discoverResourceInventory(workspaceRoot, files);
+
+  for (const kind of ['source', 'form', 'configuration', 'backend', 'workflow']) {
+    const result = buildAuthoredLayer(
+      kind,
+      files,
+      previousLayers.get(kind)
+    );
+    if (!result) continue;
+    artifacts.push(...result.artifacts);
+    layerResults.push(result);
+  }
+  if (runtimeEnabled) {
+    const runtimeResult = await buildRuntimeLayer(
+      { ...options, workspaceRoot },
+      files,
+      previousLayers.get('runtime')
+    );
+    artifacts.push(...runtimeResult.artifacts);
+    layerResults.push(runtimeResult);
+  }
+
+  const layers = LAYER_ORDER.map(kind =>
+    layerResults.find(result => result.descriptor.kind === kind)
+  )
+    .filter(Boolean)
+    .map(result => result.descriptor);
+  const packageManifest = {
+    schemaVersion: PACKAGE_SCHEMA_VERSION,
+    compilerVersion: COMPILER_VERSION,
+    mode: 'trusted-developer',
+    runtimeMode: runtimeEnabled ? 'react-spa' : 'legacy',
+    resources,
+    layers,
+  };
+  const packageBuffer = Buffer.from(canonicalJson(packageManifest));
+  const packageArtifact = artifactFromBuffer(
+    'package-manifest',
+    packageBuffer,
+    {
+      contentType: 'application/json',
+      schemaVersion: PACKAGE_SCHEMA_VERSION,
+    }
+  );
+  artifacts.push(packageArtifact);
+
+  return {
+    workspaceRoot,
+    packageDigest: packageArtifact.digest,
+    packageManifest,
+    artifacts: deduplicateArtifacts(artifacts),
+    summary: {
+      sourceFileCount: files.length,
+      artifactUploadCount: deduplicateArtifacts(artifacts).length,
+      layers: layerResults.map(result => ({
+        kind: result.descriptor.kind,
+        digest: result.descriptor.digest,
+        sourceHash: result.descriptor.sourceHash,
+        reused: result.reused,
+        built: Boolean(result.built),
+        fileCount: result.descriptor.fileCount,
+        size: result.descriptor.size,
+      })),
+    },
+  };
+}
+
+function deduplicateArtifacts(artifacts) {
+  const byDigest = new Map();
+  for (const artifact of artifacts) {
+    if (!byDigest.has(artifact.digest)) byDigest.set(artifact.digest, artifact);
+  }
+  return [...byDigest.values()];
+}
+
+function collectRuntimeFiles(distDir) {
+  if (!fs.existsSync(distDir) || !fs.statSync(distDir).isDirectory()) {
+    throw createCompilerError(
+      'DELIVERY_RUNTIME_DIST_MISSING',
+      `Runtime dist 目录不存在: ${distDir}`
+    );
+  }
+  const files = [];
+  const visit = currentDir => {
+    const entries = fs
+      .readdirSync(currentDir, { withFileTypes: true })
+      .sort((left, right) => left.name.localeCompare(right.name));
+    for (const entry of entries) {
+      const absolute = path.join(currentDir, entry.name);
+      if (entry.isDirectory()) {
+        visit(absolute);
+        continue;
+      }
+      if (!entry.isFile() || entry.name.endsWith('.map')) continue;
+      const relative = normalizePath(path.relative(distDir, absolute));
+      const buffer = fs.readFileSync(absolute);
+      files.push({
+        path: relative,
+        buffer,
+        contentType: inferContentType(relative),
+      });
+    }
+  };
+  visit(distDir);
+  if (!files.some(file => file.path === 'index.html')) {
+    throw createCompilerError(
+      'DELIVERY_RUNTIME_INDEX_MISSING',
+      `Runtime dist 缺少 index.html: ${distDir}`
+    );
+  }
+  const totalBytes = files.reduce((sum, file) => sum + file.buffer.length, 0);
+  if (totalBytes > MAX_RUNTIME_BYTES) {
+    throw createCompilerError(
+      'DELIVERY_RUNTIME_TOO_LARGE',
+      `Runtime dist 超过 ${MAX_RUNTIME_BYTES} bytes`
+    );
+  }
+  return files;
+}
+
+async function runBuild(options) {
+  await new Promise((resolve, reject) => {
+    let child;
+    try {
+      child = spawn(options.command, [], {
+        cwd: options.workspaceRoot,
+        shell: true,
+        stdio: options.onOutput ? ['ignore', 'pipe', 'pipe'] : 'inherit',
+        env: {
+          ...process.env,
+          ...options.env,
+        },
+      });
+    } catch (error) {
+      reject(
+        createCompilerError(
+          'DELIVERY_RUNTIME_BUILD_START_FAILED',
+          error?.message || String(error)
+        )
+      );
+      return;
+    }
+    if (options.onOutput) {
+      child.stdout?.on('data', chunk =>
+        options.onOutput('stdout', String(chunk))
+      );
+      child.stderr?.on('data', chunk =>
+        options.onOutput('stderr', String(chunk))
+      );
+    }
+    child.once('error', error => {
+      reject(
+        createCompilerError(
+          'DELIVERY_RUNTIME_BUILD_START_FAILED',
+          error.message
+        )
+      );
+    });
+    child.once('close', (code, signal) => {
+      if (code === 0) {
+        resolve();
+        return;
+      }
+      reject(
+        createCompilerError(
+          'DELIVERY_RUNTIME_BUILD_FAILED',
+          Number.isInteger(code)
+            ? `exit ${code}`
+            : `signal ${signal || 'unknown'}`
+        )
+      );
+    });
+  });
+}
+
+function inferContentType(file) {
+  const extension = path.extname(file).toLowerCase();
+  return (
+    {
+      '.css': 'text/css; charset=utf-8',
+      '.html': 'text/html; charset=utf-8',
+      '.ico': 'image/x-icon',
+      '.jpeg': 'image/jpeg',
+      '.jpg': 'image/jpeg',
+      '.js': 'text/javascript; charset=utf-8',
+      '.json': 'application/json',
+      '.mjs': 'text/javascript; charset=utf-8',
+      '.png': 'image/png',
+      '.svg': 'image/svg+xml',
+      '.ts': 'text/plain; charset=utf-8',
+      '.tsx': 'text/plain; charset=utf-8',
+      '.txt': 'text/plain; charset=utf-8',
+      '.webp': 'image/webp',
+      '.woff': 'font/woff',
+      '.woff2': 'font/woff2',
+    }[extension] || 'application/octet-stream'
+  );
+}
+
+function createCompilerError(code, message) {
+  const error = new Error(`${code}: ${message}`);
+  error.code = code;
+  error.retryable = false;
+  return error;
+}
+
+module.exports = {
+  COMPILER_VERSION,
+  PACKAGE_SCHEMA_VERSION,
+  canonicalJson,
+  compileAppPackage,
+  discoverResourceInventory,
+  layerForSourceFile,
+  sha256,
+  sha256Canonical,
+  shouldIncludeSourceFile,
+};

package/lib/policy.js

@@ -95,6 +95,10 @@ function renderEngineeringPolicyMarkdown(policy = loadEngineeringPolicy()) {
     '',
     `- 风险按 ${policy.risk.classifyBy.join('、')} 分级；目录只作信号。`,
     '- SDD verify 只读；Markdown 是按需派生视图。',
+    `- Delivery V${policy.release.normalDeliveryVersion} 是正常发布入口：${policy.release.normalCommands.join(
+      ' / '
+    )}；生产只消费预发验证过的封存包，ReleaseRun 与检查点由平台持久化。`,
+    '- Delivery V2 信任平台开发者，不要求 SDD、Git 主线、`--change` 或 `--only`；下列 V1 规则只保留兼容性。',
     '- 平台仓库直接开发权威 master；应用任务可用独立 worktree，但只从干净、已推送的权威主线发布。',
     '- 应用任务在主线发布和 release end 后从 canonical 主工作区执行 workspace cleanup；只删除已合并、干净、无 owner 和发布私有状态的 SAFE worktree/本地分支。',
     '- 环境托管应用冻结不可变 candidate，先部署预发并提交有效测试证据，再将同一 candidate 晋级生产；禁止生产直发。',

package/lib/workspace-bootstrap.js

@@ -18,6 +18,7 @@ const TEMPLATE_DIR = LEGACY_TEMPLATE_DIR;
 // 这些路径相对于 workspace 根；源模板必须与现有 workspace runtime 匹配。
 const BOOTSTRAP_FILES = [
   'AGENTS.md',
+  'DELIVERY.md',
   'scripts/guard-publish.mjs',
   '.qoder/rules/openxiangda.md',
   '.qoder/rules/openxiangda-form.md',