openxiangda 1.0.270 → 1.0.271

package/lib/release-plan.js

@@ -170,10 +170,14 @@ function commandFromArgs(args) {
 }
 
 function createStep(id, args, options = {}) {
+  const env = options.env && Object.keys(options.env).length > 0
+    ? { env: { ...options.env } }
+    : {};
   return {
     id,
     args,
     command: commandFromArgs(args),
+    ...env,
     writes: options.writes !== false,
     stagedKind: options.stagedKind || null,
     resumeMode: options.resumeMode || 'skip',
@@ -329,8 +333,7 @@ function buildWorkspaceReleaseSteps(
     targets.resourceSelectors?.formPermissionGroups || []
   );
   const stagesFormRelease =
-    runtimeMode === 'react-spa' &&
-    (targets.forms.length > 0 || formPermissionGroups.length > 0);
+    targets.forms.length > 0 || formPermissionGroups.length > 0;
   const deferredDataViewCodes = stagesFormRelease
     ? uniqueSorted(targets.resourceSelectors?.dataViews || [])
     : [];
@@ -347,58 +350,59 @@ function buildWorkspaceReleaseSteps(
         excludeTypes: stagesFormRelease ? ['formPermissionGroups'] : [],
       }
     );
-  if (runtimeMode === 'react-spa') {
-    const ensuredForms = uniqueSorted([
-      ...targets.forms,
-      ...targets.formDependencies,
-    ]);
-    if (ensuredForms.length > 0) {
-      steps.push(
-        createStep(
-          'form-ensure',
-          appendProfileAndChange(
-            ['form', 'ensure', '--only', ensuredForms.join(',')],
-            profileArg,
-            changeId
-          ),
-          { resumeMode: 'replay-local' }
-        )
-      );
-    }
-    if (stagesFormRelease) {
-      const resourceTypes = [
-        ...(targets.forms.length > 0 ? ['form-setting'] : []),
-        ...(formPermissionGroups.length > 0
-          ? ['form-permission-group']
-          : []),
-      ];
-      const qualify = resourceTypes.length > 1;
-      const selectors = [
-        ...targets.forms.map(code =>
-          qualify ? `form-setting:${code}` : code
+  const ensuredForms = uniqueSorted([
+    ...targets.forms,
+    ...targets.formDependencies,
+  ]);
+  if (ensuredForms.length > 0) {
+    steps.push(
+      createStep(
+        'form-ensure',
+        appendProfileAndChange(
+          ['form', 'ensure', '--only', ensuredForms.join(',')],
+          profileArg,
+          changeId
         ),
-        ...formPermissionGroups.map(code =>
-          qualify ? `form-permission-group:${code}` : code
+        { resumeMode: 'replay-local' }
+      )
+    );
+  }
+  if (stagesFormRelease) {
+    const resourceTypes = [
+      ...(targets.forms.length > 0 ? ['form-setting'] : []),
+      ...(formPermissionGroups.length > 0
+        ? ['form-permission-group']
+        : []),
+    ];
+    const qualify = resourceTypes.length > 1;
+    const selectors = [
+      ...targets.forms.map(code =>
+        qualify ? `form-setting:${code}` : code
+      ),
+      ...formPermissionGroups.map(code =>
+        qualify ? `form-permission-group:${code}` : code
+      ),
+    ];
+    steps.push(
+      createStep(
+        'form-stage',
+        appendProfileAndChange(
+          [
+            'resource',
+            'publish',
+            resourceTypes.join(','),
+            '--only',
+            selectors.join(','),
+          ],
+          profileArg,
+          changeId
         ),
-      ];
-      steps.push(
-        createStep(
-          'form-stage',
-          appendProfileAndChange(
-            [
-              'resource',
-              'publish',
-              resourceTypes.join(','),
-              '--only',
-              selectors.join(','),
-            ],
-            profileArg,
-            changeId
-          ),
-          { stagedKind: 'FormRelease' }
-        )
-      );
-    }
+        { stagedKind: 'FormRelease' }
+      )
+    );
+  }
+
+  if (runtimeMode === 'react-spa') {
     steps.push(...directConfigurationSteps);
     if (hasResourceTargets) {
       steps.push(
@@ -466,10 +470,13 @@ function buildWorkspaceReleaseSteps(
     return steps;
   }
 
-  const onlyTargets = [
-    ...targets.forms.map(code => `forms/${code}`),
-    ...targets.pages.map(code => `pages/${code}`),
-  ];
+  if (hasResourceTargets) {
+    steps.push(...directConfigurationSteps);
+    steps.push(
+      ...buildTargetedResourceReleaseSteps(targets, profileArg, changeId)
+    );
+  }
+  const onlyTargets = targets.pages.map(code => `pages/${code}`);
   if (onlyTargets.length > 0) {
     steps.push(
       createStep(
@@ -484,17 +491,17 @@ function buildWorkspaceReleaseSteps(
           ],
           profileArg,
           changeId
-        )
+        ),
+        {
+          stagedKind: 'PageRelease',
+          env: { OPENXIANGDA_PAGE_STAGE_ONLY: '1' },
+        }
       )
     );
   }
-  if (hasResourceTargets) {
-    steps.push(...directConfigurationSteps);
-    steps.push(
-      ...buildTargetedResourceReleaseSteps(targets, profileArg, changeId)
-    );
-  }
   if (
+    stagesFormRelease ||
+    targets.pages.length > 0 ||
     targets.functions.length > 0 ||
     targets.automations.length > 0 ||
     targets.workflows.length > 0
@@ -508,6 +515,12 @@ function buildWorkspaceReleaseSteps(
             'app-finalize',
             '--staged-resources-json',
             `.openxiangda/releases/${changeId || 'change'}/staged-resources.json`,
+            ...(deferredDataViewCodes.length > 0
+              ? [
+                  '--finalize-data-views',
+                  deferredDataViewCodes.join(','),
+                ]
+              : []),
             '--wait',
           ],
           profileArg,

package/openxiangda-skills/SKILL.md

@@ -167,7 +167,7 @@ When the sealed Runtime source intentionally does not descend from the active Ru
 
 `resource plan` and publish dry-runs are strictly GET/HEAD-only. `READ_ONLY_AUTH_REQUIRED` means the access token expired; run `openxiangda auth refresh --profile <name>` or log in again before retrying. Never add an automatic refresh POST inside a plan.
 
-`release publish` is the default promotion entrypoint only for legacy unmanaged workspaces. It verifies without rewriting reviewed `change.json`/`release.json`, waits for the app lease, freezes the App capture after ownership is acquired, executes deterministic exact staged steps, resumes from `.openxiangda/releases/<change>/execution.json`, atomically finalizes, verifies mainline integration, and releases the lease. When the same audited historical-lineage condition applies, legacy `release publish` accepts `--adopt-online-baseline --adoption-reason "..."` and forwards the pair only to exact `resource publish --only/--code` stages; missing reasons or plans without an exact resource stage fail before lease acquisition. Environment-managed applications use the two-phase `release ship`; candidate/deploy/test/fail/promote, `release begin`, and child commands remain recovery/diagnostic primitives.
+`release publish` is the default promotion entrypoint only for legacy unmanaged workspaces. It verifies without rewriting reviewed `change.json`/`release.json`, waits for the app lease, freezes the App capture after ownership is acquired, executes deterministic exact staged steps, resumes from `.openxiangda/releases/<change>/execution.json`, atomically finalizes, verifies mainline integration, and releases the lease. Legacy Page steps receive `OPENXIANGDA_PAGE_STAGE_ONLY=1`; the step environment and staged kind are hashed and journaled, and missing PageRelease evidence blocks Root finalize. Custom page publishers must honor that environment and call the current package CLI so `page publish` records the staged child. When the same audited historical-lineage condition applies, legacy `release publish` accepts `--adopt-online-baseline --adoption-reason "..."` and forwards the pair only to exact `resource publish --only/--code` stages. An intentional manifest replacement may add `--replace-manifest --reason "..."`; the inseparable pair reaches only the unique exact Backend stage. Missing reasons or compatible exact scopes fail before lease acquisition. Environment-managed applications use the two-phase `release ship`; candidate/deploy/test/fail/promote, `release begin`, and child commands remain recovery/diagnostic primitives.
 
 Reviewed bundle commands may retain `<profile>` as a template. The explicit real `release publish --profile <name>` value is bound to actual child argv without rewriting tracked SDD. React SPA page codes are logical coverage targets and activate through one Runtime child; they do not require PageRelease. `release app-head` and `runtime releases` are compact by default; use `--full` only when the complete manifest is required.
 

package/openxiangda-skills/references/notifications.md

@@ -1,8 +1,8 @@
 # Notification Resources
 
-Use notification resources when a page, workflow, or automation needs reusable message templates.
+Use notification resources when an App Function, workflow, or automation needs reusable message templates.
 
-AI generation rule: declare notification resources first, then call `sdk.notification` in code pages or `ctx.notification` in JS_CODE. Do not hardcode `/api/notification-config/*` or store channel credentials in source.
+AI generation rule: declare notification resources first, then send only from trusted runtime code through `ctx.notification`. Code pages call a named App Function with a business identifier through `sdk.function.invoke`; they never choose effective recipients, rendered content, or channels. Do not hardcode `/api/notification-config/*` or store channel credentials in source.
 
 ## Resource Files
 
@@ -135,21 +135,35 @@ Standard card payload variables include `title`, `lastMessage`, `content`, `cont
 
 ## Runtime Calls
 
-Code pages:
+Code pages invoke a named business action. Pass business identifiers, not an
+effective recipient, rendered message, or channel list:
 
 ```ts
-await sdk.notification.sendByType({
-  notificationType: "reservation_reminder",
-  recipientId: userId,
-  payload: {
-    title: "预约提醒",
-    instrumentName,
-    startTime,
-  },
+await sdk.function.invoke("send_reservation_reminder", {
+  input: { reservationId },
 });
 ```
 
-DingTalk-specific helpers are available when the caller wants to inspect or force the DingTalk channel:
+The App Function checks the operator and current reservation state, resolves the
+recipient and template variables from authoritative data, then sends through the
+trusted runtime bridge:
+
+```ts
+export default async function sendReservationReminder(ctx) {
+  const reservation = await loadAuthorizedReservation(ctx.input.reservationId, ctx);
+  await ctx.notification.sendByType({
+    notificationType: "reservation_reminder",
+    recipientId: reservation.ownerUserId,
+    payload: {
+      title: "预约提醒",
+      instrumentName: reservation.instrumentName,
+      startTime: reservation.startTime,
+    },
+  });
+}
+```
+
+DingTalk-specific read and preview helpers remain available to pages:
 
 ```ts
 const capabilities = await sdk.notification.capabilities();
@@ -161,13 +175,6 @@ const preview = await sdk.notification.previewDingTalk({
   },
 });
 
-await sdk.notification.sendDingTalk({
-  notificationType: "reservation_reminder",
-  recipientId: userId,
-  payload: {
-    title: "预约提醒",
-  },
-});
 ```
 
 User-facing in-app message centers should read the platform inbox instead of
@@ -198,12 +205,10 @@ openxiangda notification preview reservation_reminder --body-json '{"payload":{"
 openxiangda notification capabilities --json
 openxiangda notification dingding-preview reservation_reminder --body-json '{"payload":{"title":"测试"}}'
 openxiangda notification dingding-preview --template-code reservation_reminder --body-json '{"payload":{"title":"测试"}}'
-openxiangda notification dingding-send reservation_reminder --body-json '{"recipientId":"USER_ID","payload":{"title":"测试"}}' --force
-openxiangda notification send reservation_reminder --body-json '{"recipientId":"USER_ID","payload":{"title":"测试"}}' --force
-openxiangda notification batch-send reservation_reminder --body-json '{"recipients":[{"recipientId":"USER_ID","payload":{"title":"测试"}}]}' --force
+openxiangda function invoke send_reservation_reminder --body-json '{"input":{"reservationId":"RESERVATION_ID"}}'
 ```
 
-Automation or workflow JS_CODE:
+App Function, Automation, or workflow JS_CODE:
 
 ```ts
 export default async function notify(ctx) {

package/openxiangda-skills/references/openxiangda-api.md

@@ -344,38 +344,16 @@ Requires Bearer token. Updates menu sorting and parent relationships in batch.
 
 ### POST `/apps/:appType/notifications/send-by-type`
 
-Requires Bearer token. Sends a notification in the current app scope.
-Each returned message can include `deliveryMeta` with provider message id, outTrackId, card template id, fallback usage, and provider error summary.
-
-```json
-{
-  "notificationType": "reservation_reminder",
-  "recipientId": "user-id",
-  "payload": {
-    "title": "预约提醒"
-  },
-  "channels": ["inapp"]
-}
-```
+Removed. Always returns HTTP/envelope `410` with
+`DIRECT_NOTIFICATION_SEND_REMOVED`. Pages must invoke a named App Function;
+trusted runtime code sends through `ctx.notification` after business
+authorization and recipient resolution.
 
 ### POST `/apps/:appType/notifications/batch-send-by-type`
 
-Requires Bearer token. Sends one notification type to multiple recipients.
-
-```json
-{
-  "notificationType": "reservation_reminder",
-  "recipients": [
-    {
-      "recipientId": "user-id",
-      "payload": {
-        "title": "预约提醒"
-      },
-      "channels": ["inapp"]
-    }
-  ]
-}
-```
+Removed. Always returns HTTP/envelope `410` with
+`DIRECT_NOTIFICATION_SEND_REMOVED`. Batch recipient selection belongs in a
+bounded, authorized App Function, Workflow, Automation, or trusted JS_CODE.
 
 ### GET `/apps/:appType/notifications/templates`
 
@@ -426,7 +404,9 @@ or a direct DingTalk config:
 
 ### POST `/apps/:appType/notifications/dingtalk/send`
 
-Requires Bearer token. Sends the resolved `notificationType` through the DingTalk channel only. The CLI command is `openxiangda notification dingding-send <notificationType> --body-json '{"recipientId":"USER_ID","payload":{"title":"测试"}}' --force`.
+Removed. Always returns HTTP/envelope `410` with
+`DIRECT_NOTIFICATION_SEND_REMOVED`. The CLI command is also removed; use
+`openxiangda function invoke <functionCode>` for an authorized business action.
 
 ### GET `/apps/:appType/notifications/type-configs`
 

package/openxiangda-skills/references/pages/page-sdk.md

@@ -15,7 +15,7 @@ Guidelines:
 - Use `sdk.dataSource.run()` with a page data source descriptor when the page config should own the data view code, default fields, or default filters.
 - Use `sdk.function.invoke(code, { input })` for reusable backend business logic declared under `src/resources/functions/` and `src/functions/`. Do not implement multi-form orchestration, connector fan-out, notification orchestration, or permission-sensitive backend rules directly in a page component.
 - Use `sdk.connector.invoke`, `sdk.connector.call("connector.api")`, or `sdk.connector.download` for external services. The SDK calls the platform runtime connector endpoint; it must not call third-party domains directly.
-- Use `sdk.notification.sendByType` and `batchSendByType` for reusable business messages. Custom notification types must be declared in `src/resources/notifications/` and published with `openxiangda resource publish`.
+- Pages must not send notifications directly. Use `sdk.function.invoke(code, { input })` with business identifiers; the named App Function performs authorization, resolves recipients and variables from authoritative data, and sends with trusted `ctx.notification`. Custom notification types must still be declared in `src/resources/notifications/` and published with `openxiangda resource publish`.
 - Use `sdk.export.create` and `sdk.export.get` for asynchronous XLSX exports. Simple pages may send a declarative workbook definition. Complex or reusable exports should send only a published App Function `definitionCode`, the current query snapshot, export scope, and stable selected row IDs. The server executes `structured_export_provider_v1` with fresh user permissions; never upload executable rendering code from the browser. See `docs/structured-export-v1.md`.
 - Use `AttachmentPreviewList`, `ImagePreviewGrid`, or `useFilePreview` from `openxiangda/runtime/react` for in-page attachment previews in a custom React SPA page. They use the current PageSdk context and enforce the platform capability and ticket contracts. Use `sdk.createFileAccessTicket(bucketName, objectName, fileName, "preview", { appType })` only when the page needs a shareable or new-window preview link. `appType` defaults to the current page context. Open `response.result.previewPageUrl`; do not use `previewUrl` or `/service/file/preview-by-ticket/:ticket` as the page entry.
 - Use `sdk.organization.departments.*` and `sdk.organization.accounts.*` only for intentional organization pages. Read-only list/detail pages need `app:organization:read` or `app:organization:manage`; writes and password operations need `app:organization:manage`. Do not call legacy `/user` or `/department` endpoints from pages.

package/openxiangda-skills/references/resource-manifest-cheatsheet.md

@@ -552,19 +552,17 @@ const stats = await sdk.dataView.stats("ticket_stats_by_customer", {
 }
 ```
 
-页面调用：
+页面调用具名 App Function，只传业务标识：
 
 ```ts
-await sdk.notification.sendByType({
-  notificationType: "reservation_reminder",
-  recipientId: userId,
-  payload: { title: "预约提醒", instrumentName, startTime },
+await sdk.function.invoke("send_reservation_reminder", {
+  input: { reservationId },
 });
 ```
 
-JS_CODE 调用：`ctx.notification.sendByType({ ... })`。允许的 channels：`inapp` / `email` / `dingding` / `wechat` / `thirdparty_todo`。完整规则见 [`notifications.md`](notifications.md)。
+App Function / Workflow / Automation / JS_CODE 在完成业务鉴权并解析接收人后调用：`ctx.notification.sendByType({ ... })`。允许的 channels：`inapp` / `email` / `dingding` / `wechat` / `thirdparty_todo`。完整规则见 [`notifications.md`](notifications.md)。
 
-钉钉卡片预览/发送：`sdk.notification.previewDingTalk({ notificationType, payload })`、`sdk.notification.sendDingTalk({ notificationType, recipientId, payload })`；CLI 为 `openxiangda notification dingding-preview` 和 `openxiangda notification dingding-send --force`。
+页面可做钉钉卡片预览：`sdk.notification.previewDingTalk({ notificationType, payload })`；CLI 为 `openxiangda notification dingding-preview`。实际发送必须位于具名 App Function 等可信运行时中。
 
 ## 4. App Function — `src/resources/functions/<functionCode>.json` + `src/functions/<functionCode>/index.ts`
 

package/openxiangda-skills/skills/openxiangda-core/SKILL.md

@@ -157,7 +157,7 @@ An environment-managed release may intentionally replace complete Function/Autom
 
 For an audited Runtime source rollback, managed `release ship`, recovery `release deploy`, and `release promote` accept `--allow-runtime-rollback --reason "..."` with a reason of at least 8 characters. This pair is scoped only to `runtime-stage` and never reaches resource stages or `app-finalize`. Ship freezes it in `ship.json`; production confirmation inherits it automatically. The default remains fail closed.
 
-`release publish` is the normal whole-app entrypoint for legacy unmanaged workspaces: it verifies SDD without mutating reviewed files, waits for the promotion lease, freezes one App capture, stages the exact Form/Backend/Runtime children, resumes from a private execution journal, finalizes once, and releases the lease. For an approved historical-lineage catch-up, add `--adopt-online-baseline --adoption-reason "..."`; the pair reaches only exact `resource publish --only/--code` stages, never Form ensure, Runtime, or App finalize, and invalid or empty scopes fail before lease acquisition. Managed applications use two-phase `release ship` and its deployment-scoped journal. Individual candidate/deploy/test/fail/promote commands are recovery/diagnostic primitives. `release fail --deployment <id> --message <text> [--code <code>] [--details-json <JSON|file>] --environment preproduction` records an audited UAT failure only after verifying the deployment belongs to the selected preproduction environment; production targets and mismatched deployment identities fail before the write.
+`release publish` is the normal whole-app entrypoint for legacy unmanaged workspaces: it verifies SDD without mutating reviewed files, waits for the promotion lease, freezes one App capture, stages the exact Form/Backend/Page children, resumes from a private execution journal, finalizes once, and releases the lease. A legacy Page step runs with `OPENXIANGDA_PAGE_STAGE_ONLY=1`; its environment and staged kind are part of the plan hash, and missing PageRelease evidence blocks Root finalize. Custom page publishers must honor that environment and invoke the current package CLI. For an approved historical-lineage catch-up, add `--adopt-online-baseline --adoption-reason "..."`; the pair reaches only exact `resource publish --only/--code` stages, never Form ensure, Page, or App finalize. A deliberate Backend manifest replacement may add `--replace-manifest --reason "..."`; the pair reaches only the unique exact Backend stage. Invalid reasons or empty/incompatible scopes fail before lease acquisition. Managed applications use two-phase `release ship` and its deployment-scoped journal. Individual candidate/deploy/test/fail/promote commands are recovery/diagnostic primitives. `release fail --deployment <id> --message <text> [--code <code>] [--details-json <JSON|file>] --environment preproduction` records an audited UAT failure only after verifying the deployment belongs to the selected preproduction environment; production targets and mismatched deployment identities fail before the write.
 
 Reviewed bundle commands may retain `<profile>` as a template. The explicit real `release publish --profile <name>` value is bound to actual child argv without rewriting tracked SDD. React SPA page codes remain logical coverage targets and activate through the single Runtime child; they do not require PageRelease. If local lease state disappears, `release end --change <id>` reconciles a self-owned remote lease from the private execution journal and never reports inactive while a remote lease is active.
 

package/openxiangda-skills/skills/openxiangda-page/SKILL.md

@@ -44,7 +44,7 @@ openxiangda workspace publish --profile <name> --page <pageCode>
 - ❌ Raw native form controls in AI-authored page code (`<input>`, `<select>`, `<textarea>`, file inputs, hand-written pickers/uploaders). Use platform components or `antd` / `antd-mobile`.
 - ❌ Embed a single `FormProvider` field component temporarily; navigate to a full standard form page or render a complete `StandardFormPage` instead.
 - ❌ Reuse one form UI for both PC and mobile without verifying overlay / picker / bottom-sheet behavior on both viewports.
-- ❌ Hardcode notification or platform API URLs; use `openxiangda/runtime` and `src/resources/notifications/` declarations.
+- ❌ Send notifications directly from a page or hardcode notification/platform API URLs. Pages invoke a named App Function with business identifiers; trusted runtime code uses `ctx.notification` and `src/resources/notifications/` declarations.
 
 ## CLI Flow
 
@@ -133,7 +133,7 @@ Read these references only when editing page code:
 - Store live `pageId`, `routeKey`, and `legacyFormUuid` under the current profile only.
 - Use `openxiangda/runtime` for platform data access instead of hardcoding backend URLs in page code.
 - 家校关系必须通过 `sdk.organization.schoolContact` / `ctx.organization.schoolContact` 读取；班主任班级使用 `teachers.list` 的 `isHeadTeacher`，不要用全局角色推断具体班级，也不要直连钉钉、查询系统表或用同班成员推断亲属关系。
-- For reminders, alerts, and business messages, declare `src/resources/notifications/` first and call `sdk.notification`; do not hardcode notification API URLs.
+- For reminders, alerts, and business messages, declare `src/resources/notifications/` first. Pages call a named App Function through `sdk.function.invoke`; the function authorizes the business action, derives recipients and variables, and sends through trusted `ctx.notification`. Do not hardcode notification API URLs or pass effective recipients/content/channels from the page.
 - For backend business logic shared by pages, automations, or workflows, declare an App Function and call `sdk.function.invoke`; do not duplicate the same multi-form query/connector/notification orchestration in page code.
 - Before hand-writing mature UI behavior, consult `references/component-guide.md` and use established libraries: platform components for platform data fields, antd/antd-mobile for controls and overlays, ECharts for charts, GSAP for complex animation timelines, and maintained packages such as dnd-kit for drag/drop. Do not rebuild mature controls with raw DOM/native inputs.
 - Named imports from `@ant-design/icons` are supported by the `openxiangda` workspace build proxy, which enumerates icon module exports at runtime.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.270",
+  "version": "1.0.271",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {
@@ -233,43 +233,42 @@
   },
   "openxiangdaRelease": {
     "schemaVersion": "openxiangda.release-notes/v1",
-    "version": "1.0.270",
-    "title": "OpenXiangda V1 Inbound Webhook",
+    "version": "1.0.271",
+    "title": "OpenXiangda V1 Legacy Atomic Mixed Releases",
     "status": "reviewed",
-    "summary": "V1 应用可以声明公开 Inbound Webhook，由平台可靠接入并转发给固定 App Function，供应商验签和业务处理仍由应用负责。",
-    "newFeatures": [
-      "新增 src/resources/webhooks/*.json 资源声明、校验、计划、发布、拉取和停用能力。",
-      "新增 webhook list/get/create/update/upsert/disable/deliveries/delivery 命令，用于配置和投递诊断。",
-      "Webhook Function 获得原始 Body、原始 Query、重复参数数组、安全 Headers、投递 ID 和幂等键。"
-    ],
+    "summary": "Legacy PageRelease 应用现在可以在一次受审发布中同时暂存 FormRelease、BackendRelease 和 PageRelease，并通过一个 Root AppRelease 原子激活。",
+    "newFeatures": [],
     "fixes": [
-      "Function 资源在 Webhook 之前发布，prune 对遗失的 Webhook 执行停用而不是删除审计数据。",
-      "模板、Skill、命令发现和 API 参考统一说明 rawBody 验签、secretRefs 和业务幂等要求。"
+      "Legacy 发布计划不再把 Form 交给 workspace publish 直接处理，而是生成独立的不可变 FormRelease stage。",
+      "BackendRelease 在依赖的 staged Form contract 就绪后执行，legacy Page 继续使用 PageRelease，最后只执行一次 app-finalize。",
+      "SDD bundle 和 prepublish 校验对 legacy Form、Backend、Page 混合发布使用同一组确定性命令。",
+      "Legacy Page step 自动注入 stage-only 环境并记录 PageRelease staged evidence；缺少证据时禁止 Root finalize。",
+      "Legacy release publish 的 manifest replacement 权限只透传给唯一的精确 Backend stage。"
     ],
     "affectedUsers": [
-      "需要接收门禁、支付、IoT 或其他第三方主动回调的 OpenXiangda V1 应用开发者。"
+      "使用 legacy PageRelease 且同一变更同时包含 Form、Function/Automation 或 Page 的 OpenXiangda V1 应用。"
     ],
     "compatibility": {
       "node": ">=18；全局 V2 统一入口需要 >=24",
       "workspaceGenerations": [
         "v1"
       ],
-      "workspacePolicy": "现有 V1 资源保持兼容；只有声明 webhooks 的应用会创建公开回调端点。",
-      "platformPolicy": "必须部署包含 V1 Webhook 管理/公开入口、SQL 迁移和网关规则的平台版本。App Function Secret 必须按部署规范启用。"
+      "workspacePolicy": "React SPA 发布计划保持兼容；legacy 混合发布会改用 FormRelease + PageRelease + Root AppRelease 的原子编排。",
+      "platformPolicy": "目标平台需已支持 FormRelease、PageRelease、BackendRelease 和 atomic staged children；无需数据库迁移。"
     },
     "upgradeSteps": [
-      "将 V1 项目依赖锁定到 openxiangda@1.0.270 或运行同代 update install。",
-      "执行 skill install --force 和 skill bootstrap --force，阅读 references/webhooks.md。",
-      "先发布声明 secretRefs 的 trusted_node_v2 Function，再声明并发布 Webhook。",
-      "从 .openxiangda/state.json 读取 callbackUrl，配置到供应商并用投递查询命令完成验签、重试和幂等验收。"
+      "将 V1 项目依赖锁定到 openxiangda@1.0.271 或运行同代 update install。",
+      "对待发布变更重新生成 mainline release bundle，或至少重新执行 sdd verify --changed --stage prepublish。",
+      "确认 legacy 计划中的 workspace publish 只包含 pages/*，Form 使用 resource publish form-setting 单独暂存。",
+      "自定义 legacy 页面发布脚本必须遵守 OPENXIANGDA_PAGE_STAGE_ONLY=1，并通过当前包内 CLI 登记 staged PageRelease。",
+      "继续通过 release publish 执行一次性 Root finalize，不要顺序激活 Form、Backend 或 Page。"
     ],
     "knownLimitations": [
-      "首版公开入口只接受 application/json 的 HTTP POST，单端点 Body 上限不超过 1 MiB。",
-      "平台不内置供应商签名算法；Function 必须按照供应商正式协议使用 rawBody 验签。",
-      "投递语义为 at-least-once，应用必须用 input.idempotencyKey 原子保护业务副作用。"
+      "1.0.270 生成的错误计划不会被原地信任；必须使用 1.0.271 重新计算并通过 SDD gate。",
+      "该补丁不改变网络链路；独立的 ECONNRESET 仍需按请求时间和 ingress 日志排查。"
     ],
     "issues": [],
-    "sha256": "7ec9e6eebb0b509833283274bde2fdfba48a099c76cea862f77a08441a4ef1dd",
-    "url": "https://github.com/1377385356/openxiangda-v1/releases/tag/v1.0.270"
+    "sha256": "86b676d7d8382b8618aad501cd8cf576d95ee0a6c29b8435b9b2edc22b43eee9",
+    "url": "https://github.com/1377385356/openxiangda-v1/releases/tag/v1.0.271"
   }
 }