openyida 2026.5.17-1 → 2026.5.18

package/README.md

@@ -276,6 +276,7 @@ Environment selectors such as `--env intl`, `--intl`, `--overseas`, `--global`,
 | `openyida corp-efficiency [overview\|details\|detail\|groups\|notify] [options] [--open\|--no-open]` | Query enterprise efficiency metrics, detail report entries, and related notification actions |
 | `openyida create-app "<name>"\|--name <name> [options] [--open\|--no-open]` | Create an application and output `appType` |
 | `openyida update-app <appType> --name "..."` | Update application metadata |
+| `openyida app-permission <get\|set\|add\|remove\|search-user> ...` | Manage app primary admins, data admins, and developer members |
 | `openyida export <appType> [output]` | Export an application migration package |
 | `openyida import <file> [name]` | Import a migration package into a target environment |
 
@@ -445,13 +446,15 @@ Scan the QR code to join the OpenYida DingTalk user group for updates and suppor
 
 Thanks to everyone who has contributed to OpenYida. Read the [Contributing Guide](./CONTRIBUTING.md) to get involved.
 
+Latest contributors: [DDlixin1](https://github.com/DDlixin1), [fcloud](https://github.com/fcloud).
+
 <!-- openyida-contributors:start -->
 
 <p>
   <a href="https://github.com/yize"><img src="https://github.com/yize.png?size=48" width="48" height="48" alt="九神" title="九神" /></a>
   <a href="https://github.com/alex-mm"><img src="https://github.com/alex-mm.png?size=48" width="48" height="48" alt="天晟" title="天晟" /></a>
   <a href="https://github.com/DDlixin1"><img src="https://github.com/DDlixin1.png?size=48" width="48" height="48" alt="DDlixin1" title="DDlixin1" /></a>
-  <a href="https://github.com/fcloud"><img src="https://github.com/fcloud.png?size=48" width="48" height="48" alt="Aiden Wu" title="Aiden Wu" /></a>
+  <a href="https://github.com/fcloud"><img src="https://github.com/fcloud.png?size=48" width="48" height="48" alt="Aiden Wu (fcloud)" title="Aiden Wu (fcloud)" /></a>
   <a href="https://github.com/nicky1108"><img src="https://github.com/nicky1108.png?size=48" width="48" height="48" alt="nicky1108" title="nicky1108" /></a>
   <a href="https://github.com/angelinheys"><img src="https://github.com/angelinheys.png?size=48" width="48" height="48" alt="angelinheys" title="angelinheys" /></a>
   <a href="https://github.com/yipengmu"><img src="https://github.com/yipengmu.png?size=48" width="48" height="48" alt="yipengmu" title="yipengmu" /></a>

package/bin/yida.js

@@ -692,6 +692,12 @@ async function main() {
       break;
     }
 
+    case 'app-permission': {
+      const { run: runAppPermission } = require('../lib/app-permission/app-permission');
+      await runAppPermission(args);
+      break;
+    }
+
     case 'data': {
       if (args.length < 2) {
         warn('用法: openyida data <action> <resource> [args] [options]');

package/lib/app-permission/app-permission.js

@@ -0,0 +1,459 @@
+'use strict';
+
+const querystring = require('querystring');
+
+const {
+  loadCookieData,
+  triggerLogin,
+  resolveBaseUrl,
+  httpGet,
+  httpPost,
+  requestWithAutoLogin,
+} = require('../core/utils');
+const { searchUsers } = require('../corp-manager/api');
+
+const ROLE_CONFIGS = {
+  MAIN: {
+    key: 'main',
+    label: '应用主管理员',
+    memberField: 'managers',
+    idField: 'managerIdList',
+    required: true,
+  },
+  DATA: {
+    key: 'data',
+    label: '数据管理员',
+    memberField: 'dataManagers',
+    idField: 'dataManagerUserIdList',
+    required: false,
+  },
+  DEV: {
+    key: 'dev',
+    label: '开发成员',
+    memberField: 'devManagers',
+    idField: 'devManagerUserIdList',
+    required: false,
+  },
+};
+
+const ROLE_ALIASES = {
+  main: 'MAIN',
+  primary: 'MAIN',
+  owner: 'MAIN',
+  admin: 'MAIN',
+  manager: 'MAIN',
+  mainManagers: 'MAIN',
+  MAIN: 'MAIN',
+
+  data: 'DATA',
+  dataAdmin: 'DATA',
+  dataManager: 'DATA',
+  dataManagers: 'DATA',
+  DATA: 'DATA',
+
+  dev: 'DEV',
+  develop: 'DEV',
+  developer: 'DEV',
+  development: 'DEV',
+  devManager: 'DEV',
+  devManagers: 'DEV',
+  DEV: 'DEV',
+};
+
+const USAGE = `openyida app-permission - 应用级管理员设置
+
+Usage:
+  openyida app-permission search-user <keyword> [--dept <text>] [--size N]
+  openyida app-permission get <appType>
+  openyida app-permission set <appType> <main|data|dev> --users <userId1,userId2>
+  openyida app-permission set <appType> <data|dev> --clear
+  openyida app-permission add <appType> <main|data|dev> --users <userId1,userId2>
+  openyida app-permission remove <appType> <main|data|dev> --users <userId1,userId2>
+
+Examples:
+  openyida app-permission get APP_XXX
+  openyida app-permission add APP_XXX data --users manager7350
+  openyida app-permission set APP_XXX dev --users user001,user002
+`;
+
+function fail(message) {
+  console.error(message);
+  console.error(USAGE);
+  process.exit(1);
+}
+
+function printJson(payload) {
+  console.log(JSON.stringify(payload, null, 2));
+}
+
+function getAuthRef() {
+  let cookieData = loadCookieData();
+  if (!cookieData || !cookieData.cookies || !cookieData.csrf_token) {
+    cookieData = triggerLogin();
+  }
+
+  if (!cookieData || !cookieData.cookies || !cookieData.csrf_token) {
+    throw new Error('无法获取有效登录态或 CSRF Token');
+  }
+
+  return {
+    csrfToken: cookieData.csrf_token,
+    cookies: cookieData.cookies,
+    baseUrl: resolveBaseUrl(cookieData),
+    cookieData,
+  };
+}
+
+function assertSuccess(result, action) {
+  if (result && result.success) {
+    return result;
+  }
+  const message = result && (result.errorMsg || result.message || result.errorCode);
+  throw new Error(`${action}失败${message ? `：${message}` : ''}`);
+}
+
+function normalizeRole(role) {
+  const normalized = ROLE_ALIASES[String(role || '').trim()];
+  if (!normalized) {
+    throw new Error(`无效角色：${role}，可用值：main, data, dev`);
+  }
+  return normalized;
+}
+
+function normalizeText(value) {
+  if (value === null || value === undefined) {
+    return '';
+  }
+  if (typeof value === 'string') {
+    return value;
+  }
+  if (typeof value === 'object') {
+    return value.zh_CN || value.pureEn_US || value.en_US || value.value || value.text || value.label || '';
+  }
+  return String(value);
+}
+
+function validateAppType(appType) {
+  if (!appType) {
+    throw new Error('缺少 appType');
+  }
+  if (/[/?#]/.test(appType)) {
+    throw new Error(`无效 appType：${appType}`);
+  }
+  return appType;
+}
+
+function splitList(value) {
+  if (!value || value === true) {
+    return [];
+  }
+  if (Array.isArray(value)) {
+    return value;
+  }
+  return String(value).split(',').map(item => item.trim()).filter(Boolean);
+}
+
+function unique(values) {
+  return [...new Set((values || []).map(value => String(value).trim()).filter(Boolean))];
+}
+
+function toPositiveInt(value, defaultValue) {
+  const parsed = Number.parseInt(value || `${defaultValue}`, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return defaultValue;
+  }
+  return parsed;
+}
+
+function parseCliOptions(tokens) {
+  const positionals = [];
+  const options = {};
+
+  for (let i = 0; i < tokens.length; i += 1) {
+    const token = tokens[i];
+    if (token.startsWith('--')) {
+      const key = token.slice(2).replace(/-/g, '_');
+      const next = tokens[i + 1];
+      if (next !== undefined && !next.startsWith('--')) {
+        options[key] = next;
+        i += 1;
+      } else {
+        options[key] = true;
+      }
+    } else {
+      positionals.push(token);
+    }
+  }
+
+  return { positionals, options };
+}
+
+function buildCommonParams(authRef, params = {}) {
+  return {
+    _csrf_token: authRef.csrfToken,
+    _locale_time_zone_offset: '28800000',
+    _stamp: String(Date.now()),
+    ...params,
+  };
+}
+
+async function appGet(appType, path, params, authRef = getAuthRef()) {
+  const safeAppType = validateAppType(appType);
+  return requestWithAutoLogin(
+    auth => httpGet(
+      auth.baseUrl,
+      `/${safeAppType}/${path.replace(/^\/+/, '')}`,
+      buildCommonParams(auth, params),
+      auth.cookies,
+    ),
+    authRef,
+  );
+}
+
+async function appPost(appType, path, params, authRef = getAuthRef()) {
+  const safeAppType = validateAppType(appType);
+  return requestWithAutoLogin(
+    auth => httpPost(
+      auth.baseUrl,
+      `/${safeAppType}/${path.replace(/^\/+/, '')}`,
+      querystring.stringify(buildCommonParams(auth, params)),
+      auth.cookies,
+    ),
+    authRef,
+  );
+}
+
+function normalizeMember(record) {
+  const userId = record.userId || record.emplId || record.id || record.key || record.workNo || '';
+  const userName = normalizeText(
+    record.displayName ||
+    record.defaultName ||
+    record.name ||
+    record.nickName ||
+    record.label ||
+    record.userName,
+  );
+
+  return {
+    userId,
+    userName,
+    dingtalkId: record.dingtalkId || '',
+    avatar: record.personalPhoto || record.personalPhotoUrl || record.avatar || '',
+    companyNo: record.companyNo || '',
+    workStatus: record.workStatus || '',
+  };
+}
+
+function memberIds(members) {
+  return unique((members || []).map(member => member.userId || member.emplId || member.id || member.key));
+}
+
+function idsFromContent(content, config) {
+  const idValue = content[config.idField];
+  const idsFromField = typeof idValue === 'string' ? splitList(idValue) : [];
+  if (idsFromField.length > 0) {
+    return unique(idsFromField);
+  }
+  return memberIds(content[config.memberField] || []);
+}
+
+function normalizeRolePayload(content, roleType) {
+  const config = ROLE_CONFIGS[roleType];
+  const members = (content[config.memberField] || []).map(normalizeMember);
+  const ids = idsFromContent(content, config);
+
+  return {
+    role: config.key,
+    roleType,
+    roleLabel: config.label,
+    required: config.required,
+    userIds: ids,
+    members,
+  };
+}
+
+function normalizeAppPermission(content = {}) {
+  return {
+    success: true,
+    appType: content.appType || '',
+    appName: normalizeText(content.appName),
+    sentryMode: content.sentryMode || '',
+    isAccessControl: content.isAccessControl || '',
+    allowExternalAddressBook: content.allowExternalAddressBook || '',
+    newAllowExternalAddressBook: content.newAllowExternalAddressBook || '',
+    currentUserAdminType: content.adminType || '',
+    roles: {
+      main: normalizeRolePayload(content, 'MAIN'),
+      data: normalizeRolePayload(content, 'DATA'),
+      dev: normalizeRolePayload(content, 'DEV'),
+    },
+  };
+}
+
+async function getAppPermission(appType, authRef = getAuthRef()) {
+  const result = await appGet(
+    appType,
+    '/query/app/getAppIncludingAecpInfo.json',
+    { appKey: appType },
+    authRef,
+  );
+  assertSuccess(result, '查询应用管理员设置');
+  return normalizeAppPermission(result.content || {});
+}
+
+async function saveRoleManagers(options = {}, authRef = getAuthRef()) {
+  const appType = validateAppType(options.appType);
+  const roleType = normalizeRole(options.role || options.roleType);
+  const userIds = unique(options.userIds || options.users || []);
+
+  if (ROLE_CONFIGS[roleType].required && userIds.length === 0) {
+    throw new Error(`${ROLE_CONFIGS[roleType].label}不能为空`);
+  }
+
+  const result = await appPost(
+    appType,
+    '/query/app/updateAppAdmin.json',
+    {
+      adminType: roleType,
+      managers: userIds.join(','),
+    },
+    authRef,
+  );
+  assertSuccess(result, '保存应用管理员设置');
+
+  return {
+    success: true,
+    appType,
+    role: ROLE_CONFIGS[roleType].key,
+    roleType,
+    roleLabel: ROLE_CONFIGS[roleType].label,
+    userIds,
+    content: result.content,
+  };
+}
+
+async function updateRoleManagers(options = {}, authRef = getAuthRef()) {
+  const appType = validateAppType(options.appType);
+  const roleType = normalizeRole(options.role || options.roleType);
+  const action = options.action || 'set';
+  const inputUserIds = unique(options.userIds || options.users || []);
+
+  if (action === 'set') {
+    return saveRoleManagers({ appType, roleType, userIds: inputUserIds }, authRef);
+  }
+
+  if (inputUserIds.length === 0) {
+    throw new Error(`${action} 操作必须提供 --users`);
+  }
+
+  const current = await getAppPermission(appType, authRef);
+  const roleKey = ROLE_CONFIGS[roleType].key;
+  const previousUserIds = current.roles[roleKey].userIds;
+  let nextUserIds;
+
+  if (action === 'add') {
+    nextUserIds = unique(previousUserIds.concat(inputUserIds));
+  } else if (action === 'remove') {
+    const removeSet = new Set(inputUserIds);
+    nextUserIds = previousUserIds.filter(userId => !removeSet.has(userId));
+  } else {
+    throw new Error(`未知操作：${action}`);
+  }
+
+  const saved = await saveRoleManagers({ appType, roleType, userIds: nextUserIds }, authRef);
+  return {
+    ...saved,
+    action,
+    previousUserIds,
+  };
+}
+
+async function runSearchUser(positionals, options) {
+  const keyword = positionals[0];
+  if (!keyword) {
+    fail('缺少搜索关键词');
+  }
+
+  printJson(await searchUsers({
+    keyword,
+    dept: options.dept || options.department,
+    size: toPositiveInt(options.size, 50),
+  }));
+}
+
+async function runGet(positionals) {
+  const appType = positionals[0];
+  if (!appType) {
+    fail('缺少 appType');
+  }
+  printJson(await getAppPermission(appType));
+}
+
+async function runUpdate(action, positionals, options) {
+  const appType = positionals[0];
+  const role = positionals[1];
+  if (!appType) {
+    fail('缺少 appType');
+  }
+  if (!role) {
+    fail('缺少角色：main、data 或 dev');
+  }
+
+  const userIds = options.clear ? [] : splitList(options.users || options.user || options.user_ids);
+  if (!options.clear && userIds.length === 0) {
+    fail(`${action} 操作必须提供 --users <userId1,userId2>；清空 data/dev 请使用 --clear`);
+  }
+  if (options.clear && action !== 'set') {
+    fail('--clear 只支持 set 操作');
+  }
+
+  const saved = await updateRoleManagers({
+    action,
+    appType,
+    role,
+    userIds,
+  });
+  const current = await getAppPermission(appType);
+  const roleKey = ROLE_CONFIGS[saved.roleType].key;
+
+  printJson({
+    ...saved,
+    currentRole: current.roles[roleKey],
+  });
+}
+
+async function run(args) {
+  const { positionals, options } = parseCliOptions(args);
+  const action = positionals.shift();
+
+  if (!action || action === '--help' || action === '-h') {
+    console.log(USAGE);
+    return;
+  }
+
+  if (action === 'search-user') {
+    await runSearchUser(positionals, options);
+  } else if (action === 'get' || action === 'list') {
+    await runGet(positionals);
+  } else if (['set', 'add', 'remove'].includes(action)) {
+    await runUpdate(action, positionals, options);
+  } else {
+    fail(`未知 app-permission 子命令：${action}`);
+  }
+}
+
+module.exports = {
+  ROLE_CONFIGS,
+  ROLE_ALIASES,
+  USAGE,
+  parseCliOptions,
+  splitList,
+  normalizeRole,
+  normalizeText,
+  normalizeMember,
+  normalizeAppPermission,
+  getAppPermission,
+  saveRoleManagers,
+  updateRoleManagers,
+  run,
+};

package/lib/core/command-manifest.js

@@ -46,6 +46,9 @@ const COMMAND_GROUPS = [
       }),
       command('create-app', ['create-app'], 'create-app "<name>"|--name <name> [options] [--open|--no-open]', 'help.cmd_create_app'),
       command('update-app', ['update-app'], 'update-app <appType> --name "..."', 'help.cmd_update_app'),
+      command('app-permission', ['app-permission'], 'app-permission <get|set|add|remove|search-user> ...', 'help.cmd_app_permission', {
+        output: 'json',
+      }),
       command('export', ['export'], 'export <appType> [output]', 'help.cmd_export'),
       command('import', ['import'], 'import <file> [name]', 'help.cmd_import'),
     ],

package/lib/core/locales/ar.js

@@ -21,6 +21,7 @@ module.exports = {
     cmd_corp_efficiency: 'استعلام عن نظرة عامة على كفاءة المؤسسة وتقارير التفاصيل',
     cmd_create_app: 'إنشاء تطبيق Yida',
     cmd_update_app: 'تحديث معلومات التطبيق',
+    cmd_app_permission: 'إدارة مسؤولي التطبيق الأساسيين والبيانات والتطوير',
     cmd_export: 'تصدير التطبيق (حزمة الترحيل)',
     cmd_import: 'استيراد حزمة الترحيل، إعادة بناء التطبيق',
     group_form: 'النماذج & الصفحات',

package/lib/core/locales/de.js

@@ -21,6 +21,7 @@ module.exports = {
     cmd_corp_efficiency: 'Unternehmenseffizienz-Übersicht und Detailberichte abrufen',
     cmd_create_app: 'Yida-App erstellen',
     cmd_update_app: 'App-Informationen aktualisieren',
+    cmd_app_permission: 'App-Haupt-, Daten- und Entwicklungsadmins verwalten',
     cmd_export: 'App exportieren (Migrationspaket erstellen)',
     cmd_import: 'Migrationspaket importieren, App neu aufbauen',
     group_form: 'Formulare & Seiten',

package/lib/core/locales/en.js

@@ -23,6 +23,7 @@ module.exports = {
     cmd_corp_efficiency: 'Query enterprise efficiency overview and detail reports',
     cmd_create_app: 'Create a Yida app',
     cmd_update_app: 'Update app info',
+    cmd_app_permission: 'Manage app primary, data, and developer admins',
     cmd_export: 'Export app (generate migration package)',
     cmd_import: 'Import migration package, rebuild app',
     group_form: 'Forms & Pages',

package/lib/core/locales/es.js

@@ -21,6 +21,7 @@ module.exports = {
     cmd_corp_efficiency: 'Consultar resumen de eficiencia empresarial e informes detallados',
     cmd_create_app: 'Crear una aplicación Yida',
     cmd_update_app: 'Actualizar información de la aplicación',
+    cmd_app_permission: 'Gestionar admins principales, de datos y desarrollo de la app',
     cmd_export: 'Exportar aplicación (paquete de migración)',
     cmd_import: 'Importar paquete de migración, reconstruir app',
     group_form: 'Formularios & Páginas',

package/lib/core/locales/fr.js

@@ -21,6 +21,7 @@ module.exports = {
     cmd_corp_efficiency: 'Consulter l\'aperçu de l\'efficacité entreprise et les rapports détaillés',
     cmd_create_app: 'Créer une application Yida',
     cmd_update_app: 'Mettre à jour les infos de l\'application',
+    cmd_app_permission: 'Gérer les admins principaux, données et développement de l\'app',
     cmd_export: 'Exporter l\'application (package de migration)',
     cmd_import: 'Importer un package de migration',
     group_form: 'Formulaires & Pages',

package/lib/core/locales/hi.js

@@ -21,6 +21,7 @@ module.exports = {
     cmd_corp_efficiency: 'एंटरप्राइज दक्षता अवलोकन और विवरण रिपोर्ट क्वेरी करें',
     cmd_create_app: 'Yida ऐप बनाएं',
     cmd_update_app: 'ऐप जानकारी अपडेट करें',
+    cmd_app_permission: 'ऐप प्राथमिक, डेटा और डेवलपमेंट एडमिन प्रबंधित करें',
     cmd_export: 'ऐप निर्यात करें (माइग्रेशन पैकेज)',
     cmd_import: 'माइग्रेशन पैकेज आयात करें, ऐप पुनर्निर्माण',
     group_form: 'फॉर्म & पेज',

package/lib/core/locales/ja.js

@@ -23,6 +23,7 @@ module.exports = {
     cmd_corp_efficiency: '企業効率の概要と明細レポートを取得',
     cmd_create_app: '宜搭アプリを作成',
     cmd_update_app: 'アプリ情報を更新',
+    cmd_app_permission: 'アプリ主管理者、データ管理者、開発メンバーを管理',
     cmd_export: 'アプリをエクスポート（移行パッケージ生成）',
     cmd_import: '移行パッケージをインポート、アプリを再構築',
     group_form: 'フォーム & ページ',

package/lib/core/locales/ko.js

@@ -21,6 +21,7 @@ module.exports = {
     cmd_corp_efficiency: '기업 효율 개요 및 상세 보고서 조회',
     cmd_create_app: 'Yida 앱 생성',
     cmd_update_app: '앱 정보 업데이트',
+    cmd_app_permission: '앱 주관리자, 데이터 관리자, 개발 멤버 관리',
     cmd_export: '앱 내보내기 (마이그레이션 패키지 생성)',
     cmd_import: '마이그레이션 패키지 가져오기, 앱 재구축',
     group_form: '양식 & 페이지',

package/lib/core/locales/pt.js

@@ -21,6 +21,7 @@ module.exports = {
     cmd_corp_efficiency: 'Consultar visão geral de eficiência empresarial e relatórios detalhados',
     cmd_create_app: 'Criar um aplicativo Yida',
     cmd_update_app: 'Atualizar informações do aplicativo',
+    cmd_app_permission: 'Gerenciar admins principais, de dados e desenvolvimento do app',
     cmd_export: 'Exportar aplicativo (pacote de migração)',
     cmd_import: 'Importar pacote de migração, reconstruir app',
     group_form: 'Formulários & Páginas',

package/lib/core/locales/vi.js

@@ -21,6 +21,7 @@ module.exports = {
     cmd_corp_efficiency: 'Truy vấn tổng quan hiệu quả doanh nghiệp và báo cáo chi tiết',
     cmd_create_app: 'Tạo ứng dụng Yida',
     cmd_update_app: 'Cập nhật thông tin ứng dụng',
+    cmd_app_permission: 'Quản lý quản trị chính, dữ liệu và phát triển của ứng dụng',
     cmd_export: 'Xuất ứng dụng (tạo gói di chuyển)',
     cmd_import: 'Nhập gói di chuyển, xây dựng lại ứng dụng',
     group_form: 'Biểu mẫu & Trang',

package/lib/core/locales/zh-HK.js

@@ -23,6 +23,7 @@ module.exports = {
     cmd_corp_efficiency: '查詢企業效能概覽和明細報表',
     cmd_create_app: '建立宜搭應用程式',
     cmd_update_app: '更新應用程式資料',
+    cmd_app_permission: '管理應用主管理員、資料管理員和開發成員',
     cmd_export: '匯出應用程式（產生遷移包）',
     cmd_import: '匯入遷移包，重建應用程式',
     group_form: '表單 & 頁面',

package/lib/core/locales/zh.js

@@ -23,6 +23,7 @@ module.exports = {
     cmd_corp_efficiency: '查询企业效能概览和明细报表',
     cmd_create_app: '创建宜搭应用',
     cmd_update_app: '更新应用信息',
+    cmd_app_permission: '管理应用主管理员、数据管理员和开发成员',
     cmd_export: '导出应用（生成迁移包）',
     cmd_import: '导入迁移包，重建应用',
     group_form: '表单 & 页面',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openyida",
-  "version": "2026.5.17-1",
+  "version": "2026.5.18",
   "description": "OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）",
   "bin": {
     "openyida": "bin/yida.js",

package/scripts/e2e-real/skill-coverage.js

@@ -12,6 +12,7 @@ const SKILL_COVERAGE = {
   'large-file-write': { level: 'offline', tests: ['write fixture generation uses fs APIs in runner tests'] },
   'sls-log-workbench': { level: 'offline-unit', tests: ['skill metadata and packaging validation'], reason: 'internal support-only SLS tooling is guarded by passphrase and corp whitelist; shared real E2E must not query production logs' },
   'yida-app': { level: 'real-e2e', stages: ['app', 'form', 'page', 'data', 'report', 'dashboard'] },
+  'yida-app-permission': { level: 'offline-unit', tests: ['tests/app-permission.test.js'], reason: 'app admin mutations affect real application access; shared real E2E only validates safe read paths' },
   'yida-basic-info': { level: 'offline-unit', tests: ['tests/basic-info.test.js'], reason: 'basic-info reads org admin metadata and can update domains; unit coverage avoids mutating shared real org settings' },
   'yida-chart': { level: 'real-e2e', stages: ['report', 'dashboard'], tests: ['report chart config generation'] },
   'yida-connector': { level: 'offline', stages: ['connector-local'], commands: ['connector gen-template', 'connector parse-api'] },

package/yida-skills/SKILL.md

@@ -172,6 +172,7 @@ openyida copy
 | `yida-page-config` | `skills/yida-page-config/SKILL.md` | 页面公开访问/组织内分享配置 | `openyida verify-short-url <appType> <formUuid> <url>` |
 | `yida-basic-info` | `skills/yida-basic-info/SKILL.md` | 组织基本信息、资源容量、额度和域名设置查询 | `openyida basic-info overview` |
 | `yida-form-permission` | `skills/yida-form-permission/SKILL.md` | 表单权限查询与保存 | `openyida get-permission <appType> <formUuid>` |
+| `yida-app-permission` | `skills/yida-app-permission/SKILL.md` | 应用级管理员设置（主管理员/数据管理员/开发成员） | `openyida app-permission get <appType>` |
 | `yida-corp-manager` | `skills/yida-corp-manager/SKILL.md` | 平台管理员、应用管理员、子管理员与通讯录权限 | `openyida corp-manager <子命令>` |
 | `yida-form-detail` | `skills/yida-form-detail/SKILL.md` | 表单详情页 formDetail 样式优化 | 详见 SKILL.md |
 | `yida-data-management` | `skills/yida-data-management/SKILL.md` | 表单/流程/任务数据查询与变更 | `openyida data query form <appType> <formUuid>` |

package/yida-skills/skills/yida-app-permission/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: yida-app-permission
+description: 应用级管理员设置。查询和维护单个宜搭应用的应用主管理员、数据管理员、开发成员。不适用于：平台级管理员（应使用 yida-corp-manager），或表单权限组/数据范围（应使用 yida-form-permission）。
+---
+
+# 应用级权限设置
+
+## 严格要求 (MUST DO)
+
+- 修改前先执行 `openyida app-permission get <appType>` 查询当前应用管理员设置。
+- 添加成员前先用 `search-user` 确认目标人员 userId；同名人员必须结合部门信息区分。
+- 修改 `main` 应用主管理员会影响应用后台最高管理权限，执行前必须展示当前成员和修改后成员，并等待用户确认。
+- `main` 应用主管理员不能为空；清空仅允许 `data` 或 `dev`。
+
+## 不适用场景
+
+- 平台管理员、平台子管理员、应用创建权限：使用 `yida-corp-manager`。
+- 表单权限组、数据权限、操作权限：使用 `yida-form-permission`。
+- 页面公开访问或组织内分享：使用 `yida-page-config`。
+- 流程节点字段权限：使用 `yida-process-rule`。
+
+## 常用命令
+
+查询应用管理员设置：
+
+```bash
+openyida app-permission get <appType>
+```
+
+搜索人员，确认 userId：
+
+```bash
+openyida app-permission search-user "姓名或关键词" --dept "部门关键词"
+```
+
+添加成员：
+
+```bash
+openyida app-permission add <appType> main --users <userId>
+openyida app-permission add <appType> data --users <userId1,userId2>
+openyida app-permission add <appType> dev --users <userId1,userId2>
+```
+
+完全替换某一类成员：
+
+```bash
+openyida app-permission set <appType> main --users <userId1,userId2>
+openyida app-permission set <appType> data --users <userId1,userId2>
+openyida app-permission set <appType> dev --users <userId1,userId2>
+```
+
+移除成员：
+
+```bash
+openyida app-permission remove <appType> data --users <userId>
+openyida app-permission remove <appType> dev --users <userId>
+```
+
+清空数据管理员或开发成员：
+
+```bash
+openyida app-permission set <appType> data --clear
+openyida app-permission set <appType> dev --clear
+```
+
+## 角色映射
+
+| CLI 角色 | 页面含义 | 接口 adminType |
+|---------|----------|----------------|
+| `main` | 应用主管理员 | `MAIN` |
+| `data` | 数据管理员 | `DATA` |
+| `dev` | 开发成员 | `DEV` |
+
+## 安全检查清单
+
+1. `app-permission search-user` 确认目标 userId 和人员身份。
+2. `app-permission get` 查询当前应用管理员配置。
+3. 展示将要执行的 `add` / `remove` / `set` 命令和修改后 userId 列表。
+4. 用户确认后执行修改。
+5. 再次 `app-permission get` 验证结果。
+
+## 异常处理
+
+| 异常场景 | 处理方式 |
+|---------|----------|
+| 权限不足 / 登录态失效 | 停止执行，提示用户执行 `openyida login` 重新登录或切换具备权限的账号 |
+| 同名人员 | 必须通过部门路径或 userId 二次确认 |
+| 试图清空应用主管理员 | 拒绝执行，要求至少保留 1 个 `main` 成员 |
+| 修改前未查询现有配置 | 先执行 `app-permission get`，不要直接修改 |