@stalfh233/omc-cli 0.0.0-stage → 0.4.0

package/dist/lanes/model.js

@@ -0,0 +1,986 @@
+import { z } from "zod";
+import { ENDPOINTS } from "../endpoints.js";
+import { assertFieldFamilyAllowed, choicesArg, fieldOptionsArg, nameI18nJson, propertyTypeArg, relationTargetOf, relativeCodeArg, SYSTEM_FIELD_CODES, subFieldArg, } from "../field-families.js";
+import { fieldChangeWireBody, prepareFieldChange, sameFieldChange } from "../field-change.js";
+import { executeFormDraftWrite, executeFormPublishWrite } from "../form-support.js";
+import { validateBusinessCode } from "../code-rules.js";
+import { writeSummary } from "../human-summary.js";
+import { capabilityArg, environmentArg } from "../args.js";
+import { governedRead, withoutReadbackCache } from "../read.js";
+import { parseToolInput } from "../tool-types.js";
+import { flattenTreeRows, resolveApplicationCode } from "../support.js";
+import { writeTool } from "../write.js";
+import { registerPackageTool } from "../package-tool.js";
+import { defineTool, ToolInputError, ToolRefusalError } from "../tool-types.js";
+import { wireCall, wireRows, WireError } from "../wire.js";
+import { MODEL_CREATE_BODY_DEFAULTS, MODEL_LANE_CONTRACT } from "./model-contract.js";
+const MODEL_LANE = MODEL_LANE_CONTRACT.lane;
+const MODEL_TOOLS = MODEL_LANE_CONTRACT.tools;
+/**
+ * Ticket 68 — locate a model's app-tree node across applications. The app
+ * tree row id is the AppFunction id that `apppackage/physically_delete`
+ * requires (`removeBizModel(AppFunction.id)`); a biz-model record id is NOT
+ * interchangeable and the platform answers 601003 业务模型不存在 for it. The
+ * default/profile application is queried first; on a miss every other
+ * application's tree is scanned (the model may live in a non-default app), and
+ * the caller refuses `model-application-unresolved` rather than guessing an id.
+ */
+export async function resolveModelTreeNode(session, schemaCode, requestedApplication) {
+    const primary = await resolveApplicationCode(session, requestedApplication).catch(() => "");
+    const treeOf = async (appCode) => appCode ? flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode } })).data)) : [];
+    if (primary) {
+        const rows = await treeOf(primary);
+        const node = rows.find((row) => row.type === "BizModel" && row.code === schemaCode);
+        if (node)
+            return { node, applicationCode: primary, treeRows: rows };
+    }
+    const apps = wireRows((await wireCall(session, { path: ENDPOINTS.applicationList, query: {} })).data);
+    for (const app of apps) {
+        const appCode = String(app.appCode ?? app.code ?? "");
+        if (!appCode || appCode === primary)
+            continue;
+        const rows = await treeOf(appCode);
+        const node = rows.find((row) => row.type === "BizModel" && row.code === schemaCode);
+        if (node)
+            return { node, applicationCode: appCode, treeRows: rows };
+    }
+    return { applicationCode: primary, treeRows: [] };
+}
+/**
+ * T-11 (round 2) — the runtime data-title expression is `Summary[]`, NOT a
+ * human template string. `BizObjectTitleSetter.getSummaryValue`
+ * (launcher-8.6.26 :140-160) runs `JsonUtility.toList(summaryExpression,
+ * Summary.class)` over `Summary{int isDataItem; String code; String param}`
+ * where isDataItem 1 = form field, 2 = query field. Writing a raw template
+ * like "{field}" stores INVALID JSON, so every later data.save/data.submit on
+ * that model throws at title resolution and surfaces only as a bare
+ * `50000 服务异常` (live-verified, extremely hard to diagnose).
+ *
+ * Normalization: canonical Summary[] JSON is validated and re-serialized;
+ * a PURE `{field}` placeholder template (the live repro shape) is converted to
+ * `[{isDataItem:1,code:"field"}]`; anything else (literal text, malformed
+ * JSON) is refused fail-closed so the model can never be poisoned.
+ */
+function validSummaryEntry(entry, index) {
+    if (entry === null || typeof entry !== "object" || Array.isArray(entry))
+        throw new ToolRefusalError({ status: "refused", blocker: "model-summary-invalid", message: `summary[${index}] 必须是对象 {{isDataItem,code[,param]}}` });
+    const { isDataItem, code, param } = entry;
+    if (isDataItem !== 1 && isDataItem !== 2)
+        throw new ToolRefusalError({ status: "refused", blocker: "model-summary-invalid", message: `summary[${index}].isDataItem 必须是 1（表单字段）或 2（查询字段）` });
+    if (typeof code !== "string" || code.trim().length === 0)
+        throw new ToolRefusalError({ status: "refused", blocker: "model-summary-invalid", message: `summary[${index}].code 必须是非空字段编码` });
+    return { isDataItem, code, ...(typeof param === "string" && param.length > 0 ? { param } : {}) };
+}
+/**
+ * T-11 — whether a STORED data-title face is a valid `Summary[]` (a poisoned
+ * model — one written by the pre-fix raw-template path — is not, and its
+ * runtime title resolution throws).
+ */
+export function isCanonicalSummary(stored) {
+    try {
+        const parsed = JSON.parse(stored);
+        return (Array.isArray(parsed) &&
+            parsed.length > 0 &&
+            parsed.every((entry) => entry !== null &&
+                typeof entry === "object" &&
+                !Array.isArray(entry) &&
+                (entry.isDataItem === 1 || entry.isDataItem === 2) &&
+                typeof entry.code === "string" &&
+                entry.code.length > 0));
+    }
+    catch {
+        return false;
+    }
+}
+export function normalizeSummaryInput(raw) {
+    const trimmed = raw.trim();
+    if (trimmed.startsWith("[")) {
+        let parsed;
+        try {
+            parsed = JSON.parse(trimmed);
+        }
+        catch (error) {
+            throw new ToolRefusalError({ status: "refused", blocker: "model-summary-invalid", message: `summary 起始为 "[" 但不是合法 JSON：${error.message}。线上形状是 Summary[]（如 [{\"isDataItem\":1,\"code\":\"<字段>\"}]）` });
+        }
+        if (!Array.isArray(parsed) || parsed.length === 0)
+            throw new ToolRefusalError({ status: "refused", blocker: "model-summary-invalid", message: 'summary 必须是至少一项的 Summary[]，如 [{"isDataItem":1,"code":"<字段>"}]' });
+        return JSON.stringify(parsed.map(validSummaryEntry));
+    }
+    const tokens = trimmed.match(/\{[A-Za-z0-9_]+\}/g);
+    if (tokens && tokens.join("") === trimmed) {
+        return JSON.stringify(tokens.map((token) => ({ isDataItem: 1, code: token.slice(1, -1) })));
+    }
+    throw new ToolRefusalError({
+        status: "refused",
+        blocker: "model-summary-invalid",
+        message: 'summary 线上形状是 Summary[]（平台按 JsonUtility.toList 反序列化）——不支持字面文本。' +
+            '纯 {字段} 占位串会被转换为 [{isDataItem:1,code:"字段"}]；含字面文本的模板无法表示（旧工具把它原样入库会毒化模型：之后该模型所有 data.save/submit 恒 50000）。' +
+            '请传 Summary[] JSON（isDataItem 1=表单字段、2=查询字段）或纯 {字段} 串',
+    });
+}
+export function registerModelLane(tools) {
+    // ---- read faces (round 10 ergonomics) --------------------------------
+    // `model.list` and `model.inspect` close the survey's top gap: enumerating
+    // models, and reading ONE model's whole design-time configuration in a single
+    // call instead of a 9–16 call crawl across field.form.listview.rule.datarule.
+    tools.push(defineTool({
+        name: "model.list",
+        layer: "low",
+        kind: "read",
+        lane: MODEL_LANE,
+        scope: MODEL_TOOLS["model.list"].scope,
+        description: MODEL_TOOLS["model.list"].description,
+        inputSchema: {
+            environment: environmentArg,
+            applicationCode: z.string().optional().describe("应用 code；省略用配置/默认应用"),
+            filter: z.string().optional().describe("子串过滤：code 或 name 含该词才保留"),
+            capability: capabilityArg,
+        },
+        handler: async (ctx, args, self) => governedRead(ctx, self, args, async (session) => {
+            const applicationCode = await resolveApplicationCode(session, args.applicationCode);
+            const tree = flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode: applicationCode } })).data));
+            const all = tree
+                .filter((row) => row.type === "BizModel" && typeof row.code === "string" && row.code)
+                .map((row) => ({ code: row.code, name: row.name ?? row.text ?? null }));
+            const needle = args.filter?.trim();
+            const models = needle ? all.filter((model) => String(model.code).includes(needle) || String(model.name ?? "").includes(needle)) : all;
+            // `filterApplied` disambiguates an empty result: it distinguishes "the
+            // filter ran and matched nothing" from "the filter was not applied"
+            // (dogfood R1: count:0 alone gave no signal).
+            return { applicationCode, count: models.length, totalBeforeFilter: all.length, filterApplied: needle !== undefined && needle !== "", ...(needle ? { filter: needle } : {}), models };
+        }, { target: `model.list:${args.applicationCode ?? ""}:${args.filter ?? ""}` }),
+    }));
+    const siblings = tools;
+    tools.push(defineTool({
+        name: "model.inspect",
+        layer: "high",
+        kind: "read",
+        lane: MODEL_LANE,
+        scope: MODEL_TOOLS["model.inspect"].scope,
+        description: MODEL_TOOLS["model.inspect"].description,
+        inputSchema: {
+            environment: environmentArg,
+            schemaCode: z.string().min(1).optional().describe("模型 code（给一个 code 读全配置；或用 schemaCodes 批量）"),
+            schemaCodes: z.array(z.string().min(1)).optional().describe("一次读多个模型的配置摘要（等价于对每个 code 各调一次 model.inspect，但只花一次往返；返回 {models:[…]}）"),
+            all: z.boolean().optional().describe("默认只返业务字段与非系统规则；true 含系统字段/平台默认规则"),
+            capability: capabilityArg,
+        },
+        handler: async (ctx, args, self) => governedRead(ctx, self, args, async (session) => {
+            const all = args.all === true;
+            const codes = args.schemaCodes && args.schemaCodes.length > 0 ? args.schemaCodes : args.schemaCode ? [args.schemaCode] : [];
+            if (codes.length === 0)
+                throw new ToolInputError({ status: "error", blocker: "tool-input-invalid", tool: "model.inspect", message: "需要 schemaCode（单个）或 schemaCodes（数组，批量）" });
+            const face = async (name, toolArgs) => {
+                const tool = siblings.find((entry) => entry.name === name);
+                if (!tool)
+                    return undefined;
+                try {
+                    const parsed = parseToolInput(tool, { ...toolArgs, environment: args.environment });
+                    // Composition must see the real payload: if an identical standalone
+                    // read already primed the window-diet cache, the sibling would answer
+                    // with `{ unchanged:true, detailFile }` and this face would come back
+                    // empty. Bypass the short-circuit for the nested reads only.
+                    const result = (await withoutReadbackCache(ctx, async () => (await tool.handler(ctx, parsed, tool))));
+                    return result;
+                }
+                catch {
+                    return undefined; // a single face being unreachable must not sink the whole inspect
+                }
+            };
+            const inspectOne = async (schemaCode) => {
+                const fieldFace = await face("field.list", { schemaCode, published: true, ...(all ? { all: true } : {}) });
+                const fieldRows = Array.isArray(fieldFace?.fields) ? fieldFace.fields : [];
+                const fields = fieldRows
+                    .filter((field) => all || !SYSTEM_FIELD_CODES.has(String(field.code)))
+                    .map((field) => ({ code: field.code, type: field.type, ...(field.typeName !== undefined ? { typeName: field.typeName } : {}), name: field.name, ...(field.conditions ? { conditions: field.conditions } : {}) }));
+                const formFace = await face("form.get", { schemaCode });
+                const form = formFace && formFace.present !== undefined
+                    ? { present: formFace.present === true, published: formFace.published === true, controlCount: Array.isArray(formFace.draftControlCodes) ? formFace.draftControlCodes.length : 0 }
+                    : undefined;
+                const listviewFace = await face("listview.get", { schemaCode });
+                const listviewColumns = Array.isArray(listviewFace?.columns) ? listviewFace.columns : [];
+                // Round 13: the default view is platform-generated and lists the system
+                // columns (createdTime/creater/name/sequenceNo/…). In a design-time survey
+                // they are noise the caller must filter out; `all:true` restores them (a
+                // user CAN author a system column into a view, so this is opt-out, not a
+                // delete). Same SYSTEM_FIELD_CODES set field.list uses.
+                const visibleColumns = all ? listviewColumns : listviewColumns.filter((column) => !SYSTEM_FIELD_CODES.has(String(column.propertyCode)));
+                const listview = listviewFace && listviewFace.columns
+                    ? { code: listviewFace.code ?? schemaCode, columnCount: visibleColumns.length, columns: visibleColumns.map((column) => ({ propertyCode: column.propertyCode, propertyType: column.propertyType, visible: column.visible })) }
+                    : undefined;
+                const ruleFace = await face("rule.list", { schemaCode });
+                const ruleRows = Array.isArray(ruleFace?.rules) ? ruleFace.rules : [];
+                // All rules are kept: the platform pre-creates trigger rows (Create/Update/
+                // …) but user logic is AUTHORED INTO them, so `defaultRule` cannot be used
+                // to hide "system" rules without dropping authored ones. `defaultRule` is
+                // reported per rule so a caller can decide.
+                const rules = ruleRows.map((rule) => ({ code: rule.code, name: rule.name, enabled: rule.enabled, status: rule.status, ruleVersion: rule.ruleVersion, defaultRule: rule.defaultRule }));
+                const dataruleFace = await face("datarule.list", { schemaCode });
+                const dataruleRows = Array.isArray(dataruleFace?.rules) ? dataruleFace.rules : [];
+                const datarules = dataruleRows.map((rule) => ({ propertyCode: rule.propertyCode, propertyCodes: rule.propertyCodes, dataRuleType: rule.dataRuleType, name: rule.name, checkType: rule.checkType }));
+                // Workflow summary: use the PUBLISHED face for the `published` flag. The
+                // draft face's templateType is ALWAYS "DRAFT" (even for a published
+                // workflow — draft and published are separate faces), so deriving
+                // `published` from get_draft reported published:false forever (live round
+                // 10: an agent's flow read as published:false while get_published was
+                // templateType:PUBLISH). Activities come from whichever face exists.
+                const draftFace = await face("workflow.get_draft", { schemaCode });
+                const workflowCode = draftFace?.workflowSummary?.workflowCode ?? draftFace?.workflowCode;
+                const publishedFace = workflowCode ? await face("workflow.get_published", { schemaCode }) : undefined;
+                const draftSummary = draftFace?.workflowSummary;
+                const pubSummary = publishedFace?.workflowSummary;
+                const summary = pubSummary ?? draftSummary;
+                const workflow = draftFace?.exists === false || (draftFace === undefined && publishedFace === undefined)
+                    ? (draftFace && draftFace.schemaCode ? { exists: false } : undefined)
+                    : {
+                        workflowCode: summary?.workflowCode ?? workflowCode,
+                        published: publishedFace?.published === true || pubSummary?.templateType === "PUBLISH",
+                        activities: Array.isArray(summary?.activities) ? summary.activities.map((activity) => ({ code: activity.code, type: activity.type, name: activity.name, participant: activity.participant })) : [],
+                        edges: summary?.edges,
+                    };
+                return {
+                    schemaCode,
+                    fields,
+                    form,
+                    listview,
+                    rules,
+                    datarules,
+                    workflow,
+                    hint: "model.inspect 聚合设计时六面（fields/form/listview/rules/datarules/workflow，摘要）。字段 options 细节用 field.list --code；规则图用 rule.get schemaCode+ruleCode；运行数据用 data.list（不在此面）。",
+                };
+            };
+            const one = await inspectOne(codes[0]);
+            if (codes.length === 1)
+                return one;
+            const models = [one];
+            for (const code of codes.slice(1))
+                models.push(await inspectOne(code));
+            return { schemaCodes: codes, count: models.length, models, hint: "每个元素是 model.inspect 对单个模型的摘要；批量只花一次往返。" };
+        }, {
+            target: `model.inspect:${(args.schemaCodes ?? [args.schemaCode]).join(",")}:${args.all === true ? "all" : "biz"}`,
+            compact: (result) => {
+                // Batch shape (`{models:[…]}`) is already a summary; only a single-model
+                // inspect needs the window-diet projection.
+                if (Array.isArray(result.models))
+                    return result;
+                return {
+                    schemaCode: result.schemaCode,
+                    fieldCodes: (result.fields ?? []).map((field) => field.code),
+                    form: result.form,
+                    listview: result.listview ? { code: result.listview.code, columnCount: result.listview.columnCount } : undefined,
+                    ruleCodes: (result.rules ?? []).map((rule) => rule.code),
+                    datarules: result.datarules,
+                    workflow: result.workflow ? { workflowCode: result.workflow.workflowCode, published: result.workflow.published } : undefined,
+                    hint: result.hint,
+                };
+            },
+        }),
+    }));
+    writeTool(tools, "model.create", MODEL_LANE, MODEL_TOOLS["model.create"].scope, MODEL_TOOLS["model.create"].description, { name: z.string().min(1), code: z.string().min(1), folderId: z.string().optional(), applicationCode: z.string().optional(), modelType: z.enum(["LIST", "TREE"]).default("LIST") }, async (session, args) => {
+        const applicationCode = await resolveApplicationCode(session, args.applicationCode);
+        const existing = await resolveModelTreeNode(session, args.code, args.applicationCode);
+        if (existing.node) {
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "model-create-duplicate",
+                schemaCode: args.code,
+                applicationCode: existing.applicationCode,
+                message: `模型 ${args.code} 已存在于应用 ${existing.applicationCode} 的应用树中；create 拒绝重复 POST，不能把既有模型证明为本次创建结果`,
+            });
+        }
+        let folderId = args.folderId;
+        let resolvedFrom = args.folderId ? "explicit" : undefined;
+        if (!folderId) {
+            const tree = flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode: applicationCode } })).data));
+            const folder = tree.find((row) => row.type !== "BizModel" && typeof row.id === "string");
+            if (!folder)
+                throw new WireError("business", "no folder found for model creation", 302001);
+            folderId = String(folder.id);
+            resolvedFrom = "auto-default-folder";
+        }
+        const performed = await wireCall(session, {
+            path: ENDPOINTS.modelCreate,
+            method: "POST",
+            body: {
+                appCode: applicationCode,
+                name: args.name,
+                parentId: folderId,
+                modelType: args.modelType ?? MODEL_CREATE_BODY_DEFAULTS.modelType,
+                bizSchemaCode: args.code,
+                icon: MODEL_CREATE_BODY_DEFAULTS.icon,
+                name_i18n: nameI18nJson(args.name),
+                pcAble: MODEL_CREATE_BODY_DEFAULTS.pcAble,
+                mobileAble: MODEL_CREATE_BODY_DEFAULTS.mobileAble,
+                options: MODEL_CREATE_BODY_DEFAULTS.options,
+            },
+        });
+        const present = flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode: applicationCode } })).data)).some((row) => row.type === "BizModel" && row.code === args.code);
+        return { performed: { errcode: performed.errcode, folderId, resolvedFrom, applicationCode }, readback: { present } };
+    });
+    /** model.delete writeTool extra arg: a session-aware dry-run that scans inbound references (no write). */
+    async function modelDeleteDryRun(session, args) {
+        const record = await (async () => {
+            try {
+                return (await wireCall(session, { path: ENDPOINTS.modelGet, query: { schemaCode: args.schemaCode } })).data ?? null;
+            }
+            catch (error) {
+                if (error instanceof WireError && error.kind === "business")
+                    return null;
+                throw error;
+            }
+        })();
+        if (record === null)
+            return { wouldChange: false, absent: true, mayBeReferenced: false, reason: "model-already-absent" };
+        const resolved = await resolveModelTreeNode(session, args.schemaCode, args.applicationCode);
+        const siblings = resolved.treeRows
+            .filter((row) => row.type === "BizModel" && typeof row.code === "string" && row.code !== args.schemaCode)
+            .map((row) => ({ schemaCode: String(row.code) }));
+        const referencing = [];
+        for (const sibling of siblings) {
+            const fields = [];
+            for (const isPublish of ["false", "true"]) {
+                for (const row of wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: sibling.schemaCode, isPublish } })).data)) {
+                    if (relationTargetOf(row) !== args.schemaCode)
+                        continue;
+                    const code = row.code ?? row.propertyCode;
+                    if (typeof code === "string" && !fields.includes(code))
+                        fields.push(code);
+                }
+            }
+            if (fields.length > 0)
+                referencing.push({ schemaCode: sibling.schemaCode, fields });
+        }
+        const nodeResolved = resolved.node !== undefined;
+        return {
+            // The dry-run now performs the same inbound-reference scan the executor
+            // does, so "wouldChange:true" is never contradicted by a later refusal
+            // (dogfood R3). `mayBeReferenced` is the honest preview.
+            wouldChange: !nodeResolved || referencing.length === 0,
+            mayBeReferenced: referencing.length > 0,
+            referencingModels: referencing,
+            treeNodeResolved: nodeResolved,
+            applicationCode: resolved.applicationCode,
+            ...(referencing.length > 0
+                ? { blocker: "model-referenced-by", nextAction: "先删引用方模型或先删其关联字段，再删本模型（依赖倒序）" }
+                : !nodeResolved
+                    ? { blocker: "model-application-unresolved", nextAction: "显式传 applicationCode 或先 discover_environment 确认归属应用" }
+                    : {}),
+        };
+    }
+    writeTool(tools, "model.delete", MODEL_LANE, MODEL_TOOLS["model.delete"].scope, MODEL_TOOLS["model.delete"].description, { schemaCode: z.string().min(1), applicationCode: z.string().optional() }, async (session, args) => {
+        // authoritative model record (bizmodels/get_all); the app-tree node id
+        // may lag behind and is cleaned best-effort.
+        const readRecord = async () => {
+            try {
+                const result = await wireCall(session, { path: ENDPOINTS.modelGet, query: { schemaCode: args.schemaCode } });
+                return result.data ?? null;
+            }
+            catch (error) {
+                if (error instanceof WireError && error.kind === "business")
+                    return null;
+                throw error;
+            }
+        };
+        const record = await readRecord();
+        // Ticket 68: resolve the app-tree node across applications (the tree row
+        // id IS the AppFunction id physically_delete needs). Never fall back to
+        // the biz-model record id — the platform answers 601003 业务模型不存在
+        // for it (removeBizModel looks the id up as an AppFunction id).
+        const resolved = await resolveModelTreeNode(session, args.schemaCode, args.applicationCode);
+        const node = resolved.node;
+        const applicationCode = resolved.applicationCode;
+        const treeRows = async () => applicationCode ? flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode: applicationCode } })).data)) : [];
+        if (!node) {
+            if (record === null)
+                return { performed: { skipped: "already-absent" }, readback: { absent: true } };
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "model-application-unresolved",
+                schemaCode: args.schemaCode,
+                message: `${args.schemaCode} 的业务模型记录仍存在，但在任何应用树中都找不到它的节点（AppFunction）——不能删：physically_delete 需要 AppFunction id，传入业务模型记录 id 会被平台以 601003 业务模型不存在拒绝（不猜测 id）。请显式传 applicationCode（模型所属应用），或用 discover_environment 确认该模型的归属应用后再删。`,
+            });
+        }
+        const targetId = node.id;
+        const treeRowList = resolved.treeRows.length > 0 ? resolved.treeRows : await treeRows();
+        // Ticket 23 inbound-reference precheck: the platform's sync face answers
+        // errcode 0 while the async deleteFunctions dispatcher refuses with
+        // "xxx被模型 yyy 引用,不能删除" — surface that refusal at call time with
+        // the referencing models, before any write reaches the environment.
+        const siblings = treeRowList
+            .filter((row) => row.type === "BizModel" && typeof row.code === "string" && row.code !== args.schemaCode)
+            .map((row) => ({ schemaCode: String(row.code), name: typeof row.name === "string" && row.name ? row.name : String(row.code) }));
+        const referencingModels = [];
+        for (const sibling of siblings) {
+            const referencedFields = [];
+            for (const isPublish of ["false", "true"]) {
+                const listed = await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: sibling.schemaCode, isPublish } });
+                for (const row of wireRows(listed.data)) {
+                    if (relationTargetOf(row) !== args.schemaCode)
+                        continue;
+                    const code = row.code ?? row.propertyCode;
+                    if (typeof code === "string" && !referencedFields.some((field) => field.code === code)) {
+                        referencedFields.push({ code, type: row.type ?? row.propertyType });
+                    }
+                }
+            }
+            if (referencedFields.length > 0)
+                referencingModels.push({ schemaCode: sibling.schemaCode, name: sibling.name, fields: referencedFields });
+        }
+        if (referencingModels.length > 0) {
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "model-referenced-by",
+                schemaCode: args.schemaCode,
+                referencingModels,
+                message: `${args.schemaCode} 被模型 ${referencingModels.map((model) => model.schemaCode).join("、")} 的关联字段引用，不能删除（服务端 deleteFunctions 的异步拒绝已提前到调用时）。依赖倒序清理：先删引用方模型（或先删其关联字段），再删被引用模型；引用方物理删除的逐列异步级联需 40-60s，完成后再删本模型。`,
+            });
+        }
+        const performed = await wireCall(session, {
+            path: ENDPOINTS.appPackagePhysicallyDelete,
+            method: "POST",
+            body: [{ id: targetId, code: args.schemaCode, type: "BizModel" }],
+        });
+        // Both the model record and the app-tree node are eventually consistent
+        // (the per-column async cascade takes 3-4s per column, 40-60s for a
+        // 12-column model). Poll the authoritative record face for verified
+        // absence (~60s budget), then report the tree-node state as a pending
+        // hint with explicit wait-and-recheck guidance instead of a failure.
+        let absent = false;
+        for (let attempt = 0; attempt < 16 && !absent; attempt += 1) {
+            if (attempt > 0)
+                await new Promise((resolve) => setTimeout(resolve, Math.min(1000 * attempt, 4000)));
+            absent = (await readRecord()) === null;
+        }
+        const treeNodePending = (await treeRows()).some((row) => row.type === "BizModel" && row.code === args.schemaCode);
+        return {
+            performed: { errcode: performed.errcode, deletedId: targetId, applicationCode },
+            readback: {
+                absent,
+                treeNodePending,
+                ...(absent
+                    ? {}
+                    : {
+                        nextAction: "wait-and-recheck",
+                        note: "异步逐列级联实测 40-60s：absent:false + treeNodePending:true 表示删除级联仍在进行，不是失败。等待约 60s 后重跑 model.delete（幂等，already-absent 短路）复核；若刚删除引用方模型，其级联可能仍在拆除关联列，必须等它完成后再删本模型。",
+                    }),
+            },
+        };
+    }, undefined, modelDeleteDryRun);
+    writeTool(tools, "model.deleteMany", MODEL_LANE, MODEL_TOOLS["model.deleteMany"].scope, MODEL_TOOLS["model.deleteMany"].description, { schemaCodes: z.array(z.string().min(1)).min(1), applicationCode: z.string().optional() }, async (session, args) => {
+        // Platform evidence: physically_delete takes the WHOLE list in ONE
+        // request (AppPackageController.java:1424 @RequestBody
+        // List<AppDeleteParamVO>, 8.6.26 decompiled-full). The batch tool sends
+        // every existing model in that single request after prechecking each
+        // target's inbound references — a referenced model refuses the whole
+        // batch with per-target evidence and ZERO side effects.
+        const readRecord = async (schemaCode) => {
+            try {
+                const result = await wireCall(session, { path: ENDPOINTS.modelGet, query: { schemaCode } });
+                return result.data ?? null;
+            }
+            catch (error) {
+                if (error instanceof WireError && error.kind === "business")
+                    return null;
+                throw error;
+            }
+        };
+        const applicationCode = await resolveApplicationCode(session, args.applicationCode).catch(() => "");
+        const targets = [...new Set(args.schemaCodes)];
+        const alreadyAbsent = [];
+        const entries = [];
+        const unresolved = [];
+        // Ticket 68: resolve each model's app-tree node across applications; the
+        // tree id (AppFunction id) is what physically_delete needs. Collect the
+        // resolved trees for the sibling scan (cross-application references too).
+        const resolvedTrees = [];
+        const seenTrees = new Set();
+        const appsToScan = new Set();
+        for (const code of targets) {
+            const resolved = await resolveModelTreeNode(session, code, args.applicationCode);
+            appsToScan.add(resolved.applicationCode);
+            if (!seenTrees.has(resolved.applicationCode) && resolved.treeRows.length > 0) {
+                seenTrees.add(resolved.applicationCode);
+                resolvedTrees.push(...resolved.treeRows);
+            }
+            if (resolved.node?.id) {
+                entries.push({ id: resolved.node.id, code, type: "BizModel" });
+            }
+            else if ((await readRecord(code)) === null) {
+                alreadyAbsent.push(code);
+            }
+            else {
+                unresolved.push(code);
+            }
+        }
+        if (unresolved.length > 0) {
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "model-application-unresolved",
+                unresolved,
+                message: `批量删除被拒（零副作用）：${unresolved.join("、")} 的业务模型记录仍存在但在任何应用树中都找不到节点（AppFunction）——physically_delete 需要 AppFunction id，不能拿业务模型记录 id 猜测。请显式传 applicationCode，或先用 discover_environment 确认归属应用。`,
+            });
+        }
+        const treeRowList = resolvedTrees;
+        // Per-target inbound-reference precheck (ticket 23 semantics, scanned
+        // once per sibling across all batch targets). Siblings INSIDE the batch
+        // are being deleted together and therefore do not block.
+        const batchSet = new Set(targets);
+        const siblings = treeRowList
+            .filter((row) => row.type === "BizModel" && typeof row.code === "string" && !batchSet.has(String(row.code)))
+            .map((row) => ({ schemaCode: String(row.code), name: typeof row.name === "string" && row.name ? row.name : String(row.code) }));
+        const blockedTargets = [];
+        for (const sibling of siblings) {
+            const hitsByTarget = new Map();
+            for (const isPublish of ["false", "true"]) {
+                const listed = await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: sibling.schemaCode, isPublish } });
+                for (const row of wireRows(listed.data)) {
+                    const target = relationTargetOf(row);
+                    if (target === undefined || !batchSet.has(target))
+                        continue;
+                    const code = row.code ?? row.propertyCode;
+                    if (typeof code !== "string")
+                        continue;
+                    const hits = hitsByTarget.get(target) ?? [];
+                    if (!hits.some((field) => field.code === code))
+                        hits.push({ code, type: row.type ?? row.propertyType });
+                    hitsByTarget.set(target, hits);
+                }
+            }
+            for (const [target, fields] of hitsByTarget) {
+                const blocked = blockedTargets.find((entry) => entry.schemaCode === target) ?? { schemaCode: target, referencingModels: [] };
+                blocked.referencingModels.push({ schemaCode: sibling.schemaCode, name: sibling.name, fields });
+                if (!blockedTargets.includes(blocked))
+                    blockedTargets.push(blocked);
+            }
+        }
+        if (blockedTargets.length > 0) {
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "model-referenced-by",
+                blockedTargets,
+                message: `批量删除被拒（零副作用）：${blockedTargets.map((blocked) => `${blocked.schemaCode} 被模型 ${blocked.referencingModels.map((model) => model.schemaCode).join("、")} 的关联字段引用`).join("；")}。依赖倒序清理：把引用方模型一并纳入 schemaCodes（或先删其关联字段）；引用方物理删除的逐列异步级联需 40-60s，完成后再删被引用模型。`,
+            });
+        }
+        if (entries.length === 0) {
+            return { performed: { skipped: "already-absent", alreadyAbsent }, readback: { perCode: Object.fromEntries(targets.map((code) => [code, { absent: true }])), allAbsent: true } };
+        }
+        const performed = await wireCall(session, {
+            path: ENDPOINTS.appPackagePhysicallyDelete,
+            method: "POST",
+            body: entries,
+        });
+        // Per-model absence polling on the authoritative record face (the async
+        // per-column cascade takes 40-60s per model); pending codes carry the
+        // same wait-and-recheck guidance as model.delete.
+        const absentSet = new Set();
+        for (let attempt = 0; attempt < 16 && absentSet.size < entries.length; attempt += 1) {
+            if (attempt > 0)
+                await new Promise((resolve) => setTimeout(resolve, Math.min(1000 * attempt, 4000)));
+            for (const entry of entries) {
+                if (absentSet.has(entry.code))
+                    continue;
+                if ((await readRecord(entry.code)) === null)
+                    absentSet.add(entry.code);
+            }
+        }
+        const afterTree = (await Promise.all([...appsToScan]
+            .filter((appCode) => appCode)
+            .map(async (appCode) => flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode } })).data))))).flat();
+        const perCode = {};
+        for (const code of targets) {
+            if (alreadyAbsent.includes(code)) {
+                perCode[code] = { absent: true };
+                continue;
+            }
+            const absent = absentSet.has(code);
+            const treeNodePending = afterTree.some((row) => row.type === "BizModel" && row.code === code);
+            perCode[code] = absent ? { absent, ...(treeNodePending ? { treeNodePending } : {}) } : { absent, treeNodePending, nextAction: "wait-and-recheck", note: "异步逐列级联实测 40-60s：absent:false 表示该模型的删除级联仍在进行，不是失败。等待约 60s 后重跑 model.deleteMany（幂等，already-absent 短路）复核。" };
+        }
+        const allAbsent = targets.every((code) => perCode[code]?.absent === true);
+        return {
+            performed: { errcode: performed.errcode, deletedIds: entries.map((entry) => entry.id), alreadyAbsent, requested: targets, applicationCode },
+            readback: {
+                perCode,
+                allAbsent,
+                ...(allAbsent ? {} : { nextAction: "wait-and-recheck", note: "部分模型仍在异步级联中；按 perCode 逐项查看，等待约 60s 后重跑（幂等）。" }),
+            },
+        };
+    }, (args) => {
+        const codes = args.schemaCodes;
+        if (!Array.isArray(codes) || codes.length === 0 || new Set(codes).size !== codes.length || codes.some((code) => typeof code !== "string" || code.length === 0)) {
+            throw new ToolRefusalError({ status: "refused", blocker: "model-delete-many-invalid", message: "schemaCodes 必须是非空、去重的模型 code 数组" });
+        }
+    });
+    writeTool(tools, "model.setSummary", MODEL_LANE, MODEL_TOOLS["model.setSummary"].scope, MODEL_TOOLS["model.setSummary"].description, {
+        schemaCode: z.string().min(1),
+        summary: z.string().min(1).describe('数据标题表达式，线上存储形状是 Summary[] JSON（isDataItem 1=表单字段、2=查询字段），如 [{"isDataItem":1,"code":"subject"}]；也接受纯 {字段} 占位串（自动转换为 Summary[]）。含字面文本的模板无法表示会被拒（model-summary-invalid）'),
+    }, async (session, args) => {
+        // 8.6.26 BizSchemaController.updateSummary (decompiled :700-736):
+        // POST bizmodels/update_summary {schemaCode, summary}; the platform
+        // itself requires a non-empty summary (validateNotEmpty) and answers
+        // 300014 BIZ_SCHEMA_NOT_PUBLISHED for a missing schema. Readback is the
+        // sibling GET get_summary face.
+        const summary = normalizeSummaryInput(args.summary);
+        const performed = await wireCall(session, {
+            path: ENDPOINTS.modelUpdateSummary,
+            method: "POST",
+            body: { schemaCode: args.schemaCode, summary },
+        });
+        const readback = await wireCall(session, { path: ENDPOINTS.modelGetSummary, query: { schemaCode: args.schemaCode } });
+        const stored = readback.data ?? "";
+        const storedValid = isCanonicalSummary(stored);
+        return {
+            performed: { errcode: performed.errcode },
+            readback: {
+                summary: stored,
+                normalized: summary,
+                ...(storedValid ? {} : { warning: "读回的 summary 不是合法 Summary[]（平台运行时标题解析会抛反序列化异常 → 该模型 data.save/submit 恒 50000）；用本工具以 Summary[] 或纯 {字段} 串重写修复" }),
+            },
+        };
+    }, (args) => {
+        if (typeof args.summary !== "string" || args.summary.trim().length === 0)
+            throw new ToolRefusalError({ status: "refused", blocker: "model-summary-empty", message: "数据标题 summary 不允许为空（平台 validateNotEmpty 同语义）" });
+        normalizeSummaryInput(args.summary);
+    });
+    writeTool(tools, "model.update", MODEL_LANE, MODEL_TOOLS["model.update"].scope, MODEL_TOOLS["model.update"].description, {
+        schemaCode: z.string().min(1),
+        name: z.string().min(1).optional().describe("新显示名（bizmodels/update 补丁语义，读回 get_all + 应用树节点）"),
+        modelType: z.enum(["LIST", "TREE"]).optional().describe("恒拒（model-type-immutable）：模型类型创建时固化，bizmodels/update 只更新菜单节点显示"),
+    }, async (session, args) => {
+        // Source-pinned contract (BizSchemaController.update, 8.6.26
+        // decompiled :266-305): POST/PUT bizmodels/update with AppFunctionVO —
+        // bizSchemaCode, id (AppFunction node id), name, parentId are ALL
+        // validateNotEmpty-required; the endpoint patches the AppFunction MENU
+        // NODE (setName/setIcon/setModelType...), it does not migrate the
+        // underlying schema (probe evidence: get_all keeps the original type).
+        // So: resolve the tree node for id + parentId, patch the name, and read
+        // the NODE face back (the schema record name may stay unchanged).
+        const resolved = await resolveModelTreeNode(session, args.schemaCode);
+        const node = resolved.node;
+        if (!node)
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "model-update-target-absent",
+                schemaCode: args.schemaCode,
+                message: `模型 ${args.schemaCode} 无应用树节点（bizmodels/update 只更新 AppFunction 菜单节点，id/parentId 均必需）——确认 schemaCode 或先用 model.create`,
+            });
+        if (args.name === undefined)
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "model-update-empty-patch",
+                schemaCode: args.schemaCode,
+                message: "没有可应用的补丁字段——至少提供 name（改名节点显示）；数据标题用 model.setSummary",
+            });
+        const nodeId = typeof node.id === "string" ? node.id : String(node.id ?? "");
+        const parentId = typeof node.parentId === "string" ? node.parentId : String(node.parentId ?? "");
+        if (!nodeId || !parentId)
+            throw new WireError("business", `app tree node for ${args.schemaCode} lacks id/parentId (bizmodels/update requires both)`, 10005);
+        const performed = await wireCall(session, {
+            path: ENDPOINTS.modelUpdate,
+            method: "POST",
+            body: { bizSchemaCode: args.schemaCode, id: nodeId, parentId, name: args.name },
+        });
+        // Authoritative readback: the tree NODE name (the patched face). The
+        // get_all record face is read informationally — the schema record is
+        // NOT migrated by this endpoint (probe evidence).
+        const after = await resolveModelTreeNode(session, args.schemaCode);
+        const nodeAfter = after.node;
+        const record = await wireCall(session, { path: ENDPOINTS.modelGet, query: { schemaCode: args.schemaCode } });
+        const recordName = (record.data ?? {}).name ?? null;
+        const nodeName = typeof nodeAfter?.name === "string" ? nodeAfter.name : null;
+        return {
+            performed: { errcode: performed.errcode },
+            readback: { schemaCode: args.schemaCode, name: nodeName, renamed: nodeName === args.name, recordName, authoritativeFace: "app-tree-node" },
+        };
+    }, (args) => {
+        // `omc call` bypasses zod, so an extra modelType key still reaches here.
+        const raw = args;
+        // Probe evidence (yunshu ledger + ticket 09): bizmodels/update only
+        // updates the app-menu node display — the underlying schema (type, tree
+        // system fields) is FIXED at create. A modelType patch here would look
+        // accepted while get_all keeps the original type: refuse it.
+        if (raw.modelType !== undefined)
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "model-type-immutable",
+                schemaCode: raw.schemaCode,
+                message: "模型类型在创建时固化——bizmodels/update 只更新应用菜单节点显示，不能把底层 schema 从 LIST 迁移为 TREE（get_all 仍返回原类型与树系统字段，live 取证）。要树模型请建新模型",
+            });
+    });
+    registerPackageTool(tools, {
+        name: "configure_model",
+        lane: MODEL_LANE,
+        scope: MODEL_TOOLS["configure_model"].scope,
+        description: MODEL_TOOLS["configure_model"].description,
+        inputSchema: {
+            name: z.string().min(1),
+            code: z.string().min(1),
+            folderId: z.string().optional(),
+            fieldCode: z.string().optional().describe("legacy single-field form: the one field to create (mutually exclusive with fields[])"),
+            fieldName: z.string().optional(),
+            propertyType: propertyTypeArg.optional(),
+            choices: choicesArg,
+            relativeCode: relativeCodeArg,
+            options: fieldOptionsArg.optional(),
+            subFields: subFieldArg,
+            propertyEmpty: z.boolean().optional().describe("legacy single-field form: 数据模型层是否声明不可为空；默认 false。必填/只读请在表单与流程节点配置"),
+            fields: z
+                .array(z.object({
+                code: z.string().min(1),
+                name: z.string().min(1),
+                propertyType: propertyTypeArg,
+                choices: choicesArg,
+                relativeCode: relativeCodeArg,
+                options: fieldOptionsArg.optional(),
+                subFields: subFieldArg,
+                propertyEmpty: z.boolean().optional().describe("数据模型层是否声明不可为空；默认 false。必填/只读请在表单与流程节点配置"),
+            }))
+                .min(1)
+                .optional()
+                .describe("multi-field form: every business field of the model, created in order (replaces fieldCode/fieldName/propertyType)"),
+            publishForm: z.boolean().optional().describe("also draft + publish the model's default form after field.publish, reaching the structurally usable shape in one call"),
+            listview: z
+                .object({
+                fieldCodes: z.array(z.string().min(1)).min(1).describe("列表列（默认视图 code=schemaCode，增量：既有列保留）"),
+                code: z.string().optional().describe("视图 code；省略=默认视图"),
+                replaceColumns: z.boolean().optional().describe("true=整表列替换（未列出的列会被删除）"),
+                hideDefaultSystemFields: z.boolean().optional().describe("true=省略系统列（单号/创建时间等）"),
+            })
+                .optional()
+                .describe("也可在本调用内配置默认列表视图（内部走 listview.configure）；一次到「模型+字段+表单+列表」"),
+            applicationCode: z.string().optional(),
+        },
+        // CFG-naming/CFG-02 parity: refuse an invalid code before a plan
+        // is minted (the executor's model.create/field.create would otherwise
+        // reject a package the human already approved).
+        preflight: (args) => {
+            const entries = fieldEntriesOf(args);
+            const violations = [
+                ...validateBusinessCode(args.code, { kind: "model" }),
+                ...entries.flatMap((entry) => validateBusinessCode(entry.code, { kind: "field" })),
+            ];
+            if (violations.length > 0)
+                throw new ToolRefusalError({ status: "refused", blocker: "business-code-invalid", message: "code 未过出门前校验；按 validation 修正（长度/风格/保留字）", validation: violations });
+            for (const entry of entries)
+                prepareFieldChange(fieldChangeInputOf(args.code, entry));
+        },
+        plan: (args) => {
+            const entries = fieldEntriesOf(args);
+            return {
+                summary: writeSummary("configure_model", args, undefined, "plan"),
+                actions: [
+                    { tool: "model.create", args: { name: args.name, code: args.code, ...(args.folderId ? { folderId: args.folderId } : {}), ...(args.applicationCode ? { applicationCode: args.applicationCode } : {}) } },
+                    ...entries.map((entry) => ({
+                        tool: "field.create",
+                        args: {
+                            schemaCode: args.code,
+                            code: entry.code,
+                            name: entry.name,
+                            propertyType: entry.propertyType,
+                            ...(entry.choices ? { choices: entry.choices } : {}),
+                            ...(entry.relativeCode ? { relativeCode: entry.relativeCode } : {}),
+                            ...(entry.options ? { options: entry.options } : {}),
+                            ...(entry.subFields ? { subFields: entry.subFields } : {}),
+                            ...(entry.propertyEmpty !== undefined ? { propertyEmpty: entry.propertyEmpty } : {}),
+                        },
+                    })),
+                    { tool: "field.publish", args: { schemaCode: args.code, ...(entries.length === 1 ? { code: entries[0].code } : {}) } },
+                    ...(args.publishForm
+                        ? [
+                            { tool: "form.draft", args: { schemaCode: args.code, sheetCode: args.code } },
+                            { tool: "form.publish", args: { schemaCode: args.code, sheetCode: args.code } },
+                        ]
+                        : []),
+                    ...(args.listview
+                        ? [{ tool: "listview.configure", args: { schemaCode: args.code, ...args.listview } }]
+                        : []),
+                ],
+            };
+        },
+        execute: async (session, args) => {
+            const results = [];
+            const entries = fieldEntriesOf(args);
+            const stop = (index, tool, error) => {
+                const envelope = error instanceof ToolRefusalError
+                    ? Object.fromEntries(Object.entries(error.payload).filter(([key]) => key !== "status"))
+                    : error instanceof WireError
+                        ? { blocker: `wire-${error.kind}`, errcode: error.errcode, message: error.message }
+                        : { blocker: "configure-model-step-failed", message: error instanceof Error ? error.message : String(error) };
+                return {
+                    status: "partial",
+                    steps: results,
+                    failedStep: { index, tool },
+                    envelope: { ...envelope, message: `${String(envelope.message ?? "步骤失败")}；后续步骤未执行` },
+                };
+            };
+            const run = async (index, tool, action) => {
+                try {
+                    results.push(await action());
+                    return undefined;
+                }
+                catch (error) {
+                    return stop(index, tool, error);
+                }
+            };
+            const applicationCode = await resolveApplicationCode(session, args.applicationCode);
+            const tree = flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode: applicationCode } })).data));
+            const folder = args.folderId ? tree.find((row) => row.id === args.folderId) : tree.find((row) => row.type !== "BizModel" && typeof row.id === "string");
+            if (!folder?.id)
+                throw new WireError("business", "no folder found for model creation", 302001);
+            // Round 4: resumable. A live run created the model first, then called
+            // configure_model, which unconditionally re-ran model.create, hit the
+            // platform's duplicate-code error (601001), and aborted before ANY field
+            // or form step. The application tree is already in hand, so an existing
+            // model is detected with no extra call: skip the create and continue.
+            const existingModel = tree.find((row) => row.type === "BizModel" && row.code === args.code);
+            let failed;
+            if (existingModel) {
+                results.push({ step: "model.create", skipped: "model-exists", folderId: String(folder.id), readback: { present: true } });
+            }
+            else {
+                failed = await run(0, "model.create", async () => {
+                    const performed = await wireCall(session, { path: ENDPOINTS.modelCreate, method: "POST", body: { appCode: applicationCode, name: args.name, parentId: String(folder.id), modelType: MODEL_CREATE_BODY_DEFAULTS.modelType, bizSchemaCode: args.code, icon: MODEL_CREATE_BODY_DEFAULTS.icon, name_i18n: nameI18nJson(args.name), pcAble: MODEL_CREATE_BODY_DEFAULTS.pcAble, mobileAble: MODEL_CREATE_BODY_DEFAULTS.mobileAble, options: MODEL_CREATE_BODY_DEFAULTS.options } });
+                    const after = await resolveModelTreeNode(session, args.code, applicationCode);
+                    if (!after.node)
+                        throw new ToolRefusalError({ status: "refused", blocker: "model-create-readback-failed", message: `model.create 后权威应用树未读到 ${args.code}` });
+                    return { step: "model.create", errcode: performed.errcode, folderId: String(folder.id), readback: { present: true } };
+                });
+                if (failed)
+                    return failed;
+            }
+            const existingFields = new Map();
+            for (const isPublish of ["false", "true"]) {
+                for (const row of wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: args.code, isPublish } })).data))
+                    existingFields.set(String(row.code ?? row.propertyCode ?? ""), row);
+            }
+            for (const entry of entries) {
+                const input = fieldChangeInputOf(args.code, entry);
+                failed = await run(results.length, "field.create", async () => {
+                    const existing = existingFields.get(entry.code);
+                    if (existing !== undefined) {
+                        if (sameFieldChange(existing, input))
+                            return { step: "field.create", skipped: "field-exists", code: entry.code, readback: { present: true } };
+                        throw new ToolRefusalError({
+                            status: "refused",
+                            blocker: "field-conflict",
+                            schemaCode: args.code,
+                            propertyCode: entry.code,
+                            message: `字段 ${args.code}.${entry.code} 已存在且形状与请求不同；configure_model 只创建缺失字段，不改写既有字段。先核对既有形状（omc call field.list --args '{"schemaCode":"${args.code}","published":false,"code":"${entry.code}"}'），要改写走 field.update，要新字段就换 code`,
+                        });
+                    }
+                    const prepared = prepareFieldChange(input);
+                    const performed = await wireCall(session, { path: ENDPOINTS.fieldCreate, method: "POST", body: fieldChangeWireBody(input, prepared) });
+                    const after = wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: args.code, isPublish: "false" } })).data);
+                    if (!after.some((row) => String(row.code ?? row.propertyCode) === entry.code))
+                        throw new ToolRefusalError({ status: "refused", blocker: "field-create-readback-failed", message: `field.create 后权威草稿字段未读到 ${entry.code}` });
+                    return { step: "field.create", errcode: performed.errcode, code: entry.code, readback: { present: true } };
+                });
+                if (failed)
+                    return failed;
+            }
+            failed = await run(results.length, "field.publish", async () => {
+                const performed = await wireCall(session, { path: ENDPOINTS.fieldPublish, method: "POST", body: { bizSchemaCode: args.code, sendMessage: false } });
+                const after = wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: args.code, isPublish: "true" } })).data);
+                const publishedCodes = new Set(after.map((row) => String(row.code ?? row.propertyCode)));
+                if (entries.some((entry) => !publishedCodes.has(entry.code)))
+                    throw new ToolRefusalError({ status: "refused", blocker: "field-publish-readback-failed", message: "field.publish 后权威发布面缺少请求字段" });
+                return { step: "field.publish", errcode: performed.errcode, scope: "model", readback: { publishedCodes: [...publishedCodes] } };
+            });
+            if (failed)
+                return failed;
+            if (args.publishForm) {
+                // Reuse the proven configure_form paths so the scaffold/publish
+                // semantics are identical to the form lane.
+                failed = await run(results.length, "form.draft", async () => {
+                    const outcome = await executeFormDraftWrite(session, { schemaCode: args.code, sheetCode: args.code, fieldCodes: entries.map((entry) => entry.code) });
+                    if (outcome.readback.hasDraft !== true)
+                        throw new ToolRefusalError({ status: "refused", blocker: "form-draft-readback-failed", message: "form.draft 后权威表单未读到草稿" });
+                    return { step: "form.draft", errcode: outcome.performed.errcode, readback: outcome.readback };
+                });
+                if (failed)
+                    return failed;
+                failed = await run(results.length, "form.publish", async () => {
+                    const outcome = await executeFormPublishWrite(session, { schemaCode: args.code, sheetCode: args.code });
+                    if (outcome.readback.published !== true)
+                        throw new ToolRefusalError({ status: "refused", blocker: "form-publish-readback-failed", message: "form.publish 后权威表单未读到 published=true" });
+                    return { step: "form.publish", errcode: outcome.performed.errcode, readback: outcome.readback };
+                });
+                if (failed)
+                    return failed;
+            }
+            if (args.listview) {
+                // Delegate to the list-view lane's own executor so the gate/readback are
+                // identical to a direct listview.configure.
+                const target = tools.find((tool) => tool.name === "listview.configure");
+                if (!target?.writeExecute)
+                    throw new ToolRefusalError({ status: "refused", blocker: "configure-model-listview-unavailable", message: "listview.configure 未注册写执行" });
+                failed = await run(results.length, "listview.configure", async () => {
+                    const outcome = await target.writeExecute(session, { schemaCode: args.code, ...args.listview });
+                    return { step: "listview.configure", readback: outcome.readback };
+                });
+                if (failed)
+                    return failed;
+            }
+            const published = await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: args.code, isPublish: "true" } });
+            const rows = wireRows(published.data);
+            const publishedCodes = rows.map((row) => String(row.code ?? row.propertyCode ?? ""));
+            const readback = {
+                publishedCodes,
+                ...(entries.length === 1
+                    ? { publishedFieldPresent: publishedCodes.includes(entries[0].code) }
+                    : { publishedFieldsPresent: Object.fromEntries(entries.map((entry) => [entry.code, publishedCodes.includes(entry.code)])) }),
+            };
+            if (args.publishForm) {
+                const sheet = ((await wireCall(session, { path: ENDPOINTS.sheetGet, query: { schemaCode: args.code, sheetCode: args.code } })).data ?? {});
+                readback.formPublished = sheet.published === true;
+            }
+            return { steps: results, readback };
+        },
+        summarize: (args, _outcome, phase) => writeSummary("configure_model", args, undefined, phase),
+    });
+}
+/**
+ * Ticket 47 — the field entries of a configure_model call: the multi-field
+ * `fields[]` array when present, else the legacy single-field triple. The
+ * family gate (assertFieldFamilyAllowed) runs per entry BEFORE the write permission gate
+ * gate, exactly like a bare field.create call.
+ */
+function fieldEntriesOf(args) {
+    const withLegacy = (entry) => ({
+        ...(entry.choices ? { choices: entry.choices } : {}),
+        ...(entry.relativeCode ? { relativeCode: entry.relativeCode } : {}),
+        ...(entry.options ? { options: entry.options } : {}),
+        ...(entry.subFields ? { subFields: entry.subFields } : {}),
+        ...(entry.propertyEmpty !== undefined ? { propertyEmpty: entry.propertyEmpty } : {}),
+    });
+    if (Array.isArray(args.fields) && args.fields.length > 0) {
+        if (args.fieldCode !== undefined || args.fieldName !== undefined || args.propertyType !== undefined)
+            throw new ToolRefusalError({ status: "refused", blocker: "configure-model-fields-exclusive", message: "fields[] 与单字段参数（fieldCode/fieldName/propertyType）互斥；多字段用 fields[]，单字段用旧三元组" });
+        for (const entry of args.fields)
+            assertFieldFamilyAllowed({ ...entry });
+        return args.fields.map((entry) => ({ code: entry.code, name: entry.name, propertyType: entry.propertyType, ...withLegacy(entry) }));
+    }
+    if (typeof args.fieldCode !== "string" || typeof args.fieldName !== "string" || typeof args.propertyType !== "string")
+        throw new ToolRefusalError({
+            status: "refused",
+            blocker: "configure-model-fields-missing",
+            message: "configure_model 需要 fields[]（多字段）或 fieldCode+fieldName+propertyType（单字段）",
+        });
+    const legacy = { code: args.fieldCode, name: args.fieldName, propertyType: args.propertyType, ...withLegacy(args) };
+    assertFieldFamilyAllowed(legacy);
+    return [legacy];
+}
+function fieldChangeInputOf(schemaCode, entry) {
+    return {
+        schemaCode,
+        code: entry.code,
+        name: entry.name,
+        propertyType: entry.propertyType,
+        ...(entry.options ? { options: entry.options } : {}),
+        ...(entry.choices ? { choices: entry.choices } : {}),
+        ...(entry.relativeCode ? { relativeCode: entry.relativeCode } : {}),
+        ...(entry.subFields ? { subFields: entry.subFields } : {}),
+        ...(entry.propertyEmpty !== undefined ? { propertyEmpty: entry.propertyEmpty } : {}),
+    };
+}
+//# sourceMappingURL=model.js.map