@stalfh233/omc-cli 0.6.17 → 0.6.19

package/dist/lanes/field.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { ENDPOINTS } from "../endpoints.js";
 import { fieldChangeWireBody, fieldUpdateWireBody, prepareFieldChange, prepareFieldUpdate } from "../field-change.js";
-import { aggregationSelfSchemaMessage, aggregationTargetsOwnSchema, choicesArg, childColumnsOf, FIELD_PROPERTY_TYPES, fieldOptionsArg, fieldTypeLabel, numericalScaleWarning, propertyTypeArg, relativeCodeArg, stripAggregationPrefix, subFieldArg, SYSTEM_FIELD_CODES, assertFieldFamilyAllowed, assertSelectionChoicesAllowed, } from "../field-families.js";
+import { aggregationSelfSchemaMessage, aggregationTargetsOwnSchema, choicesArg, childColumnsOf, FIELD_PROPERTY_TYPES, fieldOptionsArg, fieldTypeLabel, numericalScaleWarning, propertyTypeArg, relativeCodeArg, stripAggregationPrefix, subFieldArg, SYSTEM_FIELD_CODES, assertFieldFamilyAllowed, assertSelectionChoicesAllowed, assertRelationTargetExists, relationPublishFailureMessage, } from "../field-families.js";
 import { capabilityArg, environmentArg } from "../args.js";
 import { governedRead } from "../read.js";
 import { writeTool } from "../write.js";
@@ -12,10 +12,35 @@ import { defineTool, ToolRefusalError } from "../tool-types.js";
 import { wireCall, wireRows, WireError } from "../wire.js";
 import { executeFormDraftWrite, executeFormPublishWrite, readFormOrNull } from "../form-support.js";
 import { FIELD_LANE_CONTRACT } from "./field-contract.js";
-import { mapBounded } from "../support.js";
+import { flattenTreeRows, mapBounded } from "../support.js";
 import { extractBizObjectPage } from "./runtime-data.js";
 const FIELD_LANE = FIELD_LANE_CONTRACT.lane;
 const FIELD_TOOLS = FIELD_LANE_CONTRACT.tools;
+/** Read actual model schema codes; bare modelList may expose internal node ids. */
+export async function modelSchemaCodes(session) {
+    try {
+        // Relation codes are tenant-global on the platform, not application-scoped.
+        // Enumerate every application for this call only; deliberately do not cache
+        // this merged candidate set across calls because model writes can change it.
+        const apps = wireRows((await wireCall(session, { path: ENDPOINTS.applicationList, query: {} })).data)
+            .map((row) => row.appCode ?? row.code)
+            .filter((code) => typeof code === "string" && code.length > 0);
+        const trees = await mapBounded(apps, 4, async (appCode) => flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode } })).data)));
+        const codes = trees.flat()
+            .filter((row) => row.type === "BizModel")
+            .map((row) => String(row.code ?? row.schemaCode ?? row.bizSchemaCode ?? ""))
+            .filter((code) => code.length > 0);
+        if (codes.length > 0)
+            return codes;
+    }
+    catch {
+        // Fall through to the compatibility endpoint below when the tenant-wide
+        // discovery face is unavailable (older/fake transports).
+    }
+    return wireRows((await wireCall(session, { path: ENDPOINTS.modelList, query: {} })).data)
+        .map((row) => String(row.schemaCode ?? row.bizSchemaCode ?? row.code ?? ""))
+        .filter((code) => code.length > 0);
+}
 async function readFieldRollback(session, args) {
     for (const published of [false, true]) {
         const row = wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: String(args.schemaCode), isPublish: String(published) } })).data).find((entry) => String(entry.code ?? entry.propertyCode) === String(args.code));
@@ -377,6 +402,8 @@ export function registerFieldLane(tools) {
             // wire body (src/field-change.ts), so configure_model and intent share it.
             assertNoSelfSchemaAggregation(args, published);
             await assertNoChildSchemaAggregation(session, args.schemaCode, args.propertyType, args.options ?? {});
+            const models = await modelSchemaCodes(session);
+            assertRelationTargetExists({ ...args }, models);
             // 目标版本决定 optionsSet 形状：8.2 以下要补 optionStructure/treeSelect
             // （cpdocs issue #8：缺键让设计器选项弹窗硬崩）。
             const targetVersion = session.detectedVersion();
@@ -434,6 +461,7 @@ export function registerFieldLane(tools) {
                 readback: {
                     face: "draft",
                     draftFieldPresent: rows.some((row) => (row.code ?? row.propertyCode) === args.code),
+                    ...(prepared.normalized ? { normalized: prepared.normalized } : {}),
                     ...(textLike
                         ? {
                             sideEffectsNote: "平台可能为文本/下拉字段自动生成一条 datarule type1 checkType=4（maxLength≈200）；本调用未显式创建。清理/对账请用 datarule.list 核对，不要把自动行当成重复写入。",
@@ -637,6 +665,15 @@ async function loadFieldRowForUpdate(session, schemaCode, code) {
     const record = rows.find((row) => (row.code ?? row.propertyCode) === code);
     if (!record)
         throw new WireError("business", `field ${code} not found on ${schemaCode}`, 301001);
+    // Some platform list faces are diet projections and omit the display name;
+    // update readback must still preserve the existing name/name_i18n.
+    try {
+        const detail = (await wireCall(session, { path: ENDPOINTS.fieldGet, query: { schemaCode, propertyCode: code } })).data;
+        return { ...detail, ...record, name: record.name ?? detail.name, name_i18n: record.name_i18n ?? detail.name_i18n };
+    }
+    catch {
+        // The detail face is optional; retain the list row.
+    }
     return record;
 }
 async function countModelDataRows(session, schemaCode) {
@@ -1031,6 +1068,58 @@ async function runFieldUpdate(session, args) {
         ...(args.propertyEmpty !== undefined ? { propertyEmpty: args.propertyEmpty } : {}),
     };
     const prepared = prepareFieldUpdate(update);
+    const currentOptions = decodeJsonObjectColumn(record.options, { invalid: "throw", array: "accept", object: "accept" }) ?? {};
+    const requestedChanges = [];
+    const same = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+    if (args.name !== undefined && !same(record.name ?? null, prepared.name ?? args.name))
+        requestedChanges.push("name");
+    if (args.name_i18n !== undefined && !same(record.name_i18n ?? null, prepared.nameI18n ?? args.name_i18n))
+        requestedChanges.push("name_i18n");
+    if (args.relativeCode !== undefined && !same(record.relativeCode ?? null, args.relativeCode))
+        requestedChanges.push("relativeCode");
+    if (args.propertyEmpty !== undefined && !same(record.propertyEmpty ?? null, args.propertyEmpty))
+        requestedChanges.push("propertyEmpty");
+    if (args.options !== undefined) {
+        for (const key of new Set([...Object.keys(currentOptions), ...Object.keys(prepared.options)]))
+            if (!same(currentOptions[key] ?? null, prepared.options[key] ?? null))
+                requestedChanges.push(`options.${key}`);
+    }
+    const mutableOptionKeys = new Set([
+        // These are established field-row update surfaces (tickets 60/61 and the
+        // condition pairing round). Everything else stays fail-closed: the
+        // platform accepts many keys and silently drops them.
+        "dictionaryData", "optionsSet", "mappings", "schemaCode", "queryCode", "displayField", "displayFieldType", "displayFieldFormat",
+        "relativePropertyMatchCode", "relativePropertyCode", "linkMode", "showStyle", "searchFormula", "conditions",
+        "requiredFormula", "readonlyCondition", "displayFormula", "readonlyFormula", "scale",
+    ]);
+    const changedOptionKeys = requestedChanges.filter((field) => field.startsWith("options.")).map((field) => field.slice("options.".length));
+    const immutableOptionKeys = changedOptionKeys.filter((key) => !mutableOptionKeys.has(key));
+    if (immutableOptionKeys.length > 0) {
+        throw new ToolRefusalError({
+            status: "refused",
+            blocker: "field-options-immutable",
+            schemaCode: args.schemaCode,
+            code: args.code,
+            fields: immutableOptionKeys.map((key) => `options.${key}`),
+            mutableFields: [...mutableOptionKeys].map((key) => `options.${key}`),
+            message: `field.update 不允许经此面修改 options.${immutableOptionKeys.join("、")}；这类字段配置会被平台静默丢弃。可改白名单：${[...mutableOptionKeys].map((key) => `options.${key}`).join("、")}。关联结构（schemaCode/queryCode/displayField 等）请 field.delete + field.create 重建；条件请用字段条件配置。`,
+        });
+    }
+    if (args.choices !== undefined && !same(choiceCodesOf(currentOptions) ?? [], [...args.choices]))
+        requestedChanges.push("choices");
+    if (requestedChanges.length === 0) {
+        return {
+            performed: { errcode: 0, unchanged: true },
+            readback: {
+                face: "draft",
+                unchanged: true,
+                changedFields: [],
+                ...(record.name !== undefined ? { name: record.name } : {}),
+                ...(record.name_i18n !== undefined ? { name_i18n: record.name_i18n } : {}),
+                availableFields: ["name", "name_i18n", "options", "choices", "relativeCode", "propertyEmpty"],
+            },
+        };
+    }
     const performed = await wireCall(session, { path: ENDPOINTS.fieldUpdate, method: "POST", body: fieldUpdateWireBody(update, prepared) });
     const readback = await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: args.schemaCode, isPublish: "false" } });
     const after = wireRows(readback.data).find((row) => (row.code ?? row.propertyCode) === args.code);
@@ -1042,7 +1131,9 @@ async function runFieldUpdate(session, args) {
     // failure never hides the field write (it is surfaced as formConditionSync.error).
     let formConditionSync;
     let formConditionSyncError;
-    if (effectiveOptions !== undefined && !prepared.isChildTable) {
+    const conditionKeys = new Set(Object.keys(FORM_CONDITION_OPTION_KEYS));
+    const conditionChanged = effectiveOptions !== undefined && [...conditionKeys].some((key) => !fieldValuesEqual((decodeJsonObjectColumn(record.options, { invalid: "throw", array: "accept", object: "accept" }) ?? {})[key], prepared.options[key]));
+    if (conditionChanged && !prepared.isChildTable) {
         const previous = decodeJsonObjectColumn(record.options, { invalid: "throw", array: "accept", object: "accept" }) ?? {};
         try {
             const sync = await syncFormConditionDataRules(session, args.schemaCode, args.code, previous, prepared.options);
@@ -1058,6 +1149,19 @@ async function runFieldUpdate(session, args) {
     // confirm the write landed — the readback only named the field. Field
     // options are the form-interaction contract (ADR 0005), so read them back.
     const storedOptions = after !== undefined ? parseFieldOptionsForReadback(after.options) : undefined;
+    if (args.options !== undefined && storedOptions && typeof storedOptions === "object" && !Array.isArray(storedOptions)) {
+        const missed = Object.keys(args.options).filter((key) => !same(storedOptions[key] ?? null, prepared.options[key] ?? null));
+        if (missed.length > 0) {
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "field-options-immutable",
+                schemaCode: args.schemaCode,
+                code: args.code,
+                fields: missed.map((key) => `options.${key}`),
+                message: `field.update 的 options.${missed.join("、")} 经此面提交后未生效；options 属于不可经此面修改的字段配置。请按字段族契约使用 field.delete + field.create 重建，或走对应的表单/数据规则工具（不要把 DELIVERED 当成已生效）。`,
+            });
+        }
+    }
     // r32（真机复现：field.update propertyEmpty:true 回 ok/DELIVERED，field.list --full
     // 与 model.inspect 都看不到该值）：平台字段行读面（bizproperty/list 与
     // bizproperty/get）都不回 propertyEmpty，这是**只写属性**。不编造读回值：
@@ -1083,8 +1187,12 @@ async function runFieldUpdate(session, args) {
             face: "draft",
             impact,
             fieldPresent: after !== undefined,
-            ...(after?.name !== undefined ? { name: after.name } : {}),
-            ...(typeof after?.name_i18n === "string" ? { name_i18n: after.name_i18n } : {}),
+            ...(after?.name !== undefined || prepared.name !== undefined || record.name !== undefined || record.propertyName !== undefined
+                ? { name: after?.name ?? prepared.name ?? record.name ?? record.propertyName }
+                : {}),
+            ...(typeof after?.name_i18n === "string" || typeof prepared.nameI18n === "string" || typeof record.name_i18n === "string"
+                ? { name_i18n: after?.name_i18n ?? prepared.nameI18n ?? record.name_i18n }
+                : {}),
             ...(after?.type !== undefined || after?.propertyType !== undefined ? { type: after?.type ?? after?.propertyType } : {}),
             ...(hasReadBackPropertyEmpty ? { propertyEmpty: after?.propertyEmpty } : {}),
             committed: committedKeys,
@@ -1349,6 +1457,13 @@ export async function executeFieldPublish(session, args) {
     const preRead = await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: args.schemaCode, isPublish: "true" } });
     const prePublishedRows = wireRows(preRead.data);
     const prePublished = prePublishedRows.map(codeOf).filter((code) => code.length > 0);
+    // Older servers accept a dangling relation row and only reveal it as the
+    // misleading 300010 at model publish.  Inspect the draft before POST so an
+    // existing poisoned model gets the same field-specific diagnosis as create.
+    const relationCandidates = await modelSchemaCodes(session);
+    const relationFailure = relationPublishFailureMessage(wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: args.schemaCode, isPublish: "false" } })).data), relationCandidates);
+    if (relationFailure)
+        throw new ToolRefusalError({ status: "refused", blocker: "relation-target-not-found", schemaCode: args.schemaCode, message: relationFailure, candidates: relationCandidates.slice(0, 5) });
     // r29e F10/F11：旧短路只看「code 在发布面存在」，改了 options 仍报
     // already-published + verification.ok（假绿）。再比草稿/发布 options 指纹；
     // 不一致就真发布。name/type 仍由 verifyFieldDetails 核对。

package/dist/lanes/folder.js

@@ -5,7 +5,7 @@ import { writeTool } from "../write.js";
 import { wireCall, wireRows } from "../wire.js";
 import { ENDPOINTS } from "../endpoints.js";
 import { capabilityArg, environmentArg } from "../args.js";
-import { resolveApplicationCode } from "../support.js";
+import { jsonBytes, resolveApplicationCode } from "../support.js";
 import { LANES } from "./lane-ids.js";
 import { FOLDER_LANE_CONTRACT } from "./folder-contract.js";
 /**
@@ -38,6 +38,33 @@ import { FOLDER_LANE_CONTRACT } from "./folder-contract.js";
  */
 const LANE = LANES.folder;
 const T = FOLDER_LANE_CONTRACT.tools;
+/**
+ * folder.tree is a node inventory, so its useful inline budget is node-count
+ * first rather than the generic read compact threshold.  Keep the existing
+ * byte guard as a second gate: a pathological 50-node tree still belongs in
+ * the artifact when the node payload itself is too large.
+ */
+export const FOLDER_TREE_INLINE_NODE_LIMIT = 50;
+export const FOLDER_TREE_NODE_INLINE_CEILING_BYTES = 8192;
+export function compactFolderTree(result) {
+    const nodes = Array.isArray(result.nodes) ? result.nodes : undefined;
+    if (nodes === undefined)
+        return { ...result };
+    if (nodes.length <= FOLDER_TREE_INLINE_NODE_LIMIT && jsonBytes(nodes) <= FOLDER_TREE_NODE_INLINE_CEILING_BYTES) {
+        return { ...result, nodes };
+    }
+    const countGate = nodes.length > FOLDER_TREE_INLINE_NODE_LIMIT;
+    const { nodes: _nodes, ...withoutNodes } = result;
+    return {
+        ...withoutNodes,
+        nodesPreview: nodes.slice(0, 5),
+        note: `${String(result.note ?? "")} ${countGate
+            ? `nodes 超过 ${FOLDER_TREE_INLINE_NODE_LIMIT} 条，完整节点已外置到 detailArtifactId；nodesPreview 仅展示前 5 条。`
+            : `nodes 正文超过 ${FOLDER_TREE_NODE_INLINE_CEILING_BYTES}B 字节闸，完整节点已外置到 detailArtifactId；这是字节闸，不是节点数限制。`}`.trim(),
+        // Deliberately omit nodes so governedRead adds the standard empty
+        // placeholder/truncatedKeys while the preview remains available.
+    };
+}
 /**
  * Live 1.1.25 (r28d F2): platform `apppackage/create` seeds one top-level Folder
  * whose `name_i18n.en` is the stable token `defaultGroup` (zh display is「默认分组」).
@@ -202,7 +229,7 @@ function folderTools(tools) {
                         : " applicationExists:false——应用不在 apppackage/list；空树不等于「空应用」。") +
                     " nodeCount/folderCount/modelCount 是全应用聚合，共享环境含其它会话资源；核对自己的资源请按 code 前缀过滤 nodes[]，不要只比计数。",
             };
-        }),
+        }, { compact: compactFolderTree }),
     }));
     writeTool({
         tools,

package/dist/lanes/model-contract.js

@@ -116,7 +116,7 @@ export const MODEL_LANE_CONTRACT = Object.freeze({
         }),
         configure_model: Object.freeze({
             scope: MODEL_SCOPE,
-            description: "High-level: create a model with one field (fieldCode/fieldName/propertyType, legacy) or N fields (fields:[{code,name,propertyType,choices?,relativeCode?,options?}]) and drive it to the structurally usable state (model.create → field.create×N → model-scoped field.publish), optionally drafting and publishing the default form in the same package (publishForm:true → form.draft → form.publish) and configuring the default list view (`listview:{fieldCodes,...}` → listview.configure). Resumable: if the model already exists in the application tree, the model.create step is SKIPPED (reported as `skipped:\"model-exists\"`) and the field/publish steps still run — it does not abort on a pre-existing model. Family gates run per field BEFORE the write permission gate; for the form-only path use configure_form.",
+            description: "High-level: create a model with one field (fieldCode/fieldName/propertyType, legacy) or N fields (fields:[{code,name,propertyType,choices?,relativeCode?,options?}]) and drive it to the structurally usable state (model.create → field.create×N → model-scoped field.publish), optionally drafting and publishing the default form in the same package (publishForm:true → form.draft → form.publish) and configuring the default list view (`listview:{fieldCodes,...}` → listview.configure). Resumable: if the model already exists, the readback declares `created:false` and `mergedChanges`; `createOnly:true` refuses with `model-already-exists`. Model code is tenant-global and cannot be reused across applications. Family gates run per field BEFORE the write permission gate; for the form-only path use configure_form.",
         }),
         "model.deleteMany": Object.freeze({
             scope: MODEL_SCOPE,

package/dist/lanes/model.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { ENDPOINTS } from "../endpoints.js";
-import { assertFieldFamilyAllowed, assertSelectionChoicesAllowed, choicesArg, fieldOptionsArg, nameI18nJson, propertyTypeArg, relationTargetOf, relativeCodeArg, SYSTEM_FIELD_CODES, subFieldArg, } from "../field-families.js";
+import { assertFieldFamilyAllowed, assertSelectionChoicesAllowed, choicesArg, fieldOptionsArg, nameI18nJson, propertyTypeArg, relationTargetOf, relativeCodeArg, SYSTEM_FIELD_CODES, subFieldArg, assertRelationTargetExists, } from "../field-families.js";
+import { modelSchemaCodes } from "./field.js";
 import { fieldChangeWireBody, prepareFieldChange, sameFieldChange } from "../field-change.js";
 import { executeFormDraftWrite, executeFormPublishWrite } from "../form-support.js";
 import { mapBounded } from "../support.js";
@@ -9,7 +10,8 @@ import { writeSummary } from "../human-summary.js";
 import { capabilityArg, environmentArg } from "../args.js";
 import { governedRead, withoutReadbackCache } from "../read.js";
 import { parseToolInput } from "../tool-types.js";
-import { applicationResolutionOf, applicationScopeHint, applicationScopeNotice, flattenTreeRows, resolveApplicationCode, resolveApplicationScope } from "../support.js";
+import { applicationResolutionOf, applicationScopeHint, applicationScopeNotice, flattenTreeRows, resolveApplicationCode } from "../support.js";
+import { resolveValidatedApplicationScope } from "./app.js";
 import { writeTool } from "../write.js";
 import { registerPackageTool } from "../package-tool.js";
 import { defineTool, ToolInputError, ToolRefusalError } from "../tool-types.js";
@@ -251,28 +253,11 @@ export function registerModelLane(tools) {
             capability: capabilityArg,
         },
         handler: async (ctx, args, self) => governedRead(ctx, self, args, async (session) => {
-            const scope = await resolveApplicationScope(session, args.applicationCode);
+            const scope = await resolveValidatedApplicationScope(session, args.applicationCode);
             const applicationCode = scope.code;
             // r29f F6：显式/配置的 applicationCode 若不在 app.list 里，旧路径会把拼写错误
             // 伪装成「该应用没有模型」。先核对租户应用表，未命中即拒（与 discover 的
             // applicationResolution.status 同构）。
-            const availableApps = wireRows((await wireCall(session, { path: ENDPOINTS.applicationList, query: {} })).data)
-                .map((row) => String(row.appCode ?? row.code ?? ""))
-                .filter((code) => code !== "");
-            if (availableApps.length > 0 && !availableApps.includes(applicationCode)) {
-                throw new ToolRefusalError({
-                    status: "refused",
-                    blocker: "app-not-found",
-                    applicationCode,
-                    applicationResolution: {
-                        status: "unresolved",
-                        source: scope.source,
-                        requested: scope.requested ?? applicationCode,
-                        available: availableApps.slice(0, 40),
-                    },
-                    message: `应用「${applicationCode}」不在租户 app.list 里（不是「该应用没有模型」）。可用：${availableApps.slice(0, 12).join("、")}${availableApps.length > 12 ? " 等" : ""}；先 app.list 取正确 applicationCode。`,
-                });
-            }
             const tree = flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode: applicationCode } })).data));
             const all = tree
                 .filter((row) => row.type === "BizModel" && typeof row.code === "string" && row.code)
@@ -361,14 +346,15 @@ export function registerModelLane(tools) {
                 // 节点本来就带 name，与六面同一批并发读，零额外顺序往返。
                 const treeFace = async () => {
                     try {
-                        return { node: (await resolveModelTreeNode(session, schemaCode)).node };
+                        const resolved = await resolveModelTreeNode(session, schemaCode);
+                        return { node: resolved.node, applicationCode: resolved.applicationCode };
                     }
                     catch {
                         return undefined;
                     }
                 };
                 const [fieldFace, formFace, listviewFace, ruleFace, dataruleFace, draftFace, treeRead] = await mapBounded([
-                    () => face("field.list", { schemaCode, published: true, ...(all ? { all: true } : {}) }, faceErrcodes),
+                    () => face("field.list", { schemaCode, published: true, ...(all ? { all: true, full: true } : {}) }, faceErrcodes),
                     () => face("form.get", { schemaCode }),
                     () => face("listview.get", { schemaCode }),
                     () => face("rule.list", { schemaCode }),
@@ -378,10 +364,21 @@ export function registerModelLane(tools) {
                 ], 7, (task) => task());
                 const treeNode = treeRead?.node;
                 const modelName = typeof treeNode?.name === "string" && treeNode.name ? treeNode.name : typeof treeNode?.text === "string" && treeNode.text ? treeNode.text : undefined;
-                const fieldRows = Array.isArray(fieldFace?.fields) ? fieldFace.fields : [];
+                let fieldRows = Array.isArray(fieldFace?.fields) ? fieldFace.fields : [];
+                if (all && typeof fieldFace?.detailFile === "string" && !fieldRows.some((field) => field.options !== undefined)) {
+                    try {
+                        const { readFileSync } = await import("node:fs");
+                        const artifact = JSON.parse(readFileSync(fieldFace.detailFile, "utf8"));
+                        if (Array.isArray(artifact.fields))
+                            fieldRows = artifact.fields;
+                    }
+                    catch {
+                        // Keep the compact field inventory if the nested artifact is unavailable.
+                    }
+                }
                 const fields = fieldRows
                     .filter((field) => all || !SYSTEM_FIELD_CODES.has(String(field.code)))
-                    .map((field) => ({ code: field.code, type: field.type, ...(field.typeName !== undefined ? { typeName: field.typeName } : {}), name: field.name, ...(field.conditions ? { conditions: field.conditions } : {}) }));
+                    .map((field) => ({ code: field.code, type: field.type, ...(field.typeName !== undefined ? { typeName: field.typeName } : {}), name: field.name, ...(field.conditions ? { conditions: field.conditions } : {}), ...(all && field.options !== undefined ? { options: field.options } : {}) }));
                 const form = formFace && formFace.present !== undefined
                     ? { present: formFace.present === true, published: formFace.published === true, controlCount: Array.isArray(formFace.draftControlCodes) ? formFace.draftControlCodes.length : 0 }
                     : undefined;
@@ -454,6 +451,7 @@ export function registerModelLane(tools) {
                 return {
                     code: schemaCode,
                     schemaCode,
+                    ...(typeof treeRead?.applicationCode === "string" && treeRead.applicationCode ? { applicationCode: treeRead.applicationCode } : {}),
                     ...(modelName !== undefined ? { name: modelName } : {}),
                     ...(modelPresent !== undefined ? { modelPresent } : {}),
                     ...(modelPresent === false
@@ -488,10 +486,14 @@ export function registerModelLane(tools) {
                     return result;
                 return {
                     schemaCode: result.schemaCode,
+                    ...(result.applicationCode !== undefined ? { applicationCode: result.applicationCode } : {}),
                     // r35a-F3：compact 投影必须保留 code（model.list 有 code，inspect 此前
                     // 只剩 schemaCode，`--jq '[].code'` 必 pathMiss 白跑一轮）。
                     ...(result.code !== undefined ? { code: result.code } : {}),
                     fieldCodes: (result.fields ?? []).map((field) => field.code),
+                    ...(Array.isArray(result.fields) && result.fields.some((field) => field.options !== undefined)
+                        ? { fields: result.fields }
+                        : {}),
                     form: result.form,
                     listview: result.listview ? { code: result.listview.code, columnCount: result.listview.columnCount } : undefined,
                     ruleCodes: (result.rules ?? []).map((rule) => rule.code),
@@ -533,15 +535,17 @@ export function registerModelLane(tools) {
         // r29a F6：dry-run 必须做与实跑同样的 duplicate 探测，否则会假绿灯。
         dryRunPayload: modelCreateDryRun,
         execute: async (session, args) => {
-            const applicationCode = await resolveApplicationCode(session, args.applicationCode);
+            const applicationScope = await resolveValidatedApplicationScope(session, args.applicationCode);
+            const applicationCode = applicationScope.code;
             const existing = await resolveModelTreeNode(session, args.code, args.applicationCode);
             if (existing.node) {
                 throw new ToolRefusalError({
                     status: "refused",
                     blocker: "model-create-duplicate",
                     schemaCode: args.code,
-                    applicationCode: existing.applicationCode,
-                    message: `模型 ${args.code} 已存在于应用 ${existing.applicationCode} 的应用树中；create 拒绝重复 POST，不能把既有模型证明为本次创建结果`,
+                    requestedApplicationCode: applicationCode,
+                    conflictInApplicationCode: existing.applicationCode,
+                    message: `模型 code 在租户内全局唯一，跨应用同名即冲突：模型 ${args.code} 已存在于应用 ${existing.applicationCode}；create 拒绝重复 POST`,
                 });
             }
             // A tree-miss does NOT prove absence: an orphan mount (row exists in
@@ -1305,6 +1309,7 @@ export function registerModelLane(tools) {
                 .optional()
                 .describe("也可在本调用内配置默认列表视图（内部走 listview.configure）；一次到「模型+字段+表单+列表」"),
             applicationCode: z.string().optional(),
+            createOnly: z.boolean().optional().describe("true=模型已存在时拒绝，不执行字段合并"),
         },
         // CFG-naming/CFG-02 parity: refuse an invalid code before a plan
         // is minted (the executor's model.create/field.create would otherwise
@@ -1358,6 +1363,12 @@ export function registerModelLane(tools) {
         execute: async (session, args) => {
             const results = [];
             const entries = fieldEntriesOf(args);
+            // r37 跨路接线（同扇门）：field.create 单独调用已对关联字段目标写前拒
+            // （relation-target-not-found），configure_model 的字段包不能是例外——
+            // 否则混合包仍会落到裸 300010 把整个模型毒住。
+            const relationCandidates = await modelSchemaCodes(session);
+            for (const entry of entries)
+                assertRelationTargetExists(entry, relationCandidates);
             const stop = (index, tool, error) => {
                 const envelope = error instanceof ToolRefusalError
                     ? Object.fromEntries(Object.entries(error.payload).filter(([key]) => key !== "status"))
@@ -1380,7 +1391,8 @@ export function registerModelLane(tools) {
                     return stop(index, tool, error);
                 }
             };
-            const applicationCode = await resolveApplicationCode(session, args.applicationCode);
+            const applicationScope = await resolveValidatedApplicationScope(session, args.applicationCode);
+            const applicationCode = applicationScope.code;
             const tree = flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode: applicationCode } })).data));
             const folder = args.folderId ? tree.find((row) => row.id === args.folderId) : tree.find((row) => row.type !== "BizModel" && typeof row.id === "string");
             if (!folder?.id)
@@ -1391,6 +1403,10 @@ export function registerModelLane(tools) {
             // or form step. The application tree is already in hand, so an existing
             // model is detected with no extra call: skip the create and continue.
             const existingModel = tree.find((row) => row.type === "BizModel" && row.code === args.code);
+            if (existingModel && args.createOnly === true) {
+                throw new ToolRefusalError({ status: "refused", blocker: "model-already-exists", requestedApplicationCode: applicationCode, conflictInApplicationCode: applicationCode, schemaCode: args.code, message: `模型 code 在租户内全局唯一，跨应用同名即冲突：${args.code} 已存在；createOnly=true 拒绝合并` });
+            }
+            const created = !existingModel;
             let failed;
             if (existingModel) {
                 results.push({ step: "model.create", skipped: "model-exists", folderId: String(folder.id), readback: { present: true } });
@@ -1407,6 +1423,7 @@ export function registerModelLane(tools) {
                     return failed;
             }
             const existingFields = new Map();
+            const mergedFieldCodes = [];
             for (const isPublish of ["false", "true"]) {
                 for (const row of wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: args.code, isPublish } })).data))
                     existingFields.set(String(row.code ?? row.propertyCode ?? ""), row);
@@ -1417,8 +1434,10 @@ export function registerModelLane(tools) {
                 failed = await run(results.length, "field.create", async () => {
                     const existing = existingFields.get(entry.code);
                     if (existing !== undefined) {
-                        if (sameFieldChange(existing, input))
+                        if (sameFieldChange(existing, input)) {
+                            mergedFieldCodes.push(entry.code);
                             return { step: "field.create", skipped: "field-exists", code: entry.code, readback: { present: true } };
+                        }
                         throw new ToolRefusalError({
                             status: "refused",
                             blocker: "field-conflict",
@@ -1432,6 +1451,7 @@ export function registerModelLane(tools) {
                     const after = wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: args.code, isPublish: "false" } })).data);
                     if (!after.some((row) => String(row.code ?? row.propertyCode) === entry.code))
                         throw new ToolRefusalError({ status: "refused", blocker: "field-create-readback-failed", message: `field.create 后权威草稿字段未读到 ${entry.code}` });
+                    mergedFieldCodes.push(entry.code);
                     return { step: "field.create", errcode: performed.errcode, code: entry.code, readback: { present: true } };
                 });
                 if (failed)
@@ -1484,6 +1504,8 @@ export function registerModelLane(tools) {
             const rows = wireRows(published.data);
             const publishedCodes = rows.map((row) => String(row.code ?? row.propertyCode ?? ""));
             const readback = {
+                created,
+                ...(created ? {} : { mergedChanges: { fields: mergedFieldCodes, nameIgnored: args.name !== String(existingModel?.name ?? args.name) } }),
                 publishedCodes,
                 ...(entries.length === 1
                     ? { publishedFieldPresent: publishedCodes.includes(entries[0].code) }

package/dist/lanes/online-js-contract.js

@@ -78,7 +78,7 @@ export const ONLINE_JS_LANE_CONTRACT = Object.freeze({
         }),
         "onlinejs.compose": Object.freeze({
             scope: ONLINE_JS_SCOPE,
-            description: `**本调用 = 改 JS + 立即发布整张表单（等同 form.publish，含布局与按钮）**：它把 source 写进 customScript，然后无条件下一次 bizsheet/publish 把整份草稿提拔成发布面（内部 force:true，即使表单此前已发布也会重推）。所以改完 JS **不需要**再单独 form.publish；反过来，form.publish 只提拔布局草稿、**不碰**在线 JS。要只改不发布必须显式传 publish:false。Compose the Online JS source as the customScript element into the form's draftHtmlJson layout array (then publish, promoting it verbatim to publishedHtmlJson). Core contract: preserve the platform template and only extend customScript.innerHTML — the six-element skeleton includes the ${PLATFORM_LIFECYCLE_WRAPPER_MARKER} lifecycle wrapper; the style, toolbar, template, beforeCustomScript, customScript, and afterCustomScript elements are kept or synthesized with platform defaults, while every layout/control element is preserved. customScript is rebuilt canonically as {tagName:'script', id:'customScript', innerHTML:<platform lifecycle wrapper containing source>, attrs:[]} because the designer requires an ARRAY attrs (e.attrs.some) and tagName, else the Online JS editor fails with t.some is not a function. Drives bizsheet/update + bizsheet/publish; publishedHtmlJson is read back verbatim and SHA-256-fingerprinted so the caller can verify byte equality. Read the EXISTING script first with onlinejs.get (decide replace vs INCREMENTAL from what is actually stored). Never overwrites the layout with a standalone script object or a partial [customScript]-only array (regression for issue 11's root cause). summary:true answers "did it land?" without any HTML/JS body (sha + byte counts + draftPublishedInSync); the default readback dedupes the composed draft and the script when they equal the published face, so the same script is never returned three times.`,
+            description: `**本调用 = 改 JS + 立即发布整张表单**（force:true 重推，不需要再 form.publish——它只提拔布局、不碰 JS）。publish:false 只写草稿；remove:true 或 source:"" 移除脚本。Compose the Online JS source as the customScript element into the form's draftHtmlJson layout array (then publish, promoting it verbatim to publishedHtmlJson). Core contract: preserve the platform template and only extend customScript.innerHTML — the six-element skeleton includes the ${PLATFORM_LIFECYCLE_WRAPPER_MARKER} lifecycle wrapper; the style, toolbar, template, beforeCustomScript, customScript, and afterCustomScript elements are kept or synthesized with platform defaults, while every layout/control element is preserved. customScript is rebuilt canonically as {tagName:'script', id:'customScript', innerHTML:<platform lifecycle wrapper containing source>, attrs:[]} because the designer requires an ARRAY attrs (e.attrs.some) and tagName, else the Online JS editor fails with t.some is not a function. Drives bizsheet/update + bizsheet/publish; publishedHtmlJson is read back verbatim and SHA-256-fingerprinted so the caller can verify byte equality. Read the EXISTING script first with onlinejs.get (decide replace vs INCREMENTAL from what is actually stored). Never overwrites the layout with a standalone script object or a partial [customScript]-only array (regression for issue 11's root cause). summary:true answers "did it land?" without any HTML/JS body (sha + byte counts + draftPublishedInSync); the default readback dedupes the composed draft and the script when they equal the published face, so the same script is never returned three times.`,
         }),
     }),
 });

package/dist/lanes/online-js.js

@@ -77,7 +77,7 @@ export function registerOnlineJsLane(tools) {
             return {
                 schemaCode: args.schemaCode,
                 sheetCode,
-                present: true,
+                present: draft.present || published.present,
                 sheetPublished: sheet.published === true,
                 draft: { ...draft, ...(draft.script === null ? { note: "草稿无 customScript 脚本（尚未 compose 或被清空）" } : {}) },
                 published: { ...published, ...(published.script === null ? { note: "发布面无 customScript 脚本" } : {}) },
@@ -107,13 +107,19 @@ export function registerOnlineJsLane(tools) {
             // 的 sheetCode 都是 optional（省略 = schemaCode）。此前只有这里必填，
             // dry-run 与真写都拒——同一个 lane 两套约定，调用方要白撞一轮才知道。
             sheetCode: z.string().min(1).optional().describe("表单槽位码；省略时默认 = schemaCode（与 form.draft/form.publish 同口径）"),
-            source: z.string().min(1).describe("在线 JS 代码。默认 INCREMENTAL：并入平台 (function(form){…}) 模板的既有脚本，模板与既有注册全部保留；配 replace:true 才是整段替换。脚本不得使用 export/import；事件名必须是平台事件（onLoad/onRendered/onValidate/onPreAction/onCustomAction/onActionDone/onPrintFormDataHandle/onPrintWorkflowLogDataHandle）"),
+            source: z.string().optional().describe("在线 JS 代码。默认 INCREMENTAL：并入平台 (function(form){…}) 模板的既有脚本，模板与既有注册全部保留；配 replace:true 才是整段替换。脚本不得使用 export/import；事件名必须是平台事件（onLoad/onRendered/onValidate/onPreAction/onCustomAction/onActionDone/onPrintFormDataHandle/onPrintWorkflowLogDataHandle）。与 remove:true 二选一；source 为空字符串也表示移除 customScript"),
             replace: z.boolean().optional().describe("true = 以 source 整体替换 customScript（含完整 (function(form){…}) 脚本）。默认 false = 增量并入既有脚本，保留平台模板与既有逻辑"),
-            publish: z.boolean().optional(),
+            remove: z.boolean().optional().describe("true = 显式移除 customScript，使 onlinejs.get 返回 present:false；会写入并按 publish 设置发布。与 source 二选一"),
+            publish: z.boolean().optional().describe("默认 true：写草稿并推发布面；false = 只写草稿不推发布面"),
             summary: z.boolean().optional().describe("true = 只回同步状态（sha/字节数/是否同步/渲染兼容），不回任何 HTML/JS 原文。确认「改动是否生效」用这个；要看原文用 onlinejs.get"),
         },
         execute: async (session, args) => {
             const shouldPublish = args.publish !== false;
+            const removing = args.remove === true || args.source === "";
+            if (!removing && args.source === undefined)
+                throw new Error("必须提供 source，或显式传 remove:true");
+            if (args.remove === true && args.source !== undefined && args.source !== "")
+                throw new Error("remove:true 不能与非空 source 同时传入");
             // r28e F9：和同 lane 其它工具一致——省略 sheetCode 即模型码槽位。
             const targetSheetCode = args.sheetCode ?? args.schemaCode;
             // 1. Read the existing draftHtmlJson.
@@ -133,10 +139,13 @@ export function registerOnlineJsLane(tools) {
             //    existing script and merge the caller's code into it; the platform
             //    default (an empty script) is seeded with the lifecycle scaffold.
             const existingScript = String(existingElements.find((element) => element.id === "customScript")?.innerHTML ?? "");
-            const composedScript = composeCustomScript(existingScript, args.source, args.replace === true ? "replace" : "merge");
+            const composedScript = removing ? "" : composeCustomScript(existingScript, args.source, args.replace === true ? "replace" : "merge");
             // 3. Preserve the platform template read-modify-write: keep the
             //    style/beforeCustomScript/afterCustomScript skeleton and every
             //    layout/control element; customScript carries the MERGED script.
+            // Keep the platform's required six-element skeleton, but an empty
+            // customScript element is semantically absent (onlinejs.get reports
+            // present:false) and remains accepted by the renderer contract.
             const composedElements = composeLayoutElements(existingElements, composedScript);
             assertHtmlRender(JSON.stringify(composedElements), { schemaCode: args.schemaCode, sheetCode: targetSheetCode, face: "composedDraftHtmlJson" }, true);
             // 4. Stringify the COMPLETE element array (never partial).
@@ -176,7 +185,10 @@ export function registerOnlineJsLane(tools) {
             const publishedScript = readCustomScriptSource(publishedRaw).script;
             const customScriptSha256 = createHash("sha256").update(composedScript, "utf8").digest("hex");
             const draftPublishedInSync = publishedScript !== null && publishedScript === composedScript;
-            const htmlRenderCompat = { draft: validateHtmlRender(composedDraftHtml, true), published: validateHtmlRender(publishedRaw, true) };
+            const htmlRenderCompat = {
+                draft: { ...validateHtmlRender(composedDraftHtml, true), note: "仅 HTML 结构不含 JS 运行" },
+                published: { ...validateHtmlRender(publishedRaw, true), note: "仅 HTML 结构不含 JS 运行" },
+            };
             // Live 2026-10-21 (customer): this readback shipped the same ~10KB script
             // three times (composedDraftHtmlJson + publishedHtmlJson + customScript),
             // ~45KB for a call whose only question was "did publish land?" — the
@@ -222,13 +234,18 @@ export function registerOnlineJsLane(tools) {
                     customScriptMatchesPublished: draftPublishedInSync,
                     customScriptMerged: args.replace !== true,
                     htmlRenderCompat,
+                    portalVerificationPlan: ["在门户打开该表单", "触发已绑定的在线 JS 事件", "检查事件产生的副作用字段或校验提示"],
                 },
             };
         },
         preflight: // Refuse a source that cannot run in the script slot (export/import, unknown
         // form.on event) BEFORE the write permission gate. This is the exact
         // class of mistake that blanked a live form page with no harness signal.
-        (args) => lintOnlineJsSource(args.source),
+        (args) => {
+            if (args.remove === true || args.source === "" || args.source === undefined)
+                return;
+            lintOnlineJsSource(args.source);
+        },
         dryRunPayload: // r23 F4：dry-run 必须走与真写相同的 compose 校验路径（含 replace/merge 的
         // wrapper 判定），否则 dry-run 过、真写拒——探针按 dry-run 绿灯写正式调用被拒。
         async (session, args) => {
@@ -238,12 +255,27 @@ export function registerOnlineJsLane(tools) {
             const compat = validateHtmlRender(raw);
             const elements = compat.ok ? parseLayoutElements(raw) : [];
             const existingScript = String(elements.find((element) => element.id === "customScript")?.innerHTML ?? "");
-            const composed = composeCustomScript(existingScript, args.source, args.replace === true ? "replace" : "merge");
+            const removing = args.remove === true || args.source === "";
+            if (!removing && args.source === undefined)
+                throw new Error("必须提供 source，或显式传 remove:true");
+            const composed = removing ? "" : composeCustomScript(existingScript, args.source, args.replace === true ? "replace" : "merge");
+            const composedBytes = Buffer.byteLength(composed, "utf8");
+            const previewSize = 200;
+            const composedPreview = composed.length <= previewSize * 2
+                ? composed
+                : `${composed.slice(0, previewSize)}…${composed.slice(-previewSize)}`;
             return {
                 mode: args.replace === true ? "replace" : "merge",
+                publish: args.publish !== false,
                 wouldChange: composed !== existingScript,
                 composedSha256: createHash("sha256").update(composed, "utf8").digest("hex"),
-                composedBytes: Buffer.byteLength(composed, "utf8"),
+                composedBytes,
+                composedPreview,
+                composedPreviewHeadBytes: Buffer.byteLength(composed.slice(0, previewSize), "utf8"),
+                composedPreviewTailBytes: Buffer.byteLength(composed.slice(-previewSize), "utf8"),
+                composedPreviewTotalBytes: composedBytes,
+                composedPreviewNote: "预览为头/尾各 200 个字符（短文本不截断）；字节数以 UTF-8 提交串对账，未自动补换行或外壳",
+                summary: args.publish === false ? "只写草稿，不推发布面" : "写草稿并推发布面",
                 hint: "dry-run 已执行与真写一致的 compose 校验；该结果即正式调用将落库的脚本形状",
             };
         },
@@ -267,7 +299,7 @@ export function registerOnlineJsLane(tools) {
             inverse: ({ before, args }) => {
                 const source = before?.customScript;
                 if (typeof source !== "string")
-                    return { kind: "irreversible", reason: "before 表单没有可识别的 customScript element，无法构造清空脚本的等价 compose 调用" };
+                    return { kind: "calls", calls: [{ tool: "onlinejs.compose", args: { schemaCode: String(args.schemaCode), sheetCode: String(args.sheetCode ?? args.schemaCode), remove: true, publish: args.publish } }] };
                 return { kind: "calls", calls: [{ tool: "onlinejs.compose", args: { schemaCode: String(args.schemaCode), sheetCode: String(args.sheetCode ?? args.schemaCode), source, replace: true, publish: args.publish } }] };
             },
         },