openxiangda-devkit-core 2.0.0-alpha.29 → 2.0.0-alpha.34

package/dist/compiler/config.js

@@ -0,0 +1,1137 @@
+import { SCHEMA_VERSIONS, nativePlatformCapabilityCatalog, validateDataResource, } from 'openxiangda-contracts';
+import { CronExpressionParser } from 'cron-parser';
+// The compiler owns the application source contract. Devkit and every adapter
+// re-export this module instead of maintaining separate configuration models.
+import { validateWorkflowBinding, validateWorkflowDefinition, } from '../internal/workflow.js';
+export const openXiangdaAppConfigSchema = {
+    $id: 'openxiangda.app-config/v3',
+    type: 'object',
+    additionalProperties: false,
+    required: ['schemaVersion', 'app', 'frontend', 'backend', 'platform'],
+    properties: {
+        schemaVersion: { const: 3 },
+        app: {
+            type: 'object',
+            additionalProperties: false,
+            required: ['code', 'name'],
+            properties: {
+                code: {
+                    type: 'string',
+                    pattern: '^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$',
+                    minLength: 2,
+                    maxLength: 128,
+                },
+                name: { type: 'string', minLength: 1, maxLength: 255 },
+            },
+        },
+        frontend: {
+            type: 'object',
+            additionalProperties: false,
+            required: ['root'],
+            properties: {
+                root: { type: 'string', minLength: 1 },
+                routes: { type: 'array', maxItems: 500, items: { type: 'object' } },
+            },
+        },
+        backend: {
+            type: 'object',
+            additionalProperties: false,
+            required: ['root', 'runtime', 'framework'],
+            properties: {
+                root: { type: 'string', minLength: 1 },
+                runtime: { const: 'node' },
+                framework: { const: 'nestjs' },
+                runMode: { enum: ['shared', 'dedicated'] },
+                secrets: {
+                    type: 'array',
+                    maxItems: 100,
+                    items: {
+                        type: 'object',
+                        additionalProperties: false,
+                        required: ['name', 'env'],
+                        properties: {
+                            name: {
+                                type: 'string',
+                                pattern: '^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$',
+                                maxLength: 128,
+                            },
+                            env: {
+                                type: 'string',
+                                pattern: '^[A-Z][A-Z0-9_]*$',
+                                maxLength: 128,
+                            },
+                            description: { type: 'string', maxLength: 2000 },
+                            required: { type: 'boolean' },
+                        },
+                    },
+                },
+                operations: {
+                    type: 'array',
+                    maxItems: 500,
+                    items: { type: 'object' },
+                },
+            },
+        },
+        platform: {
+            type: 'object',
+            additionalProperties: false,
+            required: ['root'],
+            properties: { root: { type: 'string', minLength: 1 } },
+        },
+        data: {
+            type: 'object',
+            additionalProperties: false,
+            required: ['resources'],
+            properties: {
+                resources: { type: 'array', maxItems: 100, items: { type: 'object' } },
+            },
+        },
+        authz: {
+            type: 'object',
+            additionalProperties: false,
+            required: ['capabilities', 'roles'],
+            properties: {
+                capabilities: {
+                    type: 'array',
+                    maxItems: 2000,
+                    items: { type: 'object' },
+                },
+                roles: { type: 'array', maxItems: 100, items: { type: 'object' } },
+                scopeDimensions: {
+                    type: 'array',
+                    maxItems: 100,
+                    items: {
+                        type: 'object',
+                        additionalProperties: false,
+                        required: ['code', 'name'],
+                        properties: {
+                            code: { type: 'string' },
+                            name: { type: 'string' },
+                            resourceCode: { type: 'string' },
+                            valueType: { enum: ['string', 'uuid'] },
+                            hierarchyMode: { enum: ['flat', 'self_parent'] },
+                            valueSource: {
+                                type: 'object',
+                                additionalProperties: false,
+                                required: ['kind', 'resourceCode', 'labelField'],
+                                properties: {
+                                    kind: { const: 'native_resource' },
+                                    resourceCode: { type: 'string' },
+                                    labelField: { type: 'string' },
+                                    enabledField: { type: 'string' },
+                                },
+                            },
+                        },
+                    },
+                },
+                scopeSources: {
+                    type: 'array',
+                    maxItems: 100,
+                    items: { type: 'object' },
+                },
+                dataPolicies: {
+                    type: 'array',
+                    maxItems: 100,
+                    items: { type: 'object' },
+                },
+                authorizationTransitions: {
+                    type: 'array',
+                    maxItems: 100,
+                    items: { type: 'object' },
+                },
+            },
+        },
+        events: {
+            type: 'object',
+            additionalProperties: false,
+            required: ['subscriptions'],
+            properties: {
+                subscriptions: {
+                    type: 'array',
+                    maxItems: 100,
+                    items: { type: 'object' },
+                },
+                timers: {
+                    type: 'array',
+                    maxItems: 100,
+                    items: { type: 'object' },
+                },
+            },
+        },
+        workflows: {
+            type: 'object',
+            additionalProperties: false,
+            required: ['definitions', 'bindings', 'activations'],
+            properties: {
+                definitions: {
+                    type: 'array',
+                    maxItems: 100,
+                    items: { type: 'object' },
+                },
+                bindings: {
+                    type: 'array',
+                    maxItems: 100,
+                    items: { type: 'object' },
+                },
+                activations: {
+                    type: 'array',
+                    maxItems: 100,
+                    items: { type: 'object' },
+                },
+                providers: {
+                    type: 'array',
+                    maxItems: 100,
+                    items: {
+                        type: 'object',
+                        additionalProperties: false,
+                        required: ['code', 'endpointPath'],
+                        properties: {
+                            code: {
+                                type: 'string',
+                                pattern: '^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$',
+                            },
+                            endpointPath: {
+                                type: 'string',
+                                pattern: '^/[A-Za-z0-9/_-]+$',
+                            },
+                            timeoutMs: { type: 'integer', minimum: 100, maximum: 10000 },
+                        },
+                    },
+                },
+                editableParameters: {
+                    type: 'array',
+                    maxItems: 100,
+                    items: { type: 'object' },
+                },
+            },
+        },
+    },
+};
+function diagnostic(code, message, path, remediation) {
+    return {
+        schemaVersion: SCHEMA_VERSIONS.diagnostic,
+        code,
+        severity: 'error',
+        message,
+        path,
+        source: 'openxiangda-app.config.ts',
+        retryable: false,
+        ...(remediation ? { remediation } : {}),
+    };
+}
+function object(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function string(value) {
+    return typeof value === 'string' ? value.trim() : '';
+}
+export function validateAppConfig(value) {
+    const diagnostics = [];
+    const config = object(value);
+    rejectNativeEnvironmentFields(config, diagnostics);
+    if (config.schemaVersion !== 3) {
+        diagnostics.push(diagnostic('APP_CONFIG_SCHEMA_UNSUPPORTED', 'schemaVersion 必须是 3', 'schemaVersion', '使用 Native 2.0 模板重新生成 openxiangda-app.config.ts；不支持 v2 自动转换'));
+    }
+    const app = object(config.app);
+    const appCode = string(app.code);
+    if (!/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(appCode)) {
+        diagnostics.push(diagnostic('APP_CONFIG_CODE_INVALID', 'app.code 必须是 kebab-case 稳定应用代码', 'app.code'));
+    }
+    if (!string(app.name)) {
+        diagnostics.push(diagnostic('APP_CONFIG_NAME_REQUIRED', 'app.name 必须是非空字符串', 'app.name'));
+    }
+    const frontend = object(config.frontend);
+    const backend = object(config.backend);
+    const platform = object(config.platform);
+    for (const [path, root] of [
+        ['frontend.root', frontend.root],
+        ['backend.root', backend.root],
+        ['platform.root', platform.root],
+    ]) {
+        if (!string(root)) {
+            diagnostics.push(diagnostic('APP_CONFIG_ROOT_REQUIRED', `${path} 必须是非空相对路径`, path));
+        }
+        else if (string(root).startsWith('/') || string(root).includes('..')) {
+            diagnostics.push(diagnostic('APP_CONFIG_ROOT_UNSAFE', `${path} 必须位于工作区内`, path));
+        }
+    }
+    if (backend.runtime !== 'node') {
+        diagnostics.push(diagnostic('APP_CONFIG_BACKEND_RUNTIME_UNSUPPORTED', 'backend.runtime 首期只支持 node', 'backend.runtime'));
+    }
+    if (backend.framework !== 'nestjs') {
+        diagnostics.push(diagnostic('APP_CONFIG_BACKEND_FRAMEWORK_UNSUPPORTED', 'backend.framework 首期只支持 nestjs', 'backend.framework'));
+    }
+    if (backend.runMode !== undefined &&
+        !['shared', 'dedicated'].includes(String(backend.runMode))) {
+        diagnostics.push(diagnostic('APP_CONFIG_BACKEND_RUN_MODE_UNSUPPORTED', 'backend.runMode 必须是 shared 或 dedicated', 'backend.runMode'));
+    }
+    validateFrontendRoutes(frontend.routes, diagnostics);
+    validateBackendOperations(backend.operations, diagnostics);
+    const secretNames = new Set();
+    const secretEnvs = new Set();
+    (Array.isArray(backend.secrets) ? backend.secrets : []).forEach((raw, index) => {
+        const secret = object(raw);
+        const name = string(secret.name);
+        const env = string(secret.env);
+        const path = `backend.secrets[${index}]`;
+        if (!/^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/.test(name)) {
+            diagnostics.push(diagnostic('APP_CONFIG_BACKEND_SECRET_NAME_INVALID', '后端 Secret name 必须是稳定的 kebab/snake-case 逻辑名称', `${path}.name`));
+        }
+        if (!/^[A-Z][A-Z0-9_]*$/.test(env) ||
+            env.startsWith('OPENXIANGDA_') ||
+            ['NODE_ENV', 'PORT'].includes(env)) {
+            diagnostics.push(diagnostic('APP_CONFIG_BACKEND_SECRET_ENV_INVALID', '后端 Secret env 必须是合法大写环境变量，且不能占用平台保留变量', `${path}.env`));
+        }
+        if (secretNames.has(name) || secretEnvs.has(env)) {
+            diagnostics.push(diagnostic('APP_CONFIG_BACKEND_SECRET_DUPLICATE', '后端 Secret 的 name 和 env 必须各自唯一', path));
+        }
+        if (secret.required !== undefined &&
+            typeof secret.required !== 'boolean') {
+            diagnostics.push(diagnostic('APP_CONFIG_BACKEND_SECRET_REQUIRED_INVALID', '后端 Secret required 必须是 boolean', `${path}.required`));
+        }
+        secretNames.add(name);
+        secretEnvs.add(env);
+    });
+    const data = object(config.data);
+    if (config.data !== undefined && !Array.isArray(data.resources)) {
+        diagnostics.push(diagnostic('APP_CONFIG_DATA_RESOURCES_REQUIRED', 'data.resources 必须是数组', 'data.resources'));
+    }
+    else {
+        (Array.isArray(data.resources) ? data.resources : []).forEach((resource, index) => {
+            const resourceDiagnostics = validateDataResource(resource);
+            diagnostics.push(...resourceDiagnostics.map(item => ({
+                ...item,
+                path: `data.resources[${index}]${item.path === '$' ? '' : `.${item.path}`}`,
+                source: 'openxiangda-app.config.ts',
+            })));
+            if (object(resource).appCode &&
+                string(object(resource).appCode) !== appCode) {
+                diagnostics.push(diagnostic('APP_CONFIG_DATA_RESOURCE_APP_MISMATCH', 'DataResource.appCode 必须与 app.code 一致', `data.resources[${index}].appCode`));
+            }
+        });
+    }
+    const authz = object(config.authz);
+    const declaredCapabilities = Array.isArray(authz.capabilities)
+        ? authz.capabilities
+        : [];
+    if (config.authz !== undefined) {
+        if (!Array.isArray(authz.capabilities)) {
+            diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_CAPABILITIES_REQUIRED', 'authz.capabilities 必须是显式 backend/ui capability 数组', 'authz.capabilities'));
+        }
+        validateCapabilityDeclarations(appCode, declaredCapabilities, diagnostics);
+        const roles = Array.isArray(authz.roles) ? authz.roles : [];
+        if (!Array.isArray(authz.roles)) {
+            diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_ROLES_REQUIRED', 'authz.roles 必须是数组', 'authz.roles'));
+        }
+        const roleCodes = new Set();
+        roles.forEach((raw, index) => {
+            const role = object(raw);
+            const code = string(role.code);
+            if (!/^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/.test(code)) {
+                diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_ROLE_CODE_INVALID', '角色 code 必须是稳定的小写标识', `authz.roles[${index}].code`));
+            }
+            else if (roleCodes.has(code)) {
+                diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_ROLE_DUPLICATE', '角色 code 不能重复', `authz.roles[${index}].code`));
+            }
+            roleCodes.add(code);
+            if (!string(role.name) ||
+                !Array.isArray(role.capabilities) ||
+                'isAppSuperAdmin' in role) {
+                diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_ROLE_INVALID', '角色必须声明 name 和 capabilities', `authz.roles[${index}]`));
+            }
+            const capabilities = Array.isArray(role.capabilities)
+                ? role.capabilities
+                : [];
+            const seenCapabilities = new Set();
+            capabilities.forEach((rawCapability, capabilityIndex) => {
+                const capability = string(rawCapability);
+                if (!/^[A-Za-z0-9][A-Za-z0-9:._*-]{0,254}$/.test(capability) ||
+                    seenCapabilities.has(capability)) {
+                    diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_CAPABILITY_INVALID', 'capability 必须是非空稳定标识，且同一角色内不能重复', `authz.roles[${index}].capabilities[${capabilityIndex}]`));
+                }
+                seenCapabilities.add(capability);
+            });
+        });
+        const dimensions = Array.isArray(authz.scopeDimensions)
+            ? authz.scopeDimensions
+            : [];
+        const policies = Array.isArray(authz.dataPolicies)
+            ? authz.dataPolicies
+            : [];
+        for (const [name, values] of [
+            ['scopeDimensions', authz.scopeDimensions],
+            ['scopeSources', authz.scopeSources],
+            ['dataPolicies', authz.dataPolicies],
+        ]) {
+            if (values !== undefined && !Array.isArray(values)) {
+                diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_COLLECTION_INVALID', `authz.${name} 必须是数组`, `authz.${name}`));
+            }
+        }
+        const dataResources = Array.isArray(data.resources) ? data.resources : [];
+        const resourceFieldTypes = new Map(dataResources.map(rawResource => {
+            const resource = object(rawResource);
+            const schema = object(resource.schema);
+            const fields = Array.isArray(schema.fields) ? schema.fields : [];
+            return [
+                string(resource.code),
+                new Map(fields.map(rawField => {
+                    const field = object(rawField);
+                    return [string(field.code), string(field.type)];
+                })),
+            ];
+        }));
+        const resourceFields = new Map([...resourceFieldTypes].map(([resourceCode, fields]) => [
+            resourceCode,
+            new Set(fields.keys()),
+        ]));
+        const dimensionCodes = new Set();
+        dimensions.forEach((raw, index) => {
+            const dimension = object(raw);
+            const code = string(dimension.code);
+            const dimensionPath = `authz.scopeDimensions[${index}]`;
+            if (!/^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/.test(code) ||
+                dimensionCodes.has(code) ||
+                !string(dimension.name) ||
+                (dimension.valueType !== undefined &&
+                    !['string', 'uuid'].includes(string(dimension.valueType))) ||
+                (dimension.hierarchyMode !== undefined &&
+                    !['flat', 'self_parent'].includes(string(dimension.hierarchyMode)))) {
+                diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_DIMENSION_INVALID', 'scope dimension 必须声明唯一 code、name 和受支持的类型', dimensionPath));
+            }
+            if (dimension.valueSource !== undefined) {
+                const valueSource = object(dimension.valueSource);
+                const valueSourcePath = `${dimensionPath}.valueSource`;
+                const valueSourceKeys = Object.keys(valueSource);
+                const allowedKeys = new Set([
+                    'kind',
+                    'resourceCode',
+                    'labelField',
+                    'enabledField',
+                ]);
+                const resourceCode = string(valueSource.resourceCode);
+                const labelField = string(valueSource.labelField);
+                const enabledField = valueSource.enabledField === undefined
+                    ? undefined
+                    : string(valueSource.enabledField);
+                const declaredFieldTypes = resourceFieldTypes.get(resourceCode);
+                if (string(valueSource.kind) !== 'native_resource' ||
+                    string(dimension.valueType) !== 'uuid' ||
+                    !/^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/.test(resourceCode) ||
+                    !/^[A-Za-z][A-Za-z0-9_]{0,62}$/.test(labelField) ||
+                    (enabledField !== undefined &&
+                        !/^[A-Za-z][A-Za-z0-9_]{0,62}$/.test(enabledField)) ||
+                    valueSourceKeys.some(key => !allowedKeys.has(key))) {
+                    diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_DIMENSION_VALUE_SOURCE_INVALID', 'native_resource valueSource 必须声明 UUID 维度、资源、标签字段和可选启用字段', valueSourcePath));
+                }
+                if (!declaredFieldTypes) {
+                    diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_DIMENSION_VALUE_SOURCE_RESOURCE_INVALID', 'native_resource valueSource 必须引用同一应用内已声明的 Data Resource', `${valueSourcePath}.resourceCode`));
+                }
+                else if (!['string', 'text'].includes(declaredFieldTypes.get(labelField) || '') ||
+                    (enabledField !== undefined &&
+                        declaredFieldTypes.get(enabledField) !== 'boolean')) {
+                    diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_DIMENSION_VALUE_SOURCE_FIELD_INVALID', 'valueSource 标签字段必须为 string/text，启用字段必须为 boolean', valueSourcePath));
+                }
+            }
+            dimensionCodes.add(code);
+        });
+        const scopeSources = Array.isArray(authz.scopeSources)
+            ? authz.scopeSources
+            : [];
+        const sourceCodes = new Set();
+        scopeSources.forEach((raw, index) => {
+            const source = object(raw);
+            const sourcePath = `authz.scopeSources[${index}]`;
+            const code = string(source.code);
+            const subject = object(source.subject);
+            const grants = Array.isArray(source.grants) ? source.grants : [];
+            const subjectType = string(subject.type);
+            const roleCode = string(subject.roleCode);
+            const resourceCode = string(source.resourceCode);
+            const declaredFields = resourceFields.get(resourceCode);
+            if (!/^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/.test(code) ||
+                sourceCodes.has(code) ||
+                !string(source.name) ||
+                !/^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/.test(resourceCode) ||
+                !['user', 'role_membership'].includes(subjectType) ||
+                !/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(string(subject.userIdField)) ||
+                (subjectType === 'role_membership' && !roleCodes.has(roleCode)) ||
+                (subjectType === 'user' && Boolean(roleCode)) ||
+                grants.length === 0 ||
+                !['strict', 'last_known_good'].includes(string(source.failureMode))) {
+                diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_SCOPE_SOURCE_INVALID', 'scope source 必须声明唯一 code、Data Resource、主体映射、grant 映射与失败策略', sourcePath));
+            }
+            const grantDimensions = new Set();
+            grants.forEach((rawGrant, grantIndex) => {
+                const grant = object(rawGrant);
+                const dimensionCode = string(grant.dimensionCode);
+                if (!dimensionCodes.has(dimensionCode) ||
+                    grantDimensions.has(dimensionCode) ||
+                    !/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(string(grant.valueField)) ||
+                    (grant.parentValueField !== undefined &&
+                        !/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(string(grant.parentValueField)))) {
+                    diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_SCOPE_SOURCE_GRANT_INVALID', 'scope source grant 必须引用唯一已声明维度及有效字段', `${sourcePath}.grants[${grantIndex}]`));
+                }
+                grantDimensions.add(dimensionCode);
+            });
+            for (const field of [
+                'operationField',
+                'enabledField',
+                'effectiveFromField',
+                'effectiveToField',
+            ]) {
+                if (source[field] !== undefined &&
+                    !/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(string(source[field]))) {
+                    diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_SCOPE_SOURCE_FIELD_INVALID', 'scope source 可选字段必须是有效 Data Resource 字段名', `${sourcePath}.${field}`));
+                }
+            }
+            const referencedFields = [
+                string(subject.userIdField),
+                ...grants.flatMap(rawGrant => {
+                    const grant = object(rawGrant);
+                    return [
+                        string(grant.valueField),
+                        ...(grant.parentValueField === undefined
+                            ? []
+                            : [string(grant.parentValueField)]),
+                    ];
+                }),
+                ...[
+                    source.operationField,
+                    source.enabledField,
+                    source.effectiveFromField,
+                    source.effectiveToField,
+                ]
+                    .filter(value => value !== undefined)
+                    .map(string),
+            ];
+            if (!declaredFields ||
+                referencedFields.some(field => !declaredFields.has(field))) {
+                diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_SCOPE_SOURCE_RESOURCE_INVALID', 'scope source 必须引用已声明 Data Resource 及其真实字段', sourcePath));
+            }
+            sourceCodes.add(code);
+        });
+        const policyCodes = new Set();
+        policies.forEach((raw, index) => {
+            const policy = object(raw);
+            const code = string(policy.code);
+            const rules = Array.isArray(policy.rules) ? policy.rules : [];
+            if (!/^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/.test(code) ||
+                policyCodes.has(code) ||
+                !string(policy.name) ||
+                !['AND', 'OR'].includes(string(policy.matchMode)) ||
+                rules.length === 0) {
+                diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_INVALID', 'data policy 必须声明唯一 code、name、matchMode 和至少一条规则', `authz.dataPolicies[${index}]`));
+            }
+            policyCodes.add(code);
+            if (policy.unrestrictedRoleCodes !== undefined) {
+                const unrestrictedRoleCodes = Array.isArray(policy.unrestrictedRoleCodes)
+                    ? policy.unrestrictedRoleCodes
+                    : [];
+                const seenUnrestrictedRoleCodes = new Set();
+                if (unrestrictedRoleCodes.length === 0) {
+                    diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_UNRESTRICTED_ROLES_INVALID', 'unrestrictedRoleCodes 必须是非空的已声明角色数组', `authz.dataPolicies[${index}].unrestrictedRoleCodes`));
+                }
+                unrestrictedRoleCodes.forEach((rawRoleCode, roleIndex) => {
+                    const roleCode = string(rawRoleCode);
+                    if (!roleCodes.has(roleCode) ||
+                        seenUnrestrictedRoleCodes.has(roleCode)) {
+                        diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_UNRESTRICTED_ROLE_INVALID', 'unrestrictedRoleCodes 只能引用已声明的不重复角色', `authz.dataPolicies[${index}].unrestrictedRoleCodes[${roleIndex}]`));
+                    }
+                    seenUnrestrictedRoleCodes.add(roleCode);
+                });
+            }
+            rules.forEach((rawRule, ruleIndex) => {
+                const rule = object(rawRule);
+                const rulePath = `authz.dataPolicies[${index}].rules[${ruleIndex}]`;
+                const subject = string(rule.subject);
+                const dimensionCode = string(rule.dimensionCode);
+                const relationCode = string(rule.relationCode);
+                const modes = [subject, dimensionCode, relationCode].filter(Boolean);
+                const validCurrentUser = subject === 'current_user';
+                const validDimension = Boolean(dimensionCode) && dimensionCodes.has(dimensionCode);
+                const validRelationship = Boolean(relationCode) && Boolean(string(rule.resourceCode));
+                if (!/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(string(rule.field)) ||
+                    modes.length !== 1 ||
+                    (!validCurrentUser && !validDimension && !validRelationship)) {
+                    diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_RULE_INVALID', '策略规则必须且只能声明 current_user、已声明 dimension 或 relationship 中的一种', rulePath));
+                }
+                if (rule.roleCodes !== undefined) {
+                    const scopedRoleCodes = Array.isArray(rule.roleCodes)
+                        ? rule.roleCodes
+                        : [];
+                    const seenRuleRoleCodes = new Set();
+                    if (scopedRoleCodes.length === 0) {
+                        diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_ROLE_CODES_INVALID', 'roleCodes 必须是非空的已声明角色数组', `${rulePath}.roleCodes`));
+                    }
+                    scopedRoleCodes.forEach((rawRoleCode, roleIndex) => {
+                        const roleCode = string(rawRoleCode);
+                        if (!roleCode ||
+                            !roleCodes.has(roleCode) ||
+                            seenRuleRoleCodes.has(roleCode)) {
+                            diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_ROLE_CODE_INVALID', '数据策略的 roleCodes 只能引用已声明的不重复角色', `${rulePath}.roleCodes[${roleIndex}]`));
+                        }
+                        seenRuleRoleCodes.add(roleCode);
+                    });
+                }
+            });
+        });
+        scopeSources.forEach((rawSource, sourceIndex) => {
+            const source = object(rawSource);
+            if (string(source.failureMode) !== 'last_known_good')
+                return;
+            const sourceDimensions = new Set((Array.isArray(source.grants) ? source.grants : []).map(rawGrant => string(object(rawGrant).dimensionCode)));
+            const matchingRules = policies.flatMap(rawPolicy => {
+                const rules = object(rawPolicy).rules;
+                return (Array.isArray(rules) ? rules : []).filter(rawRule => sourceDimensions.has(string(object(rawRule).dimensionCode)));
+            });
+            if (matchingRules.length === 0 ||
+                matchingRules.some(rawRule => string(object(rawRule).operation) !== 'read')) {
+                diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_SCOPE_SOURCE_LAST_KNOWN_GOOD_UNSAFE', 'last_known_good 只能用于全部显式声明 operation=read 的低风险数据策略；其他场景使用 strict', `authz.scopeSources[${sourceIndex}].failureMode`));
+            }
+        });
+        dataResources.forEach((raw, index) => {
+            const policyCode = string(object(raw).dataPolicyCode);
+            if (policyCode && !policyCodes.has(policyCode)) {
+                diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_DATA_POLICY_NOT_FOUND', `DataResource 引用了未声明的数据策略: ${policyCode}`, `data.resources[${index}].dataPolicyCode`));
+            }
+        });
+        validateAuthorizationTransitions(authz.authorizationTransitions, roleCodes, diagnostics);
+    }
+    validateCapabilityClosure(appCode, config, declaredCapabilities, diagnostics);
+    const events = object(config.events);
+    if (config.events !== undefined && !Array.isArray(events.subscriptions)) {
+        diagnostics.push(diagnostic('APP_CONFIG_EVENT_SUBSCRIPTIONS_REQUIRED', 'events.subscriptions 必须是数组', 'events.subscriptions'));
+    }
+    else {
+        (Array.isArray(events.subscriptions) ? events.subscriptions : []).forEach((item, index) => {
+            const subscription = object(item);
+            const path = `events.subscriptions[${index}]`;
+            if ('environmentKey' in subscription) {
+                diagnostics.push(diagnostic('APP_CONFIG_ENVIRONMENT_OVERRIDE_FORBIDDEN', '事件声明属于环境中立 AppVersion，不能声明 environmentKey', `${path}.environmentKey`));
+            }
+            if (!/^[a-z][a-z0-9-]*$/.test(string(subscription.code))) {
+                diagnostics.push(diagnostic('APP_CONFIG_EVENT_SUBSCRIPTION_CODE_INVALID', '事件订阅 code 必须是 kebab-case', `${path}.code`));
+            }
+            if (!Array.isArray(subscription.eventTypes) ||
+                subscription.eventTypes.length === 0) {
+                diagnostics.push(diagnostic('APP_CONFIG_EVENT_TYPES_REQUIRED', '事件订阅必须声明 eventTypes', `${path}.eventTypes`));
+            }
+            const endpointPath = string(subscription.endpointPath);
+            if (!endpointPath.startsWith('/') ||
+                endpointPath.startsWith('//') ||
+                endpointPath.includes('..')) {
+                diagnostics.push(diagnostic('APP_CONFIG_EVENT_ENDPOINT_INVALID', '事件订阅 endpointPath 必须是应用后端相对路径', `${path}.endpointPath`));
+            }
+        });
+    }
+    (Array.isArray(events.timers) ? events.timers : []).forEach((item, index) => {
+        const timer = object(item);
+        const path = `events.timers[${index}]`;
+        if ('environmentKey' in timer) {
+            diagnostics.push(diagnostic('APP_CONFIG_ENVIRONMENT_OVERRIDE_FORBIDDEN', '定时声明属于环境中立 AppVersion，不能声明 environmentKey', `${path}.environmentKey`));
+        }
+        if (!/^[a-z][a-z0-9-]*$/.test(string(timer.code))) {
+            diagnostics.push(diagnostic('APP_CONFIG_TIMER_CODE_INVALID', '定时订阅 code 必须是 kebab-case', `${path}.code`));
+        }
+        if (!string(timer.eventType) ||
+            !string(timer.cronExpression) ||
+            !string(timer.timezone)) {
+            diagnostics.push(diagnostic('APP_CONFIG_TIMER_SCHEDULE_REQUIRED', '定时订阅必须声明 eventType、六段 cronExpression 和 IANA timezone', path));
+        }
+        const cronExpression = string(timer.cronExpression);
+        const timezone = string(timer.timezone);
+        if (cronExpression && timezone) {
+            try {
+                const first = CronExpressionParser.parse(cronExpression, {
+                    currentDate: '2026-01-01T00:00:00.000Z',
+                    tz: timezone,
+                    strict: true,
+                    hashSeed: string(timer.code),
+                });
+                const firstDueAt = first.next().toDate();
+                const secondDueAt = first.next().toDate();
+                if (secondDueAt.getTime() - firstDueAt.getTime() < 60_000) {
+                    diagnostics.push(diagnostic('APP_CONFIG_TIMER_FREQUENCY_TOO_HIGH', '定时订阅最短间隔为 60 秒', `${path}.cronExpression`));
+                }
+            }
+            catch (error) {
+                diagnostics.push(diagnostic('APP_CONFIG_TIMER_CRON_INVALID', `定时订阅必须使用明确的六段 Cron 与有效 IANA 时区：${error instanceof Error ? error.message : String(error)}`, cronExpression ? `${path}.cronExpression` : `${path}.timezone`));
+            }
+        }
+        if (timer.payload === null ||
+            typeof timer.payload !== 'object' ||
+            Array.isArray(timer.payload)) {
+            diagnostics.push(diagnostic('APP_CONFIG_TIMER_PAYLOAD_INVALID', '定时事件 payload 必须是对象', `${path}.payload`));
+        }
+        else if (Buffer.byteLength(JSON.stringify(timer.payload || {}), 'utf8') > 64 * 1024) {
+            diagnostics.push(diagnostic('APP_CONFIG_TIMER_PAYLOAD_TOO_LARGE', '定时事件 payload 不能超过 64 KiB', `${path}.payload`));
+        }
+    });
+    const workflows = object(config.workflows);
+    if (config.workflows !== undefined &&
+        (!Array.isArray(workflows.definitions) ||
+            !Array.isArray(workflows.bindings) ||
+            !Array.isArray(workflows.activations))) {
+        diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_DECLARATIONS_REQUIRED', 'workflows 必须同时声明 definitions、bindings 和 activations 数组', 'workflows'));
+    }
+    else {
+        const definitions = Array.isArray(workflows.definitions)
+            ? workflows.definitions
+            : [];
+        const bindings = Array.isArray(workflows.bindings) ? workflows.bindings : [];
+        const activations = Array.isArray(workflows.activations)
+            ? workflows.activations
+            : [];
+        const providers = Array.isArray(workflows.providers)
+            ? workflows.providers
+            : [];
+        const editableParameters = Array.isArray(workflows.editableParameters)
+            ? workflows.editableParameters
+            : [];
+        const definitionByKey = new Map();
+        const bindingByKey = new Map();
+        const providerKeys = new Set();
+        providers.forEach((item, index) => {
+            const provider = object(item);
+            const path = `workflows.providers[${index}]`;
+            const code = string(provider.code);
+            const endpointPath = string(provider.endpointPath);
+            const key = code;
+            if ('environmentKey' in provider) {
+                diagnostics.push(diagnostic('APP_CONFIG_ENVIRONMENT_OVERRIDE_FORBIDDEN', 'Workflow Provider 属于环境中立 AppVersion，不能声明 environmentKey', `${path}.environmentKey`));
+            }
+            if (!/^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/.test(code) ||
+                !/^\/[A-Za-z0-9/_-]+$/.test(endpointPath) ||
+                endpointPath.split('/').includes('..')) {
+                diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_PROVIDER_INVALID', 'App Provider 必须声明合法 code 和应用内 endpointPath', path));
+            }
+            if (providerKeys.has(key)) {
+                diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_PROVIDER_DUPLICATE', `App Provider 重复: ${key}`, path));
+            }
+            providerKeys.add(key);
+        });
+        const editableParameterCodes = new Set();
+        editableParameters.forEach((item, index) => {
+            const parameter = object(item);
+            const code = string(parameter.code);
+            const path = `workflows.editableParameters[${index}]`;
+            const allowedRoleCodes = Array.isArray(parameter.allowedRoleCodes)
+                ? parameter.allowedRoleCodes.map(string)
+                : [];
+            const allowedProviderCodes = Array.isArray(parameter.allowedProviderCodes)
+                ? parameter.allowedProviderCodes.map(string)
+                : [];
+            if (!OPERATION_CODE_PATTERN.test(code) ||
+                editableParameterCodes.has(code) ||
+                !string(parameter.workflowCode) ||
+                !string(parameter.bindingKey) ||
+                !string(parameter.label) ||
+                !['role_code', 'user_ids', 'provider_code'].includes(string(parameter.valueType)) ||
+                new Set(allowedRoleCodes).size !== allowedRoleCodes.length ||
+                new Set(allowedProviderCodes).size !== allowedProviderCodes.length) {
+                diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_EDITABLE_PARAMETER_INVALID', 'Workflow editable parameter 必须声明唯一 code、workflow/binding、label 和受支持的 valueType', path));
+            }
+            editableParameterCodes.add(code);
+        });
+        definitions.forEach((item, index) => {
+            const declaration = object(item);
+            const definition = object(declaration.definition);
+            const version = Number(declaration.version);
+            const path = `workflows.definitions[${index}]`;
+            if (!Number.isInteger(version) || version < 1) {
+                diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_VERSION_INVALID', 'Workflow definition version 必须是正整数', `${path}.version`));
+            }
+            for (const error of validateWorkflowDefinition(definition)) {
+                diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_DEFINITION_INVALID', error, path));
+            }
+            const key = `${definition.code}:${version}`;
+            if (definitionByKey.has(key)) {
+                diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_DEFINITION_DUPLICATE', `Workflow definition 重复: ${key}`, path));
+            }
+            definitionByKey.set(key, definition);
+        });
+        bindings.forEach((item, index) => {
+            const declaration = object(item);
+            const binding = object(declaration.binding);
+            const version = Number(declaration.version);
+            const path = `workflows.bindings[${index}]`;
+            if (!Number.isInteger(version) || version < 1) {
+                diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_VERSION_INVALID', 'Workflow binding version 必须是正整数', `${path}.version`));
+            }
+            const key = `${binding.workflowCode}:${version}`;
+            if (bindingByKey.has(key)) {
+                diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_BINDING_DUPLICATE', `Workflow binding 重复: ${key}`, path));
+            }
+            bindingByKey.set(key, binding);
+        });
+        activations.forEach((item, index) => {
+            const activation = object(item);
+            const path = `workflows.activations[${index}]`;
+            const workflowCode = string(activation.workflowCode);
+            if ('environmentKey' in activation) {
+                diagnostics.push(diagnostic('APP_CONFIG_ENVIRONMENT_OVERRIDE_FORBIDDEN', 'Workflow activation 属于环境中立 AppVersion，不能声明 environmentKey', `${path}.environmentKey`));
+            }
+            const definitionVersion = Number(activation.definitionVersion);
+            const bindingVersion = Number(activation.bindingVersion);
+            const definition = definitionByKey.get(`${workflowCode}:${definitionVersion}`);
+            const binding = bindingByKey.get(`${workflowCode}:${bindingVersion}`);
+            if (!definition || !binding) {
+                diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_ACTIVATION_VERSION_NOT_FOUND', 'Workflow activation 引用的 definition 或 binding 版本不存在', path));
+                return;
+            }
+            for (const error of validateWorkflowBinding(definition, binding)) {
+                diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_BINDING_INVALID', error, path));
+            }
+            for (const entry of Object.values(binding.bindings || {})) {
+                if (entry.provider === 'application_provider' &&
+                    !providerKeys.has(entry.providerCode || '')) {
+                    diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_PROVIDER_NOT_FOUND', `Workflow binding 引用了未声明的 App Provider: ${entry.providerCode || ''}`, path));
+                }
+            }
+        });
+        editableParameters.forEach((item, index) => {
+            const parameter = object(item);
+            const workflowCode = string(parameter.workflowCode);
+            const bindingKey = string(parameter.bindingKey);
+            const active = activations.find(item => string(object(item).workflowCode) === workflowCode);
+            const binding = active
+                ? bindingByKey.get(`${workflowCode}:${Number(object(active).bindingVersion)}`)
+                : undefined;
+            if (!binding || !binding.bindings[bindingKey]) {
+                diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_EDITABLE_PARAMETER_BINDING_NOT_FOUND', 'Workflow editable parameter 必须引用活动版本中的 binding key', `workflows.editableParameters[${index}]`));
+            }
+            for (const roleCode of Array.isArray(parameter.allowedRoleCodes)
+                ? parameter.allowedRoleCodes.map(string)
+                : []) {
+                if (!new Set((Array.isArray(authz.roles) ? authz.roles : []).map(item => string(object(item).code))).has(roleCode)) {
+                    diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_EDITABLE_PARAMETER_ROLE_NOT_FOUND', `editable parameter 引用了未声明 role: ${roleCode}`, `workflows.editableParameters[${index}].allowedRoleCodes`));
+                }
+            }
+            for (const providerCode of Array.isArray(parameter.allowedProviderCodes)
+                ? parameter.allowedProviderCodes.map(string)
+                : []) {
+                if (!providerKeys.has(providerCode)) {
+                    diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_EDITABLE_PARAMETER_PROVIDER_NOT_FOUND', `editable parameter 引用了未声明 provider: ${providerCode}`, `workflows.editableParameters[${index}].allowedProviderCodes`));
+                }
+            }
+        });
+    }
+    return diagnostics;
+}
+const CAPABILITY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9:._*-]{0,254}$/;
+const OPERATION_CODE_PATTERN = /^[a-z][a-z0-9]*(?:[-_.][a-z0-9]+)*$/;
+const HTTP_METHODS = new Set(['GET', 'POST', 'PUT', 'PATCH', 'DELETE']);
+const RESERVED_NATIVE_KEYS = new Map([
+    ['environmentKey', 'environmentKey'],
+    ['environmentId', 'environmentId'],
+    ['secretValue', 'Secret value'],
+    ['ciphertext', 'Secret ciphertext'],
+    ['oauthClient', 'OAuth client'],
+    ['oauthClientId', 'OAuth client'],
+    ['oauthClientSecret', 'OAuth client Secret'],
+    ['signingSecret', 'signing Secret'],
+    ['kubernetesNamespace', 'Kubernetes namespace'],
+    ['nodePort', 'Kubernetes NodePort'],
+    ['productionUrl', 'production URL'],
+]);
+function rejectNativeEnvironmentFields(value, diagnostics, path = '$', seen = new Set()) {
+    if (!value || typeof value !== 'object')
+        return;
+    if (seen.has(value))
+        return;
+    seen.add(value);
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => rejectNativeEnvironmentFields(item, diagnostics, `${path}[${index}]`, seen));
+        return;
+    }
+    for (const [key, child] of Object.entries(value)) {
+        const reserved = RESERVED_NATIVE_KEYS.get(key);
+        if (reserved) {
+            diagnostics.push(diagnostic('APP_CONFIG_NATIVE_RUNTIME_FIELD_FORBIDDEN', `${reserved} 属于环境运行态，不能进入环境中立 AppVersion`, path === '$' ? key : `${path}.${key}`));
+            continue;
+        }
+        rejectNativeEnvironmentFields(child, diagnostics, path === '$' ? key : `${path}.${key}`, seen);
+    }
+}
+function validateCapabilityDeclarations(appCode, declarations, diagnostics) {
+    const seen = new Set();
+    declarations.forEach((raw, index) => {
+        const capability = object(raw);
+        const code = string(capability.code);
+        const path = `authz.capabilities[${index}]`;
+        if (!CAPABILITY_PATTERN.test(code) ||
+            !code.startsWith(`app:${appCode}:`) ||
+            seen.has(code) ||
+            !['backend', 'ui'].includes(string(capability.kind)) ||
+            !string(capability.name)) {
+            diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_CAPABILITY_DECLARATION_INVALID', '显式 capability 必须属于当前应用、code 唯一，并声明 backend/ui kind 与 name', path));
+        }
+        if (platformCapabilityCodes(appCode).has(code)) {
+            diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_PLATFORM_CAPABILITY_RESERVED', '平台 capability 由平台保留 catalog 提供，应用不能重复声明', `${path}.code`));
+        }
+        seen.add(code);
+    });
+}
+function validateBackendOperations(rawOperations, diagnostics) {
+    if (rawOperations !== undefined && !Array.isArray(rawOperations)) {
+        diagnostics.push(diagnostic('APP_CONFIG_BACKEND_OPERATIONS_INVALID', 'backend.operations 必须是数组', 'backend.operations'));
+        return;
+    }
+    const codes = new Set();
+    const routes = new Set();
+    (Array.isArray(rawOperations) ? rawOperations : []).forEach((raw, index) => {
+        const operation = object(raw);
+        const code = string(operation.code);
+        const method = string(operation.method).toUpperCase();
+        const route = string(operation.path);
+        const path = `backend.operations[${index}]`;
+        const routeKey = `${method} ${route}`;
+        if (!OPERATION_CODE_PATTERN.test(code) ||
+            codes.has(code) ||
+            !HTTP_METHODS.has(method) ||
+            !validAppPath(route) ||
+            route.startsWith('/__platform/') ||
+            routes.has(routeKey) ||
+            !CAPABILITY_PATTERN.test(string(operation.capability)) ||
+            !isRecord(operation.requestSchema) ||
+            !isRecord(operation.responseSchema)) {
+            diagnostics.push(diagnostic('APP_CONFIG_BACKEND_OPERATION_INVALID', 'App API operation 必须声明唯一 code/route、静态 HTTP path、capability 与请求响应 JSON Schema', path));
+        }
+        codes.add(code);
+        routes.add(routeKey);
+    });
+}
+function validateFrontendRoutes(rawRoutes, diagnostics) {
+    if (rawRoutes !== undefined && !Array.isArray(rawRoutes)) {
+        diagnostics.push(diagnostic('APP_CONFIG_FRONTEND_ROUTES_INVALID', 'frontend.routes 必须是数组', 'frontend.routes'));
+        return;
+    }
+    const routes = Array.isArray(rawRoutes) ? rawRoutes : [];
+    const codes = new Set();
+    const paths = new Set();
+    routes.forEach((raw, index) => {
+        const route = object(raw);
+        const code = string(route.code);
+        const routePath = string(route.path);
+        const path = `frontend.routes[${index}]`;
+        const access = object(route.access);
+        const allowedKeys = new Set([
+            'code',
+            'path',
+            'label',
+            'surface',
+            'navigation',
+            'parentCode',
+            'capability',
+            'access',
+            'pinned',
+            'tabPersistence',
+            'keepAlive',
+        ]);
+        const accessKeys = Object.keys(access);
+        const allOf = Array.isArray(access.allOf) ? access.allOf : [];
+        const anyOf = Array.isArray(access.anyOf) ? access.anyOf : [];
+        const accessInvalid = route.access !== undefined &&
+            (route.capability !== undefined ||
+                !route.access ||
+                typeof route.access !== 'object' ||
+                Array.isArray(route.access) ||
+                accessKeys.some(key => !['allOf', 'anyOf'].includes(key)) ||
+                (allOf.length === 0 && anyOf.length === 0) ||
+                allOf.length > 50 ||
+                anyOf.length > 50 ||
+                allOf.some(value => !CAPABILITY_PATTERN.test(string(value))) ||
+                anyOf.some(value => !CAPABILITY_PATTERN.test(string(value))) ||
+                new Set(allOf.map(string)).size !== allOf.length ||
+                new Set(anyOf.map(string)).size !== anyOf.length);
+        const dynamicRoute = /[:*]/.test(routePath);
+        const routePolicyInvalid = Object.keys(route).some(key => !allowedKeys.has(key)) ||
+            (route.pinned !== undefined && typeof route.pinned !== 'boolean') ||
+            (route.tabPersistence !== undefined &&
+                !['session', 'none'].includes(string(route.tabPersistence))) ||
+            (route.keepAlive !== undefined &&
+                !['none', 'memory'].includes(string(route.keepAlive))) ||
+            (dynamicRoute && route.pinned === true) ||
+            (dynamicRoute && route.tabPersistence === 'session') ||
+            (dynamicRoute && route.keepAlive === 'memory');
+        if (!OPERATION_CODE_PATTERN.test(code) ||
+            codes.has(code) ||
+            !validAppPath(routePath) ||
+            paths.has(routePath) ||
+            !string(route.label) ||
+            !['admin', 'user'].includes(string(route.surface)) ||
+            (route.navigation !== undefined &&
+                !['menu', 'hidden'].includes(string(route.navigation))) ||
+            (route.capability !== undefined &&
+                !CAPABILITY_PATTERN.test(string(route.capability))) ||
+            accessInvalid ||
+            routePolicyInvalid) {
+            diagnostics.push(diagnostic('APP_CONFIG_FRONTEND_ROUTE_INVALID', '前端 route 必须声明唯一 code/path、label、surface、有效访问表达式和有界标签策略；动态 route 不能固定、恢复或保活', path));
+        }
+        codes.add(code);
+        paths.add(routePath);
+    });
+    const parentByCode = new Map();
+    routes.forEach((raw, index) => {
+        const route = object(raw);
+        const code = string(route.code);
+        const parentCode = string(route.parentCode);
+        if (parentCode) {
+            parentByCode.set(code, parentCode);
+            if (!codes.has(parentCode) || parentCode === code) {
+                diagnostics.push(diagnostic('APP_CONFIG_FRONTEND_ROUTE_PARENT_INVALID', 'parentCode 必须引用另一个已声明 route', `frontend.routes[${index}].parentCode`));
+            }
+        }
+    });
+    for (const code of codes) {
+        const visited = new Set();
+        let current = code;
+        while (current && parentByCode.has(current)) {
+            if (visited.has(current)) {
+                diagnostics.push(diagnostic('APP_CONFIG_FRONTEND_ROUTE_CYCLE', `route parentCode 形成循环: ${code}`, 'frontend.routes'));
+                break;
+            }
+            visited.add(current);
+            current = parentByCode.get(current);
+        }
+    }
+}
+function validateAuthorizationTransitions(rawTransitions, _roleCodes, diagnostics) {
+    if (rawTransitions !== undefined && !Array.isArray(rawTransitions)) {
+        diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_TRANSITIONS_INVALID', 'authz.authorizationTransitions 必须是数组', 'authz.authorizationTransitions'));
+        return;
+    }
+    const digests = new Set();
+    (Array.isArray(rawTransitions) ? rawTransitions : []).forEach((raw, index) => {
+        const transition = object(raw);
+        const digest = string(transition.fromAuthzDigest);
+        const path = `authz.authorizationTransitions[${index}]`;
+        const removeRoles = Array.isArray(transition.removeRoleCodes)
+            ? transition.removeRoleCodes.map(string)
+            : [];
+        const removeCapabilities = Array.isArray(transition.removeCapabilityCodes)
+            ? transition.removeCapabilityCodes.map(string)
+            : [];
+        if (!/^[0-9a-f]{64}$/.test(digest) ||
+            digests.has(digest) ||
+            !string(transition.reason) ||
+            new Set(removeRoles).size !== removeRoles.length ||
+            new Set(removeCapabilities).size !== removeCapabilities.length) {
+            diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_TRANSITION_INVALID', '授权 transition 必须按来源摘要唯一，并明确不重复的移除项和 reason', path));
+        }
+        digests.add(digest);
+    });
+}
+function validateCapabilityClosure(appCode, config, declarations, diagnostics) {
+    const catalog = new Set(platformCapabilityCodes(appCode));
+    for (const raw of declarations)
+        catalog.add(string(object(raw).code));
+    const data = object(config.data);
+    const catalogOwners = new Map();
+    for (const raw of declarations) {
+        const code = string(object(raw).code);
+        if (code)
+            catalogOwners.set(code, 'authz.capabilities');
+    }
+    for (const rawResource of Array.isArray(data.resources) ? data.resources : []) {
+        const resource = object(rawResource);
+        const resourceOwner = `data.resources.${string(resource.code)}`;
+        Object.values(object(resource.capabilities)).forEach(value => {
+            const code = string(value);
+            registerCapabilityOwner(code, resourceOwner, catalogOwners, diagnostics);
+            catalog.add(code);
+        });
+        Object.values(object(resource.fieldPolicies)).forEach(rawPolicy => {
+            const policy = object(rawPolicy);
+            for (const key of ['read', 'create', 'update', 'write']) {
+                for (const value of Array.isArray(policy[key]) ? policy[key] : []) {
+                    const code = string(value);
+                    registerCapabilityOwner(code, resourceOwner, catalogOwners, diagnostics);
+                    catalog.add(code);
+                }
+            }
+        });
+    }
+    const references = [];
+    const authz = object(config.authz);
+    (Array.isArray(authz.roles) ? authz.roles : []).forEach((rawRole, index) => {
+        const role = object(rawRole);
+        (Array.isArray(role.capabilities) ? role.capabilities : []).forEach((value, capabilityIndex) => references.push({
+            capability: string(value),
+            path: `authz.roles[${index}].capabilities[${capabilityIndex}]`,
+        }));
+    });
+    const backend = object(config.backend);
+    (Array.isArray(backend.operations) ? backend.operations : []).forEach((rawOperation, index) => references.push({
+        capability: string(object(rawOperation).capability),
+        path: `backend.operations[${index}].capability`,
+    }));
+    const frontend = object(config.frontend);
+    (Array.isArray(frontend.routes) ? frontend.routes : []).forEach((rawRoute, index) => {
+        const route = object(rawRoute);
+        const capability = string(route.capability);
+        if (capability) {
+            references.push({
+                capability,
+                path: `frontend.routes[${index}].capability`,
+            });
+        }
+        const access = object(route.access);
+        for (const key of ['allOf', 'anyOf']) {
+            const values = Array.isArray(access[key]) ? access[key] : [];
+            values.forEach((value, capabilityIndex) => references.push({
+                capability: string(value),
+                path: `frontend.routes[${index}].access.${key}[${capabilityIndex}]`,
+            }));
+        }
+    });
+    for (const reference of references) {
+        if (!catalog.has(reference.capability) ||
+            (!reference.capability.startsWith(`app:${appCode}:`) &&
+                !platformCapabilityCodes(appCode).has(reference.capability))) {
+            diagnostics.push(diagnostic('APP_CONFIG_CAPABILITY_CLOSURE_FAILED', `引用了未声明、跨应用或非平台保留 capability: ${reference.capability}`, reference.path));
+        }
+    }
+}
+function registerCapabilityOwner(code, owner, owners, diagnostics) {
+    if (!code)
+        return;
+    const existing = owners.get(code);
+    if (existing && existing !== owner) {
+        diagnostics.push(diagnostic('APP_CONFIG_CAPABILITY_OWNER_CONFLICT', `capability 只能由一个 catalog owner 定义: ${code}`, owner));
+        return;
+    }
+    owners.set(code, owner);
+}
+function platformCapabilityCodes(appCode) {
+    return new Set(nativePlatformCapabilityCatalog(appCode).map(item => item.code));
+}
+function validAppPath(value) {
+    return (value.startsWith('/') &&
+        !value.startsWith('//') &&
+        !value.includes('..') &&
+        !value.includes('?') &&
+        !value.includes('#') &&
+        value.length <= 512);
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+export class AppConfigValidationError extends Error {
+    diagnostics;
+    code = 'OPENXIANGDA_APP_CONFIG_INVALID';
+    constructor(diagnostics) {
+        super(diagnostics.map(item => `${item.path}: ${item.message}`).join('; '));
+        this.diagnostics = diagnostics;
+        this.name = 'AppConfigValidationError';
+    }
+}
+export function defineOpenXiangdaApp(config) {
+    const diagnostics = validateAppConfig(config);
+    if (diagnostics.length > 0)
+        throw new AppConfigValidationError(diagnostics);
+    return Object.freeze(config);
+}
+//# sourceMappingURL=config.js.map