openxiangda-devkit-core 2.0.0-alpha.72 → 2.0.0-alpha.75

package/dist/compiler/config.js

@@ -1,7 +1,7 @@
 import { SCHEMA_VERSIONS, DATA_FIELD_TYPES, PLATFORM_EVENT_TYPES_V2, nativePlatformCapabilityCatalog, validateDataResource, } from 'openxiangda-contracts';
 import { Ajv2020 } from 'ajv/dist/2020.js';
 import { CronExpressionParser } from 'cron-parser';
-import { fieldNullable, isGeneratedField } from './field-codec.js';
+import { fieldNullable, supportsGeneratedMutation, } from './field-codec.js';
 import { supportsFilter, supportsSearch, supportsSort, } from './field-query-plan.js';
 import { physicalPlanForField } from './field-physical-plan.js';
 import { SEMANTIC_FIELD_PATH_PATTERN, semanticFieldPathRoot, validateAuthzSemanticBindings, } from './field-policy-path.js';
@@ -19,6 +19,150 @@ const DATE_TRIGGER_RESERVED_DATA_FIELDS = new Set([
     'dueAt',
 ]);
 const APP_DATA_FIELD_TYPES = new Set(DATA_FIELD_TYPES);
+function adminNavigationItem(page, options = {}) {
+    return Object.freeze({ page: Object.freeze(page), ...options });
+}
+/** Explicitly owns the complete admin menu; the compiler never appends pages. */
+export function defineAdminNavigation(groups) {
+    return Object.freeze(groups.map(group => Object.freeze({
+        ...group,
+        items: Object.freeze(group.items.map(item => Object.freeze({ ...item }))),
+    })));
+}
+export function adminNavigationGroup(code, label, items, options = {}) {
+    return Object.freeze({ code, label, items: Object.freeze([...items]), ...options });
+}
+export function adminResourcePage(resourceCode, options) {
+    return adminNavigationItem({ kind: 'resource', resourceCode }, options);
+}
+export function adminOperationPage(routeCode, options) {
+    return adminNavigationItem({ kind: 'operation', routeCode }, options);
+}
+export function adminApplicationTodoCenterPage(options) {
+    return adminNavigationItem({ kind: 'application-todo-center' }, options);
+}
+export function adminWorkflowWorkCenterPage(options) {
+    return adminNavigationItem({ kind: 'workflow-work-center' }, options);
+}
+export function adminWorkflowLaunchPage(workflowCode, options) {
+    return adminNavigationItem({ kind: 'workflow-launch', workflowCode }, options);
+}
+/**
+ * Produces a deterministic one-time authoring suggestion for tooling. The
+ * compiler never calls this function and never mutates a saved declaration.
+ */
+export function suggestAdminNavigation(config) {
+    const groups = [];
+    const resources = [...(config.data?.resources || [])]
+        .filter(resource => resource.surface?.generated?.list !== false)
+        .sort((left, right) => left.code < right.code ? -1 : left.code > right.code ? 1 : 0);
+    if (resources.length > 0) {
+        groups.push(adminNavigationGroup('data-management', '数据管理', resources.map(resource => adminResourcePage(resource.code, { label: resource.name })), { icon: 'database', order: 100 }));
+    }
+    const routes = [...(config.frontend.routes || [])]
+        .filter(route => route.surface === 'admin' && !/[:*]/.test(route.path))
+        .sort((left, right) => left.code < right.code ? -1 : left.code > right.code ? 1 : 0);
+    if (routes.length > 0) {
+        groups.push(adminNavigationGroup('business-operations', '业务操作', routes.map(route => adminOperationPage(route.code, { label: route.label })), { icon: 'operations', order: 200 }));
+    }
+    const workflowCodes = [
+        ...new Set((config.workflows?.definitions || []).map(declaration => declaration.definition.code)),
+    ].sort();
+    const workflowItems = [];
+    if (workflowCodes.length > 0) {
+        workflowItems.push(adminWorkflowWorkCenterPage({ label: '我的审批' }));
+    }
+    for (const code of workflowCodes) {
+        const declarations = (config.workflows?.definitions || []).filter(declaration => declaration.definition.code === code);
+        const activeVersion = config.workflows?.activations.find(activation => activation.workflowCode === code)?.definitionVersion;
+        const selected = declarations.find(declaration => declaration.version === activeVersion) ||
+            [...declarations].sort((left, right) => right.version - left.version)[0];
+        if (selected?.launch?.mode === 'standalone') {
+            workflowItems.push(adminWorkflowLaunchPage(code, {
+                label: `发起${selected.definition.title}`,
+            }));
+        }
+    }
+    if (workflowItems.length > 0) {
+        groups.push(adminNavigationGroup('workflow-center', '流程中心', workflowItems, {
+            icon: 'workflow',
+            order: 300,
+        }));
+    }
+    return defineAdminNavigation(groups);
+}
+function renderAdminNavigationOptions(options) {
+    const entries = [
+        ...(options.label !== undefined
+            ? [`label: ${JSON.stringify(options.label)}`]
+            : []),
+        ...(options.icon !== undefined
+            ? [`icon: ${JSON.stringify(options.icon)}`]
+            : []),
+        ...(options.order !== undefined ? [`order: ${options.order}`] : []),
+    ];
+    return entries.length > 0 ? `{ ${entries.join(', ')} }` : undefined;
+}
+/**
+ * Renders the deterministic proposal as a typed expression that an AI author
+ * can copy once into frontend.admin.navigation and then edit normally.
+ */
+export function renderAdminNavigationSuggestion(config) {
+    const navigation = suggestAdminNavigation(config);
+    const imports = new Set(['defineAdminNavigation']);
+    const groups = navigation.map(group => {
+        imports.add('adminNavigationGroup');
+        const items = group.items.map(item => {
+            const options = renderAdminNavigationOptions(item);
+            let expression;
+            switch (item.page.kind) {
+                case 'resource':
+                    imports.add('adminResourcePage');
+                    expression = `adminResourcePage(${JSON.stringify(item.page.resourceCode)}${options ? `, ${options}` : ''})`;
+                    break;
+                case 'operation':
+                    imports.add('adminOperationPage');
+                    expression = `adminOperationPage(${JSON.stringify(item.page.routeCode)}${options ? `, ${options}` : ''})`;
+                    break;
+                case 'application-todo-center':
+                    imports.add('adminApplicationTodoCenterPage');
+                    expression = `adminApplicationTodoCenterPage(${options || ''})`;
+                    break;
+                case 'workflow-work-center':
+                    imports.add('adminWorkflowWorkCenterPage');
+                    expression = `adminWorkflowWorkCenterPage(${options || ''})`;
+                    break;
+                case 'workflow-launch':
+                    imports.add('adminWorkflowLaunchPage');
+                    expression = `adminWorkflowLaunchPage(${JSON.stringify(item.page.workflowCode)}${options ? `, ${options}` : ''})`;
+                    break;
+            }
+            return `      ${expression},`;
+        });
+        const options = renderAdminNavigationOptions({
+            icon: group.icon,
+            order: group.order,
+        });
+        return [
+            '  adminNavigationGroup(',
+            `    ${JSON.stringify(group.code)},`,
+            `    ${JSON.stringify(group.label)},`,
+            '    [',
+            ...items,
+            '    ],',
+            ...(options ? [`    ${options}`] : []),
+            '  ),',
+        ].join('\n');
+    });
+    return {
+        module: 'openxiangda/config',
+        imports: [...imports].sort(),
+        proposal: navigation,
+        expression: ['defineAdminNavigation([', ...groups, '])'].join('\n'),
+        groupCount: navigation.length,
+        itemCount: navigation.reduce((count, group) => count + group.items.length, 0),
+    };
+}
 const authorizationProjectionFieldPathSchema = {
     type: 'string',
     pattern: '^[A-Za-z_][A-Za-z0-9_]{0,127}(?:\\.(?:value|snapshot\\.[A-Za-z_][A-Za-z0-9_]{0,127}))?$',
@@ -625,6 +769,7 @@ export function validateAppConfig(value) {
         diagnostics.push(diagnostic('APP_CONFIG_BACKEND_RESOURCE_PROFILE_UNSUPPORTED', 'backend.resourceProfile 必须是 light 或 standard', 'backend.resourceProfile'));
     }
     validateFrontendRoutes(frontend.routes, diagnostics);
+    validateAdminNavigation(config, diagnostics);
     validatePerspectives(config.perspectives, object(config.authz).roles, diagnostics);
     const declaredResourceCodes = new Set((Array.isArray(object(config.data).resources)
         ? object(config.data).resources
@@ -765,6 +910,24 @@ export function validateAppConfig(value) {
         if (!Array.isArray(authz.roles)) {
             diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_ROLES_REQUIRED', 'authz.roles 必须是数组', 'authz.roles'));
         }
+        const forbiddenNativeMutationCapabilities = new Map();
+        for (const rawResource of Array.isArray(data.resources)
+            ? data.resources
+            : []) {
+            const resource = object(rawResource);
+            const mutationOwner = string(object(resource.surface).mutationOwner) || 'native';
+            if (mutationOwner === 'native')
+                continue;
+            for (const operation of ['create', 'update', 'delete']) {
+                const capability = string(object(resource.capabilities)[operation]);
+                if (capability) {
+                    forbiddenNativeMutationCapabilities.set(capability, {
+                        resourceCode: string(resource.code),
+                        operation,
+                    });
+                }
+            }
+        }
         const roleCodes = new Set();
         roles.forEach((raw, index) => {
             const role = object(raw);
@@ -791,6 +954,10 @@ export function validateAppConfig(value) {
                     seenCapabilities.has(capability)) {
                     diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_CAPABILITY_INVALID', 'capability 必须是非空稳定标识，且同一角色内不能重复', `authz.roles[${index}].capabilities[${capabilityIndex}]`));
                 }
+                const forbiddenMutation = forbiddenNativeMutationCapabilities.get(capability);
+                if (forbiddenMutation) {
+                    diagnostics.push(diagnostic('APP_CONFIG_DATA_RESOURCE_NATIVE_MUTATION_GRANT_FORBIDDEN', `${forbiddenMutation.resourceCode} 的 ${forbiddenMutation.operation} 由非 Native owner 管理，应用角色不能获得对应 Native Data capability`, `authz.roles[${index}].capabilities[${capabilityIndex}]`));
+                }
                 seenCapabilities.add(capability);
             });
         });
@@ -1580,6 +1747,10 @@ export function validateAppConfig(value) {
         const editableParameters = Array.isArray(workflows.editableParameters)
             ? workflows.editableParameters
             : [];
+        const frontendRoutesByCode = new Map((Array.isArray(frontend.routes) ? frontend.routes : []).map(routeValue => {
+            const route = object(routeValue);
+            return [string(route.code), route];
+        }));
         const definitionByKey = new Map();
         const bindingByKey = new Map();
         const providerKeys = new Set();
@@ -1630,9 +1801,62 @@ export function validateAppConfig(value) {
             const definition = object(declaration.definition);
             const version = Number(declaration.version);
             const path = `workflows.definitions[${index}]`;
+            const launch = object(declaration.launch);
+            if (Object.keys(declaration).some(key => !['version', 'definition', 'launch', 'detailRouteCode'].includes(key))) {
+                diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_DEFINITION_DECLARATION_INVALID', 'Workflow definition declaration 只能声明 version、definition、launch 和 detailRouteCode', path));
+            }
+            if (declaration.launch !== undefined &&
+                (Object.keys(launch).some(key => key !== 'mode') ||
+                    ![
+                        'standalone',
+                        'custom-page',
+                        'hidden-handoff',
+                        'work-center-only',
+                    ].includes(string(launch.mode)))) {
+                diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_LAUNCH_MODE_INVALID', 'Workflow launch.mode 必须是 standalone、custom-page、hidden-handoff 或 work-center-only', `${path}.launch.mode`));
+            }
+            if (declaration.detailRouteCode !== undefined) {
+                const detailRouteCode = object(declaration.detailRouteCode);
+                const desktopCode = string(detailRouteCode.desktop);
+                const mobileCode = string(detailRouteCode.mobile);
+                if (Object.keys(detailRouteCode).some(key => !['desktop', 'mobile'].includes(key)) ||
+                    !OPERATION_CODE_PATTERN.test(desktopCode) ||
+                    !OPERATION_CODE_PATTERN.test(mobileCode) ||
+                    desktopCode === mobileCode) {
+                    diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_DETAIL_ROUTE_INVALID', 'detailRouteCode 必须声明两个不同且合法的 desktop/mobile route code', `${path}.detailRouteCode`));
+                }
+                else {
+                    for (const [device, code, surface] of [
+                        ['desktop', desktopCode, 'admin'],
+                        ['mobile', mobileCode, 'user'],
+                    ]) {
+                        const route = frontendRoutesByCode.get(code);
+                        const routePointer = `${path}.detailRouteCode.${device}`;
+                        if (!route) {
+                            diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_DETAIL_ROUTE_REFERENCE_MISSING', `detailRouteCode.${device} 必须引用已声明 frontend route`, routePointer));
+                            continue;
+                        }
+                        if (string(route.surface) !== surface) {
+                            diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_DETAIL_ROUTE_SURFACE_INVALID', `detailRouteCode.${device} 必须引用 ${surface} surface`, routePointer));
+                        }
+                        const parameters = [
+                            ...string(route.path).matchAll(/:([A-Za-z][A-Za-z0-9_]*)/g),
+                        ].map(match => match[1]);
+                        if (string(route.path).includes('*') ||
+                            parameters.length !== 1 ||
+                            parameters[0] !== 'instanceId') {
+                            diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_DETAIL_ROUTE_PATH_INVALID', `detailRouteCode.${device} 路由必须且只能声明 :instanceId 动态参数`, routePointer));
+                        }
+                    }
+                }
+            }
             if (!Number.isInteger(version) || version < 1) {
                 diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_VERSION_INVALID', 'Workflow definition version 必须是正整数', `${path}.version`));
             }
+            if (string(object(declaration.definition).title) ===
+                string(object(declaration.definition).code)) {
+                diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_USER_TITLE_REQUIRED', 'Workflow title 必须是用户可读本地化名称，不能等于内部 code', `${path}.definition.title`));
+            }
             for (const error of validateWorkflowDefinition(definition)) {
                 diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_DEFINITION_INVALID', error, path));
             }
@@ -1892,7 +2116,6 @@ function validateFrontendRoutes(rawRoutes, diagnostics) {
             'path',
             'label',
             'surface',
-            'navigation',
             'parentCode',
             'capability',
             'access',
@@ -1932,8 +2155,6 @@ function validateFrontendRoutes(rawRoutes, diagnostics) {
             paths.has(routePath) ||
             !string(route.label) ||
             !['admin', 'user'].includes(string(route.surface)) ||
-            (route.navigation !== undefined &&
-                !['menu', 'hidden'].includes(string(route.navigation))) ||
             (route.capability !== undefined &&
                 !CAPABILITY_PATTERN.test(string(route.capability))) ||
             accessInvalid ||
@@ -1968,6 +2189,160 @@ function validateFrontendRoutes(rawRoutes, diagnostics) {
         }
     }
 }
+const ADMIN_NAVIGATION_ICONS = new Set([
+    'overview',
+    'database',
+    'operations',
+    'workflow',
+    'members',
+    'calendar',
+    'document',
+    'folder',
+    'settings',
+]);
+function validAdminOrder(value) {
+    return (value === undefined ||
+        (Number.isSafeInteger(value) && Math.abs(Number(value)) <= 10_000));
+}
+function validateAdminNavigation(config, diagnostics) {
+    const frontend = object(config.frontend);
+    const admin = object(frontend.admin);
+    const rawNavigation = admin.navigation;
+    if (frontend.admin !== undefined &&
+        (Object.keys(admin).some(key => key !== 'navigation') ||
+            !Array.isArray(rawNavigation))) {
+        diagnostics.push(diagnostic('APP_CONFIG_ADMIN_NAVIGATION_INVALID', 'frontend.admin 只接受 navigation 数组', 'frontend.admin.navigation'));
+        return;
+    }
+    const groups = Array.isArray(rawNavigation) ? rawNavigation : [];
+    if (groups.length > 100) {
+        diagnostics.push(diagnostic('APP_CONFIG_ADMIN_NAVIGATION_LIMIT_EXCEEDED', '后台导航最多包含 100 个业务分组', 'frontend.admin.navigation'));
+    }
+    const resources = new Map((config.data?.resources || []).map(resource => [resource.code, resource]));
+    const routes = new Map((config.frontend.routes || []).map(route => [route.code, route]));
+    const workflows = new Map();
+    const workflowDefinitionsByCode = new Map();
+    for (const declaration of config.workflows?.definitions || []) {
+        const declarations = workflowDefinitionsByCode.get(declaration.definition.code) || [];
+        declarations.push(declaration);
+        workflowDefinitionsByCode.set(declaration.definition.code, declarations);
+    }
+    for (const [code, declarations] of workflowDefinitionsByCode) {
+        const activeVersion = config.workflows?.activations.find(activation => activation.workflowCode === code)?.definitionVersion;
+        const selected = declarations.find(declaration => declaration.version === activeVersion) ||
+            [...declarations].sort((left, right) => right.version - left.version)[0];
+        if (selected) {
+            workflows.set(code, {
+                title: selected.definition.title,
+                mode: selected.launch?.mode || 'work-center-only',
+            });
+        }
+    }
+    const groupCodes = new Set();
+    const pageKeys = new Set();
+    let itemCount = 0;
+    groups.forEach((rawGroup, groupIndex) => {
+        const group = object(rawGroup);
+        const path = `frontend.admin.navigation[${groupIndex}]`;
+        const code = string(group.code);
+        const label = string(group.label);
+        const items = Array.isArray(group.items) ? group.items : [];
+        if (Object.keys(group).some(key => !['code', 'label', 'icon', 'order', 'items'].includes(key)) ||
+            !OPERATION_CODE_PATTERN.test(code) ||
+            groupCodes.has(code) ||
+            !label ||
+            label === code ||
+            (group.icon !== undefined &&
+                !ADMIN_NAVIGATION_ICONS.has(string(group.icon))) ||
+            !validAdminOrder(group.order)) {
+            diagnostics.push(diagnostic('APP_CONFIG_ADMIN_GROUP_INVALID', '导航分组必须声明唯一 code、用户 label、受支持 icon/order 和 items', path));
+        }
+        if (items.length === 0) {
+            diagnostics.push(diagnostic('APP_CONFIG_ADMIN_GROUP_ORPHANED', '导航分组必须至少引用一个可见页面', `${path}.items`));
+        }
+        groupCodes.add(code);
+        items.forEach((rawItem, itemIndex) => {
+            itemCount += 1;
+            const item = object(rawItem);
+            const itemPath = `${path}.items[${itemIndex}]`;
+            const page = object(item.page);
+            const kind = string(page.kind);
+            let pageKey = '';
+            let defaultLabel = '';
+            let internalCode = '';
+            let exists = false;
+            let standaloneViolation = false;
+            if (kind === 'resource') {
+                const resourceCode = string(page.resourceCode);
+                const resource = resources.get(resourceCode);
+                pageKey = `resource:${resourceCode}:list`;
+                defaultLabel = resource?.name || '';
+                internalCode = resourceCode;
+                exists = Boolean(resource?.surface?.generated?.list);
+            }
+            else if (kind === 'operation') {
+                const routeCode = string(page.routeCode);
+                const route = routes.get(routeCode);
+                pageKey = `operation:${routeCode}`;
+                defaultLabel = route?.label || '';
+                internalCode = routeCode;
+                exists = Boolean(route && route.surface === 'admin' && !/[:*]/.test(route.path));
+            }
+            else if (kind === 'application-todo-center') {
+                pageKey = 'application:todo-center';
+                defaultLabel = '待办中心';
+                internalCode = pageKey;
+                exists = true;
+            }
+            else if (kind === 'workflow-work-center') {
+                pageKey = 'workflow:work-center';
+                defaultLabel = '我的审批';
+                internalCode = pageKey;
+                exists = workflows.size > 0;
+            }
+            else if (kind === 'workflow-launch') {
+                const workflowCode = string(page.workflowCode);
+                const workflow = workflows.get(workflowCode);
+                pageKey = `workflow:${workflowCode}:launch`;
+                defaultLabel = workflow ? `发起${workflow.title}` : '';
+                internalCode = workflowCode;
+                standaloneViolation = Boolean(workflow && workflow.mode !== 'standalone');
+                exists = Boolean(workflow && workflow.mode === 'standalone');
+            }
+            if (Object.keys(item).some(key => !['page', 'label', 'icon', 'order'].includes(key)) ||
+                ![
+                    'resource',
+                    'operation',
+                    'application-todo-center',
+                    'workflow-work-center',
+                    'workflow-launch',
+                ].includes(kind) ||
+                (item.icon !== undefined &&
+                    !ADMIN_NAVIGATION_ICONS.has(string(item.icon))) ||
+                !validAdminOrder(item.order)) {
+                diagnostics.push(diagnostic('APP_CONFIG_ADMIN_ITEM_INVALID', '导航项必须使用受支持的页面 helper、label、icon 和 order', itemPath));
+            }
+            if (standaloneViolation) {
+                diagnostics.push(diagnostic('APP_CONFIG_ADMIN_WORKFLOW_NOT_STANDALONE', '只有 self-contained standalone Workflow launch page 可以进入菜单', `${itemPath}.page`));
+            }
+            else if (!exists) {
+                diagnostics.push(diagnostic('APP_CONFIG_ADMIN_PAGE_NOT_FOUND', '导航引用必须指向存在且可进入菜单的 page registry 页面', `${itemPath}.page`));
+            }
+            if (pageKey && pageKeys.has(pageKey)) {
+                diagnostics.push(diagnostic('APP_CONFIG_ADMIN_PAGE_DUPLICATE', `同一页面不能重复出现在导航中: ${pageKey}`, `${itemPath}.page`));
+            }
+            if (pageKey)
+                pageKeys.add(pageKey);
+            const label = string(item.label) || defaultLabel;
+            if (!label || label === internalCode || label === pageKey) {
+                diagnostics.push(diagnostic('APP_CONFIG_ADMIN_USER_LABEL_REQUIRED', '导航页面必须解析为用户可读 label，不能泄漏内部 code', item.label === undefined ? `${itemPath}.page` : `${itemPath}.label`));
+            }
+        });
+    });
+    if (itemCount > 500) {
+        diagnostics.push(diagnostic('APP_CONFIG_ADMIN_NAVIGATION_LIMIT_EXCEEDED', '后台导航最多包含 500 个页面引用', 'frontend.admin.navigation'));
+    }
+}
 function validateAuthorizationTransitions(rawTransitions, _roleCodes, diagnostics) {
     if (rawTransitions !== undefined && !Array.isArray(rawTransitions)) {
         diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_TRANSITIONS_INVALID', 'authz.authorizationTransitions 必须是数组', 'authz.authorizationTransitions'));
@@ -2161,6 +2536,15 @@ export function resourceReadPolicy(input) {
 }
 export function materializeDataResource(appCode, declaration) {
     const capabilities = resourceCapabilityCodes(appCode, declaration.code);
+    const mutationOwner = declaration.mutationOwner || 'native';
+    const nativeMutations = mutationOwner === 'native';
+    const generated = {
+        list: declaration.generated?.list ?? true,
+        detail: declaration.generated?.detail ?? true,
+        create: declaration.generated?.create ?? nativeMutations,
+        update: declaration.generated?.update ?? nativeMutations,
+        delete: declaration.generated?.delete ?? nativeMutations,
+    };
     const fields = declaration.fields.map(field => {
         const definition = {
             code: field.code,
@@ -2176,6 +2560,8 @@ export function materializeDataResource(appCode, declaration) {
             ...(field.maxLength !== undefined ? { maxLength: field.maxLength } : {}),
             ...(field.precision !== undefined ? { precision: field.precision } : {}),
             ...(field.scale !== undefined ? { scale: field.scale } : {}),
+            ...(field.min !== undefined ? { min: field.min } : {}),
+            ...(field.max !== undefined ? { max: field.max } : {}),
             ...(field.timePrecision ? { timePrecision: field.timePrecision } : {}),
             ...(field.file ? { file: field.file } : {}),
             ...(field.serial ? { serial: field.serial } : {}),
@@ -2194,8 +2580,13 @@ export function materializeDataResource(appCode, declaration) {
         .filter(field => field.filter === true)
         .map(field => field.code);
     const access = (field, operation) => {
-        if (isGeneratedField(field.type) && operation !== 'read')
+        if (operation !== 'read' &&
+            !supportsGeneratedMutation({
+                type: field.type,
+                system: field.system,
+            })) {
             return [];
+        }
         const override = field.access?.[operation];
         if (override === false)
             return [];
@@ -2204,7 +2595,8 @@ export function materializeDataResource(appCode, declaration) {
         return [capabilities[operation]];
     };
     const surface = {
-        generated: true,
+        mutationOwner,
+        generated,
         fields: Object.fromEntries(declaration.fields.map(field => [
             field.code,
             {
@@ -2220,6 +2612,8 @@ export function materializeDataResource(appCode, declaration) {
                 ...(field.maxLength !== undefined ? { maxLength: field.maxLength } : {}),
                 ...(field.precision !== undefined ? { precision: field.precision } : {}),
                 ...(field.scale !== undefined ? { scale: field.scale } : {}),
+                ...(field.min !== undefined ? { min: field.min } : {}),
+                ...(field.max !== undefined ? { max: field.max } : {}),
                 ...(field.file?.maxCount !== undefined
                     ? { maxCount: field.file.maxCount }
                     : {}),
@@ -2267,6 +2661,7 @@ export function materializeDataResource(appCode, declaration) {
         code: declaration.code,
         name: declaration.name,
         schema: { fields },
+        ...(declaration.invariants ? { invariants: declaration.invariants } : {}),
         surface,
         capabilities,
         ...(declaration.dataPolicyCode
@@ -2292,7 +2687,10 @@ export function validateAppDeclaration(value) {
     const resourceKeys = new Set([
         'code',
         'name',
+        'mutationOwner',
+        'generated',
         'fields',
+        'invariants',
         'list',
         'form',
         'detail',
@@ -2310,6 +2708,8 @@ export function validateAppDeclaration(value) {
         'maxLength',
         'precision',
         'scale',
+        'min',
+        'max',
         'timePrecision',
         'file',
         'serial',
@@ -2332,6 +2732,26 @@ export function validateAppDeclaration(value) {
             }
         }
         const fields = Array.isArray(resource.fields) ? resource.fields : [];
+        const mutationOwner = string(resource.mutationOwner) || 'native';
+        const generated = object(resource.generated);
+        if (!['native', 'action', 'readonly', 'workflow'].includes(mutationOwner)) {
+            diagnostics.push(diagnostic('APP_CONFIG_DATA_RESOURCE_MUTATION_OWNER_INVALID', 'mutationOwner 必须是 native、action、readonly 或 workflow', `${resourcePath}.mutationOwner`));
+        }
+        for (const key of Object.keys(generated)) {
+            if (!['list', 'detail', 'create', 'update', 'delete'].includes(key)) {
+                diagnostics.push(diagnostic('APP_CONFIG_DATA_RESOURCE_GENERATED_SURFACE_INVALID', `generated.${key} 不是受支持的标准页面/操作`, `${resourcePath}.generated.${key}`));
+            }
+            else if (typeof generated[key] !== 'boolean') {
+                diagnostics.push(diagnostic('APP_CONFIG_DATA_RESOURCE_GENERATED_SURFACE_INVALID', `generated.${key} 必须是 boolean`, `${resourcePath}.generated.${key}`));
+            }
+        }
+        if (mutationOwner !== 'native') {
+            for (const operation of ['create', 'update', 'delete']) {
+                if (generated[operation] === true) {
+                    diagnostics.push(diagnostic('APP_CONFIG_DATA_RESOURCE_NATIVE_MUTATION_OWNER_CONFLICT', `${mutationOwner} owns mutations; Native ${operation} cannot be generated`, `${resourcePath}.generated.${operation}`));
+                }
+            }
+        }
         if (fields.length === 0) {
             diagnostics.push(diagnostic('APP_CONFIG_DATA_RESOURCE_FIELDS_REQUIRED', '资源必须直接声明非空 fields 数组', `${resourcePath}.fields`));
             return;
@@ -2414,6 +2834,21 @@ export function validateAppDeclaration(value) {
             if (code)
                 declaredCodes.add(code);
         });
+        for (const operation of ['create', 'update']) {
+            const enabled = generated[operation] ?? mutationOwner === 'native';
+            const writable = fields.some(rawField => {
+                const field = object(rawField);
+                return (APP_DATA_FIELD_TYPES.has(string(field.type)) &&
+                    supportsGeneratedMutation({
+                        type: string(field.type),
+                        system: field.system === true,
+                    }) &&
+                    object(field.access)[operation] !== false);
+            });
+            if (materializable && enabled && !writable) {
+                diagnostics.push(diagnostic('APP_CONFIG_DATA_RESOURCE_WRITABLE_FIELDS_REQUIRED', `generated.${operation} 需要至少一个可写业务字段`, `${resourcePath}.generated.${operation}`));
+            }
+        }
         const defaultSortField = string(object(resource.list).defaultSort && object(object(resource.list).defaultSort).field);
         if (defaultSortField && !declaredCodes.has(defaultSortField)) {
             diagnostics.push(diagnostic('APP_CONFIG_DATA_RESOURCE_SORT_FIELD_INVALID', '默认排序字段必须在同一资源 fields 中声明', `${resourcePath}.list.defaultSort.field`));