openxiangda-devkit-core 2.0.0-alpha.98 → 2.1.0

package/dist/compiler/config.js

@@ -1,3 +1,5 @@
+import { materializeApplicationModules } from './application-model.js';
+import { nativeFieldRequiresCreateInputV2 } from 'openxiangda-contracts/native-compiler';
 import { SCHEMA_VERSIONS, DATA_FIELD_TYPES, PLATFORM_EVENT_TYPES_V2, nativePlatformCapabilityCatalog, validateDataResource, WORKFLOW_SUMMARY_MAX_FIELDS, WORKFLOW_SUMMARY_TEXT_LONG_MAX_BYTES, isWorkflowSummaryFieldType, } from 'openxiangda-contracts';
 import { Ajv2020 } from 'ajv/dist/2020.js';
 import { CronExpressionParser } from 'cron-parser';
@@ -33,20 +35,58 @@ export function defineAdminNavigation(groups) {
 export function adminNavigationGroup(code, label, items, options = {}) {
     return Object.freeze({ code, label, items: Object.freeze([...items]), ...options });
 }
-export function adminResourcePage(resourceCode, options) {
-    return adminNavigationItem({ kind: 'resource', resourceCode }, options);
+export function adminResourcePage(resourceCode, options = {}) {
+    const { viewCode, ...display } = options;
+    return adminNavigationItem({ kind: 'resource', resourceCode, ...(viewCode ? { viewCode } : {}) }, display);
 }
 export function adminOperationPage(routeCode, options) {
     return adminNavigationItem({ kind: 'operation', routeCode }, options);
 }
+/**
+ * @deprecated The Todo Center is a user Surface. Existing declarations are
+ * normalized to `frontend.user.applicationTodoCenter = true` and are not
+ * retained in the admin navigation contract.
+ */
 export function adminApplicationTodoCenterPage(options) {
-    return adminNavigationItem({ kind: 'application-todo-center' }, options);
+    return Object.freeze({
+        page: Object.freeze({ kind: 'application-todo-center' }),
+        ...options,
+    });
 }
-export function adminWorkflowWorkCenterPage(options) {
-    return adminNavigationItem({ kind: 'workflow-work-center' }, options);
+function isLegacyApplicationTodoCenterItem(item) {
+    return (item.page.kind ===
+        'application-todo-center');
 }
-export function adminWorkflowLaunchPage(workflowCode, options) {
-    return adminNavigationItem({ kind: 'workflow-launch', workflowCode }, options);
+function normalizeLegacyUserSurfaceAuthoring(declaration) {
+    const admin = declaration.frontend.admin;
+    const navigation = admin?.navigation;
+    if (!navigation?.some(group => group.items.some(isLegacyApplicationTodoCenterItem))) {
+        return declaration;
+    }
+    const normalizedNavigation = navigation
+        .map(group => ({
+        ...group,
+        items: group.items.filter(item => !isLegacyApplicationTodoCenterItem(item)),
+    }))
+        .filter(group => group.items.length > 0);
+    return {
+        ...declaration,
+        frontend: {
+            ...declaration.frontend,
+            user: {
+                ...declaration.frontend.user,
+                applicationTodoCenter: true,
+            },
+            ...(admin
+                ? {
+                    admin: {
+                        ...admin,
+                        navigation: defineAdminNavigation(normalizedNavigation),
+                    },
+                }
+                : {}),
+        },
+    };
 }
 /**
  * Produces a deterministic one-time authoring suggestion for tooling. The
@@ -55,10 +95,18 @@ export function adminWorkflowLaunchPage(workflowCode, options) {
 export function suggestAdminNavigation(config) {
     const groups = [];
     const resources = [...(config.data?.resources || [])]
-        .filter(resource => resource.surface?.generated?.list !== false)
         .sort((left, right) => left.code < right.code ? -1 : left.code > right.code ? 1 : 0);
-    if (resources.length > 0) {
-        groups.push(adminNavigationGroup('data-management', '数据管理', resources.map(resource => adminResourcePage(resource.code, { label: resource.name })), { icon: 'database', order: 100 }));
+    const resourceItems = resources.flatMap(resource => [
+        ...(resource.surface?.generated?.list !== false
+            ? [adminResourcePage(resource.code, { label: resource.name })]
+            : []),
+        ...[...(resource.surface?.views || [])]
+            .filter(view => view.generated.list !== false)
+            .sort((left, right) => left.code.localeCompare(right.code, 'en'))
+            .map(view => adminResourcePage(resource.code, { viewCode: view.code, label: view.name })),
+    ]);
+    if (resourceItems.length > 0) {
+        groups.push(adminNavigationGroup('data-management', '数据管理', resourceItems, { icon: 'database', order: 100 }));
     }
     const routes = [...(config.frontend.routes || [])]
         .filter(route => route.surface === 'admin' && !/[:*]/.test(route.path))
@@ -66,34 +114,13 @@ export function suggestAdminNavigation(config) {
     if (routes.length > 0) {
         groups.push(adminNavigationGroup('business-operations', '业务操作', routes.map(route => adminOperationPage(route.code, { label: route.label })), { icon: 'operations', order: 200 }));
     }
-    const workflowCodes = [
-        ...new Set((config.workflows?.definitions || []).map(declaration => declaration.definition.code)),
-    ].sort();
-    const workflowItems = [];
-    if (workflowCodes.length > 0) {
-        workflowItems.push(adminWorkflowWorkCenterPage({ label: '我的审批' }));
-    }
-    for (const code of workflowCodes) {
-        const declarations = (config.workflows?.definitions || []).filter(declaration => declaration.definition.code === code);
-        const activeVersion = config.workflows?.activations.find(activation => activation.workflowCode === code)?.definitionVersion;
-        const selected = declarations.find(declaration => declaration.version === activeVersion) ||
-            [...declarations].sort((left, right) => right.version - left.version)[0];
-        if (selected?.launch?.mode === 'standalone') {
-            workflowItems.push(adminWorkflowLaunchPage(code, {
-                label: `发起${selected.definition.title}`,
-            }));
-        }
-    }
-    if (workflowItems.length > 0) {
-        groups.push(adminNavigationGroup('workflow-center', '流程中心', workflowItems, {
-            icon: 'workflow',
-            order: 300,
-        }));
-    }
     return defineAdminNavigation(groups);
 }
 function renderAdminNavigationOptions(options) {
     const entries = [
+        ...(options.viewCode !== undefined
+            ? [`viewCode: ${JSON.stringify(options.viewCode)}`]
+            : []),
         ...(options.label !== undefined
             ? [`label: ${JSON.stringify(options.label)}`]
             : []),
@@ -114,7 +141,9 @@ export function renderAdminNavigationSuggestion(config) {
     const groups = navigation.map(group => {
         imports.add('adminNavigationGroup');
         const items = group.items.map(item => {
-            const options = renderAdminNavigationOptions(item);
+            const options = renderAdminNavigationOptions({ ...item,
+                ...(item.page.kind === 'resource' && item.page.viewCode ? { viewCode: item.page.viewCode } : {}),
+            });
             let expression;
             switch (item.page.kind) {
                 case 'resource':
@@ -125,18 +154,6 @@ export function renderAdminNavigationSuggestion(config) {
                     imports.add('adminOperationPage');
                     expression = `adminOperationPage(${JSON.stringify(item.page.routeCode)}${options ? `, ${options}` : ''})`;
                     break;
-                case 'application-todo-center':
-                    imports.add('adminApplicationTodoCenterPage');
-                    expression = `adminApplicationTodoCenterPage(${options || ''})`;
-                    break;
-                case 'workflow-work-center':
-                    imports.add('adminWorkflowWorkCenterPage');
-                    expression = `adminWorkflowWorkCenterPage(${options || ''})`;
-                    break;
-                case 'workflow-launch':
-                    imports.add('adminWorkflowLaunchPage');
-                    expression = `adminWorkflowLaunchPage(${JSON.stringify(item.page.workflowCode)}${options ? `, ${options}` : ''})`;
-                    break;
             }
             return `      ${expression},`;
         });
@@ -604,7 +621,6 @@ export function backendRuntimeRequired(config) {
                 config.events?.subscriptions?.length ||
                 config.events?.timers?.length ||
                 config.events?.dateTriggers?.length ||
-                config.workflows?.activations?.length ||
                 config.workflows?.providers?.length)));
 }
 function object(value) {
@@ -834,7 +850,10 @@ export function validateAppConfig(value) {
     validateApplicationAuthentication(config, diagnostics);
     validateFrontendDevicePolicy(config, diagnostics);
     validateFrontendRoutes(config, diagnostics);
+    validateResourceDetailRoutes(config, diagnostics);
+    validateFrontendUser(config, diagnostics);
     validateAnonymousPublicAccess(config, diagnostics);
+    validateAdminAccess(config, diagnostics);
     validateAdminNavigation(config, diagnostics);
     validatePerspectives(config.perspectives, object(config.authz).roles, diagnostics);
     const declaredResources = new Map((Array.isArray(object(config.data).resources)
@@ -855,7 +874,7 @@ export function validateAppConfig(value) {
     const declaredWorkflowCodes = new Set((Array.isArray(object(config.workflows).activations)
         ? object(config.workflows).activations
         : []).map(item => string(object(item).workflowCode)));
-    validateBackendOperations(backend.operations, declaredResources, declaredWorkflowCodes, diagnostics);
+    validateBackendOperations(backend.operations, declaredResources, declaredWorkflowCodes, new Set((Array.isArray(object(config.authz).roles) ? object(config.authz).roles : []).map(role => string(object(role).code))), diagnostics);
     const eventConfig = object(config.events);
     const workflowConfig = object(config.workflows);
     if (backend.enabled === false &&
@@ -866,10 +885,8 @@ export function validateAppConfig(value) {
             Array.isArray(eventConfig.timers) && eventConfig.timers.length > 0 ||
             Array.isArray(eventConfig.dateTriggers) &&
                 eventConfig.dateTriggers.length > 0 ||
-            Array.isArray(workflowConfig.activations) &&
-                workflowConfig.activations.length > 0 ||
             Array.isArray(workflowConfig.providers) && workflowConfig.providers.length > 0)) {
-        diagnostics.push(diagnostic('APP_CONFIG_BACKEND_DISABLED_WITH_DECLARATIONS', 'backend.enabled=false 时不能声明后端操作、Secret、事件或工作流运行时', 'backend.enabled'));
+        diagnostics.push(diagnostic('APP_CONFIG_BACKEND_DISABLED_WITH_DECLARATIONS', 'backend.enabled=false 时不能声明后端操作、Secret、事件消费者或工作流人员提供器', 'backend.enabled'));
     }
     const secretNames = new Set();
     const secretEnvs = new Set();
@@ -1041,6 +1058,22 @@ export function validateAppConfig(value) {
                 }
                 seenCapabilities.add(capability);
             });
+            const deniedCapabilities = Array.isArray(role.deniedCapabilities)
+                ? role.deniedCapabilities
+                : [];
+            if (role.deniedCapabilities !== undefined &&
+                !Array.isArray(role.deniedCapabilities)) {
+                diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_ROLE_DENIED_CAPABILITIES_INVALID', 'deniedCapabilities 必须是 capability 数组', `authz.roles[${index}].deniedCapabilities`));
+            }
+            const seenDeniedCapabilities = new Set();
+            deniedCapabilities.forEach((rawCapability, capabilityIndex) => {
+                const capability = string(rawCapability);
+                if (!/^[A-Za-z0-9][A-Za-z0-9:._*-]{0,254}$/.test(capability) ||
+                    seenDeniedCapabilities.has(capability)) {
+                    diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_ROLE_DENIED_CAPABILITY_INVALID', 'denied capability 必须是非空稳定标识，且同一角色内不能重复', `authz.roles[${index}].deniedCapabilities[${capabilityIndex}]`));
+                }
+                seenDeniedCapabilities.add(capability);
+            });
         });
         const authenticatedUserRoleCode = authz.authenticatedUserRoleCode === undefined
             ? ''
@@ -1972,6 +2005,108 @@ export function validateAppConfig(value) {
             }
             editableParameterCodes.add(code);
         });
+        const backendOperationsByCode = new Map((Array.isArray(backend.operations) ? backend.operations : []).map(raw => {
+            const operation = object(raw);
+            return [string(operation.code), operation];
+        }));
+        const dataResourcesByCode = new Map((Array.isArray(data.resources) ? data.resources : []).map(raw => {
+            const resource = object(raw);
+            return [string(resource.code), resource];
+        }));
+        const validateNamedOperationIntent = (rawIntent, intentKind, definition, path) => {
+            const intent = object(rawIntent);
+            const operationCode = string(intent.operationCode);
+            const operation = backendOperationsByCode.get(operationCode);
+            const inputs = object(intent.inputs);
+            const output = object(intent.output);
+            const subjectResource = dataResourcesByCode.get(definition.subject?.resourceCode);
+            const subjectSchema = object(subjectResource?.schema);
+            const subjectFields = new Set((Array.isArray(subjectSchema.fields) ? subjectSchema.fields : []).map(field => string(object(field).code)));
+            const requestSchema = object(operation?.requestSchema);
+            const requestProperties = object(requestSchema.properties);
+            const requestRequired = new Set(Array.isArray(requestSchema.required)
+                ? requestSchema.required.map(string)
+                : []);
+            const responseProperties = object(object(operation?.responseSchema).properties);
+            const operationWorkflow = object(object(operation?.platformAccess).workflow);
+            const operationWorkflowCodes = Array.isArray(operationWorkflow.codes)
+                ? operationWorkflow.codes.map(string)
+                : [];
+            if (Object.keys(intent).some(key => !['operationCode', 'inputs', 'output'].includes(key)) ||
+                !OPERATION_CODE_PATTERN.test(operationCode) ||
+                !operation ||
+                string(operation.method) !== 'POST' ||
+                !operationWorkflowCodes.includes(definition.code)) {
+                diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_NAMED_OPERATION_INVALID', '标准 Workflow named-operation 必须引用同一应用中声明目标 Workflow platformAccess 的 POST operation', path));
+            }
+            const inputEntries = Object.entries(inputs);
+            const propertyCodePattern = /^[A-Za-z][A-Za-z0-9_]{0,127}$/;
+            const fieldCodes = new Set();
+            const sourceCounts = new Map();
+            let inputsInvalid = !isRecord(intent.inputs) ||
+                inputEntries.length === 0 ||
+                inputEntries.length > 64;
+            for (const [inputCode, rawBinding] of inputEntries) {
+                const binding = object(rawBinding);
+                const source = string(binding.source);
+                const allowedKeys = source === 'field' ? ['source', 'fieldCode'] : ['source'];
+                inputsInvalid ||=
+                    !propertyCodePattern.test(inputCode) ||
+                        !(inputCode in requestProperties) ||
+                        ![
+                            'field',
+                            'idempotency-key',
+                            'current-user-reference',
+                            'subject-id',
+                            'subject-revision',
+                            'requested-at',
+                        ].includes(source) ||
+                        Object.keys(binding).some(key => !allowedKeys.includes(key));
+                sourceCounts.set(source, (sourceCounts.get(source) || 0) + 1);
+                if (source === 'field') {
+                    const fieldCode = string(binding.fieldCode);
+                    inputsInvalid ||=
+                        !propertyCodePattern.test(fieldCode) ||
+                            !subjectFields.has(fieldCode) ||
+                            fieldCodes.has(fieldCode);
+                    fieldCodes.add(fieldCode);
+                }
+            }
+            inputsInvalid ||=
+                [...requestRequired].some(inputCode => !(inputCode in inputs)) ||
+                    (sourceCounts.get('idempotency-key') || 0) !== 1 ||
+                    ![...inputEntries].some(([inputCode, rawBinding]) => string(object(rawBinding).source) === 'idempotency-key' &&
+                        requestRequired.has(inputCode));
+            if (intentKind === 'create') {
+                inputsInvalid ||=
+                    (sourceCounts.get('subject-id') || 0) > 0 ||
+                        (sourceCounts.get('subject-revision') || 0) > 0;
+            }
+            else {
+                inputsInvalid ||=
+                    (sourceCounts.get('subject-id') || 0) !== 1 ||
+                        (sourceCounts.get('subject-revision') || 0) !== 1;
+            }
+            if (inputsInvalid) {
+                diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_NAMED_OPERATION_INPUT_INVALID', 'named-operation 必须以唯一且完整的顶层 input binding 覆盖请求必填字段、平台幂等键及对应 create/existing 身份来源', `${path}.inputs`));
+            }
+            const subjectIdOutput = string(output.subjectId);
+            const subjectRevisionOutput = string(output.subjectRevision);
+            const processCommandOutput = string(output.processCommand);
+            if (!isRecord(intent.output) ||
+                Object.keys(output).some(key => !['subjectId', 'subjectRevision', 'processCommand'].includes(key)) ||
+                !propertyCodePattern.test(subjectIdOutput) ||
+                !(subjectIdOutput in responseProperties) ||
+                (output.subjectRevision !== undefined &&
+                    (!propertyCodePattern.test(subjectRevisionOutput) ||
+                        !(subjectRevisionOutput in responseProperties))) ||
+                (output.processCommand !== undefined &&
+                    (!propertyCodePattern.test(processCommandOutput) ||
+                        !(processCommandOutput in responseProperties)))) {
+                diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_NAMED_OPERATION_OUTPUT_INVALID', 'named-operation output 必须引用 responseSchema 中的顶层 subjectId、可选 revision 和可选 processCommand 属性', `${path}.output`));
+            }
+            return fieldCodes;
+        };
         definitions.forEach((item, index) => {
             const declaration = object(item);
             const definition = object(declaration.definition);
@@ -1982,7 +2117,7 @@ export function validateAppConfig(value) {
                 diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_DEFINITION_DECLARATION_INVALID', 'Workflow definition declaration 只能声明 version、definition、launch 和 detailRouteCode', path));
             }
             if (declaration.launch !== undefined &&
-                (Object.keys(launch).some(key => key !== 'mode') ||
+                (Object.keys(launch).some(key => !['mode', 'submission'].includes(key)) ||
                     ![
                         'standalone',
                         'custom-page',
@@ -1991,6 +2126,41 @@ export function validateAppConfig(value) {
                     ].includes(string(launch.mode)))) {
                 diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_LAUNCH_MODE_INVALID', 'Workflow launch.mode 必须是 standalone、custom-page、hidden-handoff 或 work-center-only', `${path}.launch.mode`));
             }
+            if (launch.submission !== undefined) {
+                const submission = object(launch.submission);
+                const createFields = submission.create
+                    ? validateNamedOperationIntent(submission.create, 'create', definition, `${path}.launch.submission.create`)
+                    : new Set();
+                const existingFields = submission.existing
+                    ? validateNamedOperationIntent(submission.existing, 'existing', definition, `${path}.launch.submission.existing`)
+                    : new Set();
+                const contexts = Array.isArray(submission.context)
+                    ? submission.context
+                    : [];
+                const contextKeys = new Set();
+                let contextInvalid = contexts.length > 16;
+                for (const rawContext of contexts) {
+                    const context = object(rawContext);
+                    const queryParameter = string(context.queryParameter);
+                    const fieldCode = string(context.fieldCode);
+                    contextInvalid ||=
+                        Object.keys(context).some(key => !['queryParameter', 'fieldCode'].includes(key)) ||
+                            !/^[A-Za-z][A-Za-z0-9]{0,63}$/.test(queryParameter) ||
+                            contextKeys.has(queryParameter) ||
+                            (!createFields.has(fieldCode) && !existingFields.has(fieldCode));
+                    contextKeys.add(queryParameter);
+                }
+                if (!isRecord(launch.submission) ||
+                    submission.kind !== 'named-operation' ||
+                    Object.keys(submission).some(key => !['kind', 'create', 'existing', 'context'].includes(key)) ||
+                    (!['standalone', 'hidden-handoff'].includes(string(launch.mode))) ||
+                    (!submission.create && !submission.existing)) {
+                    diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_NAMED_OPERATION_SUBMISSION_INVALID', 'named-operation submission 只适用于 standalone/hidden-handoff，且必须声明 create 或 existing intent', `${path}.launch.submission`));
+                }
+                if (contextInvalid) {
+                    diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_LAUNCH_CONTEXT_INVALID', 'Workflow launch context 必须唯一、受限并指向已绑定的 subject form field', `${path}.launch.submission.context`));
+                }
+            }
             if (declaration.detailRouteCode !== undefined) {
                 const detailRouteCode = object(declaration.detailRouteCode);
                 const desktopCode = string(detailRouteCode.desktop);
@@ -2255,7 +2425,7 @@ function validateCapabilityDeclarations(appCode, declarations, diagnostics) {
         seen.add(code);
     });
 }
-function validateBackendOperations(rawOperations, declaredResources, declaredWorkflowCodes, diagnostics) {
+function validateBackendOperations(rawOperations, declaredResources, declaredWorkflowCodes, declaredRoleCodes, diagnostics) {
     const declaredResourceCodes = new Set(declaredResources.keys());
     if (rawOperations !== undefined && !Array.isArray(rawOperations)) {
         diagnostics.push(diagnostic('APP_CONFIG_BACKEND_OPERATIONS_INVALID', 'backend.operations 必须是数组', 'backend.operations'));
@@ -2292,10 +2462,18 @@ function validateBackendOperations(rawOperations, declaredResources, declaredWor
                 'managedFileCopies',
                 'notification',
                 'workflow',
+                'roleAssertions',
             ]);
             let invalid = !isRecord(operation.platformAccess) ||
                 Object.keys(access).length === 0 ||
                 Object.keys(access).some(key => !allowedAccessKeys.has(key));
+            if (access.roleAssertions !== undefined) {
+                const assertion = object(access.roleAssertions);
+                const roles = Array.isArray(assertion.roleCodes) ? assertion.roleCodes : [];
+                invalid ||= !isRecord(access.roleAssertions) || roles.length < 1 || roles.length > 20 ||
+                    new Set(roles).size !== roles.length || roles.some(role => !declaredRoleCodes.has(string(role))) ||
+                    Object.keys(assertion).some(key => key !== 'roleCodes');
+            }
             if (access.directory !== undefined) {
                 const directory = object(access.directory);
                 const fields = Array.isArray(directory.fields) ? directory.fields : [];
@@ -2408,7 +2586,7 @@ function validateBackendOperations(rawOperations, declaredResources, declaredWor
                         Object.keys(workflow).some(key => key !== 'codes');
             }
             if (invalid) {
-                diagnostics.push(diagnostic('APP_CONFIG_BACKEND_OPERATION_PLATFORM_ACCESS_INVALID', 'operation.platformAccess 必须只声明有界的发起人目录、托管文件、托管文件复制、标准通知或现有工作流依赖', `${path}.platformAccess`));
+                diagnostics.push(diagnostic('APP_CONFIG_BACKEND_OPERATION_PLATFORM_ACCESS_INVALID', 'operation.platformAccess 必须只声明有界的发起人目录、托管文件、托管文件复制、标准通知、现有工作流或已声明角色条件依赖', `${path}.platformAccess`));
             }
         }
         if (operation.ai !== undefined) {
@@ -2480,64 +2658,66 @@ function generatedPlatformRouteClaims(config) {
         const code = string(resource.code);
         if (!code)
             continue;
-        const surface = object(resource.surface);
-        const generated = object(surface.generated);
-        const native = !surface.mutationOwner || surface.mutationOwner === 'native';
-        const operations = {
-            list: generated.list === undefined ? true : generated.list === true,
-            detail: generated.detail === undefined ? true : generated.detail === true,
-            create: generated.create === undefined ? native : generated.create === true,
-            update: generated.update === undefined ? native : generated.update === true,
-        };
-        const base = `/admin/resources/${code}`;
-        const candidates = [
-            ['list', base],
-            ['detail', `${base}/:id`],
-            ['create', `${base}/new`],
-            ['update', `${base}/:id/edit`],
-        ];
-        for (const [operation, path] of candidates) {
-            if (!operations[operation])
-                continue;
-            claims.push({ owner: `resource:${code}:${operation}`, path }, { owner: `resource:${code}:${operation}:mobile`, path: `/m${path}` });
+        const resourceSurface = object(resource.surface);
+        for (const selected of [resourceSurface, ...(Array.isArray(resourceSurface.views) ? resourceSurface.views.map(object) : [])]) {
+            const surface = { ...resourceSurface, ...selected };
+            const viewCode = string(selected.code);
+            const generated = object(surface.generated);
+            const native = !surface.mutationOwner || surface.mutationOwner === 'native';
+            const operations = {
+                list: generated.list === undefined ? true : generated.list === true,
+                detail: generated.detail === undefined ? true : generated.detail === true,
+                create: generated.create === undefined ? native : generated.create === true,
+                update: generated.update === undefined ? native : generated.update === true,
+            };
+            const base = `/admin/resources/${code}${viewCode ? `/views/${viewCode}` : ""}`;
+            const candidates = [
+                ['list', base],
+                ['detail', `${base}/:id`],
+                ['create', `${base}/new`],
+                ['update', `${base}/:id/edit`],
+            ];
+            for (const [operation, path] of candidates) {
+                if (!operations[operation])
+                    continue;
+                const owner = `resource:${code}${viewCode ? `:view:${viewCode}` : ''}:${operation}`;
+                claims.push({ owner, path });
+                if (object(surface.mobile).enabled !== false)
+                    claims.push({ owner: `${owner}:mobile`, path: `/m${path}` });
+            }
         }
     }
     const frontend = object(config.frontend);
-    const admin = object(frontend.admin);
-    const navigation = Array.isArray(admin.navigation) ? admin.navigation : [];
-    const hasTodoCenter = navigation.some(rawGroup => {
-        const group = object(rawGroup);
-        const items = Array.isArray(group.items) ? group.items : [];
-        return items.some(rawItem => string(object(object(rawItem).page).kind) === 'application-todo-center');
-    });
+    const user = object(frontend.user);
+    const hasTodoCenter = user.applicationTodoCenter === true;
     if (hasTodoCenter) {
-        claims.push({ owner: 'application:todo-center', path: '/admin/todos' }, { owner: 'application:todo-center:mobile', path: '/m/todos' });
+        claims.push({ owner: 'application:todo-center', path: '/todos' }, { owner: 'application:todo-center:mobile', path: '/m/todos' });
     }
     const workflows = object(config.workflows);
     const definitions = Array.isArray(workflows.definitions)
         ? workflows.definitions
         : [];
     if (definitions.length > 0) {
-        claims.push({ owner: 'workflow:work-center', path: '/admin/work-center' }, { owner: 'workflow:work-center:mobile', path: '/m/work-center' }, { owner: 'workflow:task', path: '/tasks/:taskId' }, { owner: 'workflow:task:mobile', path: '/m/tasks/:taskId' }, { owner: 'workflow:instance', path: '/workflows/:instanceId' }, {
+        claims.push({ owner: 'workflow:work-center', path: '/work-center' }, { owner: 'workflow:work-center:mobile', path: '/m/work-center' }, { owner: 'workflow:task', path: '/tasks/:taskId' }, { owner: 'workflow:task:mobile', path: '/m/tasks/:taskId' }, { owner: 'workflow:instance', path: '/workflows/:instanceId' }, {
             owner: 'workflow:instance:mobile',
             path: '/m/workflows/:instanceId',
         });
-        const standaloneCodes = new Set();
+        const launchCodes = new Set();
         for (const rawDefinition of definitions) {
             const declaration = object(rawDefinition);
-            if (string(object(declaration.launch).mode) !== 'standalone')
+            if (!['standalone', 'hidden-handoff'].includes(string(object(declaration.launch).mode)))
                 continue;
             const workflowCode = string(object(declaration.definition).code);
             if (workflowCode)
-                standaloneCodes.add(workflowCode);
+                launchCodes.add(workflowCode);
         }
-        for (const workflowCode of standaloneCodes) {
+        for (const workflowCode of launchCodes) {
             claims.push({
                 owner: `workflow:${workflowCode}:launch`,
-                path: `/admin/workflows/${workflowCode}/new`,
+                path: '/workflows/:workflowCode/start',
             });
         }
-        if (standaloneCodes.size > 0) {
+        if (launchCodes.size > 0) {
             claims.push({
                 owner: 'workflow:launch:mobile',
                 path: '/m/workflows/:workflowCode/start',
@@ -2566,6 +2746,68 @@ function validateFrontendDevicePolicy(config, diagnostics) {
         diagnostics.push(diagnostic('APP_CONFIG_FRONTEND_DEVICE_POLICY_INVALID', 'frontend.devicePolicy 必须是 viewport-family，移动最大宽度和桌面最小宽度为 320-1600 的相邻整数', 'frontend.devicePolicy'));
     }
 }
+function validateResourceDetailRoutes(config, diagnostics) {
+    const frontend = object(config.frontend);
+    const routesByCode = new Map((Array.isArray(frontend.routes) ? frontend.routes : []).map(rawRoute => {
+        const route = object(rawRoute);
+        return [string(route.code), route];
+    }));
+    const data = object(config.data);
+    const resources = Array.isArray(data.resources) ? data.resources : [];
+    resources.forEach((rawResource, resourceIndex) => {
+        const resource = object(rawResource);
+        if (resource.detailRouteCode === undefined)
+            return;
+        const path = `data.resources[${resourceIndex}].detailRouteCode`;
+        const detailRouteCode = object(resource.detailRouteCode);
+        const desktopCode = string(detailRouteCode.desktop);
+        const mobileCode = string(detailRouteCode.mobile);
+        if (Object.keys(detailRouteCode).some(key => !['desktop', 'mobile'].includes(key)) ||
+            !OPERATION_CODE_PATTERN.test(desktopCode) ||
+            !OPERATION_CODE_PATTERN.test(mobileCode) ||
+            desktopCode === mobileCode) {
+            diagnostics.push(diagnostic('APP_CONFIG_DATA_RESOURCE_DETAIL_ROUTE_INVALID', 'detailRouteCode 必须声明两个不同且合法的 desktop/mobile route code', path));
+            return;
+        }
+        const readCapability = string(object(resource.capabilities).read);
+        for (const [device, code] of [
+            ['desktop', desktopCode],
+            ['mobile', mobileCode],
+        ]) {
+            const route = routesByCode.get(code);
+            const routePointer = `${path}.${device}`;
+            if (!route) {
+                diagnostics.push(diagnostic('APP_CONFIG_DATA_RESOURCE_DETAIL_ROUTE_REFERENCE_MISSING', `detailRouteCode.${device} 必须引用已声明 frontend route`, routePointer));
+                continue;
+            }
+            if (string(route.surface) !== 'user') {
+                diagnostics.push(diagnostic('APP_CONFIG_DATA_RESOURCE_DETAIL_ROUTE_SURFACE_INVALID', `detailRouteCode.${device} 必须引用 user surface`, routePointer));
+            }
+            const routePath = string(route.path);
+            const parameters = [
+                ...routePath.matchAll(/:([A-Za-z][A-Za-z0-9_]*)/g),
+            ].map(match => match[1]);
+            const wrongDeviceFamily = device === 'mobile'
+                ? !routePath.startsWith('/m/')
+                : routePath === '/m' || routePath.startsWith('/m/');
+            if (routePath.includes('*') ||
+                routePath.includes('?') ||
+                routePath.includes('#') ||
+                routePath.split('/').includes('..') ||
+                parameters.length !== 1 ||
+                wrongDeviceFamily) {
+                diagnostics.push(diagnostic('APP_CONFIG_DATA_RESOURCE_DETAIL_ROUTE_PATH_INVALID', `detailRouteCode.${device} 路由必须属于对应端且只能声明一个有界动态记录参数`, routePointer));
+            }
+            const access = object(route.access);
+            const allOf = Array.isArray(access.allOf) ? access.allOf.map(string) : [];
+            if (!readCapability ||
+                (string(route.capability) !== readCapability &&
+                    !allOf.includes(readCapability))) {
+                diagnostics.push(diagnostic('APP_CONFIG_DATA_RESOURCE_DETAIL_ROUTE_CAPABILITY_INVALID', `detailRouteCode.${device} 路由必须要求当前资源的 read capability`, routePointer));
+            }
+        }
+    });
+}
 function validateFrontendRoutes(config, diagnostics) {
     const frontend = object(config.frontend);
     const rawRoutes = frontend.routes;
@@ -2642,9 +2884,14 @@ function validateFrontendRoutes(config, diagnostics) {
             !['admin', 'user'].includes(string(route.surface)) ||
             (route.surface === 'admin' &&
                 routePath !== '/admin' &&
-                !routePath.startsWith('/admin/')) ||
+                !routePath.startsWith('/admin/') &&
+                routePath !== '/m/admin' &&
+                !routePath.startsWith('/m/admin/')) ||
             (route.surface === 'user' &&
-                (routePath === '/admin' || routePath.startsWith('/admin/'))) ||
+                (routePath === '/admin' ||
+                    routePath.startsWith('/admin/') ||
+                    routePath === '/m/admin' ||
+                    routePath.startsWith('/m/admin/'))) ||
             (route.capability !== undefined &&
                 !CAPABILITY_PATTERN.test(string(route.capability))) ||
             accessInvalid ||
@@ -2727,16 +2974,17 @@ function validateAnonymousPublicAccess(config, diagnostics) {
             const declaration = object(field);
             return [string(declaration.code), string(declaration.type)];
         }));
+        const surface = object(resource.surface);
+        const surfaceFields = object(surface.fields);
         const requiredCreateFields = new Set(fields
             .map(object)
             .filter(field => {
             const type = string(field.type);
-            return (field.nullable === false &&
-                APP_DATA_FIELD_TYPES.has(type) &&
-                supportsGeneratedMutation({ type }));
+            const fieldSurface = object(surfaceFields[string(field.code)]);
+            return (APP_DATA_FIELD_TYPES.has(type) &&
+                nativeFieldRequiresCreateInputV2({ type, ...(field.nullable === false ? { nullable: false } : {}) }, { system: fieldSurface.system === true, requiredHint: fieldSurface.requiredHint === true }));
         })
             .map(field => string(field.code)));
-        const surface = object(resource.surface);
         const generated = object(surface.generated);
         const nativeCreate = (string(surface.mutationOwner) || 'native') === 'native' &&
             generated.create !== false;
@@ -2803,9 +3051,7 @@ function validateAnonymousPublicAccess(config, diagnostics) {
             fields.some(field => !resourceFields?.has(field)) ||
             new Set(requiredFields).size !== requiredFields.length ||
             requiredFields.some(field => !fields.includes(field)) ||
-            (operations.includes('create') &&
-                (!resource?.nativeCreate ||
-                    [...(resource?.requiredCreateFields || [])].some(field => !fields.includes(field) || !requiredFields.includes(field)))) ||
+            (operations.includes('create') && !resource?.nativeCreate) ||
             new Set(ownRecordFields).size !== ownRecordFields.length ||
             ownRecordFields.some(field => !fields.includes(field)) ||
             (operations.includes('draft.read') !== operations.includes('draft.update')) ||
@@ -2826,6 +3072,13 @@ function validateAnonymousPublicAccess(config, diagnostics) {
         if (invalid) {
             diagnostics.push(diagnostic('APP_CONFIG_ANONYMOUS_PUBLIC_POLICY_INVALID', '匿名公开策略必须绑定唯一静态 user route、已声明资源/字段和有界操作', path));
         }
+        if (operations.includes('create') && resource?.nativeCreate) {
+            const missingFields = [...resource.requiredCreateFields].filter(field => !fields.includes(field));
+            const missingRequired = [...resource.requiredCreateFields].filter(field => !requiredFields.includes(field));
+            if (missingFields.length || missingRequired.length) {
+                diagnostics.push(diagnostic('APP_CONFIG_ANONYMOUS_CREATE_FIELDS_INCOMPLETE', `公开创建必须覆盖资源 ${resourceCode} 的必填字段：${[...new Set([...missingFields, ...missingRequired])].join('、')}`, `${path}.${missingFields.length ? 'fields' : 'requiredFields'}`));
+            }
+        }
         const validationCodes = new Set();
         validations.forEach((rawValidation, validationIndex) => {
             const validation = object(rawValidation);
@@ -2984,14 +3237,50 @@ function validAdminOrder(value) {
     return (value === undefined ||
         (Number.isSafeInteger(value) && Math.abs(Number(value)) <= 10_000));
 }
+function validateFrontendUser(config, diagnostics) {
+    const frontend = object(config.frontend);
+    if (frontend.user === undefined)
+        return;
+    const user = object(frontend.user);
+    if (!frontend.user ||
+        typeof frontend.user !== 'object' ||
+        Array.isArray(frontend.user) ||
+        Object.keys(user).some(key => key !== 'applicationTodoCenter') ||
+        (user.applicationTodoCenter !== undefined &&
+            typeof user.applicationTodoCenter !== 'boolean')) {
+        diagnostics.push(diagnostic('APP_CONFIG_FRONTEND_USER_INVALID', 'frontend.user 只接受 applicationTodoCenter 布尔值', 'frontend.user'));
+    }
+}
+function validateAdminAccess(config, diagnostics) {
+    const accessValue = config.frontend.admin?.access;
+    if (accessValue === undefined)
+        return;
+    const access = object(accessValue);
+    const allOf = Array.isArray(access.allOf) ? access.allOf : [];
+    const anyOf = Array.isArray(access.anyOf) ? access.anyOf : [];
+    const invalid = !accessValue ||
+        typeof accessValue !== 'object' ||
+        Array.isArray(accessValue) ||
+        Object.keys(access).some(key => !['allOf', 'anyOf'].includes(key)) ||
+        (allOf.length === 0 && anyOf.length === 0) ||
+        allOf.length > 50 ||
+        anyOf.length > 50 ||
+        allOf.some(value => !CAPABILITY_PATTERN.test(string(value))) ||
+        anyOf.some(value => !CAPABILITY_PATTERN.test(string(value))) ||
+        new Set(allOf.map(string)).size !== allOf.length ||
+        new Set(anyOf.map(string)).size !== anyOf.length;
+    if (invalid) {
+        diagnostics.push(diagnostic('APP_CONFIG_ADMIN_ACCESS_INVALID', 'frontend.admin.access 必须包含非空、无重复且有效的 allOf 或 anyOf capability 数组', 'frontend.admin.access'));
+    }
+}
 function validateAdminNavigation(config, diagnostics) {
     const frontend = object(config.frontend);
     const admin = object(frontend.admin);
     const rawNavigation = admin.navigation;
     if (frontend.admin !== undefined &&
-        (Object.keys(admin).some(key => key !== 'navigation') ||
+        (Object.keys(admin).some(key => !['access', 'navigation'].includes(key)) ||
             !Array.isArray(rawNavigation))) {
-        diagnostics.push(diagnostic('APP_CONFIG_ADMIN_NAVIGATION_INVALID', 'frontend.admin 只接受 navigation 数组', 'frontend.admin.navigation'));
+        diagnostics.push(diagnostic('APP_CONFIG_ADMIN_NAVIGATION_INVALID', 'frontend.admin 只接受 access 和 navigation 数组', 'frontend.admin.navigation'));
         return;
     }
     const groups = Array.isArray(rawNavigation) ? rawNavigation : [];
@@ -3000,24 +3289,6 @@ function validateAdminNavigation(config, diagnostics) {
     }
     const resources = new Map((config.data?.resources || []).map(resource => [resource.code, resource]));
     const routes = new Map((config.frontend.routes || []).map(route => [route.code, route]));
-    const workflows = new Map();
-    const workflowDefinitionsByCode = new Map();
-    for (const declaration of config.workflows?.definitions || []) {
-        const declarations = workflowDefinitionsByCode.get(declaration.definition.code) || [];
-        declarations.push(declaration);
-        workflowDefinitionsByCode.set(declaration.definition.code, declarations);
-    }
-    for (const [code, declarations] of workflowDefinitionsByCode) {
-        const activeVersion = config.workflows?.activations.find(activation => activation.workflowCode === code)?.definitionVersion;
-        const selected = declarations.find(declaration => declaration.version === activeVersion) ||
-            [...declarations].sort((left, right) => right.version - left.version)[0];
-        if (selected) {
-            workflows.set(code, {
-                title: selected.definition.title,
-                mode: selected.launch?.mode || 'work-center-only',
-            });
-        }
-    }
     const groupCodes = new Set();
     const pageKeys = new Set();
     let itemCount = 0;
@@ -3051,14 +3322,15 @@ function validateAdminNavigation(config, diagnostics) {
             let defaultLabel = '';
             let internalCode = '';
             let exists = false;
-            let standaloneViolation = false;
             if (kind === 'resource') {
                 const resourceCode = string(page.resourceCode);
                 const resource = resources.get(resourceCode);
-                pageKey = `resource:${resourceCode}:list`;
-                defaultLabel = resource?.name || '';
+                const viewCode = string(page.viewCode);
+                const view = resource?.surface?.views?.find((item) => item.code === viewCode);
+                pageKey = `resource:${resourceCode}${viewCode ? `:view:${viewCode}` : ""}:list`;
+                defaultLabel = (viewCode ? view?.name : resource?.name) || '';
                 internalCode = resourceCode;
-                exists = Boolean(resource?.surface?.generated?.list);
+                exists = Boolean(viewCode ? view?.generated?.list : resource?.surface?.generated?.list);
             }
             else if (kind === 'operation') {
                 const routeCode = string(page.routeCode);
@@ -3066,46 +3338,22 @@ function validateAdminNavigation(config, diagnostics) {
                 pageKey = `operation:${routeCode}`;
                 defaultLabel = route?.label || '';
                 internalCode = routeCode;
-                exists = Boolean(route && route.surface === 'admin' && !/[:*]/.test(route.path));
-            }
-            else if (kind === 'application-todo-center') {
-                pageKey = 'application:todo-center';
-                defaultLabel = '待办中心';
-                internalCode = pageKey;
-                exists = true;
-            }
-            else if (kind === 'workflow-work-center') {
-                pageKey = 'workflow:work-center';
-                defaultLabel = '我的审批';
-                internalCode = pageKey;
-                exists = workflows.size > 0;
-            }
-            else if (kind === 'workflow-launch') {
-                const workflowCode = string(page.workflowCode);
-                const workflow = workflows.get(workflowCode);
-                pageKey = `workflow:${workflowCode}:launch`;
-                defaultLabel = workflow ? `发起${workflow.title}` : '';
-                internalCode = workflowCode;
-                standaloneViolation = Boolean(workflow && workflow.mode !== 'standalone');
-                exists = Boolean(workflow && workflow.mode === 'standalone');
+                exists = Boolean(route &&
+                    route.surface === 'admin' &&
+                    !route.path.startsWith('/m/admin') &&
+                    !/[:*]/.test(route.path));
             }
             if (Object.keys(item).some(key => !['page', 'label', 'icon', 'order'].includes(key)) ||
                 ![
                     'resource',
                     'operation',
-                    'application-todo-center',
-                    'workflow-work-center',
-                    'workflow-launch',
                 ].includes(kind) ||
                 (item.icon !== undefined &&
                     !ADMIN_NAVIGATION_ICONS.has(string(item.icon))) ||
                 !validAdminOrder(item.order)) {
                 diagnostics.push(diagnostic('APP_CONFIG_ADMIN_ITEM_INVALID', '导航项必须使用受支持的页面 helper、label、icon 和 order', itemPath));
             }
-            if (standaloneViolation) {
-                diagnostics.push(diagnostic('APP_CONFIG_ADMIN_WORKFLOW_NOT_STANDALONE', '只有 self-contained standalone Workflow launch page 可以进入菜单', `${itemPath}.page`));
-            }
-            else if (!exists) {
+            if (!exists) {
                 diagnostics.push(diagnostic('APP_CONFIG_ADMIN_PAGE_NOT_FOUND', '导航引用必须指向存在且可进入菜单的 page registry 页面', `${itemPath}.page`));
             }
             if (pageKey && pageKeys.has(pageKey)) {
@@ -3199,6 +3447,12 @@ function validateCapabilityClosure(appCode, config, declarations, diagnostics) {
             capability: string(value),
             path: `authz.roles[${index}].capabilities[${capabilityIndex}]`,
         }));
+        (Array.isArray(role.deniedCapabilities)
+            ? role.deniedCapabilities
+            : []).forEach((value, capabilityIndex) => references.push({
+            capability: string(value),
+            path: `authz.roles[${index}].deniedCapabilities[${capabilityIndex}]`,
+        }));
     });
     const backend = object(config.backend);
     (Array.isArray(backend.operations) ? backend.operations : []).forEach((rawOperation, index) => references.push({
@@ -3224,6 +3478,14 @@ function validateCapabilityClosure(appCode, config, declarations, diagnostics) {
             }));
         }
     });
+    const adminAccess = object(object(frontend.admin).access);
+    for (const key of ['allOf', 'anyOf']) {
+        const values = Array.isArray(adminAccess[key]) ? adminAccess[key] : [];
+        values.forEach((value, capabilityIndex) => references.push({
+            capability: string(value),
+            path: `frontend.admin.access.${key}[${capabilityIndex}]`,
+        }));
+    }
     for (const reference of references) {
         if (!catalog.has(reference.capability) ||
             (!reference.capability.startsWith(`app:${appCode}:`) &&
@@ -3274,6 +3536,21 @@ export function resourceCapabilityCodes(appCode, resourceCode) {
         delete: `${prefix}:delete`,
     };
 }
+function materializeRoleCapabilities(role) {
+    const capabilities = new Set(role.capabilities);
+    for (const denied of role.deniedCapabilities || []) {
+        capabilities.delete(denied);
+    }
+    return [...capabilities].sort();
+}
+/** Explicit business permission preset; adding a page never changes grants. */
+export function resourceRoleCapabilities(appCode, resourceCode, access) {
+    const codes = resourceCapabilityCodes(appCode, resourceCode);
+    const operations = access === 'manage'
+        ? ['read', 'create', 'update', 'delete']
+        : access === 'read' ? ['read'] : access;
+    return [...new Set(operations.map(operation => codes[operation]))].sort();
+}
 export function currentUserDataPolicy(input) {
     return {
         code: input.code,
@@ -3365,9 +3642,12 @@ export function materializeDataResource(appCode, declaration) {
         physicalPlanForField(definition, field.searchable === true);
         return definition;
     });
-    const visible = declaration.fields
-        .filter(field => field.list !== false)
-        .slice(0, 8);
+    const listCandidates = declaration.fields
+        .filter(field => field.list !== false && (field.hidden ?? field.system) !== true);
+    const visible = declaration.list?.fields
+        ? declaration.list.fields.flatMap(code => listCandidates.filter(field => field.code === code))
+        : listCandidates.slice(0, 8);
+    const defaultSortField = visible.find(field => supportsSort(field.type));
     const searchableFields = declaration.fields
         .filter(field => field.searchable === true)
         .map(field => field.code);
@@ -3390,6 +3670,7 @@ export function materializeDataResource(appCode, declaration) {
         return [capabilities[operation]];
     };
     const surface = {
+        ...(declaration.views?.length ? { views: declaration.views } : {}),
         mutationOwner,
         generated,
         fields: Object.fromEntries(declaration.fields.map(field => [
@@ -3401,6 +3682,9 @@ export function materializeDataResource(appCode, declaration) {
                 ...(field.section ? { section: field.section } : {}),
                 ...(field.required === true ? { requiredHint: true } : {}),
                 ...(field.system !== undefined ? { system: field.system } : {}),
+                ...(field.hidden !== undefined || field.system
+                    ? { hidden: field.hidden ?? true }
+                    : {}),
                 readCapabilities: access(field, 'read'),
                 createCapabilities: access(field, 'create'),
                 updateCapabilities: access(field, 'update'),
@@ -3434,22 +3718,23 @@ export function materializeDataResource(appCode, declaration) {
             },
         ])),
         list: {
+            fieldOrder: visible.map(field => field.code),
             defaultPageSize: declaration.list?.defaultPageSize || 20,
             ...(searchableFields.length ? { searchableFields } : {}),
             ...(filterFields.length ? { filterFields } : {}),
             ...(declaration.list?.defaultSort
                 ? { defaultSort: declaration.list.defaultSort }
-                : visible[0]
-                    ? { defaultSort: { field: visible[0].code, order: 'asc' } }
+                : defaultSortField
+                    ? { defaultSort: { field: defaultSortField.code, order: 'asc' } }
                     : {}),
         },
         form: {
             layout: declaration.form?.layout || 'flat',
-            fieldOrder: declaration.fields.map(field => field.code),
+            fieldOrder: declaration.form?.fields || declaration.fields.map(field => field.code),
         },
         detail: {
             layout: declaration.detail?.layout || 'flat',
-            fieldOrder: declaration.fields.map(field => field.code),
+            fieldOrder: declaration.detail?.fields || declaration.fields.map(field => field.code),
         },
         mobile: declaration.mobile || { enabled: true },
     };
@@ -3465,6 +3750,9 @@ export function materializeDataResource(appCode, declaration) {
         ...(declaration.dataPolicyCode
             ? { dataPolicyCode: declaration.dataPolicyCode }
             : {}),
+        ...(declaration.detailRouteCode
+            ? { detailRouteCode: { ...declaration.detailRouteCode } }
+            : {}),
         fieldPolicies: Object.fromEntries(declaration.fields.map(field => [
             field.code,
             {
@@ -3483,6 +3771,7 @@ export function validateAppDeclaration(value) {
     const resources = Array.isArray(data.resources) ? data.resources : [];
     const diagnostics = [];
     const resourceKeys = new Set([
+        'views',
         'code',
         'name',
         'mutationOwner',
@@ -3494,6 +3783,7 @@ export function validateAppDeclaration(value) {
         'detail',
         'mobile',
         'dataPolicyCode',
+        'detailRouteCode',
     ]);
     const fieldKeys = new Set([
         'code',
@@ -3516,6 +3806,7 @@ export function validateAppDeclaration(value) {
         'widget',
         'section',
         'system',
+        'hidden',
         'list',
         'filter',
         'searchable',
@@ -3527,7 +3818,7 @@ export function validateAppDeclaration(value) {
         const resourcePath = `data.resources[${resourceIndex}]`;
         for (const key of Object.keys(resource)) {
             if (!resourceKeys.has(key)) {
-                diagnostics.push(diagnostic('APP_CONFIG_DATA_RESOURCE_PROPERTY_UNSUPPORTED', `${resourcePath}.${key} 不属于单次资源声明合同`, `${resourcePath}.${key}`, '只声明 code、name、fields 及可选列表/布局/数据策略'));
+                diagnostics.push(diagnostic('APP_CONFIG_DATA_RESOURCE_PROPERTY_UNSUPPORTED', `${resourcePath}.${key} 不属于单次资源声明合同`, `${resourcePath}.${key}`, '只声明 code、name、fields 及可选列表/布局/数据策略/详情路由'));
             }
         }
         const fields = Array.isArray(resource.fields) ? resource.fields : [];
@@ -3595,12 +3886,6 @@ export function validateAppDeclaration(value) {
                 else if (!rangeType && field.rangeBoundary !== undefined) {
                     diagnostics.push(diagnostic('APP_CONFIG_DATA_FIELD_RANGE_BOUNDARY_TYPE_INVALID', 'rangeBoundary 只能用于 date-range 或 datetime-range', `${fieldPath}.rangeBoundary`));
                 }
-                if (field.indexed === false &&
-                    (field.filter === true ||
-                        field.searchable === true ||
-                        field.sortable === true)) {
-                    diagnostics.push(diagnostic('APP_CONFIG_DATA_FIELD_INDEX_REQUIRED', '启用筛选、搜索或排序时不能显式关闭索引', `${fieldPath}.indexed`));
-                }
                 if (['radio', 'checkbox'].includes(widget) &&
                     object(field.source).loadMode !== 'all' &&
                     field.source !== undefined) {
@@ -3614,6 +3899,7 @@ export function validateAppDeclaration(value) {
                 'required',
                 'indexed',
                 'system',
+                'hidden',
                 'list',
                 'filter',
                 'searchable',
@@ -3642,6 +3928,27 @@ export function validateAppDeclaration(value) {
             if (code)
                 declaredCodes.add(code);
         });
+        for (const view of ['list', 'form', 'detail']) {
+            const selected = object(resource[view]).fields;
+            if (selected === undefined)
+                continue;
+            if (!Array.isArray(selected) || new Set(selected).size !== selected.length ||
+                selected.some(code => typeof code !== 'string' || !declaredCodes.has(code))) {
+                diagnostics.push(diagnostic('APP_CONFIG_DATA_VIEW_FIELDS_INVALID', '列表/表单/详情 fields 必须是当前资源中不重复的字段列表', `${resourcePath}.${view}.fields`));
+                materializable = false;
+            }
+        }
+        const selectedFormFields = object(resource.form).fields ?? fields.map(raw => object(raw).code);
+        if (Array.isArray(selectedFormFields) && (generated.create ?? mutationOwner === 'native')) {
+            for (const rawField of fields) {
+                const field = object(rawField);
+                if (field.required === true && field.system !== true &&
+                    supportsGeneratedMutation({ type: field.type, system: false }) &&
+                    object(field.access).create !== false && (field.hidden === true || !selectedFormFields.includes(field.code))) {
+                    diagnostics.push(diagnostic('APP_CONFIG_DATA_FORM_REQUIRED_FIELD_MISSING', `标准新增表单缺少必填字段 ${field.label || field.code}；请加入表单或关闭标准新增`, `${resourcePath}.form.fields`));
+                }
+            }
+        }
         for (const operation of ['create', 'update']) {
             const enabled = generated[operation] ?? mutationOwner === 'native';
             const writable = fields.some(rawField => {
@@ -3663,6 +3970,19 @@ export function validateAppDeclaration(value) {
         }
         if (appCode && fields.length && materializable) {
             const canonical = materializeDataResource(appCode, rawResource);
+            for (const [viewIndex, view] of (canonical.surface?.views || []).entries()) {
+                for (const [property, values, supports] of [
+                    ['searchableFields', view.list?.searchableFields || [], supportsSearch],
+                    ['filterFields', view.list?.filterFields || [], supportsFilter],
+                    ['defaultSort', view.list?.defaultSort ? [view.list.defaultSort.field] : [], supportsSort],
+                ]) {
+                    for (const code of values) {
+                        const field = canonical.schema.fields.find(field => field.code === code);
+                        if (!field || !supports(field.type))
+                            diagnostics.push(diagnostic('APP_CONFIG_DATA_VIEW_QUERY_FIELD_INVALID', '视图查询字段不存在或不支持此查询类型', `${resourcePath}.views[${viewIndex}].list.${property}`));
+                    }
+                }
+            }
             diagnostics.push(...validateDataResource(canonical).map(item => ({
                 ...item,
                 path: `${resourcePath}.${item.path}`,
@@ -3730,24 +4050,69 @@ export function validateAppDeclaration(value) {
     return diagnostics;
 }
 export function defineOpenXiangdaApp(declaration) {
-    const declarationDiagnostics = validateAppDeclaration(declaration);
+    const { modules, ...input } = declaration;
+    const projected = materializeApplicationModules(modules || []);
+    if (projected.diagnostics.length)
+        throw new AppConfigValidationError(projected.diagnostics);
+    const normalizedDeclaration = normalizeLegacyUserSurfaceAuthoring({
+        ...input,
+        schemaVersion: declaration.schemaVersion ?? 3,
+        frontend: { root: 'apps/web', ...declaration.frontend },
+        backend: {
+            root: 'apps/server', runtime: 'node', framework: 'nestjs',
+            enabled: Boolean(declaration.backend?.operations?.length || declaration.backend?.secrets?.length ||
+                declaration.events?.subscriptions?.length || declaration.events?.timers?.length ||
+                declaration.events?.dateTriggers?.length ||
+                declaration.workflows?.providers?.length),
+            ...declaration.backend,
+        },
+        platform: { root: 'platform', ...declaration.platform },
+        ...(modules || declaration.data ? {
+            data: { resources: [...(declaration.data?.resources || []), ...projected.resources] },
+        } : {}),
+    });
+    const declarationDiagnostics = validateAppDeclaration(normalizedDeclaration);
     if (declarationDiagnostics.length > 0) {
         throw new AppConfigValidationError(declarationDiagnostics);
     }
-    const { data, ...application } = declaration;
-    const config = {
+    const { data, ...application } = normalizedDeclaration;
+    const materialized = {
         ...application,
         ...(data
             ? {
                 data: {
-                    resources: data.resources.map(resource => materializeDataResource(declaration.app.code, resource)),
+                    resources: data.resources.map(resource => materializeDataResource(normalizedDeclaration.app.code, resource)),
                 },
             }
             : {}),
     };
+    const config = materialized.authz
+        ? {
+            ...materialized,
+            authz: {
+                ...materialized.authz,
+                roles: materialized.authz.roles.map(role => ({
+                    ...role,
+                    capabilities: materializeRoleCapabilities(role),
+                })),
+            },
+        }
+        : materialized;
     const diagnostics = validateAppConfig(config);
     if (diagnostics.length > 0)
         throw new AppConfigValidationError(diagnostics);
-    return Object.freeze(config);
+    const sealed = config.authz
+        ? {
+            ...config,
+            authz: {
+                ...config.authz,
+                roles: config.authz.roles.map(role => {
+                    const { deniedCapabilities: _deniedCapabilities, ...materializedRole } = role;
+                    return materializedRole;
+                }),
+            },
+        }
+        : config;
+    return Object.freeze(sealed);
 }
 //# sourceMappingURL=config.js.map