openxiangda 1.0.16 → 1.0.17

package/lib/cli.js

@@ -1,5 +1,6 @@
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 const { spawnSync } = require('child_process');
 const {
   CONFIG_FILE,
@@ -44,6 +45,7 @@ async function main(argv) {
   if (command === 'automation') return automation(rest);
   if (command === 'permission') return permission(rest);
   if (command === 'settings') return settings(rest);
+  if (command === 'resource') return resource(rest);
   if (command === 'inspect') return inspect(rest);
   if (command === 'skill') return skill(rest);
   if (command === 'commands') return commands(rest);
@@ -63,7 +65,7 @@ Usage:
   openxiangda env [--profile name]
   openxiangda workspace init [dir] [--name package-name] [--install] [--profile name --app-type APP_XXX]
   openxiangda workspace bind --profile <name> --app-type <APP_XXX>
-  openxiangda workspace publish --profile <name>
+  openxiangda workspace publish --profile <name> [--prune]
   openxiangda app list [--profile name] [--json]
   openxiangda app create <name> [--profile name] [--description text]
   openxiangda app snapshot <APP_XXX> [--profile name] [--json]
@@ -90,6 +92,7 @@ Usage:
   openxiangda permission page-group-list|page-group-create|page-group-bind
   openxiangda permission form-group-list|form-group-create|form-group-bind
   openxiangda settings get|save|indexes|indexes-save|data-management|data-management-save|public-access
+  openxiangda resource validate|plan|publish|pull [--profile name] [--json]
   openxiangda inspect app|form|workflow|automation|permissions
   openxiangda skill install [--agent codex] [--dest <skills-dir>] [--force] [--dry-run] [--json]
   openxiangda skill status [--agent codex] [--dest <skills-dir>] [--json]
@@ -407,6 +410,11 @@ async function workspace(args) {
         workflows: {},
         automations: {},
         menus: {},
+        roles: {},
+        connectors: {},
+        pagePermissionGroups: {},
+        formPermissionGroups: {},
+        formSettings: {},
       },
       updatedAt: new Date().toISOString(),
     };
@@ -429,6 +437,10 @@ async function workspace(args) {
       `/openxiangda-api/v1/apps/${encodeURIComponent(bound.appType)}/snapshot`
     );
     runWorkspacePublish(profileName, profile, bound.appType);
+    await publishResourcesForWorkspace(config, profileName, {
+      quiet: true,
+      prune: Boolean(flags.prune),
+    });
     return;
   }
 
@@ -1657,6 +1669,53 @@ async function settings(args) {
   );
 }
 
+async function resource(args) {
+  const [subcommand, ...rest] = args;
+  const { flags } = parseArgs(rest);
+  const config = loadConfig();
+  const profileName = flags.profile || config.currentProfile;
+
+  if (!['validate', 'plan', 'publish', 'pull'].includes(subcommand)) {
+    fail('用法: openxiangda resource validate|plan|publish|pull [--profile name] [--json]');
+  }
+
+  if (subcommand === 'pull') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const result = await pullResources(config, target);
+    if (flags.json) return writeJson(result);
+    printResourceResult(result);
+    return;
+  }
+
+  const manifest = loadWorkspaceResources();
+  const validation = validateWorkspaceResources(manifest);
+  if (subcommand === 'validate') {
+    if (flags.json) return writeJson(validation);
+    printResourceValidation(validation);
+    if (validation.errors.length > 0) {
+      fail(`资源配置校验失败: ${validation.errors.length} 个错误`);
+    }
+    return;
+  }
+  if (validation.errors.length > 0) {
+    fail(`资源配置校验失败: ${validation.errors[0]}`);
+  }
+
+  const target = getWorkspaceTarget(config, profileName, flags);
+  if (subcommand === 'plan') {
+    const plan = await buildResourcePlan(config, target, manifest);
+    if (flags.json) return writeJson(plan);
+    printResourcePlan(plan);
+    return;
+  }
+
+  const result = await publishResourceManifest(config, target, manifest, {
+    prune: Boolean(flags.prune),
+  });
+  if (flags.json) return writeJson(result);
+  printResourceResult(result);
+}
+
 async function inspect(args) {
   const [subcommand, ...rest] = args;
   const { flags, positional } = parseArgs(rest);
@@ -1744,7 +1803,7 @@ async function commands(args) {
       'platform add|list|use|remove',
       'auth status|refresh|logout',
       'env',
-      'workspace init|bind|publish',
+      'workspace init|bind|publish [--prune]',
       'app list|create|snapshot',
       'form list|create|bind|pull|publish',
       'page list|publish|bind|releases|activate',
@@ -1755,6 +1814,7 @@ async function commands(args) {
       'permission page-group-list|page-group-create|page-group-bind',
       'permission form-group-list|form-group-create|form-group-bind|form-summary|menu-permissions',
       'settings get|save|indexes|indexes-save|data-management|data-management-save|public-access|public-access-save|public-access-delete',
+      'resource validate|plan|publish|pull',
       'inspect app|form|workflow|automation|permissions',
       'skill install|status',
     ],
@@ -1891,8 +1951,10 @@ function ensureResourceBuckets(bound) {
   bound.resources.automations = bound.resources.automations || {};
   bound.resources.menus = bound.resources.menus || {};
   bound.resources.roles = bound.resources.roles || {};
+  bound.resources.connectors = bound.resources.connectors || {};
   bound.resources.pagePermissionGroups = bound.resources.pagePermissionGroups || {};
   bound.resources.formPermissionGroups = bound.resources.formPermissionGroups || {};
+  bound.resources.formSettings = bound.resources.formSettings || {};
 }
 
 function resolveFormUuid(bound, formKey, flags = {}) {
@@ -2033,106 +2095,80 @@ function resolveSettingsFormUuid(bound, formKey, flags = {}) {
 }
 
 function saveFormResource(target, formCode, formUuid, extra = {}) {
-  target.state.profiles = target.state.profiles || {};
-  target.state.profiles[target.profileName] = {
-    ...target.bound,
-    baseUrl: target.profile.baseUrl,
-    appType: target.appType,
-    updatedAt: new Date().toISOString(),
-  };
-  const nextBound = target.state.profiles[target.profileName];
-  ensureResourceBuckets(nextBound);
-  nextBound.resources.forms[formCode] = {
-    ...(nextBound.resources.forms[formCode] || {}),
-    ...extra,
+  saveStateResource(target, 'forms', formCode, {
+    ...pickStateFields(extra, []),
     formUuid,
-    updatedAt: new Date().toISOString(),
-  };
-  saveProjectState(target.state);
-  target.bound = nextBound;
+  }, ['formUuid']);
 }
 
 function savePageResource(target, pageCode, pageId, extra = {}) {
-  target.state.profiles = target.state.profiles || {};
-  target.state.profiles[target.profileName] = {
-    ...target.bound,
-    baseUrl: target.profile.baseUrl,
-    appType: target.appType,
-    updatedAt: new Date().toISOString(),
-  };
-  const nextBound = target.state.profiles[target.profileName];
-  ensureResourceBuckets(nextBound);
-  nextBound.resources.pages[pageCode] = {
-    ...(nextBound.resources.pages[pageCode] || {}),
-    ...extra,
+  const keys = ['pageId', 'routeKey', 'legacyFormUuid', 'formUuid'];
+  saveStateResource(target, 'pages', pageCode, {
+    ...pickStateFields(extra, keys),
     pageId,
-    updatedAt: new Date().toISOString(),
-  };
-  saveProjectState(target.state);
-  target.bound = nextBound;
+  }, keys);
 }
 
 function saveMenuResource(target, menuCode, menuId, extra = {}) {
-  target.state.profiles = target.state.profiles || {};
-  target.state.profiles[target.profileName] = {
-    ...target.bound,
-    baseUrl: target.profile.baseUrl,
-    appType: target.appType,
-    updatedAt: new Date().toISOString(),
-  };
-  const nextBound = target.state.profiles[target.profileName];
-  ensureResourceBuckets(nextBound);
-  nextBound.resources.menus[menuCode] = {
-    ...(nextBound.resources.menus[menuCode] || {}),
-    ...extra,
+  const keys = [
+    'menuId',
+    'formUuid',
+    'pageId',
+    'pageCode',
+    'routeKey',
+    'legacyFormUuid',
+    'parentId',
+  ];
+  saveStateResource(target, 'menus', menuCode, {
+    ...pickStateFields(extra, keys),
     menuId,
-    updatedAt: new Date().toISOString(),
-  };
-  saveProjectState(target.state);
-  target.bound = nextBound;
+  }, keys);
 }
 
 function saveWorkflowResource(target, workflowCode, workflowId, extra = {}) {
-  target.state.profiles = target.state.profiles || {};
-  target.state.profiles[target.profileName] = {
-    ...target.bound,
-    baseUrl: target.profile.baseUrl,
-    appType: target.appType,
-    updatedAt: new Date().toISOString(),
-  };
-  const nextBound = target.state.profiles[target.profileName];
-  ensureResourceBuckets(nextBound);
-  nextBound.resources.workflows[workflowCode] = {
-    ...(nextBound.resources.workflows[workflowCode] || {}),
-    ...extra,
+  const keys = ['workflowId', 'formUuid'];
+  saveStateResource(target, 'workflows', workflowCode, {
+    ...pickStateFields(extra, keys),
     workflowId,
-    updatedAt: new Date().toISOString(),
-  };
-  saveProjectState(target.state);
-  target.bound = nextBound;
+  }, keys);
 }
 
 function saveAutomationResource(target, automationCode, automationId, extra = {}) {
-  target.state.profiles = target.state.profiles || {};
-  target.state.profiles[target.profileName] = {
-    ...target.bound,
-    baseUrl: target.profile.baseUrl,
-    appType: target.appType,
-    updatedAt: new Date().toISOString(),
-  };
-  const nextBound = target.state.profiles[target.profileName];
-  ensureResourceBuckets(nextBound);
-  nextBound.resources.automations[automationCode] = {
-    ...(nextBound.resources.automations[automationCode] || {}),
-    ...extra,
+  const keys = ['automationId', 'formUuid'];
+  saveStateResource(target, 'automations', automationCode, {
+    ...pickStateFields(extra, keys),
     automationId,
-    updatedAt: new Date().toISOString(),
-  };
-  saveProjectState(target.state);
-  target.bound = nextBound;
+  }, keys);
+}
+
+function saveRoleResource(target, roleCode, roleId) {
+  saveStateResource(target, 'roles', roleCode, { roleId }, ['roleId']);
+}
+
+function saveConnectorResource(target, connectorCode, connectorId, extra = {}) {
+  const apis = {};
+  for (const [apiCode, value] of Object.entries(extra.apis || {})) {
+    if (value?.apiId) apis[apiCode] = { apiId: value.apiId };
+  }
+  saveStateResource(target, 'connectors', connectorCode, {
+    connectorId,
+    ...(Object.keys(apis).length > 0 ? { apis } : {}),
+  }, ['connectorId', 'apis']);
+}
+
+function savePagePermissionGroupResource(target, groupCode, groupId) {
+  saveStateResource(target, 'pagePermissionGroups', groupCode, { groupId }, ['groupId']);
+}
+
+function saveFormPermissionGroupResource(target, groupCode, groupId, extra = {}) {
+  const keys = ['groupId', 'formUuid'];
+  saveStateResource(target, 'formPermissionGroups', groupCode, {
+    ...pickStateFields(extra, keys),
+    groupId,
+  }, keys);
 }
 
-function saveRoleResource(target, roleCode, roleId, extra = {}) {
+function saveStateResource(target, bucket, code, value = {}, keys = Object.keys(value)) {
   target.state.profiles = target.state.profiles || {};
   target.state.profiles[target.profileName] = {
     ...target.bound,
@@ -2142,54 +2178,1862 @@ function saveRoleResource(target, roleCode, roleId, extra = {}) {
   };
   const nextBound = target.state.profiles[target.profileName];
   ensureResourceBuckets(nextBound);
-  nextBound.resources.roles[roleCode] = {
-    ...(nextBound.resources.roles[roleCode] || {}),
-    ...extra,
-    roleId,
+  const previous = nextBound.resources[bucket]?.[code] || {};
+  nextBound.resources[bucket] = nextBound.resources[bucket] || {};
+  nextBound.resources[bucket][code] = {
+    ...pickStateFields(previous, keys),
+    ...pickStateFields(value, keys),
     updatedAt: new Date().toISOString(),
   };
   saveProjectState(target.state);
   target.bound = nextBound;
 }
 
-function savePagePermissionGroupResource(target, groupCode, groupId, extra = {}) {
-  target.state.profiles = target.state.profiles || {};
-  target.state.profiles[target.profileName] = {
-    ...target.bound,
-    baseUrl: target.profile.baseUrl,
-    appType: target.appType,
-    updatedAt: new Date().toISOString(),
+function pickStateFields(value, keys) {
+  const result = {};
+  for (const key of keys) {
+    if (value?.[key] !== undefined && value[key] !== null && value[key] !== '') {
+      result[key] = value[key];
+    }
+  }
+  return result;
+}
+
+const RESOURCE_SPECS = [
+  { key: 'roles', dir: 'roles', topFiles: ['roles.json'], pluralKeys: ['roles'] },
+  { key: 'connectors', dir: 'connectors', topFiles: ['connectors.json'], pluralKeys: ['connectors'] },
+  { key: 'menus', dir: 'menus', topFiles: ['menus.json'], pluralKeys: ['menus'] },
+  { key: 'workflows', dir: 'workflows', topFiles: ['workflows.json'], pluralKeys: ['workflows'] },
+  { key: 'automations', dir: 'automations', topFiles: ['automations.json'], pluralKeys: ['automations'] },
+  {
+    key: 'pagePermissionGroups',
+    dir: path.join('permissions', 'page-groups'),
+    topFiles: [path.join('permissions', 'page-groups.json')],
+    pluralKeys: ['pagePermissionGroups', 'pageGroups'],
+  },
+  {
+    key: 'formPermissionGroups',
+    dir: path.join('permissions', 'form-groups'),
+    topFiles: [path.join('permissions', 'form-groups.json')],
+    pluralKeys: ['formPermissionGroups', 'formGroups'],
+  },
+  {
+    key: 'formSettings',
+    dir: path.join('settings', 'forms'),
+    topFiles: [path.join('settings', 'forms.json')],
+    pluralKeys: ['formSettings', 'forms'],
+  },
+];
+
+function loadWorkspaceResources() {
+  const baseDir = path.join(process.cwd(), 'src', 'resources');
+  const manifest = { baseDir };
+  for (const spec of RESOURCE_SPECS) {
+    manifest[spec.key] = readResourceItems(baseDir, spec);
+  }
+  return manifest;
+}
+
+function readResourceItems(baseDir, spec) {
+  const items = [];
+  for (const relativeFile of spec.topFiles || []) {
+    const filePath = path.join(baseDir, relativeFile);
+    if (fs.existsSync(filePath)) {
+      items.push(...readResourceItemsFromFile(filePath, spec));
+    }
+  }
+
+  const dirPath = path.join(baseDir, spec.dir);
+  if (fs.existsSync(dirPath)) {
+    for (const filePath of listJsonFiles(dirPath)) {
+      items.push(...readResourceItemsFromFile(filePath, spec));
+    }
+  }
+  return items;
+}
+
+function readResourceItemsFromFile(filePath, spec) {
+  let value;
+  try {
+    value = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+  } catch (error) {
+    return [
+      {
+        __invalid: true,
+        __source: filePath,
+        __error: `JSON 解析失败: ${error.message}`,
+      },
+    ];
+  }
+
+  const defaultCode = path.basename(filePath, '.json');
+  const values = extractResourceValues(value, spec);
+  return values.map((item, index) => {
+    if (!item || typeof item !== 'object' || Array.isArray(item)) {
+      return {
+        __invalid: true,
+        __source: filePath,
+        __error: '资源项必须是 JSON object',
+      };
+    }
+    const code =
+      item.code ||
+      item.resourceCode ||
+      item.methodName ||
+      item.formCode ||
+      (values.length === 1 ? defaultCode : undefined);
+    return {
+      ...item,
+      ...(code ? { code } : {}),
+      __source: filePath,
+      __dir: path.dirname(filePath),
+      __index: index,
+    };
+  });
+}
+
+function extractResourceValues(value, spec) {
+  if (Array.isArray(value)) return value;
+  if (!value || typeof value !== 'object') return [value];
+  for (const key of spec.pluralKeys || []) {
+    if (Array.isArray(value[key])) return value[key];
+  }
+  if (value.resource && typeof value.resource === 'object') return [value.resource];
+  return [value];
+}
+
+function listJsonFiles(dirPath) {
+  if (!fs.existsSync(dirPath)) return [];
+  return fs
+    .readdirSync(dirPath, { withFileTypes: true })
+    .flatMap(entry => {
+      const nextPath = path.join(dirPath, entry.name);
+      if (entry.isDirectory()) return listJsonFiles(nextPath);
+      return entry.isFile() && entry.name.endsWith('.json') ? [nextPath] : [];
+    })
+    .sort();
+}
+
+function validateWorkspaceResources(manifest) {
+  const errors = [];
+  const warnings = [];
+  const counts = {};
+  for (const spec of RESOURCE_SPECS) {
+    const items = manifest[spec.key] || [];
+    counts[spec.key] = items.length;
+    for (const item of items) {
+      validateResourceItem(spec.key, item, errors, warnings);
+    }
+  }
+  return {
+    valid: errors.length === 0,
+    errors,
+    warnings,
+    counts,
+    baseDir: manifest.baseDir,
   };
-  const nextBound = target.state.profiles[target.profileName];
-  ensureResourceBuckets(nextBound);
-  nextBound.resources.pagePermissionGroups[groupCode] = {
-    ...(nextBound.resources.pagePermissionGroups[groupCode] || {}),
-    ...extra,
-    groupId,
-    updatedAt: new Date().toISOString(),
+}
+
+function validateResourceItem(kind, item, errors, warnings) {
+  const label = resourceLabel(kind, item);
+  if (item.__invalid) {
+    errors.push(`${item.__source}: ${item.__error}`);
+    return;
+  }
+  if (!item.code) errors.push(`${label}: 缺少 code`);
+
+  if (kind === 'connectors') {
+    if (!item.name) errors.push(`${label}: 缺少 name`);
+    if (!item.domain && !item.url) errors.push(`${label}: 缺少 domain 或 url`);
+    if (!Array.isArray(item.apis) || item.apis.length === 0) {
+      errors.push(`${label}: 缺少 apis`);
+    } else {
+      item.apis.forEach((api, index) => {
+        if (!api.code && !api.methodName) errors.push(`${label}.apis[${index}]: 缺少 code`);
+        if (!api.path) errors.push(`${label}.apis[${index}]: 缺少 path`);
+        if (!api.method) errors.push(`${label}.apis[${index}]: 缺少 method`);
+      });
+    }
+    return;
+  }
+
+  if (kind === 'roles' && !item.name) errors.push(`${label}: 缺少 name`);
+  if (kind === 'menus' && !item.name) errors.push(`${label}: 缺少 name`);
+  if (kind === 'workflows') {
+    if (!item.formCode && !item.formUuid) errors.push(`${label}: 缺少 formCode 或 formUuid`);
+    if (!item.definitionJson && !item.definitionFile) {
+      errors.push(`${label}: 缺少 definitionJson 或 definitionFile`);
+    }
+  }
+  if (kind === 'automations') {
+    if (!item.name) errors.push(`${label}: 缺少 name`);
+    if (!item.triggerConfig) errors.push(`${label}: 缺少 triggerConfig`);
+    if (!item.definitionJson && !item.definitionFile) {
+      errors.push(`${label}: 缺少 definitionJson 或 definitionFile`);
+    }
+  }
+  if (kind === 'pagePermissionGroups' && !item.name) errors.push(`${label}: 缺少 name`);
+  if (kind === 'formPermissionGroups') {
+    if (!item.name) errors.push(`${label}: 缺少 name`);
+    if (!item.formCode && !item.formUuid) errors.push(`${label}: 缺少 formCode 或 formUuid`);
+  }
+  if (kind === 'formSettings') {
+    if (!item.formCode && !item.formUuid && !item.code) {
+      errors.push(`${label}: 缺少 formCode、formUuid 或 code`);
+    }
+    if (
+      item.settings === undefined &&
+      item.indexes === undefined &&
+      item.dataManagement === undefined &&
+      item.publicAccess === undefined
+    ) {
+      warnings.push(`${label}: 未声明 settings/indexes/dataManagement/publicAccess`);
+    }
+  }
+}
+
+function resourceLabel(kind, item) {
+  return `${kind}:${item.code || item.__source || item.__index || '?'}`;
+}
+
+async function publishResourcesForWorkspace(config, profileName, options = {}) {
+  const manifest = loadWorkspaceResources();
+  const validation = validateWorkspaceResources(manifest);
+  if (validation.errors.length > 0) {
+    fail(`资源配置校验失败: ${validation.errors[0]}`);
+  }
+  const target = getWorkspaceTarget(config, profileName, {});
+  return publishResourceManifest(config, target, manifest, options);
+}
+
+async function buildResourcePlan(config, target, manifest) {
+  const existing = await fetchExistingResourceMaps(config, target, manifest);
+  const actions = [];
+  addPlanActions(actions, 'role', manifest.roles, existing.roles, roleEquals);
+  addPlanActions(actions, 'menu', manifest.menus, existing.menus, (item, current) => menuEquals(target.bound, item, current));
+  addPlanActions(actions, 'connector', manifest.connectors, existing.connectors, connectorEquals);
+  await addWorkflowPlanActions(config, target, actions, manifest.workflows, existing.workflows);
+  await addAutomationPlanActions(config, target, actions, manifest.automations, existing.automations);
+  addPlanActions(actions, 'pagePermissionGroup', manifest.pagePermissionGroups, existing.pagePermissionGroups, (item, current) => pagePermissionGroupEquals(target.bound, item, current));
+  addPlanActions(actions, 'formPermissionGroup', manifest.formPermissionGroups, existing.formPermissionGroups, (item, current) => formPermissionGroupEquals(target.bound, item, current));
+  for (const item of manifest.formSettings || []) {
+    actions.push({ kind: 'formSetting', code: item.code || item.formCode || item.formUuid, action: 'update' });
+  }
+  return {
+    appType: target.appType,
+    profile: target.profileName,
+    actions,
+    summary: summarizeActions(actions),
   };
-  saveProjectState(target.state);
-  target.bound = nextBound;
 }
 
-function saveFormPermissionGroupResource(target, groupCode, groupId, extra = {}) {
-  target.state.profiles = target.state.profiles || {};
-  target.state.profiles[target.profileName] = {
-    ...target.bound,
-    baseUrl: target.profile.baseUrl,
+async function publishResourceManifest(config, target, manifest, options = {}) {
+  const result = {
     appType: target.appType,
-    updatedAt: new Date().toISOString(),
+    profile: target.profileName,
+    published: [],
+    pruned: [],
+    warnings: [],
   };
-  const nextBound = target.state.profiles[target.profileName];
-  ensureResourceBuckets(nextBound);
-  nextBound.resources.formPermissionGroups[groupCode] = {
-    ...(nextBound.resources.formPermissionGroups[groupCode] || {}),
-    ...extra,
-    groupId,
-    updatedAt: new Date().toISOString(),
+  if (isManifestEmpty(manifest)) {
+    if (!options.quiet) result.warnings.push('未发现 src/resources 资源配置');
+    if (!options.prune) return result;
+  }
+
+  await publishRoleResources(config, target, manifest.roles || [], result);
+  await publishFormSettingsResources(config, target, manifest.formSettings || [], result);
+  await publishMenuResources(config, target, manifest.menus || [], result);
+  await publishConnectorResources(config, target, manifest.connectors || [], result);
+  await publishWorkflowResources(config, target, manifest.workflows || [], result);
+  await publishAutomationResources(config, target, manifest.automations || [], result);
+  await publishPagePermissionGroupResources(config, target, manifest.pagePermissionGroups || [], result);
+  await publishFormPermissionGroupResources(config, target, manifest.formPermissionGroups || [], result);
+  if (options.prune) {
+    await pruneResourceManifest(config, target, manifest, result);
+  }
+  return result;
+}
+
+function isManifestEmpty(manifest) {
+  return RESOURCE_SPECS.every(spec => (manifest[spec.key] || []).length === 0);
+}
+
+async function fetchExistingResourceMaps(config, target, manifest) {
+  const maps = {
+    roles: new Map(),
+    menus: new Map(),
+    connectors: new Map(),
+    workflows: new Map(),
+    automations: new Map(),
+    pagePermissionGroups: new Map(),
+    formPermissionGroups: new Map(),
   };
-  saveProjectState(target.state);
-  target.bound = nextBound;
+
+  if ((manifest.roles || []).length > 0) {
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      apiPathWithQuery(`/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/roles`, {
+        page: 1,
+        limit: 1000,
+      })
+    );
+    indexByCode(maps.roles, normalizeItems(data), item => item.code);
+  }
+  if ((manifest.menus || []).length > 0) {
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/menus`
+    );
+    indexByCode(maps.menus, flattenItems(normalizeItems(data)), item => item.resourceCode);
+  }
+  if ((manifest.connectors || []).length > 0) {
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/connectors`
+    );
+    indexByCode(maps.connectors, normalizeItems(data), item => item.code || item.methodName);
+  }
+  if ((manifest.workflows || []).length > 0) {
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      apiPathWithQuery(`/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows`, {
+        page: 1,
+        pageSize: 1000,
+      })
+    );
+    indexByCode(maps.workflows, normalizeItems(data), item => item.resourceCode);
+  }
+  if ((manifest.automations || []).length > 0) {
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      apiPathWithQuery(`/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations`, {
+        page: 1,
+        pageSize: 1000,
+      })
+    );
+    indexByCode(maps.automations, normalizeItems(data), item => item.resourceCode);
+  }
+  if ((manifest.pagePermissionGroups || []).length > 0) {
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      apiPathWithQuery(`/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/page-permission-groups`, {
+        page: 1,
+        limit: 1000,
+      })
+    );
+    indexByCode(maps.pagePermissionGroups, normalizeItems(data), item => item.resourceCode);
+  }
+  if ((manifest.formPermissionGroups || []).length > 0) {
+    for (const formUuid of unique((manifest.formPermissionGroups || []).map(item => resolveManifestFormUuid(target.bound, item)).filter(Boolean))) {
+      const data = await requestWithAuth(
+        config,
+        target.profileName,
+        apiPathWithQuery(`/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/permission-groups`, {
+          page: 1,
+          limit: 1000,
+        })
+      );
+      indexByCode(maps.formPermissionGroups, normalizeItems(data), item => item.resourceCode);
+    }
+  }
+  return maps;
+}
+
+function addPlanActions(actions, kind, desiredItems = [], existingMap, equals) {
+  for (const item of desiredItems) {
+    const code = item.code || item.resourceCode || item.methodName;
+    const existing = existingMap.get(code);
+    actions.push({
+      kind,
+      code,
+      action: existing ? (equals(item, existing) ? 'noop' : 'update') : 'create',
+      platformId: existing?.id,
+    });
+  }
+}
+
+async function addWorkflowPlanActions(config, target, actions, desiredItems = [], existingMap) {
+  for (const item of desiredItems) {
+    const code = item.code || item.resourceCode;
+    const existing = existingMap.get(code);
+    if (!existing) {
+      actions.push({ kind: 'workflow', code, action: 'create' });
+      continue;
+    }
+    const detail = await requestOptionalWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows/${encodeURIComponent(existing.id)}`
+    );
+    actions.push({
+      kind: 'workflow',
+      code,
+      action: workflowEquals(target.bound, item, detail || existing) ? 'noop' : 'update',
+      platformId: existing.id,
+    });
+  }
+}
+
+async function addAutomationPlanActions(config, target, actions, desiredItems = [], existingMap) {
+  for (const item of desiredItems) {
+    const code = item.code || item.resourceCode;
+    const existing = existingMap.get(code);
+    if (!existing) {
+      actions.push({ kind: 'automation', code, action: 'create' });
+      continue;
+    }
+    const detail = await requestOptionalWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations/${encodeURIComponent(existing.id)}`
+    );
+    actions.push({
+      kind: 'automation',
+      code,
+      action: automationEquals(target, item, detail || existing) ? 'noop' : 'update',
+      platformId: existing.id,
+    });
+  }
+}
+
+function summarizeActions(actions) {
+  return actions.reduce(
+    (acc, item) => {
+      acc[item.action] = (acc[item.action] || 0) + 1;
+      return acc;
+    },
+    { create: 0, update: 0, noop: 0, delete: 0 }
+  );
+}
+
+function normalizeItems(data) {
+  if (!data) return [];
+  if (Array.isArray(data)) return data;
+  if (Array.isArray(data.items)) return data.items;
+  if (Array.isArray(data.data)) return data.data;
+  if (Array.isArray(data.data?.items)) return data.data.items;
+  return [];
+}
+
+function flattenItems(items) {
+  const result = [];
+  const visit = item => {
+    if (!item || typeof item !== 'object') return;
+    result.push(item);
+    for (const child of item.children || []) visit(child);
+  };
+  for (const item of items || []) visit(item);
+  return result;
+}
+
+function indexByCode(map, items, getCode) {
+  for (const item of items || []) {
+    const code = getCode(item);
+    if (code) map.set(String(code), item);
+  }
+}
+
+async function requestOptionalWithAuth(config, profileName, apiPath, options = {}) {
+  try {
+    return await requestWithAuth(config, profileName, apiPath, options);
+  } catch (error) {
+    if (Number(error?.apiCode) === 404 || String(error?.message || '').includes('HTTP 404')) {
+      return null;
+    }
+    throw error;
+  }
+}
+
+async function publishRoleResources(config, target, roles, result) {
+  for (const role of roles) {
+    const existing = await findExistingRole(config, target, role.code);
+    const body = {
+      code: role.code,
+      name: role.name || role.code,
+      description: role.description || '',
+    };
+    const data = existing
+      ? await requestWithAuth(
+          config,
+          target.profileName,
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/roles/${encodeURIComponent(existing.id)}`,
+          { method: 'PUT', body }
+        )
+      : await requestWithAuth(
+          config,
+          target.profileName,
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/roles`,
+          { method: 'POST', body }
+        );
+    if (data?.id) {
+      saveRoleResource(target, role.code, data.id, { code: data.code, name: data.name });
+    }
+    if (Array.isArray(role.userIds) && role.userIds.length > 0 && data?.id) {
+      await requestWithAuth(
+        config,
+        target.profileName,
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/roles/${encodeURIComponent(data.id)}/users`,
+        { method: 'POST', body: { userIds: role.userIds } }
+      );
+    }
+    result.published.push({ kind: 'role', code: role.code, action: existing ? 'update' : 'create', id: data?.id });
+  }
+}
+
+async function findExistingRole(config, target, code) {
+  const data = await requestWithAuth(
+    config,
+    target.profileName,
+    apiPathWithQuery(`/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/roles`, {
+      code,
+      page: 1,
+      limit: 1,
+    })
+  );
+  return normalizeItems(data).find(item => item.code === code);
+}
+
+async function publishFormSettingsResources(config, target, settingsItems, result) {
+  for (const item of settingsItems) {
+    const code = item.code || item.formCode || item.formUuid;
+    const formUuid = resolveManifestFormUuid(target.bound, item, { fallbackToCode: true });
+    if (!formUuid) fail(`表单设置 ${code} 无法解析 formUuid`);
+    if (item.settings !== undefined) {
+      await requestWithAuth(
+        config,
+        target.profileName,
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/settings`,
+        { method: 'PUT', body: { settings: item.settings } }
+      );
+    }
+    if (item.indexes !== undefined) {
+      await requestWithAuth(
+        config,
+        target.profileName,
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/field-indexes`,
+        { method: 'PUT', body: { indexes: item.indexes } }
+      );
+    }
+    if (item.dataManagement !== undefined) {
+      await requestWithAuth(
+        config,
+        target.profileName,
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/data-management`,
+        { method: 'PUT', body: { config: item.dataManagement } }
+      );
+    }
+    if (item.publicAccess !== undefined) {
+      const publicAccess =
+        typeof item.publicAccess === 'object'
+          ? item.publicAccess
+          : { isPublic: Boolean(item.publicAccess) };
+      await requestWithAuth(
+        config,
+        target.profileName,
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/public-access`,
+        {
+          method: publicAccess.isPublic === false ? 'DELETE' : 'PUT',
+          body: {
+            isPublic: publicAccess.isPublic !== false,
+            description: publicAccess.description || '',
+          },
+        }
+      );
+    }
+    saveResourceEntry(target, 'formSettings', code, { formUuid });
+    result.published.push({ kind: 'formSetting', code, action: 'update', formUuid });
+  }
+}
+
+async function publishMenuResources(config, target, menus, result) {
+  for (const menuItem of menus) {
+    const existing = await findExistingMenu(config, target, menuItem.code);
+    const formUuid = resolveManifestFormUuid(target.bound, menuItem);
+    const pageId = resolveManifestPageId(target.bound, menuItem);
+    const parentId =
+      resolveManifestMenuId(target.bound, menuItem.parentCode) ||
+      menuItem.parentId ||
+      null;
+    const body = {
+      resourceCode: menuItem.code,
+      name: menuItem.name || menuItem.code,
+      type: menuItem.type || 'nav',
+      formUuid,
+      pageId,
+      parentId,
+      sortOrder: menuItem.sortOrder,
+      icon: menuItem.icon || null,
+      isHidden: menuItem.isHidden,
+    };
+    const data = existing
+      ? await requestWithAuth(
+          config,
+          target.profileName,
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/menus/${encodeURIComponent(existing.id)}`,
+          { method: 'PUT', body }
+        )
+      : await requestWithAuth(
+          config,
+          target.profileName,
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/menus`,
+          { method: 'POST', body }
+        );
+    if (data?.id) {
+      saveMenuResource(target, menuItem.code, data.id, {
+        resourceCode: menuItem.code,
+        name: data.name,
+        type: data.type,
+        ...(formUuid ? { formUuid } : {}),
+        ...(pageId ? { pageId } : {}),
+        ...(menuItem.pageCode ? { pageCode: menuItem.pageCode } : {}),
+      });
+    }
+    result.published.push({ kind: 'menu', code: menuItem.code, action: existing ? 'update' : 'create', id: data?.id });
+  }
+}
+
+async function findExistingMenu(config, target, code) {
+  const data = await requestWithAuth(
+    config,
+    target.profileName,
+    `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/menus`
+  );
+  const items = flattenItems(normalizeItems(data));
+  const stateId = target.bound.resources?.menus?.[code]?.menuId;
+  if (stateId) {
+    const byState = items.find(item => item.id === stateId);
+    if (byState) return byState;
+  }
+  return items.find(item => item.resourceCode === code);
+}
+
+async function publishConnectorResources(config, target, connectors, result) {
+  if (connectors.length === 0) return;
+  const body = { connectors: connectors.map(normalizeConnectorManifest) };
+  const data = await requestWithAuth(
+    config,
+    target.profileName,
+    `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/connectors/actions/sync`,
+    { method: 'POST', body }
+  );
+  for (const item of data.data || []) {
+    const apiEntries = {};
+    for (const api of item.apis || []) {
+      const apiCode = api.code || api.methodName;
+      if (apiCode) apiEntries[apiCode] = { apiId: api.id, name: api.name };
+    }
+    saveConnectorResource(target, item.code, item.connector?.id, {
+      code: item.code,
+      name: item.connector?.name,
+      apis: apiEntries,
+    });
+    result.published.push({
+      kind: 'connector',
+      code: item.code,
+      action: item.created ? 'create' : 'update',
+      id: item.connector?.id,
+    });
+  }
+}
+
+async function publishWorkflowResources(config, target, workflows, result) {
+  for (const workflowItem of workflows) {
+    const existing = await findExistingWorkflow(config, target, workflowItem.code);
+    const definitionJson = await resolveManifestJson(
+      config,
+      target.profileName,
+      workflowItem,
+      'definitionJson',
+      'definitionFile'
+    );
+    const viewJson = await resolveManifestJson(
+      config,
+      target.profileName,
+      workflowItem,
+      'viewJson',
+      'viewFile',
+      true
+    );
+    const formUuid = resolveManifestFormUuid(target.bound, workflowItem);
+    const body = {
+      resourceCode: workflowItem.code,
+      formUuid,
+      definitionJson,
+      ...(viewJson !== undefined ? { viewJson } : {}),
+    };
+    const data = existing
+      ? await requestWithAuth(
+          config,
+          target.profileName,
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows/${encodeURIComponent(existing.id)}`,
+          { method: 'PUT', body }
+        )
+      : await requestWithAuth(
+          config,
+          target.profileName,
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows`,
+          { method: 'POST', body }
+        );
+    if (workflowItem.publish && data?.id) {
+      await requestWithAuth(
+        config,
+        target.profileName,
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows/${encodeURIComponent(data.id)}/publish`,
+        { method: 'POST', body: { isPublished: true } }
+      );
+    }
+    if (data?.id) saveWorkflowResource(target, workflowItem.code, data.id, { formUuid, resourceCode: workflowItem.code });
+    result.published.push({ kind: 'workflow', code: workflowItem.code, action: existing ? 'update' : 'create', id: data?.id });
+  }
+}
+
+async function findExistingWorkflow(config, target, code) {
+  const stateId = target.bound.resources?.workflows?.[code]?.workflowId;
+  if (stateId) {
+    const stateItem = await requestOptionalWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows/${encodeURIComponent(stateId)}`
+    );
+    if (stateItem?.id) return stateItem;
+  }
+  const data = await requestWithAuth(
+    config,
+    target.profileName,
+    apiPathWithQuery(`/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows`, {
+      resourceCode: code,
+      page: 1,
+      pageSize: 1000,
+    })
+  );
+  return normalizeItems(data).find(item => item.resourceCode === code);
+}
+
+async function publishAutomationResources(config, target, automations, result) {
+  for (const automationItem of automations) {
+    const existing = await findExistingAutomation(config, target, automationItem.code);
+    const definitionJson = await resolveManifestJson(
+      config,
+      target.profileName,
+      automationItem,
+      'definitionJson',
+      'definitionFile'
+    );
+    const viewJson = await resolveManifestJson(
+      config,
+      target.profileName,
+      automationItem,
+      'viewJson',
+      'viewFile',
+      true
+    );
+    const automationPayload = resolveAutomationManifestPayload(target, automationItem);
+    const body = {
+      resourceCode: automationItem.code,
+      name: automationItem.name || automationItem.code,
+      description: automationItem.description || '',
+      formUuid: automationPayload.formUuid,
+      triggerConfig: automationPayload.triggerConfig,
+      definitionJson,
+      ...(viewJson !== undefined ? { viewJson } : {}),
+      ...(automationItem.tags !== undefined ? { tags: Array.isArray(automationItem.tags) ? automationItem.tags.join(',') : automationItem.tags } : {}),
+      ...(automationItem.isEnabled !== undefined ? { isEnabled: Boolean(automationItem.isEnabled) } : {}),
+    };
+    const data = existing
+      ? await requestWithAuth(
+          config,
+          target.profileName,
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations/${encodeURIComponent(existing.id)}`,
+          { method: 'PUT', body }
+        )
+      : await requestWithAuth(
+          config,
+          target.profileName,
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations`,
+          { method: 'POST', body }
+        );
+    if (automationItem.publish && data?.id) {
+      await requestWithAuth(
+        config,
+        target.profileName,
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations/${encodeURIComponent(data.id)}/publish`,
+        { method: 'POST' }
+      );
+    }
+    if (automationItem.enable !== undefined && data?.id) {
+      await requestWithAuth(
+        config,
+        target.profileName,
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations/${encodeURIComponent(data.id)}/${automationItem.enable ? 'enable' : 'disable'}`,
+        { method: 'POST' }
+      );
+    }
+    if (data?.id) saveAutomationResource(target, automationItem.code, data.id, { formUuid: automationPayload.formUuid, resourceCode: automationItem.code });
+    result.published.push({ kind: 'automation', code: automationItem.code, action: existing ? 'update' : 'create', id: data?.id });
+  }
+}
+
+async function findExistingAutomation(config, target, code) {
+  const stateId = target.bound.resources?.automations?.[code]?.automationId;
+  if (stateId) {
+    const stateItem = await requestOptionalWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations/${encodeURIComponent(stateId)}`
+    );
+    if (stateItem?.id) return stateItem;
+  }
+  const data = await requestWithAuth(
+    config,
+    target.profileName,
+    apiPathWithQuery(`/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations`, {
+      resourceCode: code,
+      page: 1,
+      pageSize: 1000,
+    })
+  );
+  return normalizeItems(data).find(item => item.resourceCode === code);
+}
+
+async function publishPagePermissionGroupResources(config, target, groups, result) {
+  for (const group of groups) {
+    const existing = await findExistingPagePermissionGroup(config, target, group.code);
+    const body = {
+      resourceCode: group.code,
+      name: group.name || group.code,
+      roles: group.roles || [],
+      menuFormUuids: resolvePagePermissionGroupTargets(target.bound, group),
+    };
+    const data = existing
+      ? await requestWithAuth(
+          config,
+          target.profileName,
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/page-permission-groups/${encodeURIComponent(existing.id)}`,
+          { method: 'PUT', body }
+        )
+      : await requestWithAuth(
+          config,
+          target.profileName,
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/page-permission-groups`,
+          { method: 'POST', body }
+        );
+    if (data?.id) savePagePermissionGroupResource(target, group.code, data.id, { name: data.name, resourceCode: group.code });
+    result.published.push({ kind: 'pagePermissionGroup', code: group.code, action: existing ? 'update' : 'create', id: data?.id });
+  }
+}
+
+async function findExistingPagePermissionGroup(config, target, code) {
+  const stateId = target.bound.resources?.pagePermissionGroups?.[code]?.groupId;
+  if (stateId) {
+    const stateItem = await requestOptionalWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/page-permission-groups/${encodeURIComponent(stateId)}`
+    );
+    if (stateItem?.id) return stateItem;
+  }
+  const data = await requestWithAuth(
+    config,
+    target.profileName,
+    apiPathWithQuery(`/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/page-permission-groups`, {
+      resourceCode: code,
+      page: 1,
+      limit: 1000,
+    })
+  );
+  return normalizeItems(data).find(item => item.resourceCode === code);
+}
+
+async function publishFormPermissionGroupResources(config, target, groups, result) {
+  for (const group of groups) {
+    const formUuid = resolveManifestFormUuid(target.bound, group);
+    const existing = await findExistingFormPermissionGroup(config, target, group.code, formUuid);
+    const body = {
+      ...withoutResourceMeta(group),
+      resourceCode: group.code,
+      formUuid,
+      name: group.name || group.code,
+      type: group.type || 'view',
+      roles: group.roles || [],
+    };
+    delete body.code;
+    delete body.formCode;
+    delete body.form;
+    const data = existing
+      ? await requestWithAuth(
+          config,
+          target.profileName,
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/permission-groups/${encodeURIComponent(existing.id)}`,
+          { method: 'PUT', body }
+        )
+      : await requestWithAuth(
+          config,
+          target.profileName,
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/permission-groups`,
+          { method: 'POST', body }
+        );
+    if (data?.id) saveFormPermissionGroupResource(target, group.code, data.id, { formUuid, name: data.name, resourceCode: group.code });
+    result.published.push({ kind: 'formPermissionGroup', code: group.code, action: existing ? 'update' : 'create', id: data?.id });
+  }
+}
+
+async function findExistingFormPermissionGroup(config, target, code, formUuid) {
+  const stateId = target.bound.resources?.formPermissionGroups?.[code]?.groupId;
+  if (stateId) {
+    const stateItem = await requestOptionalWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/permission-groups/${encodeURIComponent(stateId)}`
+    );
+    if (stateItem?.id) return stateItem;
+  }
+  const data = await requestWithAuth(
+    config,
+    target.profileName,
+    apiPathWithQuery(`/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/permission-groups`, {
+      resourceCode: code,
+      page: 1,
+      limit: 1000,
+    })
+  );
+  return normalizeItems(data).find(item => item.resourceCode === code);
+}
+
+async function pruneResourceManifest(config, target, manifest, result) {
+  await pruneRoles(config, target, desiredCodes(manifest.roles), result);
+  await pruneConnectors(config, target, desiredCodes(manifest.connectors), result);
+  await pruneMenus(config, target, desiredCodes(manifest.menus), result);
+  await pruneWorkflows(config, target, desiredCodes(manifest.workflows), result);
+  await pruneAutomations(config, target, desiredCodes(manifest.automations), result);
+  await prunePagePermissionGroups(
+    config,
+    target,
+    desiredCodes(manifest.pagePermissionGroups),
+    result
+  );
+  await pruneFormPermissionGroups(
+    config,
+    target,
+    desiredCodes(manifest.formPermissionGroups),
+    result
+  );
+}
+
+function desiredCodes(items = []) {
+  return new Set(
+    items
+      .map(item => item.code || item.resourceCode || item.methodName)
+      .filter(Boolean)
+      .map(String)
+  );
+}
+
+async function pruneRoles(config, target, desired, result) {
+  const data = await requestWithAuth(
+    config,
+    target.profileName,
+    apiPathWithQuery(`/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/roles`, {
+      page: 1,
+      limit: 1000,
+    })
+  );
+  for (const role of normalizeItems(data)) {
+    if (!role.code || desired.has(role.code) || role.isAppAdmin) continue;
+    await pruneOne(config, target, result, 'role', role.code, role.id, async () => {
+      await requestWithAuth(
+        config,
+        target.profileName,
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/roles/${encodeURIComponent(role.id)}`,
+        { method: 'DELETE' }
+      );
+    });
+  }
+}
+
+async function pruneConnectors(config, target, desired, result) {
+  const data = await requestWithAuth(
+    config,
+    target.profileName,
+    `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/connectors`
+  );
+  for (const connector of normalizeItems(data)) {
+    const code = connector.code || connector.methodName;
+    if (!code || desired.has(code)) continue;
+    await pruneOne(config, target, result, 'connector', code, connector.id, async () => {
+      await requestWithAuth(
+        config,
+        target.profileName,
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/connectors/${encodeURIComponent(code)}`,
+        { method: 'DELETE' }
+      );
+    });
+  }
+}
+
+async function pruneMenus(config, target, desired, result) {
+  const data = await requestWithAuth(
+    config,
+    target.profileName,
+    `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/menus`
+  );
+  const items = flattenItems(normalizeItems(data)).reverse();
+  for (const menu of items) {
+    const code = menu.resourceCode;
+    if (!code || desired.has(code)) continue;
+    await pruneOne(config, target, result, 'menu', code, menu.id, async () => {
+      await requestWithAuth(
+        config,
+        target.profileName,
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/menus/${encodeURIComponent(menu.id)}`,
+        { method: 'DELETE' }
+      );
+    });
+  }
+}
+
+async function pruneWorkflows(config, target, desired, result) {
+  const data = await requestWithAuth(
+    config,
+    target.profileName,
+    apiPathWithQuery(`/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows`, {
+      page: 1,
+      pageSize: 1000,
+    })
+  );
+  for (const workflow of normalizeItems(data)) {
+    const code = workflow.resourceCode;
+    if (!code || desired.has(code)) continue;
+    await pruneOne(config, target, result, 'workflow', code, workflow.id, async () => {
+      if (workflow.isPublished) {
+        await requestWithAuth(
+          config,
+          target.profileName,
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows/${encodeURIComponent(workflow.id)}/publish`,
+          { method: 'POST', body: { isPublished: false } }
+        );
+      }
+      await requestWithAuth(
+        config,
+        target.profileName,
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows/${encodeURIComponent(workflow.id)}`,
+        { method: 'DELETE' }
+      );
+    });
+  }
+}
+
+async function pruneAutomations(config, target, desired, result) {
+  const data = await requestWithAuth(
+    config,
+    target.profileName,
+    apiPathWithQuery(`/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations`, {
+      page: 1,
+      pageSize: 1000,
+    })
+  );
+  for (const automation of normalizeItems(data)) {
+    const code = automation.resourceCode;
+    if (!code || desired.has(code)) continue;
+    await pruneOne(config, target, result, 'automation', code, automation.id, async () => {
+      if (automation.isPublished) {
+        await requestWithAuth(
+          config,
+          target.profileName,
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations/${encodeURIComponent(automation.id)}/unpublish`,
+          { method: 'POST' }
+        );
+      }
+      await requestWithAuth(
+        config,
+        target.profileName,
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations/${encodeURIComponent(automation.id)}`,
+        { method: 'DELETE' }
+      );
+    });
+  }
+}
+
+async function prunePagePermissionGroups(config, target, desired, result) {
+  const data = await requestWithAuth(
+    config,
+    target.profileName,
+    apiPathWithQuery(`/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/page-permission-groups`, {
+      page: 1,
+      limit: 1000,
+    })
+  );
+  for (const group of normalizeItems(data)) {
+    const code = group.resourceCode;
+    if (!code || desired.has(code)) continue;
+    await pruneOne(config, target, result, 'pagePermissionGroup', code, group.id, async () => {
+      await requestWithAuth(
+        config,
+        target.profileName,
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/page-permission-groups/${encodeURIComponent(group.id)}`,
+        { method: 'DELETE' }
+      );
+    });
+  }
+}
+
+async function pruneFormPermissionGroups(config, target, desired, result) {
+  const forms = await requestWithAuth(
+    config,
+    target.profileName,
+    `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms`
+  );
+  for (const form of normalizeItems(forms)) {
+    const formUuid = form.formUuid;
+    if (!formUuid) continue;
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      apiPathWithQuery(`/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/permission-groups`, {
+        page: 1,
+        limit: 1000,
+      })
+    );
+    for (const group of normalizeItems(data)) {
+      const code = group.resourceCode;
+      if (!code || desired.has(code)) continue;
+      await pruneOne(config, target, result, 'formPermissionGroup', code, group.id, async () => {
+        await requestWithAuth(
+          config,
+          target.profileName,
+          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/permission-groups/${encodeURIComponent(group.id)}`,
+          { method: 'DELETE' }
+        );
+      });
+    }
+  }
+}
+
+async function pruneOne(config, target, result, kind, code, id, deleter) {
+  try {
+    await deleter();
+    removeStateResource(target, kind, code);
+    result.pruned.push({ kind, code, id });
+  } catch (error) {
+    result.warnings.push(
+      `prune ${kind}:${code} failed: ${error?.message || String(error)}`
+    );
+  }
+}
+
+function removeStateResource(target, kind, code) {
+  const bucketByKind = {
+    role: 'roles',
+    connector: 'connectors',
+    menu: 'menus',
+    workflow: 'workflows',
+    automation: 'automations',
+    pagePermissionGroup: 'pagePermissionGroups',
+    formPermissionGroup: 'formPermissionGroups',
+  };
+  const bucket = bucketByKind[kind];
+  if (!bucket || !target.bound.resources?.[bucket]?.[code]) return;
+  delete target.bound.resources[bucket][code];
+  target.bound.updatedAt = new Date().toISOString();
+  if (target.state.profiles?.[target.profileName]) {
+    target.state.profiles[target.profileName] = target.bound;
+  }
+  saveProjectState(target.state);
+}
+
+async function pullResources(config, target) {
+  const baseDir = path.join(process.cwd(), 'src', 'resources');
+  const written = [];
+  const pullLookups = buildPullResourceLookups(target.bound);
+  const connectors = await requestWithAuth(
+    config,
+    target.profileName,
+    `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/connectors`
+  );
+  for (const connector of normalizeItems(connectors)) {
+    const filePath = path.join(baseDir, 'connectors', `${connector.code || connector.methodName}.json`);
+    writeResourceJsonFile(filePath, stripPulledResource(connector));
+    written.push(path.relative(process.cwd(), filePath));
+  }
+
+  const roles = await requestWithAuth(
+    config,
+    target.profileName,
+    apiPathWithQuery(`/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/roles`, {
+      page: 1,
+      limit: 1000,
+    })
+  );
+  for (const role of normalizeItems(roles)) {
+    const filePath = path.join(baseDir, 'roles', `${role.code}.json`);
+    writeResourceJsonFile(filePath, {
+      code: role.code,
+      name: role.name,
+      description: role.description || '',
+    });
+    written.push(path.relative(process.cwd(), filePath));
+  }
+
+  const menus = await requestWithAuth(
+    config,
+    target.profileName,
+    `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/menus`
+  );
+  const flatMenus = flattenItems(normalizeItems(menus));
+  for (const menu of flatMenus) {
+    if (menu.id && menu.resourceCode) pullLookups.menuCodeById.set(menu.id, menu.resourceCode);
+  }
+  for (const menu of flatMenus) {
+    const code = menu.resourceCode || menu.id;
+    const filePath = path.join(baseDir, 'menus', `${code}.json`);
+    const formCode = pullLookups.formCodeByUuid.get(menu.formUuid);
+    const pageCode = pullLookups.pageCodeById.get(menu.pageId);
+    const parentCode = pullLookups.menuCodeById.get(menu.parentId);
+    writeResourceJsonFile(filePath, {
+      code,
+      name: menu.name,
+      type: menu.type,
+      ...(formCode ? { formCode } : menu.formUuid ? { formUuid: menu.formUuid } : {}),
+      ...(pageCode ? { pageCode } : menu.pageId ? { pageId: menu.pageId } : {}),
+      ...(parentCode ? { parentCode } : menu.parentId ? { parentId: menu.parentId } : {}),
+      sortOrder: menu.sortOrder,
+      icon: menu.icon || undefined,
+      isHidden: menu.isHidden,
+    });
+    written.push(path.relative(process.cwd(), filePath));
+  }
+
+  const workflows = await requestWithAuth(
+    config,
+    target.profileName,
+    apiPathWithQuery(`/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows`, {
+      page: 1,
+      pageSize: 1000,
+    })
+  );
+  for (const workflow of normalizeItems(workflows)) {
+    const detail = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflows/${encodeURIComponent(workflow.id)}`
+    );
+    const code = detail.resourceCode || workflow.resourceCode || workflow.id;
+    const filePath = path.join(baseDir, 'workflows', `${code}.json`);
+    const formCode = pullLookups.formCodeByUuid.get(detail.formUuid);
+    writeResourceJsonFile(filePath, {
+      code,
+      ...(formCode ? { formCode } : detail.formUuid ? { formUuid: detail.formUuid } : {}),
+      definitionJson: detail.definitionJson,
+      viewJson: detail.viewJson || undefined,
+      publish: Boolean(detail.isPublished),
+    });
+    written.push(path.relative(process.cwd(), filePath));
+  }
+
+  const automations = await requestWithAuth(
+    config,
+    target.profileName,
+    apiPathWithQuery(`/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations`, {
+      page: 1,
+      pageSize: 1000,
+    })
+  );
+  for (const automation of normalizeItems(automations)) {
+    const detail = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/automations/${encodeURIComponent(automation.id)}`
+    );
+    const code = detail.resourceCode || automation.resourceCode || automation.id;
+    const filePath = path.join(baseDir, 'automations', `${code}.json`);
+    const formCode = pullLookups.formCodeByUuid.get(detail.formUuid);
+    writeResourceJsonFile(filePath, {
+      code,
+      name: detail.name,
+      description: detail.description || '',
+      ...(formCode ? { formCode } : detail.formUuid ? { formUuid: detail.formUuid } : {}),
+      triggerConfig: detail.triggerConfig,
+      definitionJson: detail.definitionJson,
+      viewJson: detail.viewJson || undefined,
+      tags: detail.tags || undefined,
+      publish: Boolean(detail.isPublished),
+      enable: Boolean(detail.isEnabled),
+    });
+    written.push(path.relative(process.cwd(), filePath));
+  }
+
+  const pageGroups = await requestWithAuth(
+    config,
+    target.profileName,
+    apiPathWithQuery(`/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/page-permission-groups`, {
+      page: 1,
+      limit: 1000,
+    })
+  );
+  for (const group of normalizeItems(pageGroups)) {
+    const code = group.resourceCode || group.id;
+    const filePath = path.join(baseDir, 'permissions', 'page-groups', `${code}.json`);
+    const targets = splitPagePermissionTargetsForManifest(group.menuFormUuids || [], pullLookups);
+    writeResourceJsonFile(filePath, {
+      code,
+      name: group.name,
+      roles: group.roles || [],
+      ...targets,
+    });
+    written.push(path.relative(process.cwd(), filePath));
+  }
+
+  const forms = await requestWithAuth(
+    config,
+    target.profileName,
+    `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms`
+  );
+  const stateFormCodesByUuid = new Map(
+    Object.entries(target.bound.resources?.forms || {})
+      .filter(([, entry]) => entry?.formUuid)
+      .map(([code, entry]) => [entry.formUuid, code])
+  );
+  const formEntries = normalizeItems(forms).map(form => [
+    stateFormCodesByUuid.get(form.formUuid) || form.formUuid,
+    { formUuid: form.formUuid },
+  ]);
+  for (const [formCode, formEntry] of formEntries) {
+    const formUuid = formEntry?.formUuid;
+    if (!formUuid) continue;
+    const formGroups = await requestWithAuth(
+      config,
+      target.profileName,
+      apiPathWithQuery(`/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/permission-groups`, {
+        page: 1,
+        limit: 1000,
+      })
+    );
+    for (const group of normalizeItems(formGroups)) {
+      const code = group.resourceCode || group.id;
+      const filePath = path.join(baseDir, 'permissions', 'form-groups', `${code}.json`);
+      const mappedFormCode = pullLookups.formCodeByUuid.get(formUuid);
+      const pulledGroup = stripPulledResource(group);
+      if (mappedFormCode) delete pulledGroup.formUuid;
+      writeResourceJsonFile(filePath, {
+        ...pulledGroup,
+        code,
+        ...(mappedFormCode ? { formCode: mappedFormCode } : { formUuid }),
+      });
+      written.push(path.relative(process.cwd(), filePath));
+    }
+
+    const mappedFormCode = pullLookups.formCodeByUuid.get(formUuid);
+    const formSetting = {
+      code: mappedFormCode || formCode,
+      ...(mappedFormCode ? { formCode: mappedFormCode } : { formUuid }),
+    };
+    formSetting.settings = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/settings`
+    );
+    formSetting.indexes = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/field-indexes`
+    );
+    formSetting.dataManagement = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/data-management`
+    );
+    formSetting.publicAccess = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/public-access`
+    );
+    const filePath = path.join(baseDir, 'settings', 'forms', `${formCode}.json`);
+    writeResourceJsonFile(filePath, formSetting);
+    written.push(path.relative(process.cwd(), filePath));
+  }
+  return { appType: target.appType, profile: target.profileName, written };
+}
+
+function buildPullResourceLookups(bound = {}) {
+  const formCodeByUuid = new Map();
+  for (const [code, entry] of Object.entries(bound.resources?.forms || {})) {
+    if (entry?.formUuid) formCodeByUuid.set(entry.formUuid, code);
+  }
+
+  const pageCodeById = new Map();
+  for (const [code, entry] of Object.entries(bound.resources?.pages || {})) {
+    if (entry?.pageId) pageCodeById.set(entry.pageId, code);
+  }
+
+  const menuCodeById = new Map();
+  for (const [code, entry] of Object.entries(bound.resources?.menus || {})) {
+    if (entry?.menuId) menuCodeById.set(entry.menuId, code);
+  }
+
+  return { formCodeByUuid, pageCodeById, menuCodeById };
+}
+
+function splitPagePermissionTargetsForManifest(values = [], lookups) {
+  const formCodes = [];
+  const menuCodes = [];
+  const menuFormUuids = [];
+  for (const value of values || []) {
+    if (lookups.formCodeByUuid.has(value)) {
+      formCodes.push(lookups.formCodeByUuid.get(value));
+    } else if (lookups.menuCodeById.has(value)) {
+      menuCodes.push(lookups.menuCodeById.get(value));
+    } else if (value) {
+      menuFormUuids.push(value);
+    }
+  }
+  return {
+    ...(formCodes.length > 0 ? { formCodes: unique(formCodes) } : {}),
+    ...(menuCodes.length > 0 ? { menuCodes: unique(menuCodes) } : {}),
+    ...(menuFormUuids.length > 0 ? { menuFormUuids: unique(menuFormUuids) } : {}),
+  };
+}
+
+function writeResourceJsonFile(filePath, value) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+function stripPulledResource(value) {
+  if (!value || typeof value !== 'object') return value;
+  const next = { ...value };
+  delete next.id;
+  delete next.appType;
+  delete next.createdAt;
+  delete next.updatedAt;
+  if (Array.isArray(next.apis)) {
+    next.apis = next.apis.map(api => {
+      const item = { ...api };
+      delete item.id;
+      delete item.connectorId;
+      delete item.createdAt;
+      delete item.updatedAt;
+      return item;
+    });
+  }
+  return next;
+}
+
+function normalizeConnectorManifest(connector) {
+  const parsedUrl = parseConnectorUrl(connector);
+  return {
+    code: connector.code || connector.methodName,
+    name: connector.name || connector.code || connector.methodName,
+    description: connector.description || '',
+    protocol: connector.protocol || parsedUrl.protocol || 'https',
+    domain: connector.domain || parsedUrl.domain,
+    baseUrl: connector.baseUrl !== undefined ? connector.baseUrl : parsedUrl.baseUrl,
+    authType: connector.authType || 'none',
+    authConfig: connector.authConfig,
+    defaultHeaders: connector.defaultHeaders || connector.headers,
+    userContext: connector.userContext,
+    sensitiveLog: connector.sensitiveLog,
+    apis: (connector.apis || []).map(api => ({
+      code: api.code || api.methodName,
+      name: api.name || api.code || api.methodName,
+      description: api.description || '',
+      path: api.path,
+      method: String(api.method || 'GET').toUpperCase(),
+      timeout: api.timeout,
+      requestBodyType: api.requestBodyType,
+      responseType: api.responseType,
+      pathParams: api.pathParams || [],
+      queryParams: api.queryParams || [],
+      headerParams: api.headerParams || [],
+      bodyParams: api.bodyParams || [],
+      responseDefinition: api.responseDefinition,
+    })),
+  };
+}
+
+function parseConnectorUrl(connector) {
+  const rawUrl = connector.url;
+  if (!rawUrl) return {};
+  try {
+    const url = new URL(rawUrl);
+    const baseUrl = url.pathname && url.pathname !== '/' ? url.pathname.replace(/^\/+|\/+$/g, '') : '';
+    return {
+      protocol: url.protocol.replace(':', ''),
+      domain: url.host,
+      baseUrl,
+    };
+  } catch {
+    return {};
+  }
+}
+
+async function resolveManifestJson(config, profileName, item, objectKey, fileKey, optional = false) {
+  let value = item[objectKey];
+  if (value === undefined && item[fileKey]) {
+    const filePath = path.resolve(item.__dir || process.cwd(), item[fileKey]);
+    value = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+  }
+  if (value === undefined) {
+    if (optional) return undefined;
+    fail(`${resourceLabel('resource', item)} 缺少 ${objectKey} 或 ${fileKey}`);
+  }
+  await resolveJsCodeSnapshotFiles(config, profileName, value, item.__dir || process.cwd(), new Map());
+  return value;
+}
+
+function resolveManifestFormUuid(bound, item, options = {}) {
+  const formKey = item.formCode || item.form || (options.fallbackToCode ? item.code : undefined);
+  if (formKey) {
+    const mapped = bound.resources?.forms?.[formKey]?.formUuid;
+    if (mapped) return mapped;
+  }
+  if (item.formUuid) return item.formUuid;
+  return formKey;
+}
+
+function resolveManifestPageId(bound, item) {
+  if (item.pageCode) {
+    const mapped = bound.resources?.pages?.[item.pageCode]?.pageId;
+    if (mapped) return mapped;
+  }
+  return item.pageId || item.pageCode;
+}
+
+function resolveManifestMenuId(bound, menuCode) {
+  if (!menuCode) return undefined;
+  return bound.resources?.menus?.[menuCode]?.menuId || menuCode;
+}
+
+function resolveAutomationManifestPayload(target, automationItem) {
+  const triggerConfig = {
+    ...(automationItem.triggerConfig || {}),
+  };
+  if (!triggerConfig.appType) triggerConfig.appType = target.appType;
+  const formUuid = resolveManifestFormUuid(target.bound, automationItem) || triggerConfig.formUuid;
+  if (formUuid && !triggerConfig.formUuid) {
+    triggerConfig.formUuid = formUuid;
+  }
+  return { formUuid, triggerConfig };
+}
+
+function resolvePagePermissionGroupTargets(bound, group) {
+  const direct = [
+    ...(Array.isArray(group.menuFormUuids) ? group.menuFormUuids : []),
+    ...(Array.isArray(group.menuIds) ? group.menuIds : []),
+  ];
+  const fromMenus = (group.menuCodes || []).flatMap(code => resolveMenuPermissionTargets(bound, code));
+  const fromForms = (group.formCodes || []).map(code => resolveOptionalFormUuid(bound, code));
+  const fromPages = (group.pageCodes || []).flatMap(code => resolvePagePermissionTargets(bound, code));
+  return unique([...direct, ...fromMenus, ...fromForms, ...fromPages].filter(Boolean));
+}
+
+function saveResourceEntry(target, bucket, code, extra = {}) {
+  saveStateResource(target, bucket, code, pickStateFields(extra, ['formUuid']), [
+    'formUuid',
+  ]);
+}
+
+function withoutResourceMeta(value) {
+  const next = { ...(value || {}) };
+  for (const key of Object.keys(next)) {
+    if (key.startsWith('__')) delete next[key];
+  }
+  return next;
+}
+
+function roleEquals(desired, existing) {
+  return (
+    String(existing.name || '') === String(desired.name || desired.code || '') &&
+    String(existing.description || '') === String(desired.description || '')
+  );
+}
+
+function menuEquals(bound, desired, existing) {
+  if (!existing) return false;
+  const desiredFormUuid = resolveManifestFormUuid(bound, desired);
+  const desiredPageId = resolveManifestPageId(bound, desired);
+  const desiredParentId =
+    resolveManifestMenuId(bound, desired.parentCode) || desired.parentId || null;
+  return (
+    String(existing.name || '') === String(desired.name || desired.code || '') &&
+    String(existing.type || '') === String(desired.type || 'nav') &&
+    String(existing.resourceCode || '') === String(desired.code || '') &&
+    optionalScalarEquals(existing.formUuid, desiredFormUuid, hasAnyKey(desired, ['formCode', 'formUuid', 'form'])) &&
+    optionalScalarEquals(existing.pageId, desiredPageId, hasAnyKey(desired, ['pageCode', 'pageId'])) &&
+    optionalScalarEquals(existing.parentId || null, desiredParentId, hasAnyKey(desired, ['parentCode', 'parentId'])) &&
+    optionalScalarEquals(existing.sortOrder, desired.sortOrder, desired.sortOrder !== undefined) &&
+    optionalScalarEquals(existing.icon || null, desired.icon || null, desired.icon !== undefined) &&
+    optionalScalarEquals(Boolean(existing.isHidden), Boolean(desired.isHidden), desired.isHidden !== undefined)
+  );
+}
+
+function connectorEquals(desired, existing) {
+  const normalizedDesired = normalizeConnectorManifest(desired);
+  const normalizedExisting = normalizeConnectorManifest(existing);
+  delete normalizedExisting.appType;
+  return JSON.stringify(normalizedExisting) === JSON.stringify(normalizedDesired);
+}
+
+function pagePermissionGroupEquals(bound, desired, existing) {
+  if (!existing) return false;
+  const desiredTargets = resolvePagePermissionGroupTargets(bound, desired);
+  return (
+    String(existing.name || '') === String(desired.name || desired.code || '') &&
+    String(existing.resourceCode || '') === String(desired.code || '') &&
+    stringSetEquals(existing.roles || [], desired.roles || []) &&
+    stringSetEquals(existing.menuFormUuids || [], desiredTargets)
+  );
+}
+
+function formPermissionGroupEquals(bound, desired, existing) {
+  if (!existing) return false;
+  const expected = normalizeFormPermissionGroupManifest(bound, desired);
+  const current = pickObjectKeys(existing, Object.keys(expected));
+  return stableStringifyForPlan(current, process.cwd()) === stableStringifyForPlan(expected, desired.__dir || process.cwd());
+}
+
+function normalizeFormPermissionGroupManifest(bound, group) {
+  const formUuid = resolveManifestFormUuid(bound, group);
+  const body = {
+    ...withoutResourceMeta(group),
+    resourceCode: group.code,
+    formUuid,
+    name: group.name || group.code,
+    type: group.type || 'view',
+    roles: group.roles || [],
+  };
+  delete body.code;
+  delete body.formCode;
+  delete body.form;
+  return stripUndefinedValues(body);
+}
+
+function optionalScalarEquals(existingValue, desiredValue, enabled) {
+  if (!enabled) return true;
+  return String(existingValue ?? '') === String(desiredValue ?? '');
+}
+
+function hasAnyKey(value, keys) {
+  return keys.some(key => value?.[key] !== undefined);
+}
+
+function stringSetEquals(left = [], right = []) {
+  return stableStringifyForPlan(sortStringValues(left), process.cwd()) ===
+    stableStringifyForPlan(sortStringValues(right), process.cwd());
+}
+
+function sortStringValues(value = []) {
+  return [...(value || [])].map(item => String(item)).sort();
+}
+
+function pickObjectKeys(source = {}, keys = []) {
+  return keys.reduce((acc, key) => {
+    acc[key] = source[key];
+    return acc;
+  }, {});
+}
+
+function stripUndefinedValues(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return value;
+  return Object.entries(value).reduce((acc, [key, item]) => {
+    if (item !== undefined) acc[key] = item;
+    return acc;
+  }, {});
+}
+
+function workflowEquals(bound, desired, existing) {
+  if (!existing) return false;
+  const desiredDefinition = resolveManifestPlainJson(desired, 'definitionJson', 'definitionFile');
+  const desiredView = resolveManifestPlainJson(desired, 'viewJson', 'viewFile', true);
+  const desiredFormUuid = resolveManifestFormUuid(bound, desired);
+  return (
+    String(existing.resourceCode || '') === String(desired.code || desired.resourceCode || '') &&
+    String(existing.formUuid || '') === String(desiredFormUuid || '') &&
+    jsonEqualsForPlan(existing.definitionJson, desiredDefinition, desired.__dir) &&
+    optionalJsonEqualsForPlan(existing.viewJson, desiredView, desired.__dir) &&
+    (desired.publish ? Boolean(existing.isPublished) === true : true)
+  );
+}
+
+function automationEquals(target, desired, existing) {
+  if (!existing) return false;
+  const desiredDefinition = resolveManifestPlainJson(desired, 'definitionJson', 'definitionFile');
+  const desiredView = resolveManifestPlainJson(desired, 'viewJson', 'viewFile', true);
+  const automationPayload = resolveAutomationManifestPayload(target, desired);
+  const desiredTags =
+    desired.tags === undefined
+      ? undefined
+      : Array.isArray(desired.tags)
+        ? desired.tags.join(',')
+        : String(desired.tags);
+  const desiredEnabled =
+    desired.enable !== undefined
+      ? Boolean(desired.enable)
+      : desired.isEnabled !== undefined
+        ? Boolean(desired.isEnabled)
+        : undefined;
+
+  return (
+    String(existing.resourceCode || '') === String(desired.code || desired.resourceCode || '') &&
+    String(existing.name || '') === String(desired.name || desired.code || '') &&
+    String(existing.description || '') === String(desired.description || '') &&
+    String(existing.formUuid || '') === String(automationPayload.formUuid || '') &&
+    jsonEqualsForPlan(existing.triggerConfig, automationPayload.triggerConfig, desired.__dir) &&
+    jsonEqualsForPlan(existing.definitionJson, desiredDefinition, desired.__dir) &&
+    optionalJsonEqualsForPlan(existing.viewJson, desiredView, desired.__dir) &&
+    (desiredTags === undefined ? true : String(existing.tags || '') === desiredTags) &&
+    (desired.publish ? Boolean(existing.isPublished) === true : true) &&
+    (desiredEnabled === undefined ? true : Boolean(existing.isEnabled) === desiredEnabled)
+  );
+}
+
+function resolveManifestPlainJson(item, objectKey, fileKey, optional = false) {
+  if (item[objectKey] !== undefined) return item[objectKey];
+  if (item[fileKey]) {
+    const filePath = path.resolve(item.__dir || process.cwd(), item[fileKey]);
+    try {
+      return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+    } catch (error) {
+      fail(`${resourceLabel('resource', item)} 无法读取 ${fileKey}: ${error.message}`);
+    }
+  }
+  if (optional) return undefined;
+  fail(`${resourceLabel('resource', item)} 缺少 ${objectKey} 或 ${fileKey}`);
+}
+
+function optionalJsonEqualsForPlan(existingValue, desiredValue, desiredBaseDir) {
+  const normalizedExisting =
+    existingValue === null || existingValue === undefined ? undefined : existingValue;
+  const normalizedDesired =
+    desiredValue === null || desiredValue === undefined ? undefined : desiredValue;
+  return jsonEqualsForPlan(normalizedExisting, normalizedDesired, desiredBaseDir);
+}
+
+function jsonEqualsForPlan(existingValue, desiredValue, desiredBaseDir) {
+  return (
+    stableStringifyForPlan(existingValue, process.cwd()) ===
+    stableStringifyForPlan(desiredValue, desiredBaseDir || process.cwd())
+  );
+}
+
+function stableStringifyForPlan(value, baseDir) {
+  const normalized = normalizeJsonForPlan(value, baseDir, null);
+  const result = JSON.stringify(normalized);
+  return result === undefined ? 'undefined' : result;
+}
+
+function normalizeJsonForPlan(value, baseDir, keyName) {
+  if (value === undefined || value === null) return value;
+  if (Array.isArray(value)) {
+    return value.map(item => normalizeJsonForPlan(item, baseDir, null));
+  }
+  if (typeof value !== 'object') return value;
+
+  if (keyName === 'sourceFile') {
+    if (value.localPath) return normalizeLocalSourceFileForPlan(value.localPath, baseDir);
+    if (value.sha256) return { sha256: value.sha256 };
+  }
+
+  const result = {};
+  const hasLocalSourceFile =
+    value.sourceFile && typeof value.sourceFile === 'object' && value.sourceFile.localPath;
+  for (const key of Object.keys(value).sort()) {
+    if (key.startsWith('__') || value[key] === undefined) continue;
+    result[key] = normalizeJsonForPlan(value[key], baseDir, key);
+  }
+  if (hasLocalSourceFile) {
+    result.code = result.code === undefined ? '' : result.code;
+    result.runtimeMode = result.runtimeMode || 'trusted_node';
+    result.sourceType = result.sourceType || 'file_snapshot';
+  }
+  return sortObjectForStableJson(result);
+}
+
+function normalizeLocalSourceFileForPlan(localPath, baseDir) {
+  const rawLocalPath = String(localPath);
+  const baseResolvedPath = path.resolve(baseDir || process.cwd(), rawLocalPath);
+  const cwdResolvedPath = path.resolve(process.cwd(), rawLocalPath);
+  const resolvedLocalPath = fs.existsSync(baseResolvedPath)
+    ? baseResolvedPath
+    : cwdResolvedPath;
+  const bundlePath = resolveJsCodeBundlePathForPlan(resolvedLocalPath);
+  if (bundlePath && fs.existsSync(bundlePath)) {
+    return {
+      sha256: crypto
+        .createHash('sha256')
+        .update(fs.readFileSync(bundlePath))
+        .digest('hex'),
+    };
+  }
+  return {
+    localPath: path.relative(process.cwd(), resolvedLocalPath).replace(/\\/g, '/'),
+  };
+}
+
+function resolveJsCodeBundlePathForPlan(localPath) {
+  const extension = path.extname(localPath).toLowerCase();
+  if (extension && extension !== '.ts' && extension !== '.tsx') return null;
+  const normalized = localPath.replace(/\\/g, '/');
+  const matched = normalized.match(/src\/js-code-nodes\/([^/]+)\/index\.tsx?$/);
+  if (!matched) return null;
+  const workspaceRoot = findWorkspaceRoot(localPath);
+  return path.join(workspaceRoot, 'dist', 'js-code-nodes', matched[1], 'index.cjs');
+}
+
+function sortObjectForStableJson(value) {
+  return Object.keys(value)
+    .sort()
+    .reduce((acc, key) => {
+      acc[key] = value[key];
+      return acc;
+    }, {});
+}
+
+function printResourceValidation(validation) {
+  const lines = [
+    `资源目录: ${path.relative(process.cwd(), validation.baseDir) || validation.baseDir}`,
+    `校验状态: ${validation.valid ? '通过' : '失败'}`,
+  ];
+  for (const [key, count] of Object.entries(validation.counts)) {
+    lines.push(`- ${key}: ${count}`);
+  }
+  for (const warning of validation.warnings) lines.push(`Warning: ${warning}`);
+  for (const error of validation.errors) lines.push(`Error: ${error}`);
+  print(lines.join('\n'));
+}
+
+function printResourcePlan(plan) {
+  const lines = [
+    `profile: ${plan.profile}`,
+    `appType: ${plan.appType}`,
+    `summary: create=${plan.summary.create} update=${plan.summary.update} noop=${plan.summary.noop} delete=${plan.summary.delete}`,
+  ];
+  for (const action of plan.actions) {
+    lines.push(`- ${action.kind}:${action.code} ${action.action}${action.platformId ? ` (${action.platformId})` : ''}`);
+  }
+  print(lines.join('\n'));
+}
+
+function printResourceResult(result) {
+  const lines = [`profile: ${result.profile}`, `appType: ${result.appType}`];
+  if (result.written) {
+    lines.push(`written: ${result.written.length}`);
+    result.written.forEach(file => lines.push(`- ${file}`));
+  }
+  if (result.published) {
+    lines.push(`published: ${result.published.length}`);
+    result.published.forEach(item => lines.push(`- ${item.kind}:${item.code} ${item.action}${item.id ? ` (${item.id})` : ''}`));
+  }
+  if (result.pruned) {
+    lines.push(`pruned: ${result.pruned.length}`);
+    result.pruned.forEach(item => lines.push(`- ${item.kind}:${item.code}${item.id ? ` (${item.id})` : ''}`));
+  }
+  for (const warning of result.warnings || []) lines.push(`Warning: ${warning}`);
+  print(lines.join('\n'));
 }
 
 function readJsonArg(value, label) {