@svadmin/core 0.53.0 → 0.54.0

package/src/schema.ts

@@ -1,4 +1,11 @@
 export { createExactSchemaValidator, checkExact } from './schema-validation';
+export {
+  readSchemaFormPath, matchesSchemaFormCondition, isSchemaFormNodeVisible, validateSchemaFormValue,
+  assertSchemaFormSchema, prepareSchemaFormValue,
+} from './schema-form';
+export type {
+  SchemaFormScalar, SchemaFormCondition, SchemaFormSchema, SchemaFormValidationError,
+} from './schema-form';
 export { snapshotPlainData } from './plain-data';
 export type { JsonValue } from './plain-data';
 export { decodeAuditEntry, decodeAuditCreate, decodeAuditQuery, decodeAuditEntries } from './audit-contract';

package/src/spreadsheet-clipboard.ts

@@ -0,0 +1,45 @@
+import Papa from 'papaparse';
+
+/** 复制计算值而非可执行公式；文本中和与字段转义分别处理。 */
+export function serializeSpreadsheetClipboard(rows: (string | number)[][], format: 'tsv' | 'csv'): string | undefined {
+  const width = rows[0]?.length ?? 0;
+  if (!rows.length || rows.length > 1000 || !width || width > 100 || rows.length * width > 10_000) return;
+  const safe: string[][] = [];
+  for (const row of rows) {
+    if (row.length !== width) return;
+    const values: string[] = [];
+    for (const value of row) {
+      if (typeof value !== 'string' && typeof value !== 'number') return;
+      if (typeof value === 'number' && !Number.isFinite(value)) return;
+      const text = typeof value === 'string' && (/^[\t\r\n]/.test(value) || /^\s*[=+@-]/.test(value))
+        ? `'${value}` : String(value);
+      if (text.length > 10_000) return;
+      values.push(text);
+    }
+    safe.push(values);
+  }
+  const result = Papa.unparse(safe, { delimiter: format === 'csv' ? ',' : '\t', newline: '\n', quotes: true });
+  return result.length <= 1_000_000 ? result : undefined;
+}
+
+/** 剪贴板采用显式分隔符，纯文本中的逗号不自动拆列。 */
+export function parseSpreadsheetClipboard(text: string, format: 'tsv' | 'csv' = 'tsv'): string[][] | undefined {
+  if (typeof text !== 'string' || text.length === 0 || text.length > 1_000_000
+    || (format !== 'tsv' && format !== 'csv')) return undefined;
+  const parsed = Papa.parse<string[]>(text, {
+    delimiter: format === 'csv' ? ',' : '\t',
+    dynamicTyping: false,
+    skipEmptyLines: false,
+    preview: 1002,
+  });
+  if (parsed.errors.length || parsed.meta.truncated) return undefined;
+  const rows = parsed.data;
+  // 只去掉行终止符生成的末尾空记录，保留中间空行和空单元格。
+  if (/[\r\n]$/.test(text) && rows.at(-1)?.length === 1 && rows.at(-1)?.[0] === '') rows.pop();
+  const columns = rows[0]?.length ?? 0;
+  if (!rows.length || rows.length > 1000 || columns < 1 || columns > 100 || rows.length * columns > 10_000
+    || rows.some(row => row.length !== columns || row.some(value => typeof value !== 'string' || value.length > 10_000))) {
+    return undefined;
+  }
+  return rows;
+}

package/src/spreadsheet-workbook.ts

@@ -0,0 +1,64 @@
+import { Type, type Static } from '@sinclair/typebox';
+import { snapshotPlainData } from './plain-data';
+import { checkExact } from './schema-validation';
+
+export const SPREADSHEET_WORKBOOK_LIMITS = Object.freeze({
+  maxSheets: 32, maxRows: 1000, maxCols: 100, maxCells: 10_000,
+  maxCellLength: 10_000, maxTotalText: 1_000_000, maxJsonLength: 10_000_000,
+});
+const formatSchema = Type.Object({
+  numberFormat: Type.Optional(Type.Union([Type.Literal('general'), Type.Literal('number'), Type.Literal('percent')])),
+  decimalPlaces: Type.Optional(Type.Integer({ minimum: 0, maximum: 20 })),
+  bold: Type.Optional(Type.Boolean()), italic: Type.Optional(Type.Boolean()),
+  align: Type.Optional(Type.Union([Type.Literal('left'), Type.Literal('center'), Type.Literal('right')])),
+}, { additionalProperties: false });
+export type SpreadsheetCellFormat = Static<typeof formatSchema>;
+const sheetSchema = Type.Object({
+  id: Type.String({ minLength: 1, maxLength: 200 }), name: Type.String({ minLength: 1, maxLength: 200 }),
+  rows: Type.Integer({ minimum: 1, maximum: 1000 }), cols: Type.Integer({ minimum: 1, maximum: 100 }),
+  cells: Type.Record(Type.String({ pattern: '^[A-Z]{1,2}[1-9][0-9]{0,3}$' }), Type.String({ maxLength: 10_000 })),
+  formats: Type.Optional(Type.Record(Type.String({ pattern: '^[A-Z]{1,2}[1-9][0-9]{0,3}$' }), formatSchema)),
+}, { additionalProperties: false });
+export type SpreadsheetSheet = Static<typeof sheetSchema>;
+const workbookSchema = Type.Object({
+  protocolVersion: Type.Literal(1), sheets: Type.Array(sheetSchema, { minItems: 1, maxItems: 32 }),
+  activeSheetId: Type.Optional(Type.String({ minLength: 1, maxLength: 200 })),
+}, { additionalProperties: false });
+export type SpreadsheetWorkbook = Static<typeof workbookSchema>;
+function inside(key: string, sheet: SpreadsheetSheet): boolean {
+  const match = /^([A-Z]{1,2})([1-9][0-9]{0,3})$/.exec(key);
+  if (!match) return false;
+  let column = 0;
+  for (const char of match[1] ?? '') column = column * 26 + char.charCodeAt(0) - 64;
+  return column <= sheet.cols && Number(match[2]) <= sheet.rows;
+}
+export function snapshotSpreadsheetWorkbook(value: unknown): SpreadsheetWorkbook | undefined {
+  try {
+    const plain = snapshotPlainData(value);
+    if (!checkExact(workbookSchema, plain)) return;
+    const ids = new Set<string>();
+    let totalText = 0;
+    for (const sheet of plain.sheets) {
+      if (!sheet.id.trim() || !sheet.name.trim() || ids.has(sheet.id)
+        || sheet.rows * sheet.cols > SPREADSHEET_WORKBOOK_LIMITS.maxCells) return;
+      ids.add(sheet.id);
+      for (const [key, text] of Object.entries(sheet.cells)) {
+        if (!inside(key, sheet)) return;
+        totalText += text.length;
+        if (totalText > SPREADSHEET_WORKBOOK_LIMITS.maxTotalText) return;
+      }
+      for (const key of Object.keys(sheet.formats ?? {})) if (!inside(key, sheet)) return;
+    }
+    if (plain.activeSheetId !== undefined && !ids.has(plain.activeSheetId)) return;
+    if (JSON.stringify(plain).length > SPREADSHEET_WORKBOOK_LIMITS.maxJsonLength) return;
+    return plain;
+  } catch { return; }
+}
+export function serializeSpreadsheetWorkbook(value: unknown): string | undefined {
+  const workbook = snapshotSpreadsheetWorkbook(value);
+  return workbook ? JSON.stringify(workbook) : undefined;
+}
+export function parseSpreadsheetWorkbook(value: string): SpreadsheetWorkbook | undefined {
+  if (typeof value !== 'string' || value.length > SPREADSHEET_WORKBOOK_LIMITS.maxJsonLength) return;
+  try { return snapshotSpreadsheetWorkbook(JSON.parse(value)); } catch { return; }
+}

package/src/spreadsheet-xlsx.ts

@@ -0,0 +1,181 @@
+import type { Cell, Workbook, Worksheet } from 'exceljs';
+import { snapshotSpreadsheetWorkbook, type SpreadsheetWorkbook, type SpreadsheetCellFormat } from './spreadsheet-workbook';
+
+export interface SpreadsheetXlsxOptions {
+  exceljs?: { Workbook: new () => Workbook };
+}
+
+export interface SpreadsheetXlsxImportLimits {
+  maxBytes?: number;
+  maxSheets?: number;
+  maxRows?: number;
+  maxCols?: number;
+  maxCells?: number;
+  maxCellLength?: number;
+}
+
+export interface SpreadsheetXlsxImportOptions extends SpreadsheetXlsxImportLimits {
+  exceljs?: { Workbook: new () => Workbook };
+  signal?: AbortSignal;
+}
+
+const DEFAULT_IMPORT_LIMITS: Required<SpreadsheetXlsxImportLimits> = {
+  maxBytes: 25 * 1024 * 1024,
+  maxSheets: 32,
+  maxRows: 1000,
+  maxCols: 100,
+  maxCells: 10_000,
+  maxCellLength: 10_000,
+};
+
+function checkImport(signal: AbortSignal | undefined): void {
+  if (signal?.aborted) throw new Error('aborted');
+}
+
+function cellText(cell: { value: unknown; formula?: string; result?: unknown }): string {
+  if (typeof cell.formula === 'string') return `=${cell.formula}`;
+  if (cell.value === null || cell.value === undefined) return '';
+  if (typeof cell.value === 'string') return cell.value;
+  if (typeof cell.value === 'number' || typeof cell.value === 'boolean') return String(cell.value);
+  if (typeof cell.value === 'object' && cell.value !== null && 'text' in cell.value
+    && typeof cell.value.text === 'string') return cell.value.text;
+  return '';
+}
+
+function cellFormat(cell: Cell): SpreadsheetCellFormat | undefined {
+  const format: SpreadsheetCellFormat = {};
+  if (cell.font?.bold !== undefined) format.bold = cell.font.bold;
+  if (cell.font?.italic !== undefined) format.italic = cell.font.italic;
+  if (cell.alignment?.horizontal === 'left' || cell.alignment?.horizontal === 'center'
+    || cell.alignment?.horizontal === 'right') format.align = cell.alignment.horizontal;
+  if (cell.numFmt?.includes('%')) format.numberFormat = 'percent';
+  else if (cell.numFmt?.includes('0') || cell.numFmt?.includes('#')) format.numberFormat = 'number';
+  return Object.keys(format).length > 0 ? format : undefined;
+}
+
+function worksheetData(
+  worksheet: Worksheet,
+  limits: Required<SpreadsheetXlsxImportLimits>,
+  signal: AbortSignal | undefined,
+): SpreadsheetWorkbook['sheets'][number] {
+  const rows = worksheet.rowCount;
+  const cols = worksheet.columnCount;
+  if (!Number.isSafeInteger(rows) || rows <= 0 || rows > limits.maxRows
+    || !Number.isSafeInteger(cols) || cols <= 0 || cols > limits.maxCols
+    || rows * cols > limits.maxCells) throw new Error('limit');
+  const cells: Record<string, string> = {};
+  const formats: Record<string, SpreadsheetCellFormat> = {};
+  for (let row = 1; row <= rows; row += 1) {
+    checkImport(signal);
+    for (let col = 1; col <= cols; col += 1) {
+      const cell = worksheet.getCell(row, col);
+      const text = cellText(cell);
+      if (text.length > limits.maxCellLength) throw new Error('limit');
+      const format = cellFormat(cell);
+      if (text !== '') {
+        cells[cell.address] = text;
+      }
+      if (format) formats[cell.address] = format;
+    }
+  }
+  return {
+    // XLSX 不保存 SVAdmin 的内部 sheet id；名称是唯一可复现的导入身份。
+    id: worksheet.name,
+    name: worksheet.name,
+    rows,
+    cols,
+    cells,
+    ...(Object.keys(formats).length > 0 ? { formats } : {}),
+  };
+}
+
+/** 读取有界 XLSX；失败、超限或取消时原子返回 undefined。 */
+export async function parseSpreadsheetXlsx(
+  bytes: unknown,
+  options: SpreadsheetXlsxImportOptions = {},
+): Promise<SpreadsheetWorkbook | undefined> {
+  const limits = {
+    ...DEFAULT_IMPORT_LIMITS,
+    ...Object.fromEntries(Object.entries(options).filter(([key]) => key.startsWith('max'))),
+  } as Required<SpreadsheetXlsxImportLimits>;
+  if (!(bytes instanceof Uint8Array) || bytes.byteLength > limits.maxBytes) return;
+  try {
+    checkImport(options.signal);
+    const ExcelJS = options.exceljs ?? (await import('exceljs')).default;
+    checkImport(options.signal);
+    const workbook = new ExcelJS.Workbook();
+    type XlsxInput = Parameters<typeof workbook.xlsx.load>[0];
+    const xlsxBytes = new Uint8Array(bytes).slice().buffer as ArrayBuffer;
+    await workbook.xlsx.load(xlsxBytes as XlsxInput);
+    checkImport(options.signal);
+    if (workbook.worksheets.length === 0 || workbook.worksheets.length > limits.maxSheets) return;
+    const sheets = workbook.worksheets.map((worksheet) => worksheetData(worksheet, limits, options.signal));
+    const activeIndex = workbook.views[0]?.activeTab ?? 0;
+    const activeSheetId = sheets[activeIndex]?.id ?? sheets[0]?.id;
+    if (!activeSheetId) return;
+    return snapshotSpreadsheetWorkbook({ protocolVersion: 1, activeSheetId, sheets });
+  } catch {
+    return;
+  }
+}
+
+function numberFormat(format: string | undefined, decimalPlaces: number | undefined): string | undefined {
+  const places = decimalPlaces === undefined ? 2 : decimalPlaces;
+  const fraction = places ? `.${'0'.repeat(places)}` : '';
+  if (format === 'percent') return `0${fraction}%`;
+  if (format === 'number') return `#,##0${fraction}`;
+  return undefined;
+}
+
+/** 公式按文本保留，避免将不可信内容升级为 Excel 可执行公式。 */
+export async function serializeSpreadsheetXlsx(
+  value: unknown, options: SpreadsheetXlsxOptions = {},
+): Promise<Uint8Array | undefined> {
+  const workbook = snapshotSpreadsheetWorkbook(value);
+  if (!workbook) return;
+  const names = new Set<string>();
+  for (const sheet of workbook.sheets) {
+    const name = sheet.name.toLowerCase();
+    if (sheet.name.length > 31 || /[\\/*?:[\]]/.test(sheet.name)
+      || [...sheet.name].some(character => character.charCodeAt(0) < 32)
+      || sheet.name.startsWith("'") || sheet.name.endsWith("'")
+      || name === 'history' || names.has(name)) return;
+    names.add(name);
+  }
+  try {
+    const ExcelJS = options.exceljs ?? (await import('exceljs')).default;
+    const output = new ExcelJS.Workbook();
+    output.views = [{
+      x: 0, y: 0, width: 1200, height: 800, firstSheet: 0, visibility: 'visible',
+      activeTab: Math.max(0, workbook.sheets.findIndex(sheet => sheet.id === workbook.activeSheetId)),
+    }];
+    for (const sheet of workbook.sheets) {
+      const target = output.addWorksheet(sheet.name);
+      // 空白尾部也属于网格，避免导出后尺寸缩小到最后一个非空单元格。
+      target.getCell(sheet.rows, sheet.cols).value = '';
+      const addresses = new Set([...Object.keys(sheet.cells), ...Object.keys(sheet.formats ?? {})]);
+      for (const address of addresses) {
+        const raw = sheet.cells[address] ?? '';
+        const cell = target.getCell(address);
+        const format = sheet.formats?.[address];
+        const numeric = Number(raw);
+        const explicitNumber = format?.numberFormat === 'number' || format?.numberFormat === 'percent';
+        cell.value = explicitNumber && raw !== '' && Number.isFinite(numeric)
+          && String(numeric) === raw && Math.abs(numeric) <= Number.MAX_SAFE_INTEGER ? numeric : raw;
+        if (format) {
+          cell.font = {
+            ...(format.bold === undefined ? {} : { bold: format.bold }),
+            ...(format.italic === undefined ? {} : { italic: format.italic }),
+          };
+          if (format.align !== undefined) cell.alignment = { horizontal: format.align };
+          const numFmt = numberFormat(format.numberFormat, format.decimalPlaces);
+          if (numFmt !== undefined) cell.numFmt = numFmt;
+        }
+      }
+    }
+    const result = await output.xlsx.writeBuffer();
+    return new Uint8Array(result);
+  } catch {
+    return;
+  }
+}

package/src/task-hooks.svelte.ts

@@ -1,7 +1,9 @@
 import { definedOptions } from './defined-options';
+import { onDestroy } from 'svelte';
 import { createMutation,useQueryClient } from '@tanstack/svelte-query';
 import { createSessionQuery } from './session-query.svelte';
 import { supersededQuerySession } from './query-session.svelte';
+import { captureAuthLiveScope } from './auth-hooks.svelte';
 import { getAdminOptions } from './options.svelte';
 import { captureAdminContext } from './context.svelte';
 import type { AdminContextAccessor } from './context.svelte';
@@ -85,29 +87,74 @@ export function useSubmitTask(options: UseSubmitTaskOptions={}) {
   const adminOptions=getAdminOptions();
   const queryClient=useQueryClient();
   const overtime=createOvertimeTracker(() => mutation.isPending,options.overtimeOptions??adminOptions.overtime);
-  const submissionScopes = new WeakMap<TaskHandle, ReturnType<AdminContextAccessor['queryKeyMatcher']>>();
+  let disposed = false;
+  onDestroy(() => { disposed = true; });
+  interface SubmissionScope {
+    queryScope: ReturnType<AdminContextAccessor['queryKeyMatcher']>;
+    auth: ReturnType<typeof captureAuthLiveScope>;
+    notification: AdminContextAccessor['notificationProvider'];
+    current: () => boolean;
+  }
+  const submissionScopes = new WeakMap<TaskHandle, SubmissionScope>();
+  const failureScopes = new WeakMap<Error, SubmissionScope>();
 
   const mutation=createMutation<TaskHandle,Error,UseSubmitTaskMutateParams>(() => ({
     mutationFn: async (params) => {
-      const scope = adminContext.queryKeyMatcher();
-      const provider=normalizeTaskProvider(params.taskProvider,adminContext);
-      const providerMeta=adminContext.tenant
-        ? {
-          ...(params.options?.meta??{}),
-          ...resolveTenantProviderMeta(adminContext.tenant,adminContext.tenantAdapter),
-        }
-        :params.options?.meta;
-      const taskOptions=providerMeta===params.options?.meta
-        ? params.options
-        :definedOptions({
-          ...params.options,
-          meta: providerMeta,
-        });
-      const handle = await provider.submit(params.taskName,taskOptions);
-      submissionScopes.set(handle, scope);
-      return handle;
+      const authProvider = adminContext.authProvider;
+      const auth = captureAuthLiveScope(authProvider);
+      const source = params.taskProvider ?? adminContext.taskProvider;
+      const tenant = adminContext.tenantCacheKey?.__svadminTenant;
+      const router = adminContext.routerProvider;
+      const access = adminContext.accessControlProvider;
+      const notification = adminContext.notificationProvider;
+      const scope: SubmissionScope = {
+        queryScope: adminContext.queryKeyMatcher(),
+        auth,
+        notification,
+        current: () => !disposed && auth.isCurrent() && adminContext.authProvider === authProvider
+          && adminContext.tenantCacheKey?.__svadminTenant === tenant
+          && adminContext.routerProvider === router && adminContext.accessControlProvider === access
+          && adminContext.notificationProvider === notification
+          && (params.taskProvider ?? adminContext.taskProvider) === source,
+      };
+      if (!scope.current()) throw supersededQuerySession();
+      try {
+        const provider=normalizeTaskProvider(source,adminContext);
+        const providerMeta=adminContext.tenant
+          ? {
+            ...(params.options?.meta??{}),
+            ...resolveTenantProviderMeta(adminContext.tenant,adminContext.tenantAdapter),
+          }
+          :params.options?.meta;
+        const taskOptions=providerMeta===params.options?.meta
+          ? params.options
+          :definedOptions({
+            ...params.options,
+            meta: providerMeta,
+          });
+        const handle = await provider.submit(params.taskName,taskOptions);
+        submissionScopes.set(handle, scope);
+        return handle;
+      } catch (error) {
+        const failure = error instanceof TaskError ? error : new TaskError('TASK_PROVIDER_FAILED');
+        failureScopes.set(failure, scope);
+        throw failure;
+      }
     },
     onSuccess: (data,params,context) => {
+      const submission = submissionScopes.get(data);
+      if (submission) submissionScopes.delete(data);
+      if (!submission) return;
+      if (submission.auth.isCurrent()) {
+        void queryClient.invalidateQueries({
+          predicate: (query) => queryKeyMatches(query.queryKey,{
+            ...submission.queryScope,
+            kind: 'task',
+            action: 'list',
+          }),
+        });
+      }
+      if (!submission.current()) return;
       fireSuccessNotification({
         config: params.successNotification,
         defaultMessage: i18n.t('task.submitSuccess'),
@@ -115,34 +162,27 @@ export function useSubmitTask(options: UseSubmitTaskOptions={}) {
         values: params.options,
         resource: params.taskName,
         ...definedOptions({
-          provider: adminContext.notificationProvider
+          provider: submission.notification
         })
       });
-      const scope = submissionScopes.get(data);
-      if (scope) {
-        submissionScopes.delete(data);
-        void queryClient.invalidateQueries({
-          predicate: (query) => queryKeyMatches(query.queryKey,{
-            ...scope,
-            kind: 'task',
-            action: 'list',
-          }),
-        });
-      }
-      options.mutationOptions?.onSuccess?.(data,params,context);
+      if (submission.current()) options.mutationOptions?.onSuccess?.(data,params,context);
     },
     onError: (error,params,context) => {
+      const submission = failureScopes.get(error);
+      failureScopes.delete(error);
+      if (!submission?.current()) return;
       checkError(error,adminContext);
+      if (!submission.current()) return;
       fireErrorNotification({
         config: params.errorNotification,
         defaultMessage: i18n.t('task.submitFailed'),
         error,
         resource: params.taskName,
         ...definedOptions({
-          provider: adminContext.notificationProvider
+          provider: submission.notification
         })
       });
-      options.mutationOptions?.onError?.(error,params,context);
+      if (submission.current()) options.mutationOptions?.onError?.(error,params,context);
     },
   }));
 
@@ -235,6 +275,18 @@ export function useTaskList(
     const activeProvider=options.taskProvider??adminContext.taskProvider;
     const provider=activeProvider? withValidatedTaskProvider(activeProvider):undefined;
     const params=options.params===undefined? undefined:taskQueryParams(options.params);
+    const callerMeta = params?.['meta'];
+    if (callerMeta !== undefined
+      && (typeof callerMeta !== 'object' || callerMeta === null || Array.isArray(callerMeta))) {
+      throw new TaskError('INVALID_TASK_INPUT');
+    }
+    const tenantMeta = adminContext.tenant
+      ? resolveTenantProviderMeta(adminContext.tenant, adminContext.tenantAdapter)
+      : undefined;
+    const providerParams = params === undefined && tenantMeta === undefined ? undefined : {
+      ...(params ?? {}),
+      ...(tenantMeta ? { meta: { ...(callerMeta ?? {}), ...tenantMeta } } : {}),
+    };
     const dlq=options.dlq??false;
     const queryOptions=options.queryOptions;
     const resource = dlq ? 'taskDlq' : 'tasks';
@@ -249,16 +301,16 @@ export function useTaskList(
       decode: decodeTaskList,
       queryKey: scopedTaskKey(adminContext.queryKeys().task.list(definedOptions({
         list: dlq? 'dlq':'default',
-        params,
+        params: providerParams,
       })),provider),
       queryFn: async () => {
         if(!provider) throw new Error('TaskProvider not found.');
         if(dlq) {
           if(!provider.listDlq) throw new Error('TaskProvider does not implement listDlq');
-          return provider.listDlq(params);
+          return provider.listDlq(providerParams);
         }
         if(!provider.list) throw new Error('TaskProvider does not implement list');
-        return provider.list(params);
+        return provider.list(providerParams);
       },
       enabled: queryOptions?.enabled??true,
       ...definedOptions({
@@ -294,19 +346,36 @@ export function useTaskSubscription(
     const enabled=options.enabled??true;
     if(!enabled) return;
 
-    const provider=normalizeTaskProvider(options.taskProvider,adminContext);
+    const authProvider = adminContext.authProvider;
+    const auth = captureAuthLiveScope(authProvider);
+    if (!auth.available) return;
+    const source = options.taskProvider ?? adminContext.taskProvider;
+    const tenant = adminContext.tenantCacheKey?.__svadminTenant;
+    const router = adminContext.routerProvider;
+    const access = adminContext.accessControlProvider;
+    const taskId = options.taskId;
+    const onTask = options.onTask;
+    const onError = options.onError;
+    let active = true;
+    const current = () => active && (options.enabled ?? true) && options.taskId === taskId
+      && (options.taskProvider ?? adminContext.taskProvider) === source
+      && adminContext.authProvider === authProvider && auth.isCurrent()
+      && adminContext.tenantCacheKey?.__svadminTenant === tenant
+      && adminContext.routerProvider === router && adminContext.accessControlProvider === access;
+    const provider=normalizeTaskProvider(source,adminContext);
     if(!provider.subscribe) {
       throw new Error('TaskProvider does not implement subscribe');
     }
 
-    const subscription=provider.subscribe(options.taskId,options.onTask,options.onError);
-
-    if(typeof subscription==='function') {
-      return subscription;
-    }
-
-    if(typeof subscription.unsubscribe==='function') {
-      return () => subscription.unsubscribe();
-    }
+    const subscription=provider.subscribe(taskId,
+      task => { if (current()) onTask(task); },
+      error => { if (current()) onError?.(error); },
+    );
+    return () => {
+      // 先失效，再退订；上游退订时同步发出的最后一条事件也不能进入新会话。
+      active = false;
+      if (typeof subscription === 'function') subscription();
+      else subscription.unsubscribe();
+    };
   });
 }

package/src/types.ts

@@ -405,6 +405,22 @@ export interface MenuItem {
   children?: MenuItem[];
 }
 
+export interface DateInputOptions {
+  min?: string;
+  max?: string;
+  step?: number;
+  /** 仅用于 daterange；其他日期字段由 field.type 决定输入模式。 */
+  rangeMode?: 'date' | 'time' | 'datetime';
+  disabledDate?: (date: string) => boolean;
+  presets?: { label: string; value: { start: string; end: string } }[];
+  /** datetime 字段的输出语义；默认保留本地 datetime-local 字符串。 */
+  valueMode?: 'civil' | 'instant';
+  /** valueMode=instant 时必填的 IANA 时区。 */
+  timeZone?: string;
+  /** 仅用于 datetime，重复本地时刻默认拒绝，允许明确选择较早或较晚的一次。 */
+  disambiguation?: 'reject' | 'earlier' | 'later';
+}
+
 export interface FieldDefinition {
   key: string;
   label: string;
@@ -438,6 +454,8 @@ export interface FieldDefinition {
   currency?: string;
   locale?: string;
   scale?: '100' | '1';
+  // 日期输入策略与数值上下限分离，不隐式转换时区。
+  dateInput?: DateInputOptions;
   // File upload contract
   accept?: string;
   maxSize?: number;