openxiangda-contracts 2.35.0 → 2.47.0

package/dist/native-compiler/role-membership-batch.d.ts

@@ -0,0 +1,73 @@
+import type { NativeRoleMembership, NativeRoleMembershipMutationResult, NativeScopeGrant, Sha256Digest } from '../types.js';
+export declare const NATIVE_ROLE_MEMBERSHIP_BATCH_MAX_ITEMS = 50;
+export declare const NATIVE_ROLE_MEMBERSHIP_BATCH_MAX_BYTES: number;
+export type NativeRoleMembershipBatchOperation = 'create' | 'update' | 'revoke';
+type Mutation = {
+    operationId: string;
+    reason: string;
+};
+type Changes = {
+    scopeGrants?: NativeScopeGrant[];
+    validFrom?: string | null;
+    validTo?: string | null;
+};
+export type NativeRoleMembershipBatchItem = (Mutation & Changes & {
+    operation: 'create';
+    userId: string;
+    roleCode: string;
+}) | (Mutation & Changes & {
+    operation: 'update';
+    membershipId: string;
+    expectedRevision: number;
+}) | (Mutation & {
+    operation: 'revoke';
+    membershipId: string;
+    expectedRevision: number;
+});
+export interface NativeRoleMembershipBatchInput {
+    schemaVersion: 'openxiangda.native-role-membership-batch-request/v2';
+    environmentKey?: 'preproduction' | 'production';
+    items: NativeRoleMembershipBatchItem[];
+}
+export type NativeRoleMembershipChange = Pick<NativeRoleMembership, 'userId' | 'roleCode' | 'roleSource' | 'sourceCode' | 'scopeGrants' | 'status' | 'validFrom' | 'validTo'>;
+type ItemIdentity = {
+    index: number;
+    operationId: string;
+    operation: NativeRoleMembershipBatchOperation;
+};
+export type NativeRoleMembershipBatchItemResult = ItemIdentity & ({
+    status: 'ready' | 'already_committed';
+    before: NativeRoleMembershipChange | null;
+    after: NativeRoleMembershipChange;
+} | {
+    status: 'committed' | 'replayed';
+    result: NativeRoleMembershipMutationResult;
+} | {
+    status: 'failed' | 'unconfirmed';
+    error: {
+        code: string;
+        status: number;
+        pointer: string;
+        retryable: boolean;
+    };
+});
+export interface NativeRoleMembershipBatchResult {
+    schemaVersion: 'openxiangda.native-role-membership-batch-result/v2';
+    mode: 'preview' | 'execute';
+    requestDigest: Sha256Digest;
+    items: NativeRoleMembershipBatchItemResult[];
+    succeeded: number;
+    failed: number;
+    unconfirmed: number;
+    effect: 'future_assignment_keep_existing_tasks';
+}
+export declare class NativeRoleMembershipBatchInputError extends Error {
+    readonly pointer: string;
+    readonly code = "OPENXIANGDA_NATIVE_AUTHZ_BATCH_INPUT_INVALID";
+    readonly status = 400;
+    constructor(pointer: string);
+}
+/** Shared structural bounds. Semantic authorization, scope and CAS remain in the Native kernel. */
+export declare function assertNativeRoleMembershipBatchInput(input: unknown): asserts input is NativeRoleMembershipBatchInput;
+export {};
+//# sourceMappingURL=role-membership-batch.d.ts.map

package/dist/native-compiler/role-membership-batch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-membership-batch.d.ts","sourceRoot":"","sources":["../../src/native-compiler/role-membership-batch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,kCAAkC,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE5H,eAAO,MAAM,sCAAsC,KAAK,CAAC;AACzD,eAAO,MAAM,sCAAsC,QAAa,CAAC;AACjE,MAAM,MAAM,kCAAkC,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAChF,KAAK,QAAQ,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AACxD,KAAK,OAAO,GAAG;IAAE,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AACxG,MAAM,MAAM,6BAA6B,GACrC,CAAC,QAAQ,GAAG,OAAO,GAAG;IAAE,SAAS,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,GAChF,CAAC,QAAQ,GAAG,OAAO,GAAG;IAAE,SAAS,EAAE,QAAQ,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAC,GAC9F,CAAC,QAAQ,GAAG;IAAE,SAAS,EAAE,QAAQ,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AACzF,MAAM,WAAW,8BAA8B;IAC7C,aAAa,EAAE,qDAAqD,CAAC;IACrE,cAAc,CAAC,EAAE,eAAe,GAAG,YAAY,CAAC;IAChD,KAAK,EAAE,6BAA6B,EAAE,CAAC;CACxC;AACD,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAAC,oBAAoB,EAChE,QAAQ,GAAG,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,aAAa,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC,CAAC;AAC5G,KAAK,YAAY,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,kCAAkC,CAAA;CAAE,CAAC;AAC1G,MAAM,MAAM,mCAAmC,GAAG,YAAY,GAAG,CAC7D;IAAE,MAAM,EAAE,OAAO,GAAG,mBAAmB,CAAC;IAAC,MAAM,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,0BAA0B,CAAA;CAAE,GACvH;IAAE,MAAM,EAAE,WAAW,GAAG,UAAU,CAAC;IAAC,MAAM,EAAE,kCAAkC,CAAA;CAAE,GAChF;IAAE,MAAM,EAAE,QAAQ,GAAG,aAAa,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CACrH,CAAC;AACF,MAAM,WAAW,+BAA+B;IAC9C,aAAa,EAAE,oDAAoD,CAAC;IACpE,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;IAC5B,aAAa,EAAE,YAAY,CAAC;IAC5B,KAAK,EAAE,mCAAmC,EAAE,CAAC;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,uCAAuC,CAAC;CACjD;AAED,qBAAa,mCAAoC,SAAQ,KAAK;IAGhD,QAAQ,CAAC,OAAO,EAAE,MAAM;IAFpC,QAAQ,CAAC,IAAI,kDAAkD;IAC/D,QAAQ,CAAC,MAAM,OAAO;gBACD,OAAO,EAAE,MAAM;CACrC;AAED,mGAAmG;AACnG,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,8BAA8B,CAqDpH"}

package/dist/native-compiler/role-membership-batch.js

@@ -0,0 +1,91 @@
+export const NATIVE_ROLE_MEMBERSHIP_BATCH_MAX_ITEMS = 50;
+export const NATIVE_ROLE_MEMBERSHIP_BATCH_MAX_BYTES = 128 * 1024;
+export class NativeRoleMembershipBatchInputError extends Error {
+    pointer;
+    code = 'OPENXIANGDA_NATIVE_AUTHZ_BATCH_INPUT_INVALID';
+    status = 400;
+    constructor(pointer) {
+        super('OPENXIANGDA_NATIVE_AUTHZ_BATCH_INPUT_INVALID');
+        this.pointer = pointer;
+    }
+}
+/** Shared structural bounds. Semantic authorization, scope and CAS remain in the Native kernel. */
+export function assertNativeRoleMembershipBatchInput(input) {
+    const fail = (path) => { throw new NativeRoleMembershipBatchInputError(path); };
+    const record = (value, path) => {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            fail(path);
+        return value;
+    };
+    const keys = (value, allowed, path) => {
+        for (const key of Object.keys(value))
+            if (!allowed.includes(key))
+                fail(`${path}/${key}`);
+    };
+    const text = (value, max, path) => {
+        if (typeof value !== 'string' || !value.trim() || value.length > max)
+            fail(path);
+        return value;
+    };
+    const uuid = (value, path) => {
+        const id = text(value, 36, path);
+        if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(id))
+            fail(path);
+        return id.toLowerCase();
+    };
+    const value = record(input, '');
+    let bytes;
+    try {
+        bytes = new TextEncoder().encode(JSON.stringify(value)).byteLength;
+    }
+    catch {
+        fail('');
+    }
+    if (bytes > NATIVE_ROLE_MEMBERSHIP_BATCH_MAX_BYTES)
+        fail('');
+    keys(value, ['schemaVersion', 'environmentKey', 'items'], '');
+    if (value.schemaVersion !== 'openxiangda.native-role-membership-batch-request/v2')
+        fail('/schemaVersion');
+    if (value.environmentKey !== undefined && !['preproduction', 'production'].includes(String(value.environmentKey)))
+        fail('/environmentKey');
+    if (!Array.isArray(value.items) || value.items.length < 1 || value.items.length > NATIVE_ROLE_MEMBERSHIP_BATCH_MAX_ITEMS)
+        fail('/items');
+    const operationIds = new Set(), targets = new Set();
+    let operation;
+    for (const [index, raw] of value.items.entries()) {
+        const path = `/items/${index}`, item = record(raw, path);
+        if (!['create', 'update', 'revoke'].includes(String(item.operation)))
+            fail(`${path}/operation`);
+        operation ??= item.operation;
+        if (operation !== item.operation)
+            fail(`${path}/operation`);
+        keys(item, ['operation', 'operationId', 'reason', ...(operation === 'create' ? ['userId', 'roleCode'] : ['membershipId', 'expectedRevision']), ...(operation !== 'revoke' ? ['scopeGrants', 'validFrom', 'validTo'] : [])], path);
+        const id = uuid(item.operationId, `${path}/operationId`);
+        if (operationIds.has(id))
+            fail(`${path}/operationId`);
+        operationIds.add(id);
+        text(item.reason, 1000, `${path}/reason`);
+        let target;
+        if (operation === 'create') {
+            const userId = text(item.userId, 255, `${path}/userId`), roleCode = text(item.roleCode, 128, `${path}/roleCode`);
+            if (!/^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/.test(roleCode))
+                fail(`${path}/roleCode`);
+            target = JSON.stringify([userId, roleCode]);
+        }
+        else {
+            target = uuid(item.membershipId, `${path}/membershipId`);
+            if (!Number.isSafeInteger(item.expectedRevision) || Number(item.expectedRevision) < 1)
+                fail(`${path}/expectedRevision`);
+        }
+        if (targets.has(target))
+            fail(path);
+        targets.add(target);
+        // Scope/date semantics are validated by the same kernel as single mutations.
+        if (item.scopeGrants !== undefined && (!Array.isArray(item.scopeGrants) || item.scopeGrants.length > 100))
+            fail(`${path}/scopeGrants`);
+        for (const field of ['validFrom', 'validTo'])
+            if (item[field] !== undefined && item[field] !== null)
+                text(item[field], 64, `${path}/${field}`);
+    }
+}
+//# sourceMappingURL=role-membership-batch.js.map

package/dist/native-compiler/role-membership-batch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-membership-batch.js","sourceRoot":"","sources":["../../src/native-compiler/role-membership-batch.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,sCAAsC,GAAG,EAAE,CAAC;AACzD,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,GAAG,IAAI,CAAC;AAgCjE,MAAM,OAAO,mCAAoC,SAAQ,KAAK;IAGvC;IAFZ,IAAI,GAAG,8CAA8C,CAAC;IACtD,MAAM,GAAG,GAAG,CAAC;IACtB,YAAqB,OAAe;QAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAAzE,YAAO,GAAP,OAAO,CAAQ;IAA2D,CAAC;CACjG;AAED,mGAAmG;AACnG,MAAM,UAAU,oCAAoC,CAAC,KAAc;IACjE,MAAM,IAAI,GAAG,CAAC,IAAY,EAAS,EAAE,GAAG,MAAM,IAAI,mCAAmC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,IAAY,EAA2B,EAAE;QACvE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5E,OAAO,KAAgC,CAAC;IAC1C,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,KAA8B,EAAE,OAAiB,EAAE,IAAY,EAAE,EAAE;QAC/E,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,GAAW,EAAE,IAAY,EAAU,EAAE;QACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACjF,OAAO,KAAe,CAAC;IACzB,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,IAAY,EAAE,EAAE;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,4EAA4E,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvG,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1B,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChC,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IAC/F,IAAI,KAAM,GAAG,sCAAsC;QAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,aAAa,KAAK,qDAAqD;QAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC1G,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC3I,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,sCAAsC;QAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzI,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,EAAE,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IACpE,IAAI,SAAkB,CAAC;IACvB,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAK,KAAK,CAAC,KAAmB,CAAC,OAAO,EAAE,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,UAAU,KAAK,EAAE,EAAE,IAAI,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAE,IAAI,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC;QAChG,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC;QAC7B,IAAI,SAAS,KAAK,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,EAAE,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAClO,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,cAAc,CAAC,CAAC;QACzD,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;QACtD,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC;QAC1C,IAAI,MAAc,CAAC;QACnB,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,SAAS,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,IAAI,WAAW,CAAC,CAAC;YACjH,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;YACpF,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,eAAe,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;QAC1H,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,6EAA6E;QAC7E,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,GAAG,CAAC;YAAE,IAAI,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;QACvI,KAAK,MAAM,KAAK,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;YAAE,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IACjJ,CAAC;AACH,CAAC"}

package/dist/native-compiler/workflow-assignment-routing.d.ts

@@ -0,0 +1,121 @@
+import type { WorkflowAssignmentRoutingPolicy, WorkflowAssignmentRoutingRule } from '../types.js';
+export declare const WORKFLOW_ROUTING_MAX_RULES = 256;
+export declare const WORKFLOW_ROUTING_MAX_MATCHED_RULES = 64;
+export declare const WORKFLOW_ROUTING_MAX_BYTES = 262144;
+export declare const workflowAssignmentRoutingPolicySchema: {
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["policyCode", "title", "strategy", "dimensions", "sources"];
+    readonly properties: {
+        readonly policyCode: {
+            readonly type: "string";
+            readonly pattern: "^[a-z][a-z0-9_-]{0,127}$";
+        };
+        readonly title: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+        };
+        readonly strategy: {
+            readonly enum: readonly ["replace_then_append", "replace_only"];
+        };
+        readonly dimensions: {
+            readonly type: "object";
+            readonly maxProperties: 8;
+            readonly propertyNames: {
+                readonly type: "string";
+                readonly pattern: "^[a-z][a-z0-9_-]{0,127}$";
+            };
+            readonly additionalProperties: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["title", "valueFrom"];
+                readonly properties: {
+                    readonly title: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                    };
+                    readonly valueFrom: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 255;
+                    };
+                };
+            };
+        };
+        readonly sources: {
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly maxProperties: 16;
+            readonly propertyNames: {
+                readonly type: "string";
+                readonly pattern: "^[a-z][a-z0-9_-]{0,127}$";
+            };
+            readonly additionalProperties: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["title", "provider", "roleCode"];
+                readonly properties: {
+                    readonly title: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                    };
+                    readonly provider: {
+                        readonly enum: readonly ["app_role", "app_role_in_scope"];
+                    };
+                    readonly roleCode: {
+                        readonly type: "string";
+                        readonly pattern: "^[a-z][a-z0-9_-]{0,127}$";
+                    };
+                    readonly scope: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["dimension"];
+                        readonly properties: {
+                            readonly dimension: {
+                                readonly type: "string";
+                                readonly pattern: "^[a-z][a-z0-9_-]{0,127}$";
+                            };
+                            readonly value: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                                readonly maxLength: 255;
+                            };
+                            readonly valueFrom: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                                readonly maxLength: 255;
+                            };
+                        };
+                    };
+                };
+            };
+        };
+    };
+};
+export declare function validateWorkflowAssignmentRoutingPolicy(value: unknown): string[];
+export declare function validateWorkflowAssignmentRoutingRules(policy: WorkflowAssignmentRoutingPolicy, value: unknown): string[];
+/** Semantic equality ignores object insertion order and display titles. */
+export declare function workflowAssignmentRoutingSemantic(policy: WorkflowAssignmentRoutingPolicy): string;
+export declare function validateWorkflowAssignmentRoutingBindings(bindings: Array<{
+    bindings?: Record<string, {
+        routing?: WorkflowAssignmentRoutingPolicy;
+    }>;
+}>): string[];
+/** Evaluates only code-declared scalar paths, never prototype properties. */
+export declare function workflowAssignmentRoutingFacts(policy: WorkflowAssignmentRoutingPolicy, facts: Record<string, unknown>): Record<string, string>;
+/** Same deterministic selection for preview and node entry; candidates still belong to the resolver. */
+export declare function selectWorkflowAssignmentRoutingRules(policy: WorkflowAssignmentRoutingPolicy, rules: WorkflowAssignmentRoutingRule[], input: {
+    workflowCode: string;
+    nodeId: string;
+    facts: Record<string, string>;
+    at: number;
+}): {
+    matched: WorkflowAssignmentRoutingRule[];
+    replacement: WorkflowAssignmentRoutingRule | undefined;
+    applied: WorkflowAssignmentRoutingRule[];
+    ignored: WorkflowAssignmentRoutingRule[];
+};
+//# sourceMappingURL=workflow-assignment-routing.d.ts.map

package/dist/native-compiler/workflow-assignment-routing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-assignment-routing.d.ts","sourceRoot":"","sources":["../../src/native-compiler/workflow-assignment-routing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AAElG,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,eAAO,MAAM,kCAAkC,KAAK,CAAC;AACrD,eAAO,MAAM,0BAA0B,SAAS,CAAC;AAejD,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAcxC,CAAC;AAEX,wBAAgB,uCAAuC,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAMhF;AAED,wBAAgB,sCAAsC,CAAC,MAAM,EAAE,+BAA+B,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAaxH;AAED,2EAA2E;AAC3E,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,+BAA+B,GAAG,MAAM,CAKjG;AAED,wBAAgB,yCAAyC,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,CAAC,EAAE,+BAA+B,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,GAAG,MAAM,EAAE,CAWjK;AAED,6EAA6E;AAC7E,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,+BAA+B,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9I;AAED,wGAAwG;AACxG,wBAAgB,oCAAoC,CAAC,MAAM,EAAE,+BAA+B,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,KAAK,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE;;;;;EAU/N"}

package/dist/native-compiler/workflow-assignment-routing.js

@@ -0,0 +1,113 @@
+export const WORKFLOW_ROUTING_MAX_RULES = 256;
+export const WORKFLOW_ROUTING_MAX_MATCHED_RULES = 64;
+export const WORKFLOW_ROUTING_MAX_BYTES = 262144;
+const codePattern = /^[a-z][a-z0-9_-]{0,127}$/;
+const pathPattern = /^[A-Za-z][A-Za-z0-9_]*(?:\.[A-Za-z][A-Za-z0-9_]*)*$/;
+const forbidden = new Set(['__proto__', 'prototype', 'constructor']);
+const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const keys = (v, allowed) => Object.keys(v).every(key => allowed.includes(key));
+const text = (v, max) => typeof v === 'string' && v.trim().length > 0 && v.length <= max && !/[\u0000-\u001f\u007f]/.test(v);
+const code = (v) => typeof v === 'string' && codePattern.test(v) && !forbidden.has(v);
+const path = (v) => typeof v === 'string' && v.length <= 255 && pathPattern.test(v) && !v.split('.').some(part => forbidden.has(part));
+const scopeValid = (v) => record(v) && keys(v, ['dimension', 'valueFrom', 'value']) && code(v.dimension) &&
+    ((text(v.value, 255) && v.valueFrom === undefined) || (path(v.valueFrom) && v.value === undefined));
+const instant = (v) => typeof v === 'string' && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/.test(v) && Number.isFinite(Date.parse(v));
+const stringCode = { type: 'string', pattern: '^[a-z][a-z0-9_-]{0,127}$' };
+const titleSchema = { type: 'string', minLength: 1, maxLength: 128 };
+export const workflowAssignmentRoutingPolicySchema = {
+    type: 'object', additionalProperties: false, required: ['policyCode', 'title', 'strategy', 'dimensions', 'sources'],
+    properties: {
+        policyCode: stringCode, title: titleSchema, strategy: { enum: ['replace_then_append', 'replace_only'] },
+        dimensions: { type: 'object', maxProperties: 8, propertyNames: stringCode, additionalProperties: {
+                type: 'object', additionalProperties: false, required: ['title', 'valueFrom'], properties: { title: titleSchema, valueFrom: { type: 'string', minLength: 1, maxLength: 255 } },
+            } },
+        sources: { type: 'object', minProperties: 1, maxProperties: 16, propertyNames: stringCode, additionalProperties: {
+                type: 'object', additionalProperties: false, required: ['title', 'provider', 'roleCode'], properties: {
+                    title: titleSchema, provider: { enum: ['app_role', 'app_role_in_scope'] }, roleCode: stringCode,
+                    scope: { type: 'object', additionalProperties: false, required: ['dimension'], properties: { dimension: stringCode, value: { type: 'string', minLength: 1, maxLength: 255 }, valueFrom: { type: 'string', minLength: 1, maxLength: 255 } } },
+                },
+            } },
+    },
+};
+export function validateWorkflowAssignmentRoutingPolicy(value) {
+    if (!record(value) || !keys(value, ['policyCode', 'title', 'strategy', 'dimensions', 'sources']) || !code(value.policyCode) || !text(value.title, 128) || !['replace_then_append', 'replace_only'].includes(value.strategy))
+        return ['WORKFLOW_V2_ROUTING_POLICY_INVALID'];
+    const errors = [];
+    if (!record(value.dimensions) || Object.keys(value.dimensions).length > 8 || Object.entries(value.dimensions).some(([key, dimension]) => !code(key) || !record(dimension) || !keys(dimension, ['title', 'valueFrom']) || !text(dimension.title, 128) || !path(dimension.valueFrom)))
+        errors.push('WORKFLOW_V2_ROUTING_DIMENSIONS_INVALID');
+    if (!record(value.sources) || Object.keys(value.sources).length < 1 || Object.keys(value.sources).length > 16 || Object.entries(value.sources).some(([key, source]) => !code(key) || !record(source) || !keys(source, ['title', 'provider', 'roleCode', 'scope']) || !text(source.title, 128) || !code(source.roleCode) || !['app_role', 'app_role_in_scope'].includes(source.provider) || (source.provider === 'app_role_in_scope' ? !scopeValid(source.scope) : source.scope !== undefined)))
+        errors.push('WORKFLOW_V2_ROUTING_SOURCES_INVALID');
+    return errors;
+}
+export function validateWorkflowAssignmentRoutingRules(policy, value) {
+    if (validateWorkflowAssignmentRoutingPolicy(policy).length)
+        return ['WORKFLOW_V2_ROUTING_POLICY_INVALID'];
+    if (!Array.isArray(value) || value.length > WORKFLOW_ROUTING_MAX_RULES || new TextEncoder().encode(JSON.stringify(value)).length > WORKFLOW_ROUTING_MAX_BYTES)
+        return ['WORKFLOW_V2_ROUTING_RULE_LIMIT_EXCEEDED'];
+    const errors = [], seen = new Set();
+    for (const rule of value) {
+        if (!record(rule) || !keys(rule, ['ruleCode', 'title', 'enabled', 'workflowCode', 'nodeId', 'matches', 'sourceCode', 'effect', 'priority', 'validFrom', 'validTo']) || !code(rule.ruleCode) || !text(rule.title, 128) || typeof rule.enabled !== 'boolean' || !code(rule.sourceCode) || !Object.hasOwn(policy.sources, rule.sourceCode) || !['append', 'replace'].includes(rule.effect) || !Number.isSafeInteger(rule.priority) || rule.priority < -1000 || rule.priority > 1000 || (rule.workflowCode !== undefined && !code(rule.workflowCode)) || (rule.nodeId !== undefined && (!code(rule.nodeId) || rule.workflowCode === undefined)) || (rule.validFrom !== undefined && !instant(rule.validFrom)) || (rule.validTo !== undefined && !instant(rule.validTo)) || (rule.validFrom && rule.validTo && Date.parse(rule.validFrom) >= Date.parse(rule.validTo))) {
+            errors.push('WORKFLOW_V2_ROUTING_RULE_INVALID');
+            continue;
+        }
+        if (seen.has(rule.ruleCode))
+            errors.push(`WORKFLOW_V2_ROUTING_RULE_DUPLICATE:${rule.ruleCode}`);
+        seen.add(rule.ruleCode);
+        if (!record(rule.matches) || Object.entries(rule.matches).some(([dimension, values]) => !Object.hasOwn(policy.dimensions, dimension) || !Array.isArray(values) || values.length < 1 || values.length > 64 || new Set(values).size !== values.length || values.some(v => !text(v, 255))))
+            errors.push(`WORKFLOW_V2_ROUTING_MATCH_INVALID:${rule.ruleCode}`);
+    }
+    return [...new Set(errors)];
+}
+/** Semantic equality ignores object insertion order and display titles. */
+export function workflowAssignmentRoutingSemantic(policy) {
+    return JSON.stringify({ policyCode: policy.policyCode, strategy: policy.strategy,
+        dimensions: Object.entries(policy.dimensions).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, d]) => [key, d.valueFrom]),
+        sources: Object.entries(policy.sources).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, s]) => [key, s.provider, s.roleCode, s.scope?.dimension ?? null, s.scope?.valueFrom ?? null, s.scope?.value ?? null]),
+    });
+}
+export function validateWorkflowAssignmentRoutingBindings(bindings) {
+    const errors = [], policies = new Map();
+    for (const binding of bindings)
+        for (const [bindingCode, entry] of Object.entries(binding.bindings || {})) {
+            if (!record(entry) || entry.routing === undefined)
+                continue;
+            const diagnostics = validateWorkflowAssignmentRoutingPolicy(entry.routing);
+            if (diagnostics.length) {
+                errors.push(...diagnostics.map(error => `${error}:${bindingCode}`));
+                continue;
+            }
+            const semantic = workflowAssignmentRoutingSemantic(entry.routing), existing = policies.get(entry.routing.policyCode);
+            if (existing && existing !== semantic)
+                errors.push(`WORKFLOW_V2_ROUTING_POLICY_CONFLICT:${entry.routing.policyCode}`);
+            policies.set(entry.routing.policyCode, semantic);
+        }
+    return [...new Set(errors)];
+}
+/** Evaluates only code-declared scalar paths, never prototype properties. */
+export function workflowAssignmentRoutingFacts(policy, facts) {
+    const result = {};
+    for (const [dimension, declaration] of Object.entries(policy.dimensions)) {
+        let value = facts;
+        for (const key of declaration.valueFrom.split('.'))
+            value = record(value) && Object.hasOwn(value, key) ? value[key] : undefined;
+        if (!((typeof value === 'string' && text(value, 255)) || (typeof value === 'number' && Number.isFinite(value)) || typeof value === 'boolean'))
+            throw new Error(`WORKFLOW_V2_ROUTING_FACT_REQUIRED:${dimension}`);
+        result[dimension] = String(value);
+    }
+    return result;
+}
+/** Same deterministic selection for preview and node entry; candidates still belong to the resolver. */
+export function selectWorkflowAssignmentRoutingRules(policy, rules, input) {
+    const matched = rules.filter(rule => rule.enabled && (!rule.validFrom || Date.parse(rule.validFrom) <= input.at) && (!rule.validTo || Date.parse(rule.validTo) > input.at) && (!rule.workflowCode || rule.workflowCode === input.workflowCode) && (!rule.nodeId || rule.nodeId === input.nodeId) && Object.entries(rule.matches).every(([dimension, values]) => values.includes(input.facts[dimension])));
+    if (matched.length > WORKFLOW_ROUTING_MAX_MATCHED_RULES)
+        throw new Error('WORKFLOW_V2_ROUTING_MATCH_LIMIT_EXCEEDED');
+    const order = (a, b) => b.priority - a.priority || Number(Boolean(a.workflowCode)) - Number(Boolean(b.workflowCode)) || Number(Boolean(a.nodeId)) - Number(Boolean(b.nodeId)) || (a.ruleCode < b.ruleCode ? -1 : a.ruleCode > b.ruleCode ? 1 : 0);
+    const replacements = matched.filter(rule => rule.effect === 'replace').sort(order);
+    if (replacements.length > 1 && replacements[0].priority === replacements[1].priority)
+        throw new Error('WORKFLOW_V2_ROUTING_REPLACE_CONFLICT');
+    const replacement = replacements[0];
+    const appended = replacement && policy.strategy === 'replace_only' ? [] : matched.filter(rule => rule.effect === 'append').sort(order);
+    const applied = [...(replacement ? [replacement] : []), ...appended];
+    return { matched: matched.sort(order), replacement, applied, ignored: matched.filter(rule => !applied.includes(rule)) };
+}
+//# sourceMappingURL=workflow-assignment-routing.js.map

package/dist/native-compiler/workflow-assignment-routing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-assignment-routing.js","sourceRoot":"","sources":["../../src/native-compiler/workflow-assignment-routing.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,CAAC;AACrD,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AACjD,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAC/C,MAAM,WAAW,GAAG,qDAAqD,CAAC;AAC1E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AACrE,MAAM,MAAM,GAAG,CAAC,CAAU,EAA4B,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC3G,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,OAAiB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAClG,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9I,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/F,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAChJ,MAAM,UAAU,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/G,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC;AACtG,MAAM,OAAO,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,0EAA0E,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9K,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,0BAA0B,EAAW,CAAC;AACpF,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAW,CAAC;AAC9E,MAAM,CAAC,MAAM,qCAAqC,GAAG;IACnD,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC;IACnH,UAAU,EAAE;QACV,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,qBAAqB,EAAE,cAAc,CAAC,EAAE;QACvG,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,oBAAoB,EAAE;gBAC/F,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;aAC/K,EAAE;QACH,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,oBAAoB,EAAE;gBAC/G,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,UAAU,EAAE;oBACpG,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU;oBAC/F,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE;iBAC7O;aACF,EAAE;KACJ;CACO,CAAC;AAEX,MAAM,UAAU,uCAAuC,CAAC,KAAc;IACpE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,oCAAoC,CAAC,CAAC;IAC3Q,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAC3U,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,mBAAmB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACnhB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,MAAuC,EAAE,KAAc;IAC5G,IAAI,uCAAuC,CAAC,MAAM,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,oCAAoC,CAAC,CAAC;IAC1G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,0BAA0B,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,0BAA0B;QAAE,OAAO,CAAC,yCAAyC,CAAC,CAAC;IAClN,MAAM,MAAM,GAAa,EAAE,EAAE,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACl0B,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;YAAC,SAAS;QAC5D,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,sCAAsC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,qCAAqC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7V,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iCAAiC,CAAC,MAAuC;IACvF,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ;QAC9E,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAClI,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC;KACxN,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yCAAyC,CAAC,QAA6F;IACrJ,MAAM,MAAM,GAAa,EAAE,EAAE,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClE,KAAK,MAAM,OAAO,IAAI,QAAQ;QAAE,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1G,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;gBAAE,SAAS;YAC5D,MAAM,WAAW,GAAG,uCAAuC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3E,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC1G,MAAM,QAAQ,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACrH,IAAI,QAAQ,IAAI,QAAQ,KAAK,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,uCAAuC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;YACtH,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,8BAA8B,CAAC,MAAuC,EAAE,KAA8B;IACpH,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACzE,IAAI,KAAK,GAAY,KAAK,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChI,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,KAAK,KAAK,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,SAAS,EAAE,CAAC,CAAC;QACjN,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,oCAAoC,CAAC,MAAuC,EAAE,KAAsC,EAAE,KAA0F;IAC9N,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAE,CAAC,CAAC,CAAC,CAAC;IAC3Y,IAAI,OAAO,CAAC,MAAM,GAAG,kCAAkC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACrH,MAAM,KAAK,GAAG,CAAC,CAAgC,EAAE,CAAgC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChT,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAE,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAE,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAChJ,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvI,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;IACrE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AAC1H,CAAC"}

package/dist/native-compiler/workflow-automatic-cc.d.ts

@@ -0,0 +1,20 @@
+/** Shared by source compilation, activation and transactional execution. */
+export declare const WORKFLOW_AUTOMATIC_CC_MAX_RECIPIENTS = 20;
+export declare const WORKFLOW_AUTOMATIC_CC_PROVIDERS: readonly ["fixed_users", "initiator", "input_users", "form_field_users", "app_role", "app_role_in_scope", "previous_node_actor"];
+type Definition = {
+    nodes?: Record<string, {
+        kind: string;
+        [key: string]: any;
+    }>;
+};
+type Binding = {
+    bindings?: Record<string, {
+        provider: string;
+        min?: number;
+        max?: number;
+        users?: string[];
+    }>;
+};
+export declare function validateWorkflowAutomaticCc(definition: Definition, binding?: Binding): string[];
+export {};
+//# sourceMappingURL=workflow-automatic-cc.d.ts.map

package/dist/native-compiler/workflow-automatic-cc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-automatic-cc.d.ts","sourceRoot":"","sources":["../../src/native-compiler/workflow-automatic-cc.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,eAAO,MAAM,oCAAoC,KAAK,CAAC;AACvD,eAAO,MAAM,+BAA+B,kIAGlC,CAAC;AAEX,KAAK,UAAU,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC;AACnF,KAAK,OAAO,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC;AAEjH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAsB/F"}

package/dist/native-compiler/workflow-automatic-cc.js

@@ -0,0 +1,36 @@
+/** Shared by source compilation, activation and transactional execution. */
+export const WORKFLOW_AUTOMATIC_CC_MAX_RECIPIENTS = 20;
+export const WORKFLOW_AUTOMATIC_CC_PROVIDERS = [
+    'fixed_users', 'initiator', 'input_users', 'form_field_users',
+    'app_role', 'app_role_in_scope', 'previous_node_actor',
+];
+export function validateWorkflowAutomaticCc(definition, binding) {
+    const errors = [];
+    for (const [id, node] of Object.entries(definition?.nodes || {})) {
+        if (node?.kind !== 'cc')
+            continue;
+        if (Object.keys(node).some(key => !['id', 'kind', 'title', 'binding', 'next', 'emptyPolicy', 'notify', 'administration'].includes(key)) ||
+            typeof node.title !== 'string' || !node.title.trim() || node.title.length > 255 ||
+            typeof node.binding !== 'string' || !node.binding.trim() || node.binding.length > 255 ||
+            typeof node.next !== 'string' || !node.next.trim() || !definition.nodes?.[node.next] ||
+            !['block', 'skip'].includes(node.emptyPolicy) || node.notify !== undefined && typeof node.notify !== 'boolean') {
+            errors.push(`WORKFLOW_CC_NODE_INVALID:${id}`);
+        }
+        if (!binding)
+            continue;
+        const entry = binding.bindings?.[node.binding];
+        if (!entry) {
+            errors.push(`WORKFLOW_CC_BINDING_NOT_FOUND:${id}`);
+            continue;
+        }
+        if (!WORKFLOW_AUTOMATIC_CC_PROVIDERS.includes(entry.provider))
+            errors.push(`WORKFLOW_CC_PROVIDER_INVALID:${id}`);
+        const minimum = entry.min ?? 1, maximum = entry.max ?? WORKFLOW_AUTOMATIC_CC_MAX_RECIPIENTS;
+        if (!Number.isSafeInteger(minimum) || !Number.isSafeInteger(maximum) || minimum < 1 || maximum < minimum || maximum > WORKFLOW_AUTOMATIC_CC_MAX_RECIPIENTS ||
+            entry.provider === 'fixed_users' && (!Array.isArray(entry.users) || !entry.users.length || entry.users.length > maximum)) {
+            errors.push(`WORKFLOW_CC_RECIPIENT_LIMIT_INVALID:${id}`);
+        }
+    }
+    return [...new Set(errors)];
+}
+//# sourceMappingURL=workflow-automatic-cc.js.map

package/dist/native-compiler/workflow-automatic-cc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-automatic-cc.js","sourceRoot":"","sources":["../../src/native-compiler/workflow-automatic-cc.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oCAAoC,GAAG,EAAE,CAAC;AACvD,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB;IAC7D,UAAU,EAAE,mBAAmB,EAAE,qBAAqB;CAC9C,CAAC;AAKX,MAAM,UAAU,2BAA2B,CAAC,UAAsB,EAAE,OAAiB;IACnF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,IAAI,IAAI,EAAE,IAAI,KAAK,IAAI;YAAE,SAAS;QAClC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG;YAC/E,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG;YACrF,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YACpF,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACnH,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC7E,IAAI,CAAC,+BAA+B,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAe,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,CAAC,CAAC;QACxH,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,GAAG,IAAI,oCAAoC,CAAC;QAC5F,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,OAAO,IAAI,OAAO,GAAG,oCAAoC;YACtJ,KAAK,CAAC,QAAQ,KAAK,aAAa,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;YAC7H,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC"}

package/dist/native-compiler/workflow-business-step-identity.d.ts

@@ -0,0 +1,12 @@
+import type { AppEventHandlerContract, EventHandlerManifest } from '../native.js';
+import type { WorkflowBusinessStepResult } from './workflow-business-step.js';
+/** Optional result extends the existing receipt signature without changing old calls. */
+export declare function workflowBusinessStepReceiptSignatureSuffix(result?: WorkflowBusinessStepResult): string;
+/** Other event handlers retain their existing whole-manifest identity. */
+export declare function workflowBusinessStepHandlerDigest(manifest: Omit<EventHandlerManifest, 'handlers'> & {
+    readonly handlers: readonly (Omit<AppEventHandlerContract, 'eventTypes' | 'dataSchemaVersions'> & {
+        readonly eventTypes: readonly string[];
+        readonly dataSchemaVersions: readonly string[];
+    })[];
+}, code: string): string;
+//# sourceMappingURL=workflow-business-step-identity.d.ts.map

package/dist/native-compiler/workflow-business-step-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-business-step-identity.d.ts","sourceRoot":"","sources":["../../src/native-compiler/workflow-business-step-identity.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAE9E,yFAAyF;AACzF,wBAAgB,0CAA0C,CAAC,MAAM,CAAC,EAAE,0BAA0B,GAAG,MAAM,CAEtG;AAED,0EAA0E;AAC1E,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,UAAU,CAAC,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,uBAAuB,EAAE,YAAY,GAAG,oBAAoB,CAAC,GAAG;QAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC,EAAE,CAAA;CAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAG9T"}

package/dist/native-compiler/workflow-business-step-identity.js

@@ -0,0 +1,11 @@
+import { sha256Digest } from '../canonical.js';
+/** Optional result extends the existing receipt signature without changing old calls. */
+export function workflowBusinessStepReceiptSignatureSuffix(result) {
+    return result === undefined ? '' : `\n${sha256Digest(result)}`;
+}
+/** Other event handlers retain their existing whole-manifest identity. */
+export function workflowBusinessStepHandlerDigest(manifest, code) {
+    const handler = manifest.handlers.find(item => item.code === code);
+    return sha256Digest(handler?.workflowStep ? handler : manifest);
+}
+//# sourceMappingURL=workflow-business-step-identity.js.map

package/dist/native-compiler/workflow-business-step-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-business-step-identity.js","sourceRoot":"","sources":["../../src/native-compiler/workflow-business-step-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAI/C,yFAAyF;AACzF,MAAM,UAAU,0CAA0C,CAAC,MAAmC;IAC5F,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iCAAiC,CAAC,QAAsP,EAAE,IAAY;IACpT,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACnE,OAAO,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAClE,CAAC"}