openxiangda-contracts 2.43.0 → 2.63.0

package/dist/native-compiler/compiler.js

@@ -1,4 +1,5 @@
-import { NativeUniqueKeyContractError, parseNativeUniqueKeys } from './unique-keys.js';
+import { validateUserCandidateReferences, validateWorkflowUserCandidateBindings, UserCandidateContractError } from './user-candidates.js';
+import { NativeUniqueKeyContractError, parseNativeUniqueKeys, nativeUniqueKeysContractVersion } from './unique-keys.js';
 import { validateManagedConcurrency, ManagedConcurrencyContractError } from './managed-concurrency.js';
 import { normalizeDecimalReservationEventDeclaration, decimalReservationEventContext } from './decimal-reservation.js';
 import { NativeDecimalLifecycleContractError, parseDecimalReservationLifecycle, validateDecimalReservationLifecycles } from './decimal-lifecycle.js';
@@ -9,6 +10,11 @@ import { validateWorkflowInstanceCommandPolicies } from './workflow-instance-pol
 import { validateWorkflowReadability } from './workflow-graph.js';
 import { validateWorkflowAdministration } from './workflow-node-administration.js';
 import { validateWorkflowAutomaticCc } from './workflow-automatic-cc.js';
+import { validateWorkflowApprovalEmptyPolicy, workflowBindingAllowsEmptyUsers } from './workflow-approval-empty.js';
+import { validateWorkflowInitiatorApprovalPolicy } from './workflow-initiator-approval.js';
+import { validateWorkflowRejectionNotification } from './workflow-rejection-notification.js';
+import { validateWorkflowCommandHandlers } from './workflow-business-command.js';
+import { validateWorkflowLaunchPreflight } from './workflow-launch-preflight.js';
 import { validateWorkflowTaskPages } from './workflow-task-page.js';
 import { validateWorkflowBusinessSteps, compileWorkflowBusinessStepHandlers, validateWorkflowBusinessStepSubscriptions, WORKFLOW_BUSINESS_STEP_EVENT, WORKFLOW_BUSINESS_STEP_EVENTS } from './workflow-business-step.js';
 import { validateWorkflowAssignmentRoutingBindings, validateWorkflowAssignmentRoutingPolicy } from './workflow-assignment-routing.js';
@@ -124,6 +130,7 @@ export const DATA_EVENT_TYPES_V2 = [
     'openxiangda.data.record.deleted.v2',
 ];
 export const WORKFLOW_EVENT_TYPES_V2 = [
+    'openxiangda.workflow.node.skipped.v2',
     WORKFLOW_BUSINESS_STEP_EVENT,
     'openxiangda.workflow.step.result_received.v2',
     'openxiangda.workflow.step.completed.v2',
@@ -284,6 +291,10 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
     const roles = config.authz.roles;
     const resources = config.data.resources;
     const operations = config.backend.operations;
+    const initiatorPhoneOperations = operations.filter(operation => operation.platformAccess?.directory?.mode === 'current-initiator' &&
+        operation.platformAccess.directory.fields.includes('phone'));
+    const initiatorPhoneCommands = (config.data.concurrency?.commands || []).filter((command) => command.execution?.directory?.mode === 'current-initiator' &&
+        command.execution.directory.fields.includes('phone'));
     const requiresDirectoryV2 = roles.some(role => role.capabilities.some((capability) => capability.endsWith(':directory:read'))) ||
         resources.some(resource => resource.schema.fields.some((field) => [
             'user.single',
@@ -299,12 +310,26 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
     const usesManagedFiles = operations.some(operation => operation.platformAccess?.managedFiles ||
         operation.platformAccess?.managedFileCopies) ||
         config.events.subscriptions.some((subscription) => subscription.platformAccess?.managedFileCopies);
-    const usesNotification = operations.some(operation => operation.platformAccess?.notification) ||
+    const usesNotification = config.workflows.definitions.some((item) => item.definition.rejectionNotification !== undefined) ||
+        operations.some(operation => operation.platformAccess?.notification) ||
         config.events.subscriptions.some((subscription) => subscription.platformAccess?.notification);
-    const taskManagedFileDefinitions = config.workflows.definitions.filter((item) => {
+    const hasTaskFile = (item, types, nestedOnly = false) => {
         const fields = resources.find(resource => resource.code === item.definition.subject?.resourceCode)?.schema.fields || [];
-        return Object.values(item.definition.taskPages || {}).some((page) => page.fields.some((field) => !field.readonly && fields.some((metadata) => metadata.code === field.code && ['file', 'image'].includes(metadata.type))));
-    });
+        return Object.values(item.definition.taskPages || {}).some((page) => page.fields.some((field) => {
+            if (field.readonly)
+                return false;
+            const metadata = fields.find((value) => value.code === field.code);
+            if (!nestedOnly && metadata && types.includes(metadata.type))
+                return true;
+            if (!field.subtable || !metadata?.subtable)
+                return false;
+            const children = resources.find(resource => resource.code === metadata.subtable.resourceCode)?.schema.fields || [];
+            return field.subtable.fields.some((child) => !child.readonly && children.some((value) => value.code === child.code && types.includes(value.type)));
+        }));
+    };
+    const taskManagedFileDefinitions = config.workflows.definitions.filter((item) => hasTaskFile(item, ['file', 'image', 'signature', 'text.rich']));
+    const taskRichFieldDefinitions = config.workflows.definitions.filter((item) => hasTaskFile(item, ['signature', 'text.rich']));
+    const taskOwnedFileDefinitions = config.workflows.definitions.filter((item) => hasTaskFile(item, ['file', 'image', 'signature', 'text.rich'], true));
     const standardProcessDefinitions = config.workflows.definitions.filter((declaration) => declaration.launch.mode === 'standalone' ||
         declaration.launch.mode === 'hidden-handoff');
     const usesBusinessProcess = operations.some(operation => operation.platformAccess?.workflow) ||
@@ -359,6 +384,12 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
                     declaration: resources.filter(resource => resource.decimalReservationLifecycle)
                         .map(resource => ({ code: resource.code, decimalReservationLifecycle: resource.decimalReservationLifecycle })) }]
             : []),
+        ...(operations.some(operation => operation.platformAccess?.dataCommands)
+            ? [{ code: 'data.business-commands', declaration: operations.filter(operation => operation.platformAccess?.dataCommands) }]
+            : []),
+        ...(operations.some(operation => operation.platformAccess?.recordEdit)
+            ? [{ code: 'data.record-edit', declaration: operations.filter(operation => operation.platformAccess?.recordEdit) }]
+            : []),
         ...(operations.some(operation => operation.platformAccess?.decimalReservation) ||
             config.events.subscriptions.some((subscription) => subscription.platformAccess?.decimalReservation)
             ? [{
@@ -403,6 +434,14 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
                 },
             ]
             : []),
+        ...(resources.some(resource => resource.recordComments !== undefined)
+            ? [{ code: 'data.record-comments', declaration: dataUsage }] : []),
+        ...(resources.some(resource => resource.recordDeletion !== undefined)
+            ? [{ code: 'data.workflow-record-deletion', declaration: dataUsage }] : []),
+        ...(resources.some(resource => resource.recordPrint !== undefined)
+            ? [{ code: 'data.record-print', declaration: dataUsage }] : []),
+        ...(resources.some(resource => resource.workflowHistory !== undefined)
+            ? [{ code: 'workflow.record-history-read', declaration: dataUsage }] : []),
         ...(resources.some(hasDataAuditReadPolicy)
             ? [{ code: 'data.audit-read-access', declaration: dataUsage }]
             : []),
@@ -435,6 +474,13 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
             ]
             : []),
         ...(operations.some(operation => operation.platformAccess?.directory?.mode === 'selected-user') ? [{ code: 'directory.selected-user', declaration: operations.filter(operation => operation.platformAccess?.directory?.mode === 'selected-user').map(operation => ({ code: operation.code, directory: operation.platformAccess.directory })) }] : []),
+        ...(initiatorPhoneOperations.length || initiatorPhoneCommands.length ? [{
+                code: 'directory.current-initiator-phone',
+                declaration: {
+                    operations: initiatorPhoneOperations.map(operation => ({ code: operation.code, directory: operation.platformAccess.directory })),
+                    commands: initiatorPhoneCommands.map((command) => ({ code: command.code, directory: command.execution.directory })),
+                },
+            }] : []),
         ...(usesManagedFiles
             ? [
                 {
@@ -477,6 +523,9 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
                 },
             ]
             : []),
+        ...(config.data.resources.some((resource) => resource.schema.fields.some((field) => field.userCandidates !== undefined))
+            ? [{ code: 'data.user-candidates', declaration: config.data.resources.filter((resource) => resource.schema.fields.some((field) => field.userCandidates !== undefined)) }]
+            : []),
         ...(config.workflows.activations.length
             ? [
                 {
@@ -495,12 +544,37 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
                     declaration: config.workflows.definitions.filter((item) => item.definition.instanceCommands !== undefined),
                 }]
             : []),
+        ...(config.workflows.definitions.some((item) => item.definition.instanceCommands?.withdraw?.reasonRequired === false)
+            ? [{ code: 'workflow.optional-withdrawal-reason',
+                    declaration: config.workflows.definitions.filter((item) => item.definition.instanceCommands?.withdraw?.reasonRequired === false) }]
+            : []),
+        ...(config.workflows.definitions.some((item) => item.definition.rejectionNotification !== undefined)
+            ? [{
+                    code: 'workflow.rejection-notification',
+                    declaration: config.workflows.definitions.filter((item) => item.definition.rejectionNotification !== undefined),
+                }]
+            : []),
+        ...(config.workflows.definitions.some((item) => item.definition.commandHandlers !== undefined) || operations.some(operation => operation.platformAccess?.workflow?.businessCommands)
+            ? [{ code: 'workflow.business-data-command', declaration: {
+                        definitions: config.workflows.definitions.filter((item) => item.definition.commandHandlers !== undefined),
+                        operations: operations.filter(operation => operation.platformAccess?.workflow?.businessCommands),
+                    } }] : []),
+        ...(config.workflows.definitions.some((item) => item.definition.launchPreflight !== undefined)
+            ? [{ code: 'workflow.launch-preflight', declaration: config.workflows.definitions.filter((item) => item.definition.launchPreflight !== undefined) }] : []),
+        ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.operationPolicy?.reject?.commentRequired === false))
+            ? [{ code: 'workflow.optional-rejection-comment', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.operationPolicy?.reject?.commentRequired === false)) }] : []),
         ...(namedInputSourceDefinitions.length
             ? [{ code: 'workflow.named-input-sources', declaration: namedInputSourceDefinitions }]
             : []),
         ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.administration !== undefined || node.operationPolicy !== undefined))
             ? [{ code: 'workflow.node-administration', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.administration !== undefined || node.operationPolicy !== undefined)) }]
             : []),
+        ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'approval' && node.emptyPolicy !== undefined))
+            ? [{ code: 'workflow.approval-empty-policy', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'approval' && node.emptyPolicy !== undefined)) }]
+            : []),
+        ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.initiatorApprovalPolicy !== undefined))
+            ? [{ code: 'workflow.initiator-approval-policy', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.initiatorApprovalPolicy !== undefined)) }]
+            : []),
         ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'cc'))
             ? [{ code: 'workflow.automatic-cc', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'cc')) }]
             : []),
@@ -509,6 +583,12 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
             : []),
         ...(taskManagedFileDefinitions.length
             ? [{ code: 'workflow.task-managed-files', declaration: taskManagedFileDefinitions }] : []),
+        ...(taskOwnedFileDefinitions.length
+            ? [{ code: 'workflow.task-owned-files', declaration: taskOwnedFileDefinitions }] : []),
+        ...(taskRichFieldDefinitions.length
+            ? [{ code: 'workflow.task-rich-fields', declaration: taskRichFieldDefinitions }] : []),
+        ...(config.workflows.definitions.some((item) => Object.values(item.definition.taskPages || {}).some((page) => page.fields.some((field) => field.subtable)))
+            ? [{ code: 'workflow.task-owned-subtables', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.taskPages || {}).some((page) => page.fields.some((field) => field.subtable))) }] : []),
         ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'action'))
             ? [{ code: 'workflow.durable-business-step', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'action')) }]
             : []),
@@ -537,6 +617,8 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
                 {
                     code: 'notification-hub-v2',
                     declaration: {
+                        ...(config.workflows.definitions.some((item) => item.definition.rejectionNotification !== undefined)
+                            ? { rejectionNotifications: config.workflows.definitions.filter((item) => item.definition.rejectionNotification !== undefined) } : {}),
                         operations: operations
                             .filter(operation => operation.platformAccess?.notification)
                             .map(operation => ({
@@ -573,7 +655,9 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
     return usages
         .map(({ code, declaration }) => ({
         code,
-        contractVersion: OPENXIANGDA_V2_PLATFORM_CAPABILITY_CONTRACT_VERSIONS[code],
+        contractVersion: code === 'data.unique-keys'
+            ? (resources.some(resource => nativeUniqueKeysContractVersion(resource.schema.fields, resource.uniqueKeys) === '1.1.0') ? '1.1.0' : '1.0.0')
+            : OPENXIANGDA_V2_PLATFORM_CAPABILITY_CONTRACT_VERSIONS[code],
         usageDigest: `sha256:${sha256Canonical(declaration)}`,
     }))
         .sort((left, right) => left.code === right.code ? 0 : left.code < right.code ? -1 : 1);
@@ -988,7 +1072,7 @@ function compileExpectedContract(config, configDigest, generatorVersion) {
             field: trigger.field,
         })),
         ...(config.workflows.activations.length
-            ? WORKFLOW_EVENT_TYPES_V2.filter(eventType => !WORKFLOW_BUSINESS_STEP_EVENTS.includes(eventType) || config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'action'))).map(eventType => ({
+            ? WORKFLOW_EVENT_TYPES_V2.filter(eventType => !WORKFLOW_BUSINESS_STEP_EVENTS.includes(eventType) || config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'action'))).filter(eventType => eventType !== 'openxiangda.workflow.node.skipped.v2' || config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'approval' && node.emptyPolicy === 'skip'))).map(eventType => ({
                 code: `workflow:${eventType}`,
                 source: 'workflow',
                 eventType,
@@ -1193,9 +1277,12 @@ function compileCapabilities(config) {
         };
         catalog.set(code, capability);
     }
-    for (const [resourceIndex, raw] of config.data.resources.entries()) {
-        const pointer = `/config/data/resources/${resourceIndex}`;
-        const resource = validateResource(raw, pointer, config.appCode);
+    const resources = config.data.resources.map((raw, resourceIndex) => ({
+        pointer: `/config/data/resources/${resourceIndex}`,
+        resource: validateResource(raw, `/config/data/resources/${resourceIndex}`, config.appCode),
+    }));
+    // CRUD definitions precede all field references, regardless of source order.
+    for (const { pointer, resource } of resources) {
         const operationNames = {
             read: `读取${resource.name}`,
             create: `新建${resource.name}`,
@@ -1214,6 +1301,10 @@ function compileCapabilities(config) {
                 source: 'data',
             });
         }
+    }
+    const definedCapabilities = new Set(catalog.keys());
+    const fieldOwners = new Map();
+    for (const { pointer, resource } of resources) {
         for (const [fieldCode, rawPolicy] of Object.entries(resource.fieldPolicies)) {
             if (isDataAuditMetadataField(fieldCode))
                 continue;
@@ -1223,6 +1314,13 @@ function compileCapabilities(config) {
                     continue;
                 for (const code of uniqueStrings(policy[operation], `${pointer}/fieldPolicies/${fieldCode}/${operation}`, 2000)) {
                     capabilityCode(code, `${pointer}/fieldPolicies/${fieldCode}/${operation}`, config.appCode);
+                    if (definedCapabilities.has(code))
+                        continue;
+                    const existingOwner = fieldOwners.get(code);
+                    if (existingOwner && existingOwner !== resource.code) {
+                        fail('NATIVE_CAPABILITY_DUPLICATE', `${pointer}/fieldPolicies/${fieldCode}/${operation}`);
+                    }
+                    fieldOwners.set(code, resource.code);
                     if (catalog.has(code))
                         continue;
                     catalog.set(code, {
@@ -1511,6 +1609,15 @@ function compileOperations(config) {
         const code = stableCode(operation.code, `${pointer}/code`);
         validateBackendOperationAi(operation.ai, pointer, code, method, declaredResourceCodes);
         const platformAccess = validateOperationPlatformAccess(operation.platformAccess, `${pointer}/platformAccess`, declaredResources, declaredResourceFields, declaredWorkflowCodes, new Set(config.authz.roles.map((role) => String(role.code))));
+        if (platformAccess?.recordEdit) {
+            const owner = config.data.resources.find((item) => item.code === platformAccess.recordEdit.resourceCode);
+            if (owner?.surface?.mutationOwner !== 'action')
+                fail('NATIVE_RECORD_EDIT_ACTION_OWNER_REQUIRED', `${pointer}/platformAccess/recordEdit`);
+            for (const fieldCode of platformAccess.recordEdit.fieldCodes) {
+                if (!owner.fieldPolicies?.[fieldCode]?.update?.length || owner.surface?.fields?.[fieldCode]?.system === true)
+                    fail('NATIVE_RECORD_EDIT_FIELD_INVALID', `${pointer}/platformAccess/recordEdit/fieldCodes`);
+            }
+        }
         if (platformAccess?.decimalReservation) {
             const reservation = platformAccess.decimalReservation;
             const resourceCode = String(reservation.resourceCode);
@@ -1707,11 +1814,33 @@ function validateOperationPlatformAccess(value, pointer, declaredResources, decl
     if (value === undefined)
         return null;
     const access = object(value, pointer);
-    exactKeys(access, ['directory', 'managedFiles', 'managedFileCopies', 'notification', 'workflow', 'roleAssertions', 'decimalReservation'], pointer, true);
+    exactKeys(access, ['directory', 'managedFiles', 'managedFileCopies', 'notification', 'workflow', 'roleAssertions', 'decimalReservation', 'dataCommands', 'recordEdit'], pointer, true);
     if (Object.keys(access).length === 0) {
         fail('NATIVE_OPERATION_PLATFORM_ACCESS_EMPTY', pointer);
     }
     const result = {};
+    if (access.dataCommands !== undefined) {
+        const commands = object(access.dataCommands, `${pointer}/dataCommands`);
+        exactKeys(commands, ['mode'], `${pointer}/dataCommands`);
+        equal(commands.mode, 'recoverable-native', `${pointer}/dataCommands/mode`);
+        result.dataCommands = { mode: 'recoverable-native' };
+    }
+    if (access.recordEdit !== undefined) {
+        const entryPointer = `${pointer}/recordEdit`;
+        const entry = object(access.recordEdit, entryPointer);
+        exactKeys(entry, ['resourceCode', 'fieldCodes'], entryPointer);
+        const code = resourceCode(entry.resourceCode, `${entryPointer}/resourceCode`);
+        const fields = declaredResourceFields.get(code);
+        const fieldCodes = uniqueStrings(entry.fieldCodes, `${entryPointer}/fieldCodes`, 200);
+        if (!fields || !fieldCodes.length || !result.dataCommands)
+            fail('NATIVE_RECORD_EDIT_DECLARATION_INVALID', entryPointer);
+        for (const fieldCode of fieldCodes) {
+            const field = fields.get(fieldCode);
+            if (!field || field.type === 'serial-number' || field.type === 'subtable')
+                fail('NATIVE_RECORD_EDIT_FIELD_INVALID', `${entryPointer}/fieldCodes`);
+        }
+        result.recordEdit = { resourceCode: code, fieldCodes: uniqueSorted(fieldCodes) };
+    }
     if (access.roleAssertions !== undefined) {
         const assertions = object(access.roleAssertions, `${pointer}/roleAssertions`);
         exactKeys(assertions, ['roleCodes'], `${pointer}/roleAssertions`);
@@ -1735,8 +1864,9 @@ function validateOperationPlatformAccess(value, pointer, declaredResources, decl
             'employeeNumber',
             'primaryDepartment',
             'departments',
+            ...(directory.mode === 'current-initiator' ? ['phone'] : []),
         ]);
-        const fields = uniqueStrings(directory.fields, `${pointer}/directory/fields`, 4);
+        const fields = uniqueStrings(directory.fields, `${pointer}/directory/fields`, allowed.size);
         if (!fields.length || fields.some(field => !allowed.has(field))) {
             fail('NATIVE_OPERATION_DIRECTORY_FIELDS_INVALID', `${pointer}/directory/fields`);
         }
@@ -1829,12 +1959,16 @@ function validateOperationPlatformAccess(value, pointer, declaredResources, decl
     }
     if (access.workflow !== undefined) {
         const workflow = object(access.workflow, `${pointer}/workflow`);
-        exactKeys(workflow, ['codes'], `${pointer}/workflow`);
+        exactKeys(workflow, ['codes'], `${pointer}/workflow`, ['businessCommands']);
         const codes = uniqueStrings(workflow.codes, `${pointer}/workflow/codes`, 16);
         if (!codes.length || codes.some(code => !declaredWorkflowCodes.has(code))) {
             fail('NATIVE_OPERATION_WORKFLOW_CODE_INVALID', `${pointer}/workflow/codes`);
         }
-        result.workflow = { codes: uniqueSorted(codes) };
+        const businessCommands = workflow.businessCommands === undefined ? undefined : uniqueStrings(workflow.businessCommands, `${pointer}/workflow/businessCommands`, 3);
+        if (businessCommands && (!businessCommands.length || businessCommands.some(command => !['approve', 'reject', 'withdraw'].includes(command)))) {
+            fail('NATIVE_OPERATION_WORKFLOW_BUSINESS_COMMAND_INVALID', `${pointer}/workflow/businessCommands`);
+        }
+        result.workflow = { codes: uniqueSorted(codes), ...(businessCommands ? { businessCommands: uniqueSorted(businessCommands) } : {}) };
     }
     if (access.decimalReservation !== undefined) {
         const reservationPointer = `${pointer}/decimalReservation`;
@@ -3596,6 +3730,40 @@ function validateAuthorizationReferences(config, capabilities) {
     config.data.resources.forEach((rawResource, index) => {
         const resourcePointer = `/config/data/resources/${index}`;
         const resource = object(rawResource, resourcePointer);
+        if (resource.recordDeletion !== undefined) {
+            const pointer = `${resourcePointer}/recordDeletion/delete`;
+            for (const capability of resource.recordDeletion.delete) {
+                capabilityCode(capability, pointer, config.appCode);
+                if (!capabilityCodes.has(capability))
+                    fail('NATIVE_CAPABILITY_REFERENCE_MISSING', pointer);
+            }
+        }
+        if (resource.recordComments !== undefined) {
+            for (const mode of ['read', 'create']) {
+                const pointer = `${resourcePointer}/recordComments/${mode}`;
+                for (const capability of resource.recordComments[mode]) {
+                    capabilityCode(capability, pointer, config.appCode);
+                    if (!capabilityCodes.has(capability))
+                        fail('NATIVE_CAPABILITY_REFERENCE_MISSING', pointer);
+                }
+            }
+        }
+        if (resource.recordPrint !== undefined) {
+            const pointer = `${resourcePointer}/recordPrint/read`;
+            for (const capability of resource.recordPrint.read) {
+                capabilityCode(capability, pointer, config.appCode);
+                if (!capabilityCodes.has(capability))
+                    fail('NATIVE_CAPABILITY_REFERENCE_MISSING', pointer);
+            }
+        }
+        if (resource.workflowHistory !== undefined) {
+            const pointer = `${resourcePointer}/workflowHistory/read`;
+            for (const capability of resource.workflowHistory.read) {
+                capabilityCode(capability, pointer, config.appCode);
+                if (!capabilityCodes.has(capability))
+                    fail('NATIVE_CAPABILITY_REFERENCE_MISSING', pointer);
+            }
+        }
         for (const [fieldCode, rawPolicy] of Object.entries(resource.fieldPolicies || {})) {
             if (!isDataAuditMetadataField(fieldCode))
                 continue;
@@ -3614,6 +3782,9 @@ function validateAuthorizationReferences(config, capabilities) {
             return;
         const resourceCapabilities = object(resource.capabilities, `${resourcePointer}/capabilities`);
         for (const operation of ['create', 'update', 'delete']) {
+            if (operation === 'delete' && Array.isArray(resource.recordDeletion?.delete) &&
+                resource.recordDeletion.delete.length > 0)
+                continue;
             forbiddenNativeMutationCapabilities.set(String(resourceCapabilities[operation]), operation);
         }
     });
@@ -4082,9 +4253,10 @@ function validateDataPolicyReferences(config) {
 function validateDataFieldReferences(config) {
     try {
         validateNativeDataResourceReferencesV2(config.data.resources, '/config/data/resources');
+        config.data.resources.forEach((resource, index) => validateUserCandidateReferences(resource.schema.fields, new Set(config.authz.roles.map((role) => role.code)), new Set(config.authz.scopeDimensions.map((dimension) => dimension.code)), `/config/data/resources/${index}/schema/fields`));
     }
     catch (error) {
-        if (error instanceof NativeDataFieldContractV2Error) {
+        if (error instanceof NativeDataFieldContractV2Error || error instanceof UserCandidateContractError) {
             fail(error.code, error.pointer);
         }
         throw error;
@@ -4307,9 +4479,15 @@ function validateWorkflowReferences(config) {
         }
         definitions.add(key);
         validateWorkflowDefinition(definition, `${pointer}/definition`);
+        const preflightErrors = validateWorkflowLaunchPreflight(definition);
+        if (preflightErrors.length)
+            fail(preflightErrors[0], `${pointer}/definition/launchPreflight`);
+        const businessCommandErrors = validateWorkflowCommandHandlers(definition, config.backend.operations);
+        if (businessCommandErrors.length)
+            fail(businessCommandErrors[0], `${pointer}/definition/commandHandlers`);
         validateWorkflowSubject(definition.subject, resources, `${pointer}/definition/subject`);
         const taskPageErrors = validateWorkflowTaskPages(definition, new Map((resources.get(definition.subject.resourceCode)?.schema.fields || [])
-            .map((field) => [field.code, { ...resources.get(definition.subject.resourceCode)?.surface?.fields?.[field.code], ...field, system: ['id', 'revision', 'createdAt', 'updatedAt', 'createdBy', 'updatedBy'].includes(field.code) }])));
+            .map((field) => [field.code, { ...resources.get(definition.subject.resourceCode)?.surface?.fields?.[field.code], ...field, system: ['id', 'revision', 'createdAt', 'updatedAt', 'createdBy', 'updatedBy'].includes(field.code) }])), new Map([...resources].map(([code, resource]) => [code, new Map(resource.schema.fields.map((field) => [field.code, { ...resource.surface?.fields?.[field.code], ...field, system: ['id', 'revision', 'createdAt', 'updatedAt', 'createdBy', 'updatedBy'].includes(field.code) }]))])));
         if (taskPageErrors.length)
             fail(taskPageErrors[0], `${pointer}/definition/taskPages`);
         const policyErrors = validateWorkflowInstanceCommandPolicies(definition, {
@@ -4366,6 +4544,9 @@ function validateWorkflowReferences(config) {
         }
         const definition = definitionValues.get(definitionKey);
         const binding = bindingValues.get(bindingKey);
+        const preflightErrors = validateWorkflowLaunchPreflight(definition, binding);
+        if (preflightErrors.length)
+            fail(preflightErrors[0], pointer);
         const administrationErrors = validateWorkflowAdministration(definition, binding);
         if (administrationErrors.length)
             fail(administrationErrors[0], pointer);
@@ -4375,6 +4556,15 @@ function validateWorkflowReferences(config) {
             fail('NATIVE_WORKFLOW_COMMAND_DEACTIVATION_POLICY_MISMATCH', `${pointer}/acceptedCommandDeactivationPolicy`);
         }
         validateWorkflowDefinitionBinding(definition, binding, `/config/workflows/activations/${index}`);
+        try {
+            const fields = resources.get(definition.subject.resourceCode)?.schema.fields || [];
+            validateWorkflowUserCandidateBindings(definition, binding, new Map(fields.map((field) => [field.code, field])), `${pointer}/bindings`, new Map([...resources].map(([code, resource]) => [code, new Map(resource.schema.fields.map((field) => [field.code, field]))])));
+        }
+        catch (error) {
+            if (error instanceof UserCandidateContractError)
+                fail(error.code, error.pointer);
+            throw error;
+        }
         activeBindings.set(code, binding);
     }
     const routingErrors = validateWorkflowAssignmentRoutingBindings([...activeBindings.values()]);
@@ -4533,7 +4723,7 @@ function validateWorkflowDefinition(definition, pointer) {
         'startAt',
         'inputSchema',
         'nodes',
-    ], pointer, ['organizationContext', 'instanceCommands', 'readability', 'taskPages']);
+    ], pointer, ['organizationContext', 'instanceCommands', 'readability', 'taskPages', 'rejectionNotification', 'commandHandlers', 'launchPreflight']);
     equal(definition.schemaVersion, 'openxiangda.workflow-definition/v2', `${pointer}/schemaVersion`);
     workflowCodeValue(definition.code, `${pointer}/code`);
     requiredString(definition.title, `${pointer}/title`, 255);
@@ -4552,6 +4742,15 @@ function validateWorkflowDefinition(definition, pointer) {
     const administrationErrors = validateWorkflowAdministration(definition);
     if (administrationErrors.length)
         fail(administrationErrors[0], `${pointer}/nodes`);
+    const emptyPolicyErrors = validateWorkflowApprovalEmptyPolicy(definition);
+    if (emptyPolicyErrors.length)
+        fail(emptyPolicyErrors[0], `${pointer}/nodes`);
+    const initiatorPolicyErrors = validateWorkflowInitiatorApprovalPolicy(definition);
+    if (initiatorPolicyErrors.length)
+        fail(initiatorPolicyErrors[0], `${pointer}/nodes`);
+    const rejectionNotificationErrors = validateWorkflowRejectionNotification(definition);
+    if (rejectionNotificationErrors.length)
+        fail(rejectionNotificationErrors[0], `${pointer}/rejectionNotification`);
     const ccErrors = validateWorkflowAutomaticCc(definition);
     if (ccErrors.length)
         fail(ccErrors[0], `${pointer}/nodes`);
@@ -4696,10 +4895,10 @@ function validateWorkflowBinding(binding, pointer) {
         ].includes(provider)) {
             fail('NATIVE_WORKFLOW_BINDING_PROVIDER_INVALID', `${pointer}/bindings/${code}/provider`);
         }
-        if (provider === 'fixed_users' &&
-            boundedArray(entry.users, `${pointer}/bindings/${code}/users`, 200)
-                .length === 0) {
-            fail('NATIVE_WORKFLOW_BINDING_USERS_REQUIRED', `${pointer}/bindings/${code}/users`);
+        if (provider === 'fixed_users') {
+            if (!Array.isArray(entry.users))
+                fail('NATIVE_WORKFLOW_BINDING_USERS_REQUIRED', `${pointer}/bindings/${code}/users`);
+            boundedArray(entry.users, `${pointer}/bindings/${code}/users`, 200);
         }
         if (['input_users', 'form_field_users'].includes(provider)) {
             requiredString(entry.inputPath, `${pointer}/bindings/${code}/inputPath`, 255);
@@ -4723,6 +4922,13 @@ function validateWorkflowBinding(binding, pointer) {
 function validateWorkflowDefinitionBinding(definition, binding, pointer) {
     equal(binding.workflowCode, definition.code, `${pointer}/workflowCode`);
     const entries = object(binding.bindings, `${pointer}/bindings`);
+    for (const [code, entry] of Object.entries(entries)) {
+        if (entry.provider === 'fixed_users' && !entry.users.length && !workflowBindingAllowsEmptyUsers(definition, code))
+            fail('NATIVE_WORKFLOW_BINDING_USERS_REQUIRED', `${pointer}/bindings/${code}/users`);
+    }
+    const emptyPolicyErrors = validateWorkflowApprovalEmptyPolicy(definition, binding);
+    if (emptyPolicyErrors.length)
+        fail(emptyPolicyErrors[0], pointer);
     const ccErrors = validateWorkflowAutomaticCc(definition, binding);
     if (ccErrors.length)
         fail(ccErrors[0], pointer);
@@ -4817,6 +5023,10 @@ function validateResource(raw, pointer, appCode) {
         'invariants',
         'decimalReservationLifecycle',
         'uniqueKeys',
+        'workflowHistory',
+        'recordPrint',
+        'recordComments',
+        'recordDeletion',
         'capabilities',
         'dataPolicyCode',
         'fieldPolicies',
@@ -4839,11 +5049,45 @@ function validateResource(raw, pointer, appCode) {
         validateNativeDataResourceSurfaceV2(resource.surface, fields, `${pointer}/surface`);
     }
     catch (error) {
-        if (error instanceof NativeDataFieldContractV2Error || error instanceof NativeDecimalLifecycleContractError || error instanceof NativeUniqueKeyContractError) {
+        if (error instanceof NativeDataFieldContractV2Error || error instanceof UserCandidateContractError || error instanceof NativeDecimalLifecycleContractError || error instanceof NativeUniqueKeyContractError) {
             fail(error.code, error.pointer);
         }
         throw error;
     }
+    if (resource.recordComments !== undefined) {
+        const policy = object(resource.recordComments, `${pointer}/recordComments`);
+        exactKeys(policy, ['read', 'create'], `${pointer}/recordComments`);
+        for (const mode of ['read', 'create']) {
+            const list = policy[mode];
+            if (!Array.isArray(list) || list.length > 20 ||
+                list.some(value => typeof value !== 'string' || !value.trim()) || new Set(list).size !== list.length)
+                fail('NATIVE_RECORD_COMMENTS_POLICY_INVALID', `${pointer}/recordComments/${mode}`);
+        }
+    }
+    if (resource.recordDeletion !== undefined) {
+        const policy = object(resource.recordDeletion, `${pointer}/recordDeletion`);
+        exactKeys(policy, ['delete'], `${pointer}/recordDeletion`);
+        const remove = policy.delete;
+        if (!Array.isArray(remove) || remove.length > 20 ||
+            remove.some(value => typeof value !== 'string' || !value.trim()) || new Set(remove).size !== remove.length)
+            fail('NATIVE_RECORD_DELETION_DELETE_INVALID', `${pointer}/recordDeletion/delete`);
+    }
+    if (resource.recordPrint !== undefined) {
+        const policy = object(resource.recordPrint, `${pointer}/recordPrint`);
+        exactKeys(policy, ['read'], `${pointer}/recordPrint`);
+        const read = policy.read;
+        if (!Array.isArray(read) || read.length > 20 ||
+            read.some(value => typeof value !== 'string' || !value.trim()) || new Set(read).size !== read.length)
+            fail('NATIVE_RECORD_PRINT_READ_INVALID', `${pointer}/recordPrint/read`);
+    }
+    if (resource.workflowHistory !== undefined) {
+        const policy = object(resource.workflowHistory, `${pointer}/workflowHistory`);
+        exactKeys(policy, ['read'], `${pointer}/workflowHistory`);
+        const read = policy.read;
+        if (!Array.isArray(read) || read.length > 20 ||
+            read.some(value => typeof value !== 'string' || !value.trim()) || new Set(read).size !== read.length)
+            fail('NATIVE_WORKFLOW_HISTORY_READ_INVALID', `${pointer}/workflowHistory/read`);
+    }
     const fieldCodes = new Set(fields.map(field => field.code));
     const capabilities = object(resource.capabilities, `${pointer}/capabilities`);
     exactKeys(capabilities, ['read', 'create', 'update', 'delete'], `${pointer}/capabilities`);