openxiangda-contracts 2.47.0 → 2.69.1

package/dist/native-compiler/compiler.js

@@ -1,4 +1,7 @@
-import { NativeUniqueKeyContractError, parseNativeUniqueKeys } from './unique-keys.js';
+import { assertWorkflowNativeStagePolicy } from './workflow-native-stage.js';
+import { validateAuthenticatedPublicRead, AuthenticatedPublicReadContractError } from './authenticated-public-read.js';
+import { validateUserCandidateReferences, validateWorkflowUserCandidateBindings, UserCandidateContractError, requiresUserCandidateLaunchScope } from './user-candidates.js';
+import { NativeUniqueKeyContractError, parseNativeUniqueKeys, nativeUniqueKeysContractVersion } from './unique-keys.js';
 import { validateManagedConcurrency, ManagedConcurrencyContractError } from './managed-concurrency.js';
 import { normalizeDecimalReservationEventDeclaration, decimalReservationEventContext } from './decimal-reservation.js';
 import { NativeDecimalLifecycleContractError, parseDecimalReservationLifecycle, validateDecimalReservationLifecycles } from './decimal-lifecycle.js';
@@ -9,13 +12,25 @@ import { validateWorkflowInstanceCommandPolicies } from './workflow-instance-pol
 import { validateWorkflowReadability } from './workflow-graph.js';
 import { validateWorkflowAdministration } from './workflow-node-administration.js';
 import { validateWorkflowAutomaticCc } from './workflow-automatic-cc.js';
+import { validateWorkflowApprovalEmptyPolicy, workflowBindingAllowsEmptyUsers } from './workflow-approval-empty.js';
+import { validateWorkflowInitiatorApprovalPolicy } from './workflow-initiator-approval.js';
+import { validateWorkflowCompletionDeadlines } from './workflow-completion-deadline.js';
+import { validateWorkflowRejectionNotification } from './workflow-rejection-notification.js';
+import { validateWorkflowCommandHandlers } from './workflow-business-command.js';
+import { validateWorkflowLaunchPreflight } from './workflow-launch-preflight.js';
+import { validateWorkflowApprovedDelegation } from './workflow-approved-delegation.js';
+import { validateWorkflowCorrections } from './workflow-correction.js';
+import { dateEventProjectionFieldsV2 } from './date-event-projection.js';
 import { validateWorkflowTaskPages } from './workflow-task-page.js';
+import { requiresExtendedOwnedSubtableCapacity } from './data-capacity.js';
 import { validateWorkflowBusinessSteps, compileWorkflowBusinessStepHandlers, validateWorkflowBusinessStepSubscriptions, WORKFLOW_BUSINESS_STEP_EVENT, WORKFLOW_BUSINESS_STEP_EVENTS } from './workflow-business-step.js';
 import { validateWorkflowAssignmentRoutingBindings, validateWorkflowAssignmentRoutingPolicy } from './workflow-assignment-routing.js';
+import { requiresWorkflowRoleUnion, validateWorkflowRoleUnion } from './workflow-role-union.js';
+import { assertWorkflowOwnedSubjectCreate, assertWorkflowOwnedSubjectCreateResources } from './workflow-owned-subject.js';
 import * as crypto from 'crypto';
 import { OPENXIANGDA_COMPILER_CONTRACT_VERSION as OPENXIANGDA_V2_COMPILER_CONTRACT_VERSION, PLATFORM_CAPABILITY_CONTRACT_VERSIONS as OPENXIANGDA_V2_PLATFORM_CAPABILITY_CONTRACT_VERSIONS, } from '../native-version.js';
 import { canonicalJson, sha256Digest as sha256Canonical } from '../canonical.js';
-import { NativeDataFieldContractV2Error, nativeFieldRequiresCreateInputV2, parseNativeDataFieldsV2, parseNativeDataResourceInvariantsV2, validateNativeDataResourceReferencesV2, } from './data-field.js';
+import { NativeDataFieldContractV2Error, nativeFieldRequiresCreateInputV2, requiresDateTimeMinutePrecision, requiresOwnedSubtableMinimumRows, parseNativeDataFieldsV2, parseNativeDataResourceInvariantsV2, validateNativeDataResourceReferencesV2, } from './data-field.js';
 import { validateNativeDataResourceSurfaceV2 } from './data-surface.js';
 import { nativeFieldSupportsSortV2 } from './field-query-plan.js';
 import { nativeScopeSourceGrantPathSupportedV2, nativeScopeSourceSubjectPathSupportedV2, resolveNativeScopeSourceFieldPathV2, } from './scope-source-field-path.js';
@@ -86,11 +101,10 @@ const WORKFLOW_OPERATIONS = new Set([
     'admin_override',
     'retry_resolution',
 ]);
-const MAX_CONFIG_BYTES = 4 * 1024 * 1024;
-const MAX_CONTRACT_BYTES = 8 * 1024 * 1024;
-const MAX_DEPTH = 40;
-const MAX_NODES = 100000;
-const MAX_STRING_BYTES = 1024 * 1024;
+const MAX_CONFIG_BYTES = NATIVE_ARTIFACT_CAPACITY_V2.configBytes;
+const MAX_CONTRACT_BYTES = NATIVE_ARTIFACT_CAPACITY_V2.contractBytes;
+const MAX_DEPTH = NATIVE_ARTIFACT_CAPACITY_V2.depth;
+const MAX_STRING_BYTES = NATIVE_ARTIFACT_CAPACITY_V2.stringBytes;
 const EVENT_HANDLER_MANIFEST_SCHEMA = 'openxiangda.event-handler-manifest/v2';
 const ROUTE_MANIFEST_SCHEMA = 'openxiangda.application-route-manifest/v3';
 const EVENT_CAPTURE_FIELD_LIMIT = 64;
@@ -102,28 +116,17 @@ const EVENT_AUTHORIZATION_SYSTEM_FIELDS = new Set([
     'created_at',
     'updated_at',
 ]);
-export const NATIVE_CONTRACT_CAPACITY_V2 = Object.freeze({
-    perspectives: 100,
-    resources: 100,
-    subjectReadSurfaces: 50,
-    capabilities: 2000,
-    operations: 500,
-    eventConsumers: 100,
-    eventProducers: 1000,
-    eventSchemas: 100,
-    eventTypes: 500,
-    workflows: 100,
-    routes: 500,
-    adminPages: 500,
-    adminNavigationGroups: 100,
-    adminNavigationItems: 500,
-});
+export { NATIVE_CONTRACT_CAPACITY_V2, requiresExtendedDeclarationCapacity, generatedCrudCapabilityOperations } from './declaration-capacity.js';
+import { NATIVE_CONTRACT_CAPACITY_V2, requiresExtendedDeclarationCapacity } from './declaration-capacity.js';
+export { NATIVE_ARTIFACT_CAPACITY_V2, requiresExtendedArtifactCapacity } from './artifact-capacity.js';
+import { NATIVE_ARTIFACT_CAPACITY_V2, requiresExtendedArtifactCapacity } from './artifact-capacity.js';
 export const DATA_EVENT_TYPES_V2 = [
     'openxiangda.data.record.created.v2',
     'openxiangda.data.record.updated.v2',
     'openxiangda.data.record.deleted.v2',
 ];
 export const WORKFLOW_EVENT_TYPES_V2 = [
+    'openxiangda.workflow.node.skipped.v2',
     WORKFLOW_BUSINESS_STEP_EVENT,
     'openxiangda.workflow.step.result_received.v2',
     'openxiangda.workflow.step.completed.v2',
@@ -190,8 +193,13 @@ export function compileNativeApplicationConfiguration(input) {
     verifyArtifactDigest(contractSource, expectedContractDigest, '/contractBytes', 'NATIVE_CONTRACT_DIGEST_MISMATCH');
     const parsedConfig = parseCanonicalArtifact(configSource, '/configBytes', 'NATIVE_CONFIG_JSON_INVALID', 'NATIVE_CONFIG_NOT_CANONICAL');
     const parsedContract = parseCanonicalArtifact(contractSource, '/contractBytes', 'NATIVE_CONTRACT_JSON_INVALID', 'NATIVE_CONTRACT_NOT_CANONICAL');
-    inspectJsonBudget(parsedConfig, '/config');
-    inspectJsonBudget(parsedContract, '/contracts');
+    // First enforce all global safety bounds before deriving an extension from
+    // untrusted input. The sealed configuration alone selects the larger budget.
+    inspectJsonBudget(parsedConfig, '/config', NATIVE_ARTIFACT_CAPACITY_V2.extendedNodes);
+    inspectJsonBudget(parsedContract, '/contracts', NATIVE_ARTIFACT_CAPACITY_V2.extendedNodes);
+    if (!requiresExtendedArtifactCapacity(parsedConfig)) {
+        inspectJsonBudget(parsedContract, '/contracts', NATIVE_ARTIFACT_CAPACITY_V2.legacyNodes);
+    }
     const config = parsedConfig;
     const contract = parsedContract;
     validateConfigurationEnvelope(config, appCode);
@@ -280,10 +288,20 @@ export function compileNativeApplicationConfiguration(input) {
  * Derives the platform capability usage closure from the normalized, sealed
  * ConfigurationBundleV3. Manifest declarations are deliberately not an input.
  */
+function workflowUsesOwnedInitialFacts(definition, resources) {
+    const subject = definition.subject;
+    const resource = resources.find(value => value.code === subject?.resourceCode);
+    const projected = new Set(Object.values(subject?.factProjection || {}));
+    return Boolean(resource?.schema?.fields?.some((field) => field.type === 'subtable' && projected.has(field.code)));
+}
 export function compileRequiredPlatformCapabilitiesV3(config) {
     const roles = config.authz.roles;
     const resources = config.data.resources;
     const operations = config.backend.operations;
+    const initiatorPhoneOperations = operations.filter(operation => operation.platformAccess?.directory?.mode === 'current-initiator' &&
+        operation.platformAccess.directory.fields.includes('phone'));
+    const initiatorPhoneCommands = (config.data.concurrency?.commands || []).filter((command) => command.execution?.directory?.mode === 'current-initiator' &&
+        command.execution.directory.fields.includes('phone'));
     const requiresDirectoryV2 = roles.some(role => role.capabilities.some((capability) => capability.endsWith(':directory:read'))) ||
         resources.some(resource => resource.schema.fields.some((field) => [
             'user.single',
@@ -299,7 +317,8 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
     const usesManagedFiles = operations.some(operation => operation.platformAccess?.managedFiles ||
         operation.platformAccess?.managedFileCopies) ||
         config.events.subscriptions.some((subscription) => subscription.platformAccess?.managedFileCopies);
-    const usesNotification = operations.some(operation => operation.platformAccess?.notification) ||
+    const usesNotification = config.workflows.definitions.some((item) => item.definition.rejectionNotification !== undefined) ||
+        operations.some(operation => operation.platformAccess?.notification) ||
         config.events.subscriptions.some((subscription) => subscription.platformAccess?.notification);
     const hasTaskFile = (item, types, nestedOnly = false) => {
         const fields = resources.find(resource => resource.code === item.definition.subject?.resourceCode)?.schema.fields || [];
@@ -362,6 +381,17 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
         },
     };
     const usages = [
+        ...(requiresExtendedArtifactCapacity(config)
+            ? [{ code: 'application.extended-artifact-capacity',
+                    declaration: NATIVE_ARTIFACT_CAPACITY_V2 }] : []),
+        ...(requiresExtendedDeclarationCapacity(config)
+            ? [{ code: 'application.extended-declaration-capacity', declaration: {
+                        resources: config.data.resources.length, policies: config.authz.dataPolicies.length,
+                        roles: config.authz.roles.length, capabilities: config.authz.capabilities.length,
+                        definitions: config.workflows.definitions.length, bindings: config.workflows.bindings.length,
+                        activations: config.workflows.activations.length, routes: config.frontend.routes.length,
+                        navigationItems: config.frontend.admin.navigation.reduce((count, group) => count + group.items.length, 0),
+                    } }] : []),
         ...(resources.some(resource => resource.uniqueKeys?.length)
             ? [{ code: 'data.unique-keys', declaration: resources.filter(resource => resource.uniqueKeys?.length)
                         .map(resource => ({ code: resource.code, uniqueKeys: resource.uniqueKeys })) }] : []),
@@ -372,6 +402,23 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
                     declaration: resources.filter(resource => resource.decimalReservationLifecycle)
                         .map(resource => ({ code: resource.code, decimalReservationLifecycle: resource.decimalReservationLifecycle })) }]
             : []),
+        ...(operations.some(operation => operation.platformAccess?.dataCommands)
+            ? [{ code: 'data.business-commands', declaration: operations.filter(operation => operation.platformAccess?.dataCommands) }]
+            : []),
+        ...(config.authz.dataPolicies.some((policy) => policy.publicRead)
+            ? [{ code: 'data.authenticated-public-projection',
+                    declaration: config.authz.dataPolicies.filter((policy) => policy.publicRead) }]
+            : []),
+        ...(operations.some(operation => operation.platformAccess?.roleAssertions?.actorAuthority)
+            ? [{ code: 'data.transaction-actor-authority',
+                    declaration: operations.filter(operation => operation.platformAccess?.roleAssertions?.actorAuthority) }]
+            : []),
+        ...(operations.some(operation => operation.platformAccess?.workflowStage)
+            ? [{ code: 'workflow.native-stage-guard', declaration: operations.filter(operation => operation.platformAccess?.workflowStage) }]
+            : []),
+        ...(operations.some(operation => operation.platformAccess?.recordEdit)
+            ? [{ code: 'data.record-edit', declaration: operations.filter(operation => operation.platformAccess?.recordEdit) }]
+            : []),
         ...(operations.some(operation => operation.platformAccess?.decimalReservation) ||
             config.events.subscriptions.some((subscription) => subscription.platformAccess?.decimalReservation)
             ? [{
@@ -416,6 +463,14 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
                 },
             ]
             : []),
+        ...(resources.some(resource => resource.recordComments !== undefined)
+            ? [{ code: 'data.record-comments', declaration: dataUsage }] : []),
+        ...(resources.some(resource => resource.recordDeletion !== undefined)
+            ? [{ code: 'data.workflow-record-deletion', declaration: dataUsage }] : []),
+        ...(resources.some(resource => resource.recordPrint !== undefined)
+            ? [{ code: 'data.record-print', declaration: dataUsage }] : []),
+        ...(resources.some(resource => resource.workflowHistory !== undefined)
+            ? [{ code: 'workflow.record-history-read', declaration: dataUsage }] : []),
         ...(resources.some(hasDataAuditReadPolicy)
             ? [{ code: 'data.audit-read-access', declaration: dataUsage }]
             : []),
@@ -448,6 +503,13 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
             ]
             : []),
         ...(operations.some(operation => operation.platformAccess?.directory?.mode === 'selected-user') ? [{ code: 'directory.selected-user', declaration: operations.filter(operation => operation.platformAccess?.directory?.mode === 'selected-user').map(operation => ({ code: operation.code, directory: operation.platformAccess.directory })) }] : []),
+        ...(initiatorPhoneOperations.length || initiatorPhoneCommands.length ? [{
+                code: 'directory.current-initiator-phone',
+                declaration: {
+                    operations: initiatorPhoneOperations.map(operation => ({ code: operation.code, directory: operation.platformAccess.directory })),
+                    commands: initiatorPhoneCommands.map((command) => ({ code: command.code, directory: command.execution.directory })),
+                },
+            }] : []),
         ...(usesManagedFiles
             ? [
                 {
@@ -481,6 +543,9 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
         ...(config.events.capturePolicies?.length
             ? [{ code: 'events.capture-policy', declaration: config.events.capturePolicies }]
             : []),
+        ...(config.events.dateTriggers.some((trigger) => dateEventProjectionFieldsV2(trigger.resourceCode, config.events.subscriptions.filter((subscription) => subscription.eventTypes.includes(trigger.eventType)), config.data.resources.find((resource) => resource.code === trigger.resourceCode)).length > 0)
+            ? [{ code: 'events.date-source-projection', declaration: { triggers: config.events.dateTriggers, subscriptions: config.events.subscriptions } }]
+            : []),
         ...(usesEvents
             ? [
                 { code: 'events-v2', declaration: config.events },
@@ -490,6 +555,23 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
                 },
             ]
             : []),
+        ...(requiresExtendedOwnedSubtableCapacity(config.data.resources)
+            ? [{ code: 'data.extended-owned-subtable-capacity', declaration: config.data.resources.filter((resource) => requiresExtendedOwnedSubtableCapacity([resource])) }] : []),
+        ...(config.data.resources.some((resource) => resource.schema.fields.some((field) => field.userCandidates !== undefined))
+            ? [{ code: 'data.user-candidates', declaration: config.data.resources.filter((resource) => resource.schema.fields.some((field) => field.userCandidates !== undefined)) }]
+            : []),
+        ...(requiresWorkflowRoleUnion(config.workflows.bindings)
+            ? [{ code: 'workflow.role-union', declaration: config.workflows.bindings.filter((item) => Object.values(item.binding.bindings).some((entry) => entry.roleCodes !== undefined)) }] : []),
+        ...(config.backend.operations.some((item) => item.platformAccess?.ownedSubject)
+            ? [{ code: 'workflow.named-owned-create', declaration: config.backend.operations.filter((item) => item.platformAccess?.ownedSubject) }] : []),
+        ...(requiresUserCandidateLaunchScope(config.data.resources)
+            ? [{ code: 'data.user-candidate-launch-scope', declaration: config.data.resources.filter((resource) => requiresUserCandidateLaunchScope([resource])) }]
+            : []),
+        ...(requiresOwnedSubtableMinimumRows(config.data.resources)
+            ? [{ code: 'data.subtable-minimum-rows', declaration: config.data.resources.filter((resource) => requiresOwnedSubtableMinimumRows([resource])) }] : []),
+        ...(requiresDateTimeMinutePrecision(config.data.resources)
+            ? [{ code: 'data.datetime-minute-precision', declaration: config.data.resources.filter((resource) => requiresDateTimeMinutePrecision([resource])) }]
+            : []),
         ...(config.workflows.activations.length
             ? [
                 {
@@ -508,12 +590,53 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
                     declaration: config.workflows.definitions.filter((item) => item.definition.instanceCommands !== undefined),
                 }]
             : []),
+        ...(config.workflows.definitions.some((item) => item.definition.instanceCommands?.withdraw?.reasonRequired === false)
+            ? [{ code: 'workflow.optional-withdrawal-reason',
+                    declaration: config.workflows.definitions.filter((item) => item.definition.instanceCommands?.withdraw?.reasonRequired === false) }]
+            : []),
+        ...(config.workflows.definitions.some((item) => item.definition.rejectionNotification !== undefined)
+            ? [{
+                    code: 'workflow.rejection-notification',
+                    declaration: config.workflows.definitions.filter((item) => item.definition.rejectionNotification !== undefined),
+                }]
+            : []),
+        ...(config.workflows.definitions.some((item) => item.definition.commandHandlers !== undefined) || operations.some(operation => operation.platformAccess?.workflow?.businessCommands)
+            ? [{ code: 'workflow.business-data-command', declaration: {
+                        definitions: config.workflows.definitions.filter((item) => item.definition.commandHandlers !== undefined),
+                        operations: operations.filter(operation => operation.platformAccess?.workflow?.businessCommands),
+                    } }] : []),
+        ...(config.workflows.definitions.some((item) => item.definition.commandHandlers?.resubmit) || operations.some(operation => operation.platformAccess?.workflow?.businessCommands?.includes('resubmit'))
+            ? [{ code: 'workflow.correction-business-command', declaration: {
+                        definitions: config.workflows.definitions.filter((item) => item.definition.commandHandlers?.resubmit),
+                        operations: operations.filter(operation => operation.platformAccess?.workflow?.businessCommands?.includes('resubmit')),
+                    } }] : []),
+        ...(config.workflows.definitions.some((item) => item.definition.launchPreflight !== undefined)
+            ? [{ code: 'workflow.launch-preflight', declaration: config.workflows.definitions.filter((item) => item.definition.launchPreflight !== undefined) }] : []),
+        ...(config.workflows.definitions.some((item) => item.definition.approvedDelegation !== undefined)
+            ? [{ code: 'workflow.approved-delegation', declaration: config.workflows.definitions.filter((item) => item.definition.approvedDelegation !== undefined) }] : []),
+        ...(config.workflows.definitions.some((item) => workflowUsesOwnedInitialFacts(item.definition, config.data.resources))
+            ? [{ code: 'workflow.owned-initial-facts', declaration: config.workflows.definitions.filter((item) => workflowUsesOwnedInitialFacts(item.definition, config.data.resources)) }] : []),
+        ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'correction'))
+            ? [{ code: 'workflow.initiator-correction', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'correction')) }] : []),
+        ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.operationPolicy?.reject?.commentRequired === false))
+            ? [{ code: 'workflow.optional-rejection-comment', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.operationPolicy?.reject?.commentRequired === false)) }] : []),
+        ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => Object.values(node.operationPolicy || {}).some((policy) => policy.reasonRequired === false)))
+            ? [{ code: 'workflow.optional-operation-reason', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => Object.values(node.operationPolicy || {}).some((policy) => policy.reasonRequired === false))) }] : []),
         ...(namedInputSourceDefinitions.length
             ? [{ code: 'workflow.named-input-sources', declaration: namedInputSourceDefinitions }]
             : []),
         ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.administration !== undefined || node.operationPolicy !== undefined))
             ? [{ code: 'workflow.node-administration', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.administration !== undefined || node.operationPolicy !== undefined)) }]
             : []),
+        ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'approval' && node.emptyPolicy !== undefined))
+            ? [{ code: 'workflow.approval-empty-policy', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'approval' && node.emptyPolicy !== undefined)) }]
+            : []),
+        ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.completionDeadline !== undefined))
+            ? [{ code: 'workflow.completion-deadline', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.completionDeadline !== undefined)) }]
+            : []),
+        ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.initiatorApprovalPolicy !== undefined))
+            ? [{ code: 'workflow.initiator-approval-policy', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.initiatorApprovalPolicy !== undefined)) }]
+            : []),
         ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'cc'))
             ? [{ code: 'workflow.automatic-cc', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'cc')) }]
             : []),
@@ -556,6 +679,8 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
                 {
                     code: 'notification-hub-v2',
                     declaration: {
+                        ...(config.workflows.definitions.some((item) => item.definition.rejectionNotification !== undefined)
+                            ? { rejectionNotifications: config.workflows.definitions.filter((item) => item.definition.rejectionNotification !== undefined) } : {}),
                         operations: operations
                             .filter(operation => operation.platformAccess?.notification)
                             .map(operation => ({
@@ -592,7 +717,9 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
     return usages
         .map(({ code, declaration }) => ({
         code,
-        contractVersion: OPENXIANGDA_V2_PLATFORM_CAPABILITY_CONTRACT_VERSIONS[code],
+        contractVersion: code === 'data.unique-keys'
+            ? (resources.some(resource => nativeUniqueKeysContractVersion(resource.schema.fields, resource.uniqueKeys) === '1.1.0') ? '1.1.0' : '1.0.0')
+            : OPENXIANGDA_V2_PLATFORM_CAPABILITY_CONTRACT_VERSIONS[code],
         usageDigest: `sha256:${sha256Canonical(declaration)}`,
     }))
         .sort((left, right) => left.code === right.code ? 0 : left.code < right.code ? -1 : 1);
@@ -789,13 +916,13 @@ function validateConfigurationEnvelope(config, appCode) {
         'dataPolicies',
         'authorizationTransitions',
     ], '/config/authz', ['authenticatedUserRoleCode']);
-    boundedArray(authz.capabilities, '/config/authz/capabilities', 2000);
-    boundedArray(authz.roles, '/config/authz/roles', 100);
+    boundedArray(authz.capabilities, '/config/authz/capabilities', NATIVE_CONTRACT_CAPACITY_V2.capabilities);
+    boundedArray(authz.roles, '/config/authz/roles', NATIVE_CONTRACT_CAPACITY_V2.roles);
     boundedArray(authz.scopeDimensions, '/config/authz/scopeDimensions', 100);
     boundedArray(authz.scopeSources, '/config/authz/scopeSources', 100);
     boundedArray(authz.roleMembershipSources, '/config/authz/roleMembershipSources', 100);
     boundedArray(authz.relationshipGrantSources, '/config/authz/relationshipGrantSources', 100);
-    boundedArray(authz.dataPolicies, '/config/authz/dataPolicies', 100);
+    boundedArray(authz.dataPolicies, '/config/authz/dataPolicies', NATIVE_CONTRACT_CAPACITY_V2.dataPolicies);
     boundedArray(authz.authorizationTransitions, '/config/authz/authorizationTransitions', 100);
     const backend = object(config.backend, '/config/backend');
     exactKeys(backend, ['secrets', 'operations'], '/config/backend');
@@ -808,7 +935,7 @@ function validateConfigurationEnvelope(config, appCode) {
         'subjectReadSurfaces',
         'concurrency',
     ]);
-    boundedArray(data.resources, '/config/data/resources', 100);
+    boundedArray(data.resources, '/config/data/resources', NATIVE_CONTRACT_CAPACITY_V2.resources);
     if (data.subjectReadSurfaces !== undefined) {
         boundedArray(data.subjectReadSurfaces, '/config/data/subjectReadSurfaces', NATIVE_CONTRACT_CAPACITY_V2.subjectReadSurfaces);
     }
@@ -829,14 +956,14 @@ function validateConfigurationEnvelope(config, appCode) {
         'providers',
         'editableParameters',
     ], '/config/workflows');
-    boundedArray(workflows.definitions, '/config/workflows/definitions', 100);
-    boundedArray(workflows.bindings, '/config/workflows/bindings', 100);
-    boundedArray(workflows.activations, '/config/workflows/activations', 100);
+    boundedArray(workflows.definitions, '/config/workflows/definitions', NATIVE_CONTRACT_CAPACITY_V2.workflows);
+    boundedArray(workflows.bindings, '/config/workflows/bindings', NATIVE_CONTRACT_CAPACITY_V2.workflows);
+    boundedArray(workflows.activations, '/config/workflows/activations', NATIVE_CONTRACT_CAPACITY_V2.workflows);
     boundedArray(workflows.providers, '/config/workflows/providers', 100);
     boundedArray(workflows.editableParameters, '/config/workflows/editableParameters', 100);
     const frontend = object(config.frontend, '/config/frontend');
     exactKeys(frontend, ['routes', 'user', 'admin', 'devicePolicy'], '/config/frontend', ['authentication', 'publicAccess']);
-    boundedArray(frontend.routes, '/config/frontend/routes', 500);
+    boundedArray(frontend.routes, '/config/frontend/routes', NATIVE_CONTRACT_CAPACITY_V2.routes);
     const user = object(frontend.user, '/config/frontend/user');
     exactKeys(user, ['applicationTodoCenter'], '/config/frontend/user');
     boolean(user.applicationTodoCenter, '/config/frontend/user/applicationTodoCenter');
@@ -1007,7 +1134,7 @@ function compileExpectedContract(config, configDigest, generatorVersion) {
             field: trigger.field,
         })),
         ...(config.workflows.activations.length
-            ? WORKFLOW_EVENT_TYPES_V2.filter(eventType => !WORKFLOW_BUSINESS_STEP_EVENTS.includes(eventType) || config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'action'))).map(eventType => ({
+            ? WORKFLOW_EVENT_TYPES_V2.filter(eventType => !WORKFLOW_BUSINESS_STEP_EVENTS.includes(eventType) || config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'action'))).filter(eventType => eventType !== 'openxiangda.workflow.node.skipped.v2' || config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'approval' && node.emptyPolicy === 'skip'))).map(eventType => ({
                 code: `workflow:${eventType}`,
                 source: 'workflow',
                 eventType,
@@ -1212,9 +1339,12 @@ function compileCapabilities(config) {
         };
         catalog.set(code, capability);
     }
-    for (const [resourceIndex, raw] of config.data.resources.entries()) {
-        const pointer = `/config/data/resources/${resourceIndex}`;
-        const resource = validateResource(raw, pointer, config.appCode);
+    const resources = config.data.resources.map((raw, resourceIndex) => ({
+        pointer: `/config/data/resources/${resourceIndex}`,
+        resource: validateResource(raw, `/config/data/resources/${resourceIndex}`, config.appCode),
+    }));
+    // CRUD definitions precede all field references, regardless of source order.
+    for (const { pointer, resource } of resources) {
         const operationNames = {
             read: `读取${resource.name}`,
             create: `新建${resource.name}`,
@@ -1233,6 +1363,10 @@ function compileCapabilities(config) {
                 source: 'data',
             });
         }
+    }
+    const definedCapabilities = new Set(catalog.keys());
+    const fieldOwners = new Map();
+    for (const { pointer, resource } of resources) {
         for (const [fieldCode, rawPolicy] of Object.entries(resource.fieldPolicies)) {
             if (isDataAuditMetadataField(fieldCode))
                 continue;
@@ -1242,6 +1376,13 @@ function compileCapabilities(config) {
                     continue;
                 for (const code of uniqueStrings(policy[operation], `${pointer}/fieldPolicies/${fieldCode}/${operation}`, 2000)) {
                     capabilityCode(code, `${pointer}/fieldPolicies/${fieldCode}/${operation}`, config.appCode);
+                    if (definedCapabilities.has(code))
+                        continue;
+                    const existingOwner = fieldOwners.get(code);
+                    if (existingOwner && existingOwner !== resource.code) {
+                        fail('NATIVE_CAPABILITY_DUPLICATE', `${pointer}/fieldPolicies/${fieldCode}/${operation}`);
+                    }
+                    fieldOwners.set(code, resource.code);
                     if (catalog.has(code))
                         continue;
                     catalog.set(code, {
@@ -1530,6 +1671,21 @@ function compileOperations(config) {
         const code = stableCode(operation.code, `${pointer}/code`);
         validateBackendOperationAi(operation.ai, pointer, code, method, declaredResourceCodes);
         const platformAccess = validateOperationPlatformAccess(operation.platformAccess, `${pointer}/platformAccess`, declaredResources, declaredResourceFields, declaredWorkflowCodes, new Set(config.authz.roles.map((role) => String(role.code))));
+        if (platformAccess?.workflowStage) {
+            const stage = platformAccess.workflowStage;
+            const workflow = config.workflows.definitions.find((entry) => entry.definition.code === stage.workflowCode);
+            if (!workflow || workflow.definition.subject?.resourceCode !== stage.resourceCode || stage.runningNodeIds.some((id) => !workflow.definition.nodes[id]))
+                fail('NATIVE_WORKFLOW_STAGE_NODE_INVALID', `${pointer}/platformAccess/workflowStage/runningNodeIds`);
+        }
+        if (platformAccess?.recordEdit) {
+            const owner = config.data.resources.find((item) => item.code === platformAccess.recordEdit.resourceCode);
+            if (owner?.surface?.mutationOwner !== 'action')
+                fail('NATIVE_RECORD_EDIT_ACTION_OWNER_REQUIRED', `${pointer}/platformAccess/recordEdit`);
+            for (const fieldCode of platformAccess.recordEdit.fieldCodes) {
+                if (!owner.fieldPolicies?.[fieldCode]?.update?.length || owner.surface?.fields?.[fieldCode]?.system === true)
+                    fail('NATIVE_RECORD_EDIT_FIELD_INVALID', `${pointer}/platformAccess/recordEdit/fieldCodes`);
+            }
+        }
         if (platformAccess?.decimalReservation) {
             const reservation = platformAccess.decimalReservation;
             const resourceCode = String(reservation.resourceCode);
@@ -1726,14 +1882,51 @@ function validateOperationPlatformAccess(value, pointer, declaredResources, decl
     if (value === undefined)
         return null;
     const access = object(value, pointer);
-    exactKeys(access, ['directory', 'managedFiles', 'managedFileCopies', 'notification', 'workflow', 'roleAssertions', 'decimalReservation'], pointer, true);
+    exactKeys(access, ['directory', 'managedFiles', 'managedFileCopies', 'notification', 'workflow', 'roleAssertions', 'decimalReservation', 'dataCommands', 'recordEdit', 'ownedSubject', 'workflowStage'], pointer, true);
     if (Object.keys(access).length === 0) {
         fail('NATIVE_OPERATION_PLATFORM_ACCESS_EMPTY', pointer);
     }
     const result = {};
+    if (access.dataCommands !== undefined) {
+        const commands = object(access.dataCommands, `${pointer}/dataCommands`);
+        exactKeys(commands, ['mode'], `${pointer}/dataCommands`);
+        equal(commands.mode, 'recoverable-native', `${pointer}/dataCommands/mode`);
+        result.dataCommands = { mode: 'recoverable-native' };
+    }
+    if (access.workflowStage !== undefined) {
+        try {
+            assertWorkflowNativeStagePolicy(access.workflowStage);
+        }
+        catch {
+            fail('NATIVE_WORKFLOW_STAGE_DECLARATION_INVALID', `${pointer}/workflowStage`);
+        }
+        const stage = access.workflowStage;
+        if (!result.dataCommands || access.decimalReservation !== undefined || !declaredResources.has(stage.resourceCode) ||
+            !declaredWorkflowCodes.has(stage.workflowCode) || !access.workflow?.codes?.includes(stage.workflowCode))
+            fail('NATIVE_WORKFLOW_STAGE_DECLARATION_INVALID', `${pointer}/workflowStage`);
+        result.workflowStage = { ...stage, runningNodeIds: uniqueSorted([...stage.runningNodeIds]), allowedStatuses: uniqueSorted([...stage.allowedStatuses]) };
+    }
+    if (access.recordEdit !== undefined) {
+        const entryPointer = `${pointer}/recordEdit`;
+        const entry = object(access.recordEdit, entryPointer);
+        exactKeys(entry, ['resourceCode', 'fieldCodes'], entryPointer);
+        const code = resourceCode(entry.resourceCode, `${entryPointer}/resourceCode`);
+        const fields = declaredResourceFields.get(code);
+        const fieldCodes = uniqueStrings(entry.fieldCodes, `${entryPointer}/fieldCodes`, 200);
+        if (!fields || !fieldCodes.length || !result.dataCommands)
+            fail('NATIVE_RECORD_EDIT_DECLARATION_INVALID', entryPointer);
+        for (const fieldCode of fieldCodes) {
+            const field = fields.get(fieldCode);
+            if (!field || field.type === 'serial-number' || field.type === 'subtable')
+                fail('NATIVE_RECORD_EDIT_FIELD_INVALID', `${entryPointer}/fieldCodes`);
+        }
+        result.recordEdit = { resourceCode: code, fieldCodes: uniqueSorted(fieldCodes) };
+    }
     if (access.roleAssertions !== undefined) {
         const assertions = object(access.roleAssertions, `${pointer}/roleAssertions`);
-        exactKeys(assertions, ['roleCodes'], `${pointer}/roleAssertions`);
+        exactKeys(assertions, ['roleCodes', 'actorAuthority'], `${pointer}/roleAssertions`, true);
+        if (assertions.actorAuthority !== undefined)
+            equal(assertions.actorAuthority, true, `${pointer}/roleAssertions/actorAuthority`);
         const codes = uniqueStrings(assertions.roleCodes, `${pointer}/roleAssertions/roleCodes`, 20);
         if (!codes.length)
             fail('NATIVE_OPERATION_ROLE_ASSERTIONS_REQUIRED', `${pointer}/roleAssertions/roleCodes`);
@@ -1741,7 +1934,8 @@ function validateOperationPlatformAccess(value, pointer, declaredResources, decl
             if (!declaredRoleCodes.has(code))
                 fail('NATIVE_ROLE_REFERENCE_MISSING', `${pointer}/roleAssertions/roleCodes/${index}`);
         });
-        result.roleAssertions = { roleCodes: uniqueSorted(codes) };
+        result.roleAssertions = { roleCodes: uniqueSorted(codes),
+            ...(assertions.actorAuthority === true ? { actorAuthority: true } : {}) };
     }
     if (access.directory !== undefined) {
         const directory = object(access.directory, `${pointer}/directory`);
@@ -1754,8 +1948,9 @@ function validateOperationPlatformAccess(value, pointer, declaredResources, decl
             'employeeNumber',
             'primaryDepartment',
             'departments',
+            ...(directory.mode === 'current-initiator' ? ['phone'] : []),
         ]);
-        const fields = uniqueStrings(directory.fields, `${pointer}/directory/fields`, 4);
+        const fields = uniqueStrings(directory.fields, `${pointer}/directory/fields`, allowed.size);
         if (!fields.length || fields.some(field => !allowed.has(field))) {
             fail('NATIVE_OPERATION_DIRECTORY_FIELDS_INVALID', `${pointer}/directory/fields`);
         }
@@ -1848,12 +2043,37 @@ function validateOperationPlatformAccess(value, pointer, declaredResources, decl
     }
     if (access.workflow !== undefined) {
         const workflow = object(access.workflow, `${pointer}/workflow`);
-        exactKeys(workflow, ['codes'], `${pointer}/workflow`);
+        exactKeys(workflow, ['codes'], `${pointer}/workflow`, ['businessCommands']);
         const codes = uniqueStrings(workflow.codes, `${pointer}/workflow/codes`, 16);
         if (!codes.length || codes.some(code => !declaredWorkflowCodes.has(code))) {
             fail('NATIVE_OPERATION_WORKFLOW_CODE_INVALID', `${pointer}/workflow/codes`);
         }
-        result.workflow = { codes: uniqueSorted(codes) };
+        const businessCommands = workflow.businessCommands === undefined ? undefined : uniqueStrings(workflow.businessCommands, `${pointer}/workflow/businessCommands`, 4);
+        if (businessCommands && (!businessCommands.length || businessCommands.some(command => !['approve', 'reject', 'withdraw', 'resubmit'].includes(command)))) {
+            fail('NATIVE_OPERATION_WORKFLOW_BUSINESS_COMMAND_INVALID', `${pointer}/workflow/businessCommands`);
+        }
+        result.workflow = { codes: uniqueSorted(codes), ...(businessCommands ? { businessCommands: uniqueSorted(businessCommands) } : {}) };
+    }
+    if (access.ownedSubject !== undefined) {
+        const entryPointer = `${pointer}/ownedSubject`;
+        const grant = access.ownedSubject;
+        try {
+            assertWorkflowOwnedSubjectCreate(grant);
+        }
+        catch {
+            fail('NATIVE_WORKFLOW_OWNED_SUBJECT_INVALID', entryPointer);
+        }
+        if (!result.workflow || access.decimalReservation !== undefined)
+            fail('NATIVE_WORKFLOW_OWNED_SUBJECT_INVALID', entryPointer);
+        try {
+            assertWorkflowOwnedSubjectCreateResources(grant, declaredResourceFields, result.managedFiles || []);
+        }
+        catch (error) {
+            fail(`NATIVE_${error.message}`, entryPointer);
+        }
+        result.ownedSubject = { mode: 'create', resourceCode: grant.resourceCode, subtables: sorted(grant.subtables.map(table => ({
+                fieldCode: table.fieldCode, fieldCodes: uniqueSorted([...table.fieldCodes]),
+            })), table => table.fieldCode) };
     }
     if (access.decimalReservation !== undefined) {
         const reservationPointer = `${pointer}/decimalReservation`;
@@ -2818,6 +3038,8 @@ function compileAdminNavigation(config) {
 }
 function validateAdminNavigationDeclaration(value, pointer) {
     const groups = boundedArray(value, pointer, NATIVE_CONTRACT_CAPACITY_V2.adminNavigationGroups);
+    if (groups.reduce((count, group) => count + (Array.isArray(group?.items) ? group.items.length : 0), 0) > NATIVE_CONTRACT_CAPACITY_V2.adminNavigationItems)
+        fail('NATIVE_ARRAY_LIMIT_EXCEEDED', pointer);
     let itemCount = 0;
     groups.forEach((rawGroup, groupIndex) => {
         const groupPointer = `${pointer}/${groupIndex}`;
@@ -2958,6 +3180,8 @@ function validateAdminPageContracts(value, pointer) {
 }
 function validateAdminNavigationContracts(value, pointer) {
     const groups = boundedArray(value, pointer, NATIVE_CONTRACT_CAPACITY_V2.adminNavigationGroups);
+    if (groups.reduce((count, group) => count + (Array.isArray(group?.items) ? group.items.length : 0), 0) > NATIVE_CONTRACT_CAPACITY_V2.adminNavigationItems)
+        fail('NATIVE_ARRAY_LIMIT_EXCEEDED', pointer);
     let itemCount = 0;
     groups.forEach((rawGroup, groupIndex) => {
         const groupPointer = `${pointer}/${groupIndex}`;
@@ -3479,6 +3703,9 @@ function compileWorkflowLaunchContract(config, definition, value, pointer, opera
         const fieldCodes = new Set();
         const sourceCounts = new Map();
         const normalizedInputs = {};
+        const ownedSubject = operationContract.platformAccess?.ownedSubject;
+        if (ownedSubject && (intentKind !== 'create' || ownedSubject.resourceCode !== subjectResourceCode))
+            fail('NATIVE_WORKFLOW_OWNED_SUBJECT_LAUNCH_MISMATCH', intentPointer);
         for (const [inputCode, rawBinding] of inputEntries) {
             if (!PROPERTY_CODE_PATTERN.test(inputCode) ||
                 !Object.prototype.hasOwnProperty.call(requestProperties, inputCode)) {
@@ -3505,6 +3732,9 @@ function compileWorkflowLaunchContract(config, definition, value, pointer, opera
                     fail('NATIVE_WORKFLOW_NAMED_OPERATION_INPUT_INVALID', `${bindingPointer}/fieldCode`);
                 }
                 fieldCodes.add(fieldCode);
+                const field = subjectResource.schema.fields.find((item) => item.code === fieldCode);
+                if (field?.type === 'subtable' && (!ownedSubject || !ownedSubject.subtables.some((table) => table.fieldCode === fieldCode)))
+                    fail('NATIVE_WORKFLOW_OWNED_SUBJECT_LAUNCH_REQUIRED', bindingPointer);
                 normalizedInputs[inputCode] = { source, fieldCode };
             }
             else {
@@ -3615,6 +3845,40 @@ function validateAuthorizationReferences(config, capabilities) {
     config.data.resources.forEach((rawResource, index) => {
         const resourcePointer = `/config/data/resources/${index}`;
         const resource = object(rawResource, resourcePointer);
+        if (resource.recordDeletion !== undefined) {
+            const pointer = `${resourcePointer}/recordDeletion/delete`;
+            for (const capability of resource.recordDeletion.delete) {
+                capabilityCode(capability, pointer, config.appCode);
+                if (!capabilityCodes.has(capability))
+                    fail('NATIVE_CAPABILITY_REFERENCE_MISSING', pointer);
+            }
+        }
+        if (resource.recordComments !== undefined) {
+            for (const mode of ['read', 'create']) {
+                const pointer = `${resourcePointer}/recordComments/${mode}`;
+                for (const capability of resource.recordComments[mode]) {
+                    capabilityCode(capability, pointer, config.appCode);
+                    if (!capabilityCodes.has(capability))
+                        fail('NATIVE_CAPABILITY_REFERENCE_MISSING', pointer);
+                }
+            }
+        }
+        if (resource.recordPrint !== undefined) {
+            const pointer = `${resourcePointer}/recordPrint/read`;
+            for (const capability of resource.recordPrint.read) {
+                capabilityCode(capability, pointer, config.appCode);
+                if (!capabilityCodes.has(capability))
+                    fail('NATIVE_CAPABILITY_REFERENCE_MISSING', pointer);
+            }
+        }
+        if (resource.workflowHistory !== undefined) {
+            const pointer = `${resourcePointer}/workflowHistory/read`;
+            for (const capability of resource.workflowHistory.read) {
+                capabilityCode(capability, pointer, config.appCode);
+                if (!capabilityCodes.has(capability))
+                    fail('NATIVE_CAPABILITY_REFERENCE_MISSING', pointer);
+            }
+        }
         for (const [fieldCode, rawPolicy] of Object.entries(resource.fieldPolicies || {})) {
             if (!isDataAuditMetadataField(fieldCode))
                 continue;
@@ -3633,6 +3897,9 @@ function validateAuthorizationReferences(config, capabilities) {
             return;
         const resourceCapabilities = object(resource.capabilities, `${resourcePointer}/capabilities`);
         for (const operation of ['create', 'update', 'delete']) {
+            if (operation === 'delete' && Array.isArray(resource.recordDeletion?.delete) &&
+                resource.recordDeletion.delete.length > 0)
+                continue;
             forbiddenNativeMutationCapabilities.set(String(resourceCapabilities[operation]), operation);
         }
     });
@@ -3923,6 +4190,7 @@ function validateDataPolicyReferences(config) {
             'name',
             'resourceCode',
             'unrestrictedRoleCodes',
+            'publicRead',
             'operations',
             'matchMode',
             'rules',
@@ -3954,6 +4222,26 @@ function validateDataPolicyReferences(config) {
         if (hasReadExpression && !policyFields) {
             fail('NATIVE_DATA_POLICY_RESOURCE_MISSING', `${pointer}/resourceCode`);
         }
+        if (policy.publicRead !== undefined) {
+            try {
+                const baseline = config.authz.roles.find((role) => role.code === authenticatedUserRoleCode);
+                validateAuthenticatedPublicRead({ policy,
+                    resource: config.data.resources.find((resource) => resource.code === policyResourceCode),
+                    baselineRoleCode: authenticatedUserRoleCode,
+                    baselineCapabilities: baseline?.capabilities || [],
+                    baselineDeniedCapabilities: baseline?.deniedCapabilities || [], pointer });
+            }
+            catch (error) {
+                if (!(error instanceof AuthenticatedPublicReadContractError))
+                    throw error;
+                fail(error.code, error.pointer);
+            }
+            if (!(policy.unrestrictedRoleCodes || []).includes(authenticatedUserRoleCode))
+                fail('AUTHENTICATED_PUBLIC_READ_CANONICAL_BASELINE_MISSING', `${pointer}/unrestrictedRoleCodes`);
+        }
+        else if (authenticatedUserRoleCode && (policy.unrestrictedRoleCodes || []).includes(authenticatedUserRoleCode)) {
+            fail('NATIVE_DATA_POLICY_BASELINE_UNRESTRICTED', `${pointer}/unrestrictedRoleCodes`);
+        }
         const unrestrictedRoleCodes = uniqueStrings(policy.unrestrictedRoleCodes || [], `${pointer}/unrestrictedRoleCodes`, 100);
         if (policy.unrestrictedRoleCodes !== undefined &&
             unrestrictedRoleCodes.length === 0) {
@@ -4101,9 +4389,10 @@ function validateDataPolicyReferences(config) {
 function validateDataFieldReferences(config) {
     try {
         validateNativeDataResourceReferencesV2(config.data.resources, '/config/data/resources');
+        config.data.resources.forEach((resource, index) => validateUserCandidateReferences(resource.schema.fields, new Set(config.authz.roles.map((role) => role.code)), new Set(config.authz.scopeDimensions.map((dimension) => dimension.code)), `/config/data/resources/${index}/schema/fields`));
     }
     catch (error) {
-        if (error instanceof NativeDataFieldContractV2Error) {
+        if (error instanceof NativeDataFieldContractV2Error || error instanceof UserCandidateContractError) {
             fail(error.code, error.pointer);
         }
         throw error;
@@ -4326,6 +4615,15 @@ function validateWorkflowReferences(config) {
         }
         definitions.add(key);
         validateWorkflowDefinition(definition, `${pointer}/definition`);
+        const preflightErrors = validateWorkflowLaunchPreflight(definition);
+        if (preflightErrors.length)
+            fail(preflightErrors[0], `${pointer}/definition/launchPreflight`);
+        const delegationErrors = validateWorkflowApprovedDelegation(definition);
+        if (delegationErrors.length)
+            fail(delegationErrors[0], `${pointer}/definition/approvedDelegation`);
+        const businessCommandErrors = validateWorkflowCommandHandlers(definition, config.backend.operations);
+        if (businessCommandErrors.length)
+            fail(businessCommandErrors[0], `${pointer}/definition/commandHandlers`);
         validateWorkflowSubject(definition.subject, resources, `${pointer}/definition/subject`);
         const taskPageErrors = validateWorkflowTaskPages(definition, new Map((resources.get(definition.subject.resourceCode)?.schema.fields || [])
             .map((field) => [field.code, { ...resources.get(definition.subject.resourceCode)?.surface?.fields?.[field.code], ...field, system: ['id', 'revision', 'createdAt', 'updatedAt', 'createdBy', 'updatedBy'].includes(field.code) }])), new Map([...resources].map(([code, resource]) => [code, new Map(resource.schema.fields.map((field) => [field.code, { ...resource.surface?.fields?.[field.code], ...field, system: ['id', 'revision', 'createdAt', 'updatedAt', 'createdBy', 'updatedBy'].includes(field.code) }]))])));
@@ -4385,6 +4683,9 @@ function validateWorkflowReferences(config) {
         }
         const definition = definitionValues.get(definitionKey);
         const binding = bindingValues.get(bindingKey);
+        const preflightErrors = validateWorkflowLaunchPreflight(definition, binding);
+        if (preflightErrors.length)
+            fail(preflightErrors[0], pointer);
         const administrationErrors = validateWorkflowAdministration(definition, binding);
         if (administrationErrors.length)
             fail(administrationErrors[0], pointer);
@@ -4394,6 +4695,15 @@ function validateWorkflowReferences(config) {
             fail('NATIVE_WORKFLOW_COMMAND_DEACTIVATION_POLICY_MISMATCH', `${pointer}/acceptedCommandDeactivationPolicy`);
         }
         validateWorkflowDefinitionBinding(definition, binding, `/config/workflows/activations/${index}`);
+        try {
+            const fields = resources.get(definition.subject.resourceCode)?.schema.fields || [];
+            validateWorkflowUserCandidateBindings(definition, binding, new Map(fields.map((field) => [field.code, field])), `${pointer}/bindings`, new Map([...resources].map(([code, resource]) => [code, new Map(resource.schema.fields.map((field) => [field.code, field]))])));
+        }
+        catch (error) {
+            if (error instanceof UserCandidateContractError)
+                fail(error.code, error.pointer);
+            throw error;
+        }
         activeBindings.set(code, binding);
     }
     const routingErrors = validateWorkflowAssignmentRoutingBindings([...activeBindings.values()]);
@@ -4552,7 +4862,7 @@ function validateWorkflowDefinition(definition, pointer) {
         'startAt',
         'inputSchema',
         'nodes',
-    ], pointer, ['organizationContext', 'instanceCommands', 'readability', 'taskPages']);
+    ], pointer, ['organizationContext', 'instanceCommands', 'readability', 'taskPages', 'rejectionNotification', 'commandHandlers', 'launchPreflight', 'approvedDelegation']);
     equal(definition.schemaVersion, 'openxiangda.workflow-definition/v2', `${pointer}/schemaVersion`);
     workflowCodeValue(definition.code, `${pointer}/code`);
     requiredString(definition.title, `${pointer}/title`, 255);
@@ -4571,6 +4881,18 @@ function validateWorkflowDefinition(definition, pointer) {
     const administrationErrors = validateWorkflowAdministration(definition);
     if (administrationErrors.length)
         fail(administrationErrors[0], `${pointer}/nodes`);
+    const emptyPolicyErrors = validateWorkflowApprovalEmptyPolicy(definition);
+    if (emptyPolicyErrors.length)
+        fail(emptyPolicyErrors[0], `${pointer}/nodes`);
+    const initiatorPolicyErrors = validateWorkflowInitiatorApprovalPolicy(definition);
+    if (initiatorPolicyErrors.length)
+        fail(initiatorPolicyErrors[0], `${pointer}/nodes`);
+    const deadlineErrors = validateWorkflowCompletionDeadlines(definition);
+    if (deadlineErrors.length)
+        fail(deadlineErrors[0], `${pointer}/nodes`);
+    const rejectionNotificationErrors = validateWorkflowRejectionNotification(definition);
+    if (rejectionNotificationErrors.length)
+        fail(rejectionNotificationErrors[0], `${pointer}/rejectionNotification`);
     const ccErrors = validateWorkflowAutomaticCc(definition);
     if (ccErrors.length)
         fail(ccErrors[0], `${pointer}/nodes`);
@@ -4587,7 +4909,7 @@ function validateWorkflowDefinition(definition, pointer) {
         const nodePointer = `${pointer}/nodes/${nodeId}`;
         const node = object(rawNode, nodePointer);
         equal(node.id, nodeId, `${nodePointer}/id`);
-        if (!['approval', 'condition', 'end', 'cc', 'action'].includes(node.kind)) {
+        if (!['approval', 'condition', 'end', 'cc', 'action', 'correction'].includes(node.kind)) {
             fail('NATIVE_WORKFLOW_NODE_KIND_INVALID', `${nodePointer}/kind`);
         }
         const targets = [];
@@ -4609,6 +4931,11 @@ function validateWorkflowDefinition(definition, pointer) {
                 }
             }
         }
+        else if (node.kind === 'correction') {
+            const errors = validateWorkflowCorrections(definition);
+            if (errors.length)
+                fail(errors[0], nodePointer);
+        }
         else if (node.kind === 'action') {
             targets.push(requiredString(node.next, `${nodePointer}/next`, 128));
         }
@@ -4653,6 +4980,13 @@ function validateWorkflowDefinition(definition, pointer) {
         visiting.delete(nodeId);
     };
     walk(startAt);
+    for (const id of [...reachable]) {
+        const current = nodes[id];
+        if (current?.kind === 'approval')
+            for (const target of current.returnTargets || [])
+                if (nodes[target]?.kind === 'correction')
+                    reachable.add(target);
+    }
     if (reachable.size !== nodeIds.length) {
         fail('NATIVE_WORKFLOW_NODE_UNREACHABLE', `${pointer}/nodes`);
     }
@@ -4699,6 +5033,9 @@ function validateWorkflowBinding(binding, pointer) {
     for (const [code, raw] of Object.entries(entries)) {
         workflowBindingCode(code, `${pointer}/bindings/${code}`);
         const entry = object(raw, `${pointer}/bindings/${code}`);
+        const unionErrors = validateWorkflowRoleUnion(entry);
+        if (unionErrors.length)
+            fail(unionErrors[0], `${pointer}/bindings/${code}/roleCodes`);
         const provider = requiredString(entry.provider, `${pointer}/bindings/${code}/provider`, 64);
         if (![
             'fixed_users',
@@ -4715,15 +5052,15 @@ function validateWorkflowBinding(binding, pointer) {
         ].includes(provider)) {
             fail('NATIVE_WORKFLOW_BINDING_PROVIDER_INVALID', `${pointer}/bindings/${code}/provider`);
         }
-        if (provider === 'fixed_users' &&
-            boundedArray(entry.users, `${pointer}/bindings/${code}/users`, 200)
-                .length === 0) {
-            fail('NATIVE_WORKFLOW_BINDING_USERS_REQUIRED', `${pointer}/bindings/${code}/users`);
+        if (provider === 'fixed_users') {
+            if (!Array.isArray(entry.users))
+                fail('NATIVE_WORKFLOW_BINDING_USERS_REQUIRED', `${pointer}/bindings/${code}/users`);
+            boundedArray(entry.users, `${pointer}/bindings/${code}/users`, 200);
         }
         if (['input_users', 'form_field_users'].includes(provider)) {
             requiredString(entry.inputPath, `${pointer}/bindings/${code}/inputPath`, 255);
         }
-        if (['app_role', 'app_role_in_scope', 'initiator_select'].includes(provider)) {
+        if (['app_role', 'app_role_in_scope', 'initiator_select'].includes(provider) && entry.roleCodes === undefined) {
             stableCode(entry.roleCode, `${pointer}/bindings/${code}/roleCode`);
         }
         if (provider === 'department_supervisor') {
@@ -4742,6 +5079,13 @@ function validateWorkflowBinding(binding, pointer) {
 function validateWorkflowDefinitionBinding(definition, binding, pointer) {
     equal(binding.workflowCode, definition.code, `${pointer}/workflowCode`);
     const entries = object(binding.bindings, `${pointer}/bindings`);
+    for (const [code, entry] of Object.entries(entries)) {
+        if (entry.provider === 'fixed_users' && !entry.users.length && !workflowBindingAllowsEmptyUsers(definition, code))
+            fail('NATIVE_WORKFLOW_BINDING_USERS_REQUIRED', `${pointer}/bindings/${code}/users`);
+    }
+    const emptyPolicyErrors = validateWorkflowApprovalEmptyPolicy(definition, binding);
+    if (emptyPolicyErrors.length)
+        fail(emptyPolicyErrors[0], pointer);
     const ccErrors = validateWorkflowAutomaticCc(definition, binding);
     if (ccErrors.length)
         fail(ccErrors[0], pointer);
@@ -4765,13 +5109,13 @@ function mergeUserSurfaceRoutes(expectedContract, contract, config) {
     const manifest = object(contract.routeManifest, '/contracts/routeManifest');
     const expectedManifest = object(expectedContract.routeManifest, '/contracts/routeManifest');
     const resources = new Map();
-    for (const raw of boundedArray(config.data?.resources, '/config/data/resources', 100)) {
+    for (const raw of boundedArray(config.data?.resources, '/config/data/resources', NATIVE_CONTRACT_CAPACITY_V2.resources)) {
         const resource = object(raw, '/config/data/resources');
         resources.set(String(resource.code || ''), resource);
     }
-    const existingCodes = new Set(boundedArray(expectedManifest.routes, '/contracts/routeManifest/routes', 1000).map(entry => String(object(entry, '/contracts/routeManifest/routes').code || '')));
+    const existingCodes = new Set(boundedArray(expectedManifest.routes, '/contracts/routeManifest/routes', NATIVE_CONTRACT_CAPACITY_V2.routes).map(entry => String(object(entry, '/contracts/routeManifest/routes').code || '')));
     const accepted = [];
-    for (const rawEntry of boundedArray(manifest.routes, '/contracts/routeManifest/routes', 1000)) {
+    for (const rawEntry of boundedArray(manifest.routes, '/contracts/routeManifest/routes', NATIVE_CONTRACT_CAPACITY_V2.routes)) {
         const entry = object(rawEntry, '/contracts/routeManifest/routes');
         const kind = String(entry.kind || '');
         if (kind !== 'resource-records' && kind !== 'resource-submit')
@@ -4836,6 +5180,10 @@ function validateResource(raw, pointer, appCode) {
         'invariants',
         'decimalReservationLifecycle',
         'uniqueKeys',
+        'workflowHistory',
+        'recordPrint',
+        'recordComments',
+        'recordDeletion',
         'capabilities',
         'dataPolicyCode',
         'fieldPolicies',
@@ -4858,11 +5206,45 @@ function validateResource(raw, pointer, appCode) {
         validateNativeDataResourceSurfaceV2(resource.surface, fields, `${pointer}/surface`);
     }
     catch (error) {
-        if (error instanceof NativeDataFieldContractV2Error || error instanceof NativeDecimalLifecycleContractError || error instanceof NativeUniqueKeyContractError) {
+        if (error instanceof NativeDataFieldContractV2Error || error instanceof UserCandidateContractError || error instanceof NativeDecimalLifecycleContractError || error instanceof NativeUniqueKeyContractError) {
             fail(error.code, error.pointer);
         }
         throw error;
     }
+    if (resource.recordComments !== undefined) {
+        const policy = object(resource.recordComments, `${pointer}/recordComments`);
+        exactKeys(policy, ['read', 'create'], `${pointer}/recordComments`);
+        for (const mode of ['read', 'create']) {
+            const list = policy[mode];
+            if (!Array.isArray(list) || list.length > 20 ||
+                list.some(value => typeof value !== 'string' || !value.trim()) || new Set(list).size !== list.length)
+                fail('NATIVE_RECORD_COMMENTS_POLICY_INVALID', `${pointer}/recordComments/${mode}`);
+        }
+    }
+    if (resource.recordDeletion !== undefined) {
+        const policy = object(resource.recordDeletion, `${pointer}/recordDeletion`);
+        exactKeys(policy, ['delete'], `${pointer}/recordDeletion`);
+        const remove = policy.delete;
+        if (!Array.isArray(remove) || remove.length > 20 ||
+            remove.some(value => typeof value !== 'string' || !value.trim()) || new Set(remove).size !== remove.length)
+            fail('NATIVE_RECORD_DELETION_DELETE_INVALID', `${pointer}/recordDeletion/delete`);
+    }
+    if (resource.recordPrint !== undefined) {
+        const policy = object(resource.recordPrint, `${pointer}/recordPrint`);
+        exactKeys(policy, ['read'], `${pointer}/recordPrint`);
+        const read = policy.read;
+        if (!Array.isArray(read) || read.length > 20 ||
+            read.some(value => typeof value !== 'string' || !value.trim()) || new Set(read).size !== read.length)
+            fail('NATIVE_RECORD_PRINT_READ_INVALID', `${pointer}/recordPrint/read`);
+    }
+    if (resource.workflowHistory !== undefined) {
+        const policy = object(resource.workflowHistory, `${pointer}/workflowHistory`);
+        exactKeys(policy, ['read'], `${pointer}/workflowHistory`);
+        const read = policy.read;
+        if (!Array.isArray(read) || read.length > 20 ||
+            read.some(value => typeof value !== 'string' || !value.trim()) || new Set(read).size !== read.length)
+            fail('NATIVE_WORKFLOW_HISTORY_READ_INVALID', `${pointer}/workflowHistory/read`);
+    }
     const fieldCodes = new Set(fields.map(field => field.code));
     const capabilities = object(resource.capabilities, `${pointer}/capabilities`);
     exactKeys(capabilities, ['read', 'create', 'update', 'delete'], `${pointer}/capabilities`);
@@ -4935,11 +5317,11 @@ function parseCanonicalArtifact(source, pointer, invalidCode, canonicalCode) {
         fail(canonicalCode, pointer);
     return result;
 }
-function inspectJsonBudget(value, pointer) {
+function inspectJsonBudget(value, pointer, maxNodes) {
     let nodes = 0;
     const visit = (current, path, depth) => {
         nodes += 1;
-        if (nodes > MAX_NODES)
+        if (nodes > maxNodes)
             fail('NATIVE_ARTIFACT_NODE_LIMIT_EXCEEDED', path);
         if (depth > MAX_DEPTH)
             fail('NATIVE_ARTIFACT_DEPTH_LIMIT_EXCEEDED', path);