openxiangda-contracts 2.63.0 → 2.70.0

package/dist/native-compiler/compiler.js

@@ -1,4 +1,6 @@
-import { validateUserCandidateReferences, validateWorkflowUserCandidateBindings, UserCandidateContractError } from './user-candidates.js';
+import { assertWorkflowNativeStagePolicy } from './workflow-native-stage.js';
+import { validateAuthenticatedPublicRead, AuthenticatedPublicReadContractError } from './authenticated-public-read.js';
+import { validateUserCandidateReferences, validateWorkflowUserCandidateBindings, UserCandidateContractError, requiresUserCandidateLaunchScope } from './user-candidates.js';
 import { NativeUniqueKeyContractError, parseNativeUniqueKeys, nativeUniqueKeysContractVersion } from './unique-keys.js';
 import { validateManagedConcurrency, ManagedConcurrencyContractError } from './managed-concurrency.js';
 import { normalizeDecimalReservationEventDeclaration, decimalReservationEventContext } from './decimal-reservation.js';
@@ -12,16 +14,23 @@ import { validateWorkflowAdministration } from './workflow-node-administration.j
 import { validateWorkflowAutomaticCc } from './workflow-automatic-cc.js';
 import { validateWorkflowApprovalEmptyPolicy, workflowBindingAllowsEmptyUsers } from './workflow-approval-empty.js';
 import { validateWorkflowInitiatorApprovalPolicy } from './workflow-initiator-approval.js';
+import { validateWorkflowCompletionDeadlines } from './workflow-completion-deadline.js';
 import { validateWorkflowRejectionNotification } from './workflow-rejection-notification.js';
 import { validateWorkflowCommandHandlers } from './workflow-business-command.js';
 import { validateWorkflowLaunchPreflight } from './workflow-launch-preflight.js';
+import { validateWorkflowApprovedDelegation } from './workflow-approved-delegation.js';
+import { validateWorkflowCorrections } from './workflow-correction.js';
+import { dateEventProjectionFieldsV2 } from './date-event-projection.js';
 import { validateWorkflowTaskPages } from './workflow-task-page.js';
+import { requiresExtendedOwnedSubtableCapacity, requiresAggregateOwnedSubtableCapacity, dataOwnedRowLimit, isDataOwnedRowLimit } from './data-capacity.js';
 import { validateWorkflowBusinessSteps, compileWorkflowBusinessStepHandlers, validateWorkflowBusinessStepSubscriptions, WORKFLOW_BUSINESS_STEP_EVENT, WORKFLOW_BUSINESS_STEP_EVENTS } from './workflow-business-step.js';
 import { validateWorkflowAssignmentRoutingBindings, validateWorkflowAssignmentRoutingPolicy } from './workflow-assignment-routing.js';
+import { requiresWorkflowRoleUnion, validateWorkflowRoleUnion } from './workflow-role-union.js';
+import { assertWorkflowOwnedSubjectCreate, assertWorkflowOwnedSubjectCreateResources } from './workflow-owned-subject.js';
 import * as crypto from 'crypto';
 import { OPENXIANGDA_COMPILER_CONTRACT_VERSION as OPENXIANGDA_V2_COMPILER_CONTRACT_VERSION, PLATFORM_CAPABILITY_CONTRACT_VERSIONS as OPENXIANGDA_V2_PLATFORM_CAPABILITY_CONTRACT_VERSIONS, } from '../native-version.js';
 import { canonicalJson, sha256Digest as sha256Canonical } from '../canonical.js';
-import { NativeDataFieldContractV2Error, nativeFieldRequiresCreateInputV2, parseNativeDataFieldsV2, parseNativeDataResourceInvariantsV2, validateNativeDataResourceReferencesV2, } from './data-field.js';
+import { NativeDataFieldContractV2Error, nativeFieldRequiresCreateInputV2, requiresDateTimeMinutePrecision, requiresOwnedSubtableMinimumRows, parseNativeDataFieldsV2, parseNativeDataResourceInvariantsV2, validateNativeDataResourceReferencesV2, } from './data-field.js';
 import { validateNativeDataResourceSurfaceV2 } from './data-surface.js';
 import { nativeFieldSupportsSortV2 } from './field-query-plan.js';
 import { nativeScopeSourceGrantPathSupportedV2, nativeScopeSourceSubjectPathSupportedV2, resolveNativeScopeSourceFieldPathV2, } from './scope-source-field-path.js';
@@ -92,11 +101,10 @@ const WORKFLOW_OPERATIONS = new Set([
     'admin_override',
     'retry_resolution',
 ]);
-const MAX_CONFIG_BYTES = 4 * 1024 * 1024;
-const MAX_CONTRACT_BYTES = 8 * 1024 * 1024;
-const MAX_DEPTH = 40;
-const MAX_NODES = 100000;
-const MAX_STRING_BYTES = 1024 * 1024;
+const MAX_CONFIG_BYTES = NATIVE_ARTIFACT_CAPACITY_V2.configBytes;
+const MAX_CONTRACT_BYTES = NATIVE_ARTIFACT_CAPACITY_V2.contractBytes;
+const MAX_DEPTH = NATIVE_ARTIFACT_CAPACITY_V2.depth;
+const MAX_STRING_BYTES = NATIVE_ARTIFACT_CAPACITY_V2.stringBytes;
 const EVENT_HANDLER_MANIFEST_SCHEMA = 'openxiangda.event-handler-manifest/v2';
 const ROUTE_MANIFEST_SCHEMA = 'openxiangda.application-route-manifest/v3';
 const EVENT_CAPTURE_FIELD_LIMIT = 64;
@@ -108,22 +116,10 @@ const EVENT_AUTHORIZATION_SYSTEM_FIELDS = new Set([
     'created_at',
     'updated_at',
 ]);
-export const NATIVE_CONTRACT_CAPACITY_V2 = Object.freeze({
-    perspectives: 100,
-    resources: 100,
-    subjectReadSurfaces: 50,
-    capabilities: 2000,
-    operations: 500,
-    eventConsumers: 100,
-    eventProducers: 1000,
-    eventSchemas: 100,
-    eventTypes: 500,
-    workflows: 100,
-    routes: 500,
-    adminPages: 500,
-    adminNavigationGroups: 100,
-    adminNavigationItems: 500,
-});
+export { NATIVE_CONTRACT_CAPACITY_V2, requiresExtendedDeclarationCapacity, generatedCrudCapabilityOperations } from './declaration-capacity.js';
+import { NATIVE_CONTRACT_CAPACITY_V2, requiresExtendedDeclarationCapacity } from './declaration-capacity.js';
+export { NATIVE_ARTIFACT_CAPACITY_V2, requiresExtendedArtifactCapacity } from './artifact-capacity.js';
+import { NATIVE_ARTIFACT_CAPACITY_V2, requiresExtendedArtifactCapacity } from './artifact-capacity.js';
 export const DATA_EVENT_TYPES_V2 = [
     'openxiangda.data.record.created.v2',
     'openxiangda.data.record.updated.v2',
@@ -197,8 +193,13 @@ export function compileNativeApplicationConfiguration(input) {
     verifyArtifactDigest(contractSource, expectedContractDigest, '/contractBytes', 'NATIVE_CONTRACT_DIGEST_MISMATCH');
     const parsedConfig = parseCanonicalArtifact(configSource, '/configBytes', 'NATIVE_CONFIG_JSON_INVALID', 'NATIVE_CONFIG_NOT_CANONICAL');
     const parsedContract = parseCanonicalArtifact(contractSource, '/contractBytes', 'NATIVE_CONTRACT_JSON_INVALID', 'NATIVE_CONTRACT_NOT_CANONICAL');
-    inspectJsonBudget(parsedConfig, '/config');
-    inspectJsonBudget(parsedContract, '/contracts');
+    // First enforce all global safety bounds before deriving an extension from
+    // untrusted input. The sealed configuration alone selects the larger budget.
+    inspectJsonBudget(parsedConfig, '/config', NATIVE_ARTIFACT_CAPACITY_V2.extendedNodes);
+    inspectJsonBudget(parsedContract, '/contracts', NATIVE_ARTIFACT_CAPACITY_V2.extendedNodes);
+    if (!requiresExtendedArtifactCapacity(parsedConfig)) {
+        inspectJsonBudget(parsedContract, '/contracts', NATIVE_ARTIFACT_CAPACITY_V2.legacyNodes);
+    }
     const config = parsedConfig;
     const contract = parsedContract;
     validateConfigurationEnvelope(config, appCode);
@@ -287,6 +288,12 @@ export function compileNativeApplicationConfiguration(input) {
  * Derives the platform capability usage closure from the normalized, sealed
  * ConfigurationBundleV3. Manifest declarations are deliberately not an input.
  */
+function workflowUsesOwnedInitialFacts(definition, resources) {
+    const subject = definition.subject;
+    const resource = resources.find(value => value.code === subject?.resourceCode);
+    const projected = new Set(Object.values(subject?.factProjection || {}));
+    return Boolean(resource?.schema?.fields?.some((field) => field.type === 'subtable' && projected.has(field.code)));
+}
 export function compileRequiredPlatformCapabilitiesV3(config) {
     const roles = config.authz.roles;
     const resources = config.data.resources;
@@ -374,6 +381,17 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
         },
     };
     const usages = [
+        ...(requiresExtendedArtifactCapacity(config)
+            ? [{ code: 'application.extended-artifact-capacity',
+                    declaration: NATIVE_ARTIFACT_CAPACITY_V2 }] : []),
+        ...(requiresExtendedDeclarationCapacity(config)
+            ? [{ code: 'application.extended-declaration-capacity', declaration: {
+                        resources: config.data.resources.length, policies: config.authz.dataPolicies.length,
+                        roles: config.authz.roles.length, capabilities: config.authz.capabilities.length,
+                        definitions: config.workflows.definitions.length, bindings: config.workflows.bindings.length,
+                        activations: config.workflows.activations.length, routes: config.frontend.routes.length,
+                        navigationItems: config.frontend.admin.navigation.reduce((count, group) => count + group.items.length, 0),
+                    } }] : []),
         ...(resources.some(resource => resource.uniqueKeys?.length)
             ? [{ code: 'data.unique-keys', declaration: resources.filter(resource => resource.uniqueKeys?.length)
                         .map(resource => ({ code: resource.code, uniqueKeys: resource.uniqueKeys })) }] : []),
@@ -387,6 +405,17 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
         ...(operations.some(operation => operation.platformAccess?.dataCommands)
             ? [{ code: 'data.business-commands', declaration: operations.filter(operation => operation.platformAccess?.dataCommands) }]
             : []),
+        ...(config.authz.dataPolicies.some((policy) => policy.publicRead)
+            ? [{ code: 'data.authenticated-public-projection',
+                    declaration: config.authz.dataPolicies.filter((policy) => policy.publicRead) }]
+            : []),
+        ...(operations.some(operation => operation.platformAccess?.roleAssertions?.actorAuthority)
+            ? [{ code: 'data.transaction-actor-authority',
+                    declaration: operations.filter(operation => operation.platformAccess?.roleAssertions?.actorAuthority) }]
+            : []),
+        ...(operations.some(operation => operation.platformAccess?.workflowStage)
+            ? [{ code: 'workflow.native-stage-guard', declaration: operations.filter(operation => operation.platformAccess?.workflowStage) }]
+            : []),
         ...(operations.some(operation => operation.platformAccess?.recordEdit)
             ? [{ code: 'data.record-edit', declaration: operations.filter(operation => operation.platformAccess?.recordEdit) }]
             : []),
@@ -514,6 +543,9 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
         ...(config.events.capturePolicies?.length
             ? [{ code: 'events.capture-policy', declaration: config.events.capturePolicies }]
             : []),
+        ...(config.events.dateTriggers.some((trigger) => dateEventProjectionFieldsV2(trigger.resourceCode, config.events.subscriptions.filter((subscription) => subscription.eventTypes.includes(trigger.eventType)), config.data.resources.find((resource) => resource.code === trigger.resourceCode)).length > 0)
+            ? [{ code: 'events.date-source-projection', declaration: { triggers: config.events.dateTriggers, subscriptions: config.events.subscriptions } }]
+            : []),
         ...(usesEvents
             ? [
                 { code: 'events-v2', declaration: config.events },
@@ -523,9 +555,25 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
                 },
             ]
             : []),
+        ...(requiresExtendedOwnedSubtableCapacity(config.data.resources)
+            ? [{ code: 'data.extended-owned-subtable-capacity', declaration: config.data.resources.filter((resource) => requiresExtendedOwnedSubtableCapacity([resource])) }] : []),
+        ...(requiresAggregateOwnedSubtableCapacity(config.data.resources)
+            ? [{ code: 'data.aggregate-owned-subtable-capacity', declaration: config.data.resources.filter((resource) => requiresAggregateOwnedSubtableCapacity([resource])) }] : []),
         ...(config.data.resources.some((resource) => resource.schema.fields.some((field) => field.userCandidates !== undefined))
             ? [{ code: 'data.user-candidates', declaration: config.data.resources.filter((resource) => resource.schema.fields.some((field) => field.userCandidates !== undefined)) }]
             : []),
+        ...(requiresWorkflowRoleUnion(config.workflows.bindings)
+            ? [{ code: 'workflow.role-union', declaration: config.workflows.bindings.filter((item) => Object.values(item.binding.bindings).some((entry) => entry.roleCodes !== undefined)) }] : []),
+        ...(config.backend.operations.some((item) => item.platformAccess?.ownedSubject)
+            ? [{ code: 'workflow.named-owned-create', declaration: config.backend.operations.filter((item) => item.platformAccess?.ownedSubject) }] : []),
+        ...(requiresUserCandidateLaunchScope(config.data.resources)
+            ? [{ code: 'data.user-candidate-launch-scope', declaration: config.data.resources.filter((resource) => requiresUserCandidateLaunchScope([resource])) }]
+            : []),
+        ...(requiresOwnedSubtableMinimumRows(config.data.resources)
+            ? [{ code: 'data.subtable-minimum-rows', declaration: config.data.resources.filter((resource) => requiresOwnedSubtableMinimumRows([resource])) }] : []),
+        ...(requiresDateTimeMinutePrecision(config.data.resources)
+            ? [{ code: 'data.datetime-minute-precision', declaration: config.data.resources.filter((resource) => requiresDateTimeMinutePrecision([resource])) }]
+            : []),
         ...(config.workflows.activations.length
             ? [
                 {
@@ -559,10 +607,23 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
                         definitions: config.workflows.definitions.filter((item) => item.definition.commandHandlers !== undefined),
                         operations: operations.filter(operation => operation.platformAccess?.workflow?.businessCommands),
                     } }] : []),
+        ...(config.workflows.definitions.some((item) => item.definition.commandHandlers?.resubmit) || operations.some(operation => operation.platformAccess?.workflow?.businessCommands?.includes('resubmit'))
+            ? [{ code: 'workflow.correction-business-command', declaration: {
+                        definitions: config.workflows.definitions.filter((item) => item.definition.commandHandlers?.resubmit),
+                        operations: operations.filter(operation => operation.platformAccess?.workflow?.businessCommands?.includes('resubmit')),
+                    } }] : []),
         ...(config.workflows.definitions.some((item) => item.definition.launchPreflight !== undefined)
             ? [{ code: 'workflow.launch-preflight', declaration: config.workflows.definitions.filter((item) => item.definition.launchPreflight !== undefined) }] : []),
+        ...(config.workflows.definitions.some((item) => item.definition.approvedDelegation !== undefined)
+            ? [{ code: 'workflow.approved-delegation', declaration: config.workflows.definitions.filter((item) => item.definition.approvedDelegation !== undefined) }] : []),
+        ...(config.workflows.definitions.some((item) => workflowUsesOwnedInitialFacts(item.definition, config.data.resources))
+            ? [{ code: 'workflow.owned-initial-facts', declaration: config.workflows.definitions.filter((item) => workflowUsesOwnedInitialFacts(item.definition, config.data.resources)) }] : []),
+        ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'correction'))
+            ? [{ code: 'workflow.initiator-correction', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'correction')) }] : []),
         ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.operationPolicy?.reject?.commentRequired === false))
             ? [{ code: 'workflow.optional-rejection-comment', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.operationPolicy?.reject?.commentRequired === false)) }] : []),
+        ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => Object.values(node.operationPolicy || {}).some((policy) => policy.reasonRequired === false)))
+            ? [{ code: 'workflow.optional-operation-reason', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => Object.values(node.operationPolicy || {}).some((policy) => policy.reasonRequired === false))) }] : []),
         ...(namedInputSourceDefinitions.length
             ? [{ code: 'workflow.named-input-sources', declaration: namedInputSourceDefinitions }]
             : []),
@@ -572,6 +633,9 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
         ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'approval' && node.emptyPolicy !== undefined))
             ? [{ code: 'workflow.approval-empty-policy', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'approval' && node.emptyPolicy !== undefined)) }]
             : []),
+        ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.completionDeadline !== undefined))
+            ? [{ code: 'workflow.completion-deadline', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.completionDeadline !== undefined)) }]
+            : []),
         ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.initiatorApprovalPolicy !== undefined))
             ? [{ code: 'workflow.initiator-approval-policy', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.initiatorApprovalPolicy !== undefined)) }]
             : []),
@@ -592,6 +656,9 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
         ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'action'))
             ? [{ code: 'workflow.durable-business-step', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'action')) }]
             : []),
+        ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'action' && node.handler.dataTransaction))
+            ? [{ code: 'workflow.step-data-transaction', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'action' && node.handler.dataTransaction)) }]
+            : []),
         ...(config.workflows.bindings.some((item) => Object.values(item.binding.bindings).some((entry) => entry.routing !== undefined))
             ? [{ code: 'workflow.assignment-routing', declaration: config.workflows.bindings.filter((item) => Object.values(item.binding.bindings).some((entry) => entry.routing !== undefined)) }]
             : []),
@@ -854,13 +921,13 @@ function validateConfigurationEnvelope(config, appCode) {
         'dataPolicies',
         'authorizationTransitions',
     ], '/config/authz', ['authenticatedUserRoleCode']);
-    boundedArray(authz.capabilities, '/config/authz/capabilities', 2000);
-    boundedArray(authz.roles, '/config/authz/roles', 100);
+    boundedArray(authz.capabilities, '/config/authz/capabilities', NATIVE_CONTRACT_CAPACITY_V2.capabilities);
+    boundedArray(authz.roles, '/config/authz/roles', NATIVE_CONTRACT_CAPACITY_V2.roles);
     boundedArray(authz.scopeDimensions, '/config/authz/scopeDimensions', 100);
     boundedArray(authz.scopeSources, '/config/authz/scopeSources', 100);
     boundedArray(authz.roleMembershipSources, '/config/authz/roleMembershipSources', 100);
     boundedArray(authz.relationshipGrantSources, '/config/authz/relationshipGrantSources', 100);
-    boundedArray(authz.dataPolicies, '/config/authz/dataPolicies', 100);
+    boundedArray(authz.dataPolicies, '/config/authz/dataPolicies', NATIVE_CONTRACT_CAPACITY_V2.dataPolicies);
     boundedArray(authz.authorizationTransitions, '/config/authz/authorizationTransitions', 100);
     const backend = object(config.backend, '/config/backend');
     exactKeys(backend, ['secrets', 'operations'], '/config/backend');
@@ -873,7 +940,7 @@ function validateConfigurationEnvelope(config, appCode) {
         'subjectReadSurfaces',
         'concurrency',
     ]);
-    boundedArray(data.resources, '/config/data/resources', 100);
+    boundedArray(data.resources, '/config/data/resources', NATIVE_CONTRACT_CAPACITY_V2.resources);
     if (data.subjectReadSurfaces !== undefined) {
         boundedArray(data.subjectReadSurfaces, '/config/data/subjectReadSurfaces', NATIVE_CONTRACT_CAPACITY_V2.subjectReadSurfaces);
     }
@@ -894,14 +961,14 @@ function validateConfigurationEnvelope(config, appCode) {
         'providers',
         'editableParameters',
     ], '/config/workflows');
-    boundedArray(workflows.definitions, '/config/workflows/definitions', 100);
-    boundedArray(workflows.bindings, '/config/workflows/bindings', 100);
-    boundedArray(workflows.activations, '/config/workflows/activations', 100);
+    boundedArray(workflows.definitions, '/config/workflows/definitions', NATIVE_CONTRACT_CAPACITY_V2.workflows);
+    boundedArray(workflows.bindings, '/config/workflows/bindings', NATIVE_CONTRACT_CAPACITY_V2.workflows);
+    boundedArray(workflows.activations, '/config/workflows/activations', NATIVE_CONTRACT_CAPACITY_V2.workflows);
     boundedArray(workflows.providers, '/config/workflows/providers', 100);
     boundedArray(workflows.editableParameters, '/config/workflows/editableParameters', 100);
     const frontend = object(config.frontend, '/config/frontend');
     exactKeys(frontend, ['routes', 'user', 'admin', 'devicePolicy'], '/config/frontend', ['authentication', 'publicAccess']);
-    boundedArray(frontend.routes, '/config/frontend/routes', 500);
+    boundedArray(frontend.routes, '/config/frontend/routes', NATIVE_CONTRACT_CAPACITY_V2.routes);
     const user = object(frontend.user, '/config/frontend/user');
     exactKeys(user, ['applicationTodoCenter'], '/config/frontend/user');
     boolean(user.applicationTodoCenter, '/config/frontend/user/applicationTodoCenter');
@@ -1609,6 +1676,12 @@ function compileOperations(config) {
         const code = stableCode(operation.code, `${pointer}/code`);
         validateBackendOperationAi(operation.ai, pointer, code, method, declaredResourceCodes);
         const platformAccess = validateOperationPlatformAccess(operation.platformAccess, `${pointer}/platformAccess`, declaredResources, declaredResourceFields, declaredWorkflowCodes, new Set(config.authz.roles.map((role) => String(role.code))));
+        if (platformAccess?.workflowStage) {
+            const stage = platformAccess.workflowStage;
+            const workflow = config.workflows.definitions.find((entry) => entry.definition.code === stage.workflowCode);
+            if (!workflow || workflow.definition.subject?.resourceCode !== stage.resourceCode || stage.runningNodeIds.some((id) => !workflow.definition.nodes[id]))
+                fail('NATIVE_WORKFLOW_STAGE_NODE_INVALID', `${pointer}/platformAccess/workflowStage/runningNodeIds`);
+        }
         if (platformAccess?.recordEdit) {
             const owner = config.data.resources.find((item) => item.code === platformAccess.recordEdit.resourceCode);
             if (owner?.surface?.mutationOwner !== 'action')
@@ -1814,7 +1887,7 @@ function validateOperationPlatformAccess(value, pointer, declaredResources, decl
     if (value === undefined)
         return null;
     const access = object(value, pointer);
-    exactKeys(access, ['directory', 'managedFiles', 'managedFileCopies', 'notification', 'workflow', 'roleAssertions', 'decimalReservation', 'dataCommands', 'recordEdit'], pointer, true);
+    exactKeys(access, ['directory', 'managedFiles', 'managedFileCopies', 'notification', 'workflow', 'roleAssertions', 'decimalReservation', 'dataCommands', 'recordEdit', 'ownedSubject', 'workflowStage'], pointer, true);
     if (Object.keys(access).length === 0) {
         fail('NATIVE_OPERATION_PLATFORM_ACCESS_EMPTY', pointer);
     }
@@ -1825,6 +1898,19 @@ function validateOperationPlatformAccess(value, pointer, declaredResources, decl
         equal(commands.mode, 'recoverable-native', `${pointer}/dataCommands/mode`);
         result.dataCommands = { mode: 'recoverable-native' };
     }
+    if (access.workflowStage !== undefined) {
+        try {
+            assertWorkflowNativeStagePolicy(access.workflowStage);
+        }
+        catch {
+            fail('NATIVE_WORKFLOW_STAGE_DECLARATION_INVALID', `${pointer}/workflowStage`);
+        }
+        const stage = access.workflowStage;
+        if (!result.dataCommands || access.decimalReservation !== undefined || !declaredResources.has(stage.resourceCode) ||
+            !declaredWorkflowCodes.has(stage.workflowCode) || !access.workflow?.codes?.includes(stage.workflowCode))
+            fail('NATIVE_WORKFLOW_STAGE_DECLARATION_INVALID', `${pointer}/workflowStage`);
+        result.workflowStage = { ...stage, runningNodeIds: uniqueSorted([...stage.runningNodeIds]), allowedStatuses: uniqueSorted([...stage.allowedStatuses]) };
+    }
     if (access.recordEdit !== undefined) {
         const entryPointer = `${pointer}/recordEdit`;
         const entry = object(access.recordEdit, entryPointer);
@@ -1843,7 +1929,9 @@ function validateOperationPlatformAccess(value, pointer, declaredResources, decl
     }
     if (access.roleAssertions !== undefined) {
         const assertions = object(access.roleAssertions, `${pointer}/roleAssertions`);
-        exactKeys(assertions, ['roleCodes'], `${pointer}/roleAssertions`);
+        exactKeys(assertions, ['roleCodes', 'actorAuthority'], `${pointer}/roleAssertions`, true);
+        if (assertions.actorAuthority !== undefined)
+            equal(assertions.actorAuthority, true, `${pointer}/roleAssertions/actorAuthority`);
         const codes = uniqueStrings(assertions.roleCodes, `${pointer}/roleAssertions/roleCodes`, 20);
         if (!codes.length)
             fail('NATIVE_OPERATION_ROLE_ASSERTIONS_REQUIRED', `${pointer}/roleAssertions/roleCodes`);
@@ -1851,7 +1939,8 @@ function validateOperationPlatformAccess(value, pointer, declaredResources, decl
             if (!declaredRoleCodes.has(code))
                 fail('NATIVE_ROLE_REFERENCE_MISSING', `${pointer}/roleAssertions/roleCodes/${index}`);
         });
-        result.roleAssertions = { roleCodes: uniqueSorted(codes) };
+        result.roleAssertions = { roleCodes: uniqueSorted(codes),
+            ...(assertions.actorAuthority === true ? { actorAuthority: true } : {}) };
     }
     if (access.directory !== undefined) {
         const directory = object(access.directory, `${pointer}/directory`);
@@ -1964,12 +2053,33 @@ function validateOperationPlatformAccess(value, pointer, declaredResources, decl
         if (!codes.length || codes.some(code => !declaredWorkflowCodes.has(code))) {
             fail('NATIVE_OPERATION_WORKFLOW_CODE_INVALID', `${pointer}/workflow/codes`);
         }
-        const businessCommands = workflow.businessCommands === undefined ? undefined : uniqueStrings(workflow.businessCommands, `${pointer}/workflow/businessCommands`, 3);
-        if (businessCommands && (!businessCommands.length || businessCommands.some(command => !['approve', 'reject', 'withdraw'].includes(command)))) {
+        const businessCommands = workflow.businessCommands === undefined ? undefined : uniqueStrings(workflow.businessCommands, `${pointer}/workflow/businessCommands`, 4);
+        if (businessCommands && (!businessCommands.length || businessCommands.some(command => !['approve', 'reject', 'withdraw', 'resubmit'].includes(command)))) {
             fail('NATIVE_OPERATION_WORKFLOW_BUSINESS_COMMAND_INVALID', `${pointer}/workflow/businessCommands`);
         }
         result.workflow = { codes: uniqueSorted(codes), ...(businessCommands ? { businessCommands: uniqueSorted(businessCommands) } : {}) };
     }
+    if (access.ownedSubject !== undefined) {
+        const entryPointer = `${pointer}/ownedSubject`;
+        const grant = access.ownedSubject;
+        try {
+            assertWorkflowOwnedSubjectCreate(grant);
+        }
+        catch {
+            fail('NATIVE_WORKFLOW_OWNED_SUBJECT_INVALID', entryPointer);
+        }
+        if (!result.workflow || access.decimalReservation !== undefined)
+            fail('NATIVE_WORKFLOW_OWNED_SUBJECT_INVALID', entryPointer);
+        try {
+            assertWorkflowOwnedSubjectCreateResources(grant, declaredResourceFields, result.managedFiles || []);
+        }
+        catch (error) {
+            fail(`NATIVE_${error.message}`, entryPointer);
+        }
+        result.ownedSubject = { mode: 'create', resourceCode: grant.resourceCode, subtables: sorted(grant.subtables.map(table => ({
+                fieldCode: table.fieldCode, fieldCodes: uniqueSorted([...table.fieldCodes]),
+            })), table => table.fieldCode) };
+    }
     if (access.decimalReservation !== undefined) {
         const reservationPointer = `${pointer}/decimalReservation`;
         const reservation = object(access.decimalReservation, reservationPointer);
@@ -2933,6 +3043,8 @@ function compileAdminNavigation(config) {
 }
 function validateAdminNavigationDeclaration(value, pointer) {
     const groups = boundedArray(value, pointer, NATIVE_CONTRACT_CAPACITY_V2.adminNavigationGroups);
+    if (groups.reduce((count, group) => count + (Array.isArray(group?.items) ? group.items.length : 0), 0) > NATIVE_CONTRACT_CAPACITY_V2.adminNavigationItems)
+        fail('NATIVE_ARRAY_LIMIT_EXCEEDED', pointer);
     let itemCount = 0;
     groups.forEach((rawGroup, groupIndex) => {
         const groupPointer = `${pointer}/${groupIndex}`;
@@ -3073,6 +3185,8 @@ function validateAdminPageContracts(value, pointer) {
 }
 function validateAdminNavigationContracts(value, pointer) {
     const groups = boundedArray(value, pointer, NATIVE_CONTRACT_CAPACITY_V2.adminNavigationGroups);
+    if (groups.reduce((count, group) => count + (Array.isArray(group?.items) ? group.items.length : 0), 0) > NATIVE_CONTRACT_CAPACITY_V2.adminNavigationItems)
+        fail('NATIVE_ARRAY_LIMIT_EXCEEDED', pointer);
     let itemCount = 0;
     groups.forEach((rawGroup, groupIndex) => {
         const groupPointer = `${pointer}/${groupIndex}`;
@@ -3594,6 +3708,9 @@ function compileWorkflowLaunchContract(config, definition, value, pointer, opera
         const fieldCodes = new Set();
         const sourceCounts = new Map();
         const normalizedInputs = {};
+        const ownedSubject = operationContract.platformAccess?.ownedSubject;
+        if (ownedSubject && (intentKind !== 'create' || ownedSubject.resourceCode !== subjectResourceCode))
+            fail('NATIVE_WORKFLOW_OWNED_SUBJECT_LAUNCH_MISMATCH', intentPointer);
         for (const [inputCode, rawBinding] of inputEntries) {
             if (!PROPERTY_CODE_PATTERN.test(inputCode) ||
                 !Object.prototype.hasOwnProperty.call(requestProperties, inputCode)) {
@@ -3620,6 +3737,9 @@ function compileWorkflowLaunchContract(config, definition, value, pointer, opera
                     fail('NATIVE_WORKFLOW_NAMED_OPERATION_INPUT_INVALID', `${bindingPointer}/fieldCode`);
                 }
                 fieldCodes.add(fieldCode);
+                const field = subjectResource.schema.fields.find((item) => item.code === fieldCode);
+                if (field?.type === 'subtable' && (!ownedSubject || !ownedSubject.subtables.some((table) => table.fieldCode === fieldCode)))
+                    fail('NATIVE_WORKFLOW_OWNED_SUBJECT_LAUNCH_REQUIRED', bindingPointer);
                 normalizedInputs[inputCode] = { source, fieldCode };
             }
             else {
@@ -4075,6 +4195,7 @@ function validateDataPolicyReferences(config) {
             'name',
             'resourceCode',
             'unrestrictedRoleCodes',
+            'publicRead',
             'operations',
             'matchMode',
             'rules',
@@ -4106,6 +4227,26 @@ function validateDataPolicyReferences(config) {
         if (hasReadExpression && !policyFields) {
             fail('NATIVE_DATA_POLICY_RESOURCE_MISSING', `${pointer}/resourceCode`);
         }
+        if (policy.publicRead !== undefined) {
+            try {
+                const baseline = config.authz.roles.find((role) => role.code === authenticatedUserRoleCode);
+                validateAuthenticatedPublicRead({ policy,
+                    resource: config.data.resources.find((resource) => resource.code === policyResourceCode),
+                    baselineRoleCode: authenticatedUserRoleCode,
+                    baselineCapabilities: baseline?.capabilities || [],
+                    baselineDeniedCapabilities: baseline?.deniedCapabilities || [], pointer });
+            }
+            catch (error) {
+                if (!(error instanceof AuthenticatedPublicReadContractError))
+                    throw error;
+                fail(error.code, error.pointer);
+            }
+            if (!(policy.unrestrictedRoleCodes || []).includes(authenticatedUserRoleCode))
+                fail('AUTHENTICATED_PUBLIC_READ_CANONICAL_BASELINE_MISSING', `${pointer}/unrestrictedRoleCodes`);
+        }
+        else if (authenticatedUserRoleCode && (policy.unrestrictedRoleCodes || []).includes(authenticatedUserRoleCode)) {
+            fail('NATIVE_DATA_POLICY_BASELINE_UNRESTRICTED', `${pointer}/unrestrictedRoleCodes`);
+        }
         const unrestrictedRoleCodes = uniqueStrings(policy.unrestrictedRoleCodes || [], `${pointer}/unrestrictedRoleCodes`, 100);
         if (policy.unrestrictedRoleCodes !== undefined &&
             unrestrictedRoleCodes.length === 0) {
@@ -4482,12 +4623,15 @@ function validateWorkflowReferences(config) {
         const preflightErrors = validateWorkflowLaunchPreflight(definition);
         if (preflightErrors.length)
             fail(preflightErrors[0], `${pointer}/definition/launchPreflight`);
+        const delegationErrors = validateWorkflowApprovedDelegation(definition);
+        if (delegationErrors.length)
+            fail(delegationErrors[0], `${pointer}/definition/approvedDelegation`);
         const businessCommandErrors = validateWorkflowCommandHandlers(definition, config.backend.operations);
         if (businessCommandErrors.length)
             fail(businessCommandErrors[0], `${pointer}/definition/commandHandlers`);
         validateWorkflowSubject(definition.subject, resources, `${pointer}/definition/subject`);
         const taskPageErrors = validateWorkflowTaskPages(definition, new Map((resources.get(definition.subject.resourceCode)?.schema.fields || [])
-            .map((field) => [field.code, { ...resources.get(definition.subject.resourceCode)?.surface?.fields?.[field.code], ...field, system: ['id', 'revision', 'createdAt', 'updatedAt', 'createdBy', 'updatedBy'].includes(field.code) }])), new Map([...resources].map(([code, resource]) => [code, new Map(resource.schema.fields.map((field) => [field.code, { ...resource.surface?.fields?.[field.code], ...field, system: ['id', 'revision', 'createdAt', 'updatedAt', 'createdBy', 'updatedBy'].includes(field.code) }]))])));
+            .map((field) => [field.code, { ...resources.get(definition.subject.resourceCode)?.surface?.fields?.[field.code], ...field, system: ['id', 'revision', 'createdAt', 'updatedAt', 'createdBy', 'updatedBy'].includes(field.code) }])), new Map([...resources].map(([code, resource]) => [code, new Map(resource.schema.fields.map((field) => [field.code, { ...resource.surface?.fields?.[field.code], ...field, system: ['id', 'revision', 'createdAt', 'updatedAt', 'createdBy', 'updatedBy'].includes(field.code) }]))])), dataOwnedRowLimit(resources.get(definition.subject.resourceCode)?.schema || {}));
         if (taskPageErrors.length)
             fail(taskPageErrors[0], `${pointer}/definition/taskPages`);
         const policyErrors = validateWorkflowInstanceCommandPolicies(definition, {
@@ -4723,7 +4867,7 @@ function validateWorkflowDefinition(definition, pointer) {
         'startAt',
         'inputSchema',
         'nodes',
-    ], pointer, ['organizationContext', 'instanceCommands', 'readability', 'taskPages', 'rejectionNotification', 'commandHandlers', 'launchPreflight']);
+    ], pointer, ['organizationContext', 'instanceCommands', 'readability', 'taskPages', 'rejectionNotification', 'commandHandlers', 'launchPreflight', 'approvedDelegation']);
     equal(definition.schemaVersion, 'openxiangda.workflow-definition/v2', `${pointer}/schemaVersion`);
     workflowCodeValue(definition.code, `${pointer}/code`);
     requiredString(definition.title, `${pointer}/title`, 255);
@@ -4748,6 +4892,9 @@ function validateWorkflowDefinition(definition, pointer) {
     const initiatorPolicyErrors = validateWorkflowInitiatorApprovalPolicy(definition);
     if (initiatorPolicyErrors.length)
         fail(initiatorPolicyErrors[0], `${pointer}/nodes`);
+    const deadlineErrors = validateWorkflowCompletionDeadlines(definition);
+    if (deadlineErrors.length)
+        fail(deadlineErrors[0], `${pointer}/nodes`);
     const rejectionNotificationErrors = validateWorkflowRejectionNotification(definition);
     if (rejectionNotificationErrors.length)
         fail(rejectionNotificationErrors[0], `${pointer}/rejectionNotification`);
@@ -4767,7 +4914,7 @@ function validateWorkflowDefinition(definition, pointer) {
         const nodePointer = `${pointer}/nodes/${nodeId}`;
         const node = object(rawNode, nodePointer);
         equal(node.id, nodeId, `${nodePointer}/id`);
-        if (!['approval', 'condition', 'end', 'cc', 'action'].includes(node.kind)) {
+        if (!['approval', 'condition', 'end', 'cc', 'action', 'correction'].includes(node.kind)) {
             fail('NATIVE_WORKFLOW_NODE_KIND_INVALID', `${nodePointer}/kind`);
         }
         const targets = [];
@@ -4789,6 +4936,11 @@ function validateWorkflowDefinition(definition, pointer) {
                 }
             }
         }
+        else if (node.kind === 'correction') {
+            const errors = validateWorkflowCorrections(definition);
+            if (errors.length)
+                fail(errors[0], nodePointer);
+        }
         else if (node.kind === 'action') {
             targets.push(requiredString(node.next, `${nodePointer}/next`, 128));
         }
@@ -4833,6 +4985,13 @@ function validateWorkflowDefinition(definition, pointer) {
         visiting.delete(nodeId);
     };
     walk(startAt);
+    for (const id of [...reachable]) {
+        const current = nodes[id];
+        if (current?.kind === 'approval')
+            for (const target of current.returnTargets || [])
+                if (nodes[target]?.kind === 'correction')
+                    reachable.add(target);
+    }
     if (reachable.size !== nodeIds.length) {
         fail('NATIVE_WORKFLOW_NODE_UNREACHABLE', `${pointer}/nodes`);
     }
@@ -4879,6 +5038,9 @@ function validateWorkflowBinding(binding, pointer) {
     for (const [code, raw] of Object.entries(entries)) {
         workflowBindingCode(code, `${pointer}/bindings/${code}`);
         const entry = object(raw, `${pointer}/bindings/${code}`);
+        const unionErrors = validateWorkflowRoleUnion(entry);
+        if (unionErrors.length)
+            fail(unionErrors[0], `${pointer}/bindings/${code}/roleCodes`);
         const provider = requiredString(entry.provider, `${pointer}/bindings/${code}/provider`, 64);
         if (![
             'fixed_users',
@@ -4903,7 +5065,7 @@ function validateWorkflowBinding(binding, pointer) {
         if (['input_users', 'form_field_users'].includes(provider)) {
             requiredString(entry.inputPath, `${pointer}/bindings/${code}/inputPath`, 255);
         }
-        if (['app_role', 'app_role_in_scope', 'initiator_select'].includes(provider)) {
+        if (['app_role', 'app_role_in_scope', 'initiator_select'].includes(provider) && entry.roleCodes === undefined) {
             stableCode(entry.roleCode, `${pointer}/bindings/${code}/roleCode`);
         }
         if (provider === 'department_supervisor') {
@@ -4952,13 +5114,13 @@ function mergeUserSurfaceRoutes(expectedContract, contract, config) {
     const manifest = object(contract.routeManifest, '/contracts/routeManifest');
     const expectedManifest = object(expectedContract.routeManifest, '/contracts/routeManifest');
     const resources = new Map();
-    for (const raw of boundedArray(config.data?.resources, '/config/data/resources', 100)) {
+    for (const raw of boundedArray(config.data?.resources, '/config/data/resources', NATIVE_CONTRACT_CAPACITY_V2.resources)) {
         const resource = object(raw, '/config/data/resources');
         resources.set(String(resource.code || ''), resource);
     }
-    const existingCodes = new Set(boundedArray(expectedManifest.routes, '/contracts/routeManifest/routes', 1000).map(entry => String(object(entry, '/contracts/routeManifest/routes').code || '')));
+    const existingCodes = new Set(boundedArray(expectedManifest.routes, '/contracts/routeManifest/routes', NATIVE_CONTRACT_CAPACITY_V2.routes).map(entry => String(object(entry, '/contracts/routeManifest/routes').code || '')));
     const accepted = [];
-    for (const rawEntry of boundedArray(manifest.routes, '/contracts/routeManifest/routes', 1000)) {
+    for (const rawEntry of boundedArray(manifest.routes, '/contracts/routeManifest/routes', NATIVE_CONTRACT_CAPACITY_V2.routes)) {
         const entry = object(rawEntry, '/contracts/routeManifest/routes');
         const kind = String(entry.kind || '');
         if (kind !== 'resource-records' && kind !== 'resource-submit')
@@ -5036,7 +5198,9 @@ function validateResource(raw, pointer, appCode) {
     const code = resourceCode(resource.code, `${pointer}/code`);
     const name = requiredString(resource.name, `${pointer}/name`, 255);
     const schema = object(resource.schema, `${pointer}/schema`);
-    exactKeys(schema, ['fields'], `${pointer}/schema`);
+    exactKeys(schema, ['fields', 'ownedRowLimit'], `${pointer}/schema`, true);
+    if (schema.ownedRowLimit !== undefined && !isDataOwnedRowLimit(schema.ownedRowLimit))
+        fail('NATIVE_DATA_OWNED_ROW_LIMIT_INVALID', `${pointer}/schema/ownedRowLimit`);
     let fields;
     let invariants;
     let decimalReservationLifecycle;
@@ -5115,7 +5279,7 @@ function validateResource(raw, pointer, appCode) {
         ...resource,
         code,
         name,
-        schema: { fields },
+        schema: { fields, ...(schema.ownedRowLimit !== undefined ? { ownedRowLimit: schema.ownedRowLimit } : {}) },
         ...(resource.invariants === undefined ? {} : { invariants }),
         ...(decimalReservationLifecycle ? { decimalReservationLifecycle } : {}),
         ...(uniqueKeys !== undefined ? { uniqueKeys } : {}),
@@ -5160,11 +5324,11 @@ function parseCanonicalArtifact(source, pointer, invalidCode, canonicalCode) {
         fail(canonicalCode, pointer);
     return result;
 }
-function inspectJsonBudget(value, pointer) {
+function inspectJsonBudget(value, pointer, maxNodes) {
     let nodes = 0;
     const visit = (current, path, depth) => {
         nodes += 1;
-        if (nodes > MAX_NODES)
+        if (nodes > maxNodes)
             fail('NATIVE_ARTIFACT_NODE_LIMIT_EXCEEDED', path);
         if (depth > MAX_DEPTH)
             fail('NATIVE_ARTIFACT_DEPTH_LIMIT_EXCEEDED', path);