openxiangda-contracts 2.78.0 → 2.81.0

package/dist/native-compiler/compiler.js

@@ -1,3 +1,10 @@
+import { compileApplicationAgentsV2 } from './application-agent.js';
+import { validateWorkflowSupervisorChains, validateWorkflowSupervisorChainBinding } from './workflow-supervisor-chain.js';
+import { validateWorkflowReminders } from './workflow-reminders.js';
+import { isWorkflowPlatformNotify } from './workflow-platform-notify.js';
+import { validateWorkflowParallel } from './workflow-parallel.js';
+import { validateWorkflowReturnPolicies, workflowReturnTargets } from './workflow-return-policy.js';
+import { validateWorkflowHandlingNodes } from './workflow-handle.js';
 import { normalizeDataMutationGrants } from './service-mutations.js';
 import { hasNativeParentReadPolicy, resolveNativeParentReadBinding, validateNativeParentReadPolicies, NativeParentReadPolicyError } from './parent-read-policy.js';
 import { requiresExtendedFieldCapacity, WORKFLOW_LAUNCH_MAX_INPUTS } from './data-capacity.js';
@@ -26,7 +33,7 @@ import { validateWorkflowCorrections } from './workflow-correction.js';
 import { dateEventProjectionFieldsV2 } from './date-event-projection.js';
 import { validateWorkflowTaskPages } from './workflow-task-page.js';
 import { requiresExtendedOwnedSubtableCapacity, requiresAggregateOwnedSubtableCapacity, dataOwnedRowLimit, isDataOwnedRowLimit } from './data-capacity.js';
-import { validateWorkflowBusinessSteps, compileWorkflowBusinessStepHandlers, validateWorkflowBusinessStepSubscriptions, WORKFLOW_BUSINESS_STEP_EVENT, WORKFLOW_BUSINESS_STEP_EVENTS } from './workflow-business-step.js';
+import { validateWorkflowBusinessSteps, compileWorkflowBusinessStepHandlers, validateWorkflowBusinessStepSubscriptions } from './workflow-business-step.js';
 import { validateWorkflowAssignmentRoutingBindings, validateWorkflowAssignmentRoutingPolicy } from './workflow-assignment-routing.js';
 import { requiresWorkflowRoleUnion, validateWorkflowRoleUnion, requiresWorkflowRoleInputSelection, validateWorkflowRoleInputSelection } from './workflow-role-union.js';
 import { assertWorkflowOwnedSubjectCreate, assertWorkflowOwnedSubjectCreateResources } from './workflow-owned-subject.js';
@@ -91,6 +98,8 @@ const ADMIN_NAVIGATION_ICONS = new Set([
     'settings',
 ]);
 const WORKFLOW_OPERATIONS = new Set([
+    'complete',
+    'save_form',
     'approve',
     'reject',
     'return',
@@ -128,46 +137,8 @@ export const DATA_EVENT_TYPES_V2 = [
     'openxiangda.data.record.updated.v2',
     'openxiangda.data.record.deleted.v2',
 ];
-export const WORKFLOW_EVENT_TYPES_V2 = [
-    'openxiangda.workflow.node.skipped.v2',
-    WORKFLOW_BUSINESS_STEP_EVENT,
-    'openxiangda.workflow.step.result_received.v2',
-    'openxiangda.workflow.step.completed.v2',
-    'openxiangda.workflow.step.continuation_failed.v2',
-    'openxiangda.workflow.instance.started.v2',
-    'openxiangda.workflow.instance.cc_added.v2',
-    'openxiangda.workflow.instance.completed.v2',
-    'openxiangda.workflow.instance.rejected.v2',
-    'openxiangda.workflow.instance.returned.v2',
-    'openxiangda.workflow.instance.resumed.v2',
-    'openxiangda.workflow.instance.withdrawn.v2',
-    'openxiangda.workflow.instance.terminated.v2',
-    'openxiangda.workflow.task.created.v2',
-    'openxiangda.workflow.task.assigned.v2',
-    'openxiangda.workflow.task.assignment_pending.v2',
-    'openxiangda.workflow.task.assignment_resolution_failed.v2',
-    'openxiangda.workflow.task.approved.v2',
-    'openxiangda.workflow.task.completed.v2',
-    'openxiangda.workflow.task.rejected.v2',
-    'openxiangda.workflow.task.returned.v2',
-    'openxiangda.workflow.task.resubmitted.v2',
-    'openxiangda.workflow.task.transferred.v2',
-    'openxiangda.workflow.task.reassigned.v2',
-    'openxiangda.workflow.task.delegated.v2',
-    'openxiangda.workflow.task.assignee_added.v2',
-    'openxiangda.workflow.task.cancelled.v2',
-    'openxiangda.workflow.participant.activated.v2',
-    'openxiangda.workflow.participant.completed.v2',
-    'openxiangda.workflow.participant.rejected.v2',
-    'openxiangda.workflow.participant.returned.v2',
-    'openxiangda.workflow.participant.transferred.v2',
-    'openxiangda.workflow.participant.reassigned.v2',
-    'openxiangda.workflow.participant.delegated.v2',
-    'openxiangda.workflow.participant.added.v2',
-    'openxiangda.workflow.participant.suspended.v2',
-    'openxiangda.workflow.participant.resumed.v2',
-    'openxiangda.workflow.participant.cancelled.v2',
-];
+export { WORKFLOW_EVENT_TYPES_V2 } from './workflow-events.js';
+import { WORKFLOW_EVENT_TYPES_V2, workflowProducedEventTypes } from './workflow-events.js';
 const WORKFLOW_EVENT_TYPE_SET_V2 = new Set(WORKFLOW_EVENT_TYPES_V2);
 export class NativeConfigurationCompilerError extends Error {
     code;
@@ -400,6 +371,7 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
         ...(requiresHighDensityArtifactCapacity(config)
             ? [{ code: 'application.high-density-artifact-capacity',
                     declaration: NATIVE_HIGH_DENSITY_ARTIFACT_CAPACITY_V2 }] : []),
+        ...(config.agents?.length ? [{ code: 'application.source-agents', declaration: config.agents }] : []),
         ...(requiresExtendedDeclarationCapacity(config)
             ? [{ code: 'application.extended-declaration-capacity', declaration: {
                         resources: config.data.resources.length, policies: config.authz.dataPolicies.length,
@@ -493,6 +465,11 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
         ...(resources.some(hasDataAuditReadPolicy)
             ? [{ code: 'data.audit-read-access', declaration: dataUsage }]
             : []),
+        ...(resources.some(resource => resource.schema.fields.some((field) => /^(resource-ref|user|department)\.(single|multiple)$/.test(field.type))) || config.authz.scopeDimensions.some((dimension) => dimension.valueSource)
+            ? [{ code: 'data.field-source-contexts', declaration: {
+                        resources: resources.map(resource => ({ code: resource.code, fields: resource.schema.fields.filter((field) => /^(resource-ref|user|department)\.(single|multiple)$/.test(field.type)) })),
+                        dimensions: config.authz.scopeDimensions.filter((dimension) => dimension.valueSource),
+                    } }] : []),
         ...(requiresDirectoryV2
             ? [
                 {
@@ -664,6 +641,14 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
         ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'approval' && node.emptyPolicy !== undefined))
             ? [{ code: 'workflow.approval-empty-policy', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'approval' && node.emptyPolicy !== undefined)) }]
             : []),
+        ...(config.workflows.bindings.some((item) => Object.values(item.binding.bindings).some((entry) => entry.provider === 'supervisor_chain')) ? [{ code: 'workflow.supervisor-chain', declaration: config.workflows.bindings.filter((item) => Object.values(item.binding.bindings).some((entry) => entry.provider === 'supervisor_chain')) }] : []),
+        ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.reminders)) ? [{ code: 'workflow.reminders', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.reminders)) }] : []),
+        ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => isWorkflowPlatformNotify(node)))
+            ? [{ code: 'workflow.platform-notify', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => isWorkflowPlatformNotify(node))) }] : []),
+        ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.returnPolicy !== undefined))
+            ? [{ code: 'workflow.return-policy', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.returnPolicy !== undefined)) }] : []),
+        ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'handle'))
+            ? [{ code: 'workflow.handling-nodes', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'handle')) }] : []),
         ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.completionDeadline !== undefined))
             ? [{ code: 'workflow.completion-deadline', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.completionDeadline !== undefined)) }]
             : []),
@@ -684,11 +669,11 @@ export function compileRequiredPlatformCapabilitiesV3(config) {
             ? [{ code: 'workflow.task-rich-fields', declaration: taskRichFieldDefinitions }] : []),
         ...(config.workflows.definitions.some((item) => Object.values(item.definition.taskPages || {}).some((page) => page.fields.some((field) => field.subtable)))
             ? [{ code: 'workflow.task-owned-subtables', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.taskPages || {}).some((page) => page.fields.some((field) => field.subtable))) }] : []),
-        ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'action'))
-            ? [{ code: 'workflow.durable-business-step', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'action')) }]
+        ...(config.workflows.definitions.some((item) => (item.definition.authoring?.businessSteps?.length || Object.values(item.definition.nodes).some((node) => node.kind === 'action' && !isWorkflowPlatformNotify(node))))
+            ? [{ code: 'workflow.durable-business-step', declaration: config.workflows.definitions.filter((item) => (item.definition.authoring?.businessSteps?.length || Object.values(item.definition.nodes).some((node) => node.kind === 'action' && !isWorkflowPlatformNotify(node)))) }]
             : []),
-        ...(config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'action' && node.handler.dataTransaction))
-            ? [{ code: 'workflow.step-data-transaction', declaration: config.workflows.definitions.filter((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'action' && node.handler.dataTransaction)) }]
+        ...(config.workflows.definitions.some((item) => [...Object.values(item.definition.nodes), ...item.definition.authoring?.businessSteps || []].some((node) => node.handler?.dataTransaction))
+            ? [{ code: 'workflow.step-data-transaction', declaration: config.workflows.definitions.filter((item) => [...Object.values(item.definition.nodes), ...item.definition.authoring?.businessSteps || []].some((node) => node.handler?.dataTransaction)) }]
             : []),
         ...(config.workflows.bindings.some((item) => Object.values(item.binding.bindings).some((entry) => entry.routing !== undefined))
             ? [{ code: 'workflow.assignment-routing', declaration: config.workflows.bindings.filter((item) => Object.values(item.binding.bindings).some((entry) => entry.routing !== undefined)) }]
@@ -942,7 +927,8 @@ function validateConfigurationEnvelope(config, appCode) {
         'workflows',
         'frontend',
         'runtime',
-    ], '/config');
+    ], '/config', ['agents']);
+    compileApplicationAgentsV2(appCode, config.agents, config.data?.resources || [], { authz: config.authz });
     equal(config.schemaVersion, CONFIG_SCHEMA, '/config/schemaVersion');
     equal(config.compilerContractVersion, COMPILER_CONTRACT_VERSION, '/config/compilerContractVersion');
     equal(config.appCode, appCode, '/config/appCode');
@@ -1176,7 +1162,7 @@ function compileExpectedContract(config, configDigest, generatorVersion) {
             field: trigger.field,
         })),
         ...(config.workflows.activations.length
-            ? WORKFLOW_EVENT_TYPES_V2.filter(eventType => !WORKFLOW_BUSINESS_STEP_EVENTS.includes(eventType) || config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'action'))).filter(eventType => eventType !== 'openxiangda.workflow.node.skipped.v2' || config.workflows.definitions.some((item) => Object.values(item.definition.nodes).some((node) => node.kind === 'approval' && node.emptyPolicy === 'skip'))).map(eventType => ({
+            ? workflowProducedEventTypes(config.workflows.definitions).map(eventType => ({
                 code: `workflow:${eventType}`,
                 source: 'workflow',
                 eventType,
@@ -3646,7 +3632,7 @@ function compileWorkflows(config) {
             const nodes = object(item.definition.nodes, '/config/workflows/definitions/nodes');
             for (const nodeValue of Object.values(nodes)) {
                 const node = object(nodeValue, '/config/workflows/definitions/nodes/*');
-                if (node.kind !== 'approval')
+                if (node.kind !== 'approval' && node.kind !== 'handle')
                     continue;
                 for (const operation of uniqueStrings(node.allowedOperations || [], '/config/workflows/definitions/nodes/*/allowedOperations', 20)) {
                     operations.add(operation);
@@ -4758,11 +4744,18 @@ function validateWorkflowReferences(config) {
             'definitionVersion',
             'bindingVersion',
             'acceptedCommandDeactivationPolicy',
-        ], pointer, ['environmentKey']);
+        ], pointer, ['environmentKey', 'sourceBase']);
         const code = stableCode(activation.workflowCode, `${pointer}/workflowCode`);
         if (activationCodes.has(code))
             fail('NATIVE_WORKFLOW_ACTIVATION_DUPLICATE', pointer);
         activationCodes.add(code);
+        if (activation.sourceBase !== undefined) {
+            const base = object(activation.sourceBase, `${pointer}/sourceBase`);
+            exactKeys(base, ['definitionDigest', 'bindingDigest'], `${pointer}/sourceBase`);
+            for (const key of ['definitionDigest', 'bindingDigest'])
+                if (!/^(sha256:)?[a-f0-9]{64}$/.test(String(base[key] || '')))
+                    fail('NATIVE_WORKFLOW_SOURCE_BASE_INVALID', `${pointer}/sourceBase/${key}`);
+        }
         const definitionKey = `${code}:${positiveInteger(activation.definitionVersion, `${pointer}/definitionVersion`)}`;
         const bindingKey = `${code}:${positiveInteger(activation.bindingVersion, `${pointer}/bindingVersion`)}`;
         if (!definitions.has(definitionKey)) {
@@ -4952,7 +4945,7 @@ function validateWorkflowDefinition(definition, pointer) {
         'startAt',
         'inputSchema',
         'nodes',
-    ], pointer, ['organizationContext', 'instanceCommands', 'readability', 'taskPages', 'rejectionNotification', 'commandHandlers', 'launchPreflight', 'approvedDelegation']);
+    ], pointer, ['authoring', 'organizationContext', 'instanceCommands', 'readability', 'taskPages', 'rejectionNotification', 'commandHandlers', 'launchPreflight', 'approvedDelegation']);
     equal(definition.schemaVersion, 'openxiangda.workflow-definition/v2', `${pointer}/schemaVersion`);
     workflowCodeValue(definition.code, `${pointer}/code`);
     requiredString(definition.title, `${pointer}/title`, 255);
@@ -4989,6 +4982,18 @@ function validateWorkflowDefinition(definition, pointer) {
     const taskPageErrors = validateWorkflowTaskPages(definition);
     if (taskPageErrors.length)
         fail(taskPageErrors[0], `${pointer}/taskPages`);
+    const returnErrors = validateWorkflowReturnPolicies(definition);
+    if (returnErrors.length)
+        fail(returnErrors[0], `${pointer}/nodes`);
+    const reminderErrors = validateWorkflowReminders(definition);
+    if (reminderErrors.length)
+        fail(reminderErrors[0], `${pointer}/nodes`);
+    const handleErrors = validateWorkflowHandlingNodes(definition);
+    if (handleErrors.length)
+        fail(handleErrors[0], `${pointer}/nodes`);
+    const parallelErrors = validateWorkflowParallel(definition);
+    if (parallelErrors.length)
+        fail(parallelErrors[0], `${pointer}/nodes`);
     const stepErrors = validateWorkflowBusinessSteps(definition);
     if (stepErrors.length)
         fail(stepErrors[0], `${pointer}/nodes`);
@@ -4999,17 +5004,20 @@ function validateWorkflowDefinition(definition, pointer) {
         const nodePointer = `${pointer}/nodes/${nodeId}`;
         const node = object(rawNode, nodePointer);
         equal(node.id, nodeId, `${nodePointer}/id`);
-        if (!['approval', 'condition', 'end', 'cc', 'action', 'correction'].includes(node.kind)) {
+        if (!['approval', 'handle', 'condition', 'end', 'cc', 'action', 'correction', 'parallel', 'join'].includes(node.kind)) {
             fail('NATIVE_WORKFLOW_NODE_KIND_INVALID', `${nodePointer}/kind`);
         }
         const targets = [];
-        if (node.kind === 'approval') {
+        if (node.kind === 'approval' || node.kind === 'handle') {
             requiredString(node.title, `${nodePointer}/title`, 255);
             workflowBindingCode(node.binding, `${nodePointer}/binding`);
             if (!['single', 'any', 'all', 'sequence'].includes(node.mode)) {
                 fail('NATIVE_WORKFLOW_APPROVAL_MODE_INVALID', `${nodePointer}/mode`);
             }
-            targets.push(requiredString(node.onApprove, `${nodePointer}/onApprove`, 128), requiredString(node.onReject, `${nodePointer}/onReject`, 128));
+            if (node.kind === 'handle')
+                targets.push(requiredString(node.next, `${nodePointer}/next`, 128));
+            else
+                targets.push(requiredString(node.onApprove, `${nodePointer}/onApprove`, 128), requiredString(node.onReject, `${nodePointer}/onReject`, 128));
             for (const returnTarget of uniqueStrings(node.returnTargets || [], `${nodePointer}/returnTargets`, 200)) {
                 if (!nodes[returnTarget]) {
                     fail('NATIVE_WORKFLOW_TARGET_MISSING', `${nodePointer}/returnTargets`);
@@ -5034,6 +5042,20 @@ function validateWorkflowDefinition(definition, pointer) {
             workflowBindingCode(node.binding, `${nodePointer}/binding`);
             targets.push(requiredString(node.next, `${nodePointer}/next`, 128));
         }
+        else if (node.kind === 'parallel') {
+            requiredString(node.title, `${nodePointer}/title`, 255);
+            targets.push(requiredString(node.join, `${nodePointer}/join`, 128));
+            for (const [index, raw] of boundedArray(node.branches, `${nodePointer}/branches`, 8).entries()) {
+                const branch = object(raw, `${nodePointer}/branches/${index}`);
+                if (branch.when !== undefined)
+                    validateWorkflowExpression(branch.when, `${nodePointer}/branches/${index}/when`, 0);
+                targets.push(requiredString(branch.target, `${nodePointer}/branches/${index}/target`, 128));
+            }
+        }
+        else if (node.kind === 'join') {
+            requiredString(node.title, `${nodePointer}/title`, 255);
+            targets.push(requiredString(node.next, `${nodePointer}/next`, 128));
+        }
         else if (node.kind === 'condition') {
             const branches = boundedArray(node.branches, `${nodePointer}/branches`, 100);
             if (branches.length === 0) {
@@ -5072,8 +5094,8 @@ function validateWorkflowDefinition(definition, pointer) {
     walk(startAt);
     for (const id of [...reachable]) {
         const current = nodes[id];
-        if (current?.kind === 'approval')
-            for (const target of current.returnTargets || [])
+        if (current?.kind === 'approval' || current?.kind === 'handle')
+            for (const target of workflowReturnTargets(current))
                 if (nodes[target]?.kind === 'correction')
                     reachable.add(target);
     }
@@ -5123,6 +5145,9 @@ function validateWorkflowBinding(binding, pointer) {
     for (const [code, raw] of Object.entries(entries)) {
         workflowBindingCode(code, `${pointer}/bindings/${code}`);
         const entry = object(raw, `${pointer}/bindings/${code}`);
+        const chainErrors = validateWorkflowSupervisorChainBinding(entry);
+        if (chainErrors.length)
+            fail(chainErrors[0], `${pointer}/bindings/${code}`);
         const selectionErrors = validateWorkflowRoleInputSelection(entry);
         if (selectionErrors.length)
             fail(selectionErrors[0], `${pointer}/bindings/${code}/selectedInputPath`);
@@ -5136,6 +5161,7 @@ function validateWorkflowBinding(binding, pointer) {
             'input_users',
             'form_field_users',
             'department_supervisor',
+            'supervisor_chain',
             'app_role',
             'app_role_in_scope',
             'business_relation',
@@ -5170,6 +5196,9 @@ function validateWorkflowBinding(binding, pointer) {
     }
 }
 function validateWorkflowDefinitionBinding(definition, binding, pointer) {
+    const chainErrors = validateWorkflowSupervisorChains(definition, binding);
+    if (chainErrors.length)
+        fail(chainErrors[0], pointer);
     equal(binding.workflowCode, definition.code, `${pointer}/workflowCode`);
     const entries = object(binding.bindings, `${pointer}/bindings`);
     for (const [code, entry] of Object.entries(entries)) {
@@ -5187,7 +5216,7 @@ function validateWorkflowDefinitionBinding(definition, binding, pointer) {
         fail(stepErrors[0], pointer);
     for (const [nodeId, rawNode] of Object.entries(object(definition.nodes, `${pointer}/nodes`))) {
         const node = object(rawNode, `${pointer}/nodes/${nodeId}`);
-        if (['approval', 'cc'].includes(node.kind) && !entries[node.binding]) {
+        if (['approval', 'handle', 'cc'].includes(node.kind) && !entries[node.binding]) {
             fail('NATIVE_WORKFLOW_BINDING_REFERENCE_MISSING', `${pointer}/nodes/${nodeId}/binding`);
         }
     }