openxiangda-devkit-core 2.41.6 → 2.51.1

package/dist/compiler/config.js

@@ -1,10 +1,16 @@
+import { assertWorkflowNativeStagePolicy } from 'openxiangda-contracts';
+import { validateAuthenticatedPublicRead, AuthenticatedPublicReadContractError } from 'openxiangda-contracts/native-compiler';
+import { DATE_EVENT_RESERVED_DATA_FIELDS_V2, dateEventProjectionFieldsV2, dateEventProjectionEnvelopeSchemaV2 } from 'openxiangda-contracts/native-compiler';
+import { validateUserCandidateReferences, validateWorkflowUserCandidateBindings, UserCandidateContractError } from 'openxiangda-contracts';
 import { parseNativeUniqueKeys, DATA_SUBTABLE_MAX_TOTAL_ROWS } from 'openxiangda-contracts';
+import { assertWorkflowOwnedSubjectCreate } from 'openxiangda-contracts';
+export { workflowBusinessCommandInvocationSchema } from 'openxiangda-contracts';
 import { validateManagedConcurrency } from 'openxiangda-contracts/native-compiler';
 import { normalizeDecimalReservationEventDeclaration, decimalReservationEventContext } from 'openxiangda-contracts';
 import { materializeApplicationModules } from './application-model.js';
 import { nativeFieldRequiresCreateInputV2 } from 'openxiangda-contracts/native-compiler';
 import { NativeDecimalLifecycleContractError, validateDecimalReservationLifecycles } from 'openxiangda-contracts/native-compiler';
-import { SCHEMA_VERSIONS, DATA_AUDIT_METADATA_FIELDS, isDataAuditMetadataField, isDataSystemSortField, DATA_FIELD_TYPES, PLATFORM_EVENT_TYPES_V2, nativePlatformCapabilityCatalog, validateDataResource, validateWorkflowInstanceCommandPolicies, validateWorkflowTaskPages, validateWorkflowAssignmentRoutingBindings, WORKFLOW_SUMMARY_MAX_FIELDS, WORKFLOW_SUMMARY_TEXT_LONG_MAX_BYTES, isWorkflowSummaryFieldType, } from 'openxiangda-contracts';
+import { SCHEMA_VERSIONS, DATA_AUDIT_METADATA_FIELDS, isDataAuditMetadataField, isDataSystemSortField, DATA_FIELD_TYPES, PLATFORM_EVENT_TYPES_V2, nativePlatformCapabilityCatalog, validateDataResource, validateWorkflowInstanceCommandPolicies, validateWorkflowTaskPages, validateWorkflowCommandHandlers, validateWorkflowAssignmentRoutingBindings, WORKFLOW_SUMMARY_MAX_FIELDS, WORKFLOW_SUMMARY_TEXT_LONG_MAX_BYTES, isWorkflowSummaryFieldType, } from 'openxiangda-contracts';
 import { Ajv2020 } from 'ajv/dist/2020.js';
 import { CronExpressionParser } from 'cron-parser';
 import { fieldNullable, supportsGeneratedMutation, } from './field-codec.js';
@@ -17,14 +23,7 @@ import { AUTHORIZATION_TRANSITION_CAPABILITY_CODE_PATTERN, AUTHORIZATION_TRANSIT
 // The compiler owns the application source contract. Devkit and every adapter
 // re-export this module instead of maintaining separate configuration models.
 import { validateWorkflowBinding, validateWorkflowDefinition, } from '../internal/workflow.js';
-const DATE_TRIGGER_RESERVED_DATA_FIELDS = new Set([
-    'triggerCode',
-    'resourceCode',
-    'recordId',
-    'recordRevision',
-    'field',
-    'dueAt',
-]);
+const DATE_TRIGGER_RESERVED_DATA_FIELDS = new Set(DATE_EVENT_RESERVED_DATA_FIELDS_V2);
 const APP_DATA_FIELD_TYPES = new Set(DATA_FIELD_TYPES);
 const WORKFLOW_RUNTIME_CODE_PATTERN = /^[a-z][a-z0-9-]{2,63}$/;
 function adminNavigationItem(page, options = {}) {
@@ -966,6 +965,7 @@ export function validateAppConfig(value) {
         secretNames.add(name);
         secretEnvs.add(env);
     });
+    const authz = object(config.authz);
     const data = object(config.data);
     if (config.data !== undefined && !Array.isArray(data.resources)) {
         diagnostics.push(diagnostic('APP_CONFIG_DATA_RESOURCES_REQUIRED', 'data.resources 必须是数组', 'data.resources'));
@@ -995,6 +995,15 @@ export function validateAppConfig(value) {
         resources.forEach((resource, index) => {
             const resourceRecord = object(resource);
             const fields = object(resourceRecord.schema).fields;
+            try {
+                validateUserCandidateReferences((Array.isArray(fields) ? fields : []), new Set((Array.isArray(authz.roles) ? authz.roles : []).map(item => string(object(item).code))), new Set((Array.isArray(authz.scopeDimensions) ? authz.scopeDimensions : []).map(item => string(object(item).code))), `data.resources[${index}].schema.fields`);
+            }
+            catch (error) {
+                if (!(error instanceof UserCandidateContractError))
+                    throw error;
+                const issue = error;
+                diagnostics.push(diagnostic(issue.code, '人员候选必须引用同一应用声明的职责、范围和兼容字段', issue.pointer));
+            }
             (Array.isArray(fields) ? fields : []).forEach((rawField, fieldIndex) => {
                 const field = object(rawField);
                 const source = object(field.source);
@@ -1048,7 +1057,6 @@ export function validateAppConfig(value) {
             });
         });
     }
-    const authz = object(config.authz);
     const declaredCapabilities = Array.isArray(authz.capabilities)
         ? authz.capabilities
         : [];
@@ -1069,7 +1077,13 @@ export function validateAppConfig(value) {
             const mutationOwner = string(object(resource.surface).mutationOwner) || 'native';
             if (['native', 'queued-command'].includes(mutationOwner))
                 continue;
+            const recordDeletionCapabilities = object(resource.recordDeletion).delete;
             for (const operation of ['create', 'update', 'delete']) {
+                // This capability authorizes the server's controlled deletion entry;
+                // ordinary Native mutations still belong to the declared owner.
+                if (operation === 'delete' && Array.isArray(recordDeletionCapabilities) &&
+                    recordDeletionCapabilities.length > 0)
+                    continue;
                 const capability = string(object(resource.capabilities)[operation]);
                 if (capability) {
                     forbiddenNativeMutationCapabilities.set(capability, {
@@ -1436,6 +1450,7 @@ export function validateAppConfig(value) {
                 'name',
                 'resourceCode',
                 'unrestrictedRoleCodes',
+                'publicRead',
                 'operations',
                 'matchMode',
                 'rules',
@@ -1478,6 +1493,20 @@ export function validateAppConfig(value) {
             if (!/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(string(policy.resourceCode))) {
                 diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_RESOURCE_REQUIRED', 'data policy 必须声明唯一目标 resourceCode', `authz.dataPolicies[${index}].resourceCode`));
             }
+            if (policy.publicRead !== undefined) {
+                const resource = dataResources.map(object).find(resource => resource.code === policy.resourceCode);
+                const baseline = roles.map(object).find(role => role.code === authenticatedUserRoleCode);
+                try {
+                    validateAuthenticatedPublicRead({ policy, resource, baselineRoleCode: authenticatedUserRoleCode,
+                        baselineCapabilities: Array.isArray(baseline?.capabilities) ? baseline.capabilities : [],
+                        baselineDeniedCapabilities: Array.isArray(baseline?.deniedCapabilities) ? baseline.deniedCapabilities : [], pointer: policyPath });
+                }
+                catch (error) {
+                    if (!(error instanceof AuthenticatedPublicReadContractError))
+                        throw error;
+                    diagnostics.push(diagnostic(error.code, '认证公共投影必须闭合公共字段，所有非公开字段与历史继续拒绝基线成员', error.pointer));
+                }
+            }
             if (policy.unrestrictedRoleCodes !== undefined) {
                 const unrestrictedRoleCodes = Array.isArray(policy.unrestrictedRoleCodes)
                     ? policy.unrestrictedRoleCodes
@@ -1996,6 +2025,16 @@ export function validateAppConfig(value) {
         const field = string(trigger.field);
         const fieldType = eventResourceFields.get(resourceCode)?.get(field);
         const payload = object(trigger.payload);
+        let projectionFields = [];
+        let generatedSchema = applicationEventSchemas.get(string(trigger.eventType));
+        try {
+            projectionFields = dateEventProjectionFieldsV2(resourceCode, (Array.isArray(events.subscriptions) ? events.subscriptions : []).map(object)
+                .filter(subscription => Array.isArray(subscription.eventTypes) && subscription.eventTypes.includes(trigger.eventType)), eventDataResources.map(object).find(resource => resource.code === resourceCode));
+            generatedSchema = dateEventProjectionEnvelopeSchemaV2(generatedSchema, projectionFields);
+        }
+        catch (error) {
+            diagnostics.push(diagnostic('APP_CONFIG_DATE_TRIGGER_PROJECTION_INVALID', `日期事件资料投影无效：${error instanceof Error ? error.message : 'invalid'}`, path));
+        }
         let payloadBytes = Number.POSITIVE_INFINITY;
         try {
             payloadBytes = Buffer.byteLength(JSON.stringify(trigger.payload || {}), 'utf8');
@@ -2014,7 +2053,7 @@ export function validateAppConfig(value) {
             Array.isArray(trigger.payload) ||
             payloadBytes > 64 * 1024 ||
             Object.keys(payload).some(key => DATE_TRIGGER_RESERVED_DATA_FIELDS.has(key)) ||
-            !eventDataMatchesSchema(applicationEventSchemas.get(string(trigger.eventType)), {
+            !eventDataMatchesSchema(generatedSchema, {
                 ...payload,
                 triggerCode: code,
                 resourceCode,
@@ -2022,6 +2061,7 @@ export function validateAppConfig(value) {
                 recordRevision: 1,
                 field,
                 dueAt: '2026-01-01T00:00:00.000Z',
+                ...(projectionFields.length ? { projection: {} } : {}),
             })) {
             diagnostics.push(diagnostic('APP_CONFIG_DATE_TRIGGER_INVALID', 'dateTrigger 必须使用唯一 code、date/datetime 字段、十年内 ISO-8601 offset、已注册应用事件、无保留字段且完整生成数据满足 JSON Schema', path));
         }
@@ -2372,6 +2412,11 @@ export function validateAppConfig(value) {
                     const property = workflowInputProperties[factKey];
                     const propertyRecord = isRecord(property) ? property : {};
                     const propertyType = string(propertyRecord.type);
+                    const nullableObject = Array.isArray(propertyRecord.type) &&
+                        propertyRecord.type.length === 2 &&
+                        new Set(propertyRecord.type).size === 2 &&
+                        propertyRecord.type.includes('object') &&
+                        propertyRecord.type.includes('null');
                     const itemRecord = isRecord(propertyRecord.items)
                         ? propertyRecord.items
                         : {};
@@ -2384,20 +2429,20 @@ export function validateAppConfig(value) {
                         ? 'array（items.type=array，items.items.type=object）'
                         : fieldType.endsWith('.multiple')
                             ? 'array（items.type=object）'
-                            : 'object';
+                            : 'object 或 [object, null]';
                     const shapeValid = fieldType === 'cascade.multiple'
                         ? propertyType === 'array' &&
                             itemType === 'array' &&
                             nestedItemType === 'object'
                         : fieldType.endsWith('.multiple')
                             ? propertyType === 'array' && itemType === 'object'
-                            : propertyType === 'object';
+                            : propertyType === 'object' || nullableObject;
                     if (!shapeValid) {
                         diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_FACT_PROJECTION_SHAPE_INVALID', `fact "${factKey}" 投影的字段 ${fieldCode} 是 ${fieldType} 快照字段；inputSchema.properties.${factKey} 必须声明 ${expected}`, `${path}.definition.inputSchema.properties.${factKey}`));
                     }
                 }
             }
-            for (const error of validateWorkflowDefinition(definition)) {
+            for (const error of [...validateWorkflowDefinition(definition), ...validateWorkflowCommandHandlers(definition, object(config.backend).operations)]) {
                 diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_DEFINITION_INVALID', error, path));
             }
             const policyResource = object((Array.isArray(data.resources) ? data.resources : []).find(resource => object(resource).code === definition.subject?.resourceCode));
@@ -2474,6 +2519,18 @@ export function validateAppConfig(value) {
             for (const error of validateWorkflowBinding(definition, binding)) {
                 diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_BINDING_INVALID', error, path));
             }
+            try {
+                const resource = (Array.isArray(data.resources) ? data.resources : []).map(object).find(item => item.code === definition.subject.resourceCode);
+                const fields = object(resource?.schema).fields;
+                validateWorkflowUserCandidateBindings(definition, binding, new Map((Array.isArray(fields) ? fields : []).map(item => [String(object(item).code), item])), `${path}.bindings`, new Map((Array.isArray(data.resources) ? data.resources : []).map(object).map(resource => [String(resource.code),
+                    new Map((Array.isArray(object(resource.schema).fields) ? object(resource.schema).fields : []).map(field => [field.code, field]))])));
+            }
+            catch (error) {
+                if (!(error instanceof UserCandidateContractError))
+                    throw error;
+                const issue = error;
+                diagnostics.push(diagnostic(issue.code, '流程选人必须引用原人员字段及固定范围事实，办理页不能修改选人范围', issue.pointer));
+            }
             activeRoutingBindings.push(binding);
             for (const entry of Object.values(binding.bindings || {})) {
                 if (entry.provider === 'application_provider' &&
@@ -2771,16 +2828,54 @@ function validateBackendOperations(rawOperations, declaredResources, declaredRes
                 'workflow',
                 'roleAssertions',
                 'decimalReservation',
+                'dataCommands',
+                'workflowStage',
+                'recordEdit',
+                'ownedSubject',
             ]);
             let invalid = !isRecord(operation.platformAccess) ||
                 Object.keys(access).length === 0 ||
                 Object.keys(access).some(key => !allowedAccessKeys.has(key));
+            if (access.ownedSubject !== undefined) {
+                try {
+                    assertWorkflowOwnedSubjectCreate(access.ownedSubject);
+                }
+                catch {
+                    invalid = true;
+                }
+                invalid ||= access.workflow === undefined || access.decimalReservation !== undefined;
+            }
+            if (access.dataCommands !== undefined) {
+                const commands = object(access.dataCommands);
+                invalid ||= commands.mode !== 'recoverable-native' || Object.keys(commands).some(key => key !== 'mode');
+            }
+            if (access.workflowStage !== undefined) {
+                try {
+                    assertWorkflowNativeStagePolicy(access.workflowStage);
+                }
+                catch {
+                    invalid = true;
+                }
+                const stage = object(access.workflowStage);
+                invalid ||= object(access.dataCommands).mode !== 'recoverable-native' || access.decimalReservation !== undefined ||
+                    !declaredResources.has(string(stage.resourceCode)) || !declaredWorkflowCodes.has(string(stage.workflowCode)) ||
+                    !Array.isArray(object(access.workflow).codes) || !object(access.workflow).codes.includes(stage.workflowCode);
+            }
+            if (access.recordEdit !== undefined) {
+                const edit = object(access.recordEdit);
+                const fields = Array.isArray(edit.fieldCodes) ? edit.fieldCodes : [];
+                invalid ||= !isRecord(access.recordEdit) || !string(edit.resourceCode) || fields.length < 1 || fields.length > 200 ||
+                    new Set(fields).size !== fields.length || fields.some(field => !string(field)) ||
+                    Object.keys(edit).some(key => !['resourceCode', 'fieldCodes'].includes(key)) ||
+                    object(access.dataCommands).mode !== 'recoverable-native';
+            }
             if (access.roleAssertions !== undefined) {
                 const assertion = object(access.roleAssertions);
                 const roles = Array.isArray(assertion.roleCodes) ? assertion.roleCodes : [];
                 invalid ||= !isRecord(access.roleAssertions) || roles.length < 1 || roles.length > 20 ||
                     new Set(roles).size !== roles.length || roles.some(role => !declaredRoleCodes.has(string(role))) ||
-                    Object.keys(assertion).some(key => key !== 'roleCodes');
+                    Object.keys(assertion).some(key => !['roleCodes', 'actorAuthority'].includes(key)) ||
+                    (Object.hasOwn(assertion, 'actorAuthority') && assertion.actorAuthority !== true);
             }
             if (access.directory !== undefined) {
                 const directory = object(access.directory);
@@ -2790,6 +2885,7 @@ function validateBackendOperations(rawOperations, declaredResources, declaredRes
                     'employeeNumber',
                     'primaryDepartment',
                     'departments',
+                    ...(directory.mode === 'current-initiator' ? ['phone'] : []),
                 ]);
                 invalid ||=
                     !['current-initiator', 'selected-user'].includes(String(directory.mode)) ||
@@ -2891,7 +2987,12 @@ function validateBackendOperations(rawOperations, declaredResources, declaredRes
                         workflowCodes.length > 16 ||
                         new Set(workflowCodes).size !== workflowCodes.length ||
                         workflowCodes.some(code => !declaredWorkflowCodes.has(code)) ||
-                        Object.keys(workflow).some(key => key !== 'codes');
+                        Object.keys(workflow).some(key => !['codes', 'businessCommands'].includes(key));
+                if (workflow.businessCommands !== undefined) {
+                    const commands = workflow.businessCommands;
+                    invalid ||= !Array.isArray(commands) || commands.length === 0 || commands.length > 4 ||
+                        new Set(commands).size !== commands.length || commands.some(command => !['approve', 'reject', 'withdraw', 'resubmit'].includes(command));
+                }
             }
             if (access.decimalReservation !== undefined) {
                 const reservation = object(access.decimalReservation);
@@ -4226,7 +4327,10 @@ function validateCapabilityClosure(appCode, config, declarations, diagnostics) {
         if (code)
             catalogOwners.set(code, 'authz.capabilities');
     }
-    for (const [resourceIndex, rawResource] of (Array.isArray(data.resources) ? data.resources : []).entries()) {
+    const resources = Array.isArray(data.resources) ? data.resources : [];
+    // Register every real definition before inspecting field references. A field
+    // may reference a later resource without claiming that resource's catalog.
+    for (const rawResource of resources) {
         const resource = object(rawResource);
         const resourceOwner = `data.resources.${string(resource.code)}`;
         Object.values(object(resource.capabilities)).forEach(value => {
@@ -4234,18 +4338,42 @@ function validateCapabilityClosure(appCode, config, declarations, diagnostics) {
             registerCapabilityOwner(code, resourceOwner, catalogOwners, diagnostics);
             catalog.add(code);
         });
+    }
+    const definedCapabilities = new Set(catalog);
+    for (const [resourceIndex, rawResource] of resources.entries()) {
+        const resource = object(rawResource);
+        const resourceOwner = `data.resources.${string(resource.code)}`;
+        for (const mode of ['read', 'create']) {
+            const list = object(resource.recordComments)[mode];
+            for (const capability of Array.isArray(list) ? list : []) {
+                references.push({ capability: string(capability), path: `data.resources[${resourceIndex}].recordComments.${mode}` });
+            }
+        }
+        const printRead = object(resource.recordPrint).read;
+        const recordDelete = object(resource.recordDeletion).delete;
+        for (const capability of Array.isArray(recordDelete) ? recordDelete : []) {
+            references.push({ capability: string(capability), path: `data.resources[${resourceIndex}].recordDeletion.delete` });
+        }
+        for (const capability of Array.isArray(printRead) ? printRead : []) {
+            references.push({ capability: string(capability), path: `data.resources[${resourceIndex}].recordPrint.read` });
+        }
+        const historyRead = object(resource.workflowHistory).read;
+        for (const capability of Array.isArray(historyRead) ? historyRead : []) {
+            references.push({ capability: string(capability), path: `data.resources[${resourceIndex}].workflowHistory.read` });
+        }
         Object.entries(object(resource.fieldPolicies)).forEach(([fieldCode, rawPolicy]) => {
             const policy = object(rawPolicy);
             for (const key of ['read', 'create', 'update']) {
                 for (const value of Array.isArray(policy[key]) ? policy[key] : []) {
                     const code = string(value);
-                    if (isDataAuditMetadataField(fieldCode)) {
-                        references.push({
-                            capability: code,
-                            path: `data.resources[${resourceIndex}].fieldPolicies.${fieldCode}.${key}`,
-                        });
+                    references.push({
+                        capability: code,
+                        path: `data.resources[${resourceIndex}].fieldPolicies.${fieldCode}.${key}`,
+                    });
+                    if (isDataAuditMetadataField(fieldCode) || definedCapabilities.has(code))
                         continue;
-                    }
+                    // Preserve resource-owned implicit field capabilities. Reusing an
+                    // explicit/CRUD definition is different from two implicit owners.
                     registerCapabilityOwner(code, resourceOwner, catalogOwners, diagnostics);
                     catalog.add(code);
                 }
@@ -4444,6 +4572,7 @@ export function materializeDataResource(appCode, declaration) {
                 Boolean(field.filter || field.searchable || field.sortable),
             ...(field.options ? { options: field.options } : {}),
             ...(field.source ? { source: field.source } : {}),
+            ...(field.userCandidates !== undefined ? { userCandidates: field.userCandidates } : {}),
             ...(field.maxLength !== undefined ? { maxLength: field.maxLength } : {}),
             ...(field.precision !== undefined ? { precision: field.precision } : {}),
             ...(field.scale !== undefined ? { scale: field.scale } : {}),
@@ -4525,6 +4654,7 @@ export function materializeDataResource(appCode, declaration) {
                 ...(field.file?.accept ? { accept: field.file.accept } : {}),
                 ...(field.options ? { options: field.options } : {}),
                 ...(field.source ? { source: field.source } : {}),
+                ...(field.userCandidates !== undefined ? { userCandidates: field.userCandidates } : {}),
                 ...(field.timePrecision ? { timePrecision: field.timePrecision } : {}),
                 ...(field.serial ? { serial: field.serial } : {}),
                 ...(field.subtable ? { subtable: field.subtable } : {}),
@@ -4572,6 +4702,24 @@ export function materializeDataResource(appCode, declaration) {
         ...(declaration.invariants ? { invariants: declaration.invariants } : {}),
         ...(declaration.decimalReservationLifecycle !== undefined ? { decimalReservationLifecycle: declaration.decimalReservationLifecycle } : {}),
         ...(uniqueKeys !== undefined ? { uniqueKeys } : {}),
+        ...(declaration.recordComments === undefined ? {} : { recordComments: {
+                read: declaration.recordComments.read === false ? [] : declaration.recordComments.read === true
+                    ? [capabilities.read] : [...declaration.recordComments.read],
+                create: declaration.recordComments.create === false ? [] : declaration.recordComments.create === true
+                    ? [capabilities.read] : [...declaration.recordComments.create],
+            } }),
+        ...(declaration.recordPrint === undefined ? {} : { recordPrint: {
+                read: declaration.recordPrint.read === false ? [] : declaration.recordPrint.read === true
+                    ? [capabilities.read] : [...declaration.recordPrint.read],
+            } }),
+        ...(declaration.recordDeletion === undefined ? {} : { recordDeletion: {
+                delete: declaration.recordDeletion.delete === false ? [] : declaration.recordDeletion.delete === true
+                    ? [capabilities.delete] : [...declaration.recordDeletion.delete],
+            } }),
+        ...(declaration.workflowHistory === undefined ? {} : { workflowHistory: {
+                read: declaration.workflowHistory.read === false ? [] : declaration.workflowHistory.read === true
+                    ? [capabilities.read] : [...declaration.workflowHistory.read],
+            } }),
         surface,
         capabilities,
         ...(declaration.dataPolicyCode
@@ -4621,6 +4769,10 @@ export function validateAppDeclaration(value) {
         'detailRouteCode',
         'userSurface',
         'audit',
+        'workflowHistory',
+        'recordPrint',
+        'recordComments',
+        'recordDeletion',
     ]);
     const fieldKeys = new Set([
         'code',
@@ -4630,6 +4782,7 @@ export function validateAppDeclaration(value) {
         'indexed',
         'options',
         'source',
+        'userCandidates',
         'maxLength',
         'precision',
         'scale',
@@ -4672,6 +4825,55 @@ export function validateAppDeclaration(value) {
                 diagnostics.push(diagnostic('APP_CONFIG_DATA_AUDIT_READ_INVALID', 'audit.read 必须为 true（绑定资源读能力）、false 或不重复的非空 capability 数组（最多 20 项）', `${resourcePath}.audit`, `audit: { read: true } 会把审计读取绑定到本资源的 read 能力；需要更细粒度时写能力数组，例如 audit: { read: ['app:${appCode}:data:<resource>:read'] }`));
             }
         }
+        let recordCommentsValid = true;
+        if (resource.recordComments !== undefined) {
+            const rule = object(resource.recordComments);
+            if (!resource.recordComments || typeof resource.recordComments !== 'object' || Array.isArray(resource.recordComments) ||
+                Object.keys(rule).some(key => !['read', 'create'].includes(key)) || ['read', 'create'].some(mode => {
+                const list = rule[mode];
+                return list !== false && list !== true && (!Array.isArray(list) || list.length < 1 || list.length > 20 ||
+                    list.some(value => typeof value !== 'string' || !value.trim()) || new Set(list).size !== list.length);
+            })) {
+                recordCommentsValid = false;
+                diagnostics.push(diagnostic('APP_CONFIG_RECORD_COMMENTS_POLICY_INVALID', 'recordComments.read/create 必须为 true、false 或不重复的非空 capability 数组（最多20项）', `${resourcePath}.recordComments`, 'true绑定本资源read；每项操作的能力需由同一成员全部持有。'));
+            }
+        }
+        let recordDeletionValid = true;
+        if (resource.recordDeletion !== undefined) {
+            const rule = object(resource.recordDeletion);
+            const remove = rule.delete;
+            if (!resource.recordDeletion || typeof resource.recordDeletion !== 'object' || Array.isArray(resource.recordDeletion) ||
+                Object.keys(rule).some(key => key !== 'delete') ||
+                (remove !== true && remove !== false && (!Array.isArray(remove) || remove.length < 1 || remove.length > 20 ||
+                    remove.some(value => typeof value !== 'string' || !value.trim()) || new Set(remove).size !== remove.length))) {
+                recordDeletionValid = false;
+                diagnostics.push(diagnostic('APP_CONFIG_RECORD_DELETION_DELETE_INVALID', 'recordDeletion.delete 必须为 true、false 或不重复的非空 capability 数组（最多20项）', `${resourcePath}.recordDeletion`, 'true绑定本资源delete；同一成员需同时有资料read、delete及全部维护能力。'));
+            }
+        }
+        let recordPrintValid = true;
+        if (resource.recordPrint !== undefined) {
+            const rule = object(resource.recordPrint);
+            const read = rule.read;
+            if (!resource.recordPrint || typeof resource.recordPrint !== 'object' || Array.isArray(resource.recordPrint) ||
+                Object.keys(rule).some(key => key !== 'read') ||
+                (read !== true && read !== false && (!Array.isArray(read) || read.length < 1 || read.length > 20 ||
+                    read.some(value => typeof value !== 'string' || !value.trim()) || new Set(read).size !== read.length))) {
+                recordPrintValid = false;
+                diagnostics.push(diagnostic('APP_CONFIG_RECORD_PRINT_READ_INVALID', 'recordPrint.read 必须为 true、false 或不重复的非空 capability 数组（最多 20 项）', `${resourcePath}.recordPrint`, 'true 绑定本资源 read；独立能力数组按同一成员全部持有校验。'));
+            }
+        }
+        let workflowHistoryValid = true;
+        if (resource.workflowHistory !== undefined) {
+            const rule = object(resource.workflowHistory);
+            const read = rule.read;
+            if (!resource.workflowHistory || typeof resource.workflowHistory !== 'object' || Array.isArray(resource.workflowHistory) ||
+                Object.keys(rule).some(key => key !== 'read') ||
+                (read !== true && read !== false && (!Array.isArray(read) || read.length < 1 || read.length > 20 ||
+                    read.some(value => typeof value !== 'string' || !value.trim()) || new Set(read).size !== read.length))) {
+                workflowHistoryValid = false;
+                diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_HISTORY_READ_INVALID', 'workflowHistory.read 必须为 true、false 或不重复的非空 capability 数组（最多 20 项）', `${resourcePath}.workflowHistory`, 'true 绑定本资源 read；独立能力数组按同一成员全部持有校验。'));
+            }
+        }
         const userSurface = resource.userSurface;
         if (userSurface !== undefined) {
             const surface = object(userSurface);
@@ -4708,7 +4910,7 @@ export function validateAppDeclaration(value) {
             return;
         }
         const declaredCodes = new Set();
-        let materializable = auditValid;
+        let materializable = auditValid && workflowHistoryValid && recordPrintValid && recordCommentsValid && recordDeletionValid;
         fields.forEach((rawField, fieldIndex) => {
             const field = object(rawField);
             const fieldPath = `${resourcePath}.fields[${fieldIndex}]`;
@@ -4894,6 +5096,11 @@ export function validateAppDeclaration(value) {
                 return;
             const path = `data.resources[${declaration.resourceIndex}].fields[${fieldIndex}].subtable`;
             const subtable = object(field.subtable);
+            if (subtable.minRows !== undefined &&
+                (!Number.isSafeInteger(subtable.minRows) || Number(subtable.minRows) < 0 ||
+                    Number(subtable.minRows) > Number(subtable.maxRows ?? 20))) {
+                diagnostics.push(diagnostic('APP_CONFIG_DATA_SUBTABLE_MIN_ROWS_INVALID', '子表 minRows 必须是非负整数且不能超过 maxRows（默认20）', `${path}.minRows`));
+            }
             const targetCode = string(subtable.resourceCode);
             const target = declaredResources.get(targetCode);
             if (!target || targetCode === resourceCode) {