openxiangda-devkit-core 2.58.0 → 2.60.1

package/dist/compiler/config.js

@@ -1,3 +1,4 @@
+import { normalizeDataMutationGrants } from 'openxiangda-contracts';
 import { parseNativeParentReadPolicy, validateNativeParentReadPolicies, NativeParentReadPolicyError, NativeDataPolicyExpressionV2Error } from 'openxiangda-contracts/native-compiler';
 import { assertWorkflowNativeStagePolicy } from 'openxiangda-contracts';
 import { WORKFLOW_LAUNCH_MAX_INPUTS } from 'openxiangda-contracts';
@@ -1043,6 +1044,12 @@ export function validateAppConfig(value) {
                         }
                     });
                 }
+                (Array.isArray(source.filterWhere) ? source.filterWhere : []).forEach((rawFilter, filterIndex) => {
+                    const filterField = string(object(rawFilter).field);
+                    if (!targetFieldList.some(candidate => string(object(candidate).code) === filterField)) {
+                        diagnostics.push(diagnostic('APP_CONFIG_DATA_RESOURCE_SOURCE_FILTER_FIELD_NOT_FOUND', `动态来源筛选字段 ${filterField} 未在 ${targetCode} 声明`, `${sourcePath}.filterWhere[${filterIndex}].field`));
+                    }
+                });
                 const sourceFilters = Array.isArray(source.filters) ? source.filters : [];
                 sourceFilters.forEach((rawFilter, filterIndex) => {
                     const filter = object(rawFilter);
@@ -1937,6 +1944,14 @@ export function validateAppConfig(value) {
                         copiesInvalid = true;
                     copyKeys.add(key);
                 }
+                if (access.dataMutations !== undefined) {
+                    try {
+                        access.dataMutations = normalizeDataMutationGrants(access.dataMutations, eventResourceFields);
+                    }
+                    catch {
+                        copiesInvalid = true;
+                    }
+                }
                 let decimalInvalid = false;
                 if (access.decimalReservation !== undefined) {
                     try {
@@ -1947,11 +1962,11 @@ export function validateAppConfig(value) {
                     }
                 }
                 if (decimalInvalid ||
-                    Object.keys(access).some(key => !['notification', 'managedFileCopies', 'decimalReservation'].includes(key)) ||
+                    Object.keys(access).some(key => !['notification', 'managedFileCopies', 'decimalReservation', 'dataMutations'].includes(key)) ||
                     (access.notification !== undefined &&
                         (notification.mode !== 'business-standard' ||
                             Object.keys(notification).some(key => key !== 'mode'))) ||
-                    (access.notification === undefined && access.managedFileCopies === undefined && access.decimalReservation === undefined) ||
+                    (access.notification === undefined && access.managedFileCopies === undefined && access.decimalReservation === undefined && access.dataMutations === undefined) ||
                     copiesInvalid) {
                     diagnostics.push(diagnostic('APP_CONFIG_EVENT_PLATFORM_ACCESS_INVALID', '事件订阅 platformAccess 必须显式声明标准通知、托管文件复制或与审批/额度资源匹配的受管终态', `${path}.platformAccess`));
                 }
@@ -2517,6 +2532,7 @@ export function validateAppConfig(value) {
                 'definitionVersion',
                 'bindingVersion',
                 'acceptedCommandDeactivationPolicy',
+                'sourceBase',
             ].includes(key))) {
                 diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_ACTIVATION_INVALID', 'Workflow activation 只能声明固定版本与停用策略', path));
             }
@@ -2528,6 +2544,11 @@ export function validateAppConfig(value) {
             if ('environmentKey' in activation) {
                 diagnostics.push(diagnostic('APP_CONFIG_ENVIRONMENT_OVERRIDE_FORBIDDEN', 'Workflow activation 属于环境中立 AppVersion，不能声明 environmentKey', `${path}.environmentKey`));
             }
+            if (activation.sourceBase !== undefined) {
+                const base = object(activation.sourceBase);
+                if (Object.keys(base).length !== 2 || !['definitionDigest', 'bindingDigest'].every(key => /^(sha256:)?[a-f0-9]{64}$/.test(String(base[key] || ''))))
+                    diagnostics.push(diagnostic('APP_CONFIG_WORKFLOW_SOURCE_BASE_INVALID', '源码基线只能包含 definitionDigest 和 bindingDigest', `${path}.sourceBase`));
+            }
             const definitionVersion = Number(activation.definitionVersion);
             const bindingVersion = Number(activation.bindingVersion);
             const definition = definitionByKey.get(`${workflowCode}:${definitionVersion}`);
@@ -2857,10 +2878,19 @@ function validateBackendOperations(rawOperations, declaredResources, declaredRes
                 'workflowStage',
                 'recordEdit',
                 'ownedSubject',
+                'dataMutations',
             ]);
             let invalid = !isRecord(operation.platformAccess) ||
                 Object.keys(access).length === 0 ||
                 Object.keys(access).some(key => !allowedAccessKeys.has(key));
+            if (access.dataMutations !== undefined) {
+                try {
+                    access.dataMutations = normalizeDataMutationGrants(access.dataMutations, declaredResourceFields);
+                }
+                catch {
+                    invalid = true;
+                }
+            }
             if (access.ownedSubject !== undefined) {
                 try {
                     assertWorkflowOwnedSubjectCreate(access.ownedSubject);
@@ -3211,6 +3241,15 @@ function validateBackendOperations(rawOperations, declaredResources, declaredRes
                 ? ai.sideEffects
                 : [];
             const risk = string(ai.risk);
+            if (risk === 'external' && ai.reconcile === undefined) {
+                diagnostics.push({
+                    ...diagnostic('AI_EXTERNAL_RECONCILIATION_MISSING', '外部 AI 操作未声明业务结果核对能力，执行结果不确定时只能保留未知并人工核实', `${path}.ai.reconcile`),
+                    severity: 'warning',
+                });
+            }
+            if (object(ai.reconcile).kind === 'platform-transaction') {
+                diagnostics.push({ ...diagnostic('AI_APP_TRANSACTION_RECONCILIATION_UNSUPPORTED', '应用业务操作的 completing 平台事务核对尚未提供；请声明只读状态操作，否则保留结果未知', `${path}.ai.reconcile`), severity: 'warning' });
+            }
             const aiKeys = Object.keys(ai);
             const allowedAiKeys = new Set([
                 'name',
@@ -3219,6 +3258,7 @@ function validateBackendOperations(rawOperations, declaredResources, declaredRes
                 'confirmation',
                 'resources',
                 'sideEffects',
+                'reconcile',
                 'concurrency',
                 'timeoutMs',
                 'agent',