@dforge-core/dforge-mcp 0.2.46-next → 0.2.48

package/skills/dforge-mcp-author/references/registers.md

@@ -188,6 +188,7 @@ A register column is a `bool` state column. `A` writes `balance`, `turnover` and
 | `lineDateField` | On a line posting, a line column dating that line's movement instead of `dateField`; an empty one falls back to `dateField`. With `periodEntity` each line's period must be open, judged by the movement's stamped date (line's or document's, after `dateTrunc`); lines skipped by `skipPostingWhenEmpty` don't count. On a `recordChangesOnly` info register, one line per key (several dates on a key are refused). A `date` or zoneless `timestamp`, in `lockedLineFields` (and `groupLinesBy` when grouped), not with `periodDimField`. |
 | `skipPostingWhenEmpty` | Dimensions whose emptiness means "this row posts nothing". The exception, see below. |
 | `lockedFields` / `lockedLineFields` | Columns frozen while posted. `["*"]` freezes the whole row. |
+| `postAction` / `unpostAction` | Params of the binding column (an `A` or `L` column), codes of this entity's actions that post and unpost the document. A direct `data.insert` / `data.update` that turns the state flag on or off needs `E` on the one for its direction, as the button does; actions and DSL `update()` are not re-checked. Each direction is gated on its own: with only one declared, the other direction needs just Insert/Update. A binding with neither gets a pack / validate warning, silenced by `"editorMayPost": true` (not allowed together with an action name). A name no action declared for the entity in `ui/actions.json` carries is refused by `module pack` / validate and by the write. **Unreleased: not in platform 1.28.12.** |
 | `movementMapping` | Journal attribute column to document or line column. |
 
 ### `map` value forms
@@ -256,6 +257,7 @@ execute:
 ```
 
 - A dimension left out is summed over by `getBalance` and `getTurnover`. `getSlice` refuses an omitted dimension.
+- `getSlice` answers one dimension tuple from an action. A value per row — each line's price on its document's date, in a print form, report or view — is the formula `SLICE()` on an `F` column (formulas.md).
 - As-of reads and `getTurnover` need a journal with both stamps.
 - A read of the wrong kind is refused, naming the right one.
 - DSL reads are gated by the action's Execute right, not Select on the register tables.
@@ -285,6 +287,7 @@ For a history loaded from another system, an `accounting` register may declare `
 - **One constant for two resources.** Two resources mapped to the same constant read as two resources storing into one column and are refused.
 - **Period missing from the calendar.** With `periodEntity`, a month that has no row in the period entity counts as **closed**, and posting into it fails (`DF003: Period 1999-04 does not exist`). Seed or load the periods before the documents that post into them.
 - **A summed column that isn't a number.** A resource of a `balance`, `turnover` or `accounting` register, and a `totals` cache's columns, must be a scalar number. The editor and language server warn (`registers/column-not-numeric`, metadata 0.0.46) on `varchar`, `integer[]` and the like. An `info` register's resources are returned, not summed, and may be any type.
+- **"May edit" is not "may post".** Without `postAction` / `unpostAction` a role with Insert/Update on the document can post it through the API (`data.update` with the state flag) though it cannot run the Post action. **Unreleased: not in platform 1.28.12**, so do not declare these keys against that platform. Declare both (declaring one leaves the other direction open), and grant `E` on the actions (`"action:post_entry": "E"`) only to the roles that may post. Each name must be declared for that entity in the `ui/actions.json` of the package that owns the column; `module pack` refuses any other, including an action a bridge adds to the host's entity. `E` guards only the direct API path: an action with `E` that calls `update()` on the state flag can still post, so guard that inside its `execute:` (check the role or state and `error()`).
 - **Missing or unlocked `dateField`.** Required once the register has `journalDate` or `period`, and it must be in `lockedFields`.
 - **Key over dimensions.** The journal, a subordinate `info` register's records and an `autoCreate` state table are written by the platform. Each needs **one** surrogate primary key of type `bigint` (`identity`/`cuid`) or `uuid`. A key over dimensions, a multi-column key, a text key and `int4` are refused.
 - **State column narrower than the journal column.** It must hold the journal's value exactly, or unposting cannot take back what posting added.

package/skills/dforge-mcp-author/references/reports.md

@@ -75,7 +75,7 @@ A report has a `label`, a `description`, a `datasets` map, a `layout` object (`{
 ```
 
 - `query.entityCd` — source entity code (**not** `entityCode`).
-- `query.columns` — column codes; supports dot navigation (`customer.name`).
+- `query.columns` — column codes; supports dot navigation (`customer.name`). Plain column codes and reference paths only: an `{ "c", "agg" }` or `{ "formula" }` object fails `report.run`. Grouping and ad-hoc formulas belong to `ui/queries.json`; in a report, aggregate in the visualization.
 - `query.filter` — canonical filter (`{c,o,v}` or `{g,i:[...]}`); use `@param_code` to reference a parameter.
 - `query.sort` — `[{ c, d }]` where `d` ∈ `asc | desc`.
 - `columnsDef` — optional per-column display overrides (`{ label, fieldTypeCd, format, width }`; each key replaces the projected value). `label` is a literal and wins over a translated header. `visible` is accepted but read by nothing. `baseDatatypeCd` is read only where the dataset projects no columns of its own.

package/skills/dforge-mcp-author/references/security.md

@@ -81,6 +81,8 @@ Example:
 |---|---|
 | `E` | Execute (run the action/report/stored procedure, access the folder) |
 
+**`E` on an action is not limited by the user's entity rights.** The gate is on running the action, not on the statements inside it: `insert()` / `update()` / `delete()` / `query()` in its script work on an entity where the user has only `S`. Entity rights apply to the grid, the card and the API, not to action scripts (core #1580).
+
 ### Common combinations
 
 | Rights | Meaning |

package/skills/dforge-mcp-author/references/validation-checklist.md

@@ -79,6 +79,7 @@ For each entity:
 - [ ] The rendered entity has **at least one visible scalar column** (a field with `V` in `flags`, `columnType` not `S`) — a grid/list/kanban/etc. view over an entity whose fields are all hidden (or only sets) is **rejected** at validate/pack and would render "No visible columns configured for this entity." `diagram`/`matrix`/`library` are exempt
 - [ ] If set, `viewType` is from the supported list (`grid`, `list`, `kanban`, `calendar`, `gallery`, `tree-grid`, `diagram`, `master-detail`, `library`, `matrix`)
 - [ ] A `matrix` view has a `viewConfig` with `rowAxis`, `colAxis`, and `cell` (cell `entity` matches the primary `dataSources` entity; `rowKey`/`colKey` are real cell columns)
+- [ ] A `grid`/`list` view's `groupByField` and every `groupByOptions` entry is a dropdown, flags, reference or user column; `groupByOptions` includes `groupByField`; `collapsedGroups` has a valid `groupByField` and, for a dropdown, lists only its option values. **Rejected at validate/install**
 - [ ] Sort uses the view-def-root `order` key — a `string[]` like `["-created_date", "name"]` (leading `-` = descending), NOT `sort` / `[{column_cd, direction}]` (that object shape belongs to queries & reports, not data views)
 
 ## Menus
@@ -121,14 +122,12 @@ For each action:
 - [ ] DSL file exists at `logic/actions/<script>.dsl`, where `<script>` is the bare filename in the action's `script` field (no path, no `.dsl` extension)
 - [ ] DSL file has `params:`, `canExecute:`, and `execute:` blocks
 - [ ] `canExecute:` is a valid formula expression
-- [ ] If `canExecute:` is meant to **gate** and not just grey out a button, its
-      guard is expressed in the server-enforced subset — **comparisons** between
-      fields and literals, combined with `AND` / `OR` / `NOT`. Function calls
-      (`TODAY()`, `COUNT()`, `CURRENT_USER_ID()`), arithmetic, ref navigation and
-      `$[setting]` reads are fail-open server-side and are advisory only
-- [ ] No **bare boolean field** as a whole condition — `[is_active]` and
-      `NOT [is_blocked]` are not enforced (a field is only an operand). Write
-      `[is_active] = true` / `NOT ([is_blocked] = true)`
+- [ ] `canExecute:` uses only constructs the server can evaluate — fields,
+      literals, comparisons, arithmetic, `IN`, formula functions, a bare boolean
+      field. `$[setting]` reads, `SUM` / `COUNT` / `AVG` and unknown function
+      names are **refused at install**. `[ref].[col]` works on the
+      server but the client throws and **enables** the button: denormalise it
+      into a column, and count with a `G` column
 - [ ] Anything that MUST hold is also checked in `execute:` with `error()` — a
       `canExecute` alone is never the authoritative guard
 - [ ] `execute:` uses only documented built-in functions