@nexia/sdk 0.8.9 → 0.8.10

package/README.md

@@ -42,3 +42,30 @@ Reconfigure mutable fixtures per test to avoid state leaking between cases.
 `nexiaAppConfig(import.meta.url)` generates Tailwind utilities from the App resources, including lazy screens, and records emitted CSS in `nexia-host.json`. The build references the shared `@nexia/sdk/theme.css` token aliases; Core supplies token values and resets. Keep those aliases aligned with the Core theme contract. Do not bundle a second preflight or global theme.
 
 After adopting the SDK release containing this fix, rebuild and resubmit each standalone App. Existing deployed bundles are unchanged until replaced. Custom builds must declare every emitted stylesheet in `nexia-host.json`.
+
+### App API and Core host capabilities
+
+`api` from `@nexia/sdk/host` is bound to the calling App. It is not an
+unrestricted HTTP client for Core. Development frames and installed App surfaces
+use the same host transport policy; a mocked Axios response or direct HTTP test
+does not exercise that boundary.
+
+Use `useOrganizationTargetsQuery`, `useAffiliatedOperatingUnits` and Resource
+Reference options for scoped business choices. Tenant-wide administration is a
+different authority. Core's explicit host routes preserve their tenant-wide
+permissions: legal-entity/operating-unit reads, operating-unit creation,
+party duplicate lookup, user creation/invitation/credential sending, and the
+actor's self-service profile. Unsupported methods and arbitrary Core routes
+remain unavailable. A host refusal reports `APP_HOST_ROUTE_UNAVAILABLE` rather
+than proving that the actor lacks a business permission.
+
+`sendUserInvitation` and `useDataMigrationBackgroundOperation` retain the calling
+App's client. Do not replace it with a global client to bypass a refusal.
+Background operation status is accessible only to the originating App and actor;
+Core returns 404 for another App's ticket even when the actor is the same.
+The Core host-capability fix must be deployed before relying on these paths;
+an SDK-only update does not install server routes.
+
+Test both a successful call and a denied call through an actual development
+frame or installed App transport. For invitations, use a test mail sink; for
+imports, verify the terminal result as well as the initial 202 response.

package/dist/platform.d.ts

@@ -302,6 +302,18 @@ export interface ProfileSlotPropsV2 {
     familyKey: string;
     workContext: SelfWorkContext | null;
 }
+/** App-owned workforce view in the Core organization surface. No access memberships are implied. */
+export interface OrganizationWorkforceSlotPropsV1 {
+    slot: 'organization.workforce';
+    slotApiVersion: 1;
+    tenant: Pick<TenantContext, 'id' | 'name'>;
+    legalEntity: Pick<LegalEntityContext, 'name' | 'code' | 'public_id'>;
+    descriptorKey: string;
+    appKey: string;
+    familyKey: string;
+    view: 'chart' | 'table';
+    search: string;
+}
 export interface OperatingUnitScopeReference {
     public_id: string;
     code: string;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nexia/sdk",
-    "version": "0.8.9",
+    "version": "0.8.10",
     "description": "Frontend contracts for Nexia App Packages",
     "license": "UNLICENSED",
     "type": "module",