openxiangda-skill-kit 2.0.0-alpha.131 → 2.0.0-alpha.132

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda-skill-kit",
-  "version": "2.0.0-alpha.131",
+  "version": "2.0.0-alpha.132",
   "description": "Validation and deterministic packaging for OpenXiangda 2.0 AI skills.",
   "type": "module",
   "main": "./dist/index.js",
@@ -17,7 +17,7 @@
     "README.md"
   ],
   "dependencies": {
-    "openxiangda-devkit-core": "2.0.0-alpha.106"
+    "openxiangda-devkit-core": "2.0.0-alpha.107"
   },
   "devDependencies": {
     "tsx": "4.23.12",

package/skills/manifest.json

@@ -4,7 +4,7 @@
     {
       "name": "openxiangda-v2",
       "description": "Use when researching, designing, building, testing, or delivering an OpenXiangda 2.0 application, including anonymous public forms and other no-account external-user pages.",
-      "sha256": "30164c69a712928b1d63bbc79a294820f9b1a330259e0c915dcd8c70c3fb356e"
+      "sha256": "ad7e89a4cfeba1b730cdd9504609872e1355bf5d79101c439cdf7350a4bc9678"
     }
   ]
 }

package/skills/openxiangda-v2/references/frontend.md

@@ -85,6 +85,19 @@ operation pages under `/admin/operations`; parameterized routes remain
 reachable but cannot be menu references. `defineAdminContributions` remains an
 admin-only helper and intentionally rejects `user` routes.
 
+When a Workflow Surface must link back to an application-owned business record,
+declare `detailRouteCode: { desktop, mobile }` on that resource. Both codes must
+reference explicit `surface: 'user'` routes that require the resource's read
+capability. The desktop path must stay outside `/m`, the mobile path must start
+with `/m/`, and each path must contain exactly one bounded dynamic record
+parameter; its name may follow the application domain, such as
+`:applicationId`. The compiler emits the pair in the resource Contract and in
+`resourceDefinitions`; the platform substitutes the record id from the
+authorized Workflow Surface. Never derive `/<resourceCode>/<recordId>`, add an
+alias, or build the destination in the browser. Omitting the declaration means
+there is no application business-record target; a broken published mapping
+fails closed.
+
 The platform also owns admin appearance. Wrap bespoke admin content in
 `OpenXiangdaAdminPage`. Ant Design components inherit the existing
 `ConfigProvider`; do not create another theme provider. Use
@@ -238,8 +251,9 @@ to insert a button.
 
 Generated contracts intentionally emit each resource Surface once in
 `resourceSurfaces`; `resourceDefinitions[code].surface` references that shared
-object. Import the generated runtime definitions normally. Do not serialize,
-inline or duplicate Surface literals in application code.
+object, while an explicit resource `detailRouteCode` is preserved beside it.
+Import the generated runtime definitions normally. Do not serialize, inline or
+duplicate Surface literals in application code.
 
 The standard Workflow detail renderers consume only the authoritative Surface:
 `presentation.businessDetail`, `presentation.summary`, the typed timeline and

package/skills/openxiangda-v2/references/workflow-events.md

@@ -143,6 +143,31 @@ Use a canonical navigation target with `PLATFORM_ROUTE`, `APP_ROUTE` or allowlis
 
 The Notification Hub resolves desktop, mobile and channel deep links. The landing page always re-runs platform authentication and Data/AuthZ/Workflow authorization.
 
+Business-record navigation and custom Workflow detail are separate contracts.
+To let the standard Workflow page offer “view business detail”, declare an
+explicit route pair on the subject resource:
+
+```ts
+const purchaseResource = {
+  code: 'purchases',
+  name: '采购申请',
+  detailRouteCode: {
+    desktop: 'purchase-record-detail',
+    mobile: 'purchase-record-detail-mobile',
+  },
+  fields: [/* ... */],
+} satisfies AppDataResourceDeclaration;
+```
+
+Both routes are authenticated `surface: 'user'` routes, require
+`app:<app-code>:data:<resource-code>:read`, and contain exactly one dynamic
+record parameter. Desktop stays outside `/m`; mobile starts with `/m/`. The
+parameter may be named for the domain (`:purchaseId`, `:applicationId`, and so
+on). The compiler seals the mapping and the platform renders it from the same
+active Contract revision used for Workflow navigation. With no mapping the
+Surface returns no business-record target. It never guesses a path from the
+resource code, and a malformed active mapping fails closed.
+
 To replace the standard Workflow detail page everywhere, declare both route
 codes on the Workflow definition declaration. The desktop route must be an
 `admin` route, the mobile route must be a `user` route, and both paths contain

package/skills/openxiangda-v2/references/workspace.md

@@ -26,7 +26,7 @@
 - Application login is optional `frontend.authentication`: existing platform users only, registration rejected, exact desktop `/login` and mobile `/m/login`. Bind generated `authenticationSurfaces` to separate PC/mobile renderers through `defineApplicationContributions`; renderers own only brand visuals and call `ApplicationLoginSurfaceProps`. The platform alone owns passwords, providers, OAuth state/callbacks, secure cookies, current identity and authorization. Never put login in protected `appRoutes`, call a v1 auth route, store tokens, create users/roles, or add another Router/identity provider. Keep QA in generated `platformAuthManifest`, outside the protected route denominator.
 - Branded standard user pages use the optional exact `standardUserSurfaces` contribution from `openxiangda/react`: provide separate desktop/mobile `frame` and `applicationTodoCenter` renderers or omit the property entirely. The platform still owns `/todos`, `/m/todos`, Workflow routes, `RuntimeBoundary`, current-user Notification Hub data, query/load/interaction callbacks and navigation. Never add a second Router, Todo API client, identity store or token prop.
 - External users without platform accounts use only an exact static `surface: 'user'` route declared through `frontend.publicAccess`. Declare the one resource, bounded field sets, required operations, draft limits and named duplicate validations; consume only generated `anonymousPublicAccess` and `createAnonymousPublicClient`. `own.list`/`own.read` mean records submitted by the same platform-issued HttpOnly browser credential, not a verified natural person, and another browser or cleared cookie intentionally loses access. Never create a guest role/user, call the general Native Data API, expose an anonymous upload path, store identity locally or derive ownership from IP, user-agent or fingerprint.
-- Declare each resource once in `openxiangda.config.ts` with only `code`, `name`, `fields` and optional `mutationOwner`, generated/list/layout/data-policy settings. Each field owns type, label, required state, Surface flags, reference/file metadata and access. Resource codes are lower kebab-case. Use `native` for direct Data API mutations, `action`, `readonly` or `workflow` for non-Native ownership; never grant or generate Native mutation for a non-Native owner.
+- Declare each resource once in `openxiangda.config.ts` with only `code`, `name`, `fields` and optional `mutationOwner`, generated/list/layout/data-policy settings. A Workflow subject resource may additionally declare `detailRouteCode: { desktop, mobile }`; both values reference explicit authenticated user routes that require the resource read capability, use the correct `/m` family and contain exactly one dynamic record parameter. This is the only business-record navigation source: never infer `/<resourceCode>/<recordId>` or add an alias. Each field owns type, label, required state, Surface flags, reference/file metadata and access. Resource codes are lower kebab-case. Use `native` for direct Data API mutations, `action`, `readonly` or `workflow` for non-Native ownership; never grant or generate Native mutation for a non-Native owner.
 - Never write resource-level `schemaVersion`, `appCode`, `schema`, `surface`, `capabilities`, `fieldPolicies` or `platform/data` modules. The compiler derives the strict DataResource, CRUD capabilities, Surface and AI Schema. The application manifest still starts with its one top-level `schemaVersion: 3`.
 - Ordinary list/get/create/update/delete, filters, export and batch operations use the platform Native Data API. Do not create Function CRUD or NestJS wrappers.
 - Add NestJS only for a named business action that needs a cross-resource transaction, an invariant or an external side effect.