openxiangda-skill-kit 2.0.0-alpha.56 → 2.0.0-alpha.57

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda-skill-kit",
-  "version": "2.0.0-alpha.56",
+  "version": "2.0.0-alpha.57",
   "description": "Validation and deterministic packaging for OpenXiangda 2.0 AI skills.",
   "type": "module",
   "main": "./dist/index.js",
@@ -17,7 +17,7 @@
     "README.md"
   ],
   "dependencies": {
-    "openxiangda-devkit-core": "2.0.0-alpha.42"
+    "openxiangda-devkit-core": "2.0.0-alpha.43"
   },
   "devDependencies": {
     "tsx": "4.23.12",

package/skills/openxiangda-v2/references/data-authz.md

@@ -3,3 +3,5 @@
 Declare stable capabilities and application roles. Express row access with platform-enforced predicates such as unrestricted school access, college field matching and current-user membership in an instrument manager array.
 
 Declare restricted field access separately for read, create and update. There is no shared `write` field and no fallback. A resource create capability owns unrestricted fields; generated update access is denied until the field declares update capabilities. Capability arrays are all-of. Frontend filtering is presentation only. Run `pnpm openxiangda check` after every policy change.
+
+One resource field owns storage and selector semantics together. A single `directory-user` reference uses `type: 'string'`; a single `directory-department` or same-application `resource` reference uses `type: 'uuid'`; every reference with `multiple: true` uses `type: 'json'`. Resource references must target a declared resource and a `string` or `text` label field. File limits belong only on `type: 'file'`. Never save labels or copied directory objects. Any role that reads or edits directory-backed fields must explicitly include `app:<app-code>:directory:read`.

package/skills/openxiangda-v2/references/workspace.md

@@ -9,5 +9,6 @@
 - Use the current logged-in user and the union of application roles. Do not select RoleSession, persist platform Token or implement a second authorization path.
 - Declare restricted field read, create and update permissions explicitly. There is no `write` fallback; generated update permission is denied unless explicitly granted.
 - Desktop and mobile pages share values, validation and authorization, but use separate renderers. Members, departments, resources and attachments use platform-owned selectors and stable IDs.
+- A single directory user reference uses a `string` field; a single department or same-app resource reference uses `uuid`; every `multiple: true` reference uses `json`. Roles that consume directory-backed fields explicitly include `app:<app-code>:directory:read`.
 - Do not add compatibility aliases, migration branches or silent fallbacks for an earlier 2.0 alpha contract. Replace an incorrect contract and regenerate the application.
 - Run `pnpm openxiangda check` after contract changes. Deploy with `pnpm openxiangda deploy`, inspect with `pnpm openxiangda status` and `pnpm openxiangda logs`, and use the platform rollback command rather than mutating K3s directly.