openxiangda-skill-kit 2.0.0-alpha.95 → 2.0.0-alpha.97
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -14,6 +14,15 @@ for this exact application, environment, version and operation. Do not forward
|
|
|
14
14
|
the caller's resource, row or field permissions into that internal Data call,
|
|
15
15
|
and do not author an `authorizationJSON` permission mirror. The platform still
|
|
16
16
|
records the initiating user and action code in records, files, events and audit.
|
|
17
|
+
The platform models this internal hop as the request-bounded
|
|
18
|
+
`native-business-action` principal. It is neither an OAuth client nor a Native
|
|
19
|
+
runtime credential: PostgreSQL accepts it only after the platform has verified
|
|
20
|
+
the signed Gateway invocation, exact target/Head, published
|
|
21
|
+
`code + requiredCapability`, application data scope and initiating user. Never
|
|
22
|
+
copy an invocation token into application data, construct the action headers
|
|
23
|
+
yourself, or fall back to `OpenXiangdaApplicationDataApiService` when this
|
|
24
|
+
channel is rejected; a rejection means the platform/package combination is not
|
|
25
|
+
compatible or the invocation is stale.
|
|
17
26
|
|
|
18
27
|
For an informational business notification, inject
|
|
19
28
|
`OpenXiangdaBusinessNotificationService` in the same declared action. The SDK
|
|
@@ -109,6 +109,12 @@ generated UI and platform field policies.
|
|
|
109
109
|
|
|
110
110
|
Field types are semantic, not PostgreSQL storage aliases. Use the catalog in the generated `AGENTS.md`: for example `text.short`, `number.integer`, `user.single`, `department.multiple`, `resource-ref.single`, `file`, `address` and `subtable`. The compiler alone chooses storage columns and constraints. Reference fields store JSON display values. For `resource-ref.*`, `resourceCode`, `value`, `label`, optional `description` and optional `snapshot` are convenient historical display data only: the target resource remains authoritative, the platform does not create a foreign key or refresh/check the stored JSON, and business actions that need current target state must query it by `resourceCode` plus `value`. A resource source `labelField` must point to `text.short` or `text.long`; a `serial-number` field can be listed in `searchFields`, `descriptionFields` or `snapshotFields`, but it is not a display label. File limits exist only under `file`; `maxCount` owns the single/multiple bound and `maxSizeMb` owns the per-file size bound. There is no `file.multiple` key.
|
|
111
111
|
|
|
112
|
+
Generated list, detail, audit and preview surfaces render the stored canonical
|
|
113
|
+
`label` snapshots for `option.*`, `user.*`, `department.*` and
|
|
114
|
+
`resource-ref.*`, including multiple arrays and the first linked list column.
|
|
115
|
+
Do not add application formatters, directory re-queries or browser-side joins
|
|
116
|
+
for these standard fields.
|
|
117
|
+
|
|
112
118
|
Numeric bounds belong on the field declaration and are enforced by the
|
|
113
119
|
platform for every write path. They are inclusive, and only valid on
|
|
114
120
|
`number.integer` or `number.decimal`:
|