openxiangda-skill-kit 2.0.0-alpha.95 → 2.0.0-alpha.97

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "openxiangda-skill-kit",
3
- "version": "2.0.0-alpha.95",
3
+ "version": "2.0.0-alpha.97",
4
4
  "description": "Validation and deterministic packaging for OpenXiangda 2.0 AI skills.",
5
5
  "type": "module",
6
6
  "main": "./dist/index.js",
@@ -14,6 +14,15 @@ for this exact application, environment, version and operation. Do not forward
14
14
  the caller's resource, row or field permissions into that internal Data call,
15
15
  and do not author an `authorizationJSON` permission mirror. The platform still
16
16
  records the initiating user and action code in records, files, events and audit.
17
+ The platform models this internal hop as the request-bounded
18
+ `native-business-action` principal. It is neither an OAuth client nor a Native
19
+ runtime credential: PostgreSQL accepts it only after the platform has verified
20
+ the signed Gateway invocation, exact target/Head, published
21
+ `code + requiredCapability`, application data scope and initiating user. Never
22
+ copy an invocation token into application data, construct the action headers
23
+ yourself, or fall back to `OpenXiangdaApplicationDataApiService` when this
24
+ channel is rejected; a rejection means the platform/package combination is not
25
+ compatible or the invocation is stale.
17
26
 
18
27
  For an informational business notification, inject
19
28
  `OpenXiangdaBusinessNotificationService` in the same declared action. The SDK
@@ -109,6 +109,12 @@ generated UI and platform field policies.
109
109
 
110
110
  Field types are semantic, not PostgreSQL storage aliases. Use the catalog in the generated `AGENTS.md`: for example `text.short`, `number.integer`, `user.single`, `department.multiple`, `resource-ref.single`, `file`, `address` and `subtable`. The compiler alone chooses storage columns and constraints. Reference fields store JSON display values. For `resource-ref.*`, `resourceCode`, `value`, `label`, optional `description` and optional `snapshot` are convenient historical display data only: the target resource remains authoritative, the platform does not create a foreign key or refresh/check the stored JSON, and business actions that need current target state must query it by `resourceCode` plus `value`. A resource source `labelField` must point to `text.short` or `text.long`; a `serial-number` field can be listed in `searchFields`, `descriptionFields` or `snapshotFields`, but it is not a display label. File limits exist only under `file`; `maxCount` owns the single/multiple bound and `maxSizeMb` owns the per-file size bound. There is no `file.multiple` key.
111
111
 
112
+ Generated list, detail, audit and preview surfaces render the stored canonical
113
+ `label` snapshots for `option.*`, `user.*`, `department.*` and
114
+ `resource-ref.*`, including multiple arrays and the first linked list column.
115
+ Do not add application formatters, directory re-queries or browser-side joins
116
+ for these standard fields.
117
+
112
118
  Numeric bounds belong on the field declaration and are enforced by the
113
119
  platform for every write path. They are inclusive, and only valid on
114
120
  `number.integer` or `number.decimal`: