openxiangda 1.0.156 → 1.0.157

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.156",
+  "version": "1.0.157",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {
@@ -62,7 +62,7 @@
   "scripts": {
     "build:sdk": "tsup --config packages/sdk/tsup.config.ts",
     "check": "node --check bin/openxiangda.js && node --check lib/*.js && node --check packages/sdk/src/build-source/src/cli.mjs && node --check packages/sdk/src/build-source/scripts/*.mjs && node --check packages/sdk/src/build-source/scripts/utils/*.mjs",
-    "test": "npm run check && node scripts/form-export-cli-smoke.mjs",
+    "test": "npm run check && node scripts/form-export-cli-smoke.mjs && node scripts/open-api-cli-smoke.mjs",
     "prepack": "npm run build:sdk",
     "test:profile-isolation": "bash scripts/profile-isolation-smoke.sh",
     "test:resource-plan": "node scripts/resource-plan-smoke.mjs",
@@ -75,8 +75,11 @@
     "test:app-function-fallback": "node scripts/app-function-source-fallback-smoke.mjs",
     "test:runtime-deploy": "node scripts/runtime-deploy-smoke.mjs",
     "test:sdd": "node scripts/sdd-smoke.mjs",
+    "test:open-api": "node scripts/open-api-cli-smoke.mjs",
     "test:skill-install": "bash scripts/skill-install-smoke.sh",
-    "test:workspace-init": "bash scripts/workspace-init-smoke.sh"
+    "test:workspace-init": "bash scripts/workspace-init-smoke.sh",
+    "open-api:sync": "node scripts/sync-dingtalk-openapi.mjs",
+    "open-api:verify": "node scripts/sync-dingtalk-openapi.mjs --check"
   },
   "dependencies": {
     "@ant-design/cssinjs": "^1.23.0",

package/templates/openxiangda-react-spa/.cursor/rules/openxiangda.mdc

@@ -16,6 +16,7 @@ This is an OpenXiangda React SPA workspace. See [AGENTS.md](mdc:AGENTS.md) for f
 | full deploy | `pnpm deploy -- --profile <name>` |
 | diff / plan | `openxiangda resource plan --profile <name>` |
 | diagnose | `openxiangda doctor --profile <name> --json` |
+| external backend Open API | `openxiangda-open-api` + `openxiangda open-api spec describe ...` |
 
 ## Always
 
@@ -29,6 +30,7 @@ This is an OpenXiangda React SPA workspace. See [AGENTS.md](mdc:AGENTS.md) for f
 - Use `AttachmentField` / `ImageField` for form-context previews, and `AttachmentPreviewList` / `ImagePreviewGrid` / `useFilePreview` for standalone custom pages. Do not fake form context, import internal preview implementations, or maintain local previewable-extension lists.
 - Backend permissions, public-access grants, and App Function role/scope checks are authoritative.
 - Query parameters are context, filters, or ticket input only; they are not sensitive authorization.
+- External backends using `/dingtalk-api/v1.0` must own AK/SK and token storage; never pass those credentials into the React SPA.
 
 ## Never
 

package/templates/openxiangda-react-spa/.qoder/rules/openxiangda.md

@@ -16,6 +16,7 @@ This is an OpenXiangda React SPA workspace. Read [AGENTS.md](AGENTS.md) for full
 | 完整部署 / deploy | `pnpm deploy -- --profile <name>` |
 | 资源计划 / diff | `openxiangda resource plan --profile <name>` |
 | 诊断 / 环境 | `openxiangda doctor --profile <name> --json` / `openxiangda env --profile <name>` |
+| 外部后端 / 三方系统开放接口 | `openxiangda-open-api` + `openxiangda open-api spec describe ...` |
 
 ## Always
 
@@ -29,6 +30,7 @@ This is an OpenXiangda React SPA workspace. Read [AGENTS.md](AGENTS.md) for full
 - 表单附件预览使用 `AttachmentField` / `ImageField`；普通自定义页面使用 `AttachmentPreviewList` / `ImagePreviewGrid` / `useFilePreview`，不要伪造表单上下文、直接引用内部预览实现或维护扩展名白名单。
 - 页面权限、表单权限、公开访问 grants、App Function 后端检查是授权依据；前端只做展示保护。
 - 查询参数只能做上下文、筛选或 ticket 输入，不能作为敏感数据授权依据。
+- 外部后端使用 `/dingtalk-api/v1.0` 时由后端自己保管 AK/SK 和 token；React SPA 不得接收这些凭证。
 
 ## Never
 

package/templates/openxiangda-react-spa/AGENTS.md

@@ -19,6 +19,7 @@
 - 只给用户分配“管理员”业务角色不等于授权其设置角色；缺少 `app:role:manage` 时角色创建、成员分配和角色接口权限授予会被后端拒绝。
 - 本地开发通过 Vite `/service` 代理远端平台，保持 HttpOnly Cookie 同域访问。
 - 新公开访问页使用 `/view/:appType/public/*`、`src/resources/routes/`、`src/resources/public-access/` 和 `PublicAccessGate`。不要使用旧 `?publicAccess=guest`。
+- 外部后端或三方系统调用享搭时，使用 `openxiangda-open-api` 与 `openxiangda open-api spec describe`；不要把 AK/SK 或开放 API token 放进 React SPA。
 
 ## 常用命令
 

package/templates/sy-lowcode-app-workspace/.cursor/rules/openxiangda.mdc

@@ -21,6 +21,7 @@ This is a `sy-lowcode-app-workspace` managed by the `openxiangda` CLI. See [AGEN
 | account / role / permission / data scope / query-param authorization | `openxiangda-permission-settings` | run `openxiangda design gates --topic permissions --json` first, then `openxiangda permission ...` / `openxiangda settings ...` |
 | diagnose / snapshot / 排查 / 报错 | `openxiangda-inspect` | `openxiangda app snapshot APP_XXX --profile <name> --json` |
 | login / token / switch profile | `openxiangda-core` | `openxiangda env --profile <name>` / `openxiangda auth status` |
+| external backend / third-party platform calls / AK/SK | `openxiangda-open-api` | `openxiangda open-api spec list --search <keyword> --json` |
 
 ## Always
 
@@ -39,7 +40,7 @@ This is a `sy-lowcode-app-workspace` managed by the `openxiangda` CLI. See [AGEN
 ## Never
 
 - ❌ `pnpm publish:all` / `pnpm publish:oss` / `pnpm register` / `lowcode-workspace publish-*` directly. They are guarded by `_guard:publish` and will fail-fast without `OPENXIANGDA_PROFILE`.
-- ❌ Ask for AK / SK / appKey / appSecret.
+- ❌ Ask the user to paste AK / SK / appKey / appSecret into chat; use authorized `open-api credential` secure handoff for external backends.
 - ❌ Search the platform for similar app names when `.openxiangda/state.json` has no binding.
 - ❌ Copy `formUuid` / `pageId` / `workflowId` / `automationId` across profiles.
 - ❌ Run a full publish for a single-file edit.

package/templates/sy-lowcode-app-workspace/.qoder/rules/openxiangda.md

@@ -21,6 +21,7 @@ This is a `sy-lowcode-app-workspace` managed by the `openxiangda` CLI. Read [AGE
 | 账号 / 角色 / 权限 / 数据范围 / 查询参数授权 | `openxiangda-permission-settings` | 先 `openxiangda design gates --topic permissions --json`，再 `openxiangda permission ...` / `openxiangda settings ...` |
 | 排查 / 快照 / 对比 / 报错 | `openxiangda-inspect` | `openxiangda app snapshot APP_XXX --profile <name> --json` |
 | 登录 / token / 切平台 | `openxiangda-core` | `openxiangda env --profile <name>` / `openxiangda auth status` |
+| 外部后端 / 三方系统调用享搭 / AK/SK | `openxiangda-open-api` | `openxiangda open-api spec list --search <keyword> --json` |
 
 ## Always
 
@@ -39,7 +40,7 @@ This is a `sy-lowcode-app-workspace` managed by the `openxiangda` CLI. Read [AGE
 ## Never
 
 - ❌ `pnpm publish:all` / `pnpm publish:oss` / `pnpm register` / `lowcode-workspace publish-*` 直接调用。它们由 `_guard:publish` 拦截，缺少 `OPENXIANGDA_PROFILE` 时会 fail-fast。
-- ❌ 询问 AK / SK / appKey / appSecret。
+- ❌ 要求用户在对话中粘贴 AK / SK / appKey / appSecret；获授权的外部后端集成使用 `open-api credential` 安全交付。
 - ❌ 在没有本地 `.openxiangda/state.json` 绑定时，去平台搜索同名应用"复用"。
 - ❌ 把 `formUuid` / `pageId` / `workflowId` / `automationId` 从 dev 复制到 prod。
 - ❌ 改一处就全量发布。

package/templates/sy-lowcode-app-workspace/AGENTS.md

@@ -31,6 +31,7 @@
 | 登录 / 切平台 / token / whoami | `openxiangda-core` | `openxiangda env --profile <name>` / `openxiangda auth status` |
 | 多表只读联表查询 / 报表数据源 | `openxiangda-form`（data view） | 在 `src/resources/data-views/<code>.json` 声明 → `resource publish` |
 | 调外部 / 第三方 API / 钉钉 / 自建系统 | `openxiangda-page`（connector） | 在 `src/resources/connectors/<code>.json` 声明 → `sdk.connector.invoke()` |
+| 外部后端 / 三方系统调用享搭 / AK/SK / 开放接口 | `openxiangda-open-api` | `openxiangda open-api spec list --search <keyword> --json` |
 | 资源诊断 / 小步修复 / 同步 manifest | 对应资源 skill | `openxiangda route|public-access|auth-config|function|connector|notification|data-view|menu|permission ... --dry-run` |
 
 ## 必须遵守
@@ -52,7 +53,7 @@
 ## 严禁
 
 - ❌ 直接 `pnpm publish:all` / `pnpm publish:oss` / `pnpm register` / `lowcode-workspace publish-*`。它们是工作区内部脚本，不会注入 `OPENXIANGDA_PROFILE / BASE_URL / ACCESS_TOKEN / APP_TYPE`，发到错的环境也无人提醒。
-- ❌ 询问 AK / SK / appKey / appSecret。整个流程基于普通用户登录 token。
+- ❌ 要求用户在对话中粘贴 AK / SK / appKey / appSecret。普通工作区流程使用用户 token；获授权的外部后端集成使用 `open-api credential` 安全交付。
 - ❌ 在没有本地 `.openxiangda/state.json` 绑定时，去平台搜索同名应用尝试"复用"。空目录 / 无绑定 → 直接 `workspace init --app-name` 创建新应用。
 - ❌ 把 `openxiangda form create` / `form publish` / `page publish` 当作日常页面生成方式。它们仅作底层修复 / 诊断。
 - ❌ 改一个文件就 `workspace publish` 全量。
@@ -100,7 +101,7 @@ sy-lowcode-app-workspace/
 
 ## 还想看更细的
 
-- 全局 skill：`~/.qoder/skills/openxiangda/SKILL.md`（root 决策卡）+ 7 个子 skill。
+- 全局 skill：`~/.qoder/skills/openxiangda/SKILL.md`（root 决策卡）+ 9 个子 skill。
 - 资源 / 连接器 manifest：`docs/openxiangda-resources-and-connectors.md`（来自 openxiangda 仓库）。
 - 平台数据模型：`references/platform-data-model.md`（option `{label, value}`、附件、成员字段等持久化形态）。
 - 排错清单：`references/troubleshooting.md`。