openxiangda 2.75.6 → 2.75.9

package/documentation/reference/mcp.md

@@ -1706,6 +1706,140 @@ MCP 使用项目锁定的根包；在客户端配置下列 stdio 启动参数，
         "input"
       ]
     },
+    {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "operation": {
+          "const": "notifications.configure-dingtalk-card",
+          "description": "配置钉钉互动卡片与可选的三方组织授权；仅使用 Secret 引用"
+        },
+        "environment": {
+          "type": "string",
+          "enum": [
+            "test",
+            "production"
+          ]
+        },
+        "input": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "bindingCode": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 128
+            },
+            "expectedRevision": {
+              "type": "integer",
+              "minimum": 0,
+              "maximum": 9007199254740991
+            },
+            "status": {
+              "type": "string",
+              "enum": [
+                "active",
+                "paused"
+              ]
+            },
+            "config": {
+              "type": "object",
+              "additionalProperties": false,
+              "properties": {
+                "schemaVersion": {
+                  "const": "openxiangda.notification.dingtalk-card-channel/v2"
+                },
+                "corpId": {
+                  "type": "string",
+                  "minLength": 1,
+                  "maxLength": 128
+                },
+                "usage": {
+                  "const": "ADVANCED"
+                },
+                "authorizationMode": {
+                  "const": "THIRD_PARTY_INSTALLATION"
+                },
+                "defaultCardTemplateId": {
+                  "type": "string",
+                  "minLength": 1,
+                  "maxLength": 255
+                },
+                "informationalTemplateParameters": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "properties": {
+                    "content": {
+                      "type": "string",
+                      "minLength": 1,
+                      "maxLength": 64,
+                      "pattern": "^[A-Za-z][A-Za-z0-9_]{0,63}$"
+                    },
+                    "link": {
+                      "type": "string",
+                      "minLength": 1,
+                      "maxLength": 64,
+                      "pattern": "^[A-Za-z][A-Za-z0-9_]{0,63}$"
+                    }
+                  },
+                  "required": [
+                    "content",
+                    "link"
+                  ]
+                },
+                "clientIdSecretRef": {
+                  "type": "string",
+                  "minLength": 1,
+                  "maxLength": 128
+                },
+                "clientSecretSecretRef": {
+                  "type": "string",
+                  "minLength": 1,
+                  "maxLength": 128
+                },
+                "robotCode": {
+                  "type": "string",
+                  "minLength": 1,
+                  "maxLength": 255
+                },
+                "callbackMode": {
+                  "const": "STREAM"
+                },
+                "supportForward": {
+                  "const": false
+                },
+                "actionTokenTtlMinutes": {
+                  "type": "integer",
+                  "minimum": 5,
+                  "maximum": 43200
+                }
+              },
+              "required": [
+                "schemaVersion",
+                "corpId",
+                "usage",
+                "clientIdSecretRef",
+                "clientSecretSecretRef",
+                "callbackMode",
+                "supportForward",
+                "actionTokenTtlMinutes"
+              ]
+            }
+          },
+          "required": [
+            "bindingCode",
+            "expectedRevision",
+            "status",
+            "config"
+          ]
+        }
+      },
+      "required": [
+        "operation",
+        "environment",
+        "input"
+      ]
+    },
     {
       "type": "object",
       "additionalProperties": false,

package/documentation/workflow-events.md

@@ -1310,3 +1310,18 @@ generationPath、sequencePath、statePath、recipientPaths、titlePath 和可选
 并创建下一轮，不因管理员变化覆盖旧任务。此能力复用平台任务中心、通知发件箱、
 供应方关闭和审计；普通 informational 通知仍不能创建待办。业务提交成功不等于
 供应方投递或用户收到，分别核对业务回执、事件投递和消息详情。
+
+
+### 三方应用互动卡片与班级接收范围
+
+应用通过 `notifications.configure-dingtalk-card` 配置模板、Secret引用和可选的 `authorizationMode: THIRD_PARTY_INSTALLATION`。三方模式按消息持久化来源组织核对Suite安装及企业身份；配置corpId仅供管理员检查渠道，不作为未知消息的默认投递企业。应用决定内容、模板和PC/移动详情目标，平台统一校验、投递并维护回执。
+
+信息模板可以声明 `informationalTemplateParameters: { content: 'content', link: 'link' }`：变量名属于应用；内容来自应用的summary，链接从应用声明的navigationTarget封装，保留路由、业务参数与字面量corpId占位符。该模式不能隐藏审批办理动作，原标准模板默认不变。高级显式卡片继续使用应用提供的cardParamMap。
+
+事件通知的可选 `directoryRecipients: [{ classIdPath: 'projection.classId', roleCodes: ['guardian'] }]` 按不可变事件所属组织解析已同步班级身份，可与recipientPaths合并去重；recipientPaths可在有目录范围时传空数组。角色限guardian/head_teacher/teacher，最多20个范围，合计最多1000人；无有效人员、无来源组织、超限、失效身份均拒绝。此能力不导出通讯录、不依据URL的corpId授权、不推断其他组织。
+
+上线渠道不会补发历史通知；真实金丝雀投递仅使用指定新业务和接收人。渠道健康、消息收到、点击打开正确组织以及业务详情权限需分别验收。
+
+通知事件可用 `targetOrganizationPath` 指向不可变业务事实中的目标组织ID（例如区级规则所属组织）。平台核验同租户有效组织及来源的祖先/后代关系，按目标组织核验接收人及安装；URL或浏览器输入不授予权限。`directoryRecipients` 始终限原学校，不允许借此跨组织展开班级成员。来源组织归属保留，接受后的目标与接收人冻结，原键重试不重新展开。
+
+worker-effect在readFields中可显式声明系统只读元数据 `organization_id`，用于冻结继承规则的真实所有者；行授权不变，未授予不能选择，写入始终拒绝。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "2.75.6",
+  "version": "2.75.9",
   "description": "OpenXiangda 2.0 的统一命令、应用 SDK、MCP 与中文 AI 技能资料。",
   "type": "module",
   "main": "./dist/index.js",
@@ -95,13 +95,13 @@
     "dayjs": "1.11.18",
     "docx-preview": "0.3.7",
     "elkjs": "0.12.0",
-    "openxiangda-cli": "2.11.18",
-    "openxiangda-contracts": "2.95.6",
-    "openxiangda-devkit-core": "2.71.7",
+    "openxiangda-cli": "2.11.21",
+    "openxiangda-contracts": "2.96.0",
+    "openxiangda-devkit-core": "2.72.0",
     "openxiangda-legacy": "npm:openxiangda@1.0.269",
-    "openxiangda-mcp": "2.2.29",
-    "openxiangda-nest": "2.22.9",
-    "openxiangda-skill-kit": "2.3.132",
+    "openxiangda-mcp": "2.2.31",
+    "openxiangda-nest": "2.22.11",
+    "openxiangda-skill-kit": "2.3.134",
     "xlsx": "https://github.com/1377385356/openxiangda/releases/download/vendor-mirror/xlsx-0.20.3.tgz"
   },
   "peerDependencies": {
@@ -167,38 +167,36 @@
   },
   "openxiangdaRelease": {
     "schemaVersion": "openxiangda.release-notes/v1",
-    "version": "2.75.6",
+    "version": "2.75.9",
     "status": "reviewed",
-    "title": "OpenXiangda 2.75.6：同域名独立租户的浏览器会话协调",
-    "summary": "平台显式按应用路径绑定独立租户时，SDK 使用平台提供的范围隔离跨标签页会话通知，并为共享接口续期传递应用路由上下文。未绑定应用沿用原有平台会话。",
-    "newFeatures": [],
-    "fixes": [
-      "隔离路径绑定租户的 BroadcastChannel 与 localStorage 退出、组织切换通知，避免新旧租户页面互相失效。",
-      "共享平台接口请求和续期携带应用路由提示；身份与租户校验继续由服务端完成。",
-      "CLI 模板及官方 contracts 制品随同一源提交配对发布；编译器授权和业务语义未改变。"
+    "title": "OpenXiangda 2.75.9: organization-scoped third-party cards",
+    "summary": "Generic event contracts retain application-owned content and targets while the platform resolves enterprise authorization and class recipients.",
+    "newFeatures": [
+      "Declared class-role notification audiences and verified related delivery organizations.",
+      "Managed configuration for third-party card channels and custom content/link parameter names.",
+      "Explicit read-only organization_id metadata for event workers; no wider row authority."
     ],
+    "fixes": [],
     "affectedUsers": [
-      "在同一域名不同应用路径部署独立租户的站点维护者及应用用户。"
+      "V2 application developers sending cards through third-party school installations."
     ],
     "compatibility": {
-      "node": "Node.js 24 or newer for maintained toolchain",
-      "generation": "OpenXiangda V2; unbound and V1 session coordination unchanged",
-      "platform": "需要支持应用入口绑定、独立平台 Cookie 与 openxiangda-platform-session-scope 元数据的配套平台。平台消费同源 openxiangda-contracts 2.95.6 制品。",
+      "node": "Node.js 24 or newer",
+      "generation": "V2 only; V1 unchanged",
+      "platform": "Requires matching notification platform services and compiler.",
       "releaseChannels": "latest / stable-v2"
     },
     "upgradeSteps": [
-      "部署兼容 SDK 的应用前端并保留成功 TEST 运行；正式复用该不可变版本。",
-      "随后在配套平台显式配置精确 host、应用编码与租户编码绑定；不修改旧域名归属，不合并账号或目录。",
-      "分别验证新旧登录、续期、退出、跨标签页及真实钉钉回调；包发布不代表现场业务验收。"
+      "Upgrade the matching backend and configure published templates with encrypted credential references.",
+      "Pin the SDK, verify organization isolation and detail permissions on TEST, then promote."
     ],
     "knownLimitations": [
-      "路径隔离保留独立登录态，但不同路径仍属于同一浏览器 origin，并非跨来源脚本安全隔离。",
-      "旧 SDK 会忽略新增范围元数据；必须先更新相关前端再启用独立租户入口。",
-      "免登仍要求对应租户的真实钉钉配置与用户身份，不会继承其他租户账号。"
+      "Package tests do not prove real DingTalk receipt, placeholder substitution or login return.",
+      "No automatic historical resend; recover uncertain results with original keys."
     ],
     "issues": [],
-    "sha256": "4af73277009cb3b1fbaef52ba5c5a6d626b3712ca95784fae852594f356867d8",
-    "url": "https://github.com/1377385356/openxiangda/releases/tag/v2.75.6"
+    "sha256": "3c215aa49c0d416cb2f5cb1b73cb8914810048ee54b1474fae49e20c877682bf",
+    "url": "https://github.com/1377385356/openxiangda/releases/tag/v2.75.9"
   },
   "scripts": {
     "build": "node ../../scripts/prune-package-dist.mjs && tsc -p tsconfig.json && node scripts/copy-assets.mjs",

package/releases/2.75.9.json

@@ -0,0 +1,33 @@
+{
+  "schemaVersion": "openxiangda.release-notes/v1",
+  "version": "2.75.9",
+  "status": "reviewed",
+  "title": "OpenXiangda 2.75.9: organization-scoped third-party cards",
+  "summary": "Generic event contracts retain application-owned content and targets while the platform resolves enterprise authorization and class recipients.",
+  "newFeatures": [
+    "Declared class-role notification audiences and verified related delivery organizations.",
+    "Managed configuration for third-party card channels and custom content/link parameter names.",
+    "Explicit read-only organization_id metadata for event workers; no wider row authority."
+  ],
+  "fixes": [],
+  "affectedUsers": [
+    "V2 application developers sending cards through third-party school installations."
+  ],
+  "compatibility": {
+    "node": "Node.js 24 or newer",
+    "generation": "V2 only; V1 unchanged",
+    "platform": "Requires matching notification platform services and compiler.",
+    "releaseChannels": "latest / stable-v2"
+  },
+  "upgradeSteps": [
+    "Upgrade the matching backend and configure published templates with encrypted credential references.",
+    "Pin the SDK, verify organization isolation and detail permissions on TEST, then promote."
+  ],
+  "knownLimitations": [
+    "Package tests do not prove real DingTalk receipt, placeholder substitution or login return.",
+    "No automatic historical resend; recover uncertain results with original keys."
+  ],
+  "issues": [],
+  "sha256": "3c215aa49c0d416cb2f5cb1b73cb8914810048ee54b1474fae49e20c877682bf",
+  "url": "https://github.com/1377385356/openxiangda/releases/tag/v2.75.9"
+}

package/skills/manifest.json

@@ -4,7 +4,7 @@
     {
       "name": "openxiangda-v2",
       "description": "使用 OpenXiangda 2.0 从模糊业务想法、已有资料或具体变更出发，通过对话发现模块、完成详细产品设计，由当前 AI Agent 按需用 Image 2.5 等图片能力形成视觉参考，直接实现真实页面并在浏览器修正，再检查和交付应用；维护 1.x 应用时使用对应的 1.x 技能。",
-      "sha256": "8f356994a579bd735eb0b50a00bcf030beb08edd5b35a377113d81ab2c24a28d"
+      "sha256": "4210e05cdd97c259e667e85cc4dd87deafa9efe535747c2621b7e5bde81b20ae"
     }
   ]
 }

package/skills/openxiangda-v2/SKILL.md

@@ -40,10 +40,10 @@ AI 接到新应用、页面或改版任务时，在同一个 OpenXiangda 工作
 未创建工作区时使用本 Skill 随根包发布的精确版本：
 
 ```bash
-pnpm dlx openxiangda@2.75.6 auth status --cwd <应用目录> --base-url <平台地址> --json
-pnpm dlx openxiangda@2.75.6 login --cwd <应用目录> --base-url <平台地址>
-pnpm dlx openxiangda@2.75.6 create <应用目录> --base-url <同一平台地址>
-pnpm dlx openxiangda@2.75.6 skill install --force
+pnpm dlx openxiangda@2.75.9 auth status --cwd <应用目录> --base-url <平台地址> --json
+pnpm dlx openxiangda@2.75.9 login --cwd <应用目录> --base-url <平台地址>
+pnpm dlx openxiangda@2.75.9 create <应用目录> --base-url <同一平台地址>
+pnpm dlx openxiangda@2.75.9 skill install --force
 ```
 
 创建前把产品要求的目标平台明确带入命令，不从旧登录态推断站点。已有工作区从原绑定恢复，平台不一致时先解决登录与目标，不改 link 文件跨站创建。

package/skills/openxiangda-v2/references/application-operations.md

@@ -118,7 +118,8 @@ Native记录事件才能使用 `ordering:record`。订阅错误先修正应用
 
 先读 `notifications.diagnostics/channels/rules`。缺少标准模板/规则时执行
 `notifications.bootstrap` 再回读。已有健康渠道可直接选默认，不必重新配置或获取密码。
-新增/更新分别用 `notifications.configure-external-http` 和 `notifications.configure-dingtalk-oa`。
+新增/更新使用 `notifications.configure-external-http`、`notifications.configure-dingtalk-oa` 或 `notifications.configure-dingtalk-card`。
+互动卡片可显式启用 `authorizationMode: THIRD_PARTY_INSTALLATION`，由平台按可信消息所属组织核对三方安装；内容、模板和详情目标由应用控制。OA工作通知配置不能代替互动卡片渠道。
 完整参数见目录inputSchema；新渠道revision用0，更新用实时revision。配置只接受Secret引用，
 不接受token、明文clientSecret或收件身份。External HTTP支持HMAC、OAuth2客户端凭据和mTLS。
 正式启用沿用服务器 `confirmProduction:true`，表示该请求明确选择正式环境，无需管理页。

package/skills/openxiangda-v2/references/getting-started.md

@@ -68,10 +68,10 @@ MCP 服务随项目根包一起安装，AI 客户端的 stdio 连接仍需配置
 以下命令的版本占位符由随包资料替换为该根包的精确版本。网站源码阅读者应先确认要使用的发行版本。
 
 ```bash
-pnpm dlx openxiangda@2.75.6 skill install --force
-pnpm dlx openxiangda@2.75.6 auth status --base-url <平台地址> --json
-pnpm dlx openxiangda@2.75.6 login --cwd my-app --base-url https://platform.example.com
-pnpm dlx openxiangda@2.75.6 create my-app --base-url https://platform.example.com
+pnpm dlx openxiangda@2.75.9 skill install --force
+pnpm dlx openxiangda@2.75.9 auth status --base-url <平台地址> --json
+pnpm dlx openxiangda@2.75.9 login --cwd my-app --base-url https://platform.example.com
+pnpm dlx openxiangda@2.75.9 create my-app --base-url https://platform.example.com
 cd my-app
 pnpm openxiangda context --json
 pnpm openxiangda dev
@@ -221,9 +221,9 @@ MCP 的 `docs_read` 可以读取本说明，当前没有独立的源码操作 MC
 无需本地工作区，使用本 Skill 随包精确版本或已安装的对应 CLI：
 
 ```bash
-pnpm dlx openxiangda@2.75.6 auth status --base-url <平台> --json
-pnpm dlx openxiangda@2.75.6 source resolve <仓库URL> --base-url <平台> --json
-pnpm dlx openxiangda@2.75.6 source clone <仓库URL> <新目录> --base-url <平台> --json
+pnpm dlx openxiangda@2.75.9 auth status --base-url <平台> --json
+pnpm dlx openxiangda@2.75.9 source resolve <仓库URL> --base-url <平台> --json
+pnpm dlx openxiangda@2.75.9 source clone <仓库URL> <新目录> --base-url <平台> --json
 ```
 
 登录缺失或站点不匹配时，先按该平台执行 login。resolve 根据平台已经登记的绑定返回

package/skills/openxiangda-v2/references/mcp.md

@@ -1706,6 +1706,140 @@ MCP 使用项目锁定的根包；在客户端配置下列 stdio 启动参数，
         "input"
       ]
     },
+    {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "operation": {
+          "const": "notifications.configure-dingtalk-card",
+          "description": "配置钉钉互动卡片与可选的三方组织授权；仅使用 Secret 引用"
+        },
+        "environment": {
+          "type": "string",
+          "enum": [
+            "test",
+            "production"
+          ]
+        },
+        "input": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "bindingCode": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 128
+            },
+            "expectedRevision": {
+              "type": "integer",
+              "minimum": 0,
+              "maximum": 9007199254740991
+            },
+            "status": {
+              "type": "string",
+              "enum": [
+                "active",
+                "paused"
+              ]
+            },
+            "config": {
+              "type": "object",
+              "additionalProperties": false,
+              "properties": {
+                "schemaVersion": {
+                  "const": "openxiangda.notification.dingtalk-card-channel/v2"
+                },
+                "corpId": {
+                  "type": "string",
+                  "minLength": 1,
+                  "maxLength": 128
+                },
+                "usage": {
+                  "const": "ADVANCED"
+                },
+                "authorizationMode": {
+                  "const": "THIRD_PARTY_INSTALLATION"
+                },
+                "defaultCardTemplateId": {
+                  "type": "string",
+                  "minLength": 1,
+                  "maxLength": 255
+                },
+                "informationalTemplateParameters": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "properties": {
+                    "content": {
+                      "type": "string",
+                      "minLength": 1,
+                      "maxLength": 64,
+                      "pattern": "^[A-Za-z][A-Za-z0-9_]{0,63}$"
+                    },
+                    "link": {
+                      "type": "string",
+                      "minLength": 1,
+                      "maxLength": 64,
+                      "pattern": "^[A-Za-z][A-Za-z0-9_]{0,63}$"
+                    }
+                  },
+                  "required": [
+                    "content",
+                    "link"
+                  ]
+                },
+                "clientIdSecretRef": {
+                  "type": "string",
+                  "minLength": 1,
+                  "maxLength": 128
+                },
+                "clientSecretSecretRef": {
+                  "type": "string",
+                  "minLength": 1,
+                  "maxLength": 128
+                },
+                "robotCode": {
+                  "type": "string",
+                  "minLength": 1,
+                  "maxLength": 255
+                },
+                "callbackMode": {
+                  "const": "STREAM"
+                },
+                "supportForward": {
+                  "const": false
+                },
+                "actionTokenTtlMinutes": {
+                  "type": "integer",
+                  "minimum": 5,
+                  "maximum": 43200
+                }
+              },
+              "required": [
+                "schemaVersion",
+                "corpId",
+                "usage",
+                "clientIdSecretRef",
+                "clientSecretSecretRef",
+                "callbackMode",
+                "supportForward",
+                "actionTokenTtlMinutes"
+              ]
+            }
+          },
+          "required": [
+            "bindingCode",
+            "expectedRevision",
+            "status",
+            "config"
+          ]
+        }
+      },
+      "required": [
+        "operation",
+        "environment",
+        "input"
+      ]
+    },
     {
       "type": "object",
       "additionalProperties": false,

package/skills/openxiangda-v2/references/multi-organization.md

@@ -29,7 +29,8 @@
 | 应用角色 `self` / `subtree` | V2 声明、组织维度角色绑定和实时 SQL 准入已接通 | 声明每个角色的覆盖意图；旧应用未声明继续沿用原行为 |
 | 家校事实到应用角色、班级范围的消费 | `authz.directoryRoleSources` 由平台投影到应用角色和字符串 scope | 使用真实来源角色事实，目录派生绑定不能手工覆盖；事实退休立即拒绝旧投影 |
 | 组织数据归属、隔离、后代可见与内容下发 | `organization.mode=owned/inherited-down`、不可改归属及 RLS 已实现 | 声明策略并核验目标站点的配套能力，按真实组织角色验收允许和拒绝 |
-| 安装回调、每校自动定时同步、组织通知路由与链接生成 | 尚未完成整条自动接入 | 不假定安装完成后立即能登录，不假定消息自动选中正确安装 |
+| 安装回调、每校自动定时同步 | 尚未完成整条自动接入 | 不假定安装完成后立即能登录 |
+| 三方互动卡片按组织授权与身份路由 | 配套平台支持显式启用的THIRD_PARTY_INSTALLATION渠道 | 核对可信来源组织、有效安装及企业身份；应用控制内容、模板、接收范围和详情目标，实际投递与点击分别验证 |
 
 平台管理组织的授权与应用业务授权是两种事实。能开通学校或查询组织树，不会自动获得该学校的业务数据权限；看到一条成员关系，也不会自动成为应用管理员。
 
@@ -181,7 +182,7 @@ data: {
 
 组织已开通但尚未安装，或安装已匹配但成员尚未同步，均不等于用户已获得应用访问权限。提示“账号信息尚未同步，请稍后再试”等状态可以使用实际平台结果，不能假装登录成功。自动安装事件、逐组织定时同步、应用可触发的有界同步请求尚未接通，不应在应用里开启无界轮询或用管理员凭据调用修复接口。
 
-平台组织 registry 支持每企业安装信息，但尚未完成 Notification Hub 按目标组织选择安装、corp-bound 详情链接的完整接入。消息到人、消息点击进入正确学校和该用户有业务权限是三个独立条件，需分别验收；不能仅凭 unionId 就认定通知会路由到正确学校。
+配套平台版本的 Notification Hub 支持通过THIRD_PARTY_INSTALLATION卡片渠道按持久化来源组织选择有效Suite安装与企业身份，首次接受通知时固定接收范围及目标安装，发送前复核身份。应用通过正式事件通知契约声明内容和目标；需要班级来源角色时可声明directoryRecipients，平台仅在事件所属组织中有界解析，不导出通讯录。信息模板的变量名由应用配置，链接封装保留应用业务参数和corpId占位符，详见[工作流与事件](workflow-events.md)。管理员必须先核对目标站点的配套版本、渠道、安装与权限。消息到人、消息点击进入正确学校和该用户有业务权限是三个独立条件，需分别验收；不能仅凭 unionId 或SDK接口存在就认定实际路由通过。
 
 ## 开发前核对与验收 {#verification}
 
@@ -202,3 +203,5 @@ DirectoryClassSummary.directoryClassId 是平台目录 UUID，sourceClassId 是
 具名后端动作声明 platformAccess: { directoryClasses: { maxIds: 20 } }，调用 OpenXiangdaBusinessDirectoryService.currentClasses(sourceClassIds) 精确解析1..maxIds个来源班级。同一动作证明中的人和工作组织由平台决定，不能传入其他userId/corpId/organizationId。缺少来源事实、工作组织、活动成员或任一选择不可读时整体拒绝；事务还需 actor-authority 和业务行边界复核。该能力是只读目录，无目录同步/管理授权。
 
 HTTP GET /openxiangda-api/v2/platform/organizations/me/directory-classes 只接受limit/after；POST /openxiangda-api/v2/applications/:appCode/directory/current-classes 的 schemaVersion 为 openxiangda.current-classes-directory-request/v1、字段为sourceClassIds。返回 openxiangda.directory-class-page/v1，绑定userId和organizationId。未部署此能力的站点不能仅凭SDK方法存在就报告接入完成。
+
+通知事件可用 `targetOrganizationPath` 指向不可变业务事实中的目标组织ID（例如区级规则所属组织）。平台核验同租户有效组织及来源的祖先/后代关系，按目标组织核验接收人及安装；URL或浏览器输入不授予权限。`directoryRecipients` 始终限原学校，不允许借此跨组织展开班级成员。来源组织归属保留，接受后的目标与接收人冻结，原键重试不重新展开。

package/skills/openxiangda-v2/references/workflow-events.md

@@ -1310,3 +1310,18 @@ generationPath、sequencePath、statePath、recipientPaths、titlePath 和可选
 并创建下一轮，不因管理员变化覆盖旧任务。此能力复用平台任务中心、通知发件箱、
 供应方关闭和审计；普通 informational 通知仍不能创建待办。业务提交成功不等于
 供应方投递或用户收到，分别核对业务回执、事件投递和消息详情。
+
+
+### 三方应用互动卡片与班级接收范围
+
+应用通过 `notifications.configure-dingtalk-card` 配置模板、Secret引用和可选的 `authorizationMode: THIRD_PARTY_INSTALLATION`。三方模式按消息持久化来源组织核对Suite安装及企业身份；配置corpId仅供管理员检查渠道，不作为未知消息的默认投递企业。应用决定内容、模板和PC/移动详情目标，平台统一校验、投递并维护回执。
+
+信息模板可以声明 `informationalTemplateParameters: { content: 'content', link: 'link' }`：变量名属于应用；内容来自应用的summary，链接从应用声明的navigationTarget封装，保留路由、业务参数与字面量corpId占位符。该模式不能隐藏审批办理动作，原标准模板默认不变。高级显式卡片继续使用应用提供的cardParamMap。
+
+事件通知的可选 `directoryRecipients: [{ classIdPath: 'projection.classId', roleCodes: ['guardian'] }]` 按不可变事件所属组织解析已同步班级身份，可与recipientPaths合并去重；recipientPaths可在有目录范围时传空数组。角色限guardian/head_teacher/teacher，最多20个范围，合计最多1000人；无有效人员、无来源组织、超限、失效身份均拒绝。此能力不导出通讯录、不依据URL的corpId授权、不推断其他组织。
+
+上线渠道不会补发历史通知；真实金丝雀投递仅使用指定新业务和接收人。渠道健康、消息收到、点击打开正确组织以及业务详情权限需分别验收。
+
+通知事件可用 `targetOrganizationPath` 指向不可变业务事实中的目标组织ID（例如区级规则所属组织）。平台核验同租户有效组织及来源的祖先/后代关系，按目标组织核验接收人及安装；URL或浏览器输入不授予权限。`directoryRecipients` 始终限原学校，不允许借此跨组织展开班级成员。来源组织归属保留，接受后的目标与接收人冻结，原键重试不重新展开。
+
+worker-effect在readFields中可显式声明系统只读元数据 `organization_id`，用于冻结继承规则的真实所有者；行授权不变，未授予不能选择，写入始终拒绝。

package/releases/2.63.0.json

@@ -1,45 +0,0 @@
-{
-  "schemaVersion": "openxiangda.release-notes/v1",
-  "version": "2.63.0",
-  "status": "reviewed",
-  "title": "Workflow design, handling nodes and editable application templates",
-  "summary": "Publish the reviewed mainline workflow designer and handling capabilities, shared-record Save, structured parallel branches and guarded workflow source synchronisation. Add editable templates, resource reference read/update contexts and read-only AI command reconciliation. The platform must use the same public contracts 2.79.0 pure compiler as the SDK.",
-  "newFeatures": [
-    "Canonical workflow designer definitions, target/variable catalogs, administration, proposals and instance adoption share the same pure validation rules.",
-    "Independent handling and correction nodes support explicit completion actions, opinion requirements, shared-record Save, return policies, durable reminders, platform notifications and supervisor-chain assignments.",
-    "Paired parallel/join nodes have bounded disjoint branches, branch-scoped position proofs and publication validation while retaining immutable task-entry authority.",
-    "Workflow source export/import, read-only version registration plans and environment synchronisation use digest and target-head guards and preserve prepared version history.",
-    "Editable application templates cover administration, PC, mobile and login frames, with shared resource-page controllers, source digests and composition validation.",
-    "Resource reference filtering has an independent read intent; ordinary edits supply saved-record id/revision and actual edits for authoritative server-side merge.",
-    "AI reconciliation binds a read-only GET/read operation to the original command receipt instead of replaying a business mutation."
-  ],
-  "fixes": [
-    "Give the new workflow pure-rule APIs a fresh public contracts version so platforms need not privately add exports under an already published semver.",
-    "Correct canvas branch selection, outline hierarchy and approval action presentation while retaining permissions, CAS, idempotency and unknown-result recovery.",
-    "Export standard resource query, cascade and address helpers from shared contracts so browser and platform consumers use the same query semantics."
-  ],
-  "affectedUsers": [
-    "OpenXiangda V2 platforms and applications using workflow design, independent handling, shared Save, reminders, notifications or instance adoption.",
-    "V2 workspaces using editable template composition, resource reference fields or read-only AI result reconciliation."
-  ],
-  "upgradeSteps": [
-    "Deploy a platform matching the actual contracts 2.79.0 native validator first. Server contracts must come from the official published tarball with verified SRI.",
-    "Upgrade the complete workspace distribution to public openxiangda 2.63.0, install the lockfile and refresh project documentation and MCP sessions.",
-    "Preserve application, record, task, workflow-version and idempotency identities. Run normal check/deploy preflight against the actual platform capabilities and validator digest.",
-    "Verify workflow design, shared Save, handling completion, return paths, notification recipients and reference reads/updates with real roles before environment promotion."
-  ],
-  "knownLimitations": [
-    "New reference contexts and workflow contracts require the matching platform to be deployed first; declaring a different digest does not establish compatibility.",
-    "Template appearance and package regressions do not replace real-role, notification, instance-adoption and business-data acceptance.",
-    "The separate event-receipt lease-ownership and worker-effect candidates are not included in this public release."
-  ],
-  "compatibility": {
-    "generation": "v2",
-    "node": ">=24",
-    "platform": "contracts 2.79.0 exact native validator and matching workflow/resource contexts",
-    "v1": "Independent 1.x maintenance distribution is unchanged"
-  },
-  "issues": [],
-  "sha256": "ef4279a6f846a604d68dbd1adc2473203ffef4287e2dc74b51aa17727a7397b5",
-  "url": "https://github.com/1377385356/openxiangda/releases/tag/v2.63.0"
-}

package/releases/2.63.1.json

@@ -1,46 +0,0 @@
-{
-  "schemaVersion": "openxiangda.release-notes/v1",
-  "version": "2.63.1",
-  "status": "reviewed",
-  "title": "流程设计、独立办理与公开契约配套发行",
-  "summary": "正式发行已评审的流程设计、办理节点、共享数据保存、结构化并行、提醒通知和流程源码同步能力，提供可编辑应用模板、资源引用读取上下文及只读 AI 回执核对，同时修复首次导入前的源基线比较和配置写入边界。公开 SDK 与 contracts 2.79.1 使用同一冻结分发。",
-  "newFeatures": [
-    "流程设计、变量和目标目录、管理员配置、设计提案及历史实例接管共用规范定义与纯校验规则。",
-    "独立办理与补正节点支持明确完成动作、意见要求、共享数据保存、退回策略、持久提醒、平台通知和主管链规则。",
-    "结构化 parallel/join 节点支持有界独立分支、分支位置证明及发布校验，保留任务进入时的权威事实。",
-    "流程源码导出、导入、版本注册和环境同步使用源摘要及目标版本守卫，保留准备版本历史。",
-    "可编辑模板覆盖后台、PC、移动端和登录外观，资源页控制器、来源摘要及组合校验共用标准边界。",
-    "资源引用筛选使用独立读取意图；普通关联编辑提供记录 id/revision 和实际编辑上下文，由平台合并权威绑定。",
-    "AI 核对通过只读 GET/read 查询原幂等键的提交回执，不重新执行业务命令。"
-  ],
-  "fixes": [
-    "首次导入前按目标应用声明比较流程源状态，忽略其他环境观察，复用规范摘要、校验源锁并将写入限定于应用导出的配置。",
-    "并行分支卡片居中且条件开关保持单行，审批布局继续保留权限、CAS、幂等和未知结果恢复。",
-    "新增流程规则使用正式公开 contracts 新版本，不在已公开旧版本号下私有添加 API。",
-    "封包清单正确检查 template/list 命令，参考候选仓库支持显式任务代理访问官方上游。"
-  ],
-  "affectedUsers": [
-    "使用流程设计、独立办理、共享保存、提醒通知、流程源同步或历史实例接管的 OpenXiangda 2.0 平台和应用。",
-    "使用可编辑模板、资源引用字段或只读 AI 结果核对的 2.0 工作区。"
-  ],
-  "upgradeSteps": [
-    "先部署与 contracts 2.79.1 实际纯规则摘要一致的平台；服务器使用官方公开 tarball 并核对 SRI。",
-    "完整工作区分发升级到 openxiangda 2.63.1，按锁文件安装并刷新资料及 MCP 连接。",
-    "保留原应用、数据、任务、流程版本和幂等标识，正常 check/deploy 核对实际能力与 validatorDigest。",
-    "按真实角色验证设计、保存、办理完成、退回、通知收件人及关联字段读写，再执行原晋级流程。"
-  ],
-  "knownLimitations": [
-    "新增读取上下文和流程契约需要配套平台先升级，修改摘要不能代替真实兼容性。",
-    "包测试和模板外观不代替真实角色、通知、实例接管及业务数据读回验收。",
-    "事件回执租约对象归属和 Worker 原子效果仍为独立 PLT-040 候选，本次不包含未整合改动。"
-  ],
-  "compatibility": {
-    "generation": "v2",
-    "node": ">=24",
-    "platform": "contracts 2.79.1 exact native validator and matching workflow/resource contexts",
-    "v1": "独立 1.x 维护分发不变"
-  },
-  "issues": [],
-  "sha256": "364565fc1ab2b4a1db89328b684ca7f5d1b261ad882e00e5da7c1687e5be7861",
-  "url": "https://github.com/1377385356/openxiangda/releases/tag/v2.63.1"
-}