openxiangda-cli 2.0.0-alpha.143 → 2.0.0-alpha.144

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda-cli",
-  "version": "2.0.0-alpha.143",
+  "version": "2.0.0-alpha.144",
   "description": "Thin application-level CLI for OpenXiangda 2.0.",
   "type": "module",
   "main": "./dist/index.js",
@@ -21,10 +21,10 @@
   ],
   "dependencies": {
     "@oclif/core": "4.13.3",
-    "openxiangda-contracts": "2.0.0-alpha.72",
-    "openxiangda-devkit-core": "2.0.0-alpha.92",
-    "openxiangda-mcp": "2.0.0-alpha.92",
-    "openxiangda-skill-kit": "2.0.0-alpha.113"
+    "openxiangda-contracts": "2.0.0-alpha.73",
+    "openxiangda-devkit-core": "2.0.0-alpha.93",
+    "openxiangda-mcp": "2.0.0-alpha.93",
+    "openxiangda-skill-kit": "2.0.0-alpha.114"
   },
   "devDependencies": {
     "tsx": "4.23.12",

package/template/AGENTS.md

@@ -12,7 +12,7 @@
 - Add NestJS only for a named business action that needs a cross-resource transaction, an invariant or an external side effect.
 - Every interactive business action binds `@OpenXiangdaOperation(operation)` and injects `OpenXiangdaBusinessDataApiService`, `OpenXiangdaBusinessNotificationService`, or `OpenXiangdaStandardOperations`. The platform checks the action capability once at App API ingress; the trusted backend then has full Data/managed business-notification access only to its exact application/environment while audit retains the initiating user and action. Do not author `authorizationJSON`, forward user tokens, grant ordinary users `app:notification2:send`, or reapply the user's resource, row and field permissions inside the action.
 - A NestJS backend declares only `enabled`, `isolation: 'shared' | 'dedicated'` and `resourceProfile: 'light' | 'standard'`. Never put raw Kubernetes resources, replicas, ports or environment maps in application metadata; the platform owns capacity and scaling.
-- Use the current logged-in user and the union of that user's application roles. An optional declared Perspective projects only read visibility (pages, rows and fields); create/update/delete, workflows and custom actions continue to authorize against the complete union. Standard Data API calls inherit `X-OpenXiangda-Perspective` automatically. Use `@CurrentPerspective()` only when custom Nest code reads outside the standard Data API, and apply an equivalent read projection explicitly. Business code must not persist a platform Token or authorization result and must not implement a second identity path.
+- Use the current logged-in user and the union of that user's application roles. An app for every logged-in platform user may declare one existing package role through `authz.authenticatedUserRoleCode`; the platform materializes it on first access and unions it with manual and business-projected roles. Do not fabricate a browser fallback role or use a business membership resource for this universal audience. An optional declared Perspective projects only read visibility (pages, rows and fields); create/update/delete, workflows and custom actions continue to authorize against the complete union. Standard Data API calls inherit `X-OpenXiangda-Perspective` automatically. Use `@CurrentPerspective()` only when custom Nest code reads outside the standard Data API, and apply an equivalent read projection explicitly. Business code must not persist a platform Token or authorization result and must not implement a second identity path.
 - Fields inherit the resource read/create/update capabilities. Use field `access` only to tighten them; arrays are all-of and `false` is explicit deny. There is no `write` fallback.
 - Field `type` is semantic, never a hand-authored database type. The supported catalog is exactly `text.short`, `text.long`, `text.rich`, `number.integer`, `number.decimal`, `boolean`, `date`, `time`, `datetime`, `date-range`, `datetime-range`, `option.single`, `option.multiple`, `cascade.single`, `cascade.multiple`, `user.single`, `user.multiple`, `department.single`, `department.multiple`, `resource-ref.single`, `resource-ref.multiple`, `file`, `image`, `signature`, `address`, `location`, `json`, `serial-number`, `uuid` and `subtable`. The compiler alone derives PostgreSQL columns, constraints and indexes.
 - Every `date-range` and `datetime-range` field explicitly declares `rangeBoundary: 'closed' | 'half-open'`. Values remain `{ start, end }`; callers never send or override the boundary. Closed ranges allow `start <= end` and use PostgreSQL `[]`; half-open ranges require `start < end` and use `[)`.

package/template/apps/server/package.json

@@ -15,7 +15,7 @@
     "@nestjs/common": "11.1.29",
     "@nestjs/core": "11.1.29",
     "@nestjs/platform-fastify": "11.1.29",
-    "openxiangda": "2.0.0-alpha.62",
+    "openxiangda": "2.0.0-alpha.63",
     "reflect-metadata": "0.2.2",
     "rxjs": "7.8.2"
   },

package/template/apps/web/package.json

@@ -14,7 +14,7 @@
     "@ant-design/icons": "6.2.3",
     "@refinedev/core": "5.0.12",
     "antd": "6.4.3",
-    "openxiangda": "2.0.0-alpha.62",
+    "openxiangda": "2.0.0-alpha.63",
     "react": "19.2.8",
     "react-dom": "19.2.8",
     "react-router-dom": "7.8.2"

package/template/package.json

@@ -23,7 +23,7 @@
     "build": "pnpm --recursive build"
   },
   "devDependencies": {
-    "openxiangda": "2.0.0-alpha.62",
+    "openxiangda": "2.0.0-alpha.63",
     "typescript": "5.9.3"
   }
 }

package/template/packages/contracts/src/generated.ts

@@ -1,5 +1,5 @@
 // Generated by OpenXiangda 2.0 Native compiler. Do not edit by hand.
-export const compilerContractVersion = "native-3" as const;
+export const compilerContractVersion = "native-4" as const;
 export const appCode = "openxiangda-application" as const;
 export const appName = "OpenXiangda 应用" as const;
 export const appPerspectives = [] as const;