openxiangda-skill-kit 2.0.0-alpha.65 → 2.0.0-alpha.66

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda-skill-kit",
-  "version": "2.0.0-alpha.65",
+  "version": "2.0.0-alpha.66",
   "description": "Validation and deterministic packaging for OpenXiangda 2.0 AI skills.",
   "type": "module",
   "main": "./dist/index.js",
@@ -17,7 +17,7 @@
     "README.md"
   ],
   "dependencies": {
-    "openxiangda-devkit-core": "2.0.0-alpha.47"
+    "openxiangda-devkit-core": "2.0.0-alpha.48"
   },
   "devDependencies": {
     "tsx": "4.23.12",

package/skills/openxiangda-v2/SKILL.md

@@ -5,9 +5,9 @@ description: Use when building, inspecting, validating, or delivering a complete
 
 # OpenXiangda 2.0
 
-Use the generated React, NestJS and Data API workspace as one application. Before a workspace exists, invoke the exact 2.0 package published with this Skill: `pnpm dlx openxiangda-cli@2.0.0-alpha.80`. Inside an application use only its locked CLI through `pnpm openxiangda`; never invoke a bare global `openxiangda`, because that executable may belong to 1.x.
+Use the generated React, NestJS and Data API workspace as one application. Before a workspace exists, invoke the exact 2.0 package published with this Skill: `pnpm dlx openxiangda-cli@2.0.0-alpha.81`. Inside an application use only its locked CLI through `pnpm openxiangda`; never invoke a bare global `openxiangda`, because that executable may belong to 1.x.
 
-Start with `pnpm dlx openxiangda-cli@2.0.0-alpha.80 login`, then `pnpm dlx openxiangda-cli@2.0.0-alpha.80 create <directory>`. Run `pnpm openxiangda dev` for the local feedback loop and `pnpm openxiangda check` before delivery. Moving tags such as `latest` and `alpha` are forbidden for bootstrap because package-manager metadata and dlx caches can resolve an older toolchain.
+Start with `pnpm dlx openxiangda-cli@2.0.0-alpha.81 login`, then `pnpm dlx openxiangda-cli@2.0.0-alpha.81 create <directory>`. Run `pnpm openxiangda dev` for the local feedback loop and `pnpm openxiangda check` before delivery. Moving tags such as `latest` and `alpha` are forbidden for bootstrap because package-manager metadata and dlx caches can resolve an older toolchain.
 
 For an AI-native development client, start the workspace MCP through the same
 pinned executable with `pnpm exec openxiangda --mcp-stdio --cwd <workspace>`.

package/skills/openxiangda-v2/references/backend.md

@@ -53,6 +53,12 @@ Backend routes are private to the application unless their operation declaration
 }
 ```
 
+Every custom operation capability is declared once in
+`authz.capabilities` with `kind: 'backend'`, then referenced by the operation
+and granted to every role allowed to call it. A capability string written only
+on an operation or role is invalid. Resource CRUD capabilities remain generated
+and must not be copied into this catalog.
+
 Generated CRUD and custom actions use the same platform Catalog, current-user authorization, Preview/Confirm boundary and idempotent execution path. Do not create an application-owned MCP server, preview store, AI role or database client.
 
 For visitor duplicates, meeting-time conflicts, and course capacity, use
@@ -62,6 +68,33 @@ calculate replacement counters in application code. Course selection is a
 locked `record-assert` plus a bounded `increment`; replay must reach the
 platform idempotency receipt even after the course becomes full.
 
+The visitor helper has one exact command shape. `duplicateMatch` is the actual
+field-to-submitted-value object used for equality matching; it is never a list
+of field names:
+
+```ts
+return this.operations.createVisitorReservation({
+  reservationResourceCode: 'visitor-reservations',
+  duplicateMatch: {
+    visitorIdentityNumber: body.visitorIdentityNumber,
+    visitDate: body.visitDate,
+    startTime: body.startTime,
+  },
+  data: {
+    visitorIdentityNumber: body.visitorIdentityNumber,
+    visitDate: body.visitDate,
+    startTime: body.startTime,
+    status: body.status,
+  },
+  idempotencyKey: body.idempotencyKey,
+  activeStatusField: 'status',
+  activeStatusValues: ['pending', 'approved'],
+});
+```
+
+Use only declared field codes in `duplicateMatch`. Its values and `data` come
+from the same immutable request body.
+
 An idempotency key and the complete command payload are one immutable pair.
 Never put `new Date()`, `Date.now()`, `randomUUID()` or another changing value
 inside a controller while constructing the transaction. If a business time is

package/skills/openxiangda-v2/references/data-authz.md

@@ -63,6 +63,11 @@ without `access` inherits the resource read/create/update capability. Each
 access array is all-of; `false` is explicit deny. The same arrays drive the
 generated UI and platform field policies.
 
+The complete storage type set is `string`, `text`, `integer`, `decimal`,
+`boolean`, `date`, `datetime`, `uuid`, `json` and `file`. Use `integer` for
+whole numbers and `decimal` for other numeric values; `number` is not a field
+type. `openxiangda check` reports an invalid type at the authored field path.
+
 A single directory user reference uses `type: 'string'`; a single department
 or same-app resource reference uses `uuid`; any `reference.multiple: true` uses
 `json`. A resource reference also declares `resourceCode` and a string/text

package/skills/openxiangda-v2/references/workspace.md

@@ -9,6 +9,9 @@
 - A NestJS backend declares only `enabled`, `isolation: 'shared' | 'dedicated'` and `resourceProfile: 'light' | 'standard'`. Never put raw Kubernetes resources, replicas, ports or environment maps in application metadata; the platform owns capacity and scaling.
 - Use the current logged-in user and the union of application roles. Do not select RoleSession, persist platform Token or implement a second authorization path.
 - Fields inherit the resource read/create/update capabilities. Use field `access` only to tighten them; arrays are all-of and `false` is explicit deny. There is no `write` fallback.
+- Field storage types are exactly `string`, `text`, `integer`, `decimal`, `boolean`, `date`, `datetime`, `uuid`, `json` and `file`; there is no `number` type.
+- Declare every custom operation capability in `authz.capabilities` with `kind: 'backend'`, then reference that same code from the operation and its allowed roles. Generated resource CRUD capabilities do not go in this catalog.
+- Visitor duplicate protection uses `createVisitorReservation({ duplicateMatch: { fieldCode: submittedValue }, ... })`. `duplicateMatch` is a non-empty value map, never a field-name array, and no mutable pre-read is allowed.
 - Desktop and mobile pages share values, validation and authorization, but use separate renderers. Members, departments, resources and attachments use platform-owned selectors and stable IDs.
 - A single directory user reference uses a `string` field; a single department or same-app resource reference uses `uuid`; every `multiple: true` reference uses `json`. Roles that consume directory-backed fields explicitly include `app:<app-code>:directory:read`.
 - Derive role grants with `resourceCapabilityCodes(appCode, resourceCode)`. Declare current-user rows only with `currentUserDataPolicy(...)`; do not invent operators, values or alternate current-user spellings.