openxiangda 1.0.161 → 1.0.163

package/README.md

@@ -119,6 +119,8 @@ openxiangda resource publish function --code customer_get --change <change> --pr
   --replace-manifest --reason "reviewed manifest is the complete desired definition"
 ```
 
+Exact `--only` / `--code` selectors are applied before unrelated manifests, source dependencies, and JS_CODE targets are read or built. Shared/transitive dependencies of the selected targets remain in scope; omitting a selector intentionally preserves full-workspace validation and planning. Resource commands use the packaged canonical scoped builder for standard workspaces, so an older checked-in `scripts/build-js-code.mjs` does not need to be upgraded before the installed CLI gains this optimization; refresh the workspace template only when developers also need the same behavior from a manual `pnpm build-js-code` command.
+
 For source-only Function/Automation changes, the final command does not reconstruct whole definitions with client-side GET+PUT. `release begin` captures the Git/change baseline, one preflight covers every selected code, and Backend Release performs one `prepare -> verify -> activate` sequence for all eligible updates. Inspect history with `openxiangda release backend-head|backend-list|backend-detail`, compare it with `backend-diff`, or create an audited immutable rollback with `backend-rollback <releaseId> --change <change> --reason "..."`. Always run `release end` when promotion finishes or is abandoned.
 
 Page repair publishing is staged by default. It first freezes `pages/snapshot`, sends the active Page Release parent plus every page revision, and uses revision `0` only for a genuinely new page. Review with `openxiangda page head|releases|detail|diff`; activate an immutable complete release explicitly with `page activate <releaseId> --change <change>`. Historical activation requires `page rollback <releaseId> --rollback --change <change> --reason "..."`. Parent or revision conflicts are never refreshed or retried automatically.

package/lib/cli.js

@@ -6931,7 +6931,7 @@ async function resource(args) {
       '  - publish --dry-run 等价于发布前计划，不会写平台资源。',
       '  - 在线 publish 必须用 --only/--code 精确选择；真正全量发布必须显式 --all --reason，SDD bypass 不能绕过此范围门。',
       '  - 源码依赖触发的 Function/Automation 更新默认只替换 source snapshot，保留线上 bindings/schema/metadata；显式替换 manifest 必须加 --replace-manifest --reason。',
-      '  - --only/--code 在读取 manifest 后立即按逻辑资源 code 过滤；也支持 function:foo 这类带类型 selector。',
+      '  - --only/--code 会在读取/分析 manifest 与构建源码前按逻辑资源 code 早期收窄；也支持 function:foo 这类带类型 selector。',
       '  - type 可选: workflow, notification, route, menu, role, permission, data-view, function, connector 等。',
       '  - plan/publish 会在 stderr 输出阶段进度，超过 15 秒持续心跳；JSON 结果包含 timings，不污染 stdout。',
       '  - plan/publish --dry-run 严格只允许 GET/HEAD；READ_ONLY_AUTH_REQUIRED 时先执行 auth refresh 或重新登录。',
@@ -9539,6 +9539,12 @@ function resourceCodeSelectorMatches(selector, resourceKey, item) {
   return getResourceItemCode(item) === selector.code;
 }
 
+function resourceCodeSelectorAppliesToKey(selector, resourceKey) {
+  if (selector.key) return selector.key === resourceKey;
+  if (selector.keys) return selector.keys.includes(resourceKey);
+  return true;
+}
+
 function normalizeResourceTypeAlias(value) {
   return String(value || '')
     .trim()
@@ -9569,21 +9575,40 @@ function loadWorkspaceResources(options = {}) {
         }
       : {}),
   };
+  if (codeFilters) {
+    Object.defineProperty(manifest, '__resourceCodeSelectors', {
+      value: codeFilters,
+      configurable: true,
+      enumerable: false,
+      writable: false,
+    });
+  }
   for (const spec of RESOURCE_SPECS) {
-    const items = !typeFilters || typeFilters.has(spec.key)
-      ? readResourceItems(baseDir, spec)
-      : [];
-    manifest[spec.key] = codeFilters
-      ? items.filter(item => {
-          let matched = false;
-          for (let index = 0; index < codeFilters.length; index += 1) {
-            if (!resourceCodeSelectorMatches(codeFilters[index], spec.key, item)) continue;
-            matchedCodeFilters.add(index);
-            matched = true;
-          }
-          return matched;
-        })
-      : items;
+    if (typeFilters && !typeFilters.has(spec.key)) {
+      manifest[spec.key] = [];
+      continue;
+    }
+    if (!codeFilters) {
+      manifest[spec.key] = readResourceItems(baseDir, spec);
+      continue;
+    }
+
+    const selectorEntries = codeFilters
+      .map((selector, index) => ({ selector, index }))
+      .filter(({ selector }) => resourceCodeSelectorAppliesToKey(selector, spec.key));
+    if (selectorEntries.length === 0) {
+      manifest[spec.key] = [];
+      continue;
+    }
+    manifest[spec.key] = readResourceItems(baseDir, spec, {
+      selectorEntries,
+      matchedCodeFilters,
+      // Composite menu/notification files may expose several logical codes
+      // whose children cannot be located from the filename alone. They still
+      // filter before validation/source analysis; exact Function/Automation
+      // manifests use the fail-safe early file path below.
+      selectorFileScope: !['menus', 'notifications'].includes(spec.key),
+    });
   }
   if (codeFilters) {
     manifest.unmatchedResourceCodeFilters = codeFilters
@@ -9593,19 +9618,63 @@ function loadWorkspaceResources(options = {}) {
   return manifest;
 }
 
-function readResourceItems(baseDir, spec) {
+function readResourceItems(baseDir, spec, options = {}) {
   const items = [];
+  const selectorEntries = options.selectorEntries || null;
+  const matchedSelectorIndexes = new Set();
+  const visitedFiles = new Set();
+  const appendFile = filePath => {
+    if (visitedFiles.has(filePath)) return;
+    visitedFiles.add(filePath);
+    const fileItems = readResourceItemsFromFile(filePath, spec);
+    if (!selectorEntries) {
+      items.push(...fileItems);
+      return;
+    }
+    for (const item of fileItems) {
+      let matched = false;
+      for (const { selector, index } of selectorEntries) {
+        if (!resourceCodeSelectorMatches(selector, spec.key, item)) continue;
+        options.matchedCodeFilters?.add(index);
+        matchedSelectorIndexes.add(index);
+        matched = true;
+      }
+      if (matched) items.push(item);
+    }
+  };
   for (const relativeFile of spec.topFiles || []) {
     const filePath = path.join(baseDir, relativeFile);
     if (fs.existsSync(filePath)) {
-      items.push(...readResourceItemsFromFile(filePath, spec));
+      appendFile(filePath);
     }
   }
 
   const dirPath = path.join(baseDir, spec.dir);
   if (fs.existsSync(dirPath)) {
-    for (const filePath of listResourceJsonFiles(dirPath, spec)) {
-      items.push(...readResourceItemsFromFile(filePath, spec));
+    if (selectorEntries && options.selectorFileScope !== false) {
+      const remaining = () => selectorEntries.filter(
+        ({ index }) => !matchedSelectorIndexes.has(index)
+      );
+      for (const filePath of listSelectedResourceJsonFiles(
+        dirPath,
+        spec,
+        remaining().map(({ selector }) => selector.code)
+      )) {
+        appendFile(filePath);
+      }
+      if (remaining().length > 0) {
+        // A direct path is only a hint. The file may declare another explicit
+        // code, while the requested logical resource lives in an arbitrarily
+        // named legacy bundle. Fall back only when no selected item actually
+        // matched, preserving the standard-layout fast path.
+        for (const filePath of listResourceJsonFiles(dirPath, spec)) {
+          appendFile(filePath);
+        }
+      }
+    } else {
+      for (const filePath of listResourceJsonFiles(dirPath, spec)) {
+        appendFile(filePath);
+      }
     }
   }
   return items;
@@ -9754,6 +9823,36 @@ function listResourceJsonFiles(dirPath, spec) {
   );
 }
 
+function listSelectedResourceJsonFiles(dirPath, spec, selectedCodes = []) {
+  const codeSet = new Set(selectedCodes.map(code => String(code || '').trim()).filter(Boolean));
+  if (codeSet.size === 0) return [];
+
+  const directCandidates = new Set();
+  for (const code of codeSet) {
+    if (
+      code === '.' ||
+      code === '..' ||
+      code.includes('/') ||
+      code.includes('\\')
+    ) {
+      continue;
+    }
+    const directFile = path.join(dirPath, `${code}.json`);
+    if (fs.existsSync(directFile) && fs.statSync(directFile).isFile()) {
+      directCandidates.add(directFile);
+    }
+    const directDir = path.join(dirPath, code);
+    if (fs.existsSync(directDir) && fs.statSync(directDir).isDirectory()) {
+      for (const filePath of listJsonFiles(directDir)) {
+        if (shouldReadResourceJsonFile(filePath, dirPath, spec)) {
+          directCandidates.add(filePath);
+        }
+      }
+    }
+  }
+  return Array.from(directCandidates).sort();
+}
+
 function shouldReadResourceJsonFile(filePath, dirPath, spec) {
   if (spec.key !== 'workflows') return true;
   const relativeParts = path.relative(dirPath, filePath).split(path.sep);
@@ -10987,7 +11086,7 @@ async function publishResourcesForWorkspace(config, profileName, options = {}) {
 
 async function buildResourcePlan(config, target, manifest) {
   return await withReadOnlyHttpGuard('resource plan', async () => {
-  prepareManifestJsCodeBundlesForPlan(manifest);
+  await prepareManifestJsCodeBundlesForPlan(manifest);
   const existing = await fetchExistingResourceMaps(config, target, manifest);
   const actions = [];
   addPlanActions(actions, 'role', manifest.roles, existing.roles, roleEquals);
@@ -11024,7 +11123,7 @@ async function buildResourcePlan(config, target, manifest) {
   });
 }
 
-function prepareManifestJsCodeBundlesForPlan(manifest) {
+async function prepareManifestJsCodeBundlesForPlan(manifest) {
   const targetsByWorkspace = new Map();
   const seenObjects = new Set();
 
@@ -11079,21 +11178,45 @@ function prepareManifestJsCodeBundlesForPlan(manifest) {
   };
 
   for (const spec of RESOURCE_SPECS) {
-    visit(manifest[spec.key] || [], manifest.baseDir);
+    const selectors = manifest.__resourceCodeSelectors || null;
+    const items = selectors
+      ? (manifest[spec.key] || []).filter(item =>
+          selectors.some(selector =>
+            resourceCodeSelectorMatches(selector, spec.key, item)
+          )
+        )
+      : manifest[spec.key] || [];
+    visit(items, manifest.baseDir);
   }
 
   for (const [workspaceRoot, sourceMap] of targetsByWorkspace.entries()) {
     const sourceInfos = Array.from(sourceMap.values());
     if (sourceInfos.length === 0) continue;
-    const result = runWorkspaceJsCodeBuildBatch(
+    let result = runWorkspaceJsCodeBuildBatch(
       workspaceRoot,
       sourceInfos.map(item => ({
         sourceKind: item.sourceKind,
         scriptCode: item.scriptCode,
       }))
     );
-    if (result.stdout) process.stderr.write(result.stdout);
-    if (result.stderr) process.stderr.write(result.stderr);
+    if (result.status !== 0) {
+      const legacyFallback = result.openxiangdaBuildMode === 'workspace-script'
+        ? await tryBuildFunctionSourcesWithLegacyWorkspaceBuilder(
+            workspaceRoot,
+            sourceInfos
+          )
+        : { ok: false, result: null };
+      if (legacyFallback.ok) {
+        result = { status: 0, stdout: '', stderr: '' };
+      } else {
+        const failure = legacyFallback.result || result;
+        if (failure.stdout) process.stderr.write(failure.stdout);
+        if (failure.stderr) process.stderr.write(failure.stderr);
+      }
+    } else {
+      if (result.stdout) process.stderr.write(result.stdout);
+      if (result.stderr) process.stderr.write(result.stderr);
+    }
     if (result.status !== 0) {
       fail(
         `JS_CODE batch bundle构建失败，无法生成资源计划: ${sourceInfos
@@ -11112,6 +11235,48 @@ function prepareManifestJsCodeBundlesForPlan(manifest) {
   }
 }
 
+async function tryBuildFunctionSourcesWithLegacyWorkspaceBuilder(
+  workspaceRoot,
+  sourceInfos
+) {
+  if (
+    sourceInfos.length === 0 ||
+    sourceInfos.some(item => item.sourceKind !== 'functions')
+  ) {
+    return { ok: false, result: null };
+  }
+
+  let usedLegacyBuilder = false;
+  for (const sourceInfo of sourceInfos) {
+    const result = runWorkspaceJsCodeBuild(
+      workspaceRoot,
+      sourceInfo.scriptCode,
+      sourceInfo.sourceKind
+    );
+    if (result.status === 0) {
+      usedLegacyBuilder = true;
+      if (result.stdout) process.stderr.write(result.stdout);
+      if (result.stderr) process.stderr.write(result.stderr);
+      continue;
+    }
+    if (!isUnsupportedFunctionsBuildScript(result)) {
+      return { ok: false, result };
+    }
+    warn(
+      `当前工作区 scripts/build-js-code.mjs 不支持 App Function source=functions，已使用 openxiangda 内置构建器兼容构建 ${sourceInfo.scriptCode}`
+    );
+    await buildFunctionSourceWithBundledEsbuild(
+      sourceInfo.entryPath,
+      workspaceRoot,
+      sourceInfo.scriptCode
+    );
+  }
+  if (usedLegacyBuilder) {
+    warn('当前工作区 build-js-code 不支持批量 --scripts，已兼容使用逐 Function 构建');
+  }
+  return { ok: true, result: null };
+}
+
 function buildResourcePlanActionIndex(actions = []) {
   const index = new Map();
   for (const action of actions || []) {
@@ -17034,6 +17199,7 @@ function getJsCodeSourceInfoForPlan(localPath) {
     workspaceRoot,
     sourceKind,
     scriptCode,
+    entryPath: localPath,
     bundlePath: path.join(workspaceRoot, 'dist', sourceKind, scriptCode, 'index.cjs'),
   };
 }

package/lib/js-code-build.js

@@ -1,6 +1,16 @@
+const fs = require('fs');
+const path = require('path');
 const { spawnSync } = require('child_process');
 
 const JS_CODE_SOURCE_KINDS = new Set(['js-code-nodes', 'automations', 'functions']);
+const CANONICAL_BUILD_SCRIPT = path.join(
+  __dirname,
+  '..',
+  'templates',
+  'openxiangda-react-spa',
+  'scripts',
+  'build-js-code.mjs'
+);
 
 function normalizeJsCodeBuildTargets(targets = []) {
   const normalized = [];
@@ -42,20 +52,122 @@ function buildJsCodeBatchArgs(targets, options = {}) {
   ];
 }
 
+function readWorkspacePackage(workspaceRoot) {
+  try {
+    return JSON.parse(
+      fs.readFileSync(path.join(workspaceRoot, 'package.json'), 'utf8')
+    );
+  } catch {
+    return null;
+  }
+}
+
+function isStandardWorkspaceJsCodeBuilder(workspaceRoot) {
+  const command = String(
+    readWorkspacePackage(workspaceRoot)?.scripts?.['build-js-code'] || ''
+  ).trim().replace(/\\/g, '/');
+  if (!command) return true;
+  // Only bypass the exact template-shaped command. Extra flags, command
+  // chaining, or wrappers may be meaningful custom preprocessing and must keep
+  // using the workspace builder.
+  const matched = command.match(
+    /^(?:node\s+)?((?:\.\/)?scripts\/build-js-code\.(?:mjs|cjs|js))$/
+  );
+  if (!matched) return false;
+  try {
+    const source = fs.readFileSync(path.resolve(workspaceRoot, matched[1]), 'utf8');
+    return [
+      'tsconfig.js-code-nodes.json',
+      'sourceKinds',
+      'buildScript',
+    ].every(marker => source.includes(marker)) &&
+      (source.includes('resolveBuildTargets') ||
+        source.includes('resolveBuildSelection'));
+  } catch {
+    return false;
+  }
+}
+
+function findWorkspaceTargetEntry(workspaceRoot, target) {
+  const base = path.join(
+    workspaceRoot,
+    'src',
+    target.sourceKind,
+    target.scriptCode,
+    'index'
+  );
+  return ['.ts', '.tsx']
+    .map(extension => `${base}${extension}`)
+    .find(filePath => fs.existsSync(filePath));
+}
+
+function canUseCanonicalJsCodeBuilder(workspaceRoot, targets, options = {}) {
+  if (
+    options.preferWorkspaceBuilder ||
+    process.env.OPENXIANGDA_USE_WORKSPACE_JS_CODE_BUILDER === '1'
+  ) {
+    return false;
+  }
+  if (
+    !fs.existsSync(CANONICAL_BUILD_SCRIPT) ||
+    !fs.existsSync(path.join(workspaceRoot, 'tsconfig.js-code-nodes.json')) ||
+    !isStandardWorkspaceJsCodeBuilder(workspaceRoot)
+  ) {
+    return false;
+  }
+  return targets.every(target => findWorkspaceTargetEntry(workspaceRoot, target));
+}
+
+function resolveWorkspaceJsCodeBuildCommand(workspaceRoot, targets, options = {}) {
+  const normalized = normalizeJsCodeBuildTargets(targets);
+  const packageArgs = buildJsCodeBatchArgs(normalized, options);
+  if (canUseCanonicalJsCodeBuilder(workspaceRoot, normalized, options)) {
+    return {
+      mode: 'canonical-scoped',
+      command: options.nodeBinary || process.execPath,
+      args: [CANONICAL_BUILD_SCRIPT, ...packageArgs.slice(1)],
+      env: {
+        OPENXIANGDA_WORKSPACE_ROOT: path.resolve(workspaceRoot),
+      },
+    };
+  }
+  return {
+    mode: 'workspace-script',
+    command: options.packageManager || 'pnpm',
+    args: packageArgs,
+    env: {},
+  };
+}
+
 function runWorkspaceJsCodeBuildBatch(workspaceRoot, targets, options = {}) {
-  return spawnSync(
-    options.packageManager || 'pnpm',
-    buildJsCodeBatchArgs(targets, options),
-    {
-      cwd: workspaceRoot,
-      encoding: 'utf8',
-      ...options.spawnOptions,
-    }
+  const resolved = resolveWorkspaceJsCodeBuildCommand(
+    workspaceRoot,
+    targets,
+    options
   );
+  const spawnOptions = {
+    cwd: workspaceRoot,
+    encoding: 'utf8',
+    ...options.spawnOptions,
+  };
+  if (resolved.mode === 'canonical-scoped') {
+    spawnOptions.env = {
+      ...process.env,
+      ...(options.spawnOptions?.env || {}),
+      ...resolved.env,
+    };
+  }
+  const result = spawnSync(resolved.command, resolved.args, spawnOptions);
+  Object.defineProperty(result, 'openxiangdaBuildMode', {
+    value: resolved.mode,
+    enumerable: false,
+  });
+  return result;
 }
 
 module.exports = {
   buildJsCodeBatchArgs,
   normalizeJsCodeBuildTargets,
+  resolveWorkspaceJsCodeBuildCommand,
   runWorkspaceJsCodeBuildBatch,
 };

package/openxiangda-skills/SKILL.md

@@ -31,6 +31,8 @@ This file is a router and safety card. Read only the one or two subskills select
 4. Plan and publish exact resource codes with `--only <codes>` or `--code <code>`; a type-only or full-resource publish is allowed only when the dependency closure intentionally contains the whole type/application.
 5. A React SPA page change rebuilds one application runtime. Commit the complete build input first, upload/preview with `runtime deploy --no-activate`, and promote only from a clean merged release head that descends from the online Runtime source revision.
 
+An exact Function/Automation selector is an early scope boundary: unrelated manifests, source dependency graphs, and JS_CODE targets must not be read, typechecked, or built. Transitive/shared/ambient dependencies of the selected entry remain included. No selector intentionally keeps full-workspace behavior.
+
 Never infer a release scope from a globally dirty `git status` when multiple changes are present. Never publish a temporary source tree that differs from the reviewed patch.
 
 ## Risk and approval

package/openxiangda-skills/references/automation-v3.md

@@ -287,7 +287,7 @@ Use JS_CODE V2 when the script is local to one automation graph node.
 }
 ```
 
-Author source in `src/js-code-nodes/<scriptCode>/index.ts`. AI-authored source must be TypeScript. Build with `pnpm build-js-code --script <scriptCode>`; the command runs TypeScript validation before bundling. During validate/create, the CLI uploads the generated bundle, replaces `sourceFile.localPath` with `{ bucketName, objectName, sha256, ... }`, and the backend verifies sha256 before execution.
+Author source in `src/js-code-nodes/<scriptCode>/index.ts`. AI-authored source must be TypeScript. Build with `pnpm build-js-code --script <scriptCode>`; the explicit selector typechecks only that entry plus its transitive/shared/ambient dependencies before bundling, while an unscoped build validates the whole workspace. During validate/create, the CLI uploads the generated bundle, replaces `sourceFile.localPath` with `{ bucketName, objectName, sha256, ... }`, and the backend verifies sha256 before execution.
 
 The backend runs the snapshot in the trusted Node runtime, applies the node timeout (`30000` ms by default), stores execution logs, and writes the returned value to the node output and `variables.node_<nodeId>`. Scripts may use `export default async function (ctx) {}`, `module.exports = async (ctx) => {}`, `require`, `process`, `Buffer`, arbitrary HTTP, and `platform.api` for `/openxiangda-api/v1`.
 

package/openxiangda-skills/references/resource-manifest-cheatsheet.md

@@ -754,7 +754,7 @@ export default async function (ctx) {
 }
 ```
 
-构建：`pnpm build-js-code --script sync_customer`（先 `tsc` 再打包到 `dist/js-code-nodes/<code>/index.cjs`）。CLI validate/create/publish 时会上传快照、用 `{ bucketName, objectName, sha256 }` 替换 `sourceFile.localPath`。
+构建：`pnpm build-js-code --script sync_customer`（只校验该入口及其传递/shared/ambient 依赖，再打包到 `dist/js-code-nodes/<code>/index.cjs`；仅无 selector 时全量校验）。CLI validate/create/publish 时会上传快照、用 `{ bucketName, objectName, sha256 }` 替换 `sourceFile.localPath`。
 
 `ctx.methods.*` 仍可用于兼容旧脚本；新脚本优先使用 `ctx.resources`、`ctx.form.queryOne/queryMany/getById/createOne/updateOne/updateById`、`ctx.dataView`、`ctx.connector`、`ctx.notification`、`ctx.platform.roles` 和 `ctx.platform.api`。
 

package/openxiangda-skills/references/workflow-v3.md

@@ -371,7 +371,7 @@ File snapshot:
 }
 ```
 
-AI-authored JS_CODE source must be TypeScript under `src/js-code-nodes/<scriptCode>/index.ts`. When validating or creating, the CLI runs `pnpm build-js-code --script <scriptCode>`, which runs TypeScript validation first, bundles to `dist/js-code-nodes/<scriptCode>/index.cjs`, uploads the bundle, and replaces `sourceFile.localPath` with immutable snapshot metadata. The backend verifies snapshot `sha256`, runs it in the trusted Node runtime, applies the node timeout (`30000` ms by default), stores execution logs, and writes the returned value to the node output and `variables.node_<nodeId>`.
+AI-authored JS_CODE source must be TypeScript under `src/js-code-nodes/<scriptCode>/index.ts`. When validating or creating, the CLI runs `pnpm build-js-code --script <scriptCode>`, which typechecks only the selected entry plus its transitive/shared/ambient dependencies, bundles to `dist/js-code-nodes/<scriptCode>/index.cjs`, uploads the bundle, and replaces `sourceFile.localPath` with immutable snapshot metadata. An intentionally unscoped build retains full-workspace TypeScript validation. The backend verifies snapshot `sha256`, runs it in the trusted Node runtime, applies the node timeout (`30000` ms by default), stores console/runtime logs in the execution record, and writes the returned value to the node output and `variables.node_<nodeId>`.
 
 For reusable backend logic that should be shared by pages, automations, and workflows, prefer an App Function under `src/functions/<functionCode>/index.ts` plus `src/resources/functions/<functionCode>.json`. Workflow graphs that support App Function nodes can call it with:
 

package/openxiangda-skills/skills/openxiangda-core/SKILL.md

@@ -53,6 +53,8 @@ openxiangda resource publish function --only function_a,function_b --profile <na
 
 `--code <code>` is the single-resource equivalent of `--only <codes>`. Type-only planning is appropriate for an intentional shared dependency closure. Unscoped full-resource planning/publishing is app-wide and requires an app-wide approved change.
 
+Selectors apply before manifest parsing, source dependency analysis, and JS_CODE typecheck/build. A scoped Function/Automation plan must touch only the selected targets plus their transitive/shared/ambient dependencies; an unscoped plan intentionally retains full-workspace behavior. Resource commands use the canonical scoped builder packaged with the installed CLI for standard workspaces, so old checked-in builders still receive the optimization; refresh/bootstrap the workspace script only for equivalent manual `pnpm build-js-code` behavior. Nonstandard custom builders remain an explicit compatibility fallback.
+
 Source-triggered Function/Automation targets use one immutable Backend Release by default. The CLI uploads every eligible existing source-only target, freezes the current Backend Release parent plus Git/change baseline, then runs `prepare -> verify -> activate`; activation first CAS-checks the entire set and applies all updates in one transaction. Never fall back to sequential PATCH after prepare/verify/activate has started. Compatibility fallback is allowed only when the Backend Release `head` feature probe is an explicit HTTP 404, and must warn. Existing online bindings, contracts, metadata, trigger/view configuration, and enabled/published state remain unchanged; noops do not advance resource versions/timestamps. A deliberate whole-definition replacement requires exact `--only/--code` and `--replace-manifest --reason "<why>"`; SDD bypass does not imply replacement authority.
 
 Use `openxiangda release backend-head|backend-list|backend-detail|backend-diff` to inspect immutable history. `backend-rollback <releaseId> --change <change> --reason "..."` prepares, verifies, and activates a new release from the historical snapshot; it never mutates or directly reactivates the old row. `backend-abort` stops prepared/verified work and `backend-retry` retries only recorded post-commit side effects. Do not fetch newer revisions to replay an older payload.

package/openxiangda-skills/skills/openxiangda-workflow-automation/SKILL.md

@@ -29,7 +29,7 @@ Create a workflow only when the scenario has **real approval semantics**: approv
 - ✅ Delayed approval start: save the process-form record first with `StandardFormPage submitBehavior="save-draft"` or `sdk.form.create({ formUuid, data, saveAsDraft: true, startProcess: false })`, then start approval in place with `sdk.process.startFromExistingInstance({ formUuid, formInstId })` or `StandardFormPage submitBehavior="start-existing-process"`.
 - ✅ Return-to-initiator flows: use `returnPolicy: { scopeType: "initiator", resubmitMode: "resume_current" | "replay" }` or `flow.action.returnToInitiator()`. The runtime capabilities protocol exposes `resubmit` only for pending `originator_return` tasks; return to a previous approval node continues through the normal `approve` action.
 - ✅ Reusable backend business logic: prefer **App Function** (`src/functions/<functionCode>/index.ts` + `src/resources/functions/<functionCode>.json`), then call it from page `sdk.function.invoke` or automation/workflow `function_call`.
-- ✅ JS_CODE V2 trusted_node: source in TypeScript under `src/js-code-nodes/<scriptCode>/index.ts`, `src/automations/<resourceCode>/index.ts`, or `src/functions/<functionCode>/index.ts`. Run `pnpm build-js-code --script <code>` (validates with `tsc` first).
+- ✅ JS_CODE V2 trusted_node: source in TypeScript under `src/js-code-nodes/<scriptCode>/index.ts`, `src/automations/<resourceCode>/index.ts`, or `src/functions/<functionCode>/index.ts`. Run `pnpm build-js-code --script <code>`; an explicit selector validates/builds only that entry plus its transitive/shared/ambient dependencies, while an unscoped command validates the whole workspace.
 - ✅ Use `trigger_v2` for new automation triggers; CLI fills root `appType` / `formUuid` from active profile when `--form-code` is provided.
 - ✅ Use logical `workflowCode` / `automationCode` locally; live IDs are profile-isolated under `.openxiangda/state.json`.
 - ✅ `ctx.logger.debug/info/warn/error(message, data?)` at every important step — inspect via `automation executions` / `automation logs` / `automation diagnose`.
@@ -112,7 +112,7 @@ For new AI-authored workflows where users do not need canvas editing, prefer com
 Do not use JS_CODE for simple UI interactions, ordinary form validation, display-only page behavior, or logic that belongs in a normal React code page. For non-trivial backend logic, prefer JS_CODE V2 trusted Node scripts over large inline snippets. AI-authored JS_CODE source must be TypeScript:
 
 1. Put source in `src/js-code-nodes/<scriptCode>/index.ts`.
-2. Run `pnpm build-js-code --script <scriptCode>`. This command runs TypeScript validation first and only bundles after `tsc` passes.
+2. Run `pnpm build-js-code --script <scriptCode>`. In a refreshed workspace this command typechecks only the selected entry and its transitive/shared/ambient dependencies, then bundles after validation passes; omit the selector only for an intentional full-workspace validation. Installed CLI resource commands independently use their packaged canonical scoped builder, including against standard older workspaces.
 3. In workflow or automation JSON, use:
    ```json
    {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.161",
+  "version": "1.0.163",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {
@@ -91,6 +91,8 @@
     "test:app-release-cli": "node scripts/app-release-cli-smoke.mjs",
     "test:form-release-cas": "node scripts/form-release-cas-smoke.mjs",
     "test:source-dependencies": "node scripts/source-dependencies-smoke.mjs",
+    "test:package-runtime-dependencies": "node scripts/package-runtime-dependencies-smoke.mjs",
+    "test:packed-cli": "node scripts/packed-cli-smoke.mjs",
     "test:runtime-deploy": "node scripts/runtime-deploy-smoke.mjs",
     "test:sdd": "node scripts/sdd-smoke.mjs",
     "test:sdd-stages": "node scripts/sdd-stages-smoke.mjs",
@@ -145,6 +147,7 @@
     "qrcode-terminal": "^0.12.0",
     "tailwindcss": "^3.4.17",
     "tsx": "^4.20.0",
+    "typescript": "^5.7.0",
     "undici": "^6.27.0",
     "vite": "^6.0.0",
     "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz"
@@ -164,7 +167,6 @@
     "react": "18.3.1",
     "react-dom": "18.3.1",
     "tsup": "^8.3.0",
-    "typescript": "^5.7.0",
     "vitest": "^4.1.7"
   },
   "engines": {

package/templates/openxiangda-react-spa/.cursor/rules/openxiangda-resources.mdc

@@ -24,6 +24,7 @@ openxiangda resource typegen --profile <name>
 - Guest access to forms, dataViews, functions, and connectors requires explicit policy `grants`.
 - Connector secrets and third-party credentials belong in the platform backend, never in manifests or page source.
 - Formal changes should keep Git as the source of truth: edit manifests, validate, plan, then publish.
+- Exact selectors apply before manifest/source analysis and JS_CODE build: touch only selected targets plus transitive/shared/ambient dependencies; omit selectors only for intentional full-workspace work.
 - `resource plan` and publish dry-runs are GET/HEAD-only. On `READ_ONLY_AUTH_REQUIRED`, run `openxiangda auth refresh --profile <name>` or log in again before retrying; never refresh inside the plan.
 - Source-triggered Function/Automation publishing patches only source fields on the server and preserves online bindings/contracts/metadata/state. Whole-manifest replacement requires `--replace-manifest --reason "..."`.
 - Formal promotion runs `release begin --change` (freeze Git + remote baseline, preflight the complete set) through `release end`. Reconcile `SOURCE_BASE_DIVERGED` / `RESOURCE_FIELD_CONFLICT`; never retry an old full payload with a fresh revision.

package/templates/openxiangda-react-spa/.qoder/rules/openxiangda-resources.md

@@ -24,6 +24,7 @@ openxiangda resource typegen --profile <name>
 - Guest access to forms, dataViews, functions, and connectors requires explicit policy `grants`.
 - Connector secrets and third-party credentials belong in the platform backend, never in manifests or page source.
 - Formal changes should keep Git as the source of truth: edit manifests, validate, plan, then publish.
+- Exact selectors apply before manifest/source analysis and JS_CODE build: touch only selected targets plus transitive/shared/ambient dependencies; omit selectors only for intentional full-workspace work.
 - `resource plan` and publish dry-runs are GET/HEAD-only. On `READ_ONLY_AUTH_REQUIRED`, run `openxiangda auth refresh --profile <name>` or log in again before retrying; never refresh inside the plan.
 - Source-triggered Function/Automation publishing patches only source fields on the server and preserves online bindings/contracts/metadata/state. Whole-manifest replacement requires `--replace-manifest --reason "..."`.
 - Formal promotion runs `release begin --change` (freeze Git + remote baseline, preflight the complete set) through `release end`. Reconcile `SOURCE_BASE_DIVERGED` / `RESOURCE_FIELD_CONFLICT`; never retry an old full payload with a fresh revision.

package/templates/openxiangda-react-spa/AGENTS.md

@@ -64,7 +64,7 @@ openxiangda runtime activate <reviewedReleaseId> --change <change> --profile <na
 openxiangda release end --profile <name>
 ```
 
-`pnpm build-js-code` 会检查并打包 `src/js-code-nodes/<code>/index.ts`、`src/automations/<code>/index.ts`、`src/functions/<code>/index.ts`，供 JS_CODE V2、代码自动化和 App Function 资源发布使用。批量目标使用 `pnpm build-js-code --scripts functions:a,functions:b,automations:c`，也兼容重复的 `--script a --script b --source functions`；一批目标只运行一次完整 TypeScript 校验。构建缓存写入 `.openxiangda/build-cache.json`，按源码、实际共享依赖、构建配置、Node/Vite/TypeScript 版本及产物校验和判断命中；需要强制重建时追加 `--force`。
+`pnpm build-js-code` 会检查并打包 `src/js-code-nodes/<code>/index.ts`、`src/automations/<code>/index.ts`、`src/functions/<code>/index.ts`，供 JS_CODE V2、代码自动化和 App Function 资源发布使用。批量目标使用 `pnpm build-js-code --scripts functions:a,functions:b,automations:c`，也兼容重复的 `--script a --script b --source functions`。显式 selector 只校验和构建选中入口及其传递/shared/ambient 依赖；不带 selector 才执行全工作区 TypeScript 校验。构建缓存写入 `.openxiangda/build-cache.json` 并按 scoped target、实际共享依赖、构建配置、Node/Vite/TypeScript 版本及产物校验和判断命中；需要强制重建时追加 `--force`。
 
 `openxiangda runtime deploy --no-activate` 会构建并上传不可变预览版本；发布前先提交所有可能进入构建的源码/配置。所有 Runtime deploy（包括 `--no-activate`）都会先获取应用发布 lease，并在任何构建和上传前冻结 clean `HEAD` 与当前 active Runtime 父血缘；旧分支返回 `RUNTIME_SOURCE_BASE_DIVERGED`，不能先上传旧 preview 再激活。`openspec/` SDD 证据和生成/状态目录不算源码 dirty。仅审批的回退可使用 `--allow-runtime-rollback --reason "至少 8 个字符"`；`--no-build` 不会跳过守卫。不要手工修改 `dist/index.html`。
 

package/templates/openxiangda-react-spa/scripts/build-js-code.mjs

@@ -19,13 +19,29 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { build } from "vite";
 
-const rootDir = fileURLToPath(new URL("..", import.meta.url));
 const scriptFile = fileURLToPath(import.meta.url);
+const defaultRootDir = fileURLToPath(new URL("..", import.meta.url));
+const rootDir = path.resolve(process.env.OPENXIANGDA_WORKSPACE_ROOT || defaultRootDir);
 const args = process.argv.slice(2);
 const require = createRequire(import.meta.url);
-const CACHE_VERSION = 2;
-const CACHE_FILE = path.join(rootDir, ".openxiangda", "build-cache.json");
+const ts = require("typescript");
+const CACHE_VERSION = 3;
+const builderFingerprint = crypto
+  .createHash("sha256")
+  .update(readFileSync(scriptFile))
+  .digest("hex");
+const workspaceBuilderFile = path.join(rootDir, "scripts", "build-js-code.mjs");
+const workspaceBuilderMatches =
+  existsSync(workspaceBuilderFile) &&
+  crypto.createHash("sha256").update(readFileSync(workspaceBuilderFile)).digest("hex") ===
+    builderFingerprint;
+const cacheFileName =
+  path.resolve(defaultRootDir) !== rootDir && !workspaceBuilderMatches
+    ? "build-cache.cli-v3.json"
+    : "build-cache.json";
+const CACHE_FILE = path.join(rootDir, ".openxiangda", cacheFileName);
 const CACHE_LOCK_FILE = `${CACHE_FILE}.lock`;
+const TSCONFIG_FILE = path.join(rootDir, "tsconfig.js-code-nodes.json");
 const forceBuild = args.includes("--force") || args.includes("--no-cache");
 
 const sourceKinds = {
@@ -84,11 +100,24 @@ function assertScriptCode(scriptCode) {
 function listScriptCodes(kind) {
   if (!existsSync(kind.sourceRoot)) return [];
   return readdirSync(kind.sourceRoot, { withFileTypes: true })
-    .filter((entry) => entry.isDirectory() && existsSync(path.join(kind.sourceRoot, entry.name, "index.ts")))
+    .filter(
+      (entry) =>
+        entry.isDirectory() &&
+        ["index.ts", "index.tsx"].some((name) =>
+          existsSync(path.join(kind.sourceRoot, entry.name, name)),
+        ),
+    )
     .map((entry) => entry.name)
     .sort();
 }
 
+function targetEntryFile(target) {
+  const base = path.join(target.kind.sourceRoot, target.scriptCode);
+  return ["index.ts", "index.tsx"]
+    .map((name) => path.join(base, name))
+    .find((file) => existsSync(file)) || path.join(base, "index.ts");
+}
+
 function parseScriptSpec(rawSpec, defaultKind) {
   const prefixed = String(rawSpec).match(/^(js-code-nodes|automations|functions)[:/](.+)$/);
   const requestedKind = prefixed?.[1] || defaultKind?.name;
@@ -101,7 +130,9 @@ function parseScriptSpec(rawSpec, defaultKind) {
   if (requestedKind) return { kind: sourceKinds[requestedKind], scriptCode };
 
   const matches = Object.values(sourceKinds).filter((kind) =>
-    existsSync(path.join(kind.sourceRoot, scriptCode, "index.ts")),
+    ["index.ts", "index.tsx"].some((name) =>
+      existsSync(path.join(kind.sourceRoot, scriptCode, name)),
+    ),
   );
   if (matches.length > 1) {
     console.warn(
@@ -111,7 +142,7 @@ function parseScriptSpec(rawSpec, defaultKind) {
   return { kind: matches[0] || sourceKinds["js-code-nodes"], scriptCode };
 }
 
-function resolveBuildTargets() {
+function resolveBuildSelection() {
   const sourceArgs = readArgs("source");
   const sourceNames = [...new Set(sourceArgs)];
   if (sourceNames.length > 1) throw new Error("--source may only select one source kind");
@@ -128,7 +159,10 @@ function resolveBuildTargets() {
     : (selectedKind ? [selectedKind] : Object.values(sourceKinds)).flatMap((kind) =>
         listScriptCodes(kind).map((scriptCode) => ({ kind, scriptCode })),
       );
-  return [...new Map(targets.map((target) => [`${target.kind.name}/${target.scriptCode}`, target])).values()];
+  return {
+    scoped: specs.length > 0,
+    targets: [...new Map(targets.map((target) => [`${target.kind.name}/${target.scriptCode}`, target])).values()],
+  };
 }
 
 function packageVersion(name) {
@@ -144,6 +178,7 @@ const toolFingerprint = crypto
   .update(
     JSON.stringify({
       cacheVersion: CACHE_VERSION,
+      builder: builderFingerprint,
       node: process.version,
       platform: process.platform,
       arch: process.arch,
@@ -157,14 +192,25 @@ const toolFingerprint = crypto
   .digest("hex");
 
 function emptyCache() {
-  return { version: CACHE_VERSION, toolFingerprint, typecheck: null, targets: {} };
+  return {
+    version: CACHE_VERSION,
+    toolFingerprint,
+    typecheck: null,
+    typechecks: {},
+    targets: {},
+  };
 }
 
 function readCache(file = CACHE_FILE) {
   try {
     const cache = JSON.parse(readFileSync(file, "utf8"));
     if (cache.version !== CACHE_VERSION) return emptyCache();
-    return { ...emptyCache(), ...cache, targets: cache.targets || {} };
+    return {
+      ...emptyCache(),
+      ...cache,
+      typechecks: cache.typechecks || {},
+      targets: cache.targets || {},
+    };
   } catch {
     return emptyCache();
   }
@@ -231,7 +277,7 @@ function typecheckInputHash() {
 }
 
 function targetInputHash(target, dependencies) {
-  const entry = relativeWorkspaceFile(path.join(target.kind.sourceRoot, target.scriptCode, "index.ts"));
+  const entry = relativeWorkspaceFile(targetEntryFile(target));
   return hashFileSet(
     [...configInputFiles(), entry, ...(dependencies || [])].filter(Boolean),
     `target:${target.kind.name}/${target.scriptCode}`,
@@ -258,11 +304,94 @@ function isTargetCacheHit(cache, target) {
   );
 }
 
-function typecheckScripts(cache) {
+function formatTypeScriptDiagnostics(diagnostics) {
+  return ts.formatDiagnosticsWithColorAndContext(diagnostics, {
+    getCanonicalFileName: (file) => file,
+    getCurrentDirectory: () => rootDir,
+    getNewLine: () => "\n",
+  });
+}
+
+function scopedTypecheckKey(targets) {
+  return targets
+    .map((target) => `${target.kind.name}/${target.scriptCode}`)
+    .sort()
+    .join(",");
+}
+
+function scopedAmbientDeclarationFiles() {
+  return walkFiles(path.join(rootDir, "src"))
+    .filter((file) => file.endsWith(".d.ts"))
+    .map(relativeWorkspaceFile)
+    .filter(Boolean);
+}
+
+function createScopedTypecheckProgram(targets) {
+  const loaded = ts.readConfigFile(TSCONFIG_FILE, ts.sys.readFile);
+  if (loaded.error) {
+    process.stderr.write(formatTypeScriptDiagnostics([loaded.error]));
+    throw new Error("JS_CODE scoped TypeScript config validation failed");
+  }
+  const files = [
+    ...targets.map((target) =>
+      relativeWorkspaceFile(targetEntryFile(target)),
+    ),
+    ...scopedAmbientDeclarationFiles(),
+  ].filter(Boolean);
+  const parsed = ts.parseJsonConfigFileContent(
+    { ...loaded.config, files, include: [] },
+    ts.sys,
+    rootDir,
+    { noEmit: true },
+    TSCONFIG_FILE,
+  );
+  if (parsed.errors.length > 0) {
+    process.stderr.write(formatTypeScriptDiagnostics(parsed.errors));
+    throw new Error("JS_CODE scoped TypeScript config validation failed");
+  }
+  return ts.createProgram({
+    rootNames: parsed.fileNames,
+    options: parsed.options,
+    projectReferences: parsed.projectReferences,
+  });
+}
+
+function scopedTypecheckInputHash(program, cacheKey) {
+  const sourceFiles = program
+    .getSourceFiles()
+    .map((sourceFile) => relativeWorkspaceFile(sourceFile.fileName))
+    .filter(Boolean);
+  return hashFileSet([...configInputFiles(), ...sourceFiles], `typecheck:${cacheKey}`);
+}
+
+function typecheckSelectedScripts(cache, targets) {
+  const cacheKey = scopedTypecheckKey(targets);
+  const program = createScopedTypecheckProgram(targets);
+  const inputHash = scopedTypecheckInputHash(program, cacheKey);
+  if (
+    !forceBuild &&
+    cache.toolFingerprint === toolFingerprint &&
+    cache.typechecks?.[cacheKey]?.inputHash === inputHash
+  ) {
+    console.log(`[build-js-code] scoped TypeScript validation cache hit (${targets.length} selected)`);
+    return { cacheHit: true, cacheKey, inputHash, mode: "scoped" };
+  }
+
+  console.log(`[build-js-code] validating TypeScript for ${targets.length} selected target(s)...`);
+  const diagnostics = ts.getPreEmitDiagnostics(program);
+  if (diagnostics.length > 0) {
+    process.stderr.write(formatTypeScriptDiagnostics(diagnostics));
+    throw new Error("JS_CODE scoped TypeScript validation failed");
+  }
+  console.log("[build-js-code] scoped TypeScript validation passed");
+  return { cacheHit: false, cacheKey, inputHash, mode: "scoped" };
+}
+
+function typecheckAllScripts(cache) {
   const inputHash = typecheckInputHash();
   if (!forceBuild && cache.toolFingerprint === toolFingerprint && cache.typecheck?.inputHash === inputHash) {
     console.log("[build-js-code] TypeScript validation cache hit");
-    return { cacheHit: true, inputHash };
+    return { cacheHit: true, inputHash, mode: "full" };
   }
 
   console.log("[build-js-code] validating TypeScript once for this batch...");
@@ -275,7 +404,13 @@ function typecheckScripts(cache) {
   console.log("[build-js-code] TypeScript validation passed");
   // pnpm may materialize/update a lockfile on the first invocation. Record the
   // post-validation inputs so the next process can reuse this successful tsc.
-  return { cacheHit: false, inputHash: typecheckInputHash() };
+  return { cacheHit: false, inputHash: typecheckInputHash(), mode: "full" };
+}
+
+function typecheckScripts(cache, targets, scoped) {
+  return scoped
+    ? typecheckSelectedScripts(cache, targets)
+    : typecheckAllScripts(cache);
 }
 
 function collectBuildDependencies(buildResult, entry) {
@@ -296,7 +431,7 @@ function collectBuildDependencies(buildResult, entry) {
 
 async function buildScript(target) {
   const { kind, scriptCode } = target;
-  const entry = path.join(kind.sourceRoot, scriptCode, "index.ts");
+  const entry = targetEntryFile(target);
   if (!existsSync(entry)) throw new Error(`${kind.label} script not found: ${entry}`);
   const outDir = path.join(kind.outputRoot, scriptCode);
   const external = Array.from(
@@ -361,14 +496,31 @@ function saveCache(typecheck, updatedTargets) {
   if (typecheck.cacheHit && updatedTargets.size === 0) return;
   const lockFd = acquireCacheLock();
   try {
-    const latest = readCache();
+    const stored = readCache();
+    // A scoped build updates only part of the cache. Never carry metadata from
+    // a different compiler/builder fingerprint into the new cache, otherwise
+    // untouched targets could become false hits after this process stamps the
+    // cache with the current fingerprint.
+    const latest = stored.toolFingerprint === toolFingerprint
+      ? stored
+      : emptyCache();
+    const validatedAt = new Date().toISOString();
+    const mergedTypechecks = { ...latest.typechecks };
+    if (!typecheck.cacheHit && typecheck.mode === "scoped") {
+      mergedTypechecks[typecheck.cacheKey] = {
+        inputHash: typecheck.inputHash,
+        validatedAt,
+      };
+    }
     const merged = {
       ...latest,
       version: CACHE_VERSION,
       toolFingerprint,
-      typecheck: typecheck.cacheHit
-        ? latest.typecheck
-        : { inputHash: typecheck.inputHash, validatedAt: new Date().toISOString() },
+      typecheck:
+        !typecheck.cacheHit && typecheck.mode === "full"
+          ? { inputHash: typecheck.inputHash, validatedAt }
+          : latest.typecheck,
+      typechecks: mergedTypechecks,
       targets: { ...latest.targets, ...Object.fromEntries(updatedTargets) },
     };
     const tempFile = `${CACHE_FILE}.${process.pid}.${crypto.randomBytes(6).toString("hex")}.tmp`;
@@ -398,7 +550,7 @@ function saveCache(typecheck, updatedTargets) {
   }
 }
 
-const targets = resolveBuildTargets();
+const { scoped, targets } = resolveBuildSelection();
 if (targets.length === 0) {
   console.log(
     "no JS_CODE scripts found under src/js-code-nodes/<scriptCode>/index.ts, src/automations/<scriptCode>/index.ts, or src/functions/<functionCode>/index.ts",
@@ -407,7 +559,7 @@ if (targets.length === 0) {
 }
 
 const cache = readCache();
-const typecheck = typecheckScripts(cache);
+const typecheck = typecheckScripts(cache, targets, scoped);
 const updatedTargets = new Map();
 let builtCount = 0;
 let cachedCount = 0;

package/templates/sy-lowcode-app-workspace/.cursor/rules/openxiangda-resources.mdc

@@ -27,6 +27,8 @@ Commands: `openxiangda resource validate|plan|publish <type> --only <codes> --pr
 
 `resource plan` and publish dry-runs are strictly GET/HEAD-only. On `READ_ONLY_AUTH_REQUIRED`, run `openxiangda auth refresh --profile <name>` or log in again before retrying; never refresh inside the plan.
 
+Exact `--only/--code` selectors apply before manifest/source analysis and JS_CODE build. Touch only selected targets plus transitive/shared/ambient dependencies; omit selectors only for intentional full-workspace work.
+
 When a Function/Automation enters scope only through source changes, publishing uses a server-side source-field PATCH and preserves online bindings, contracts, metadata, trigger/view configuration, and enabled/published state. Whole-manifest replacement requires `--replace-manifest --reason "..."`. Formal promotion runs `release begin --change` (Git + remote baseline, whole-set preflight) through `release end`; `SOURCE_BASE_DIVERGED` and `RESOURCE_FIELD_CONFLICT` require reconciliation and a new plan.
 
 Before editing `roles`, `permissions/page-groups`, or `permissions/form-groups` for account/role/data-scope/RBAC/query-param authorization work, run `openxiangda design gates --topic permissions --json`, choose the permission mode, and write the permission matrix.

package/templates/sy-lowcode-app-workspace/.qoder/rules/openxiangda-resources.md

@@ -45,6 +45,8 @@ Function/Automation 仅因源码变化进入 scope 时，默认通过服务端
 
 `resource plan` 与 publish dry-run 严格只允许 GET/HEAD。遇到 `READ_ONLY_AUTH_REQUIRED` 时，先执行 `openxiangda auth refresh --profile <name>` 或重新登录再重试；不得在 plan 内自动 POST 刷新 token。
 
+精确 `--only/--code` 会在 manifest/source 分析与 JS_CODE 构建前收窄，只触碰目标及其传递/shared/ambient 依赖；只有明确的全工作区任务才省略 selector。
+
 ## 严禁
 
 - ❌ 把 `formUuid` / `pageId` / `workflowId` 等平台 ID 直接写进 manifest（CLI 解析逻辑 code）。

package/templates/sy-lowcode-app-workspace/AGENTS.md

@@ -86,7 +86,7 @@
 
 ## JS_CODE 批量构建
 
-`pnpm build-js-code --scripts functions:a,functions:b,automations:c` 可在一次进程中构建多个 App Function / Automation / JS_CODE 目标；也兼容 `--script a --script b --source functions`，完整 TypeScript 校验每批只运行一次。`.openxiangda/build-cache.json` 按源码、实际共享依赖、构建配置、Node/Vite/TypeScript 版本及产物校验和决定是否跳过，不能只因 `dist/**/index.cjs` 存在就视为有效；强制重建使用 `--force`。
+`pnpm build-js-code --scripts functions:a,functions:b,automations:c` 可在一次进程中构建多个 App Function / Automation / JS_CODE 目标；也兼容 `--script a --script b --source functions`。显式 selector 只校验和构建选中入口及其传递/shared/ambient 依赖；不带 selector 才保持全工作区 TypeScript 校验。`.openxiangda/build-cache.json` 分 scoped target 记录源码、实际共享依赖、构建配置、Node/Vite/TypeScript 版本及产物校验和，不能只因 `dist/**/index.cjs` 存在就视为有效；强制重建使用 `--force`。
 
 ## 工作区结构速查
 

package/templates/sy-lowcode-app-workspace/scripts/build-js-code.mjs

@@ -19,13 +19,29 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { build } from "vite";
 
-const rootDir = fileURLToPath(new URL("..", import.meta.url));
 const scriptFile = fileURLToPath(import.meta.url);
+const defaultRootDir = fileURLToPath(new URL("..", import.meta.url));
+const rootDir = path.resolve(process.env.OPENXIANGDA_WORKSPACE_ROOT || defaultRootDir);
 const args = process.argv.slice(2);
 const require = createRequire(import.meta.url);
-const CACHE_VERSION = 2;
-const CACHE_FILE = path.join(rootDir, ".openxiangda", "build-cache.json");
+const ts = require("typescript");
+const CACHE_VERSION = 3;
+const builderFingerprint = crypto
+  .createHash("sha256")
+  .update(readFileSync(scriptFile))
+  .digest("hex");
+const workspaceBuilderFile = path.join(rootDir, "scripts", "build-js-code.mjs");
+const workspaceBuilderMatches =
+  existsSync(workspaceBuilderFile) &&
+  crypto.createHash("sha256").update(readFileSync(workspaceBuilderFile)).digest("hex") ===
+    builderFingerprint;
+const cacheFileName =
+  path.resolve(defaultRootDir) !== rootDir && !workspaceBuilderMatches
+    ? "build-cache.cli-v3.json"
+    : "build-cache.json";
+const CACHE_FILE = path.join(rootDir, ".openxiangda", cacheFileName);
 const CACHE_LOCK_FILE = `${CACHE_FILE}.lock`;
+const TSCONFIG_FILE = path.join(rootDir, "tsconfig.js-code-nodes.json");
 const forceBuild = args.includes("--force") || args.includes("--no-cache");
 
 const sourceKinds = {
@@ -84,11 +100,24 @@ function assertScriptCode(scriptCode) {
 function listScriptCodes(kind) {
   if (!existsSync(kind.sourceRoot)) return [];
   return readdirSync(kind.sourceRoot, { withFileTypes: true })
-    .filter((entry) => entry.isDirectory() && existsSync(path.join(kind.sourceRoot, entry.name, "index.ts")))
+    .filter(
+      (entry) =>
+        entry.isDirectory() &&
+        ["index.ts", "index.tsx"].some((name) =>
+          existsSync(path.join(kind.sourceRoot, entry.name, name)),
+        ),
+    )
     .map((entry) => entry.name)
     .sort();
 }
 
+function targetEntryFile(target) {
+  const base = path.join(target.kind.sourceRoot, target.scriptCode);
+  return ["index.ts", "index.tsx"]
+    .map((name) => path.join(base, name))
+    .find((file) => existsSync(file)) || path.join(base, "index.ts");
+}
+
 function parseScriptSpec(rawSpec, defaultKind) {
   const prefixed = String(rawSpec).match(/^(js-code-nodes|automations|functions)[:/](.+)$/);
   const requestedKind = prefixed?.[1] || defaultKind?.name;
@@ -101,7 +130,9 @@ function parseScriptSpec(rawSpec, defaultKind) {
   if (requestedKind) return { kind: sourceKinds[requestedKind], scriptCode };
 
   const matches = Object.values(sourceKinds).filter((kind) =>
-    existsSync(path.join(kind.sourceRoot, scriptCode, "index.ts")),
+    ["index.ts", "index.tsx"].some((name) =>
+      existsSync(path.join(kind.sourceRoot, scriptCode, name)),
+    ),
   );
   if (matches.length > 1) {
     console.warn(
@@ -111,7 +142,7 @@ function parseScriptSpec(rawSpec, defaultKind) {
   return { kind: matches[0] || sourceKinds["js-code-nodes"], scriptCode };
 }
 
-function resolveBuildTargets() {
+function resolveBuildSelection() {
   const sourceArgs = readArgs("source");
   const sourceNames = [...new Set(sourceArgs)];
   if (sourceNames.length > 1) throw new Error("--source may only select one source kind");
@@ -128,7 +159,10 @@ function resolveBuildTargets() {
     : (selectedKind ? [selectedKind] : Object.values(sourceKinds)).flatMap((kind) =>
         listScriptCodes(kind).map((scriptCode) => ({ kind, scriptCode })),
       );
-  return [...new Map(targets.map((target) => [`${target.kind.name}/${target.scriptCode}`, target])).values()];
+  return {
+    scoped: specs.length > 0,
+    targets: [...new Map(targets.map((target) => [`${target.kind.name}/${target.scriptCode}`, target])).values()],
+  };
 }
 
 function packageVersion(name) {
@@ -144,6 +178,7 @@ const toolFingerprint = crypto
   .update(
     JSON.stringify({
       cacheVersion: CACHE_VERSION,
+      builder: builderFingerprint,
       node: process.version,
       platform: process.platform,
       arch: process.arch,
@@ -157,14 +192,25 @@ const toolFingerprint = crypto
   .digest("hex");
 
 function emptyCache() {
-  return { version: CACHE_VERSION, toolFingerprint, typecheck: null, targets: {} };
+  return {
+    version: CACHE_VERSION,
+    toolFingerprint,
+    typecheck: null,
+    typechecks: {},
+    targets: {},
+  };
 }
 
 function readCache(file = CACHE_FILE) {
   try {
     const cache = JSON.parse(readFileSync(file, "utf8"));
     if (cache.version !== CACHE_VERSION) return emptyCache();
-    return { ...emptyCache(), ...cache, targets: cache.targets || {} };
+    return {
+      ...emptyCache(),
+      ...cache,
+      typechecks: cache.typechecks || {},
+      targets: cache.targets || {},
+    };
   } catch {
     return emptyCache();
   }
@@ -231,7 +277,7 @@ function typecheckInputHash() {
 }
 
 function targetInputHash(target, dependencies) {
-  const entry = relativeWorkspaceFile(path.join(target.kind.sourceRoot, target.scriptCode, "index.ts"));
+  const entry = relativeWorkspaceFile(targetEntryFile(target));
   return hashFileSet(
     [...configInputFiles(), entry, ...(dependencies || [])].filter(Boolean),
     `target:${target.kind.name}/${target.scriptCode}`,
@@ -258,11 +304,94 @@ function isTargetCacheHit(cache, target) {
   );
 }
 
-function typecheckScripts(cache) {
+function formatTypeScriptDiagnostics(diagnostics) {
+  return ts.formatDiagnosticsWithColorAndContext(diagnostics, {
+    getCanonicalFileName: (file) => file,
+    getCurrentDirectory: () => rootDir,
+    getNewLine: () => "\n",
+  });
+}
+
+function scopedTypecheckKey(targets) {
+  return targets
+    .map((target) => `${target.kind.name}/${target.scriptCode}`)
+    .sort()
+    .join(",");
+}
+
+function scopedAmbientDeclarationFiles() {
+  return walkFiles(path.join(rootDir, "src"))
+    .filter((file) => file.endsWith(".d.ts"))
+    .map(relativeWorkspaceFile)
+    .filter(Boolean);
+}
+
+function createScopedTypecheckProgram(targets) {
+  const loaded = ts.readConfigFile(TSCONFIG_FILE, ts.sys.readFile);
+  if (loaded.error) {
+    process.stderr.write(formatTypeScriptDiagnostics([loaded.error]));
+    throw new Error("JS_CODE scoped TypeScript config validation failed");
+  }
+  const files = [
+    ...targets.map((target) =>
+      relativeWorkspaceFile(targetEntryFile(target)),
+    ),
+    ...scopedAmbientDeclarationFiles(),
+  ].filter(Boolean);
+  const parsed = ts.parseJsonConfigFileContent(
+    { ...loaded.config, files, include: [] },
+    ts.sys,
+    rootDir,
+    { noEmit: true },
+    TSCONFIG_FILE,
+  );
+  if (parsed.errors.length > 0) {
+    process.stderr.write(formatTypeScriptDiagnostics(parsed.errors));
+    throw new Error("JS_CODE scoped TypeScript config validation failed");
+  }
+  return ts.createProgram({
+    rootNames: parsed.fileNames,
+    options: parsed.options,
+    projectReferences: parsed.projectReferences,
+  });
+}
+
+function scopedTypecheckInputHash(program, cacheKey) {
+  const sourceFiles = program
+    .getSourceFiles()
+    .map((sourceFile) => relativeWorkspaceFile(sourceFile.fileName))
+    .filter(Boolean);
+  return hashFileSet([...configInputFiles(), ...sourceFiles], `typecheck:${cacheKey}`);
+}
+
+function typecheckSelectedScripts(cache, targets) {
+  const cacheKey = scopedTypecheckKey(targets);
+  const program = createScopedTypecheckProgram(targets);
+  const inputHash = scopedTypecheckInputHash(program, cacheKey);
+  if (
+    !forceBuild &&
+    cache.toolFingerprint === toolFingerprint &&
+    cache.typechecks?.[cacheKey]?.inputHash === inputHash
+  ) {
+    console.log(`[build-js-code] scoped TypeScript validation cache hit (${targets.length} selected)`);
+    return { cacheHit: true, cacheKey, inputHash, mode: "scoped" };
+  }
+
+  console.log(`[build-js-code] validating TypeScript for ${targets.length} selected target(s)...`);
+  const diagnostics = ts.getPreEmitDiagnostics(program);
+  if (diagnostics.length > 0) {
+    process.stderr.write(formatTypeScriptDiagnostics(diagnostics));
+    throw new Error("JS_CODE scoped TypeScript validation failed");
+  }
+  console.log("[build-js-code] scoped TypeScript validation passed");
+  return { cacheHit: false, cacheKey, inputHash, mode: "scoped" };
+}
+
+function typecheckAllScripts(cache) {
   const inputHash = typecheckInputHash();
   if (!forceBuild && cache.toolFingerprint === toolFingerprint && cache.typecheck?.inputHash === inputHash) {
     console.log("[build-js-code] TypeScript validation cache hit");
-    return { cacheHit: true, inputHash };
+    return { cacheHit: true, inputHash, mode: "full" };
   }
 
   console.log("[build-js-code] validating TypeScript once for this batch...");
@@ -275,7 +404,13 @@ function typecheckScripts(cache) {
   console.log("[build-js-code] TypeScript validation passed");
   // pnpm may materialize/update a lockfile on the first invocation. Record the
   // post-validation inputs so the next process can reuse this successful tsc.
-  return { cacheHit: false, inputHash: typecheckInputHash() };
+  return { cacheHit: false, inputHash: typecheckInputHash(), mode: "full" };
+}
+
+function typecheckScripts(cache, targets, scoped) {
+  return scoped
+    ? typecheckSelectedScripts(cache, targets)
+    : typecheckAllScripts(cache);
 }
 
 function collectBuildDependencies(buildResult, entry) {
@@ -296,7 +431,7 @@ function collectBuildDependencies(buildResult, entry) {
 
 async function buildScript(target) {
   const { kind, scriptCode } = target;
-  const entry = path.join(kind.sourceRoot, scriptCode, "index.ts");
+  const entry = targetEntryFile(target);
   if (!existsSync(entry)) throw new Error(`${kind.label} script not found: ${entry}`);
   const outDir = path.join(kind.outputRoot, scriptCode);
   const external = Array.from(
@@ -361,14 +496,31 @@ function saveCache(typecheck, updatedTargets) {
   if (typecheck.cacheHit && updatedTargets.size === 0) return;
   const lockFd = acquireCacheLock();
   try {
-    const latest = readCache();
+    const stored = readCache();
+    // A scoped build updates only part of the cache. Never carry metadata from
+    // a different compiler/builder fingerprint into the new cache, otherwise
+    // untouched targets could become false hits after this process stamps the
+    // cache with the current fingerprint.
+    const latest = stored.toolFingerprint === toolFingerprint
+      ? stored
+      : emptyCache();
+    const validatedAt = new Date().toISOString();
+    const mergedTypechecks = { ...latest.typechecks };
+    if (!typecheck.cacheHit && typecheck.mode === "scoped") {
+      mergedTypechecks[typecheck.cacheKey] = {
+        inputHash: typecheck.inputHash,
+        validatedAt,
+      };
+    }
     const merged = {
       ...latest,
       version: CACHE_VERSION,
       toolFingerprint,
-      typecheck: typecheck.cacheHit
-        ? latest.typecheck
-        : { inputHash: typecheck.inputHash, validatedAt: new Date().toISOString() },
+      typecheck:
+        !typecheck.cacheHit && typecheck.mode === "full"
+          ? { inputHash: typecheck.inputHash, validatedAt }
+          : latest.typecheck,
+      typechecks: mergedTypechecks,
       targets: { ...latest.targets, ...Object.fromEntries(updatedTargets) },
     };
     const tempFile = `${CACHE_FILE}.${process.pid}.${crypto.randomBytes(6).toString("hex")}.tmp`;
@@ -398,7 +550,7 @@ function saveCache(typecheck, updatedTargets) {
   }
 }
 
-const targets = resolveBuildTargets();
+const { scoped, targets } = resolveBuildSelection();
 if (targets.length === 0) {
   console.log(
     "no JS_CODE scripts found under src/js-code-nodes/<scriptCode>/index.ts, src/automations/<scriptCode>/index.ts, or src/functions/<functionCode>/index.ts",
@@ -407,7 +559,7 @@ if (targets.length === 0) {
 }
 
 const cache = readCache();
-const typecheck = typecheckScripts(cache);
+const typecheck = typecheckScripts(cache, targets, scoped);
 const updatedTargets = new Map();
 let builtCount = 0;
 let cachedCount = 0;