openxiangda 1.0.264 → 2.0.0-alpha.2

package/policy/openxiangda-policy.json

@@ -1,72 +0,0 @@
-{
-  "schemaVersion": "openxiangda_engineering_policy_v1",
-  "policyVersion": 7,
-  "risk": {
-    "levels": ["L0", "L1", "L2", "L3"],
-    "quickMaxLevel": "L1",
-    "classifyBy": [
-      "data-impact",
-      "permission-impact",
-      "contract-impact",
-      "reversibility",
-      "dependency-blast-radius"
-    ],
-    "directoryIsOnlySignal": true
-  },
-  "sdd": {
-    "sourceOfTruth": "openspec/changes/<change>/change.json",
-    "verifyIsReadOnly": true,
-    "markdownIsDerived": true,
-    "explicitWriteCommands": ["sdd sync", "sdd record-result", "sdd render"]
-  },
-  "git": {
-    "platformRepositoryMode": "direct-authoritative-master",
-    "applicationTaskMode": "isolated-worktree",
-    "applicationPublishMode": "clean-authoritative-master",
-    "taskReadyCommand": "sdd ready",
-    "integrationCommand": "sdd bundle",
-    "requireRemoteMainlineContainment": true
-  },
-  "release": {
-    "normalDeliveryVersion": 2,
-    "trustedDeveloperMode": true,
-    "normalCommands": ["check", "deploy", "status", "retry", "rollback"],
-    "productionConsumesSealedPackage": true,
-    "serverPersistedReleaseRun": true,
-    "sealedAuthoredBuildClosure": true,
-    "workspaceNodeModulesDuringExecution": false,
-    "exactResourceFingerprintDiff": true,
-    "deletionsFailClosed": true,
-    "attemptFencing": true,
-    "crossMachineBindingReplay": true,
-    "deterministicRuntimeBuildIdentity": "runtime-layer-plus-package-digest",
-    "deterministicRuntimeUploadedReleaseReuse": "exact-content-source-parent-only",
-    "statusAutoResolvesEnvironment": true,
-    "v2RequiresSdd": false,
-    "v2RequiresGitMainline": false,
-    "planAndVerifyAreReadOnly": true,
-    "applicationEnvironmentMode": "candidate-preproduction-evidence-production",
-    "candidateImmutable": true,
-    "productionDirectPublish": false,
-    "sameCandidateRequiredForPromotion": true,
-    "atomicChildren": [
-      "RuntimeRelease",
-      "PageRelease",
-      "BackendRelease",
-      "FormRelease",
-      "WorkflowRelease"
-    ],
-    "unsupportedGenericMode": "fail-closed",
-    "explicitMaintenanceDirectMode": true,
-    "postCommitMode": "transactional-outbox"
-  },
-  "ownership": {
-    "defaultTtlSeconds": 7200,
-    "releaseOnTaskReady": true
-  },
-  "testing": {
-    "layers": ["changed", "contract", "release", "all"],
-    "evidenceDirectory": ".openxiangda/evidence/tests",
-    "preproductionEvidenceMaxAgeHours": 24
-  }
-}

package/templates/openxiangda-react-spa/.cursor/rules/openxiangda-form.mdc

@@ -1,24 +0,0 @@
----
-description: src/forms/** — Use openxiangda-form skill
-globs: src/forms/**/*
-alwaysApply: false
----
-
-# OpenXiangda React SPA Form Files
-
-Editing `src/forms/<formCode>/`. Use the **`openxiangda-form`** skill.
-
-- Keep field/schema rules in `schema.ts` and presentation in `page.tsx`.
-- Prefer OpenXiangda platform fields, then `antd` / `antd-mobile`; do not use native inputs, hand-written uploaders, pickers, or user/department selectors.
-- Option fields require non-empty `options`; linked data uses `SelectField` with `optionSource.type: "linkedForm"`.
-- Top-level `schema.rules` is only for `FormEffect[]`; validation belongs to field `rules`.
-- Do not recreate platform system fields. Use `behavior: "HIDDEN"` + `valueSync` for derived or permission keys.
-
-Release with exact scope:
-
-```bash
-openxiangda resource plan form-setting --only <formCode> --profile <name>
-openxiangda resource publish form-setting --only <formCode> --change <change> --profile <name>
-```
-
-Managed production activation only occurs through candidate → preproduction deploy/test → promotion of the same candidate.

package/templates/openxiangda-react-spa/.cursor/rules/openxiangda-page.mdc

@@ -1,25 +0,0 @@
----
-description: src/pages/** — Use openxiangda-page skill
-globs: src/pages/**/*
-alwaysApply: false
----
-
-# OpenXiangda React SPA Page Files
-
-Editing `src/pages/`. Use the **`openxiangda-page`** skill.
-
-- Keep routes in `src/app/router.tsx` and navigation in `src/app/navigation.ts`.
-- Split complex pages into thin views, `domain/`, `shared/{services,hooks}/`, `components/`, and styles.
-- Use server pagination and structured `filterGroup`; never fetch an oversized page and filter in the browser.
-- Prefer OpenXiangda platform components for platform data fields and `antd` / `antd-mobile` for ordinary UI.
-- Do not use native form controls, hand-written pickers/uploaders, or frontend-only authorization.
-
-Build and stage:
-
-```bash
-pnpm typecheck
-pnpm build
-openxiangda runtime deploy --no-activate --change <change> --profile <name>
-```
-
-Managed production activation only occurs through candidate → preproduction deploy/test → promotion of the same candidate.

package/templates/openxiangda-react-spa/.cursor/rules/openxiangda-resources.mdc

@@ -1,32 +0,0 @@
----
-description: src/resources/** glob — OpenXiangda React SPA resource manifests
-globs: src/resources/**/*
-alwaysApply: false
----
-
-# OpenXiangda Resource Manifests
-
-You are editing engineering-managed resource manifests under `src/resources/`. Local files use logical codes; platform IDs stay in `.openxiangda/state.json`.
-
-## Commands
-
-```bash
-openxiangda resource validate <type> --only <codes> --profile <name>
-openxiangda resource plan <type> --only <codes> --profile <name>
-openxiangda resource publish <type> --only <codes> --profile <name>
-# one target: replace --only <codes> with --code <code>
-openxiangda resource typegen --profile <name>
-```
-
-## Rules
-
-- Public routes require matching `routes` and `public-access` manifests.
-- Guest access to forms, dataViews, functions, and connectors requires explicit policy `grants`.
-- Guest file upload requires a structured form grant such as `{code, actions: ["upload", "preview"], fields?: [...]}`; optional form `upload` or `grants.storage` constraints define bucket/MIME/extensions/size/visibility/path prefix.
-- Connector secrets and third-party credentials belong in the platform backend, never in manifests or page source.
-- App Function manifests may contain only metadata names in top-level `secretRefs`; values use the Secret CLI and runtime `ctx.secrets.get(name)` under `function_v2` / `trusted_node_v2`.
-- Formal changes should keep Git as the source of truth: edit manifests, validate, plan, then publish.
-- Exact selectors apply before manifest/source analysis and JS_CODE build: touch only selected targets plus transitive/shared/ambient dependencies; omit selectors only for intentional full-workspace work.
-- `resource plan` and publish dry-runs are GET/HEAD-only. On `READ_ONLY_AUTH_REQUIRED`, run `openxiangda auth refresh --profile <name>` or log in again before retrying; never refresh inside the plan.
-- Source-triggered Function/Automation publishing patches only source fields on the server and preserves online bindings/contracts/metadata/state. A new source-free Automation with a complete `definitionJson.version="v3"` automatically uses manifest create; replacing an existing whole manifest requires `--replace-manifest --reason "..."`.
-- Formal promotion freezes the clean publish HEAD separately from the change base, preflights the complete set, and rejects `SOURCE_BASE_DIVERGED` / `RELEASE_SOURCE_BEHIND_MAIN` / `RESOURCE_FIELD_CONFLICT`. After activation, merge/fast-forward and push the frozen SHA, verify `release integration-status`, then run normal `release end`; squash/rebase does not preserve the released source.

package/templates/openxiangda-react-spa/.cursor/rules/openxiangda-workflow-automation.mdc

@@ -1,26 +0,0 @@
----
-description: src/{workflows,automations,js-code-nodes,functions}/** — Use openxiangda-workflow-automation skill
-globs: src/{workflows,automations,js-code-nodes,functions}/**/*
-alwaysApply: false
----
-
-# OpenXiangda React SPA Workflow / Automation / Function Files
-
-Use the **`openxiangda-workflow-automation`** skill for workflows, automations, JS_CODE, and App Functions.
-
-- Ordinary lifecycle state changes use a status field, domain state machine, and automation; create workflows only for real approval semantics.
-- Prefer App Functions for reusable backend logic. JS_CODE is for cross-form, batch, process, platform API, external HTTP, and complex orchestration.
-- Keep UI interactions, normal validation, and display logic in React.
-- Log important backend steps with `ctx.logger`; obtain third-party credentials only through declared `secretRefs`.
-- Never copy workflow, automation, or function IDs across profiles.
-
-Build and release with exact scope:
-
-```bash
-pnpm typecheck:js-code
-pnpm build-js-code --script <code>
-openxiangda resource plan <workflow|automation|function> --only <code> --profile <name>
-openxiangda resource publish <workflow|automation|function> --only <code> --change <change> --profile <name>
-```
-
-Managed production activation only occurs through candidate → preproduction deploy/test → promotion of the same candidate.

package/templates/openxiangda-react-spa/.cursor/rules/openxiangda.mdc

@@ -1,68 +0,0 @@
----
-description: OpenXiangda React SPA workspace strong constraints
-alwaysApply: true
----
-
-# OpenXiangda React SPA Rule
-
-This is an OpenXiangda React SPA workspace using Delivery V2. See [DELIVERY.md](mdc:DELIVERY.md) and [AGENTS.md](mdc:AGENTS.md). Low-level V1 resource/runtime commands are compatibility tools.
-
-## Hard route
-
-| User says | Command |
-|---|---|
-| publish / deploy | `openxiangda check --environment preproduction` → `openxiangda deploy preproduction` |
-| formal promotion | `openxiangda deploy production --package <packageDigest>` |
-| status / retry | `openxiangda status <runId>` → `openxiangda retry <runId>` |
-| rollback | `openxiangda rollback production --to <appReleaseId>` |
-| diagnose | `openxiangda doctor --profile <name> --json` |
-| external backend Open API | `openxiangda-open-api` + `openxiangda open-api spec describe ...` |
-
-## Always
-
-- Delivery V2 derives exact scope and does not require SDD, Git clean, `--change`, `--only`, candidate, or ship.
-- Treat `check --json` as the authoritative exact delta and execution plan. Deletions and unsealed third-party build dependencies fail before writes; package execution uses only the CLI toolchain and never links workspace `node_modules`. `status`/`retry` auto-locate the environment, while retry fences the old attempt and replays only cross-machine local Form bindings. Runtime build IDs combine the Runtime layer and sealed package digests; only an exact same-package `uploaded` release with matching content, source, and parent may be reused, and immutable storage is never overwritten.
-- Writes and deploys must pass `--profile <name>` explicitly.
-- Architecture-class work is plan-gated: run `openxiangda design gates --topic <code> --json` and wait for confirmation.
-- Give every task an isolated worktree/branch and one explicit development change; feature worktrees never publish. Merge approved commits to the remote default branch, create one `sdd bundle <release-change> --changes ...`, commit/push it, then publish once from the synchronized clean main/master checkout.
-- Close tasks from canonical main only. Review `openxiangda workspace cleanup`, then run `openxiangda workspace cleanup --apply` for that exact hashed `SAFE` plan; it revalidates managed worktrees under the owner lock, never picks up newly-safe entries, and never runs global `git worktree prune`. Review stale records separately.
-- L0 read-only/docs/tests need no SDD; L1 narrow reversible fixes record exact scope without a redundant second confirmation; schema, business Functions, Automation/Workflow, permissions, auth/public access, data writes, and runtime/config are L2/L3 full-SDD work. Live evidence/archive are post-release stages.
-- Very small copy/style/binding changes may use `openxiangda sdd quick <change> ...`; quick mode records exact low-risk scope without a redundant proposal/approval loop when the user already requested it.
-- SDD is streamlined by default: approval and exact structured scope are hard gates, while unfinished task/evidence/spec prose only warns. Configure `strictDocumentation: true` only when prose must block.
-- Before platform writes, run `release begin` from a clean local main/master that exactly equals the authoritative remote tip. Feature branches and unpushed mainline commits fail before any write. A clone primary may be canonicalized to the frozen repository ID only when that ID is already in `repoAliases`; otherwise release prepare fails closed. After activation, run `integration-status` and `release end`; no post-release merge is needed.
-- Managed preproduction and production targets own independent app/resource/data identities and side-effect policy. Existing workspaces use `environment attach`; only an appType-matching legacy binding may seed preproduction and production starts empty. Never direct-publish or copy IDs across them; use `openxiangda studio` to inspect candidate, evidence, and drift state. Only an explicitly authorized commissioning reclassification may use `environment swap --reason "..." --confirm-production`; it preserves app data/Release Heads and keeps side effects restricted by default.
-- Managed `release ship` always runs candidate → preproduction → production. Normally confirmation is a later invocation; an explicitly authorized emergency may put `--confirm-production` on the first invocation to run both phases in one command. The candidate seals environment/resource bindings, sourceRevision, and target-specific Runtime artifacts; a later mainline HEAD is only a safety gate, while Backend/Runtime/Root retain candidate provenance. Deployment uses no rebuild and must finish each server deployment as `succeeded`.
-- Record a failed preproduction UAT with `release fail --deployment <id> --message "..." [--code <code>] [--details-json <JSON|file>] --environment preproduction`; the CLI verifies target ownership before the audited write and rejects production or mismatched deployments.
-- Change one target's side-effect policy only with `environment policy update <preproduction|production> --side-effect-policy-json <JSON|file> --reason "..."`: run `--dry-run` first, add `--confirm-production` for production, and never use `environment swap` for this. Patch mode validates only supplied fields and preserves unrecognized historical fields; `--full-replace` validates the supplied complete target and intentionally removes omissions. `organizationWrites=explicit_capability_only` removes the environment deny but still requires `app:organization:manage`. Keep release hard gates to explicit scope/profile/target, authorization, clean pushed mainline, immutable identity, CAS/lease, and production confirmation; prose and human acceptance notes are advisory unless strict mode is configured.
-- Account/role/permission/RBAC/organization-account/query-param authorization work must run `openxiangda design gates --topic permissions --json`, choose `managed-platform-account`, `existing-platform-user-assignment`, `static-role-permission`, or `query-param-context`, and write the permission matrix.
-- Roles that create roles, assign members, grant API permissions, maintain permission groups, or manage organization accounts must declare `apiPermissionCodes`, such as `app:role:manage`, `app:page-permission-group:manage`, `app:form-permission-group:manage`, and `app:organization:manage`.
-- `src/resources/**` is the resource source of truth; use `validate -> plan -> publish`.
-- Select logical resource codes with `--only`, or one code with `--code`; type-wide/app-wide release requires an approved dependency closure.
-- Source-triggered Function/Automation publishing uses server-side source-field PATCH and preserves online bindings, contracts, metadata, trigger/view configuration, and enabled/published state. A new source-free Automation with a complete `definitionJson.version="v3"` automatically uses Backend Release manifest create without `--replace-manifest`; replacing an existing whole manifest requires `--replace-manifest --reason "..."`. On `SOURCE_BASE_DIVERGED` or `RESOURCE_FIELD_CONFLICT`, reconcile, rebuild, and re-plan.
-- A staged FormRelease for the same change may be rebound to a fresh baseline/session only after server verification of immutable/inactive/non-aborted state, identity/hash, frozen schema/formType, finalized resources, parent/base revision, and current Form head. `schemaSyncedAt` is not release evidence; never synthesize it, direct-publish the schema, or activate the Form early to bypass Workflow validation.
-- When Form settings and form permission groups ship together, stage them with one `resource publish form-setting,form-permission-group` command and exact qualified `form-setting:<code>` / `form-permission-group:<code>` selectors. SDD generation and validation share this contract and reject missing, extra, or split FormRelease scope.
-- Managed `release ship --adopt-online-baseline --adoption-reason "..."` freezes that audited intent in the private ship journal; the later `--confirm-production` automatically reuses it and rejects an explicitly different pair before any request.
-- Managed `release ship --replace-manifest --reason "..."` requires the pair, reason length >= 8, and exact Backend selectors; production confirmation repeats the exact preproduction pair, with no forwarding to Form/Workflow/Runtime/config/all stages.
-- After managed promotion, run `release integration-status --change <change> --profile <name> --check`; it recovers lineage from private `ship.json` or its referenced production/preproduction deployment execution journal, and names the missing file or field when recovery is impossible.
-- In a managed workspace with multiple targets, `function invoke` must include `--environment <target>`; verify the resolved target line on stderr before drawing conclusions from the response.
-- React routes live in `src/app/router.tsx`; frontend artifacts are deployed with `openxiangda runtime deploy`.
-- Use `AttachmentField` / `ImageField` for form-context previews, and `AttachmentPreviewList` / `ImagePreviewGrid` / `useFilePreview` for standalone custom pages. Do not fake form context, import internal preview implementations, or maintain local previewable-extension lists.
-- Backend permissions, public-access grants, and App Function role/scope checks are authoritative.
-- Public guest uploads require structured form grants with explicit upload/preview/download actions; never whitelist generic `/file/upload` or trust client-supplied app/form/field context without the signed guest claim.
-- Query parameters are context, filters, or ticket input only; they are not sensitive authorization.
-- External backends using `/dingtalk-api/v1.0` must own AK/SK and token storage; never pass those credentials into the React SPA.
-
-## Never
-
-- Do not run `lowcode-workspace publish-all`, `pnpm publish:all`, or `pnpm openxiangda:publish` directly.
-- Do not deploy without `--profile`.
-- Do not hot-patch a temporary release copy or activate a Runtime built from an unmerged task branch.
-- Do not use legacy `?publicAccess=guest`, `isRenderNav`, or workbench page parameters for new React SPA routes.
-- Do not rely on frontend-only button hiding, query-param checks, hardcoded roles, mock permissions, fake account IDs, or `PermissionBoundary` alone for real authorization.
-- Do not assign a business admin role without the role-setting API permissions needed for role/member management.
-- Do not bypass `sdk.organization` / `ctx.organization` for platform account/department writes.
-- Do not commit tokens, AK/SK, or third-party secrets.
-
-## Parallel candidates
-
-A candidate may cross unrelated later mainline commits only when its commit remains an ancestor of clean pushed mainline and all sealed input hashes remain unchanged. Each target allows one running or evidence-pending deployment; wait for the lease/slot, and keep emergency fixes on the narrow candidate → preproduction → production path.

package/templates/openxiangda-react-spa/.env.example

@@ -1,4 +0,0 @@
-OPENXIANGDA_BASE_URL=https://your-platform.example.com
-OPENXIANGDA_APP_TYPE=APP_XXXX
-APP_SERVICE_PREFIX=/service
-OPENXIANGDA_DEV_PORT=5174

package/templates/openxiangda-react-spa/.qoder/rules/openxiangda-form.md

@@ -1,37 +0,0 @@
----
-description: src/forms/** glob — 精准引导到 openxiangda-form skill
-glob: src/forms/**/*
-alwaysApply: false
----
-
-# OpenXiangda React SPA Form Files
-
-You are editing files under `src/forms/<formCode>/`. Use the **`openxiangda-form`** skill.
-
-## Required structure
-
-```text
-src/forms/<formCode>/
-├── schema.ts   # defineFormSchema() default export
-└── page.tsx    # presentation only
-```
-
-## Common pitfalls
-
-- 平台字段组件优先于 `antd` / `antd-mobile` 包装和自定义业务组件。
-- `schema.ts` 定义字段、选项、规则与行为；`page.tsx` 只负责展示。
-- 禁止直接写原生 `<input>` / `<select>` / `<textarea>` / file input，禁止手写人员、部门、上传和 picker 组件。
-- 选项字段必须提供非空 `options`；跨表数据使用 `SelectField` + `optionSource.type: "linkedForm"`。
-- 顶层 `schema.rules` 只用于 `FormEffect[]`；字段校验放字段自己的 `rules`。
-- 平台系统字段由平台维护，不要重复创建。
-- 派生键和隐式权限键使用 `behavior: "HIDDEN"` + `valueSync`。
-
-## Release
-
-```bash
-openxiangda resource validate form-setting --only <formCode> --profile <name>
-openxiangda resource plan form-setting --only <formCode> --profile <name>
-openxiangda resource publish form-setting --only <formCode> --change <change> --profile <name>
-```
-
-正式环境托管发布仍必须走 candidate → preproduction deploy/test → 同 candidate promotion，禁止直接激活生产资源。

package/templates/openxiangda-react-spa/.qoder/rules/openxiangda-page.md

@@ -1,29 +0,0 @@
----
-description: src/pages/** glob — 精准引导到 openxiangda-page skill
-glob: src/pages/**/*
-alwaysApply: false
----
-
-# OpenXiangda React SPA Page Files
-
-You are editing files under `src/pages/`. Use the **`openxiangda-page`** skill.
-
-## Strong defaults
-
-- 路由集中维护在 `src/app/router.tsx`，应用导航维护在 `src/app/navigation.ts`。
-- 复杂页面拆分为薄视图、`domain/`、`shared/{services,hooks}/`、`components/` 和样式文件。
-- 默认使用原生 Tailwind utilities，不使用未配置的 shadcn token。
-- 列表必须服务端分页并使用结构化 `filterGroup`；禁止抓取超大页后在浏览器过滤。
-- 平台数据字段优先使用 OpenXiangda 平台组件；普通 UI 使用 `antd` / `antd-mobile`。
-- 禁止原生表单控件、手写 picker/uploader/人员部门选择器。
-- 后端权限、公开访问 grants 与 App Function 检查才是授权依据；前端只做展示保护。
-
-## Release
-
-```bash
-pnpm typecheck
-pnpm build
-openxiangda runtime deploy --no-activate --change <change> --profile <name>
-```
-
-Runtime 只暂存到候选发布；正式环境托管发布必须走 candidate → preproduction deploy/test → 同 candidate promotion。

package/templates/openxiangda-react-spa/.qoder/rules/openxiangda-resources.md

@@ -1,32 +0,0 @@
----
-description: src/resources/** glob — OpenXiangda React SPA 资源 manifest 规则
-glob: src/resources/**/*
-alwaysApply: false
----
-
-# OpenXiangda Resource Manifests
-
-You are editing engineering-managed resource manifests under `src/resources/`. Local files use logical codes; platform IDs stay in `.openxiangda/state.json`.
-
-## Commands
-
-```bash
-openxiangda resource validate <type> --only <codes> --profile <name>
-openxiangda resource plan <type> --only <codes> --profile <name>
-openxiangda resource publish <type> --only <codes> --profile <name>
-# one target: replace --only <codes> with --code <code>
-openxiangda resource typegen --profile <name>
-```
-
-## Rules
-
-- Public routes require matching `routes` and `public-access` manifests.
-- Guest access to forms, dataViews, functions, and connectors requires explicit policy `grants`.
-- Guest file upload requires a structured form grant such as `{code, actions: ["upload", "preview"], fields?: [...]}`; optional form `upload` or `grants.storage` constraints define bucket/MIME/extensions/size/visibility/path prefix.
-- Connector secrets and third-party credentials belong in the platform backend, never in manifests or page source.
-- App Function manifests may contain only metadata names in top-level `secretRefs`; values use the Secret CLI and runtime `ctx.secrets.get(name)` under `function_v2` / `trusted_node_v2`.
-- Formal changes should keep Git as the source of truth: edit manifests, validate, plan, then publish.
-- Exact selectors apply before manifest/source analysis and JS_CODE build: touch only selected targets plus transitive/shared/ambient dependencies; omit selectors only for intentional full-workspace work.
-- `resource plan` and publish dry-runs are GET/HEAD-only. On `READ_ONLY_AUTH_REQUIRED`, run `openxiangda auth refresh --profile <name>` or log in again before retrying; never refresh inside the plan.
-- Source-triggered Function/Automation publishing patches only source fields on the server and preserves online bindings/contracts/metadata/state. A new source-free Automation with a complete `definitionJson.version="v3"` automatically uses manifest create; replacing an existing whole manifest requires `--replace-manifest --reason "..."`.
-- Formal promotion freezes the clean publish HEAD separately from the change base, preflights the complete set, and rejects `SOURCE_BASE_DIVERGED` / `RELEASE_SOURCE_BEHIND_MAIN` / `RESOURCE_FIELD_CONFLICT`. After activation, merge/fast-forward and push the frozen SHA, verify `release integration-status`, then run normal `release end`; squash/rebase does not preserve the released source.

package/templates/openxiangda-react-spa/.qoder/rules/openxiangda-workflow-automation.md

@@ -1,34 +0,0 @@
----
-description: src/{workflows,automations,js-code-nodes,functions}/** glob — 精准引导到 openxiangda-workflow-automation skill
-glob: src/{workflows,automations,js-code-nodes,functions}/**/*
-alwaysApply: false
----
-
-# OpenXiangda React SPA Workflow / Automation / Function Files
-
-Use the **`openxiangda-workflow-automation`** skill when editing:
-
-- `src/workflows/<code>/workflow.ts`
-- `src/automations/<code>/index.ts`
-- `src/js-code-nodes/<code>/index.ts`
-- `src/functions/<code>/index.ts`
-
-## Boundaries
-
-- 普通 `pending → processing → resolved → closed` 使用状态字段、领域状态机与 automation；只有真实审批语义才创建 workflow。
-- 复用后端业务逻辑优先 App Function；JS_CODE 用于跨表、批量、流程、平台 API、外部 HTTP 与复杂编排。
-- UI 交互、普通表单校验和展示逻辑留在 React 代码，不放进 JS_CODE。
-- 每个关键步骤使用 `ctx.logger.debug/info/warn/error`；第三方凭据只通过 `secretRefs` 与 `ctx.secrets.get()` 获取。
-- workflowId / automationId / functionId 不得跨 profile 复制。
-
-## Build and release
-
-```bash
-pnpm typecheck:js-code
-pnpm build-js-code --script <code>
-openxiangda resource validate <workflow|automation|function> --only <code> --profile <name>
-openxiangda resource plan <workflow|automation|function> --only <code> --profile <name>
-openxiangda resource publish <workflow|automation|function> --only <code> --change <change> --profile <name>
-```
-
-资源发布只生成候选子版本；正式环境托管发布必须走 candidate → preproduction deploy/test → 同 candidate promotion。

package/templates/openxiangda-react-spa/.qoder/rules/openxiangda.md

@@ -1,66 +0,0 @@
----
-description: OpenXiangda React SPA 工作区强约束 — 路由、命令、不变量、禁令
-alwaysApply: true
----
-
-# OpenXiangda React SPA Rule
-
-This is an OpenXiangda React SPA workspace using Delivery V2. Read [DELIVERY.md](DELIVERY.md) and [AGENTS.md](AGENTS.md). Low-level V1 resource/runtime commands are compatibility tools, not the normal release entrypoint.
-
-## Hard route
-
-| 用户说 | 必用命令 |
-|---|---|
-| 发布 / 完整部署 | `openxiangda check --environment preproduction` → `openxiangda deploy preproduction` |
-| 正式 promotion | `openxiangda deploy production --package <packageDigest>` |
-| 状态 / 失败重试 | `openxiangda status <runId>` → `openxiangda retry <runId>` |
-| 回滚 | `openxiangda rollback production --to <appReleaseId>` |
-| 诊断 / 环境 | `openxiangda doctor --profile <name> --json` / `openxiangda env --profile <name>` |
-| 外部后端 / 三方系统开放接口 | `openxiangda-open-api` + `openxiangda open-api spec describe ...` |
-
-## Always
-
-- Delivery V2 自动计算精确范围，不要求 SDD、Git clean、`--change`、`--only` 或 candidate/ship。
-- `check --json` 是 V2 权威预检：确认精确资源差异和执行计划。删除与未密封第三方构建依赖在写入前失败；包执行只用 CLI 工具链且不链接工作区 `node_modules`。`status`/`retry` 自动定位环境，retry 以 attempt 隔离旧执行器并仅重放跨机器所需的本地 Form 绑定。Runtime buildId 同时包含 Runtime layer 与密封包摘要；仅同包 `uploaded` Release 在内容、源码、父版本完全一致时复用，不覆盖不可变存储对象。
-- 发布和写平台资源必须显式传 `--profile <name>`。
-- 架构类需求先跑 `openxiangda design gates --topic <code> --json` 并等用户确认。
-- 每个任务使用独立 worktree/branch 和一个开发 change，但 feature worktree 不发布。批准提交先合并并 push 到远端默认主分支，再创建一个 `sdd bundle <release-change> --changes ...`，从同步且干净的 main/master 一次发布。
-- 合并、push、发布和 `release end` 后，回到 canonical 主工作区先审阅 `openxiangda workspace cleanup`，再执行 `openxiangda workspace cleanup --apply` 应用精确哈希计划。CLI 在 owner lock 内复核，只删除已审阅的 managed `SAFE` 项，不顺带处理后来才安全的项，也不执行全局 `git worktree prune`；stale 记录单独人工审阅。
-- L0 只读/文档/测试无需 SDD；L1 使用 quick；L2/L3 保留批准和结构化范围。默认 streamlined 模式下，未完成的 task/evidence/spec 文案只告警；只有 `strictDocumentation: true` 才阻断。
-- 账号/角色/权限/RBAC/组织账号/查询参数授权需求先跑 `openxiangda design gates --topic permissions --json`，选择 `managed-platform-account` / `existing-platform-user-assignment` / `static-role-permission` / `query-param-context` 并输出权限矩阵。
-- 角色能新增角色、分配成员、授接口权限、维护权限组或管理组织账号时，角色资源必须声明 `apiPermissionCodes`，例如 `app:role:manage`、`app:page-permission-group:manage`、`app:form-permission-group:manage`、`app:organization:manage`。
-- `src/resources/**` 是工程化资源来源，正式多资源变更走 `validate -> plan -> publish`。
-- 默认按逻辑资源 code 使用 `--only` 或单资源 `--code`；全类型/全应用发布必须由批准的依赖闭包明确覆盖。
-- Function/Automation 源码触发默认走服务端 source-field PATCH，保留线上 bindings/contracts/metadata/trigger/view/enabled/published state；无源码且 `definitionJson.version="v3"` 完整的新建 Automation 自动走 manifest create，只有替换已有整包 manifest 才必须加 `--replace-manifest --reason "..."`。
-- 相同 change 的 staged FormRelease 只有经服务端重新核验 immutable/inactive/non-aborted、identity/hash、冻结 schema/formType、finalized 资源、parent/base revision 与当前 Form Head 后，才可重挂接新 baseline/session。`schemaSyncedAt` 不是发布证据；禁止伪造、直发 schema 或提前激活 Form 绕过 Workflow 校验。
-- Form 设置与表单权限组同时发布时，必须合并为一条 `resource publish form-setting,form-permission-group`，并使用 `form-setting:<code>`、`form-permission-group:<code>` 精确 selector；SDD 生成与校验共享同一契约，禁止缺失、夹带或拆分 FormRelease。
-- 环境托管 `release ship --adopt-online-baseline --adoption-reason "..."` 会把审计意图冻结进私有 ship journal，后续 `--confirm-production` 自动复用；显式传入不同参数会在任何请求前失败。
-- 环境托管 `release ship --replace-manifest --reason "..."` 必须成对、reason 至少 8 字符且仅限精确 Backend selector；正式确认复用与预发完全相同的参数，不透传 Form/Workflow/Runtime/配置或全量步骤。
-- `release ship` 始终顺序执行 candidate → 预发 → 生产。日常分两次确认；明确授权紧急发布时首条命令可带 `--confirm-production` 一次完成，但不跳过预发/证据/CAS。candidate 封存环境/资源绑定、sourceRevision 及两目标 Runtime 哈希产物；后续主线 HEAD 只作安全门禁，Backend/Runtime/Root 不改写候选来源，且每条服务端 deployment 必须闭环为 `succeeded`。
-- 预发 UAT 失败使用 `release fail --deployment <id> --message "..." [--code <code>] [--details-json <JSON|file>] --environment preproduction` 写审计；CLI 先校验 deployment 属于所选预发环境，禁止 production 或环境不匹配写入。
-- 托管发布完成后运行 `release integration-status --change <change> --profile <name> --check`；CLI 从私有 `ship.json` 或其引用的 production/preproduction deployment execution 日志恢复血缘，无法恢复时指出实际缺失的文件或字段。
-- 多 target 的托管工作区执行 `function invoke` 必须显式传 `--environment <target>`，并先核对 stderr 回显的最终 target 再判断响应。
-- Promotion 必须持有 `release begin/end` 租约；`release begin` 只接受与权威远端 tip 完全一致的 clean main/master。feature branch 或未 push 主线在任何写入前失败。clone primary 只有在冻结仓库 ID 已存在于 `repoAliases` 时才会 canonicalize；无交集在 Release prepare 前失败关闭。激活后直接运行 `integration-status` 和 `release end`，不再补做发布后合并。
-- 已有工作区通过 `environment attach` 接入环境组，旧资源映射只迁移到 appType 相同的预发 target，正式 target 必须为空。preproduction / production 分别拥有独立 appType、资源 ID、数据和副作用策略；禁止直接 `release publish`，禁止跨环境复制 ID，使用 `openxiangda studio` 查看状态。只有用户明确授权的投产前重分类可执行 `environment swap --reason "..." --confirm-production`；它不移动应用数据或 Release Head，且默认不放开副作用。
-- 单独修改某个环境的副作用策略只能使用 `environment policy update <preproduction|production> --side-effect-policy-json <JSON|file> --reason "..."`：先执行 `--dry-run`，正式环境额外要求 `--confirm-production`，不得借用 `environment swap`。patch 只校验本次提交字段并原样保留未知历史字段，`--full-replace` 才按完整目标删除遗漏字段。`organizationWrites=explicit_capability_only` 只解除环境级 deny，仍强制 `app:organization:manage`。发布硬门禁只保留明确 scope/profile/target、权限、干净且已推送主线、不可变版本、CAS/租约与生产确认；文案和人工验收说明默认是建议，只有显式 strict 模式才阻断。
-- React SPA 路由由 `src/app/router.tsx` 管理，前端包通过 `openxiangda runtime deploy` 发布。
-- 表单附件预览使用 `AttachmentField` / `ImageField`；普通自定义页面使用 `AttachmentPreviewList` / `ImagePreviewGrid` / `useFilePreview`，不要伪造表单上下文、直接引用内部预览实现或维护扩展名白名单。
-- 页面权限、表单权限、公开访问 grants、App Function 后端检查是授权依据；前端只做展示保护。
-- 公开 guest 上传必须使用带 `code/actions/fields` 的结构化表单 grant；禁止匿名放开通用 `/file/upload`，客户端 app/form/field 上下文只能与签名 guest claim 比对，不能单独授权。
-- 查询参数只能做上下文、筛选或 ticket 输入，不能作为敏感数据授权依据。
-- 外部后端使用 `/dingtalk-api/v1.0` 时由后端自己保管 AK/SK 和 token；React SPA 不得接收这些凭证。
-
-## Never
-
-- 不要直接运行 `lowcode-workspace publish-all`、`pnpm publish:all` 或 `pnpm openxiangda:publish`。
-- 不要省略 `--profile` 发布。
-- 不要在临时发布副本中做仓库没有的 hot patch，也不要直接激活未合并会话构建的 Runtime。
-- 不要使用旧 `?publicAccess=guest`、`isRenderNav` 或 workbench 参数模型开发新 React SPA。
-- 不要只隐藏按钮、只判断 query 参数、硬编码角色、前端模拟权限、假账号/假 ID、或用 `PermissionBoundary` 代替真实授权。
-- 不要给用户挂“管理员”业务角色但不给该角色绑定 `app:role:manage` 等角色设置接口权限。
-- 不要绕过 `sdk.organization` / `ctx.organization` 直接写平台账号/部门。
-- 不要把 token、AK、SK、第三方密钥写入项目文件。
-
-## 并行 candidate
-
-candidate 只可跨越不相干的后续主线提交：其 commit 必须仍是干净、已推送主线的祖先，且 sealed 输入哈希全部不变。同一目标一次只允许一个 running / evidence-pending deployment；等待 lease/槽位，紧急修复也走精确 candidate → preproduction → production。