openxiangda 1.0.264 → 2.0.0-alpha.2

package/templates/openxiangda-react-spa/src/styles/index.css

@@ -1,105 +0,0 @@
-@tailwind base;
-@tailwind components;
-@tailwind utilities;
-
-html,
-body,
-#root {
-  min-height: 100%;
-}
-
-body {
-  margin: 0;
-  font-family:
-    Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI",
-    sans-serif;
-  background: #eef2f7;
-  color: #0f172a;
-  overflow-x: hidden;
-}
-
-button,
-input,
-select,
-textarea {
-  font: inherit;
-}
-
-button {
-  border: 0;
-}
-
-a {
-  color: inherit;
-  text-decoration: none;
-}
-
-.ox-panel {
-  border: 1px solid rgb(255 255 255 / 0.72);
-  border-radius: 16px;
-  background: rgb(255 255 255 / 0.88);
-  box-shadow: 0 18px 55px rgb(15 23 42 / 0.06);
-}
-
-.ox-scrollbar {
-  scrollbar-color: rgb(148 163 184 / 0.7) transparent;
-  scrollbar-width: thin;
-}
-
-.ox-scrollbar::-webkit-scrollbar {
-  height: 10px;
-  width: 10px;
-}
-
-.ox-scrollbar::-webkit-scrollbar-thumb {
-  background: rgb(148 163 184 / 0.65);
-  border-radius: 999px;
-}
-
-.ox-scrollbar::-webkit-scrollbar-track {
-  background: transparent;
-}
-
-.ox-admin-content :where(.sy-runtime-page) {
-  min-height: auto;
-  background: transparent;
-  color: inherit;
-}
-
-.ox-admin-content :where(.sy-runtime-page__content) {
-  max-width: 100% !important;
-  padding: 0 !important;
-}
-
-.ox-admin-content :where(.sy-submit-page) {
-  gap: 0;
-  min-height: auto;
-}
-
-.ox-admin-content :where(.sy-submit-card, .sy-detail-card) {
-  border: 1px solid rgb(226 232 240 / 0.86);
-  border-radius: 20px;
-  background: rgb(255 255 255 / 0.9);
-  box-shadow: 0 18px 55px rgb(15 23 42 / 0.06);
-}
-
-.ox-admin-content :where(.sy-submit-card) {
-  min-height: auto;
-}
-
-.ox-admin-content :where(.sy-detail-main) {
-  max-width: 100%;
-  padding: 0 0 32px;
-}
-
-.ox-admin-content :where(.sy-detail-header) {
-  display: none;
-}
-
-.ox-admin-content :where(.sy-detail-page) {
-  background: transparent;
-}
-
-.ox-default-data-route :where(.sy-data-management-list, .sy-runtime-page) {
-  min-width: 0;
-}

package/templates/openxiangda-react-spa/tailwind.config.cjs

@@ -1,37 +0,0 @@
-const path = require("node:path");
-const openxiangdaPresetModule = require("openxiangda/tailwind-preset");
-const openxiangdaPreset =
-  openxiangdaPresetModule.default ?? openxiangdaPresetModule;
-
-function resolveOpenXiangdaContent() {
-  try {
-    const packagePath = require.resolve("openxiangda");
-    const distDir = path.dirname(packagePath);
-    return [path.join(distDir, "..", "**/*.{js,mjs,cjs}")];
-  } catch {
-    return [];
-  }
-}
-
-/** @type {import('tailwindcss').Config} */
-module.exports = {
-  content: ["./index.html", "./src/**/*.{js,ts,jsx,tsx}", ...resolveOpenXiangdaContent()],
-  blocklist: ["[-:T]", "[-:TZ.]"],
-  presets: [openxiangdaPreset],
-  theme: {
-    extend: {
-      colors: {
-        graphite: "#1f2937",
-      },
-      borderRadius: {
-        sm: "0.125rem",
-        md: "0.375rem",
-        lg: "0.5rem",
-      },
-    },
-  },
-  corePlugins: {
-    preflight: true,
-  },
-  plugins: [],
-};

package/templates/openxiangda-react-spa/tsconfig.app.json

@@ -1,36 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "useDefineForClassFields": true,
-    "lib": ["ES2022", "DOM", "DOM.Iterable"],
-    "allowJs": false,
-    "skipLibCheck": true,
-    "esModuleInterop": true,
-    "allowSyntheticDefaultImports": true,
-    "strict": true,
-    "forceConsistentCasingInFileNames": true,
-    "module": "ESNext",
-    "moduleResolution": "Bundler",
-    "resolveJsonModule": true,
-    "isolatedModules": true,
-    "noEmit": true,
-    "jsx": "react-jsx",
-    "baseUrl": ".",
-    "paths": {
-      "@/*": ["src/*"],
-      "openxiangda": [
-        "../../packages/sdk/src/components/index.ts",
-        "node_modules/openxiangda"
-      ],
-      "openxiangda/runtime": [
-        "../../packages/sdk/src/runtime/index.ts",
-        "node_modules/openxiangda/runtime"
-      ],
-      "openxiangda/runtime/react": [
-        "../../packages/sdk/src/runtime/react/index.ts",
-        "node_modules/openxiangda/runtime/react"
-      ]
-    }
-  },
-  "include": ["src", "vite.config.ts"]
-}

package/templates/openxiangda-react-spa/tsconfig.js-code-nodes.json

@@ -1,19 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "ESNext",
-    "moduleResolution": "Bundler",
-    "strict": true,
-    "skipLibCheck": true,
-    "types": ["node"],
-    "baseUrl": ".",
-    "paths": {
-      "@/*": ["src/*"]
-    }
-  },
-  "include": [
-    "src/js-code-nodes/**/*.ts",
-    "src/automations/**/*.ts",
-    "src/functions/**/*.ts"
-  ]
-}

package/templates/openxiangda-react-spa/tsconfig.json

@@ -1,7 +0,0 @@
-{
-  "files": [],
-  "references": [
-    { "path": "./tsconfig.app.json" },
-    { "path": "./tsconfig.node.json" }
-  ]
-}

package/templates/openxiangda-react-spa/tsconfig.node.json

@@ -1,10 +0,0 @@
-{
-  "compilerOptions": {
-    "composite": true,
-    "skipLibCheck": true,
-    "module": "ESNext",
-    "moduleResolution": "Bundler",
-    "allowSyntheticDefaultImports": true
-  },
-  "include": ["vite.config.ts"]
-}

package/templates/openxiangda-react-spa/vite.config.ts

@@ -1,209 +0,0 @@
-import react from "@vitejs/plugin-react";
-import { existsSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { defineConfig, loadEnv } from "vite";
-
-const resolveProxyTarget = (value?: string) => {
-  const normalized = String(value || "").trim();
-  if (!normalized) return "";
-  try {
-    return new URL(normalized).origin;
-  } catch {
-    return "";
-  }
-};
-
-const toPort = (value?: string) => {
-  const port = Number(value || 5174);
-  return Number.isFinite(port) && port > 0 ? port : 5174;
-};
-
-const localSdkRoot = fileURLToPath(
-  new URL("../../packages/sdk/src", import.meta.url),
-);
-const localSdkAliases = existsSync(localSdkRoot)
-  ? [
-      {
-        find: "openxiangda/runtime/react",
-        replacement: fileURLToPath(
-          new URL(
-            "../../packages/sdk/src/runtime/react/index.ts",
-            import.meta.url,
-          ),
-        ),
-      },
-      {
-        find: "openxiangda/runtime",
-        replacement: fileURLToPath(
-          new URL("../../packages/sdk/src/runtime/index.ts", import.meta.url),
-        ),
-      },
-      {
-        find: "openxiangda",
-        replacement: fileURLToPath(
-          new URL("../../packages/sdk/src/components/index.ts", import.meta.url),
-        ),
-      },
-    ]
-  : [];
-
-export default defineConfig(({ mode }) => {
-  const env = loadEnv(mode, process.cwd(), "");
-  const serviceTarget = resolveProxyTarget(
-    env.OPENXIANGDA_BASE_URL || env.APP_PLATFORM_URL,
-  );
-  const servicePrefix = env.APP_SERVICE_PREFIX || "/service";
-  const appType = env.OPENXIANGDA_APP_TYPE || env.APP_TYPE || "";
-  const buildId = env.OPENXIANGDA_BUILD_ID || "";
-  const runtimeAssetBase =
-    env.OPENXIANGDA_RUNTIME_ASSET_BASE ||
-    (appType && buildId
-      ? `${servicePrefix.replace(/\/+$/, "")}/openxiangda-api/v1/apps/${encodeURIComponent(appType)}/runtime/releases/by-build/${encodeURIComponent(buildId)}/files/`
-      : "/");
-
-  return {
-    base: runtimeAssetBase,
-    define: {
-      "process.env.OPENXIANGDA_APP_TYPE": JSON.stringify(appType),
-      "process.env.APP_TYPE": JSON.stringify(appType),
-      "process.env.OPENXIANGDA_BASE_URL": JSON.stringify(
-        env.OPENXIANGDA_BASE_URL || env.APP_PLATFORM_URL || "",
-      ),
-      "process.env.APP_SERVICE_PREFIX": JSON.stringify(servicePrefix),
-    },
-    plugins: [react()],
-    resolve: {
-      alias: [
-        ...localSdkAliases,
-        {
-          find: "@",
-          replacement: fileURLToPath(new URL("./src", import.meta.url)),
-        },
-      ],
-      dedupe: ["react", "react-dom"],
-    },
-    build: {
-      rollupOptions: {
-        output: {
-          manualChunks(id) {
-            if (!id.includes("/node_modules/")) return undefined;
-            const openXiangdaChunk = getOpenXiangdaChunk(id);
-            if (openXiangdaChunk) return openXiangdaChunk;
-            const packageName = getPackageName(id);
-            if (!packageName) return undefined;
-            if (reactPackages.has(packageName)) return "vendor-react";
-            if (
-              packageName === "antd" ||
-              packageName.startsWith("@ant-design/") ||
-              packageName.startsWith("rc-") ||
-              packageName.startsWith("@rc-component/")
-            ) {
-              return "vendor-antd";
-            }
-            if (packageName === "echarts" || packageName === "echarts-for-react") return "vendor-echarts";
-            if (packageName === "zrender") return "vendor-zrender";
-            if (tiptapPackages.has(packageName) || packageName.startsWith("prosemirror-")) return "vendor-editor";
-            if (visualPackages.has(packageName)) return "vendor-visual";
-            return undefined;
-          },
-        },
-      },
-    },
-    server: {
-      host: env.OPENXIANGDA_DEV_HOST || "127.0.0.1",
-      port: toPort(env.OPENXIANGDA_DEV_PORT),
-      proxy: serviceTarget
-        ? {
-            [servicePrefix]: {
-              target: serviceTarget,
-              changeOrigin: true,
-              secure: false,
-              cookieDomainRewrite: "",
-              cookiePathRewrite: "/",
-              headers: {
-                "x-openxiangda-dev-proxy": "1",
-              },
-            },
-          }
-        : undefined,
-    },
-  };
-});
-
-function getPackageName(id: string) {
-  const marker = "/node_modules/";
-  const index = id.lastIndexOf(marker);
-  if (index === -1) return "";
-  const path = id.slice(index + marker.length);
-  if (path.startsWith(".pnpm/")) {
-    const [, packagePart] = path.split("/node_modules/");
-    return packagePart ? normalizePackageName(packagePart) : "";
-  }
-  return normalizePackageName(path);
-}
-
-function normalizePackageName(path: string) {
-  const parts = path.split("/");
-  if (!parts[0]) return "";
-  if (parts[0].startsWith("@")) return `${parts[0]}/${parts[1] || ""}`;
-  return parts[0];
-}
-
-function getOpenXiangdaChunk(id: string) {
-  if (!id.includes("/node_modules/openxiangda/")) return "";
-  if (id.includes("/packages/sdk/dist/runtime/react.")) return "vendor-openxiangda-runtime-react";
-  if (id.includes("/packages/sdk/dist/runtime/index.")) return "vendor-openxiangda-runtime";
-  if (id.includes("/packages/sdk/dist/components/index.")) return "vendor-openxiangda-components";
-  return "vendor-openxiangda";
-}
-
-const reactPackages = new Set([
-  "react",
-  "react-dom",
-  "react-is",
-  "react-router",
-  "react-router-dom",
-  "scheduler",
-  "use-sync-external-store",
-]);
-
-const tiptapPackages = new Set([
-  "@tiptap/core",
-  "@tiptap/extension-blockquote",
-  "@tiptap/extension-bold",
-  "@tiptap/extension-bullet-list",
-  "@tiptap/extension-code",
-  "@tiptap/extension-code-block",
-  "@tiptap/extension-document",
-  "@tiptap/extension-dropcursor",
-  "@tiptap/extension-gapcursor",
-  "@tiptap/extension-hard-break",
-  "@tiptap/extension-heading",
-  "@tiptap/extension-history",
-  "@tiptap/extension-horizontal-rule",
-  "@tiptap/extension-image",
-  "@tiptap/extension-italic",
-  "@tiptap/extension-link",
-  "@tiptap/extension-list-item",
-  "@tiptap/extension-ordered-list",
-  "@tiptap/extension-paragraph",
-  "@tiptap/extension-placeholder",
-  "@tiptap/extension-strike",
-  "@tiptap/extension-table",
-  "@tiptap/extension-table-cell",
-  "@tiptap/extension-table-header",
-  "@tiptap/extension-table-row",
-  "@tiptap/extension-task-item",
-  "@tiptap/extension-task-list",
-  "@tiptap/extension-text",
-  "@tiptap/extension-underline",
-  "@tiptap/extensions",
-  "@tiptap/pm",
-  "@tiptap/react",
-  "@tiptap/starter-kit",
-]);
-
-const visualPackages = new Set([
-  "framer-motion",
-  "lucide-react",
-]);

package/templates/sy-lowcode-app-workspace/.cursor/rules/openxiangda-form.mdc

@@ -1,24 +0,0 @@
----
-description: src/forms/** — Use openxiangda-form skill
-globs: src/forms/**/*
-alwaysApply: false
----
-
-# OpenXiangda Form Files
-
-Editing files under `src/forms/<formCode>/`. Use the **`openxiangda-form`** skill.
-
-Structure: `schema.ts`（`defineFormSchema()` default export — fields / options / rules / top-level FormEffect[]）+ `page.tsx`（presentation only）.
-
-Pitfalls:
-- 表单录入组件优先级：OpenXiangda 平台字段组件 → `antd` / `antd-mobile` wrapper → custom business component only when neither fits.
-- `schema.ts` defines fields and platform components; `page.tsx` is presentation-only and should render the OpenXiangda standard form/runtime instead of assembling raw controls.
-- `src/forms/**` must not contain raw native `<input>` / `<select>` / `<textarea>` / file input, hand-written pickers/uploaders, or hand-written user/department selectors.
-- 选项字段（Select/MultiSelect/Radio/Checkbox/Cascade）必须有 `options`。
-- 跨表数据 → `SelectField` + `optionSource.type: "linkedForm"`，禁止 `AssociationFormField`。
-- 顶层 `schema.rules` 仅 `FormEffect[]`（when/then），校验放字段 `rules`。
-- 平台系统字段（创建人/修改人/创建时间…）由平台维护，不要重复。
-- 派生 / 隐式权限键 → `behavior: "HIDDEN"` + `valueSync`。
-- Missing platform component capability → `openxiangda feedback submit --yes`, then use an `antd` / `antd-mobile` wrapper as temporary workaround and tell the user the fingerprint.
-
-Publish: `openxiangda workspace publish --profile <name> --form <formCode>`（先 `--dry-run`）。

package/templates/sy-lowcode-app-workspace/.cursor/rules/openxiangda-page.mdc

@@ -1,21 +0,0 @@
----
-description: src/pages/** — Use openxiangda-page skill
-globs: src/pages/**/*
-alwaysApply: false
----
-
-# OpenXiangda Page Files
-
-Editing files under `src/pages/<pageCode>/`. Use the **`openxiangda-page`** skill.
-
-Structure for complex pages: `page.config.ts` / `page.tsx` (thin) / `domain/` / `shared/{services,hooks}/` / `components/` / `styles.css`.
-
-Strong defaults:
-- 正式入口 (admin / portal) MUST be app-shell: `entry: { mode: "app-shell", hidePlatformNav: true, defaultRoute: "<home>" }`.
-- Default `cssIsolation: "none"` + native Tailwind utilities. Don't use `bg-card` / `text-muted-foreground` shadcn tokens.
-- List pages: use `DataManagementList` + pagination + structured `filterGroup`. Never `pageSize=10000` + browser-side filter.
-- Filters, search bars, modals, drawers, and inline edits: use OpenXiangda platform components for platform data fields; otherwise use `antd` / `antd-mobile`.
-- AI-authored `src/pages/**` must not contain raw native `<input>` / `<select>` / `<textarea>` / file input, hand-written pickers/uploaders, or hand-written user/department selectors.
-- External APIs: `src/resources/connectors/` + `sdk.connector.call()`. Joined read-only: `src/resources/data-views/` + `sdk.dataView.query()`. Notifications: `src/resources/notifications/` + `sdk.notification`.
-
-Publish: `openxiangda workspace publish --profile <name> --page <pageCode>` (first `--dry-run`).

package/templates/sy-lowcode-app-workspace/.cursor/rules/openxiangda-resources.mdc

@@ -1,40 +0,0 @@
----
-description: src/resources/** — Resource manifests, use logical codes only
-globs: src/resources/**/*
-alwaysApply: false
----
-
-# OpenXiangda Resource Manifests
-
-Editing engineering-managed manifests under `src/resources/`. **All platform IDs are resolved by the CLI**; only logical `code` values go here.
-
-| Path | Skill |
-|---|---|
-| `connectors/<code>.json` | `openxiangda-page` |
-| `data-views/<code>.json` | `openxiangda-form` |
-| `notifications/<code>.json` | `openxiangda-page` / `-workflow-automation` |
-| `workflows/<code>/` | `openxiangda-workflow-automation` |
-| `automations/<code>/` | `openxiangda-workflow-automation` |
-| `roles/<code>.json` | `openxiangda-permission-settings` |
-| `permissions/page-groups/<code>.json` | `openxiangda-permission-settings` |
-| `permissions/form-groups/<formCode>/<code>.json` | `openxiangda-permission-settings` |
-| `settings/forms/<formCode>.json` | `openxiangda-permission-settings` |
-| `menus/<code>.json` | `openxiangda-app` |
-
-See `references/resource-manifest-cheatsheet.md` for copy-paste skeletons.
-
-Commands: `openxiangda resource validate|plan|publish <type> --only <codes> --profile <name>`; use `--code <code>` for one resource and `pull` only for an intentional platform-to-local sync.
-
-`resource plan` and publish dry-runs are strictly GET/HEAD-only. On `READ_ONLY_AUTH_REQUIRED`, run `openxiangda auth refresh --profile <name>` or log in again before retrying; never refresh inside the plan.
-
-Exact `--only/--code` selectors apply before manifest/source analysis and JS_CODE build. Touch only selected targets plus transitive/shared/ambient dependencies; omit selectors only for intentional full-workspace work.
-
-App Function manifests may contain only logical names in top-level `secretRefs`; use `function_v2` / `trusted_node_v2`, resolve values with `ctx.secrets.get(name)`, and manage values only with `openxiangda secret ... --value-stdin --change ... --profile ...`. Values never belong in Git, `.env`, manifests, source, builds, plans, logs, or errors.
-
-When a Function/Automation enters scope only through source changes, publishing uses a server-side source-field PATCH and preserves online bindings, contracts, metadata, trigger/view configuration, and enabled/published state. A new source-free Automation with a complete `definitionJson.version="v3"` automatically uses manifest create; replacing an existing whole manifest requires `--replace-manifest --reason "..."`. Formal promotion freezes the clean publish HEAD separately from the change/remote baseline and preflights the whole set; `SOURCE_BASE_DIVERGED`, `RELEASE_SOURCE_BEHIND_MAIN`, and `RESOURCE_FIELD_CONFLICT` require reconciliation. After activation, merge/push the frozen SHA, verify `release integration-status`, then run normal `release end`.
-
-Before editing `roles`, `permissions/page-groups`, or `permissions/form-groups` for account/role/data-scope/RBAC/query-param authorization work, run `openxiangda design gates --topic permissions --json`, choose the permission mode, and write the permission matrix.
-
-If a `roles/<code>.json` role can create roles, assign members, grant API permissions, maintain permission groups, or manage organization accounts, it must declare `apiPermissionCodes`; a business role name alone does not grant backend API permission.
-
-Forbidden: 把 `formUuid` / `pageId` / `workflowId` 等平台 ID 写进 manifest；把 API key / token / secret / authorization 写进 manifest；data view 用作单表 CRUD / linkedForm / 写回 / 强实时；只靠 query 参数、前端隐藏按钮、硬编码角色、mock 权限或 `PermissionBoundary` 作为敏感授权；管理型角色缺少 `app:role:manage` / `app:page-permission-group:manage` / `app:form-permission-group:manage` / `app:organization:manage`；page 源里 hardcode 通知或 connector URL。

package/templates/sy-lowcode-app-workspace/.cursor/rules/openxiangda-workflow-automation.mdc

@@ -1,21 +0,0 @@
----
-description: src/{workflows,automations,js-code-nodes}/** — Use openxiangda-workflow-automation skill
-globs: src/{workflows,automations,js-code-nodes}/**/*
-alwaysApply: false
----
-
-# OpenXiangda Workflow / Automation / JS_CODE
-
-Editing one of:
-- `src/workflows/<code>/workflow.ts`        # 代码优先工作流
-- `src/automations/<code>/index.ts`         # automation_code_ts (推荐)
-- `src/js-code-nodes/<code>/index.ts`       # JS_CODE V2 trusted_node
-
-Use the **`openxiangda-workflow-automation`** skill.
-
-Boundary: **大多数业务流转不是 workflow**。`pending → processing → resolved → closed` 用表单 `status` 字段 + 状态机 + automation。仅有真审批语义（审批人 / 任务 / 同意/驳回 / 节点权限 / 流程记录）才创建 workflow。
-
-JS_CODE 适用：跨表查询、批量更新、终止流程、平台 API、外部 HTTP。**不适用**：UI 交互、普通校验、展示逻辑。
-
-Build: `pnpm build-js-code --script <code>`（先 `tsc` 再打包）。
-Publish: `openxiangda workflow|automation validate|create|publish --profile <name>`。

package/templates/sy-lowcode-app-workspace/.cursor/rules/openxiangda.mdc

@@ -1,81 +0,0 @@
----
-description: OpenXiangda workspace strong constraint — routing, commands, invariants, prohibitions
-alwaysApply: true
----
-
-# OpenXiangda Workspace Rule
-
-This is a `sy-lowcode-app-workspace` managed by the `openxiangda` CLI. See [AGENTS.md](mdc:AGENTS.md) for full guidance.
-
-## Hard route — user intent → skill / command
-
-| User says | Skill | Command |
-|---|---|---|
-| publish / deploy / 发布 / 上线 / 部署 | `openxiangda-core` | `openxiangda check --environment preproduction` → `openxiangda deploy preproduction` |
-| production promotion | `openxiangda-core` | `openxiangda deploy production --package <packageDigest>` |
-| failed delivery / retry | `openxiangda-core` | `openxiangda status <runId>` → `openxiangda retry <runId>` |
-| create / scaffold app / 创建应用 / 初始化 | `openxiangda-app` | `openxiangda workspace init <dir> --profile <name> --app-name "..."` |
-| bind existing app / 绑定已有应用 | `openxiangda-app` | `openxiangda workspace bind --profile <name> --app-type APP_XXX` |
-| edit form / schema / 表单字段 / 表单页 | `openxiangda-form` | edit `src/forms/<code>/` → `workspace publish --form <code>` |
-| edit code page / portal / dashboard / 代码页 | `openxiangda-page` | edit `src/pages/<code>/` → `workspace publish --page <code>` |
-| approval workflow / 审批流程 / JS_CODE | `openxiangda-workflow-automation` | `openxiangda workflow ...` |
-| automation / cron / 自动化 / 定时 | `openxiangda-workflow-automation` | `openxiangda automation ...` |
-| account / role / permission / data scope / query-param authorization | `openxiangda-permission-settings` | run `openxiangda design gates --topic permissions --json` first, then `openxiangda permission ...` / `openxiangda settings ...` |
-| diagnose / snapshot / 排查 / 报错 | `openxiangda-inspect` | `openxiangda app snapshot APP_XXX --profile <name> --json` |
-| login / token / switch profile | `openxiangda-core` | `openxiangda env --profile <name>` / `openxiangda auth status` |
-| external backend / third-party platform calls / AK/SK | `openxiangda-open-api` | `openxiangda open-api spec list --search <keyword> --json` |
-
-## Always
-
-- For `deliveryVersion: 2`, use only Delivery V2 commands. Runtime build IDs combine the Runtime layer and sealed package digests; retry may reuse only an exact same-package `uploaded` release whose content, source, and parent match. Immutable storage is never overwritten. Later V1 SDD/mainline/`--only`/candidate/ship text is compatibility guidance and must not be mixed into V2.
-- Treat V2 `check --json` as the authoritative exact delta and execution plan. Deletions and unsealed third-party build dependencies fail before writes; package execution uses only the CLI toolchain and never links workspace `node_modules`. `status`/`retry` auto-locate the environment, while retry fences the old attempt and replays only cross-machine local Form bindings.
-- Give every task an isolated worktree/branch and one development change; feature worktrees never publish. Merge approved commits to the remote default branch, create one `sdd bundle`, commit/push it, and publish once from synchronized clean main/master.
-- Close tasks from canonical main only. Review `openxiangda workspace cleanup`, then run `openxiangda workspace cleanup --apply` for that exact hashed `SAFE` plan; it revalidates managed worktrees under the owner lock, never picks up newly-safe entries, and never runs global `git worktree prune`. Review stale records separately.
-- L0 read-only/docs/tests need no SDD; L1 narrow reversible fixes record exact scope without a redundant second confirmation; schema, business Functions, Automation/Workflow, permissions, auth/public access, data writes, and runtime/config are L2/L3 full-SDD work. Live evidence/archive are post-release stages.
-- Very small copy/style/binding changes may use `openxiangda sdd quick <change> ...`; quick mode is limited to an exact low-risk scope and does not add a redundant proposal/approval loop when the user already requested that exact edit.
-- SDD is streamlined by default: approval and exact structured scope are hard gates, while unfinished task/evidence/spec prose only warns. Use `strictDocumentation: true` only when prose must block.
-- Source-triggered Function/Automation publishing uses server-side source-field PATCH by default and preserves online bindings, contracts, metadata, trigger/view configuration, and enabled/published state. A new source-free Automation with a complete `definitionJson.version="v3"` automatically uses manifest create; replacing an existing whole manifest requires exact `--only/--code` plus `--replace-manifest --reason "..."`.
-- A staged FormRelease for the same change may be rebound to a fresh baseline/session only after server verification of immutable/inactive/non-aborted state, identity/hash, frozen schema/formType, finalized resources, parent/base revision, and current Form head. `schemaSyncedAt` is not release evidence; never synthesize it, direct-publish the schema, or activate the Form early to bypass Workflow validation.
-- When Form settings and form permission groups ship together, stage them with one `resource publish form-setting,form-permission-group` command and exact qualified `form-setting:<code>` / `form-permission-group:<code>` selectors. SDD generation and validation share this contract and reject missing, extra, or split FormRelease scope.
-- Managed `release ship --replace-manifest --reason "..."` requires the pair, reason length >= 8, and exact Backend selectors; production confirmation repeats the exact preproduction pair, with no forwarding to Form/Workflow/Runtime/config/all stages.
-- After managed promotion, run `release integration-status --change <change> --profile <name> --check`; it recovers lineage from private `ship.json` or its referenced production/preproduction deployment execution journal, and names the missing file or field when recovery is impossible.
-- Before platform writes, run `release begin` only from clean main/master exactly equal to the authoritative remote tip. Feature branches and unpushed mainline commits fail before writes. A clone primary may be canonicalized to the frozen repository ID only when that ID is already in `repoAliases`; otherwise release prepare fails closed. After activation, run `integration-status` and `release end`; no post-release merge is needed.
-- Environment-managed workspaces never publish directly. Use `release ship`: normally stop after preproduction and confirm later; for an explicitly authorized emergency, put `--confirm-production` on the first invocation to run both ordered phases. The candidate seals bindings and target-specific Runtime artifacts, deployments do not rebuild, and each server deployment must close as `succeeded`. Keep app/resource/data IDs isolated.
-- Record a failed preproduction UAT with `release fail --deployment <id> --message "..." [--code <code>] [--details-json <JSON|file>] --environment preproduction`; the CLI verifies target ownership before the audited write and rejects production or mismatched deployments.
-- Change one target's side-effect policy only with `environment policy update <preproduction|production> --side-effect-policy-json <JSON|file> --reason "..."`: run `--dry-run` first, add `--confirm-production` for production, and never use `environment swap` for this. Patch mode validates only supplied fields and preserves unrecognized historical fields; `--full-replace` validates the supplied complete target and intentionally removes omissions. `organizationWrites=explicit_capability_only` removes the environment deny but still requires `app:organization:manage`. Keep release hard gates to explicit scope/profile/target, authorization, clean pushed mainline, immutable identity, CAS/lease, and production confirmation; prose and human acceptance notes are advisory unless strict mode is configured.
-- Routine edits should plan and publish exact change targets: `workspace plan --profile <name> --change <change> --changed`, then `workspace publish --profile <name> --change <change> --only pages/a,forms/b --dry-run`.
-- Account/role/permission/RBAC/organization-account/query-param authorization work must choose a mode first: `managed-platform-account`, `existing-platform-user-assignment`, `static-role-permission`, or `query-param-context`, then write the permission matrix.
-- Roles that create roles, assign members, grant API permissions, maintain permission groups, or manage organization accounts must declare `apiPermissionCodes` in `src/resources/roles/<code>.json`, such as `app:role:manage`, `app:page-permission-group:manage`, `app:form-permission-group:manage`, and `app:organization:manage`.
-- Confirm current profile before any write: `openxiangda env --profile <name>`.
-- `.openxiangda/state.json` is the authoritative durable profile → appType → resource-ID map; volatile release/deployment progress stays in the private `.openxiangda/releases/` journal. CLI maintains both; do not hand-edit.
-- In a managed workspace with multiple targets, pass `--environment <target>` to `function invoke` and verify the resolved target printed on stderr.
-- User tokens live in `~/.openxiangda/profiles.json`; shared env in `~/.openxiangda/.env`.
-- Form fields need user-facing `placeholder`; use `SelectField` / `RadioField` for enums, `linkedForm` SelectField for cross-form sources.
-- Form-entry component priority: OpenXiangda platform components → `antd` / `antd-mobile` wrappers → custom business component only when neither fits.
-- Proactively run `openxiangda feedback submit --yes` for platform defects, missing capabilities, unclear rules, repeated workarounds, AI uncertainty, and user-visible UX gaps; tell the user what was reported and the fingerprint.
-- Pages default to `cssIsolation: "none"` + native Tailwind utilities; formal entries must be app-shell.
-
-## Never
-
-- ❌ `pnpm publish:all` / `pnpm publish:oss` / `pnpm register` / `lowcode-workspace publish-*` directly. They are guarded by `_guard:publish` and will fail-fast without `OPENXIANGDA_PROFILE`.
-- ❌ Ask the user to paste AK / SK / appKey / appSecret into chat; use authorized `open-api credential` secure handoff for external backends.
-- ❌ Search the platform for similar app names when `.openxiangda/state.json` has no binding.
-- ❌ Copy `formUuid` / `pageId` / `workflowId` / `automationId` across profiles.
-- ❌ Run `release publish` against a registered preproduction/production target or promote without valid preproduction evidence.
-- ❌ Run a full publish for a single-file edit.
-- ❌ Hot-patch a temporary release copy or include another task's dirty files in a release.
-- ❌ Frontend-only button hiding, query-param checks, hardcoded roles, mock permissions, fake account IDs, or `PermissionBoundary` alone as real authorization.
-- ❌ Business admin roles without `app:role:manage` or required role-setting API permissions when they are expected to manage roles or members.
-- ❌ Direct platform account/department writes that bypass `sdk.organization` / `ctx.organization`.
-- ❌ Use `openxiangda form create` / `form publish` / `page publish` as the normal page generation path.
-- ❌ Store tokens / AK / SK / third-party secrets in project files.
-- ❌ `npm publish` — this workspace is `"private": true`, not an npm package.
-- ❌ Raw native form controls in AI-authored `src/forms/**` / `src/pages/**`: `<input>`, `<select>`, `<textarea>`, file input, hand-written pickers/uploaders, hand-written user/department selectors.
-
-## When unsure
-
-Read [AGENTS.md](mdc:AGENTS.md) and the global skill: `~/.qoder/skills/openxiangda/SKILL.md`.
-
-## Parallel candidates
-
-A candidate may cross unrelated later mainline commits only when its commit remains an ancestor of clean pushed mainline and all sealed input hashes remain unchanged. The later HEAD is only a safety gate; Backend, Runtime, and Root keep the candidate sourceRevision. Each target allows one running or evidence-pending deployment; wait for the lease/slot, and keep emergency fixes on the narrow candidate → preproduction → production path.