openxiangda 2.0.0-alpha.21 → 2.0.0-alpha.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "2.0.0-alpha.21",
+  "version": "2.0.0-alpha.23",
   "description": "Unified OpenXiangda 2.0 CLI, SDK, React runtime, NestJS integration and AI skill distribution.",
   "type": "module",
   "main": "./dist/index.js",
@@ -49,12 +49,12 @@
   "dependencies": {
     "dayjs": "1.11.18",
     "docx-preview": "0.3.7",
-    "openxiangda-cli": "2.0.0-alpha.108",
-    "openxiangda-contracts": "2.0.0-alpha.50",
-    "openxiangda-devkit-core": "2.0.0-alpha.67",
-    "openxiangda-mcp": "2.0.0-alpha.67",
-    "openxiangda-nest": "2.0.0-alpha.61",
-    "openxiangda-skill-kit": "2.0.0-alpha.85",
+    "openxiangda-cli": "2.0.0-alpha.110",
+    "openxiangda-contracts": "2.0.0-alpha.52",
+    "openxiangda-devkit-core": "2.0.0-alpha.69",
+    "openxiangda-mcp": "2.0.0-alpha.69",
+    "openxiangda-nest": "2.0.0-alpha.63",
+    "openxiangda-skill-kit": "2.0.0-alpha.87",
     "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz"
   },
   "peerDependencies": {

package/skills/manifest.json

@@ -4,7 +4,7 @@
     {
       "name": "openxiangda-v2",
       "description": "Use when researching, designing, building, testing, or delivering a complete OpenXiangda 2.0 application.",
-      "sha256": "4e79de2626b4fe8ec1049cba8354db8447b2d93160957237df8ba6a3d547bc93"
+      "sha256": "0d7a537bb7af5b79bc9e9b78de2a078cfc39201d65cecffd78231086cfa2bf55"
     }
   ]
 }

package/skills/openxiangda-v2/SKILL.md

@@ -10,14 +10,14 @@ Treat requirement discovery, architecture, authorization, development, testing a
 Before a workspace exists, use this Skill's exact npm version:
 
 ```bash
-pnpm dlx openxiangda@2.0.0-alpha.21 login --base-url <platform>
-pnpm dlx openxiangda@2.0.0-alpha.21 create <directory>
+pnpm dlx openxiangda@2.0.0-alpha.23 login --base-url <platform>
+pnpm dlx openxiangda@2.0.0-alpha.23 create <directory>
 ```
 
 Inside an application, use only its locked executable through `pnpm openxiangda`. Never invoke a bare global `openxiangda`, because that executable may belong to stable 1.x. Moving tags such as `latest` and `alpha` are forbidden. To install or refresh this same Skill from the package, run:
 
 ```bash
-pnpm dlx openxiangda@2.0.0-alpha.21 skill install --force
+pnpm dlx openxiangda@2.0.0-alpha.23 skill install --force
 ```
 
 Use this order:

package/skills/openxiangda-v2/references/backend.md

@@ -157,6 +157,9 @@ contract:
 
 - every guard has a stable `OPENXIANGDA_*` `errorCode`;
 - `query-empty` protects a business-key uniqueness rule;
+- `record-exists` requires one visible record without forcing a mutation of it;
+- `record-match` requires one visible record plus typed value/field assertions,
+  and may protect a mutation of another resource;
 - `record-assert` locks one exact record and checks declared field values or
   declared field-to-field comparisons;
 - `increment` targets one declared integer field and must have a matching

package/skills/openxiangda-v2/references/data-authz.md

@@ -124,4 +124,50 @@ resource `dataPolicyCode` to the same code. Do not invent `operator`, `value`,
 policy-level `roleCodes`. The compiler and platform know that `user.*` fields
 compare their stable `value`; `field` remains the declared field root code.
 
+When a business membership resource is the durable source of a package role or
+RelationshipGrant, declare the projection instead of calling authorization
+management endpoints from application code:
+
+```ts
+authz: {
+  // ...capabilities, roles and policies...
+  roleMembershipSources: [{
+    code: 'venue-managers',
+    name: '场馆管理员角色成员',
+    resourceCode: 'venue-manager-relations',
+    userIdField: 'manager.value',
+    roleCode: 'venue_admin',
+    enabledField: 'enabled',
+    failureMode: 'strict',
+  }],
+  relationshipGrantSources: [{
+    code: 'venue-member-grants',
+    name: '场馆成员关系授权',
+    resourceCode: 'venue-manager-relations',
+    subject: { type: 'user', userIdField: 'manager.value' },
+    relationCode: 'member',
+    targetResourceCode: 'venues',
+    resourceIdField: 'venue.value',
+    operations: ['read', 'update'],
+    enabledField: 'enabled',
+    failureMode: 'strict',
+  }],
+}
+```
+
+The user path must be `user.single.value`; the target path is `id` only when the
+source resource is also the target resource, or a `resource-ref.single.value`
+that points at the declared target resource.
+Operations are a bounded constant list. Create/update/delete the relationship
+resource through the standard Data API; the platform converges and revokes only
+the facts owned by that source. Projection failure is always strict because a
+last-known-good grant could defeat revocation.
+
+Use the SDK projection health call after deployment. A platform operator with
+the existing authorization-management capability may run rebuild for historical
+rows or recover a dead-letter job. Rebuild/recovery are idempotent and accept an
+`operationId`; they never accept a user token, user id override or impersonation
+input. Do not write `sourceCode`, canonical membership rows or relationship
+grant rows yourself.
+
 Run `pnpm openxiangda check` after every declaration or permission change.