openxiangda 2.0.0-alpha.23 → 2.0.0-alpha.26

package/dist/config.d.ts

@@ -1,2 +1,2 @@
-export { defineOpenXiangdaApp, composeAppOperationSchemas, composeJsonSchema, currentUserDataPolicy, resourceRecordSchema, resourceCapabilityCodes, schemaRef, type AppDataFieldAccessDeclaration, type AppDataFieldDeclaration, type AppDataResourceDeclaration, type OpenXiangdaAppConfig, type OpenXiangdaAppDeclaration, type AppOperationSchemasInput, type JsonSchemaDefinitions, type ResourceRecordSchemaOptions, } from 'openxiangda-devkit-core';
+export { defineOpenXiangdaApp, composeAppOperationSchemas, composeJsonSchema, currentUserDataPolicy, dataPolicyExpression, resourceRecordSchema, resourceReadPolicy, resourceCapabilityCodes, schemaRef, type AppDataFieldAccessDeclaration, type AppDataFieldDeclaration, type AppDataResourceDeclaration, type OpenXiangdaAppConfig, type OpenXiangdaAppDeclaration, type AppOperationSchemasInput, type JsonSchemaDefinitions, type ResourceRecordSchemaOptions, } from 'openxiangda-devkit-core';
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,SAAS,EACT,KAAK,6BAA6B,EAClC,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,GACjC,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,SAAS,EACT,KAAK,6BAA6B,EAClC,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,GACjC,MAAM,yBAAyB,CAAC"}

package/dist/config.js

@@ -1,2 +1,2 @@
-export { defineOpenXiangdaApp, composeAppOperationSchemas, composeJsonSchema, currentUserDataPolicy, resourceRecordSchema, resourceCapabilityCodes, schemaRef, } from 'openxiangda-devkit-core';
+export { defineOpenXiangdaApp, composeAppOperationSchemas, composeJsonSchema, currentUserDataPolicy, dataPolicyExpression, resourceRecordSchema, resourceReadPolicy, resourceCapabilityCodes, schemaRef, } from 'openxiangda-devkit-core';
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,SAAS,GASV,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,SAAS,GASV,MAAM,yBAAyB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "2.0.0-alpha.23",
+  "version": "2.0.0-alpha.26",
   "description": "Unified OpenXiangda 2.0 CLI, SDK, React runtime, NestJS integration and AI skill distribution.",
   "type": "module",
   "main": "./dist/index.js",
@@ -49,12 +49,12 @@
   "dependencies": {
     "dayjs": "1.11.18",
     "docx-preview": "0.3.7",
-    "openxiangda-cli": "2.0.0-alpha.110",
-    "openxiangda-contracts": "2.0.0-alpha.52",
-    "openxiangda-devkit-core": "2.0.0-alpha.69",
-    "openxiangda-mcp": "2.0.0-alpha.69",
-    "openxiangda-nest": "2.0.0-alpha.63",
-    "openxiangda-skill-kit": "2.0.0-alpha.87",
+    "openxiangda-cli": "2.0.0-alpha.113",
+    "openxiangda-contracts": "2.0.0-alpha.54",
+    "openxiangda-devkit-core": "2.0.0-alpha.71",
+    "openxiangda-mcp": "2.0.0-alpha.71",
+    "openxiangda-nest": "2.0.0-alpha.65",
+    "openxiangda-skill-kit": "2.0.0-alpha.89",
     "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz"
   },
   "peerDependencies": {

package/skills/manifest.json

@@ -4,7 +4,7 @@
     {
       "name": "openxiangda-v2",
       "description": "Use when researching, designing, building, testing, or delivering a complete OpenXiangda 2.0 application.",
-      "sha256": "0d7a537bb7af5b79bc9e9b78de2a078cfc39201d65cecffd78231086cfa2bf55"
+      "sha256": "08bd64cb7f0dee4889fd34e9081b3b01dcafa714273c51bae57ee9e22ccfcf9e"
     }
   ]
 }

package/skills/openxiangda-v2/SKILL.md

@@ -10,14 +10,14 @@ Treat requirement discovery, architecture, authorization, development, testing a
 Before a workspace exists, use this Skill's exact npm version:
 
 ```bash
-pnpm dlx openxiangda@2.0.0-alpha.23 login --base-url <platform>
-pnpm dlx openxiangda@2.0.0-alpha.23 create <directory>
+pnpm dlx openxiangda@2.0.0-alpha.26 login --base-url <platform>
+pnpm dlx openxiangda@2.0.0-alpha.26 create <directory>
 ```
 
 Inside an application, use only its locked executable through `pnpm openxiangda`. Never invoke a bare global `openxiangda`, because that executable may belong to stable 1.x. Moving tags such as `latest` and `alpha` are forbidden. To install or refresh this same Skill from the package, run:
 
 ```bash
-pnpm dlx openxiangda@2.0.0-alpha.23 skill install --force
+pnpm dlx openxiangda@2.0.0-alpha.26 skill install --force
 ```
 
 Use this order:
@@ -29,7 +29,7 @@ Use this order:
 5. For every resource or permission change, read [Data and authorization](references/data-authz.md) before editing `openxiangda.config.ts`.
 6. Read [Frontend](references/frontend.md) for pages or fields and [Backend actions](references/backend.md) only for a real business action.
 7. When the application explicitly enables standard approval, application events or notifications, read [Workflow, Events and Notification Hub](references/workflow-events.md). Keep them optional and out of ordinary CRUD.
-8. Run the connected loop with `pnpm openxiangda dev`, then follow [Testing](references/testing.md) and `pnpm openxiangda check`.
+8. Run the connected loop with `pnpm openxiangda dev`, then follow [Testing](references/testing.md) and `pnpm openxiangda check`; check performs the target platform's read-only Native compatibility preflight before application checks or builds.
 9. Follow [Delivery](references/delivery.md): deploy preproduction first, inspect status/logs, then promote the exact successful version to production.
 
 For an AI-native client, start the workspace protocol through the same pinned executable:

package/skills/openxiangda-v2/references/commands.md

@@ -6,7 +6,7 @@
 | --- | --- | --- |
 | `pnpm openxiangda create` | deploy | 创建、绑定并初始化应用 |
 | `pnpm openxiangda dev` | write-local | 连接平台测试数据启动本地 Web 与 Nest |
-| `pnpm openxiangda check` | write-local | 生成契约并执行检查、测试和构建 |
+| `pnpm openxiangda check` | write-local | 生成契约并在目标平台预检后执行检查、测试和构建 |
 | `pnpm openxiangda accept` | deploy | 按计划准备可选的真实预发验收身份 |
 | `pnpm openxiangda deploy` | deploy | 部署测试环境或显式复用测试版本部署生产 |
 | `pnpm openxiangda status` | read | 查询最近或指定部署状态 |

package/skills/openxiangda-v2/references/data-authz.md

@@ -8,8 +8,10 @@ source. Do not create `platform/data` modules.
 ```ts
 import {
   currentUserDataPolicy,
+  dataPolicyExpression,
   defineOpenXiangdaApp,
   resourceCapabilityCodes,
+  resourceReadPolicy,
 } from 'openxiangda/config';
 
 const APP_CODE = 'visitor-center';
@@ -119,10 +121,50 @@ currentUserDataPolicy({
 ```
 
 Put that value in `authz.dataPolicies`, declare both roles, and set the
-resource `dataPolicyCode` to the same code. Do not invent `operator`, `value`,
-`current_user: true`, lowercase match modes, a dotted value path, or
-policy-level `roleCodes`. The compiler and platform know that `user.*` fields
-compare their stable `value`; `field` remains the declared field root code.
+resource `dataPolicyCode` to the same code. Do not invent `current_user: true`,
+lowercase match modes, a dotted value path, or policy-level `roleCodes`. The
+compiler and platform know that `user.*` fields compare their stable `value`;
+`field` remains the declared field root code.
+
+For portal visibility windows, use the typed SDK expression and keep it a
+server-enforced read policy:
+
+```ts
+resourceReadPolicy({
+  code: 'published-articles',
+  name: '仅查看当前已发布内容',
+  resourceCode: 'articles',
+  matchMode: 'AND',
+  rules: [{ dimensionCode: 'organization', field: 'organizationId' }],
+  expression: dataPolicyExpression.allOf(
+    dataPolicyExpression.constant({
+      field: 'status', operator: 'eq', value: 'PUBLISHED',
+    }),
+    dataPolicyExpression.databaseNow({
+      field: 'publishAt', operator: 'lte',
+    }),
+    dataPolicyExpression.anyOf(
+      dataPolicyExpression.null({ field: 'expireAt', operator: 'is_null' }),
+      dataPolicyExpression.databaseNow({ field: 'expireAt', operator: 'gt' }),
+    ),
+  ),
+})
+```
+
+`db_now` is platform-owned PostgreSQL statement time and only accepts a
+`datetime` field. Missing/null values match only `is_null`; they do not match
+negative constants or time comparisons. The same bounded expression can
+combine `currentUser`, `dimension`, `relation`, `constant`, `null`, and
+`databaseNow` leaves under `allOf`/`anyOf`. Never duplicate this expression in
+a page `where` filter and call it authorization: UI filters are optional
+display state and cannot weaken or replace Native RLS.
+
+`readExpression` is always added on top of the base `matchMode`/`rules`; those
+base rules continue to restrict create/update/delete. If writes truly need no
+row scope beyond capability checks, say so explicitly with
+`writeBoundary: 'capability_only'` instead of `matchMode`/`rules`. Never use an
+empty base implicitly: `check` rejects it so an AI cannot accidentally remove
+write authorization while adding a portal read window.
 
 When a business membership resource is the durable source of a package role or
 RelationshipGrant, declare the projection instead of calling authorization

package/skills/openxiangda-v2/references/delivery.md

@@ -1,7 +1,22 @@
 # OpenXiangda 2.0 Delivery
 
-Run `pnpm openxiangda check --json`; it owns generation, static checks, tests
-and production builds but deliberately does not seal an AppPackage. Its
+Run `pnpm openxiangda check --json`; it defaults to the test target, compiles
+the complete configuration and contract bundles, and asks the target
+platform's advertised `configurationCompatibility` endpoint to run the same
+Native compiler validation used during deployment preparation. This read-only
+preflight happens before workspace checks, tests, builds, Buildx or uploads.
+Use `--environment production` only when explicitly checking that target. A
+failure preserves `pointer`, client contract/schema versions, platform
+version/capability and the required/supported application-contract tuples.
+The capability also publishes the existing 4 MiB configuration, 8 MiB
+contract and 10 MiB total request bounds so oversized input fails before the
+transport layer.
+Never remove generated fields, reduce versions, raise limits, add app-code
+exceptions or introduce 1.x compatibility to make it pass. The platform
+revalidates authoritatively during deployment preparation.
+
+After compatibility succeeds, check owns static checks, tests and production
+builds but deliberately does not seal an AppPackage. Its
 `data.sealedArtifact` object and `.openxiangda/build/seal-status.json` make that
 state explicit even when an older `app-package.json` remains on disk. Deploy to
 test with the returned `openxiangda deploy` next command. Deploy owns the

package/skills/openxiangda-v2/references/testing.md

@@ -1,8 +1,11 @@
 # Testing and Acceptance
 
 Run `pnpm openxiangda check --json` after declaration or code changes. It owns
-generation, static validation, unit tests and production builds; preserve its
-stable diagnostic instead of bypassing a failing stage. Read
+generation plus a read-only Native compatibility preflight against the test
+platform before static validation, unit tests or production builds. Use
+`--environment production` only for an explicit production-target check.
+Preserve the stable diagnostic and JSON pointer instead of bypassing a failing
+stage. Read
 `data.sealedArtifact` in the machine result. A successful check always reports
 `state: "check-did-not-seal"`, `sealed: false` and
 `usableForDeploy: false`; it may also describe an older package as
@@ -20,8 +23,11 @@ For each changed resource, verify the real chain:
 6. PostgreSQL/RLS remains authoritative, including current-user and multi-role-union cases.
 
 For platform generator changes, add a representative multi-resource fixture
-(currently nineteen standard resources), assert each Surface literal is emitted
-only once, then run the unchanged Web dist budget gate. A budget failure is a
+(the compatibility corpus fixes 43 resources, complete list/form/detail/mobile
+surfaces, Perspective/AuthZ/Workflow/Event and exactly 161 producers), assert
+the real toolchain generator output remains byte-identical, and pass the same
+fixture through the platform's exported Native validator. Then run the unchanged
+Web dist budget gate. A budget failure is a
 generator/runtime regression to fix; never raise the application budget or copy
 generated contracts into a smaller application-local format. Browser acceptance
 must also cover the large more-filters modal, declaration-order forms, hidden