openxiangda 2.0.0-alpha.24 → 2.0.0-alpha.26

package/dist/config.d.ts

@@ -1,2 +1,2 @@
-export { defineOpenXiangdaApp, composeAppOperationSchemas, composeJsonSchema, currentUserDataPolicy, resourceRecordSchema, resourceCapabilityCodes, schemaRef, type AppDataFieldAccessDeclaration, type AppDataFieldDeclaration, type AppDataResourceDeclaration, type OpenXiangdaAppConfig, type OpenXiangdaAppDeclaration, type AppOperationSchemasInput, type JsonSchemaDefinitions, type ResourceRecordSchemaOptions, } from 'openxiangda-devkit-core';
+export { defineOpenXiangdaApp, composeAppOperationSchemas, composeJsonSchema, currentUserDataPolicy, dataPolicyExpression, resourceRecordSchema, resourceReadPolicy, resourceCapabilityCodes, schemaRef, type AppDataFieldAccessDeclaration, type AppDataFieldDeclaration, type AppDataResourceDeclaration, type OpenXiangdaAppConfig, type OpenXiangdaAppDeclaration, type AppOperationSchemasInput, type JsonSchemaDefinitions, type ResourceRecordSchemaOptions, } from 'openxiangda-devkit-core';
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,SAAS,EACT,KAAK,6BAA6B,EAClC,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,GACjC,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,SAAS,EACT,KAAK,6BAA6B,EAClC,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,GACjC,MAAM,yBAAyB,CAAC"}

package/dist/config.js

@@ -1,2 +1,2 @@
-export { defineOpenXiangdaApp, composeAppOperationSchemas, composeJsonSchema, currentUserDataPolicy, resourceRecordSchema, resourceCapabilityCodes, schemaRef, } from 'openxiangda-devkit-core';
+export { defineOpenXiangdaApp, composeAppOperationSchemas, composeJsonSchema, currentUserDataPolicy, dataPolicyExpression, resourceRecordSchema, resourceReadPolicy, resourceCapabilityCodes, schemaRef, } from 'openxiangda-devkit-core';
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,SAAS,GASV,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,SAAS,GASV,MAAM,yBAAyB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "2.0.0-alpha.24",
+  "version": "2.0.0-alpha.26",
   "description": "Unified OpenXiangda 2.0 CLI, SDK, React runtime, NestJS integration and AI skill distribution.",
   "type": "module",
   "main": "./dist/index.js",
@@ -49,12 +49,12 @@
   "dependencies": {
     "dayjs": "1.11.18",
     "docx-preview": "0.3.7",
-    "openxiangda-cli": "2.0.0-alpha.111",
-    "openxiangda-contracts": "2.0.0-alpha.53",
-    "openxiangda-devkit-core": "2.0.0-alpha.70",
-    "openxiangda-mcp": "2.0.0-alpha.70",
-    "openxiangda-nest": "2.0.0-alpha.64",
-    "openxiangda-skill-kit": "2.0.0-alpha.88",
+    "openxiangda-cli": "2.0.0-alpha.113",
+    "openxiangda-contracts": "2.0.0-alpha.54",
+    "openxiangda-devkit-core": "2.0.0-alpha.71",
+    "openxiangda-mcp": "2.0.0-alpha.71",
+    "openxiangda-nest": "2.0.0-alpha.65",
+    "openxiangda-skill-kit": "2.0.0-alpha.89",
     "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz"
   },
   "peerDependencies": {

package/skills/manifest.json

@@ -4,7 +4,7 @@
     {
       "name": "openxiangda-v2",
       "description": "Use when researching, designing, building, testing, or delivering a complete OpenXiangda 2.0 application.",
-      "sha256": "928646b9ded6fd61a73f3bd909d163d35b9735313e7bff40dc8490fbbdc32e1f"
+      "sha256": "08bd64cb7f0dee4889fd34e9081b3b01dcafa714273c51bae57ee9e22ccfcf9e"
     }
   ]
 }

package/skills/openxiangda-v2/SKILL.md

@@ -10,14 +10,14 @@ Treat requirement discovery, architecture, authorization, development, testing a
 Before a workspace exists, use this Skill's exact npm version:
 
 ```bash
-pnpm dlx openxiangda@2.0.0-alpha.24 login --base-url <platform>
-pnpm dlx openxiangda@2.0.0-alpha.24 create <directory>
+pnpm dlx openxiangda@2.0.0-alpha.26 login --base-url <platform>
+pnpm dlx openxiangda@2.0.0-alpha.26 create <directory>
 ```
 
 Inside an application, use only its locked executable through `pnpm openxiangda`. Never invoke a bare global `openxiangda`, because that executable may belong to stable 1.x. Moving tags such as `latest` and `alpha` are forbidden. To install or refresh this same Skill from the package, run:
 
 ```bash
-pnpm dlx openxiangda@2.0.0-alpha.24 skill install --force
+pnpm dlx openxiangda@2.0.0-alpha.26 skill install --force
 ```
 
 Use this order:

package/skills/openxiangda-v2/references/data-authz.md

@@ -8,8 +8,10 @@ source. Do not create `platform/data` modules.
 ```ts
 import {
   currentUserDataPolicy,
+  dataPolicyExpression,
   defineOpenXiangdaApp,
   resourceCapabilityCodes,
+  resourceReadPolicy,
 } from 'openxiangda/config';
 
 const APP_CODE = 'visitor-center';
@@ -119,10 +121,50 @@ currentUserDataPolicy({
 ```
 
 Put that value in `authz.dataPolicies`, declare both roles, and set the
-resource `dataPolicyCode` to the same code. Do not invent `operator`, `value`,
-`current_user: true`, lowercase match modes, a dotted value path, or
-policy-level `roleCodes`. The compiler and platform know that `user.*` fields
-compare their stable `value`; `field` remains the declared field root code.
+resource `dataPolicyCode` to the same code. Do not invent `current_user: true`,
+lowercase match modes, a dotted value path, or policy-level `roleCodes`. The
+compiler and platform know that `user.*` fields compare their stable `value`;
+`field` remains the declared field root code.
+
+For portal visibility windows, use the typed SDK expression and keep it a
+server-enforced read policy:
+
+```ts
+resourceReadPolicy({
+  code: 'published-articles',
+  name: '仅查看当前已发布内容',
+  resourceCode: 'articles',
+  matchMode: 'AND',
+  rules: [{ dimensionCode: 'organization', field: 'organizationId' }],
+  expression: dataPolicyExpression.allOf(
+    dataPolicyExpression.constant({
+      field: 'status', operator: 'eq', value: 'PUBLISHED',
+    }),
+    dataPolicyExpression.databaseNow({
+      field: 'publishAt', operator: 'lte',
+    }),
+    dataPolicyExpression.anyOf(
+      dataPolicyExpression.null({ field: 'expireAt', operator: 'is_null' }),
+      dataPolicyExpression.databaseNow({ field: 'expireAt', operator: 'gt' }),
+    ),
+  ),
+})
+```
+
+`db_now` is platform-owned PostgreSQL statement time and only accepts a
+`datetime` field. Missing/null values match only `is_null`; they do not match
+negative constants or time comparisons. The same bounded expression can
+combine `currentUser`, `dimension`, `relation`, `constant`, `null`, and
+`databaseNow` leaves under `allOf`/`anyOf`. Never duplicate this expression in
+a page `where` filter and call it authorization: UI filters are optional
+display state and cannot weaken or replace Native RLS.
+
+`readExpression` is always added on top of the base `matchMode`/`rules`; those
+base rules continue to restrict create/update/delete. If writes truly need no
+row scope beyond capability checks, say so explicitly with
+`writeBoundary: 'capability_only'` instead of `matchMode`/`rules`. Never use an
+empty base implicitly: `check` rejects it so an AI cannot accidentally remove
+write authorization while adding a portal read window.
 
 When a business membership resource is the durable source of a package role or
 RelationshipGrant, declare the projection instead of calling authorization