openxiangda-cli 2.0.0-alpha.111 → 2.0.0-alpha.114

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda-cli",
-  "version": "2.0.0-alpha.111",
+  "version": "2.0.0-alpha.114",
   "description": "Thin application-level CLI for OpenXiangda 2.0.",
   "type": "module",
   "main": "./dist/index.js",
@@ -21,10 +21,10 @@
   ],
   "dependencies": {
     "@oclif/core": "4.13.3",
-    "openxiangda-contracts": "2.0.0-alpha.53",
-    "openxiangda-devkit-core": "2.0.0-alpha.70",
-    "openxiangda-mcp": "2.0.0-alpha.70",
-    "openxiangda-skill-kit": "2.0.0-alpha.88"
+    "openxiangda-contracts": "2.0.0-alpha.55",
+    "openxiangda-devkit-core": "2.0.0-alpha.72",
+    "openxiangda-mcp": "2.0.0-alpha.72",
+    "openxiangda-skill-kit": "2.0.0-alpha.90"
   },
   "devDependencies": {
     "tsx": "4.23.12",

package/template/AGENTS.md

@@ -8,7 +8,7 @@
 - Never write resource-level `schemaVersion`, `appCode`, `schema`, `surface`, `capabilities`, `fieldPolicies` or `platform/data` modules. The compiler derives the strict DataResource, CRUD capabilities, Surface and AI Schema. The application manifest still starts with its one top-level `schemaVersion: 3`.
 - Ordinary list/get/create/update/delete, filters, export and batch operations use the platform Native Data API. Do not create Function CRUD or NestJS wrappers.
 - Add NestJS only for a named business action that needs a cross-resource transaction, an invariant or an external side effect.
-- Every interactive business action binds `@OpenXiangdaOperation(operation)` and injects `OpenXiangdaBusinessDataApiService` or `OpenXiangdaStandardOperations`. The platform checks the action capability once at App API ingress; the trusted backend then has full Data access only to its exact application/environment while audit retains the initiating user. Do not author `authorizationJSON` or reapply the user's resource, row and field permissions inside the action.
+- Every interactive business action binds `@OpenXiangdaOperation(operation)` and injects `OpenXiangdaBusinessDataApiService`, `OpenXiangdaBusinessNotificationService`, or `OpenXiangdaStandardOperations`. The platform checks the action capability once at App API ingress; the trusted backend then has full Data/managed business-notification access only to its exact application/environment while audit retains the initiating user and action. Do not author `authorizationJSON`, forward user tokens, grant ordinary users `app:notification2:send`, or reapply the user's resource, row and field permissions inside the action.
 - A NestJS backend declares only `enabled`, `isolation: 'shared' | 'dedicated'` and `resourceProfile: 'light' | 'standard'`. Never put raw Kubernetes resources, replicas, ports or environment maps in application metadata; the platform owns capacity and scaling.
 - Use the current logged-in user and the union of that user's application roles. An optional declared Perspective projects only read visibility (pages, rows and fields); create/update/delete, workflows and custom actions continue to authorize against the complete union. Standard Data API calls inherit `X-OpenXiangda-Perspective` automatically. Use `@CurrentPerspective()` only when custom Nest code reads outside the standard Data API, and apply an equivalent read projection explicitly. Business code must not persist a platform Token or authorization result and must not implement a second identity path.
 - Fields inherit the resource read/create/update capabilities. Use field `access` only to tighten them; arrays are all-of and `false` is explicit deny. There is no `write` fallback.

package/template/apps/server/package.json

@@ -15,7 +15,7 @@
     "@nestjs/common": "11.1.29",
     "@nestjs/core": "11.1.29",
     "@nestjs/platform-fastify": "11.1.29",
-    "openxiangda": "2.0.0-alpha.24",
+    "openxiangda": "2.0.0-alpha.27",
     "reflect-metadata": "0.2.2",
     "rxjs": "7.8.2"
   },

package/template/apps/web/package.json

@@ -14,7 +14,7 @@
     "@ant-design/icons": "6.2.3",
     "@refinedev/core": "5.0.12",
     "antd": "6.4.3",
-    "openxiangda": "2.0.0-alpha.24",
+    "openxiangda": "2.0.0-alpha.27",
     "react": "19.2.8",
     "react-dom": "19.2.8",
     "react-router-dom": "7.8.2"

package/template/apps/web/playwright.config.ts

@@ -6,7 +6,10 @@ const baseURL =
 
 export default defineConfig({
   testDir: './e2e',
-  workers: 2,
+  // The development server owns one mutable dependency-optimizer generation.
+  // Serial browser entrypoints prevent a second HTML graph from invalidating
+  // an in-flight transformed module during release acceptance.
+  workers: 1,
   use: { baseURL, trace: 'retain-on-failure' },
   webServer: process.env.OPENXIANGDA_E2E_BASE_URL
     ? undefined

package/template/apps/web/test/contracts.test.ts

@@ -3,6 +3,7 @@ import { readFileSync, readdirSync } from 'node:fs';
 import test from 'node:test';
 import { readRuntimeMount, resolveApplicationBasename } from 'openxiangda/core';
 import {
+  notificationTemplateCodes,
   resourceCodes,
   resourceDefinitions,
 } from '../../../packages/contracts/src/generated.js';
@@ -21,6 +22,10 @@ test('clean template contains only application declarations and one React entry'
     .sort();
   assert.deepEqual(productionSources, ['main.tsx']);
   assert.deepEqual(Object.keys(resourceDefinitions).sort(), [...resourceCodes].sort());
+  assert.equal(
+    notificationTemplateCodes.applicationInformational,
+    'application.informational.standard'
+  );
   assert.match(config, /data:\s*\{\s*resources:/);
   assert.match(source, /OpenXiangdaApplication/);
   assert.match(source, /defineAdminContributions\(appRoutes/);
@@ -91,8 +96,12 @@ test('published E2E harnesses do not write evidence into the platform source rep
   assert.doesNotMatch(workflowSource, /docs\/architecture|evidenceDirectory/);
 });
 
-test('Vite prewarms every E2E HTML entry before concurrent browser acceptance', () => {
+test('browser acceptance serializes the prewarmed Vite HTML entrypoints', () => {
   const viteConfig = readFileSync(new URL('../vite.config.ts', import.meta.url), 'utf8');
+  const playwrightConfig = readFileSync(
+    new URL('../playwright.config.ts', import.meta.url),
+    'utf8'
+  );
   const htmlEntries = readdirSync(new URL('..', import.meta.url))
     .filter(name => name.endsWith('.e2e.html'))
     .sort();
@@ -104,6 +113,7 @@ test('Vite prewarms every E2E HTML entry before concurrent browser acceptance',
   for (const entry of htmlEntries) {
     assert.ok(viteConfig.includes(`'${entry}'`), `missing optimizeDeps entry ${entry}`);
   }
+  assert.match(playwrightConfig, /workers:\s*1/);
 });
 
 test('the platform package owns Web build verification policy', () => {

package/template/package.json

@@ -22,7 +22,7 @@
     "build": "pnpm --recursive build"
   },
   "devDependencies": {
-    "openxiangda": "2.0.0-alpha.24",
+    "openxiangda": "2.0.0-alpha.27",
     "typescript": "5.9.3"
   }
 }

package/template/packages/contracts/src/generated.ts

@@ -27,6 +27,9 @@ export const eventHandlerManifest = {
 export const eventHandlers = {} as const;
 export const eventSchemas = [] as const;
 export const workflowCodes = [] as const;
+export const notificationTemplateCodes = {
+  applicationInformational: "application.informational.standard",
+} as const;
 
 export type ResourceCode = (typeof resourceCodes)[number];
 export type Capability = (typeof capabilities)[number];
@@ -37,6 +40,7 @@ export type EventType = (typeof eventTypes)[number];
 export type EventSubscriptionCode = (typeof eventSubscriptionCodes)[number];
 export type EventTypesForSubscription<TCode extends EventSubscriptionCode> = never;
 export type WorkflowCode = (typeof workflowCodes)[number];
+export type NotificationTemplateCode = (typeof notificationTemplateCodes)[keyof typeof notificationTemplateCodes];
 
 export interface OpenXiangdaCloudEvent<TType extends EventType = EventType, TData extends Record<string, unknown> = Record<string, unknown>> {
   specversion: "1.0";