openxiangda-cli 2.0.0-alpha.124 → 2.0.0-alpha.126

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda-cli",
-  "version": "2.0.0-alpha.124",
+  "version": "2.0.0-alpha.126",
   "description": "Thin application-level CLI for OpenXiangda 2.0.",
   "type": "module",
   "main": "./dist/index.js",
@@ -21,10 +21,10 @@
   ],
   "dependencies": {
     "@oclif/core": "4.13.3",
-    "openxiangda-contracts": "2.0.0-alpha.60",
-    "openxiangda-devkit-core": "2.0.0-alpha.78",
-    "openxiangda-mcp": "2.0.0-alpha.78",
-    "openxiangda-skill-kit": "2.0.0-alpha.99"
+    "openxiangda-contracts": "2.0.0-alpha.62",
+    "openxiangda-devkit-core": "2.0.0-alpha.80",
+    "openxiangda-mcp": "2.0.0-alpha.80",
+    "openxiangda-skill-kit": "2.0.0-alpha.101"
   },
   "devDependencies": {
     "tsx": "4.23.12",

package/template/AGENTS.md

@@ -4,6 +4,7 @@
 - `appspec/` is the optional OpenXiangda 2.0 business-intent layer. Before changing observable behavior, read the bounded index with `pnpm openxiangda spec context --json`, then select only the relevant stable ID; use no ChangeSpec for L0 work, one short ChangeSpec for L1, and add permission/rollback/concurrency detail only for L2/L3. Before close, the user—not AI—confirms `currentSpec=merged` or `not-applicable`. AppSpec is advisory and never a release gate. Never read, import or migrate 1.x `openspec/` or SDD.
 - Use Vite, React Router, Refine Core and Ant Design. Do not add Umi, ProComponents or another admin shell.
 - Bind every generated `appRoutes` entry to its local page with `defineApplicationContributions`; desktop `admin` routes stay inside the platform Shell, while `user` routes render without an admin Shell for independent mobile/user experiences. Generated resource CRUD routes are compiler-owned under `/admin/resources/<resourceCode>...` and `/m/admin/resources/<resourceCode>...`; never recreate root resource paths, aliases or redirects. Explicit routes that have the same canonical shape as another explicit or generated route fail compilation, even when dynamic parameter names differ. Use only the typed `toolbar`, `row` and `detail` resource slots for generated resource actions. Declare the complete editable admin menu with `defineAdminNavigation` and its page/group helpers; the Shell renders only generated `adminNavigation` references and permissions only filter them. Do not create another router, menu store, layout, identity provider, permission store or copied CRUD page; route/action access uses capability or `allOf`/`anyOf`, while Data/App API and Workflow authorization remain server-owned.
+- Application login is optional `frontend.authentication`: existing platform users only, registration rejected, exact desktop `/login` and mobile `/m/login`. Bind generated `authenticationSurfaces` to separate PC/mobile renderers through `defineApplicationContributions`; renderers own only brand visuals and call `ApplicationLoginSurfaceProps`. The platform alone owns passwords, providers, OAuth state/callbacks, secure cookies, current identity and authorization. Never put login in protected `appRoutes`, call a v1 auth route, store tokens, create users/roles, or add another Router/identity provider. Keep QA in generated `platformAuthManifest`, outside the protected route denominator.
 - Declare each resource once in `openxiangda.config.ts` with only `code`, `name`, `fields` and optional `mutationOwner`, generated/list/layout/data-policy settings. Each field owns type, label, required state, Surface flags, reference/file metadata and access. Resource codes are lower kebab-case. Use `native` for direct Data API mutations, `action`, `readonly` or `workflow` for non-Native ownership; never grant or generate Native mutation for a non-Native owner.
 - Never write resource-level `schemaVersion`, `appCode`, `schema`, `surface`, `capabilities`, `fieldPolicies` or `platform/data` modules. The compiler derives the strict DataResource, CRUD capabilities, Surface and AI Schema. The application manifest still starts with its one top-level `schemaVersion: 3`.
 - Ordinary list/get/create/update/delete, filters, export and batch operations use the platform Native Data API. Do not create Function CRUD or NestJS wrappers.

package/template/README.md

@@ -26,6 +26,14 @@ BrowserRouter、RuntimeBoundary、Refine、generated routes 和后台 Shell
 在显式后台导航组中加入 `adminApplicationTodoCenterPage()`；平台生成
 `/admin/todos` 与 `/m/todos`，只读取当前用户的消息/待办投影并统一解析目标页面。
 
+登录声明位于 `frontend.authentication`，只允许现有平台用户并拒绝注册。桌面 `/login`
+与移动 `/m/login` 是独立生成的 `authenticationSurfaces`，不计入受保护的
+`appRoutes`。用 `defineApplicationContributions({ routes: appRoutes,
+authenticationSurfaces }, { pages, authentication })` 分别绑定 PC/移动品牌 renderer；
+renderer 只使用 `ApplicationLoginSurfaceProps` 回调，不能验证密码、读取 Token、处理
+OAuth callback 或创建第二个 Router/身份状态。`platformAuthManifest` 单独记录登录面 QA，
+不会改变用户路由覆盖数。
+
 生成式资源后台路径固定为 `/admin/resources/<resourceCode>...`，移动后台面为
 `/m/admin/resources/<resourceCode>...`；普通根路径和 `/m/...` 产品路径可由显式
 `user` route 使用。生成页内部跳转来自编译后的 `adminPages`，不要手写旧根路径、别名或

package/template/apps/server/package.json

@@ -15,7 +15,7 @@
     "@nestjs/common": "11.1.29",
     "@nestjs/core": "11.1.29",
     "@nestjs/platform-fastify": "11.1.29",
-    "openxiangda": "2.0.0-alpha.38",
+    "openxiangda": "2.0.0-alpha.40",
     "reflect-metadata": "0.2.2",
     "rxjs": "7.8.2"
   },

package/template/apps/web/e2e/workflow.spec.ts

@@ -579,7 +579,7 @@ test('shows an explicit authorization error instead of an empty work center', as
   await page.goto('/workflow-experience.e2e.html?initial=/admin/work-center', {
     waitUntil: 'domcontentloaded',
   });
-  await expect(page.getByRole('alert')).toContainText('HTTP_403: forbidden', {
+  await expect(page.getByRole('alert')).toContainText('403: forbidden', {
     timeout: 30_000,
   });
   await expect(page.getByRole('link', { name: '采购申请审批' })).toHaveCount(0);

package/template/apps/web/package.json

@@ -14,7 +14,7 @@
     "@ant-design/icons": "6.2.3",
     "@refinedev/core": "5.0.12",
     "antd": "6.4.3",
-    "openxiangda": "2.0.0-alpha.38",
+    "openxiangda": "2.0.0-alpha.40",
     "react": "19.2.8",
     "react-dom": "19.2.8",
     "react-router-dom": "7.8.2"

package/template/apps/web/src/main.tsx

@@ -3,13 +3,17 @@ import ReactDOM from 'react-dom/client';
 import {
   defineApplicationContributions,
   defineWorkflowLaunchContributions,
+  DefaultDesktopApplicationLoginSurface,
+  DefaultMobileApplicationLoginSurface,
   OpenXiangdaApplication,
+  type ApplicationLoginSurfaceProps,
 } from 'openxiangda/react';
 import {
   appCode,
   appName,
   appPerspectives,
   appRoutes,
+  authenticationSurfaces,
   adminNavigation,
   adminPages,
   resourceDefinitions,
@@ -17,9 +21,28 @@ import {
 } from '../../../packages/contracts/src/generated.js';
 import 'openxiangda/react/styles.css';
 
-const applicationContributions = defineApplicationContributions(appRoutes, {
-  pages: {},
-});
+const ApplicationHome = () => <main>OpenXiangda 应用</main>;
+const ApplicationHomeMobile = () => <main>OpenXiangda 移动应用</main>;
+const BrandedDesktopLogin = (props: ApplicationLoginSurfaceProps) => (
+  <DefaultDesktopApplicationLoginSurface {...props} />
+);
+const BrandedMobileLogin = (props: ApplicationLoginSurfaceProps) => (
+  <DefaultMobileApplicationLoginSurface {...props} />
+);
+
+const applicationContributions = defineApplicationContributions(
+  { routes: appRoutes, authenticationSurfaces },
+  {
+    pages: {
+      applicationHome: ApplicationHome,
+      applicationHomeMobile: ApplicationHomeMobile,
+    },
+    authentication: {
+      applicationLogin: BrandedDesktopLogin,
+      applicationLoginMobile: BrandedMobileLogin,
+    },
+  },
+);
 const workflowContributions = defineWorkflowLaunchContributions(
   workflowDefinitions,
   {},

package/template/apps/web/test/contracts.test.ts

@@ -4,6 +4,7 @@ import test from 'node:test';
 import { readRuntimeMount, resolveApplicationBasename } from 'openxiangda/core';
 import {
   notificationTemplateCodes,
+  platformAuthManifest,
   resourceCodes,
   resourceDefinitions,
 } from '../../../packages/contracts/src/generated.js';
@@ -26,9 +27,13 @@ test('clean template contains only application declarations and one React entry'
     notificationTemplateCodes.applicationInformational,
     'application.informational.standard'
   );
+  assert.equal(platformAuthManifest?.protectedUserRouteCount, 2);
+  assert.equal(platformAuthManifest?.surfaces.length, 2);
   assert.match(config, /data:\s*\{\s*resources:/);
   assert.match(source, /OpenXiangdaApplication/);
-  assert.match(source, /defineApplicationContributions\(appRoutes/);
+  assert.match(source, /routes: appRoutes, authenticationSurfaces/);
+  assert.match(source, /DefaultDesktopApplicationLoginSurface/);
+  assert.match(source, /DefaultMobileApplicationLoginSurface/);
   assert.match(source, /contributions=\{applicationContributions\}/);
   assert.match(source, /from 'openxiangda\/react'/);
   assert.match(source, /openxiangda\/react\/styles\.css/);

package/template/openxiangda.config.ts

@@ -6,7 +6,45 @@ export default defineOpenXiangdaApp({
   app: { code: 'openxiangda-application', name: 'OpenXiangda 应用' },
   frontend: {
     root: 'apps/web',
-    routes: [],
+    routes: [
+      {
+        code: 'application-home',
+        path: '/home',
+        label: '应用首页',
+        surface: 'user',
+      },
+      {
+        code: 'application-home-mobile',
+        path: '/m/home',
+        label: '移动首页',
+        surface: 'user',
+      },
+    ],
+    authentication: {
+      accountMode: 'existing-platform-users-only',
+      registration: { mode: 'reject' },
+      methods: [
+        {
+          code: 'password',
+          type: 'password',
+          label: '账号密码登录',
+          presentation: 'primary',
+          required: true,
+        },
+      ],
+      surfaces: {
+        desktop: {
+          routeCode: 'application-login',
+          path: '/login',
+          defaultRouteCode: 'application-home',
+        },
+        mobile: {
+          routeCode: 'application-login-mobile',
+          path: '/m/login',
+          defaultRouteCode: 'application-home-mobile',
+        },
+      },
+    },
     admin: { navigation: defineAdminNavigation([]) },
   },
   backend: {

package/template/package.json

@@ -2,6 +2,7 @@
   "name": "openxiangda-application",
   "version": "0.1.0",
   "private": true,
+  "type": "module",
   "packageManager": "pnpm@10.15.1",
   "engines": {
     "node": ">=22.12"
@@ -22,7 +23,7 @@
     "build": "pnpm --recursive build"
   },
   "devDependencies": {
-    "openxiangda": "2.0.0-alpha.38",
+    "openxiangda": "2.0.0-alpha.40",
     "typescript": "5.9.3"
   }
 }

package/template/packages/contracts/src/generated.ts

@@ -16,7 +16,102 @@ export const capabilities = [
   "app:super-admin:manage"
 ] as const;
 export const appOperations = {} as const;
-export const appRoutes = {} as const;
+export const appRoutes = {
+  applicationHome: {
+    "code": "application-home",
+    "path": "/home",
+    "label": "应用首页",
+    "surface": "user",
+    "tabPersistence": "session",
+    "keepAlive": "none"
+  },
+  applicationHomeMobile: {
+    "code": "application-home-mobile",
+    "path": "/m/home",
+    "label": "移动首页",
+    "surface": "user",
+    "tabPersistence": "session",
+    "keepAlive": "none"
+  }
+} as const;
+export const authenticationMethods = [
+  {
+    "code": "password",
+    "type": "password",
+    "label": "账号密码登录",
+    "presentation": "primary",
+    "required": true
+  }
+] as const;
+export const authenticationSurfaces = {
+  applicationLogin: {
+    "device": "desktop",
+    "routeCode": "application-login",
+    "path": "/login",
+    "defaultRouteCode": "application-home"
+  },
+  applicationLoginMobile: {
+    "device": "mobile",
+    "routeCode": "application-login-mobile",
+    "path": "/m/login",
+    "defaultRouteCode": "application-home-mobile"
+  }
+} as const;
+export const applicationAuthentication = {
+  "accountMode": "existing-platform-users-only",
+  "registration": {
+    "mode": "reject"
+  },
+  "methods": [
+    {
+      "code": "password",
+      "type": "password",
+      "label": "账号密码登录",
+      "presentation": "primary",
+      "required": true
+    }
+  ],
+  "surfaces": {
+    "desktop": {
+      "routeCode": "application-login",
+      "path": "/login",
+      "defaultRouteCode": "application-home"
+    },
+    "mobile": {
+      "routeCode": "application-login-mobile",
+      "path": "/m/login",
+      "defaultRouteCode": "application-home-mobile"
+    }
+  }
+} as const;
+export const platformAuthManifest = {
+  "schemaVersion": "openxiangda.platform-auth-manifest/v2",
+  "appCode": "openxiangda-application",
+  "protectedUserRouteCount": 2,
+  "methods": [
+    {
+      "code": "password",
+      "type": "password",
+      "label": "账号密码登录",
+      "presentation": "primary",
+      "required": true
+    }
+  ],
+  "surfaces": [
+    {
+      "device": "desktop",
+      "routeCode": "application-login",
+      "path": "/login",
+      "defaultRouteCode": "application-home"
+    },
+    {
+      "device": "mobile",
+      "routeCode": "application-login-mobile",
+      "path": "/m/login",
+      "defaultRouteCode": "application-home-mobile"
+    }
+  ]
+} as const;
 export const adminPages = [] as const;
 export const adminNavigation = [] as const;
 export const eventTypes = [] as const;
@@ -39,6 +134,9 @@ export type Capability = (typeof capabilities)[number];
 export type AppOperation = (typeof appOperations)[keyof typeof appOperations];
 export type AppRoute = (typeof appRoutes)[keyof typeof appRoutes];
 export type AppRouteCode = AppRoute["code"];
+export type ApplicationAuthenticationMethod = (typeof authenticationMethods)[number];
+export type ApplicationAuthenticationSurface = (typeof authenticationSurfaces)[keyof typeof authenticationSurfaces];
+export type ApplicationAuthenticationSurfaceCode = ApplicationAuthenticationSurface["routeCode"];
 export type AdminPage = (typeof adminPages)[number];
 export type AdminNavigationGroup = (typeof adminNavigation)[number];
 export type AppPerspective = (typeof appPerspectives)[number];