openxiangda-cli 2.0.0-alpha.133 → 2.0.0-alpha.135

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda-cli",
-  "version": "2.0.0-alpha.133",
+  "version": "2.0.0-alpha.135",
   "description": "Thin application-level CLI for OpenXiangda 2.0.",
   "type": "module",
   "main": "./dist/index.js",
@@ -21,10 +21,10 @@
   ],
   "dependencies": {
     "@oclif/core": "4.13.3",
-    "openxiangda-contracts": "2.0.0-alpha.66",
-    "openxiangda-devkit-core": "2.0.0-alpha.86",
-    "openxiangda-mcp": "2.0.0-alpha.86",
-    "openxiangda-skill-kit": "2.0.0-alpha.107"
+    "openxiangda-contracts": "2.0.0-alpha.67",
+    "openxiangda-devkit-core": "2.0.0-alpha.87",
+    "openxiangda-mcp": "2.0.0-alpha.87",
+    "openxiangda-skill-kit": "2.0.0-alpha.108"
   },
   "devDependencies": {
     "tsx": "4.23.12",

package/template/AGENTS.md

@@ -5,6 +5,7 @@
 - Use Vite, React Router, Refine Core and Ant Design. Do not add Umi, ProComponents or another admin shell.
 - Bind every generated `appRoutes` entry to its local page with `defineApplicationContributions`; desktop `admin` routes stay inside the platform Shell, while `user` routes render without an admin Shell for independent mobile/user experiences. Generated resource CRUD routes are compiler-owned under `/admin/resources/<resourceCode>...` and `/m/admin/resources/<resourceCode>...`; never recreate root resource paths, aliases or redirects. Explicit routes that have the same canonical shape as another explicit or generated route fail compilation, even when dynamic parameter names differ. Use only the typed `toolbar`, `row` and `detail` resource slots for generated resource actions. Declare the complete editable admin menu with `defineAdminNavigation` and its page/group helpers; the Shell renders only generated `adminNavigation` references and permissions only filter them. Do not create another router, menu store, layout, identity provider, permission store or copied CRUD page; route/action access uses capability or `allOf`/`anyOf`, while Data/App API and Workflow authorization remain server-owned.
 - Application login is optional `frontend.authentication`: existing platform users only, registration rejected, exact desktop `/login` and mobile `/m/login`. Bind generated `authenticationSurfaces` to separate PC/mobile renderers through `defineApplicationContributions`; renderers own only brand visuals and call `ApplicationLoginSurfaceProps`. The platform alone owns passwords, providers, OAuth state/callbacks, secure cookies, current identity and authorization. Never put login in protected `appRoutes`, call a v1 auth route, store tokens, create users/roles, or add another Router/identity provider. Keep QA in generated `platformAuthManifest`, outside the protected route denominator.
+- External users without platform accounts use only an exact static `surface: 'user'` route declared through `frontend.publicAccess`. Declare the one resource, bounded field sets, required operations, draft limits and named duplicate validations; consume only generated `anonymousPublicAccess` and `createAnonymousPublicClient`. `own.list`/`own.read` mean records submitted by the same platform-issued HttpOnly browser credential, not a verified natural person, and another browser or cleared cookie intentionally loses access. Never create a guest role/user, call the general Native Data API, expose an anonymous upload path, store identity locally or derive ownership from IP, user-agent or fingerprint.
 - Declare each resource once in `openxiangda.config.ts` with only `code`, `name`, `fields` and optional `mutationOwner`, generated/list/layout/data-policy settings. Each field owns type, label, required state, Surface flags, reference/file metadata and access. Resource codes are lower kebab-case. Use `native` for direct Data API mutations, `action`, `readonly` or `workflow` for non-Native ownership; never grant or generate Native mutation for a non-Native owner.
 - Never write resource-level `schemaVersion`, `appCode`, `schema`, `surface`, `capabilities`, `fieldPolicies` or `platform/data` modules. The compiler derives the strict DataResource, CRUD capabilities, Surface and AI Schema. The application manifest still starts with its one top-level `schemaVersion: 3`.
 - Ordinary list/get/create/update/delete, filters, export and batch operations use the platform Native Data API. Do not create Function CRUD or NestJS wrappers.

package/template/apps/server/package.json

@@ -15,7 +15,7 @@
     "@nestjs/common": "11.1.29",
     "@nestjs/core": "11.1.29",
     "@nestjs/platform-fastify": "11.1.29",
-    "openxiangda": "2.0.0-alpha.48",
+    "openxiangda": "2.0.0-alpha.50",
     "reflect-metadata": "0.2.2",
     "rxjs": "7.8.2"
   },

package/template/apps/web/e2e/workflow-experience-fixture.tsx

@@ -245,11 +245,32 @@ const adminNavigation = [
   },
 ] as const satisfies AdminNavigationInput;
 
-const initialPath =
-  new URLSearchParams(window.location.search).get('initial') ||
-  '/admin/work-center';
+const fixtureParams = new URLSearchParams(window.location.search);
+const initialPath = fixtureParams.get('initial') || '/admin/work-center';
+const runtimeBase = fixtureParams.get('base')?.trim();
+if (runtimeBase) {
+  for (const [name, content] of [
+    ['openxiangda-runtime-base', runtimeBase],
+    ['openxiangda-app-code', appCode],
+    ['openxiangda-environment', 'preproduction'],
+  ] as const) {
+    const meta =
+      document.querySelector<HTMLMetaElement>(`meta[name="${name}"]`) ||
+      document.createElement('meta');
+    meta.name = name;
+    meta.content = content;
+    if (!meta.parentElement) document.head.appendChild(meta);
+  }
+}
 if (location.pathname.endsWith('/workflow-experience.e2e.html')) {
-  history.replaceState({}, '', initialPath);
+  const stateToken = fixtureParams.get('state');
+  history.replaceState(
+    stateToken
+      ? { usr: { routeNegotiationState: stateToken }, key: 'fixture-state' }
+      : {},
+    '',
+    initialPath,
+  );
 }
 
 ReactDOM.createRoot(document.getElementById('root')!).render(

package/template/apps/web/e2e/workflow.spec.ts

@@ -22,6 +22,16 @@ function detailNavigation(custom = false) {
       };
 }
 
+function workflowFixtureUrl(
+  initialPath: string,
+  options: { base?: string; state?: string } = {},
+) {
+  const params = new URLSearchParams({ initial: initialPath });
+  if (options.base) params.set('base', options.base);
+  if (options.state) params.set('state', options.state);
+  return `/workflow-experience.e2e.html?${params.toString()}`;
+}
+
 function task(completed = false, customDetail = false) {
   return {
     schemaVersion: 'openxiangda.workflow-task/v2',
@@ -673,3 +683,108 @@ test('shows an explicit authorization error instead of an empty work center', as
   });
   await expect(page.getByRole('link', { name: '采购申请审批' })).toHaveCount(0);
 });
+
+test('negotiates direct standard routes after BrowserRouter listener setup', async ({
+  page,
+}) => {
+  await mockWorkflow(page);
+  await page.setViewportSize({ width: 360, height: 844 });
+  await page.goto(
+    workflowFixtureUrl('/admin/todos?view=pending#unread', {
+      state: 'deep-link',
+    }),
+  );
+
+  // The initial desktop URL is replaced by the mobile pair and the rendered
+  // surface follows the Router update. The fixture is StrictMode-mounted.
+  await expect(page.locator('.oxa-todo-center-mobile')).toBeVisible();
+  await expect(page.locator('.oxa-todo-center-desktop')).toHaveCount(0);
+  await expect(page).toHaveURL(/\/m\/todos\?view=pending#unread$/);
+  const historyLength = await page.evaluate(() => window.history.length);
+  const negotiatedUrl = page.url();
+  await expect
+    .poll(() => page.url(), { timeout: 1_000 })
+    .toBe(negotiatedUrl);
+  expect(await page.evaluate(() => window.history.state?.usr)).toEqual({
+    routeNegotiationState: 'deep-link',
+  });
+
+  // 768px remains mobile; crossing to 769px switches the same manifest pair
+  // back to desktop without adding a browser-history entry.
+  await page.setViewportSize({ width: 768, height: 844 });
+  await expect(page.locator('.oxa-todo-center-mobile')).toBeVisible();
+  await page.setViewportSize({ width: 769, height: 844 });
+  await expect(page.locator('.oxa-todo-center-desktop')).toBeVisible();
+  await expect(page).toHaveURL(/\/admin\/todos\?view=pending#unread$/);
+  expect(await page.evaluate(() => window.history.length)).toBe(historyLength);
+  expect(await page.evaluate(() => window.history.state?.usr)).toEqual({
+    routeNegotiationState: 'deep-link',
+  });
+  await page.goBack();
+  await expect(page).not.toHaveURL(/\/admin\/todos\?view=pending#unread$/);
+
+  // Direct task and instance URLs carry their dynamic parameter and deep-link
+  // context to the independent mobile renderer at the narrow width.
+  await page.setViewportSize({ width: 360, height: 844 });
+  await page.goto(
+    workflowFixtureUrl(`/admin/tasks/${taskId}?from=todo#approval`),
+  );
+  await expect(page.locator('.oxa-workflow-detail-mobile')).toBeVisible();
+  await expect(page).toHaveURL(
+    new RegExp(`/m/tasks/${taskId}\\?from=todo#approval$`),
+  );
+
+  await page.goto(
+    workflowFixtureUrl(`/admin/workflows/${instanceId}?from=todo#timeline`),
+  );
+  await expect(page.locator('.oxa-workflow-detail-mobile')).toBeVisible();
+  await expect(page).toHaveURL(
+    new RegExp(`/m/workflows/${instanceId}\\?from=todo#timeline$`),
+  );
+});
+
+test('negotiates launch pairs in both directions and preserves the mount basename', async ({
+  page,
+}) => {
+  await mockWorkflow(page);
+  const base = '/runtime/route-negotiation';
+  await page.setViewportSize({ width: 360, height: 844 });
+  await page.goto(
+    workflowFixtureUrl(
+      `${base}/admin/workflows/purchase-approval/new?source=todo#launch`,
+      { base },
+    ),
+  );
+  await expect(page.locator('.oxa-workflow-submission-mobile')).toBeVisible();
+  await expect(page).toHaveURL(
+    new RegExp(
+      `${base}/m/workflows/purchase-approval/start\\?source=todo#launch$`,
+    ),
+  );
+
+  await page.setViewportSize({ width: 1_440, height: 900 });
+  await expect(page.locator('.oxa-workflow-submission-desktop')).toBeVisible();
+  await expect(page).toHaveURL(
+    new RegExp(
+      `${base}/admin/workflows/purchase-approval/new\\?source=todo#launch$`,
+    ),
+  );
+});
+
+test('does not negotiate non-standard application contribution routes', async ({
+  page,
+}) => {
+  await mockWorkflow(page);
+  const base = '/runtime/route-negotiation';
+  await page.setViewportSize({ width: 360, height: 844 });
+  const customPath = `${base}/admin/operations/purchases/${instanceId}?taskId=${taskId}`;
+  await page.goto(workflowFixtureUrl(customPath, { base }));
+  await expect(page.getByTestId('custom-workflow-detail')).toContainText(
+    `${instanceId} / ${taskId}`,
+  );
+  const customUrl = page.url();
+  await expect(page).toHaveURL(new RegExp(`${base}/admin/operations/`));
+  await expect
+    .poll(() => page.url(), { timeout: 1_000 })
+    .toBe(customUrl);
+});

package/template/apps/web/package.json

@@ -14,7 +14,7 @@
     "@ant-design/icons": "6.2.3",
     "@refinedev/core": "5.0.12",
     "antd": "6.4.3",
-    "openxiangda": "2.0.0-alpha.48",
+    "openxiangda": "2.0.0-alpha.50",
     "react": "19.2.8",
     "react-dom": "19.2.8",
     "react-router-dom": "7.8.2"

package/template/apps/web/src/main.tsx

@@ -14,6 +14,7 @@ import {
   appRoutes,
   routeManifest,
   authenticationSurfaces,
+  anonymousPublicAccess,
   adminNavigation,
   adminPages,
   resourceDefinitions,
@@ -52,6 +53,7 @@ ReactDOM.createRoot(document.getElementById('root')!).render(
       adminPages={adminPages}
       routeManifest={routeManifest}
       contributions={applicationContributions}
+      publicAccess={anonymousPublicAccess}
       perspectives={appPerspectives}
       resourceDefinitions={resourceDefinitions}
       workflows={workflowDefinitions}

package/template/apps/web/test/contracts.test.ts

@@ -35,6 +35,7 @@ test('clean template contains only application declarations and one React entry'
   assert.match(source, /DefaultDesktopApplicationLoginSurface/);
   assert.match(source, /DefaultMobileApplicationLoginSurface/);
   assert.match(source, /contributions=\{applicationContributions\}/);
+  assert.match(source, /publicAccess=\{anonymousPublicAccess\}/);
   assert.match(source, /from 'openxiangda\/react'/);
   assert.match(source, /openxiangda\/react\/styles\.css/);
   const legacyMarkers = [

package/template/package.json

@@ -23,7 +23,7 @@
     "build": "pnpm --recursive build"
   },
   "devDependencies": {
-    "openxiangda": "2.0.0-alpha.48",
+    "openxiangda": "2.0.0-alpha.50",
     "typescript": "5.9.3"
   }
 }

package/template/packages/contracts/src/generated.ts

@@ -84,6 +84,7 @@ export const applicationAuthentication = {
     }
   }
 } as const;
+export const anonymousPublicAccess = undefined;
 export const platformAuthManifest = {
   "schemaVersion": "openxiangda.platform-auth-manifest/v2",
   "appCode": "openxiangda-application",
@@ -143,6 +144,7 @@ export type AppRouteCode = AppRoute["code"];
 export type ApplicationAuthenticationMethod = (typeof authenticationMethods)[number];
 export type ApplicationAuthenticationSurface = (typeof authenticationSurfaces)[keyof typeof authenticationSurfaces];
 export type ApplicationAuthenticationSurfaceCode = ApplicationAuthenticationSurface["routeCode"];
+export type AnonymousPublicAccess = typeof anonymousPublicAccess;
 export type RouteManifest = typeof routeManifest;
 export type AdminPage = (typeof adminPages)[number];
 export type AdminNavigationGroup = (typeof adminNavigation)[number];