openxiangda-cli 2.0.0-alpha.151 → 2.0.0-alpha.153

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda-cli",
-  "version": "2.0.0-alpha.151",
+  "version": "2.0.0-alpha.153",
   "description": "Thin application-level CLI for OpenXiangda 2.0.",
   "type": "module",
   "main": "./dist/index.js",
@@ -21,10 +21,10 @@
   ],
   "dependencies": {
     "@oclif/core": "4.13.3",
-    "openxiangda-contracts": "2.0.0-alpha.78",
-    "openxiangda-devkit-core": "2.0.0-alpha.98",
-    "openxiangda-mcp": "2.0.0-alpha.98",
-    "openxiangda-skill-kit": "2.0.0-alpha.120"
+    "openxiangda-contracts": "2.0.0-alpha.80",
+    "openxiangda-devkit-core": "2.0.0-alpha.100",
+    "openxiangda-mcp": "2.0.0-alpha.100",
+    "openxiangda-skill-kit": "2.0.0-alpha.122"
   },
   "devDependencies": {
     "tsx": "4.23.12",

package/template/AGENTS.md

@@ -42,6 +42,6 @@
 - `option.*`, `user.*`, `department.*` and `resource-ref.*` values never collapse to scalar IDs. Single values store one labeled object and multiple values store object arrays. `resource-ref.*` JSON is not a foreign key, trusted target snapshot or automatically refreshed copy; current target state is read by `resourceCode` plus `value`. A resource source `labelField` must be `text.short` or `text.long`; `serial-number` is allowed in source search, description and snapshot fields, but not as the label. `location` accepts only exact WGS84 coordinates captured by DingTalk or browser geolocation; it has no manual input or `manual` source. Roles that consume directory-backed fields explicitly include `app:<app-code>:directory:read`.
 - Derive role grants with `resourceCapabilityCodes(appCode, resourceCode)`. Declare current-user rows only with `currentUserDataPolicy(...)`; do not invent operators, values or alternate current-user spellings.
 - Do not add compatibility aliases, migration branches or silent fallbacks for an earlier 2.0 alpha contract. Replace an incorrect contract and regenerate the application.
-- Standard Workflow and Notification Hub are optional 2.0 modules. Enable them only through canonical `openxiangda.config.ts` declarations and generated clients. `standalone`/`hidden-handoff` use the compiler-owned process operation and Durable Business Process Command; never add a browser save callback or call Workflow prepare/start directly. Custom pages launch only through a verified Named Action using `OpenXiangdaBusinessProcessService`. PC and mobile render the same `ProcessCommandSurface` independently and recover only by `commandId`. To replace Workflow detail, declare both desktop and mobile `detailRouteCode` values whose routes contain exactly `:instanceId`. Add the current-user todo page only with `adminApplicationTodoCenterPage()`; never query Notification Hub management APIs from a user page.
+- Standard Workflow and Notification Hub are optional 2.0 modules. Enable them only through canonical `openxiangda.config.ts` declarations and generated clients. `standalone`/`hidden-handoff` default to the compiler-owned process operation; action-owned submission must instead declare `launch.submission.kind: 'named-operation'` with sealed create/existing input and output bindings so the standard PC/mobile page calls the original Named Action and accepts an explicit no-Workflow result. Never add a browser save callback or call Workflow prepare/start directly. Custom pages launch only through a verified Named Action using `OpenXiangdaBusinessProcessService`. PC and mobile render the same `ProcessCommandSurface` independently and recover only by `commandId`. To replace Workflow detail, declare both desktop and mobile `detailRouteCode` values whose routes contain exactly `:instanceId`. Add the current-user todo page only with `frontend.user.applicationTodoCenter: true`; never query Notification Hub management APIs from a user page.
 - Run `pnpm openxiangda check --json` after contract changes and read `data.sealedArtifact`; check never seals, and an older `.openxiangda/build/app-package.json` is not the current check result. Use `pnpm openxiangda accept --plan <file>` only for optional real preproduction identity acceptance; it never blocks delivery. Deploy with `pnpm openxiangda deploy`, inspect with `pnpm openxiangda status` and `pnpm openxiangda logs`, and use the platform rollback command rather than mutating K3s directly.
 - AI-native clients start the workspace protocol through the same pinned binary: `pnpm exec openxiangda --mcp-stdio --cwd <workspace>`. Read `openxiangda://workspace/contracts` or call `contract_describe`; for first-time menu authoring, copy `data.adminNavigationAuthoring.suggestion.expression` once into `frontend.admin.navigation` with its listed `openxiangda/config` imports, then edit that application-owned declaration. Never treat the proposal as runtime discovery. When AppSpec is enabled, also read `openxiangda://workspace/appspec` or call `appspec_context`. Require `aiCatalog` and `aiCatalogDigest` to match the normal compiler output. This is a stdio transport mode, not another application-owned server. Never write an application MCP server, Catalog file, preview store or second authorization path.

package/template/README.md

@@ -23,8 +23,8 @@ pnpm openxiangda dev
 逐项绑定本地组件并传给 `OpenXiangdaApplication`。后者是唯一的
 BrowserRouter、RuntimeBoundary、Refine、generated routes 和后台 Shell
 所有者；用户页可以拥有独立布局，但不要再建 router/Shell。要使用通用应用待办中心，
-在显式后台导航组中加入 `adminApplicationTodoCenterPage()`；平台生成
-`/admin/todos` 与 `/m/todos`，只读取当前用户的消息/待办投影并统一解析目标页面。
+声明 `frontend.user.applicationTodoCenter: true`；平台生成 `/todos` 与 `/m/todos`，
+只读取当前用户的消息/待办投影并统一解析目标页面。
 
 自定义后台页使用 `OpenXiangdaAdminPage` 作为页面根；Ant Design 组件自动继承平台
 `ConfigProvider`，图表等 TypeScript 渲染值读取 `theme.useToken()`，自定义 CSS

package/template/apps/server/package.json

@@ -15,7 +15,7 @@
     "@nestjs/common": "11.1.29",
     "@nestjs/core": "11.1.29",
     "@nestjs/platform-fastify": "11.1.29",
-    "openxiangda": "2.0.0-alpha.70",
+    "openxiangda": "2.0.0-alpha.72",
     "reflect-metadata": "0.2.2",
     "rxjs": "7.8.2"
   },

package/template/apps/web/e2e/workflow-experience-fixture.tsx

@@ -90,44 +90,7 @@ const applicationContributions = defineApplicationContributions(detailRoutes, {
   },
 });
 
-const adminPages = [
-  {
-    code: 'application:todo-center',
-    kind: 'application-todo-center',
-    path: '/admin/todos',
-    label: '待办中心',
-    navigationEligible: true,
-  },
-  {
-    code: 'workflow:work-center',
-    kind: 'workflow-work-center',
-    path: '/admin/work-center',
-    label: '我的审批',
-    navigationEligible: true,
-  },
-  {
-    code: 'workflow:purchase-approval:launch',
-    kind: 'workflow-launch',
-    path: '/admin/workflows/purchase-approval/new',
-    label: '发起采购审批',
-    navigationEligible: true,
-    workflowCode: 'purchase-approval',
-  },
-  {
-    code: 'workflow:task',
-    kind: 'workflow-task',
-    path: '/tasks/:taskId',
-    label: '审批任务',
-    navigationEligible: false,
-  },
-  {
-    code: 'workflow:instance',
-    kind: 'workflow-instance',
-    path: '/workflows/:instanceId',
-    label: '流程详情',
-    navigationEligible: false,
-  },
-] as const satisfies AdminPagesInput;
+const adminPages = [] as const satisfies AdminPagesInput;
 
 const routeManifest = {
   schemaVersion: 'openxiangda.application-route-manifest/v3',
@@ -148,8 +111,8 @@ const routeManifest = {
       kind: 'application-todo-center',
       desktop: {
         routeCode: 'application.todo-center.desktop',
-        path: '/admin/todos',
-        surface: 'admin',
+        path: '/todos',
+        surface: 'user',
         pathParams: [],
         requiresAuthentication: true,
       },
@@ -166,8 +129,8 @@ const routeManifest = {
       kind: 'workflow-work-center',
       desktop: {
         routeCode: 'workflow.work.center.desktop',
-        path: '/admin/work-center',
-        surface: 'admin',
+        path: '/work-center',
+        surface: 'user',
         pathParams: [],
         requiresAuthentication: true,
       },
@@ -185,7 +148,7 @@ const routeManifest = {
       desktop: {
         routeCode: 'workflow.task.desktop',
         path: '/tasks/:taskId',
-        surface: 'admin',
+        surface: 'user',
         pathParams: ['taskId'],
         requiresAuthentication: true,
       },
@@ -203,7 +166,7 @@ const routeManifest = {
       desktop: {
         routeCode: 'workflow.instance.desktop',
         path: '/workflows/:instanceId',
-        surface: 'admin',
+        surface: 'user',
         pathParams: ['instanceId'],
         requiresAuthentication: true,
       },
@@ -221,9 +184,9 @@ const routeManifest = {
       workflowCode: 'purchase-approval',
       desktop: {
         routeCode: 'workflow.purchase-approval.launch.desktop',
-        path: '/admin/workflows/purchase-approval/new',
-        surface: 'admin',
-        pathParams: [],
+        path: '/workflows/:workflowCode/start',
+        surface: 'user',
+        pathParams: ['workflowCode'],
         requiresAuthentication: true,
       },
       mobile: {
@@ -238,26 +201,10 @@ const routeManifest = {
   digest: '34cc08a02cd187a07d9e2d2f99c1080b5b86f3a4512f9e0f43ff4cb05b7195fa',
 } as const;
 
-const adminNavigation = [
-  {
-    code: 'workflow-center',
-    label: '流程中心',
-    icon: 'workflow',
-    order: 0,
-    items: [
-      { pageCode: 'application:todo-center', label: '待办中心', order: 0 },
-      { pageCode: 'workflow:work-center', label: '我的审批', order: 1 },
-      {
-        pageCode: 'workflow:purchase-approval:launch',
-        label: '发起采购审批',
-        order: 2,
-      },
-    ],
-  },
-] as const satisfies AdminNavigationInput;
+const adminNavigation = [] as const satisfies AdminNavigationInput;
 
 const fixtureParams = new URLSearchParams(window.location.search);
-const initialPath = fixtureParams.get('initial') || '/admin/work-center';
+const initialPath = fixtureParams.get('initial') || '/work-center';
 const runtimeBase = fixtureParams.get('base')?.trim();
 if (runtimeBase) {
   for (const [name, content] of [

package/template/apps/web/e2e/workflow.spec.ts

@@ -409,8 +409,8 @@ function detail(completed = false, customDetail = false) {
 
 function launchSurface() {
   return {
-    schemaVersion: 'openxiangda.workflow-launch-surface/v2',
-    protocolVersion: 'workflow_launch_surface_v2',
+    schemaVersion: 'openxiangda.workflow-launch-surface/v3',
+    protocolVersion: 'workflow_launch_surface_v3',
     surfaceRevision: 'launch-revision-1',
     engineVersion: '2.0',
     appCode,
@@ -434,7 +434,7 @@ function launchSurface() {
       contractRevisionId: 'contract-revision-1',
     },
     paths: {
-      desktop: '/admin/workflows/purchase-approval/new',
+      desktop: '/workflows/purchase-approval/start',
       mobile: '/m/workflows/purchase-approval/start',
     },
     commit: {
@@ -442,6 +442,15 @@ function launchSurface() {
       href: `/openxiangda-api/v2/applications/${appCode}/business-process/standard-commands`,
       idempotencyRequired: true,
     },
+    submission: {
+      kind: 'standard-process',
+      processOperationCode: 'openxiangda.workflow.purchase-approval.submit',
+      commit: {
+        method: 'POST',
+        href: `/openxiangda-api/v2/applications/${appCode}/business-process/standard-commands`,
+        idempotencyRequired: true,
+      },
+    },
   };
 }
 
@@ -785,7 +794,7 @@ test('renders a paged desktop work center from the current-user role union', asy
   page,
 }) => {
   await mockWorkflow(page);
-  await page.goto('/workflow-experience.e2e.html?initial=/admin/work-center');
+  await page.goto('/workflow-experience.e2e.html?initial=/work-center');
   await expect(page.getByRole('heading', { name: '审批工作台' })).toBeVisible();
   await expect(page.getByRole('link', { name: '采购申请审批' })).toBeVisible();
   await expect(page.getByText('PO-2026-0825')).toBeVisible();
@@ -795,7 +804,7 @@ test('renders the generic desktop and mobile application todo center without a s
   page,
 }) => {
   await mockWorkflow(page);
-  await page.goto('/workflow-experience.e2e.html?initial=/admin/todos');
+  await page.goto('/workflow-experience.e2e.html?initial=/todos');
   await expect(page.getByRole('heading', { name: '待办中心' })).toBeVisible();
   await expect(page.locator('.oxa-todo-table')).toBeVisible();
   await expect(page.locator('.oxa-todo-preview-card')).toHaveCount(0);
@@ -853,7 +862,7 @@ test('routes desktop and mobile work-center entries to the declared custom detai
   page,
 }) => {
   await mockWorkflow(page, { customDetail: true });
-  await page.goto('/workflow-experience.e2e.html?initial=/admin/work-center');
+  await page.goto('/workflow-experience.e2e.html?initial=/work-center');
   await page.getByRole('link', { name: '采购申请审批' }).click();
   await expect(page.getByTestId('custom-workflow-detail')).toContainText(
     `${instanceId} / ${taskId}`
@@ -885,16 +894,16 @@ test('redirects a direct standard task URL to the declared custom detail page',
   );
 });
 
-test('renders a standalone desktop detail and redirects the legacy admin URL', async ({
+test('renders a standalone desktop detail on the canonical user URL', async ({
   page,
 }) => {
   await mockWorkflow(page);
   await page.goto(
-    workflowFixtureUrl(`/admin/tasks/${taskId}?from=legacy#approval`),
+    workflowFixtureUrl(`/tasks/${taskId}?from=todo#approval`),
   );
   await expect(page.locator('.oxa-workflow-desktop-standalone-page')).toBeVisible();
   await expect(page).toHaveURL(
-    new RegExp(`/tasks/${taskId}\\?from=legacy#approval$`),
+    new RegExp(`/tasks/${taskId}\\?from=todo#approval$`),
   );
   await expect(page.locator('.oxa-app-layout')).toHaveCount(0);
   await expect(page.locator('.oxa-topbar')).toHaveCount(0);
@@ -942,7 +951,7 @@ test('shows an explicit authorization error instead of an empty work center', as
 }) => {
   test.setTimeout(45_000);
   await mockWorkflow(page, { forbidden: true });
-  await page.goto('/workflow-experience.e2e.html?initial=/admin/work-center', {
+  await page.goto('/workflow-experience.e2e.html?initial=/work-center', {
     waitUntil: 'domcontentloaded',
   });
   await expect(page.getByRole('alert')).toContainText('403: forbidden', {
@@ -957,7 +966,7 @@ test('negotiates direct standard routes after BrowserRouter listener setup', asy
   await mockWorkflow(page);
   await page.setViewportSize({ width: 360, height: 844 });
   await page.goto(
-    workflowFixtureUrl('/admin/todos?view=pending#unread', {
+    workflowFixtureUrl('/todos?view=pending#unread', {
       state: 'deep-link',
     }),
   );
@@ -982,13 +991,13 @@ test('negotiates direct standard routes after BrowserRouter listener setup', asy
   await expect(page.locator('.oxa-todo-center-mobile')).toBeVisible();
   await page.setViewportSize({ width: 901, height: 844 });
   await expect(page.locator('.oxa-todo-center-desktop')).toBeVisible();
-  await expect(page).toHaveURL(/\/admin\/todos\?view=pending#unread$/);
+  await expect(page).toHaveURL(/\/todos\?view=pending#unread$/);
   expect(await page.evaluate(() => window.history.length)).toBe(historyLength);
   expect(await page.evaluate(() => window.history.state?.usr)).toEqual({
     routeNegotiationState: 'deep-link',
   });
   await page.goBack();
-  await expect(page).not.toHaveURL(/\/admin\/todos\?view=pending#unread$/);
+  await expect(page).not.toHaveURL(/\/todos\?view=pending#unread$/);
 
   // Direct task and instance URLs carry their dynamic parameter and deep-link
   // context to the independent mobile renderer at the narrow width.
@@ -1018,7 +1027,7 @@ test('negotiates launch pairs in both directions and preserves the mount basenam
   await page.setViewportSize({ width: 360, height: 844 });
   await page.goto(
     workflowFixtureUrl(
-      `${base}/admin/workflows/purchase-approval/new?source=todo#launch`,
+      `${base}/workflows/purchase-approval/start?source=todo#launch`,
       { base },
     ),
   );
@@ -1033,7 +1042,7 @@ test('negotiates launch pairs in both directions and preserves the mount basenam
   await expect(page.locator('.oxa-workflow-submission-desktop')).toBeVisible();
   await expect(page).toHaveURL(
     new RegExp(
-      `${base}/admin/workflows/purchase-approval/new\\?source=todo#launch$`,
+      `${base}/workflows/purchase-approval/start\\?source=todo#launch$`,
     ),
   );
 });

package/template/apps/web/package.json

@@ -14,7 +14,7 @@
     "@ant-design/icons": "6.2.3",
     "@refinedev/core": "5.0.12",
     "antd": "6.4.3",
-    "openxiangda": "2.0.0-alpha.70",
+    "openxiangda": "2.0.0-alpha.72",
     "react": "19.2.8",
     "react-dom": "19.2.8",
     "react-router-dom": "7.8.2"

package/template/apps/web/src/main.tsx

@@ -16,6 +16,7 @@ import {
   authenticationSurfaces,
   anonymousPublicAccess,
   adminNavigation,
+  adminAccess,
   adminPages,
   resourceDefinitions,
   workflowDefinitions,
@@ -50,6 +51,7 @@ ReactDOM.createRoot(document.getElementById('root')!).render(
     <OpenXiangdaApplication
       appCode={appCode}
       appName={appName}
+      adminAccess={adminAccess}
       adminNavigation={adminNavigation}
       adminPages={adminPages}
       routeManifest={routeManifest}

package/template/apps/web/test/contracts.test.ts

@@ -102,7 +102,7 @@ test('published E2E harnesses do not write evidence into the platform source rep
   assert.doesNotMatch(workflowSource, /docs\/architecture|evidenceDirectory/);
 });
 
-test('E2E experience fixtures explicitly own every tested admin route', () => {
+test('E2E experience fixtures explicitly own every tested route', () => {
   const resourceFixture = readFileSync(
     new URL('../e2e/resource-experience-fixture.tsx', import.meta.url),
     'utf8'
@@ -121,7 +121,13 @@ test('E2E experience fixtures explicitly own every tested admin route', () => {
   assert.match(workflowFixture, /code: 'workflow:work-center'/);
   assert.match(workflowFixture, /code: 'workflow:task'/);
   assert.match(workflowFixture, /code: 'workflow:instance'/);
-  assert.match(workflowFixture, /pageCode: 'workflow:work-center'/);
+  assert.match(workflowFixture, /path: '\/work-center'/);
+  assert.match(workflowFixture, /path: '\/tasks\/:taskId'/);
+  assert.match(workflowFixture, /path: '\/workflows\/:instanceId'/);
+  assert.doesNotMatch(
+    workflowFixture,
+    /path: '\/(?:m\/)?admin\/(?:todos|work-center|tasks|workflows)/
+  );
 });
 
 test('browser acceptance serializes the prewarmed Vite HTML entrypoints', () => {

package/template/package.json

@@ -23,7 +23,7 @@
     "build": "pnpm --recursive build"
   },
   "devDependencies": {
-    "openxiangda": "2.0.0-alpha.70",
+    "openxiangda": "2.0.0-alpha.72",
     "typescript": "5.9.3"
   }
 }

package/template/packages/contracts/src/generated.ts

@@ -113,6 +113,7 @@ export const platformAuthManifest = {
     }
   ]
 } as const;
+export const adminAccess = undefined;
 export const routeManifest = {
   "schemaVersion": "openxiangda.application-route-manifest/v3",
   "appCode": "openxiangda-application",
@@ -165,6 +166,7 @@ export type ApplicationAuthenticationMethod = (typeof authenticationMethods)[num
 export type ApplicationAuthenticationSurface = (typeof authenticationSurfaces)[keyof typeof authenticationSurfaces];
 export type ApplicationAuthenticationSurfaceCode = ApplicationAuthenticationSurface["routeCode"];
 export type AnonymousPublicAccess = typeof anonymousPublicAccess;
+export type AdminAccess = typeof adminAccess;
 export type RouteManifest = typeof routeManifest;
 export type AdminPage = (typeof adminPages)[number];
 export type AdminNavigationGroup = (typeof adminNavigation)[number];