openxiangda-cli 2.0.0-alpha.68 → 2.0.0-alpha.69

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda-cli",
-  "version": "2.0.0-alpha.68",
+  "version": "2.0.0-alpha.69",
   "description": "Thin application-level CLI for OpenXiangda 2.0.",
   "type": "module",
   "main": "./dist/index.js",
@@ -23,9 +23,9 @@
   ],
   "dependencies": {
     "@oclif/core": "4.13.3",
-    "openxiangda-contracts": "2.0.0-alpha.31",
-    "openxiangda-devkit-core": "2.0.0-alpha.41",
-    "openxiangda-mcp": "2.0.0-alpha.41"
+    "openxiangda-contracts": "2.0.0-alpha.32",
+    "openxiangda-devkit-core": "2.0.0-alpha.42",
+    "openxiangda-mcp": "2.0.0-alpha.42"
   },
   "devDependencies": {
     "tsx": "4.23.12",

package/template/AGENTS.md

@@ -1,8 +1,13 @@
-# Application development rules
+# OpenXiangda 2.0 Application Agent Contract
 
-- Build normal application code directly; generated Skills and historical templates are not design authority.
-- Keep CRUD in the replaceable browser Data API adapter under `/service`.
-- Put only real transactional or integration actions in Nest under `/api`.
-- Read current-user role/capability unions from the platform. UI guards are presentation only; server authorization is authoritative.
-- Use the declared `reference` mapping for members, departments, and related resources; persist stable IDs, not display labels.
-- Run `openxiangda check` before delivery.
+- Use only the workspace-pinned CLI: `pnpm openxiangda <command>`. Never invoke a bare global `openxiangda` inside a 2.0 task.
+- Use Vite, React Router, Refine Core and Ant Design. Do not add Umi, ProComponents or another admin shell.
+- Declare each resource once in `openxiangda.config.ts`. Resource codes are lower kebab-case. The same declaration owns storage, Surface metadata, permissions and generated AI Schema.
+- Ordinary list/get/create/update/delete, filters, export and batch operations use the platform Native Data API. Do not create Function CRUD or NestJS wrappers.
+- Add NestJS only for a named business action that needs a cross-resource transaction, an invariant or an external side effect.
+- A NestJS backend declares only `enabled`, `isolation: 'shared' | 'dedicated'` and `resourceProfile: 'light' | 'standard'`. Never put raw Kubernetes resources, replicas, ports or environment maps in application metadata; the platform owns capacity and scaling.
+- Use the current logged-in user and the union of application roles. Do not select RoleSession, persist platform Token or implement a second authorization path.
+- Declare restricted field read, create and update permissions explicitly. There is no `write` fallback; generated update permission is denied unless explicitly granted.
+- Desktop and mobile pages share values, validation and authorization, but use separate renderers. Members, departments, resources and attachments use platform-owned selectors and stable IDs.
+- Do not add compatibility aliases, migration branches or silent fallbacks for an earlier 2.0 alpha contract. Replace an incorrect contract and regenerate the application.
+- Run `pnpm openxiangda check` after contract changes. Deploy with `pnpm openxiangda deploy`, inspect with `pnpm openxiangda status` and `pnpm openxiangda logs`, and use the platform rollback command rather than mutating K3s directly.

package/template/README.md

@@ -3,10 +3,10 @@
 这是干净的资源 CRUD 模板：Vite + React Router + Refine Core + Ant Design 前端、NestJS 平台启动层，以及平台 Data/AuthZ 声明。
 
 ```bash
-openxiangda login --base-url https://platform.example.com
-openxiangda create visitor-reservations
+pnpm dlx openxiangda-cli@latest login --base-url https://platform.example.com
+pnpm dlx openxiangda-cli@latest create visitor-reservations
 cd visitor-reservations
-openxiangda dev
+pnpm openxiangda dev
 ```
 
 在 `platform/data` 中声明 `DataResource` 和字段即可生成标准后台列表、筛选、表单、详情、审计、文件上传和独立移动端页面。成员、部门和资源关系分别使用 `reference: { kind: 'directory-user' }`、`directory-department`、`resource`，只保存稳定 ID，不复制目录数据。
@@ -16,10 +16,10 @@ openxiangda dev
 前端读取平台 current-user 的角色/能力并集进行展示保护，服务端始终权威。字段策略区分 create/update；无权字段在提交前从 payload 删除。
 
 ```bash
-openxiangda check
-openxiangda deploy
-openxiangda status
-openxiangda logs
+pnpm openxiangda check
+pnpm openxiangda deploy
+pnpm openxiangda status
+pnpm openxiangda logs
 ```
 
 `deploy` 使用本模板的 `apps/server/Dockerfile` 自动构建并推送 `linux/amd64` 镜像，再把不可变 digest 写入 AppPackage。纯 CRUD 应用可以保持 backend disabled；复杂事务再启用 Nest。

package/template/apps/server/package.json

@@ -15,7 +15,7 @@
     "@nestjs/common": "11.1.29",
     "@nestjs/core": "11.1.29",
     "@nestjs/platform-fastify": "11.1.29",
-    "openxiangda-nest": "2.0.0-alpha.37",
+    "openxiangda-nest": "2.0.0-alpha.38",
     "reflect-metadata": "0.2.2",
     "rxjs": "7.8.2"
   },

package/template/apps/web/package.json

@@ -16,7 +16,7 @@
     "antd": "6.4.3",
     "dayjs": "1.11.18",
     "docx-preview": "0.3.7",
-    "openxiangda-contracts": "2.0.0-alpha.31",
+    "openxiangda-contracts": "2.0.0-alpha.32",
     "react": "19.2.8",
     "react-dom": "19.2.8",
     "react-router-dom": "7.8.2",

package/template/apps/web/scripts/check.mjs

@@ -6,26 +6,31 @@ const files = [];
 function visit(directory) {
   for (const entry of readdirSync(directory, { withFileTypes: true })) {
     const path = join(directory, entry.name);
-    if (
-      entry.isDirectory() &&
-      !['.umi', '.umi-production', '.turbopack'].includes(entry.name)
-    )
-      visit(path);
+    if (entry.isDirectory() && !['.umi', '.umi-production', '.turbopack'].includes(entry.name)) visit(path);
     else if (/\.(?:ts|tsx)$/.test(entry.name)) files.push(path);
   }
 }
 visit(join(root, 'src'));
-const lines = files.reduce(
-  (total, file) => total + readFileSync(file, 'utf8').split(/\r?\n/).length,
-  0
-);
+const lines = files.reduce((total, file) => total + readFileSync(file, 'utf8').split(/\r?\n/).length, 0);
 // The shared Surface renderer is deliberately counted as application source;
 // keep its small budget explicit instead of hiding it in generated output.
 if (files.length > 20) throw new Error(`WEB_SOURCE_FILE_BUDGET_EXCEEDED:${files.length}>20`);
-// Mobile shells, Surface filters, and generated resource CRUD are shared application infrastructure.
-if (lines > 5_600) throw new Error(`WEB_BUSINESS_LOC_BUDGET_EXCEEDED:${lines}>5600`);
-const source = files.map(file => readFileSync(file, 'utf8')).join('\n');
-for (const marker of ['@umijs/', 'openxiangda-' + 'admin', 'openxiangda-' + 'user', 'instrument_query', 'instrument_save', 'function.invoke', 'role' + '-session', 'college-' + 'am', 'user-' + 'wang', 'dept-' + 'am-test']) {
+// Mobile shells, Surface filters, generated resource CRUD, atomic batch actions,
+// and import preview are shared application infrastructure.
+if (lines > 6_000) throw new Error(`WEB_BUSINESS_LOC_BUDGET_EXCEEDED:${lines}>6000`);
+const source = files.map((file) => readFileSync(file, 'utf8')).join('\n');
+for (const marker of [
+  '@umijs/',
+  'openxiangda-' + 'admin',
+  'openxiangda-' + 'user',
+  'instrument_query',
+  'instrument_save',
+  'function.invoke',
+  'role' + '-session',
+  'college-' + 'am',
+  'user-' + 'wang',
+  'dept-' + 'am-test',
+]) {
   if (source.includes(marker)) throw new Error(`WEB_FORBIDDEN_MARKER:${marker}`);
 }
 const playwright = readFileSync(join(root, 'playwright.config.ts'), 'utf8');