openxiangda 2.0.0-alpha.26 → 2.0.0-alpha.27

package/dist/nest.d.ts

@@ -4,6 +4,6 @@
  * Applications receive only current-user-union, Perspective read projection,
  * application-principal, Data API, runtime, event and bounded operation APIs.
  */
-export { bootstrapOpenXiangdaApplication, OpenXiangdaModule, OpenXiangdaAuthzGuard, RequireCapability, OpenXiangdaOperation, CurrentPrincipal, CurrentUser, CurrentPerspective, currentUserFromVerifiedContext, currentUserFromPrincipal, CurrentApplicationPrincipal, OpenXiangdaDataApiService, OpenXiangdaBusinessDataApiService, OpenXiangdaApplicationDataApiService, OpenXiangdaApplicationCredentials, OpenXiangdaRuntimeLeaseService, OpenXiangdaRuntimeSecrets, OpenXiangdaStandardOperations, OpenXiangdaEventContext, OpenXiangdaEventHandler, OpenXiangdaEventRegistry, OpenXiangdaEventRetryableError, OpenXiangdaEventDeterministicError, eventSigningSecretsFromEnvironment, assertValidTimeInterval, idempotentTransaction, } from 'openxiangda-nest';
-export type { OpenXiangdaApplicationBootstrapOptions, OpenXiangdaModuleOptions, OpenXiangdaOAuthClientOptions, OpenXiangdaFetch, OpenXiangdaCurrentUser, OpenXiangdaServicePrincipal, OpenXiangdaConnectedDevelopmentStatus, OpenXiangdaDomainEventEmitInput, OpenXiangdaDomainEventEmitResult, OpenXiangdaBusinessActionContext, OpenXiangdaRuntimeLeaseState, OpenXiangdaEventHandlerContext, OpenXiangdaEventHandlerDeclaration, OpenXiangdaEventConsumer, TimeInterval, MeetingReservationOperationInput, CourseSelectionOperationInput, VisitorReservationOperationInput, } from 'openxiangda-nest';
+export { bootstrapOpenXiangdaApplication, OpenXiangdaModule, OpenXiangdaAuthzGuard, RequireCapability, OpenXiangdaOperation, CurrentPrincipal, CurrentUser, CurrentPerspective, currentUserFromVerifiedContext, currentUserFromPrincipal, CurrentApplicationPrincipal, OpenXiangdaDataApiService, OpenXiangdaBusinessDataApiService, OpenXiangdaBusinessNotificationService, OpenXiangdaNotificationService, OpenXiangdaApplicationDataApiService, OpenXiangdaApplicationCredentials, OpenXiangdaRuntimeLeaseService, OpenXiangdaRuntimeSecrets, OpenXiangdaStandardOperations, OpenXiangdaEventContext, OpenXiangdaEventHandler, OpenXiangdaEventRegistry, OpenXiangdaEventRetryableError, OpenXiangdaEventDeterministicError, eventSigningSecretsFromEnvironment, assertValidTimeInterval, idempotentTransaction, } from 'openxiangda-nest';
+export type { OpenXiangdaApplicationBootstrapOptions, OpenXiangdaModuleOptions, OpenXiangdaOAuthClientOptions, OpenXiangdaFetch, OpenXiangdaCurrentUser, OpenXiangdaServicePrincipal, OpenXiangdaConnectedDevelopmentStatus, OpenXiangdaDomainEventEmitInput, OpenXiangdaDomainEventEmitResult, OpenXiangdaBusinessActionContext, OpenXiangdaBusinessNotificationInput, OpenXiangdaEventBusinessNotificationInput, OpenXiangdaRuntimeLeaseState, OpenXiangdaEventHandlerContext, OpenXiangdaEventHandlerDeclaration, OpenXiangdaEventConsumer, TimeInterval, MeetingReservationOperationInput, CourseSelectionOperationInput, VisitorReservationOperationInput, } from 'openxiangda-nest';
 //# sourceMappingURL=nest.d.ts.map

package/dist/nest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nest.d.ts","sourceRoot":"","sources":["../src/nest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,+BAA+B,EAC/B,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACX,kBAAkB,EAClB,8BAA8B,EAC9B,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,iCAAiC,EACjC,oCAAoC,EACpC,iCAAiC,EACjC,8BAA8B,EAC9B,yBAAyB,EACzB,6BAA6B,EAC7B,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,kCAAkC,EAClC,kCAAkC,EAClC,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EACV,sCAAsC,EACtC,wBAAwB,EACxB,6BAA6B,EAC7B,gBAAgB,EAChB,sBAAsB,EACtB,2BAA2B,EAC3B,qCAAqC,EACrC,+BAA+B,EAC/B,gCAAgC,EAChC,gCAAgC,EAChC,4BAA4B,EAC5B,8BAA8B,EAC9B,kCAAkC,EAClC,wBAAwB,EACxB,YAAY,EACZ,gCAAgC,EAChC,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"nest.d.ts","sourceRoot":"","sources":["../src/nest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,+BAA+B,EAC/B,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACX,kBAAkB,EAClB,8BAA8B,EAC9B,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,iCAAiC,EACjC,sCAAsC,EACtC,8BAA8B,EAC9B,oCAAoC,EACpC,iCAAiC,EACjC,8BAA8B,EAC9B,yBAAyB,EACzB,6BAA6B,EAC7B,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,kCAAkC,EAClC,kCAAkC,EAClC,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EACV,sCAAsC,EACtC,wBAAwB,EACxB,6BAA6B,EAC7B,gBAAgB,EAChB,sBAAsB,EACtB,2BAA2B,EAC3B,qCAAqC,EACrC,+BAA+B,EAC/B,gCAAgC,EAChC,gCAAgC,EAChC,oCAAoC,EACpC,yCAAyC,EACzC,4BAA4B,EAC5B,8BAA8B,EAC9B,kCAAkC,EAClC,wBAAwB,EACxB,YAAY,EACZ,gCAAgC,EAChC,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,kBAAkB,CAAC"}

package/dist/nest.js

@@ -4,5 +4,5 @@
  * Applications receive only current-user-union, Perspective read projection,
  * application-principal, Data API, runtime, event and bounded operation APIs.
  */
-export { bootstrapOpenXiangdaApplication, OpenXiangdaModule, OpenXiangdaAuthzGuard, RequireCapability, OpenXiangdaOperation, CurrentPrincipal, CurrentUser, CurrentPerspective, currentUserFromVerifiedContext, currentUserFromPrincipal, CurrentApplicationPrincipal, OpenXiangdaDataApiService, OpenXiangdaBusinessDataApiService, OpenXiangdaApplicationDataApiService, OpenXiangdaApplicationCredentials, OpenXiangdaRuntimeLeaseService, OpenXiangdaRuntimeSecrets, OpenXiangdaStandardOperations, OpenXiangdaEventContext, OpenXiangdaEventHandler, OpenXiangdaEventRegistry, OpenXiangdaEventRetryableError, OpenXiangdaEventDeterministicError, eventSigningSecretsFromEnvironment, assertValidTimeInterval, idempotentTransaction, } from 'openxiangda-nest';
+export { bootstrapOpenXiangdaApplication, OpenXiangdaModule, OpenXiangdaAuthzGuard, RequireCapability, OpenXiangdaOperation, CurrentPrincipal, CurrentUser, CurrentPerspective, currentUserFromVerifiedContext, currentUserFromPrincipal, CurrentApplicationPrincipal, OpenXiangdaDataApiService, OpenXiangdaBusinessDataApiService, OpenXiangdaBusinessNotificationService, OpenXiangdaNotificationService, OpenXiangdaApplicationDataApiService, OpenXiangdaApplicationCredentials, OpenXiangdaRuntimeLeaseService, OpenXiangdaRuntimeSecrets, OpenXiangdaStandardOperations, OpenXiangdaEventContext, OpenXiangdaEventHandler, OpenXiangdaEventRegistry, OpenXiangdaEventRetryableError, OpenXiangdaEventDeterministicError, eventSigningSecretsFromEnvironment, assertValidTimeInterval, idempotentTransaction, } from 'openxiangda-nest';
 //# sourceMappingURL=nest.js.map

package/dist/nest.js.map

@@ -1 +1 @@
-{"version":3,"file":"nest.js","sourceRoot":"","sources":["../src/nest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,+BAA+B,EAC/B,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACX,kBAAkB,EAClB,8BAA8B,EAC9B,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,iCAAiC,EACjC,oCAAoC,EACpC,iCAAiC,EACjC,8BAA8B,EAC9B,yBAAyB,EACzB,6BAA6B,EAC7B,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,kCAAkC,EAClC,kCAAkC,EAClC,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"nest.js","sourceRoot":"","sources":["../src/nest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,+BAA+B,EAC/B,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACX,kBAAkB,EAClB,8BAA8B,EAC9B,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,iCAAiC,EACjC,sCAAsC,EACtC,8BAA8B,EAC9B,oCAAoC,EACpC,iCAAiC,EACjC,8BAA8B,EAC9B,yBAAyB,EACzB,6BAA6B,EAC7B,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,kCAAkC,EAClC,kCAAkC,EAClC,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "2.0.0-alpha.26",
+  "version": "2.0.0-alpha.27",
   "description": "Unified OpenXiangda 2.0 CLI, SDK, React runtime, NestJS integration and AI skill distribution.",
   "type": "module",
   "main": "./dist/index.js",
@@ -49,12 +49,12 @@
   "dependencies": {
     "dayjs": "1.11.18",
     "docx-preview": "0.3.7",
-    "openxiangda-cli": "2.0.0-alpha.113",
-    "openxiangda-contracts": "2.0.0-alpha.54",
-    "openxiangda-devkit-core": "2.0.0-alpha.71",
-    "openxiangda-mcp": "2.0.0-alpha.71",
-    "openxiangda-nest": "2.0.0-alpha.65",
-    "openxiangda-skill-kit": "2.0.0-alpha.89",
+    "openxiangda-cli": "2.0.0-alpha.114",
+    "openxiangda-contracts": "2.0.0-alpha.55",
+    "openxiangda-devkit-core": "2.0.0-alpha.72",
+    "openxiangda-mcp": "2.0.0-alpha.72",
+    "openxiangda-nest": "2.0.0-alpha.66",
+    "openxiangda-skill-kit": "2.0.0-alpha.90",
     "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz"
   },
   "peerDependencies": {

package/skills/manifest.json

@@ -4,7 +4,7 @@
     {
       "name": "openxiangda-v2",
       "description": "Use when researching, designing, building, testing, or delivering a complete OpenXiangda 2.0 application.",
-      "sha256": "08bd64cb7f0dee4889fd34e9081b3b01dcafa714273c51bae57ee9e22ccfcf9e"
+      "sha256": "98417ad9a7d8f02cc88435d4642ba12f345dee9f9e455133efe3b124e40fdb75"
     }
   ]
 }

package/skills/openxiangda-v2/SKILL.md

@@ -10,14 +10,14 @@ Treat requirement discovery, architecture, authorization, development, testing a
 Before a workspace exists, use this Skill's exact npm version:
 
 ```bash
-pnpm dlx openxiangda@2.0.0-alpha.26 login --base-url <platform>
-pnpm dlx openxiangda@2.0.0-alpha.26 create <directory>
+pnpm dlx openxiangda@2.0.0-alpha.27 login --base-url <platform>
+pnpm dlx openxiangda@2.0.0-alpha.27 create <directory>
 ```
 
 Inside an application, use only its locked executable through `pnpm openxiangda`. Never invoke a bare global `openxiangda`, because that executable may belong to stable 1.x. Moving tags such as `latest` and `alpha` are forbidden. To install or refresh this same Skill from the package, run:
 
 ```bash
-pnpm dlx openxiangda@2.0.0-alpha.26 skill install --force
+pnpm dlx openxiangda@2.0.0-alpha.27 skill install --force
 ```
 
 Use this order:

package/skills/openxiangda-v2/references/backend.md

@@ -7,13 +7,96 @@ Keep normal record CRUD in the platform Data API. Use `apps/server` only for typ
 
 Every interactive business action uses `@OpenXiangdaOperation(operation)`. The
 guard checks `operation.requiredCapability` once at App API ingress. Inside that
-declared action, inject `OpenXiangdaBusinessDataApiService` or use
-`OpenXiangdaStandardOperations`: Native Data then runs as the trusted backend
+declared action, inject `OpenXiangdaBusinessDataApiService`,
+`OpenXiangdaBusinessNotificationService`, or use
+`OpenXiangdaStandardOperations`: Native Data and Notification Hub then run as the trusted backend
 for this exact application, environment, version and operation. Do not forward
 the caller's resource, row or field permissions into that internal Data call,
 and do not author an `authorizationJSON` permission mirror. The platform still
 records the initiating user and action code in records, files, events and audit.
 
+For an informational business notification, inject
+`OpenXiangdaBusinessNotificationService` in the same declared action. The SDK
+uses the short-lived gateway invocation, never the caller's original login
+token. The platform rechecks the operation and capability, promotes the call to
+the exact application/environment principal, and records the initiating user
+and action. Do not grant ordinary users `app:notification2:send` and do not use
+the privileged `OpenXiangdaNotificationService` as an application workaround.
+
+```ts
+import { Inject } from '@nestjs/common';
+import {
+  OPENXIANGDA_NOTIFICATION_BUSINESS_SEND_V2,
+  OPENXIANGDA_NOTIFICATION_EVENT_SEND_V2,
+} from 'openxiangda/contracts';
+import {
+  OpenXiangdaBusinessNotificationService,
+} from 'openxiangda/nest';
+
+constructor(
+  @Inject(OpenXiangdaBusinessNotificationService)
+  private readonly notifications: OpenXiangdaBusinessNotificationService,
+) {}
+
+await this.notifications.send({
+  schemaVersion: OPENXIANGDA_NOTIFICATION_BUSINESS_SEND_V2,
+  eventId: body.eventId,
+  correlationId: `proposal:${proposal.id}`,
+  messageKey: `proposal:${proposal.id}:invite:${member.id}`,
+  sourceSequence: proposal.revision,
+  recipients: [{ userId: member.userId }],
+  title: '待您附议',
+  summary: proposal.title,
+  navigationTarget: {
+    kind: 'APP_ROUTE',
+    appCode: 'proposal_app',
+    routeCode: 'proposal.detail',
+    pathParams: { id: proposal.id },
+    access: 'AUTHENTICATED',
+  },
+  idempotencyKey: `proposal:${proposal.id}:invite:${member.id}:v${proposal.revision}`,
+});
+
+```
+
+The fixed template accepts only `title` and optional `summary`. Reuse the same
+`eventId` or `idempotencyKey` for retries. Reuse `messageKey` with increasing
+`sourceSequence` for state convergence; do not generate a new logical message
+for each retry.
+
+The generated
+`notificationTemplateCodes.applicationInformational` constant documents the
+selected platform template; `send()` chooses it automatically and does not
+accept a caller-supplied template code.
+
+Inside a signed Application Events/date-trigger handler, call
+`sendFromEvent()` on the same service. The SDK obtains the application
+credential and forwards the current eventId, deliveryId and subscription code.
+Declare only dot paths beneath the immutable event `data`; Notification Hub
+resolves the actual Native user IDs and presentation text. Do not copy values
+from the event into a caller-supplied `recipients` array and never manufacture a
+user token.
+
+```ts
+await this.notifications.sendFromEvent({
+  schemaVersion: OPENXIANGDA_NOTIFICATION_EVENT_SEND_V2,
+  correlationId: `proposal:${event.data.proposalId}`,
+  messageKey: `proposal:${event.data.proposalId}:reminder`,
+  sourceSequence: event.data.revision,
+  recipientPaths: ['assigneeUserIds'],
+  titlePath: 'notification.title',
+  summaryPath: 'notification.summary',
+  navigationTarget: {
+    kind: 'APP_ROUTE',
+    appCode: 'proposal_app',
+    routeCode: 'proposal.detail',
+    pathParams: { id: event.data.proposalId },
+    access: 'AUTHENTICATED',
+  },
+  idempotencyKey: event.id,
+});
+```
+
 `OpenXiangdaDataApiService` deliberately retains ordinary current-user Data
 authorization and automatically inherits the request Perspective for reads.
 Its writes still authorize against the complete role union. Do not use it to

package/skills/openxiangda-v2/references/workflow-events.md

@@ -11,6 +11,7 @@ Use these optional modules only when the application has a real standard approva
 - Workflow Kernel v2 owns definitions, instances, tasks, participants, commands, transitions and audit facts.
 - Application Events v2 owns durable facts and delivery.
 - Notification Hub v2 owns templates, rules, logical messages, channel delivery, callbacks and message operations.
+- Named Action business notifications use `OpenXiangdaBusinessNotificationService` and the platform-owned `application.informational.standard` template. App Gateway authorizes the current user once; Notification Hub revalidates the action proof, sends as the application principal, and retains initiating user/action audit. Ordinary users never need `app:notification2:send`.
 - Native Identity/AuthZ v2 owns the current user and the union of that user's current application roles. Perspective is read-only and never changes workflow participation or action authorization.
 - Never import, query, migrate or call 1.x workflow/message code, tables, APIs, queues, templates or callbacks.
 
@@ -47,6 +48,22 @@ A node may reference a notification profile that selects:
 
 Template variables must be declared by JSON Schema and stay within the field policy visible to the recipient. The Notification Hub does not query arbitrary application tables to complete a template.
 
+For a non-Workflow informational message, the public business contract accepts
+only `title`, optional `summary`, recipients and a canonical navigation target.
+Supply stable `eventId`, `idempotencyKey`, `messageKey` and monotonic
+`sourceSequence`: duplicate events and idempotency keys replay the stored
+message, while a later source sequence converges the same logical message.
+Never forward a user token, application credential or global Notification Hub
+permission from application code.
+
+A signed event/date-trigger consumer uses
+`OpenXiangdaBusinessNotificationService.sendFromEvent()`. The application
+declares safe paths under event `data` for recipients, title and summary;
+Notification Hub verifies the active durable delivery and resolves those paths
+itself. The audit actor remains the application event consumer with eventId,
+deliveryId and subscription code as initiating source. Missing or forged event
+proof, arbitrary recipient values and user impersonation are rejected.
+
 ## Detail navigation
 
 Use a canonical navigation target with `PLATFORM_ROUTE`, `APP_ROUTE` or allowlisted `EXTERNAL_URL`, stable route code, path/query parameters and an authenticated access requirement. Do not place environment domains, bearer tokens, cookies, identity-switching credentials or secrets in template strings.

package/skills/openxiangda-v2/references/workspace.md

@@ -8,7 +8,7 @@
 - Never write resource-level `schemaVersion`, `appCode`, `schema`, `surface`, `capabilities`, `fieldPolicies` or `platform/data` modules. The compiler derives the strict DataResource, CRUD capabilities, Surface and AI Schema. The application manifest still starts with its one top-level `schemaVersion: 3`.
 - Ordinary list/get/create/update/delete, filters, export and batch operations use the platform Native Data API. Do not create Function CRUD or NestJS wrappers.
 - Add NestJS only for a named business action that needs a cross-resource transaction, an invariant or an external side effect.
-- Every interactive business action binds `@OpenXiangdaOperation(operation)` and injects `OpenXiangdaBusinessDataApiService` or `OpenXiangdaStandardOperations`. The platform checks the action capability once at App API ingress; the trusted backend then has full Data access only to its exact application/environment while audit retains the initiating user. Do not author `authorizationJSON` or reapply the user's resource, row and field permissions inside the action.
+- Every interactive business action binds `@OpenXiangdaOperation(operation)` and injects `OpenXiangdaBusinessDataApiService`, `OpenXiangdaBusinessNotificationService`, or `OpenXiangdaStandardOperations`. The platform checks the action capability once at App API ingress; the trusted backend then has full Data/managed business-notification access only to its exact application/environment while audit retains the initiating user and action. Do not author `authorizationJSON`, forward user tokens, grant ordinary users `app:notification2:send`, or reapply the user's resource, row and field permissions inside the action.
 - A NestJS backend declares only `enabled`, `isolation: 'shared' | 'dedicated'` and `resourceProfile: 'light' | 'standard'`. Never put raw Kubernetes resources, replicas, ports or environment maps in application metadata; the platform owns capacity and scaling.
 - Use the current logged-in user and the union of that user's application roles. An optional declared Perspective projects only read visibility (pages, rows and fields); create/update/delete, workflows and custom actions continue to authorize against the complete union. Standard Data API calls inherit `X-OpenXiangda-Perspective` automatically. Use `@CurrentPerspective()` only when custom Nest code reads outside the standard Data API, and apply an equivalent read projection explicitly. Business code must not persist a platform Token or authorization result and must not implement a second identity path.
 - Fields inherit the resource read/create/update capabilities. Use field `access` only to tighten them; arrays are all-of and `false` is explicit deny. There is no `write` fallback.