Release breaking OpenCloud CLI v2 SDK contract

CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 2.0.0
+
+- Make manifest schema 2 the only application contract. Projects now use
+  `runtime.sdk`, `files.access`, and Function `access`; schema-1 fields fail
+  with focused migration errors instead of being preserved or translated.
+- Vendor OpenCloud SDK 1.0.0 and generate apps that import the stable
+  `opencloud` singleton from `/_opencloud/sdk.js`.
+- Replace deployment and draft response aliases with the canonical
+  `sdkVersion` and `artifactFiles` fields, and expose the exact development
+  capability contract.
+- Generate a working SDK-connected starter with Files enabled and make
+  `app sdk-inspect` report only the stable SDK module and declarations paths.
+- Remove the partial local smoke, Chromium, session, and runtime-contract
+  verification commands. `app verify` is now the single authoritative release
+  gate.
+
 ## 1.0.0
 
 - Add reusable account login through an explicit browser approval flow with

README.md

@@ -12,12 +12,12 @@ offline source bundle, but cannot connect to or deploy through OpenCloud.
 
 ## Install a pinned release
 
-OpenCloud application skills pin an exact CLI release. To install `v1.0.0` in
+OpenCloud application skills pin an exact CLI release. To install `v2.0.0` in
 an isolated task directory:
 
 ```bash
-OPENCLOUD_CLI_VERSION="v1.0.0"
-OPENCLOUD_CLI_PACKAGE="opencloud-cli-1.0.0.tgz"
+OPENCLOUD_CLI_VERSION="v2.0.0"
+OPENCLOUD_CLI_PACKAGE="opencloud-cli-2.0.0.tgz"
 OPENCLOUD_CLI_DIR="$(mktemp -d)"
 
 curl -fsSLo "$OPENCLOUD_CLI_DIR/$OPENCLOUD_CLI_PACKAGE" \
@@ -79,10 +79,10 @@ user work safely across multiple app directories.
 "$OPENCLOUD_CLI" logout
 ```
 
-## Legacy passwordless project onboarding
+## Passwordless project onboarding
 
-The pre-1.0 email onboarding flow remains available for compatibility. New
-terminal workflows should use `login` and `app connect`.
+For a new project, agents can request passwordless onboarding directly. For an
+existing account, use `login` and `app connect`.
 
 Give the CLI the user's email and agreed project title:
 
@@ -163,7 +163,8 @@ Use the stable capability preview and isolated migration-replayed database befor
 ```
 
 Development data is isolated from production and uses dummy records. Auth,
-Storage, Realtime, cron, and production secrets are unavailable. Functions
+Files, and Functions are available; Realtime, cron, and production secrets are
+not. Functions
 imported from `@opencloud/server` remain dormant until `app dev invoke` or a
 deliberate preview interaction calls them. Exact-revision verification requires
 every declared Function to have a successful explicit invocation.
@@ -204,8 +205,9 @@ app-declared interaction contract on the server:
 "$OPENCLOUD_CLI" app verify "$APP_ID"
 ```
 
-The lower-level `app smoke` and `app verify-ui` commands remain diagnostic
-helpers for platform development; they are not substitutes for `app verify`.
+CLI v2 has one release-verification command. The former local smoke, Chromium,
+session, and verification-contract commands were removed so agents cannot
+mistake a partial diagnostic for the authoritative gate.
 
 ## Develop
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opencloud/cli",
-  "version": "1.0.0",
+  "version": "2.0.0",
   "description": "Versioned command-line client for building, deploying, and verifying OpenCloud applications",
   "type": "module",
   "bin": {
@@ -24,8 +24,7 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@napi-rs/keyring": "1.3.0",
-    "playwright": "1.62.0"
+    "@napi-rs/keyring": "1.3.0"
   },
   "devDependencies": {
     "@types/node": "26.1.2",

scripts/build.mjs

@@ -17,7 +17,7 @@ await build({
   target: "node22",
   sourcemap: false,
   legalComments: "none",
-  external: ["@napi-rs/keyring", "playwright"],
+  external: ["@napi-rs/keyring"],
   alias: {
     "@opencloud/contracts": path.join(
       root,

src/bundle.test.ts

@@ -25,7 +25,7 @@ async function writeManifest(root: string, body: string): Promise<void> {
   await writeFile(
     path.join(root, "opencloud.yaml"),
     `
-schemaVersion: 1
+schemaVersion: 2
 appId: aeea1c71-72a3-4b1d-a32e-213900735091
 version: test-1
 ${body.trim()}
@@ -45,7 +45,7 @@ describe("bundle builder", () => {
     await writeFile(path.join(root, "frontend", "index.html"), "hello");
     await writeFile(
       path.join(root, "frontend", "assets", "app.js"),
-      "const sdk = runtime.javascriptSdk.module; createOpenCloudClient(sdk);",
+      'import { opencloud } from "/_opencloud/sdk.js"; void opencloud.app.info();',
     );
     await writeFile(
       path.join(root, "migrations", "0001_notes.sql"),
@@ -88,8 +88,8 @@ functions:
     const first = await buildBundle(root);
     expect(first.manifest.migrations[0]?.sha256).toMatch(/^[a-f0-9]{64}$/);
     expect(first.manifest.runtime).toEqual({
-      javascriptSdk: {
-        version: "0.2.2",
+      sdk: {
+        version: "1.0.0",
       },
     });
     expect(first.files).toEqual([
@@ -199,7 +199,7 @@ functions: []
     expect(bundle.files).not.toContain("functions/forgotten/index.ts");
   });
 
-  it("preserves an explicit older SDK pin instead of replacing it with current", async () => {
+  it("preserves an explicit SDK pin instead of replacing it with current", async () => {
     const root = await temporaryDirectory();
     await mkdir(path.join(root, "frontend"));
     await writeFile(path.join(root, "frontend", "index.html"), "hello");
@@ -209,15 +209,15 @@ functions: []
 frontend:
   directory: frontend
 runtime:
-  javascriptSdk:
-    version: 0.2.0
+  sdk:
+    version: 9.8.7
 `,
     );
 
     const bundle = await buildBundle(root);
     expect(bundle.manifest.runtime).toEqual({
-      javascriptSdk: {
-        version: "0.2.0",
+      sdk: {
+        version: "9.8.7",
       },
     });
   });