openxiangda 1.0.148 → 1.0.150

package/packages/sdk/dist/runtime/index.mjs

@@ -667,6 +667,17 @@ var createPageSdk = (context) => {
       throw toSdkError(error, payload);
     }
   };
+  const createFileAccessTicket = (bucketName, objectName, fileName, action = "preview", options = {}) => request({
+    path: "/file/access-ticket",
+    method: "post",
+    body: {
+      bucketName,
+      objectName,
+      fileName,
+      action,
+      appType: resolveAppType(context, options.appType)
+    }
+  });
   const logout = () => request({
     path: "/api/auth/logout",
     method: "post"
@@ -1952,6 +1963,7 @@ var createPageSdk = (context) => {
     context,
     request,
     download,
+    createFileAccessTicket,
     transport: {
       request,
       download
@@ -5543,14 +5555,14 @@ var useAuth = (options = {}) => {
     () => createAuthClient({
       appType: options.appType || runtime.appType,
       servicePrefix: options.servicePrefix || runtime.servicePrefix,
-      fetchImpl: options.fetchImpl || runtime.fetchImpl
+      fetchImpl: options.fetchImpl || runtime.baseFetchImpl
     }),
     [
       options.appType,
       options.fetchImpl,
       options.servicePrefix,
       runtime.appType,
-      runtime.fetchImpl,
+      runtime.baseFetchImpl,
       runtime.servicePrefix
     ]
   );
@@ -5829,7 +5841,19 @@ var LoginPage = ({
   };
   async function handleSuccess(data) {
     await onSuccess?.(data);
-    await runtime.reload();
+    const accessToken = data.accessToken || data.token;
+    const accessTokenOptions = {
+      expiresAt: data.accessTokenExpiresAt
+    };
+    if (accessToken) {
+      runtime.setAccessToken(accessToken, accessTokenOptions);
+    }
+    await runtime.reload(
+      accessToken ? {
+        accessToken,
+        accessTokenOptions
+      } : void 0
+    );
     if (redirectOnSuccess && typeof window !== "undefined") {
       window.location.replace(
         redirectUrl || getCallbackUrl() || `/view/${auth.client.appType}`
@@ -6113,27 +6137,125 @@ var OpenXiangdaProvider = ({
     () => appType || resolveAppTypeFromLocation(),
     [appType]
   );
-  const [accessToken, setAccessTokenState] = useState9(null);
+  const [, setAccessTokenState] = useState9(null);
+  const [authState, setAuthState] = useState9({
+    status: "unknown",
+    error: null
+  });
   const accessTokenRef = useRef5(null);
-  const setAccessToken = useCallback8(
+  const refreshRequestRef = useRef5(null);
+  const applyAccessToken = useCallback8(
     (nextAccessToken, options = {}) => {
       if (!nextAccessToken && options.clearIfToken && accessTokenRef.current?.token !== options.clearIfToken) {
-        return;
+        return accessTokenRef.current;
       }
       const normalizedAccessToken = nextAccessToken || null;
       const nextState = normalizedAccessToken ? {
         token: normalizedAccessToken,
         scope: options.scope || "default",
-        path: options.path || null
+        path: options.path || null,
+        expiresAt: options.expiresAt
       } : null;
       accessTokenRef.current = nextState;
       setAccessTokenState(nextState);
+      return nextState;
     },
     []
   );
+  const setAccessToken = useCallback8(
+    (nextAccessToken, options = {}) => {
+      const previousState = accessTokenRef.current;
+      const nextState = applyAccessToken(nextAccessToken, options);
+      if (nextState) {
+        if (nextState.scope === "public") return;
+        setAuthState({
+          status: "authenticated",
+          error: null
+        });
+      } else if (previousState?.scope !== "public") {
+        setAuthState({ status: "unauthenticated", error: null });
+      }
+    },
+    [applyAccessToken]
+  );
+  const markUnauthenticated = useCallback8(
+    (error) => {
+      const runtimeError = normalizeRuntimeError(error);
+      applyAccessToken(null);
+      setAuthState({ status: "unauthenticated", error: runtimeError });
+    },
+    [applyAccessToken]
+  );
+  const refreshAccessToken = useCallback8(async () => {
+    if (!resolvedAppType) return null;
+    if (!refreshRequestRef.current) {
+      setAuthState((prev) => ({ ...prev, status: "refreshing", error: null }));
+      refreshRequestRef.current = (async () => {
+        const response = await resolvedFetch(
+          buildServiceUrl3(
+            servicePrefix,
+            `/openxiangda-api/v1/apps/${encodeURIComponent(
+              resolvedAppType
+            )}/auth/refresh`
+          ),
+          {
+            method: "POST",
+            credentials: "include",
+            headers: {
+              accept: "application/json",
+              "content-type": "application/json"
+            },
+            body: "{}"
+          }
+        );
+        const payload = await readJsonPayload(response);
+        if (isRuntimeEnvelopeFailure(response, payload)) {
+          throw createRuntimeHttpError(
+            response,
+            payload,
+            payload?.message || `Token refresh failed: ${response.status}`
+          );
+        }
+        const data = unwrapRuntimePayload(payload);
+        const nextAccessToken = getRecordString(data, "accessToken") || getRecordString(data, "token");
+        if (!nextAccessToken) {
+          throw createRuntimeError({
+            type: "unauthenticated",
+            status: response.status,
+            code: getRecordValue3(payload, "code"),
+            message: "Token refresh response missing accessToken",
+            payload
+          });
+        }
+        const nextState = applyAccessToken(nextAccessToken, {
+          expiresAt: getRecordNumber(data, "accessTokenExpiresAt")
+        });
+        setAuthState({
+          status: "authenticated",
+          error: null,
+          refreshedAt: Date.now()
+        });
+        return nextState;
+      })().catch((error) => {
+        const runtimeError = normalizeRuntimeError(error);
+        applyAccessToken(null);
+        setAuthState({ status: "unauthenticated", error: runtimeError });
+        throw runtimeError;
+      }).finally(() => {
+        refreshRequestRef.current = null;
+      });
+    }
+    return refreshRequestRef.current;
+  }, [applyAccessToken, resolvedAppType, resolvedFetch, servicePrefix]);
   const authorizedFetch = useMemo11(
-    () => createAuthorizedFetch(resolvedFetch, accessToken),
-    [accessToken, resolvedFetch]
+    () => createAuthorizedFetch({
+      appType: resolvedAppType,
+      baseFetch: resolvedFetch,
+      accessTokenRef,
+      markUnauthenticated,
+      refreshAccessToken
+    }),
+    [markUnauthenticated, refreshAccessToken, resolvedAppType, resolvedFetch]
   );
   const getAuthHeaders = useCallback8(() => {
     const state2 = accessTokenRef.current;
@@ -6159,13 +6281,13 @@ var OpenXiangdaProvider = ({
       return;
     }
     setState((prev) => ({ ...prev, loading: true, error: null }));
-    const requestFetch = options.accessToken !== void 0 ? createAuthorizedFetch(
+    const requestFetch = options.accessToken !== void 0 ? createAccessTokenFetch(
       resolvedFetch,
       createAccessTokenState(
         options.accessToken || null,
         options.accessTokenOptions
       )
-    ) : createAuthorizedFetch(resolvedFetch, accessTokenRef.current);
+    ) : authorizedFetch;
     try {
       const response = await requestFetch(
         buildServiceUrl3(
@@ -6187,19 +6309,29 @@ var OpenXiangdaProvider = ({
           payload?.message || `Runtime bootstrap failed: ${response.status}`
         );
       }
+      const nextData = payload?.data || null;
       setState({
-        data: payload?.data || null,
+        data: nextData,
         loading: false,
         error: null
       });
+      if (isAuthenticatedBootstrap(nextData)) {
+        setAuthState(
+          (prev) => prev.status === "authenticated" ? prev : { status: "authenticated", error: null }
+        );
+      }
     } catch (error) {
+      const runtimeError = normalizeRuntimeError(error);
       setState({
         data: null,
         loading: false,
-        error: normalizeRuntimeError(error)
+        error: runtimeError
       });
+      if (runtimeError.type === "unauthenticated") {
+        setAuthState({ status: "unauthenticated", error: runtimeError });
+      }
     }
-  }, [resolvedAppType, resolvedFetch, servicePrefix]);
+  }, [authorizedFetch, resolvedAppType, resolvedFetch, servicePrefix]);
   useEffect9(() => {
     void reload();
   }, [reload]);
@@ -6210,6 +6342,7 @@ var OpenXiangdaProvider = ({
       servicePrefix,
       fetchImpl: authorizedFetch,
       baseFetchImpl: resolvedFetch,
+      authState,
       getAuthHeaders,
       reload,
       setAccessToken
@@ -6221,7 +6354,8 @@ var OpenXiangdaProvider = ({
       resolvedAppType,
       resolvedFetch,
       servicePrefix,
-      state
+      state,
+      authState
     ]
   );
   return /* @__PURE__ */ jsx10(OpenXiangdaRuntimeContext.Provider, { value, children });
@@ -6488,7 +6622,7 @@ var useRuntimeAuth = () => {
           buildServiceUrl3(runtime.servicePrefix, "/api/sso/status"),
           { domain }
         );
-        const statusResponse = await runtime.fetchImpl(statusUrl, {
+        const statusResponse = await runtime.baseFetchImpl(statusUrl, {
           credentials: "include",
           headers: { accept: "application/json" }
         });
@@ -6499,7 +6633,7 @@ var useRuntimeAuth = () => {
           enabled && (sso.forceLogin ?? sso.autoRedirect ?? true)
         );
         if (shouldUseSso) {
-          const loginUrlResponse = await runtime.fetchImpl(
+          const loginUrlResponse = await runtime.baseFetchImpl(
             withQuery(buildServiceUrl3(runtime.servicePrefix, "/api/sso/login-url"), {
               domain,
               redirectUri,
@@ -6523,7 +6657,7 @@ var useRuntimeAuth = () => {
       }
       return attachCallback("/platform/login", redirectUri);
     },
-    [runtime.data?.app, runtime.fetchImpl, runtime.servicePrefix]
+    [runtime.baseFetchImpl, runtime.data?.app, runtime.servicePrefix]
   );
   const redirectToLogin = useCallback8(
     async (options = {}) => {
@@ -6540,7 +6674,7 @@ var useRuntimeAuth = () => {
     [resolveLoginUrl2]
   );
   const logout = useCallback8(async () => {
-    const response = await runtime.fetchImpl(
+    const response = await runtime.baseFetchImpl(
       buildServiceUrl3(runtime.servicePrefix, "/api/auth/logout"),
       {
         method: "POST",
@@ -6556,8 +6690,9 @@ var useRuntimeAuth = () => {
         payload?.message || `Logout failed: ${response.status}`
       );
     }
+    runtime.setAccessToken(null);
     return payload;
-  }, [runtime.fetchImpl, runtime.servicePrefix]);
+  }, [runtime.baseFetchImpl, runtime.servicePrefix, runtime.setAccessToken]);
   const logoutAndRedirect = useCallback8(
     async (options = {}) => {
       try {
@@ -6576,12 +6711,83 @@ var useRuntimeAuth = () => {
     resolveLoginUrl: resolveLoginUrl2
   };
 };
+var RuntimeAuthGuard = ({
+  children,
+  fallback = null,
+  disabled = false,
+  excludedPaths = [],
+  ...redirectOptions
+}) => {
+  const runtime = useOpenXiangda();
+  const auth = useRuntimeAuth();
+  const redirectedRef = useRef5(false);
+  const currentPath = getCurrentPathname2();
+  const excluded = isRuntimeAuthGuardExcluded(
+    currentPath,
+    runtime.appType,
+    excludedPaths
+  );
+  const shouldRedirect = !disabled && !excluded && !runtime.loading && (runtime.authState.status === "unauthenticated" || runtime.error?.type === "unauthenticated");
+  useEffect9(() => {
+    if (!shouldRedirect || redirectedRef.current) return;
+    redirectedRef.current = true;
+    void auth.redirectToLogin({
+      ...redirectOptions,
+      redirectUri: redirectOptions.redirectUri || getCurrentHref4()
+    }).catch(() => {
+      redirectedRef.current = false;
+    });
+  }, [
+    auth,
+    redirectOptions.domain,
+    redirectOptions.loginUrl,
+    redirectOptions.redirectUri,
+    redirectOptions.replace,
+    shouldRedirect
+  ]);
+  if (excluded) return /* @__PURE__ */ jsx10(Fragment5, { children });
+  if (shouldRedirect) return /* @__PURE__ */ jsx10(Fragment5, { children: fallback });
+  return /* @__PURE__ */ jsx10(Fragment5, { children });
+};
 var buildServiceUrl3 = (servicePrefix, path) => {
   const prefix = servicePrefix.endsWith("/") ? servicePrefix.slice(0, -1) : servicePrefix;
   const suffix = path.startsWith("/") ? path : `/${path}`;
   return `${prefix}${suffix}`;
 };
-var createAuthorizedFetch = (baseFetch, accessToken) => {
+var createAuthorizedFetch = ({
+  appType,
+  baseFetch,
+  accessTokenRef,
+  refreshAccessToken,
+  markUnauthenticated
+}) => (async (input, init = {}) => {
+  const currentTokenState = accessTokenRef.current;
+  const response = await createAccessTokenFetch(
+    baseFetch,
+    currentTokenState
+  )(input, init);
+  if (!shouldAttemptAuthRefresh({
+    appType,
+    input,
+    init,
+    tokenState: currentTokenState
+  })) {
+    return response;
+  }
+  if (!await isUnauthenticatedResponse(response)) return response;
+  try {
+    const refreshedTokenState = await refreshAccessToken();
+    if (!refreshedTokenState) return response;
+    return await createAccessTokenFetch(
+      baseFetch,
+      refreshedTokenState
+    )(input, init);
+  } catch (error) {
+    markUnauthenticated(error);
+    return response;
+  }
+});
+var createAccessTokenFetch = (baseFetch, accessToken) => {
   if (!accessToken) return baseFetch;
   return ((input, init = {}) => {
     const token = resolveAccessTokenForCurrentRoute(accessToken);
@@ -6599,8 +6805,53 @@ var createAuthorizedFetch = (baseFetch, accessToken) => {
 var createAccessTokenState = (accessToken, options = {}) => accessToken ? {
   token: accessToken,
   scope: options.scope || "default",
-  path: options.path || null
+  path: options.path || null,
+  expiresAt: options.expiresAt
 } : null;
+var shouldAttemptAuthRefresh = ({
+  appType,
+  input,
+  init,
+  tokenState
+}) => {
+  if (!appType) return false;
+  if (tokenState?.scope === "public") return false;
+  if (isPublicRoutePath(normalizeRoutePath(getCurrentPathname2()))) return false;
+  if (hasAuthorizationHeader(init?.headers)) return false;
+  const pathname = getFetchInputPathname(input);
+  if (!pathname) return false;
+  if (/\/openxiangda-api\/v1\/apps\/[^/]+\/auth(?:\/|$)/.test(pathname)) {
+    return false;
+  }
+  if (/\/openxiangda-api\/v1\/apps\/[^/]+\/public\/session(?:\/|$)/.test(pathname)) {
+    return false;
+  }
+  if (/\/openxiangda-api\/v1\/auth(?:\/|$)/.test(pathname)) return false;
+  if (/\/api\/auth\/logout(?:\/|$)/.test(pathname)) return false;
+  if (/\/api\/sso(?:\/|$)/.test(pathname)) return false;
+  return true;
+};
+var isUnauthenticatedResponse = async (response) => {
+  if (response.status === 401) return true;
+  const payload = await readJsonPayload(response.clone());
+  const code = getRecordValue3(payload, "code");
+  return classifyRuntimeError(response.status, code) === "unauthenticated";
+};
+var hasAuthorizationHeader = (headers) => {
+  if (!headers) return false;
+  const normalized = new Headers(headers);
+  return normalized.has("authorization");
+};
+var getFetchInputPathname = (input) => {
+  const text = typeof input === "string" ? input : input instanceof URL ? input.toString() : typeof Request !== "undefined" && input instanceof Request ? input.url : String(input || "");
+  if (!text) return "";
+  try {
+    const base = typeof window !== "undefined" ? window.location.origin : "http://localhost";
+    return new URL(text, base).pathname;
+  } catch {
+    return text.split(/[?#]/, 1)[0] || "";
+  }
+};
 var resolveAccessTokenForCurrentRoute = (accessToken) => {
   if (accessToken.scope !== "public") return accessToken.token;
   const scopedPath = normalizeRoutePath(accessToken.path);
@@ -6785,6 +7036,31 @@ var getRecordString = (value, key) => {
   const result = getRecordValue3(value, key);
   return typeof result === "string" ? result : void 0;
 };
+var getRecordNumber = (value, key) => {
+  const result = getRecordValue3(value, key);
+  const numberValue = Number(result);
+  return Number.isFinite(numberValue) ? numberValue : void 0;
+};
+var unwrapRuntimePayload = (payload) => {
+  if (!payload || typeof payload !== "object") return payload;
+  const record = payload;
+  return "data" in record ? record.data : payload;
+};
+var isAuthenticatedBootstrap = (value) => {
+  if (!value || typeof value !== "object") return false;
+  const user = toRuntimeRecord(getRecordValue3(value, "user"));
+  if (!getRecordValue3(user, "id") && !getRecordValue3(user, "username")) {
+    return false;
+  }
+  return !getRecordValue3(user, "publicAccess");
+};
+var isRuntimeAuthGuardExcluded = (path, appType, excludedPaths) => {
+  const normalizedPath = normalizeRoutePath(path);
+  if (isPublicRoutePath(normalizedPath)) return true;
+  const loginPath = normalizeRoutePath(`/view/${encodeURIComponent(appType)}/login`);
+  if (appType && normalizedPath === loginPath) return true;
+  return excludedPaths.map((item) => normalizeRoutePath(item)).some((item) => item && normalizedPath === item);
+};
 var resolveAppTypeFromLocation = () => {
   if (typeof window === "undefined") return "";
   const segments = window.location.pathname.split("/").filter(Boolean);
@@ -6921,7 +7197,7 @@ var readPathFromLocation = () => typeof window === "undefined" ? void 0 : window
 
 // packages/sdk/src/runtime/host/builtinRouteRenderer.tsx
 import { useCallback as useCallback27, useEffect as useEffect51, useMemo as useMemo37, useState as useState42 } from "react";
-import { Alert as Alert4, Button as Button16, Card as Card2, Empty as Empty8, Spin as Spin6, Typography as Typography3 } from "antd";
+import { Alert as Alert4, Button as Button16, Card as Card2, Empty as Empty8, Spin as Spin6, Table as Table4, Tabs as Tabs2, Typography as Typography3 } from "antd";
 
 // packages/sdk/src/components/core/imageCompression.ts
 var DEFAULT_THUMB = {
@@ -7622,11 +7898,11 @@ function createFormRuntimeApi(config) {
       });
       return normalizeFileTicketResult(baseUrl, response.data || response.result);
     },
-    createFileAccessTicket: async (bucketName, objectName, fileName, purpose = "preview") => {
+    createFileAccessTicket: async (bucketName, objectName, fileName, purpose = "preview", options = {}) => {
       const response = await request({
         url: "/file/access-ticket",
         method: "post",
-        data: { bucketName, objectName, fileName, purpose }
+        data: { bucketName, objectName, fileName, purpose, appType: options.appType }
       });
       return normalizeFileTicketResult(baseUrl, response.data || response.result);
     },
@@ -10782,6 +11058,11 @@ function canPreview(item) {
   const ext = getFileExtension(item.name);
   return isImageFile(item.name, item.contentType) || ["mp4", "webm", "ogg", "mov", "m4v"].includes(ext) || PREVIEW_PAGE_EXTENSIONS.includes(ext);
 }
+function appendTicketIfMissing(url, ticket) {
+  if (!url || !ticket || /[?&]ticket=/.test(url)) return url;
+  const separator = url.includes("?") ? "&" : "?";
+  return `${url}${separator}ticket=${encodeURIComponent(ticket)}`;
+}
 function AttachmentFieldPC({
   fieldId,
   behavior,
@@ -10897,16 +11178,15 @@ function AttachmentFieldPC({
         item.bucketName || bucketName,
         item.objectName,
         item.name,
-        "preview"
+        "preview",
+        { appType: item.appType || config.appType }
       );
       const ticketValue = typeof ticket === "string" ? { previewUrl: ticket } : ticket;
-      if (ticketValue?.previewPageUrl && ticketValue?.ticket) {
-        const separator = ticketValue.previewPageUrl.includes("?") ? "&" : "?";
-        return `${ticketValue.previewPageUrl}${separator}ticket=${encodeURIComponent(ticketValue.ticket)}`;
+      if (ticketValue?.previewPageUrl) {
+        return appendTicketIfMissing(ticketValue.previewPageUrl, ticketValue.ticket);
       }
       if (ticketValue?.ticket && PREVIEW_PAGE_EXTENSIONS.includes(getFileExtension(item.name))) {
-        const separator = previewPagePath.includes("?") ? "&" : "?";
-        return `${previewPagePath}${separator}ticket=${encodeURIComponent(ticketValue.ticket)}`;
+        return appendTicketIfMissing(previewPagePath, ticketValue.ticket);
       }
       return ticketValue?.previewUrl || ticketValue?.url || "";
     }
@@ -11148,6 +11428,11 @@ function canPreview2(item) {
   const ext = getFileExtension(item.name);
   return isImageFile(item.name, item.contentType) || ["mp4", "webm", "ogg", "mov", "m4v"].includes(ext) || PREVIEW_PAGE_EXTENSIONS2.includes(ext);
 }
+function appendTicketIfMissing2(url, ticket) {
+  if (!url || !ticket || /[?&]ticket=/.test(url)) return url;
+  const separator = url.includes("?") ? "&" : "?";
+  return `${url}${separator}ticket=${encodeURIComponent(ticket)}`;
+}
 function AttachmentFieldMobile({
   fieldId,
   behavior,
@@ -11296,16 +11581,15 @@ function AttachmentFieldMobile({
         item.bucketName || bucketName,
         item.objectName,
         item.name,
-        "preview"
+        "preview",
+        { appType: item.appType || config.appType }
       );
       const ticketValue = typeof ticket === "string" ? { previewUrl: ticket } : ticket;
-      if (ticketValue?.previewPageUrl && ticketValue?.ticket) {
-        const separator = ticketValue.previewPageUrl.includes("?") ? "&" : "?";
-        return `${ticketValue.previewPageUrl}${separator}ticket=${encodeURIComponent(ticketValue.ticket)}`;
+      if (ticketValue?.previewPageUrl) {
+        return appendTicketIfMissing2(ticketValue.previewPageUrl, ticketValue.ticket);
       }
       if (ticketValue?.ticket && PREVIEW_PAGE_EXTENSIONS2.includes(getFileExtension(item.name))) {
-        const separator = previewPagePath.includes("?") ? "&" : "?";
-        return `${previewPagePath}${separator}ticket=${encodeURIComponent(ticketValue.ticket)}`;
+        return appendTicketIfMissing2(previewPagePath, ticketValue.ticket);
       }
       return ticketValue?.previewUrl || ticketValue?.url || "";
     }
@@ -11436,6 +11720,11 @@ function canPreview3(item) {
   const ext = getFileExtension(item.name);
   return isImageFile(item.name, item.contentType) || ["mp4", "webm", "ogg", "mov", "m4v"].includes(ext) || PREVIEW_PAGE_EXTENSIONS3.includes(ext);
 }
+function appendTicketIfMissing3(url, ticket) {
+  if (!url || !ticket || /[?&]ticket=/.test(url)) return url;
+  const separator = url.includes("?") ? "&" : "?";
+  return `${url}${separator}ticket=${encodeURIComponent(ticket)}`;
+}
 function AttachmentFieldReadonly({
   fieldId,
   readonlyClassName,
@@ -11446,7 +11735,7 @@ function AttachmentFieldReadonly({
   showFileTypeBadge = false,
   previewPagePath = "/file-preview"
 }) {
-  const { formData, api } = useFormContext();
+  const { formData, api, config } = useFormContext();
   const { isMobile } = useDeviceDetect();
   const value = formData[fieldId] ?? [];
   if (value.length === 0) {
@@ -11471,15 +11760,14 @@ function AttachmentFieldReadonly({
         item.bucketName || bucketName,
         item.objectName,
         item.name,
-        "preview"
+        "preview",
+        { appType: item.appType || config.appType }
       );
       const ticketValue = typeof ticket === "string" ? { previewUrl: ticket } : ticket;
-      if (ticketValue?.previewPageUrl && ticketValue?.ticket) {
-        const separator = ticketValue.previewPageUrl.includes("?") ? "&" : "?";
-        url = `${ticketValue.previewPageUrl}${separator}ticket=${encodeURIComponent(ticketValue.ticket)}`;
+      if (ticketValue?.previewPageUrl) {
+        url = appendTicketIfMissing3(ticketValue.previewPageUrl, ticketValue.ticket);
       } else if (ticketValue?.ticket && PREVIEW_PAGE_EXTENSIONS3.includes(getFileExtension(item.name))) {
-        const separator = previewPagePath.includes("?") ? "&" : "?";
-        url = `${previewPagePath}${separator}ticket=${encodeURIComponent(ticketValue.ticket)}`;
+        url = appendTicketIfMissing3(previewPagePath, ticketValue.ticket);
       } else {
         url = getTicketUrl(ticketValue, url);
       }
@@ -17206,7 +17494,7 @@ async function fetchRuntimeFormData(api, appType, params) {
       order: order ? JSON.stringify(order) : void 0
     }
   });
-  const payload = unwrapRuntimePayload(response);
+  const payload = unwrapRuntimePayload2(response);
   const data = Array.isArray(payload?.data) ? payload.data : Array.isArray(payload) ? payload : [];
   return {
     data,
@@ -17263,7 +17551,7 @@ function FormProvider({
     let cancelled = false;
     api.getUserById("current").then((payload) => {
       if (cancelled || !payload) return;
-      const currentUser = normalizeUser(unwrapRuntimePayload(payload));
+      const currentUser = normalizeUser(unwrapRuntimePayload2(payload));
       const departments = normalizeDepartmentArray(currentUser.departments);
       const currentDepartment = departments[0];
       const currentUserManagers = normalizeUserArray(
@@ -17660,7 +17948,7 @@ function needsCurrentUserRuntime(shortcutType) {
     ].includes(shortcutType)
   );
 }
-function unwrapRuntimePayload(payload) {
+function unwrapRuntimePayload2(payload) {
   return payload?.data || payload?.result || payload?.user || payload;
 }
 function isBlankFormValue(value) {
@@ -19615,7 +19903,7 @@ var DraftManager = ({
 // packages/sdk/src/components/templates/FormSubmitTemplate.tsx
 import { Fragment as Fragment14, jsx as jsx96, jsxs as jsxs47 } from "react/jsx-runtime";
 var SUPERVISOR_APPROVER_TYPE = "ext_target_approval_department_supervisor";
-var unwrapRuntimePayload2 = (value) => value?.data ?? value?.result ?? value;
+var unwrapRuntimePayload3 = (value) => value?.data ?? value?.result ?? value;
 var normalizeSubmitFormType = (value) => {
   const raw = String(value || "").toLowerCase();
   return raw === "process" || raw === "flow" ? "process" : "form";
@@ -19812,7 +20100,7 @@ var InnerFormContent = ({
       return departmentId;
     }
     const runtimeUser = schema.runtime?.currentUser;
-    const loadedUser = runtimeUser || unwrapRuntimePayload2(await api.getUserById("current"));
+    const loadedUser = runtimeUser || unwrapRuntimePayload3(await api.getUserById("current"));
     const departments = normalizeDepartmentOptions(loadedUser?.departments);
     if (departments.length === 0) {
       message4.error("\u5F53\u524D\u8D26\u53F7\u672A\u5206\u914D\u90E8\u95E8\uFF0C\u65E0\u6CD5\u53D1\u8D77\u4E3B\u7BA1\u5BA1\u6279\u6D41\u7A0B");
@@ -22791,7 +23079,7 @@ var downloadBlobResponse = async (response, fallbackName) => {
   anchor.remove();
   window.URL.revokeObjectURL(url);
 };
-var unwrapRuntimePayload3 = (payload) => {
+var unwrapRuntimePayload4 = (payload) => {
   const data = payload?.data?.result ?? payload?.result ?? payload?.data ?? payload;
   return data?.items || data?.list || data?.data || data?.records || data || [];
 };
@@ -22890,14 +23178,14 @@ function AsyncEntityFilterSelect({
               method: "get",
               params: keyword ? { keyword, pageSize: 20 } : { pageSize: 20 }
             });
-            rows = unwrapRuntimePayload3(response);
+            rows = unwrapRuntimePayload4(response);
           }
         } else {
           const response = await api.request({
             url: keyword ? "/department/list" : "/department/root",
             method: "get"
           });
-          rows = unwrapRuntimePayload3(response);
+          rows = unwrapRuntimePayload4(response);
           if (keyword) {
             const normalizedKeyword = keyword.toLowerCase();
             rows = rows.filter(
@@ -24559,7 +24847,7 @@ var normalizeRuntimeFormSchema = (payload, options) => {
 };
 
 // packages/sdk/src/runtime/host/builtinRouteRenderer.tsx
-import { jsx as jsx101, jsxs as jsxs51 } from "react/jsx-runtime";
+import { Fragment as Fragment16, jsx as jsx101, jsxs as jsxs51 } from "react/jsx-runtime";
 var DEFAULT_SERVICE_PREFIX = "/service";
 var trimTrailingSlash3 = (value) => String(value || DEFAULT_SERVICE_PREFIX).replace(/\/+$/, "") || DEFAULT_SERVICE_PREFIX;
 var appendQuery3 = (url, params) => {
@@ -24683,23 +24971,337 @@ var getDetailBasePath = (appType, formUuid, formType) => {
   const detailType = isProcessKind("data-manage-list", formType) ? "processDetail" : "formDetail";
   return `/view/${appType}/${detailType}/${formUuid}`;
 };
+var unwrapRuntimePayload5 = (payload) => payload?.data ?? payload?.result ?? payload;
+var formatFileSize2 = (size) => {
+  const value = Number(size || 0);
+  if (!value) return "0 B";
+  const units = ["B", "KB", "MB", "GB"];
+  const index = Math.min(
+    units.length - 1,
+    Math.floor(Math.log(value) / Math.log(1024))
+  );
+  return `${(value / Math.pow(1024, index)).toFixed(index === 0 ? 0 : 1)} ${units[index]}`;
+};
+var toColumnName = (index) => {
+  let value = index + 1;
+  let name = "";
+  while (value > 0) {
+    const mod = (value - 1) % 26;
+    name = String.fromCharCode(65 + mod) + name;
+    value = Math.floor((value - mod) / 26);
+  }
+  return name;
+};
+var buildRowsTable = (rows = []) => {
+  const maxColumns = rows.reduce(
+    (count, row) => Math.max(count, Array.isArray(row) ? row.length : 0),
+    0
+  );
+  const columns = Array.from({ length: maxColumns }).map((_, index) => ({
+    title: toColumnName(index),
+    dataIndex: `col_${index}`,
+    key: `col_${index}`,
+    width: 160,
+    render: (value) => /* @__PURE__ */ jsx101(Typography3.Text, { ellipsis: { tooltip: String(value ?? "") }, children: String(value ?? "") })
+  }));
+  const dataSource = rows.map((row, rowIndex) => {
+    const record = { key: rowIndex };
+    (Array.isArray(row) ? row : []).forEach((value, colIndex) => {
+      record[`col_${colIndex}`] = value;
+    });
+    return record;
+  });
+  return { columns, dataSource };
+};
+var loadScriptOnce = (src) => new Promise((resolve, reject) => {
+  if (!src || typeof document === "undefined") {
+    reject(new Error("ONLYOFFICE \u811A\u672C\u5730\u5740\u4E0D\u53EF\u7528"));
+    return;
+  }
+  const existed = document.querySelector(`script[src="${src}"]`);
+  if (existed) {
+    resolve();
+    return;
+  }
+  const script = document.createElement("script");
+  script.src = src;
+  script.async = true;
+  script.onload = () => resolve();
+  script.onerror = () => reject(new Error("ONLYOFFICE \u811A\u672C\u52A0\u8F7D\u5931\u8D25"));
+  document.body.appendChild(script);
+});
+var OnlyOfficePreview = ({
+  configUrl,
+  request,
+  servicePrefix,
+  ticket
+}) => {
+  const editorId = useMemo37(
+    () => `openxiangda-onlyoffice-${ticket.replace(/[^a-zA-Z0-9_-]/g, "") || "editor"}`,
+    [ticket]
+  );
+  const [loading, setLoading] = useState42(false);
+  const [error, setError] = useState42("");
+  useEffect51(() => {
+    let disposed = false;
+    const load = async () => {
+      setLoading(true);
+      setError("");
+      try {
+        const response = await request({
+          url: configUrl || `/file/onlyoffice/config/${encodeURIComponent(ticket)}`,
+          method: "get"
+        });
+        const payload = unwrapRuntimePayload5(response);
+        const scriptUrl = `${String(payload.documentServerUrl || "").replace(
+          /\/+$/,
+          ""
+        )}/web-apps/apps/api/documents/api.js`;
+        await loadScriptOnce(joinServicePath2(servicePrefix, scriptUrl));
+        if (!disposed && typeof window !== "undefined" && window.DocsAPI?.DocEditor) {
+          new window.DocsAPI.DocEditor(editorId, payload.config);
+        }
+      } catch (currentError) {
+        if (!disposed) {
+          setError(currentError?.message || "ONLYOFFICE \u9884\u89C8\u52A0\u8F7D\u5931\u8D25");
+        }
+      } finally {
+        if (!disposed) {
+          setLoading(false);
+        }
+      }
+    };
+    void load();
+    return () => {
+      disposed = true;
+    };
+  }, [configUrl, editorId, request, servicePrefix, ticket]);
+  return /* @__PURE__ */ jsxs51("div", { style: { minHeight: "calc(100vh - 180px)" }, children: [
+    loading ? /* @__PURE__ */ jsx101(Spin6, { tip: "\u6B63\u5728\u52A0\u8F7D ONLYOFFICE..." }) : null,
+    error ? /* @__PURE__ */ jsx101(Alert4, { type: "warning", showIcon: true, message: error }) : null,
+    /* @__PURE__ */ jsx101("div", { id: editorId, style: { height: "calc(100vh - 180px)", minHeight: 520 } })
+  ] });
+};
 var BuiltinFilePreview = ({
+  request,
   route,
   servicePrefix
 }) => {
   const ticket = pickRouteValue(route, "ticket");
+  const [metadata, setMetadata] = useState42(null);
+  const [payload, setPayload] = useState42(null);
+  const [loading, setLoading] = useState42(false);
+  const [payloadLoading, setPayloadLoading] = useState42(false);
+  const [error, setError] = useState42("");
+  const [reloadKey, setReloadKey] = useState42(0);
+  useEffect51(() => {
+    let disposed = false;
+    setMetadata(null);
+    setPayload(null);
+    setError("");
+    if (!ticket) return () => {
+      disposed = true;
+    };
+    const loadMetadata = async () => {
+      setLoading(true);
+      try {
+        const response = await request({
+          url: `/file/access-ticket/${encodeURIComponent(ticket)}`,
+          method: "get"
+        });
+        if (!disposed) {
+          setMetadata(unwrapRuntimePayload5(response));
+        }
+      } catch (currentError) {
+        if (!disposed) {
+          setError(currentError?.message || "\u6587\u4EF6\u9884\u89C8\u4FE1\u606F\u52A0\u8F7D\u5931\u8D25");
+        }
+      } finally {
+        if (!disposed) {
+          setLoading(false);
+        }
+      }
+    };
+    void loadMetadata();
+    return () => {
+      disposed = true;
+    };
+  }, [request, reloadKey, ticket]);
+  const resolvePreviewUrl = (url) => joinServicePath2(
+    servicePrefix,
+    url || `/file/preview-by-ticket/${encodeURIComponent(ticket)}`
+  );
+  const downloadUrl = metadata?.downloadUrl ? joinServicePath2(servicePrefix, metadata.downloadUrl) : "";
+  useEffect51(() => {
+    let disposed = false;
+    setPayload(null);
+    if (!metadata?.renderMode || ["pdfjs", "inline", "download", "onlyoffice"].includes(metadata.renderMode)) {
+      setPayloadLoading(false);
+      return () => {
+        disposed = true;
+      };
+    }
+    const url = metadata.renderMode === "excel-basic" ? metadata.excelPreviewUrl : metadata.renderMode === "office-text" ? metadata.officeTextPreviewUrl : metadata.textPreviewUrl;
+    if (!url) return () => {
+      disposed = true;
+    };
+    const loadPayload = async () => {
+      setPayloadLoading(true);
+      try {
+        const response = await request({ url, method: "get" });
+        if (!disposed) {
+          setPayload(unwrapRuntimePayload5(response));
+        }
+      } catch (currentError) {
+        if (!disposed) {
+          setError(currentError?.message || "\u6587\u4EF6\u9884\u89C8\u5185\u5BB9\u52A0\u8F7D\u5931\u8D25");
+        }
+      } finally {
+        if (!disposed) {
+          setPayloadLoading(false);
+        }
+      }
+    };
+    void loadPayload();
+    return () => {
+      disposed = true;
+    };
+  }, [metadata, request]);
   if (!ticket) {
     return /* @__PURE__ */ jsx101(Card2, { style: { margin: 16 }, children: /* @__PURE__ */ jsx101(Empty8, { description: "\u7F3A\u5C11\u6587\u4EF6\u8BBF\u95EE\u7968\u636E" }) });
   }
-  const src = joinServicePath2(servicePrefix, `/file/preview-by-ticket/${encodeURIComponent(ticket)}`);
-  return /* @__PURE__ */ jsx101("div", { style: { minHeight: "calc(100vh - 74px)", background: "#fff" }, children: /* @__PURE__ */ jsx101(
-    "iframe",
-    {
-      title: "\u6587\u4EF6\u9884\u89C8",
-      src,
-      style: { width: "100%", minHeight: "calc(100vh - 74px)", border: 0 }
+  const renderContent = () => {
+    if (loading && !metadata) return /* @__PURE__ */ jsx101(Spin6, { tip: "\u6B63\u5728\u52A0\u8F7D\u6587\u4EF6\u4FE1\u606F..." });
+    if (error) {
+      return /* @__PURE__ */ jsx101(
+        Alert4,
+        {
+          type: "error",
+          showIcon: true,
+          message: error,
+          action: /* @__PURE__ */ jsx101(Button16, { onClick: () => setReloadKey((value) => value + 1), children: "\u91CD\u8BD5" })
+        }
+      );
     }
-  ) });
+    if (!metadata) return /* @__PURE__ */ jsx101(Empty8, { description: "\u672A\u83B7\u53D6\u5230\u6587\u4EF6\u4FE1\u606F" });
+    if (metadata.renderMode === "pdfjs") {
+      return /* @__PURE__ */ jsx101(
+        "iframe",
+        {
+          title: "PDF \u9884\u89C8",
+          src: resolvePreviewUrl(metadata.previewUrl),
+          style: { width: "100%", minHeight: "calc(100vh - 180px)", border: 0 }
+        }
+      );
+    }
+    if (metadata.renderMode === "inline" && metadata.previewType === "image") {
+      return /* @__PURE__ */ jsx101("div", { style: { textAlign: "center" }, children: /* @__PURE__ */ jsx101(
+        "img",
+        {
+          alt: metadata.fileName || "\u9644\u4EF6\u9884\u89C8",
+          src: resolvePreviewUrl(metadata.previewUrl),
+          style: { maxWidth: "100%", maxHeight: "calc(100vh - 190px)" }
+        }
+      ) });
+    }
+    if (metadata.renderMode === "inline" && metadata.previewType === "video") {
+      return /* @__PURE__ */ jsx101(
+        "video",
+        {
+          controls: true,
+          playsInline: true,
+          preload: "metadata",
+          src: resolvePreviewUrl(metadata.previewUrl),
+          style: { width: "100%", maxHeight: "calc(100vh - 190px)" }
+        }
+      );
+    }
+    if (metadata.renderMode === "excel-basic") {
+      if (payloadLoading) return /* @__PURE__ */ jsx101(Spin6, { tip: "\u6B63\u5728\u89E3\u6790 Excel..." });
+      const sheets = Array.isArray(payload?.sheets) ? payload.sheets : [];
+      if (!sheets.length) return /* @__PURE__ */ jsx101(Empty8, { description: "\u6682\u65E0\u53EF\u9884\u89C8\u7684\u5DE5\u4F5C\u8868" });
+      return /* @__PURE__ */ jsx101(
+        Tabs2,
+        {
+          items: sheets.map((sheet) => {
+            const table = buildRowsTable(sheet.rows || []);
+            return {
+              key: String(sheet.id || sheet.name),
+              label: sheet.name || "Sheet",
+              children: /* @__PURE__ */ jsx101(
+                Table4,
+                {
+                  bordered: true,
+                  size: "small",
+                  pagination: false,
+                  scroll: { x: true, y: "calc(100vh - 250px)" },
+                  columns: table.columns,
+                  dataSource: table.dataSource
+                }
+              )
+            };
+          })
+        }
+      );
+    }
+    if (metadata.renderMode === "text" || metadata.renderMode === "office-text") {
+      if (payloadLoading) return /* @__PURE__ */ jsx101(Spin6, { tip: "\u6B63\u5728\u8BFB\u53D6\u6587\u672C..." });
+      return /* @__PURE__ */ jsxs51("pre", { style: { whiteSpace: "pre-wrap", wordBreak: "break-word", margin: 0 }, children: [
+        payload?.text || "\u6682\u65E0\u6587\u672C\u5185\u5BB9",
+        payload?.truncated ? "\n\n... \u6587\u4EF6\u8F83\u5927\uFF0C\u4EC5\u5C55\u793A\u524D\u90E8\u5185\u5BB9\u3002" : ""
+      ] });
+    }
+    if (metadata.renderMode === "onlyoffice") {
+      return /* @__PURE__ */ jsx101(
+        OnlyOfficePreview,
+        {
+          configUrl: metadata.onlyofficeConfigUrl,
+          request,
+          servicePrefix,
+          ticket
+        }
+      );
+    }
+    return /* @__PURE__ */ jsx101(
+      Empty8,
+      {
+        description: "\u5F53\u524D\u6587\u4EF6\u7C7B\u578B\u6682\u4E0D\u652F\u6301\u9884\u89C8",
+        image: Empty8.PRESENTED_IMAGE_SIMPLE,
+        children: downloadUrl ? /* @__PURE__ */ jsx101(Button16, { type: "primary", onClick: () => window.location.assign(downloadUrl), children: "\u4E0B\u8F7D\u6587\u4EF6" }) : null
+      }
+    );
+  };
+  return /* @__PURE__ */ jsxs51("div", { style: { minHeight: "calc(100vh - 74px)", background: "#fff", padding: 16 }, children: [
+    /* @__PURE__ */ jsxs51(
+      Card2,
+      {
+        size: "small",
+        style: { marginBottom: 16 },
+        extra: /* @__PURE__ */ jsxs51(Fragment16, { children: [
+          /* @__PURE__ */ jsx101(Button16, { size: "small", onClick: () => setReloadKey((value) => value + 1), children: "\u5237\u65B0" }),
+          downloadUrl ? /* @__PURE__ */ jsx101(
+            Button16,
+            {
+              size: "small",
+              type: "primary",
+              style: { marginLeft: 8 },
+              onClick: () => window.location.assign(downloadUrl),
+              children: "\u4E0B\u8F7D"
+            }
+          ) : null
+        ] }),
+        children: [
+          /* @__PURE__ */ jsx101(Typography3.Text, { strong: true, children: metadata?.fileName || "\u9644\u4EF6\u9884\u89C8" }),
+          metadata ? /* @__PURE__ */ jsxs51(Typography3.Text, { type: "secondary", style: { marginLeft: 12 }, children: [
+            (metadata.extension || "FILE").toUpperCase(),
+            " \xB7 ",
+            formatFileSize2(metadata.size)
+          ] }) : null
+        ]
+      }
+    ),
+    renderContent()
+  ] });
 };
 var BuiltinRouteError = ({
   error,
@@ -24826,7 +25428,14 @@ function BuiltinRouteRenderer({
   }
   let defaultNode;
   if (route.kind === "file-preview") {
-    defaultNode = /* @__PURE__ */ jsx101(BuiltinFilePreview, { route, servicePrefix: normalizedServicePrefix });
+    defaultNode = /* @__PURE__ */ jsx101(
+      BuiltinFilePreview,
+      {
+        request,
+        route,
+        servicePrefix: normalizedServicePrefix
+      }
+    );
   } else if (route.kind === "data-manage-list") {
     if (!appType || !formUuid) {
       defaultNode = /* @__PURE__ */ jsx101(Card2, { style: { margin: 16 }, children: /* @__PURE__ */ jsx101(Empty8, { description: "\u6570\u636E\u7BA1\u7406\u9875\u7F3A\u5C11 formUuid\uFF0C\u8BF7\u5728 URL \u6216 resolver params \u4E2D\u63D0\u4F9B formUuid" }) });
@@ -24919,6 +25528,7 @@ export {
   ProcessTimeline,
   PublicAccessClientError,
   PublicAccessGate,
+  RuntimeAuthGuard,
   createAuthClient,
   createBrowserPageBridge,
   createBrowserPageContext,