openyida 2026.7.18 → 2026.7.21

package/lib/app/publish.js

@@ -11,8 +11,8 @@
  * 流程：
  * 1. 读取源文件，通过内置 babel-transform 编译 + UglifyJS 压缩
  * 2. 用代码动态构建 Schema，将 source/compiled 填入 actions.module
- * 3. 读取本地 token session 获取登录态；若未登录或 token 失效，则提示重新执行 openyida login
- * 4. 通过 HTTP POST 调用 saveFormSchema 接口发布 Schema
+ * 3. 读取 token session，在写前确认登录态
+ * 4. 通过 HTTP POST 调用 saveFormSchema，token 失效时尝试 token refresh
  */
 
 const fs = require('fs');
@@ -22,22 +22,38 @@ const http = require('http');
 const querystring = require('querystring');
 const {
   findProjectRoot,
-  loadAuthData,
-  triggerLogin,
+  isLoginExpired,
+  isCsrfTokenExpired,
   httpPost,
   httpGet,
   requestWithAutoLogin,
 } = require('../core/utils');
+const { createAuthRef, isTokenAuthRef } = require('../core/yida-client');
+const { requireSchemaServerRevision } = require('../schema/server-revision');
 const { t } = require('../core/i18n');
 const { banner, step, label, success, fail, warn, info, error, result, usage, hint } = require('../core/chalk');
 const { compileSource } = require('./page-compiler');
 const { compileCanvas } = require('./canvas-compile');
-const { stripSubtableFieldPrefix } = require('../formula/evaluate');
 const { runLintCheck } = require('./page-linter');
 const { buildPageFile, shouldBuildPageSource } = require('./page-compat');
 const { warnLargePageSource } = require('./page-size-guard');
 const { fetchFormPageList } = require('./form-navigation');
 const { parseOpenOption, withBrowserHandoff } = require('../core/browser-handoff');
+const {
+  assertLegacyDirectWriteAllowed,
+  extractLegacyGuardArgs,
+} = require('../core/legacy-schema-guard');
+const {
+  buildDefaultPageDataSource,
+  buildNativePageSchemaContent,
+  countCustomPageDataSources,
+  extractPageDataSource,
+  extractSchemaContent,
+  mergePageDataSource,
+} = require('./services/native-page-schema-builder');
+const {
+  buildCanvasPageSchemaContent,
+} = require('./services/canvas-page-schema-builder');
 
 // ── 配置读取 ──────────────────────────────────────────
 const CONFIG = fs.existsSync(path.resolve(findProjectRoot(), 'config.json')) ? JSON.parse(fs.readFileSync(path.resolve(findProjectRoot(), 'config.json'), 'utf-8')) : {};
@@ -76,13 +92,20 @@ function normalizePublishArgs(positionals) {
 
 function parseArgs(argv = process.argv.slice(2)) {
   const openOption = parseOpenOption(argv);
-  const args = openOption.args;
+  const guardSplit = extractLegacyGuardArgs(openOption.args);
+  const args = guardSplit.args;
   const skipLint = args.includes('--skip-lint');
   const healthCheck = args.includes('--health-check') || args.includes('--check');
   const compat = args.includes('--compat') || args.includes('--modern');
   const force = args.includes('--force');
   const canvas = args.includes('--canvas');
-  const filteredArgs = args.filter(arg => arg !== '--skip-lint' && arg !== '--health-check' && arg !== '--check' && arg !== '--compat' && arg !== '--modern' && arg !== '--force' && arg !== '--canvas');
+  const help = args.includes('--help') || args.includes('-h');
+  const filteredArgs = args.filter(arg => arg !== '--skip-lint' && arg !== '--health-check' && arg !== '--check' && arg !== '--compat' && arg !== '--modern' && arg !== '--force' && arg !== '--canvas' && arg !== '--help' && arg !== '-h');
+
+  if (help) {
+    usage(t('publish.usage'), t('publish.example'));
+    return { help: true };
+  }
 
   if (filteredArgs.length < 3) {
     usage(t('publish.usage'), t('publish.example'));
@@ -99,230 +122,23 @@ function parseArgs(argv = process.argv.slice(2)) {
     force,
     canvas,
     browserOpenMode: openOption.mode,
+    legacyGuardOptions: guardSplit.guardOptions,
   };
 }
 
-// ── 从登录态解析 baseUrl ─────────────────────────────
-
-function resolveBaseUrl(authData) {
-  return (authData.base_url || DEFAULT_BASE_URL).replace(/\/+$/, '');
-}
-
-// ── ID 生成工具 ──────────────────────────────────────
-
-/**
- * 创建一个独立的 nodeId 生成器，每次调用 buildSchemaContent 时应创建新实例，
- * 避免模块级全局计数器在多次调用时累加导致 ID 不可预期。
- */
-function createNodeIdGenerator() {
-  let counter = 1;
-  return function nextNodeId() {
-    return 'node_oc' + Date.now().toString(36) + (counter++).toString(36);
-  };
-}
-
-function generateSuffix() {
-  return Date.now().toString(36) + Math.random().toString(36).substring(2, 8);
-}
-
-// ── 2. 构建 Schema ──────────────────────────────────
-
-function getGlobalDataSourceFitConfig() {
-  const fitCompiled = "'use strict';\n\nvar __preParser__ = function fit(response) {\n  var content = response.content !== undefined ? response.content : response;\n  var error = {\n    message: response.errorMsg || response.errors && response.errors[0] && response.errors[0].msg || response.content || '远程数据源请求出错，success is false'\n  };\n  var success = true;\n  if (response.success !== undefined) {\n    success = response.success;\n  } else if (response.hasError !== undefined) {\n    success = !response.hasError;\n  }\n  return {\n    content: content,\n    success: success,\n    error: error\n  };\n};";
-  const fitSource = "function fit(response) {\r\n  const content = (response.content !== undefined) ? response.content : response;\r\n  const error = {\r\n    message: response.errorMsg ||\r\n      (response.errors && response.errors[0] && response.errors[0].msg) ||\r\n      response.content || '远程数据源请求出错，success is false',\r\n  };\r\n  let success = true;\r\n  if (response.success !== undefined) {\r\n    success = response.success;\r\n  } else if (response.hasError !== undefined) {\r\n    success = !response.hasError;\r\n  }\r\n  return {\r\n    content,\r\n    success,\r\n    error,\r\n  };\r\n}";
-
-  return {
-    fit: {
-      compiled: fitCompiled,
-      source: fitSource,
-      type: 'js',
-      error: {},
-    },
-  };
-}
-
-function buildDefaultPageDataSource(formUuid) {
-  const urlParamsDataSource = {
-    id: 'VCB660714833IBHEOXK376TA7XJH2AXUWR8MMW',
-    name: 'urlParams',
-    description: '当前页面地址的参数：如 aliwork.com/APP_XXX/workbench?id=1&name=宜搭，可通过 this.state.urlParams.name 获取到宜搭',
-    formUuid: formUuid,
-    protocal: 'URI',
-    isReadonly: true,
-  };
-  const timestampDataSource = {
-    id: '',
-    name: 'timestamp',
-    description: '',
-    formUuid: formUuid,
-    protocal: 'VALUE',
-    initialData: '',
-  };
-
-  return {
-    offline: [],
-    globalConfig: getGlobalDataSourceFitConfig(),
-    online: [urlParamsDataSource, timestampDataSource],
-    list: [urlParamsDataSource, timestampDataSource],
-    sync: true,
-  };
-}
-
-function cloneJson(value) {
-  if (value === undefined || value === null) {
-    return value;
-  }
-  return JSON.parse(JSON.stringify(value));
-}
-
-function getDataSourceIdentity(item) {
-  if (!item || typeof item !== 'object') {
-    return '';
-  }
-  if (isBuiltInPageDataSource(item)) {
-    return 'builtin:' + item.name;
-  }
-  if (item.id) {
-    return 'id:' + item.id;
-  }
-  if (item.name && item.protocal) {
-    return 'name:' + item.name + '|protocal:' + item.protocal;
-  }
-  if (item.name) {
-    return 'name:' + item.name;
-  }
-  return JSON.stringify(item);
-}
-
-function mergeDataSourceArray(existingItems, generatedItems) {
-  const merged = Array.isArray(existingItems) ? cloneJson(existingItems) : [];
-  const seen = new Set(merged.map(getDataSourceIdentity).filter(Boolean));
-
-  (Array.isArray(generatedItems) ? generatedItems : []).forEach((item) => {
-    const identity = getDataSourceIdentity(item);
-    if (!identity || !seen.has(identity)) {
-      merged.push(cloneJson(item));
-      if (identity) {
-        seen.add(identity);
-      }
-    }
-  });
-
-  return merged;
-}
-
-function mergePageDataSource(existingDataSource, generatedDataSource) {
-  if (!existingDataSource || typeof existingDataSource !== 'object') {
-    return cloneJson(generatedDataSource);
-  }
-
-  const existing = cloneJson(existingDataSource);
-  const generated = cloneJson(generatedDataSource || {});
-  const merged = Object.assign({}, generated, existing);
-
-  merged.offline = mergeDataSourceArray(existing.offline, generated.offline);
-  merged.online = mergeDataSourceArray(existing.online, generated.online);
-  merged.list = mergeDataSourceArray(existing.list, generated.list);
-  merged.globalConfig = Object.assign(
-    {},
-    generated.globalConfig || {},
-    existing.globalConfig || {}
-  );
-  merged.sync = existing.sync !== undefined ? existing.sync : generated.sync;
-
-  return merged;
-}
-
-function extractSchemaContent(schemaResult) {
-  if (!schemaResult) {
-    return null;
-  }
-
-  let content = schemaResult.content !== undefined ? schemaResult.content : schemaResult;
-  if (typeof content === 'string') {
-    try {
-      content = JSON.parse(content);
-    } catch {
-      return null;
-    }
-  }
-
-  if (content && typeof content === 'object' && content.pages) {
-    return content;
-  }
-  if (schemaResult.pages) {
-    return schemaResult;
-  }
-  return null;
-}
-
-function extractPageDataSource(schema) {
-  if (!schema || !Array.isArray(schema.pages)) {
-    return null;
-  }
-
-  function findPageDataSource(node) {
-    if (!node || typeof node !== 'object') {
-      return null;
-    }
-    if (node.componentName === 'Page' && node.dataSource) {
-      return node.dataSource;
-    }
-    const children = Array.isArray(node.children) ? node.children : [];
-    for (const child of children) {
-      const dataSource = findPageDataSource(child);
-      if (dataSource) {
-        return dataSource;
-      }
-    }
-    return null;
-  }
-
-  for (const page of schema.pages) {
-    const tree = page && Array.isArray(page.componentsTree) ? page.componentsTree : [];
-    for (const component of tree) {
-      const dataSource = findPageDataSource(component);
-      if (dataSource) {
-        return dataSource;
-      }
-    }
-  }
-  return null;
-}
-
-function isBuiltInPageDataSource(item) {
-  return !!(item && (item.name === 'urlParams' || item.name === 'timestamp'));
-}
-
-function countCustomPageDataSources(dataSource) {
-  if (!dataSource || typeof dataSource !== 'object') {
-    return 0;
-  }
-
-  const identities = new Set();
-  ['offline', 'online', 'list'].forEach((key) => {
-    (Array.isArray(dataSource[key]) ? dataSource[key] : []).forEach((item) => {
-      if (!isBuiltInPageDataSource(item)) {
-        const identity = getDataSourceIdentity(item);
-        if (identity) {
-          identities.add(identity);
-        }
-      }
-    });
-  });
-  return identities.size;
-}
+// ── 2. 读取并构建 Schema ────────────────────────────
 
 async function fetchExistingSchemaContent(appType, formUuid, authRef) {
   const result = await requestWithAutoLogin((auth) => {
     return httpGet(
       auth.baseUrl,
       `/alibaba/web/${appType}/${PREFIX}/query/formdesign/getFormSchema.json`,
-      { formUuid, schemaVersion: SCHEMA_VERSION }
+      { formUuid, schemaVersion: SCHEMA_VERSION },
+      auth.cookies
     );
   }, authRef);
 
-  if (!result || result.success === false || result.__needLogin) {
+  if (!result || result.success === false || result.__needLogin || result.__csrfExpired) {
     const errorMsg = result ? result.errorMsg || t('common.unknown_error') : t('common.request_failed');
     throw new Error(errorMsg);
   }
@@ -332,13 +148,16 @@ async function fetchExistingSchemaContent(appType, formUuid, authRef) {
     throw new Error(t('create_form.schema_parse_failed'));
   }
 
-  return schema;
+  return {
+    schema,
+    serverRevision: requireSchemaServerRevision(result),
+  };
 }
 
 async function readExistingPageDataSource(appType, formUuid, authRef) {
   info(t('publish.data_source_fetching'));
-  const existingSchema = await fetchExistingSchemaContent(appType, formUuid, authRef);
-  const dataSource = extractPageDataSource(existingSchema);
+  const existing = await fetchExistingSchemaContent(appType, formUuid, authRef);
+  const dataSource = extractPageDataSource(existing.schema);
   const customCount = countCustomPageDataSources(dataSource);
 
   if (customCount > 0) {
@@ -347,338 +166,249 @@ async function readExistingPageDataSource(appType, formUuid, authRef) {
     info(t('publish.data_source_none'));
   }
 
-  return dataSource;
+  return { dataSource, serverRevision: existing.serverRevision };
 }
 
 function buildSchemaContent(sourceCode, compiledCode, formUuid, options = {}) {
-  info(t('publish.building_schema'));
-
-  const sourceFix = stripSubtableFieldPrefix(sourceCode);
-  const compiledFix = stripSubtableFieldPrefix(compiledCode);
-  sourceCode = sourceFix.value;
-  compiledCode = compiledFix.value;
-  const fixedRefs = sourceFix.count + compiledFix.count;
-  if (fixedRefs > 0) {
-    info(t('publish.formula_prefix_fixed', fixedRefs));
-  }
-
-  const nextNodeId = createNodeIdGenerator();
-
-  // 构造函数代码（固定模板）
-  const constructorCode = "function constructor() {\nvar module = { exports: {} };\nvar _this = this;\nthis.__initMethods__(module.exports, module);\nObject.keys(module.exports).forEach(function(item) {\n  if(typeof module.exports[item] === 'function'){\n    _this[item] = module.exports[item];\n  }\n});\n\n}";
-  const pageDataSource = mergePageDataSource(
-    options.existingDataSource,
-    buildDefaultPageDataSource(formUuid)
-  );
-
-  const schema = {
-    schemaType: 'superform',
-    schemaVersion: '5.0',
-    pages: [
-      {
-        utils: [
-          {
-            name: 'legaoBuiltin',
-            type: 'npm',
-            content: {
-              package: '@ali/vu-legao-builtin',
-              version: '3.0.0',
-              exportName: 'legaoBuiltin',
-            },
-          },
-          {
-            name: 'yidaPlugin',
-            type: 'npm',
-            content: {
-              package: '@ali/vu-yida-plugin',
-              version: '1.1.0',
-              exportName: 'yidaPlugin',
-            },
-          },
-        ],
-        componentsMap: [
-          { package: '@ali/vc-deep-yida', version: '1.5.169', componentName: 'RootHeader' },
-          { package: '@ali/vc-deep-yida', version: '1.5.169', componentName: 'Jsx' },
-          { package: '@ali/vc-deep-yida', version: '1.5.169', componentName: 'RootContent' },
-          { package: '@ali/vc-deep-yida', version: '1.5.169', componentName: 'RootFooter' },
-          { package: '@ali/vc-deep-yida', version: '1.5.169', componentName: 'Page' },
-        ],
-        componentsTree: [
-          {
-            componentName: 'Page',
-            id: nextNodeId(),
-            props: {
-              contentBgColor: 'white',
-              pageStyle: { backgroundColor: '#f2f3f5' },
-              contentMargin: '0',
-              contentPadding: '0',
-              showTitle: false,
-              contentPaddingMobile: '0',
-              templateVersion: '1.0.0',
-              contentMarginMobile: '0',
-              className: 'page_' + generateSuffix(),
-              contentBgColorMobile: 'white',
-            },
-            condition: true,
-            css: 'body{background-color:#f2f3f5}.vc-page-yida-page{--yida-form-content-padding:0;--yida-form-content-margin:0;--yida-layout-padding:0}.vc-deep-container-entry.vc-rootcontent{padding:0!important;margin-top:0!important;margin-right:0!important;margin-bottom:0!important;margin-left:0!important}',
-            methods: {
-              __initMethods__: {
-                type: 'js',
-                source: 'function (exports, module) { /*set actions code here*/ }',
-                compiled: 'function (exports, module) { /*set actions code here*/ }',
-              },
-            },
-            dataSource: pageDataSource,
-            lifeCycles: {
-              constructor: {
-                type: 'js',
-                compiled: constructorCode,
-                source: constructorCode,
-              },
-              componentWillUnmount: {
-                name: 'didUnmount',
-                id: 'didUnmount',
-                type: 'actionRef',
-                params: {},
-              },
-              componentDidMount: {
-                name: 'didMount',
-                id: 'didMount',
-                params: {},
-                type: 'actionRef',
-              },
-            },
-            hidden: false,
-            title: '',
-            isLocked: false,
-            conditionGroup: '',
-            children: [
-              {
-                componentName: 'RootHeader',
-                id: nextNodeId(),
-                props: {},
-                condition: true,
-                hidden: false,
-                title: '',
-                isLocked: false,
-                conditionGroup: '',
-              },
-              {
-                componentName: 'RootContent',
-                id: nextNodeId(),
-                props: {},
-                condition: true,
-                hidden: false,
-                title: '',
-                isLocked: false,
-                conditionGroup: '',
-                children: [
-                  {
-                    componentName: 'Jsx',
-                    id: nextNodeId(),
-                    props: {
-                      render: {
-                        type: 'js',
-                        compiled: 'function main(){\n    \n    "use strict";\n\nvar __compiledFunc__ = function render() {\n  return this.renderJsx();\n};\n    return __compiledFunc__.apply(this, arguments);\n  }',
-                        source: 'function render() {\n  return this.renderJsx();\n}',
-                        error: {},
-                      },
-                      __style__: {},
-                      fieldId: 'jsx_' + generateSuffix(),
-                    },
-                    condition: true,
-                    hidden: false,
-                    title: '',
-                    isLocked: false,
-                    conditionGroup: '',
-                  },
-                ],
-              },
-              {
-                componentName: 'RootFooter',
-                id: nextNodeId(),
-                props: {},
-                condition: true,
-                hidden: false,
-                title: '',
-                isLocked: false,
-                conditionGroup: '',
-              },
-            ],
-          },
-        ],
-        id: formUuid,
-        connectComponent: [],
-      },
-    ],
-    // ★ 核心：source 和 compiled 由编译结果动态填入
-    actions: {
-      module: {
-        compiled: compiledCode,
-        source: sourceCode,
-      },
-      type: 'FUNCTION',
-      list: [
-        { id: 'getCustomState', title: 'getCustomState' },
-        { id: 'setCustomState', title: 'setCustomState' },
-        { id: 'forceUpdate', title: 'forceUpdate' },
-        { id: 'didMount', title: 'didMount' },
-        { id: 'didUnmount', title: 'didUnmount' },
-        { id: 'renderJsx', title: 'renderJsx' },
-      ],
-    },
-    config: {
-      connectComponent: [],
+  const logInfo = options.silent === true ? () => {} : info;
+  return buildNativePageSchemaContent(sourceCode, compiledCode, formUuid, {
+    ...options,
+    onBuildingSchema: () => logInfo(t('publish.building_schema')),
+    onFormulaPrefixFixed: fixedRefs => {
+      logInfo(t('publish.formula_prefix_fixed', fixedRefs));
     },
-  };
-
-  return JSON.stringify(schema);
+  });
 }
 
 // ── 2b. 构建 Code Canvas Schema ─────────────────────
-// 与普通自定义页面 Schema 的差异仅在 content JSON：Page.children 直接挂一个 YidaCodeCanvas
+// 与 native 的差异仅在 content JSON：Page.children 直接挂一个 YidaCodeCanvas
 // 节点，无 RootHeader/RootContent/Jsx/RootFooter；actions.module 为默认 didMount
 // 样板；Page.dataSource 精简（canvas 无原生数据桥）。
-// wire 层（path/query/body/headers）完全复用 sendSaveRequest，零改动。
-
-// canvas 页无用户页面方法，actions.module 只需注册一个空 didMount。
-const CANVAS_ACTIONS_SOURCE = 'export function didMount() {}';
-const CANVAS_ACTIONS_COMPILED = '"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.didMount=didMount;function didMount(){}';
+// wire 层（path/query/body/headers）复用单次 save transport。
 
 function buildCanvasSchemaContent(sourceCode, runtimeCode, importedModules, formUuid) {
   info(t('publish.building_schema'));
+  return buildCanvasPageSchemaContent(sourceCode, runtimeCode, importedModules, formUuid);
+}
+
+
+// ── 4. 发送 saveFormSchema 请求 ──────────────────────
+
+function sendSaveRequestOnce(csrfToken, cookies, schemaContent, baseUrl, appType, formUuid, serverRevision) {
+  if (
+    typeof csrfToken !== 'string' ||
+    csrfToken.length === 0 ||
+    !Array.isArray(cookies) ||
+    typeof baseUrl !== 'string' ||
+    baseUrl.length === 0
+  ) {
+    const authError = new Error('Publish Schema write authentication is not ready.');
+    authError.code = 'PUBLISH_SCHEMA_WRITE_PRECHECK_FAILED';
+    return Promise.reject(authError);
+  }
+  const gmtModified = requireSchemaServerRevision({ gmtModified: serverRevision });
+  return new Promise((resolve, reject) => {
+    const saveSchemaPath = `/alibaba/web/${appType}/${PREFIX}/query/formdesign/saveFormSchema.json?_stamp=${Date.now()}`;
+
+    const postData = querystring.stringify({
+      _csrf_token: csrfToken,
+      prefix: PREFIX,
+      content: schemaContent,
+      formUuid: formUuid,
+      gmtModified,
+      schemaVersion: SCHEMA_VERSION,
+      domainCode: DOMAIN_CODE,
+      importSchema: true,
+    });
+
+    const cookieHeader = cookies
+      .map((cookie) => `${cookie.name}=${cookie.value}`)
+      .join('; ');
+
+    const parsedUrl = new URL(baseUrl);
+    const isHttps = parsedUrl.protocol === 'https:';
+    const requestModule = isHttps ? https : http;
 
-  const nextNodeId = createNodeIdGenerator();
-  const constructorCode = "function constructor() {\nvar module = { exports: {} };\nvar _this = this;\nthis.__initMethods__(module.exports, module);\nObject.keys(module.exports).forEach(function(item) {\n  if(typeof module.exports[item] === 'function'){\n    _this[item] = module.exports[item];\n  }\n});\n\n}";
-
-  const schema = {
-    schemaType: 'superform',
-    schemaVersion: '5.0',
-    pages: [
-      {
-        utils: [
-          {
-            name: 'legaoBuiltin',
-            type: 'npm',
-            content: { package: '@ali/vu-legao-builtin', version: '3.0.0', exportName: 'legaoBuiltin' },
-          },
-          {
-            name: 'yidaPlugin',
-            type: 'npm',
-            content: { package: '@ali/vu-yida-plugin', version: '1.1.0', exportName: 'yidaPlugin' },
-          },
-        ],
-        componentsMap: [
-          { package: '@ali/vc-deep-yida', version: '1.5.169', componentName: 'YidaCodeCanvas' },
-          { package: '@ali/vc-deep-yida', version: '1.5.169', componentName: 'RootHeader' },
-          { package: '@ali/vc-deep-yida', version: '1.5.169', componentName: 'RootContent' },
-          { package: '@ali/vc-deep-yida', version: '1.5.169', componentName: 'RootFooter' },
-          { package: '@ali/vc-deep-yida', version: '1.5.169', componentName: 'Page' },
-        ],
-        componentsTree: [
-          {
-            componentName: 'Page',
-            id: nextNodeId(),
-            props: {
-              contentBgColor: 'white',
-              pageStyle: { backgroundColor: '#f2f3f5' },
-              contentMargin: '0',
-              contentPadding: '0',
-              showTitle: false,
-              contentPaddingMobile: '0',
-              templateVersion: '1.0.0',
-              contentMarginMobile: '0',
-              className: 'page_' + generateSuffix(),
-              contentBgColorMobile: 'white',
-            },
-            condition: true,
-            css: 'body{background-color:#f2f3f5}.vc-page-yida-page{--yida-form-content-padding:0;--yida-form-content-margin:0;--yida-layout-padding:0}.vc-deep-container-entry.vc-rootcontent{padding:0!important;margin-top:0!important;margin-right:0!important;margin-bottom:0!important;margin-left:0!important}',
-            methods: {
-              __initMethods__: {
-                type: 'js',
-                source: 'function (exports, module) { /*set actions code here*/ }',
-                compiled: 'function (exports, module) { /*set actions code here*/ }',
-              },
-            },
-            dataSource: {
-              offline: [],
-              globalConfig: getGlobalDataSourceFitConfig(),
-              online: [],
-              list: [],
-              sync: true,
-            },
-            lifeCycles: {
-              constructor: { type: 'js', compiled: constructorCode, source: constructorCode },
-              componentWillUnmount: '',
-              componentDidMount: { name: 'didMount', id: 'didMount', params: {}, type: 'actionRef' },
-            },
-            hidden: false,
-            title: '',
-            isLocked: false,
-            conditionGroup: '',
-            children: [
-              {
-                componentName: 'YidaCodeCanvas',
-                id: nextNodeId(),
-                props: {
-                  code: sourceCode,
-                  runtimeCode: runtimeCode,
-                  pageType: 'application',
-                  isWebCCompiled: true,
-                  componentProps: {},
-                  importedModules: importedModules || '',
-                },
-                condition: true,
-                hidden: false,
-                title: '',
-                isLocked: false,
-                conditionGroup: '',
-              },
-            ],
-          },
-        ],
-        id: formUuid,
-        connectComponent: [],
+    const requestOptions = {
+      hostname: parsedUrl.hostname,
+      port: parsedUrl.port || (isHttps ? 443 : 80),
+      path: saveSchemaPath,
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded',
+        'Content-Length': Buffer.byteLength(postData),
+        Origin: baseUrl,
+        Referer: `${baseUrl}/`,
+        Cookie: cookieHeader,
       },
-    ],
-    actions: {
-      module: { compiled: CANVAS_ACTIONS_COMPILED, source: CANVAS_ACTIONS_SOURCE },
-      type: 'FUNCTION',
-      list: [{ id: 'didMount', title: 'didMount' }],
-    },
-    config: { connectComponent: [] },
-  };
+    };
 
-  return JSON.stringify(schema);
-}
+    const request = requestModule.request(requestOptions, (response) => {
+      let responseData = '';
+      response.on('data', (chunk) => { responseData += chunk; });
+      response.on('end', () => {
+        info(t('common.http_status', response.statusCode));
+        let parsed;
+        try {
+          parsed = JSON.parse(responseData);
+        } catch (parseError) {
+          warn(t('common.response_body', responseData.substring(0, 500)));
+          resolve({ success: false, errorMsg: 'HTTP ' + response.statusCode + ': ' + t('common.response_not_json') });
+          return;
+        }
+        // 检测登录过期（errorCode: "307"）
+        if (isLoginExpired(parsed)) {
+          warn(t('common.login_expired', parsed.errorMsg));
+          resolve({ __needLogin: true });
+          return;
+        }
+        // 检测 csrf_token 过期（errorCode: "TIANSHU_000030"）
+        if (isCsrfTokenExpired(parsed)) {
+          warn(t('common.csrf_expired', parsed.errorMsg));
+          resolve({ __csrfExpired: true });
+          return;
+        }
+        resolve(parsed);
+      });
+    });
 
+    request.on('error', (requestError) => { reject(requestError); });
 
-// ── 4. 发送 saveFormSchema 请求 ──────────────────────
+    request.write(postData);
+    request.end();
+  });
+}
 
-function sendSaveRequest(schemaContent, baseUrl, appType, formUuid) {
+function sendSaveRequestWithAuth(authRef, schemaContent, appType, formUuid, serverRevision) {
+  if (!authRef || typeof authRef.baseUrl !== 'string' || authRef.baseUrl.length === 0) {
+    const authError = new Error('Publish Schema write authentication is not ready.');
+    authError.code = 'PUBLISH_SCHEMA_WRITE_PRECHECK_FAILED';
+    return Promise.reject(authError);
+  }
+  if (!isTokenAuthRef(authRef)) {
+    return sendSaveRequestOnce(
+      authRef.csrfToken,
+      authRef.cookies,
+      schemaContent,
+      authRef.baseUrl,
+      appType,
+      formUuid,
+      serverRevision
+    );
+  }
+  const gmtModified = requireSchemaServerRevision({ gmtModified: serverRevision });
   const saveSchemaPath = `/alibaba/web/${appType}/${PREFIX}/query/formdesign/saveFormSchema.json?_stamp=${Date.now()}`;
   const postData = querystring.stringify({
+    _csrf_token: authRef.csrfToken,
     prefix: PREFIX,
     content: schemaContent,
-    formUuid: formUuid,
+    formUuid,
+    gmtModified,
     schemaVersion: SCHEMA_VERSION,
     domainCode: DOMAIN_CODE,
     importSchema: true,
   });
-  return httpPost(baseUrl, saveSchemaPath, postData);
+  return httpPost(authRef.baseUrl, saveSchemaPath, postData, authRef.cookies, { silentStatus: true });
 }
 
 // ── 5. 发送 updateFormConfig 请求 ────────────────────
 
-function sendUpdateConfigRequest(baseUrl, appType, formUuid, version, value) {
+function sendUpdateConfigRequest(csrfToken, cookies, baseUrl, appType, formUuid, version, value) {
   const updateConfigPath = `/dingtalk/web/${appType}/query/formdesign/updateFormConfig.json`;
   const postData = querystring.stringify({
+    _csrf_token: csrfToken,
     formUuid: formUuid,
     version: version,
     configType: 'MINI_RESOURCE',
     value: value,
   });
-  return httpPost(baseUrl, updateConfigPath, postData);
+  if (!Array.isArray(cookies) || cookies.length === 0) {
+    return httpPost(baseUrl, updateConfigPath, postData);
+  }
+
+  return new Promise((resolve, reject) => {
+    const cookieHeader = cookies
+      .map((cookie) => `${cookie.name}=${cookie.value}`)
+      .join('; ');
+
+    const parsedUrl = new URL(baseUrl);
+    const isHttps = parsedUrl.protocol === 'https:';
+    const requestModule = isHttps ? https : http;
+
+    const requestOptions = {
+      hostname: parsedUrl.hostname,
+      port: parsedUrl.port || (isHttps ? 443 : 80),
+      path: updateConfigPath,
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded',
+        'Content-Length': Buffer.byteLength(postData),
+        Origin: baseUrl,
+        Referer: `${baseUrl}/`,
+        Cookie: cookieHeader,
+      },
+    };
+
+    const request = requestModule.request(requestOptions, (response) => {
+      let responseData = '';
+      response.on('data', (chunk) => { responseData += chunk; });
+      response.on('end', () => {
+        info(t('common.http_status', response.statusCode));
+        let parsed;
+        try {
+          parsed = JSON.parse(responseData);
+        } catch (parseError) {
+          warn(t('common.response_body', responseData.substring(0, 500)));
+          resolve({ success: false, errorMsg: 'HTTP ' + response.statusCode + ': ' + t('common.response_not_json') });
+          return;
+        }
+        // 检测登录过期（errorCode: "307"）
+        if (isLoginExpired(parsed)) {
+          warn(t('common.login_expired', parsed.errorMsg));
+          resolve({ __needLogin: true });
+          return;
+        }
+        // 检测 csrf_token 过期（errorCode: "TIANSHU_000030"）
+        if (isCsrfTokenExpired(parsed)) {
+          warn(t('common.csrf_expired', parsed.errorMsg));
+          resolve({ __csrfExpired: true });
+          return;
+        }
+        resolve(parsed);
+      });
+    });
+
+    request.on('error', (requestError) => { reject(requestError); });
+
+    request.write(postData);
+    request.end();
+  });
+}
+
+async function sendUpdateConfigRequestWithAuth(authRef, appType, formUuid, version, value) {
+  return requestWithAutoLogin(async (currentAuthRef) => {
+    const requestAuthRef = currentAuthRef || {};
+    const response = await sendUpdateConfigRequest(
+      requestAuthRef.csrfToken,
+      requestAuthRef.cookies,
+      requestAuthRef.baseUrl || DEFAULT_BASE_URL,
+      appType,
+      formUuid,
+      version,
+      value
+    );
+
+    if (response && response.__csrfExpired && isTokenAuthRef(requestAuthRef)) {
+      return {
+        ...response,
+        __needLogin: true,
+        errorCode: response.errorCode || 'TOKEN_AUTH_REQUIRED',
+        errorMsg: response.errorMsg || 'token_auth_required: token auth was rejected while updating page config. Run openyida auth refresh or openyida login.',
+      };
+    }
+
+    return response;
+  }, authRef);
 }
 
 function walkFiles(dir, results, limit) {
@@ -819,13 +549,14 @@ async function ensurePublishTargetOrExit(appType, formUuid, authRef, options = {
   return null;
 }
 
-async function sendHealthCheckRequest(pageUrl) {
-  const { getAccessToken } = require('../auth/token-auth');
-  const accessToken = await getAccessToken();
+function sendHealthCheckRequest(pageUrl, cookies) {
   return new Promise((resolve) => {
     const parsedUrl = new URL(pageUrl);
     const isHttps = parsedUrl.protocol === 'https:';
     const requestModule = isHttps ? https : http;
+    const cookieHeader = cookies
+      .map((cookie) => `${cookie.name}=${cookie.value}`)
+      .join('; ');
     const requestOptions = {
       hostname: parsedUrl.hostname,
       port: parsedUrl.port || (isHttps ? 443 : 80),
@@ -833,7 +564,7 @@ async function sendHealthCheckRequest(pageUrl) {
       method: 'GET',
       headers: {
         Accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
-        Authorization: `Bearer ${accessToken}`,
+        Cookie: cookieHeader,
       },
       timeout: 30000,
     };
@@ -871,14 +602,25 @@ async function sendHealthCheckRequest(pageUrl) {
 // ── 主流程 ────────────────────────────────────────────
 
 async function main(argv) {
-  const { appType, formUuid, sourceFile, skipLint, healthCheck, compat, force, canvas: canvasFlag, browserOpenMode } = parseArgs(argv);
+  const options = parseArgs(argv);
+  if (options.help) {
+    return options;
+  }
+  const { appType, formUuid, sourceFile, skipLint, healthCheck, compat, force, canvas: canvasFlag, browserOpenMode, legacyGuardOptions } = options;
+  assertLegacyDirectWriteAllowed({
+    command: 'publish',
+    resourceType: 'page',
+    action: 'update',
+    appType,
+    formUuid,
+  }, { guardOptions: legacyGuardOptions });
 
   let sourcePath = path.resolve(sourceFile);
   if (!fs.existsSync(sourcePath)) {
     error(t('publish.source_not_found', sourcePath));
   }
 
-  // 路由：默认普通自定义页面；.canvas.jsx / .canvas.tsx 源文件自动走 Code Canvas 链路，
+  // 路由：默认 native；.canvas.jsx / .canvas.tsx 源文件自动走 Code Canvas 链路，
   // --canvas 作为显式覆盖（用于扩展名不规范但确为 canvas 源码的场景）。
   const isCanvas = canvasFlag || /\.canvas\.(jsx|tsx)$/i.test(sourcePath);
 
@@ -890,7 +632,7 @@ async function main(argv) {
   let canvasResult = null;
 
   if (isCanvas) {
-    // Code Canvas 链路：跳过普通自定义页面编译/lint，改用本地 Babel 编译
+    // Code Canvas 链路：跳过 native 编译/lint，改用本地 Babel 编译
     // （JSX/TS → runtimeCode + importedModules），无需登录态，可在开浏览器前失败快。
     step(1, t('publish.step_canvas_compile'));
     info(t('publish.canvas_compiling'));
@@ -939,35 +681,35 @@ async function main(argv) {
   const compiledPath = path.join(findProjectRoot(), 'pages', 'dist', `${parsedSource.name}.js`);
 
   step(2, t('common.step_login', 2));
-  let authData = loadAuthData();
-  if (!authData) {
-    warn(t('common.login_no_cache'));
-    authData = triggerLogin();
-  }
-  let baseUrl = resolveBaseUrl(authData);
-  const authRef = {
-    baseUrl,
-    authData,
-    authMode: authData.auth_mode || '',
-    authSource: authData.auth_source || '',
-    corpId: authData.corp_id || '',
-    userId: authData.user_id || '',
-  };
+  const authRef = createAuthRef();
+  let cookies = authRef.cookies;
+  let baseUrl = authRef.baseUrl;
   await ensurePublishTargetOrExit(appType, formUuid, authRef, { force });
+  cookies = authRef.cookies;
   baseUrl = authRef.baseUrl;
 
   let schemaContent;
+  let serverRevision;
   if (isCanvas) {
+    try {
+      serverRevision = (await fetchExistingSchemaContent(appType, formUuid, authRef)).serverRevision;
+    } catch (schemaReadError) {
+      fail(t('publish.data_source_fetch_failed', schemaReadError.message));
+      process.exit(1);
+    }
     // canvasResult 已在登录前本地编译完成，这里只需据其装配 Schema content。
     schemaContent = buildCanvasSchemaContent(sourceCode, canvasResult.runtimeCode, canvasResult.importedModules, formUuid);
   } else {
     let existingDataSource = null;
     try {
-      existingDataSource = await readExistingPageDataSource(appType, formUuid, authRef);
+      const existing = await readExistingPageDataSource(appType, formUuid, authRef);
+      existingDataSource = existing.dataSource;
+      serverRevision = existing.serverRevision;
     } catch (dataSourceError) {
       fail(t('publish.data_source_fetch_failed', dataSourceError.message));
       process.exit(1);
     }
+    cookies = authRef.cookies;
     baseUrl = authRef.baseUrl;
     schemaContent = buildSchemaContent(sourceCode, compiledCode, formUuid, { existingDataSource });
   }
@@ -980,18 +722,12 @@ async function main(argv) {
   label('Source:', sourcePath);
   label('Compiled:', compiledPath);
   step(3, t('publish.step_publish'));
-  const response = await requestWithAutoLogin((ref) => sendSaveRequest(
-    schemaContent,
-    ref.baseUrl,
-    appType,
-    formUuid
-  ), authRef);
-  baseUrl = authRef.baseUrl;
+  const response = await sendSaveRequestWithAuth(authRef, schemaContent, appType, formUuid, serverRevision);
 
   if (!response || !response.success) {
     const errorMsg = response ? response.errorMsg || t('common.unknown_error') : t('common.request_failed');
     fail(t('publish.publish_failed', errorMsg));
-    if (response && !response.__needLogin) {
+    if (response && !response.__needLogin && !response.__csrfExpired) {
       hint(t('common.response_detail', JSON.stringify(response, null, 2)));
     }
     process.exit(1);
@@ -1006,20 +742,15 @@ async function main(argv) {
 
   step(4, t('publish.step_config'));
   info(t('publish.sending_config'));
-  const configResponse = await requestWithAutoLogin((ref) => sendUpdateConfigRequest(
-    ref.baseUrl,
-    appType,
-    savedFormUuid,
-    version,
-    8
-  ), authRef);
-  baseUrl = authRef.baseUrl;
+  const configResponse = await sendUpdateConfigRequestWithAuth(authRef, appType, savedFormUuid, version, 8);
+  cookies = authRef.cookies;
+  baseUrl = authRef.baseUrl || baseUrl;
 
   const pageUrl = `${baseUrl}/${appType}/workbench/${savedFormUuid}`;
   let healthCheckResult = null;
   if (healthCheck) {
     step(5, t('publish.step_health_check'));
-    healthCheckResult = await sendHealthCheckRequest(pageUrl);
+    healthCheckResult = await sendHealthCheckRequest(pageUrl, cookies);
     if (healthCheckResult.ok) {
       success(t('publish.health_check_ok', healthCheckResult.statusCode));
     } else {
@@ -1081,4 +812,6 @@ if (require.main === module) {
   module.exports.countCustomPageDataSources = countCustomPageDataSources;
   module.exports.buildSchemaContent = buildSchemaContent;
   module.exports.buildCanvasSchemaContent = buildCanvasSchemaContent;
+  module.exports.sendSaveRequestOnce = sendSaveRequestOnce;
+  module.exports.sendUpdateConfigRequestWithAuth = sendUpdateConfigRequestWithAuth;
 }