openyida 2026.7.19 → 2026.7.21

package/lib/app/create-page.js

@@ -16,21 +16,39 @@ const { t } = require('../core/i18n');
 const { buildYidaI18n, buildYidaTitleI18n, normalizeYidaLocale, resolveContentLocale } = require('../core/yida-i18n');
 const { parseOpenOption, withBrowserHandoff } = require('../core/browser-handoff');
 const { throwCommandError } = require('../core/command-errors');
+const {
+  assertLegacyDirectWriteAllowed,
+  extractLegacyGuardArgs,
+} = require('../core/legacy-schema-guard');
 
 function parseArgs(args) {
   const openOption = parseOpenOption(args);
+  const guardSplit = extractLegacyGuardArgs(openOption.args);
   const filteredArgs = [];
   let mode = 'default';
   let locale = null;
 
-  for (let i = 0; i < openOption.args.length; i++) {
-    const arg = openOption.args[i];
-    if (arg === '--mode' && openOption.args[i + 1]) {
-      mode = openOption.args[++i];
+  if (guardSplit.args.includes('--help') || guardSplit.args.includes('-h')) {
+    return {
+      args: [],
+      appType: null,
+      pageName: null,
+      mode,
+      locale,
+      help: true,
+      openMode: openOption.mode,
+      legacyGuardOptions: guardSplit.guardOptions,
+    };
+  }
+
+  for (let i = 0; i < guardSplit.args.length; i++) {
+    const arg = guardSplit.args[i];
+    if (arg === '--mode' && guardSplit.args[i + 1]) {
+      mode = guardSplit.args[++i];
       continue;
     }
-    if ((arg === '--locale' || arg === '--content-locale' || arg === '--lang') && openOption.args[i + 1]) {
-      locale = openOption.args[++i];
+    if ((arg === '--locale' || arg === '--content-locale' || arg === '--lang') && guardSplit.args[i + 1]) {
+      locale = guardSplit.args[++i];
       if (!normalizeYidaLocale(locale)) {
         throw new Error(`Unsupported locale: ${locale}`);
       }
@@ -46,10 +64,11 @@ function parseArgs(args) {
     mode,
     locale,
     openMode: openOption.mode,
+    legacyGuardOptions: guardSplit.guardOptions,
   };
 }
 
-function buildPageInfoPostData(formUuid, pageName, isRenderNav) {
+function buildPageInfoPostData(formUuid, pageName, isRenderNav, csrfToken) {
   const titleJson = JSON.stringify(buildYidaTitleI18n(pageName, {
     en_US: pageName,
     ja_JP: pageName,
@@ -57,6 +76,7 @@ function buildPageInfoPostData(formUuid, pageName, isRenderNav) {
 
   return querystring.stringify({
     _api: 'Form.updateFormSchemaInfo',
+    _csrf_token: csrfToken,
     _locale_time_zone_offset: '28800000',
     formUuid,
     serialSwitch: 'n',
@@ -90,7 +110,8 @@ async function configureDashboardMode(authRef, appType, pageId, pageName) {
     return httpPost(
       auth.baseUrl,
       `/dingtalk/web/${appType}/query/formdesign/updateFormSchemaInfo.json`,
-      buildPageInfoPostData(pageId, pageName, false)
+      buildPageInfoPostData(pageId, pageName, false, auth.csrfToken),
+      auth.cookies
     );
   }, authRef);
 }
@@ -104,6 +125,13 @@ async function run(args) {
     chalkError(err.message, { hint: t('create_page.usage') });
   }
 
+  if (options.help) {
+    const { usage, hint } = require('../core/chalk');
+    usage(t('create_page.usage'), t('create_page.example'));
+    hint(t('create_page.mode_hint'));
+    return options;
+  }
+
   if (options.args.length < 2) {
     const { error: chalkError } = require('../core/chalk');
     chalkError(t('create_page.usage'), { hint: t('create_page.example') });
@@ -112,6 +140,12 @@ async function run(args) {
   const appType = options.appType;
   const pageName = options.pageName;
   const mode = options.mode;
+  assertLegacyDirectWriteAllowed({
+    command: 'create-page',
+    resourceType: 'page',
+    action: 'create',
+    appType,
+  }, { guardOptions: options.legacyGuardOptions });
   if (mode !== 'default' && mode !== 'dashboard') {
     const { error: chalkError } = require('../core/chalk');
     chalkError(t('create_page.err_mode_invalid', mode), { hint: t('create_page.mode_hint') });
@@ -138,13 +172,15 @@ async function run(args) {
 
   const response = await requestWithAutoLogin((auth) => {
     const postData = querystring.stringify({
+      _csrf_token: auth.csrfToken,
       formType: 'display',
       title: JSON.stringify(buildYidaI18n(pageName, { en_US: pageName, ja_JP: pageName })),
     });
     return httpPost(
       auth.baseUrl,
       `/dingtalk/web/${appType}/query/formdesign/saveFormSchemaInfo.json`,
-      postData
+      postData,
+      auth.cookies
     );
   }, authRef);
 

package/lib/app/get-schema.js

@@ -2,6 +2,7 @@
  * get-schema.js - 宜搭表单 Schema 获取命令
  *
  * 用法：
+ *   openyida get-schema <appType> <formUuid> [--compact] [--resolve-fields <labelOrFieldId,...>]
  *   openyida get-schema <appType> <formUuid> [--summary-json|--field-map-json]
  *   openyida get-schema <appType> --all [--summary-json] [--output-dir <dir>] [--concurrency N] [--retries N]
  */
@@ -20,6 +21,7 @@ const {
 const { t } = require('../core/i18n');
 const { throwCommandError } = require('../core/command-errors');
 const { fetchFormPageList } = require('./form-navigation');
+const { buildFieldResolution } = require('./schema-field-resolution');
 
 // 需要在报表 fieldCode 中加 _value 后缀的字段类型
 const FIELD_TYPES_NEEDING_VALUE_SUFFIX = new Set([
@@ -202,8 +204,9 @@ function parseArgs(args) {
     concurrency: 3,
     retries: 1,
     keyword: '',
-    // --field <labelOrFieldId>：单字段过滤模式，命中时跳过 runBatch 分支，
-    // 仅返回目标字段的 {componentName, fieldId, label, props}
+    compact: false,
+    fields: [],
+    // 保留已有单字段参数，作为 --fields 的单值兼容别名。
     field: '',
     json: false,
     summaryJson: false,
@@ -225,7 +228,15 @@ function parseArgs(args) {
     } else if (arg === '--keyword' && args[index + 1]) {
       parsed.keyword = args[index + 1];
       index++;
-    } else if (arg === '--field' && args[index + 1]) {
+    } else if (arg === '--compact') {
+      parsed.compact = true;
+    } else if (arg === '--resolve-fields') {
+      parsed.compact = true;
+      if (args[index + 1] && !args[index + 1].startsWith('--')) {
+        appendFieldQueries(parsed.fields, args[index + 1]);
+        index++;
+      }
+    } else if (arg === '--field' && args[index + 1] && !args[index + 1].startsWith('--')) {
       parsed.field = args[index + 1];
       index++;
     } else if (arg === '--json') {
@@ -240,15 +251,27 @@ function parseArgs(args) {
   return parsed;
 }
 
+function appendFieldQueries(target, value) {
+  String(value || '')
+    .split(/[,，]/)
+    .map(item => item.trim())
+    .filter(Boolean)
+    .forEach((item) => {
+      if (!target.includes(item)) {
+        target.push(item);
+      }
+    });
+}
+
 function ensureUsage(parsed) {
   if (!parsed.appType || (!parsed.all && !parsed.formUuid)) {
     const { error: chalkError } = require('../core/chalk');
     chalkError(t('get_schema.usage'), { hint: t('get_schema.example') });
   }
-  // --field 模式必须同时提供 formUuid（单字段过滤不支持 --all 批量）
-  if (parsed.field && parsed.all) {
+  // contract v1 的 resource 对应单个 form，不与 --all 批量模式混用。
+  if ((parsed.compact || parsed.field) && parsed.all) {
     const { error: chalkError } = require('../core/chalk');
-    chalkError('--field 不支持与 --all 同时使用，请改为单 form 模式');
+    chalkError(t('get_schema.usage'), { hint: t('get_schema.example') });
   }
 }
 
@@ -503,21 +526,37 @@ async function runSingle(parsed, authRef) {
   banner(t('get_schema.title'));
   label('App', parsed.appType);
   label('Form', parsed.formUuid);
-  if (parsed.field) {label('Field', parsed.field);}
+  if (parsed.field) {
+    label('Field', parsed.field);
+  } else if (parsed.fields.length > 0) {
+    label('Fields', parsed.fields.join(', '));
+  }
 
   // Step 2: 获取表单 Schema
   step(2, t('get_schema.step_get'));
   info(t('get_schema.sending'));
 
-  const result = await fetchSchema(parsed.appType, parsed.formUuid, authRef);
+  let result;
+  try {
+    result = await fetchSchema(parsed.appType, parsed.formUuid, authRef);
+  } catch (error) {
+    if (!parsed.compact) {
+      throw error;
+    }
+    chalkResult(false, t('get_schema.failed', t('common.request_failed')));
+    process.exit(1);
+    return;
+  }
 
   if (!isSuccessfulSchemaResult(result)) {
-    const errorMsg = result ? result.errorMsg || t('common.unknown_error') : t('common.request_failed');
+    const errorMsg = parsed.compact
+      ? t('common.request_failed')
+      : result ? result.errorMsg || t('common.unknown_error') : t('common.request_failed');
     chalkResult(false, t('get_schema.failed', errorMsg));
     throwCommandError(errorMsg);
   }
 
-  // --field 模式：只返回单个字段的详细 props（含 SelectField.dataSource 等）
+  // 保留既有 --field 返回结构；新 contract 仅由 --compact / --resolve-fields 触发。
   if (parsed.field) {
     const allFieldNodes = collectFieldNodes(result);
     const aliasMaps = buildComponentAliasMaps(result);
@@ -531,18 +570,29 @@ async function runSingle(parsed, authRef) {
     }
     const props = matched.props || {};
     const labelRaw = props.label;
-    const label = labelRaw
+    const fieldLabel = labelRaw
       ? (typeof labelRaw === 'object' ? (labelRaw.zh_CN || labelRaw.en_US || '') : String(labelRaw))
       : '';
-    const compact = {
+    const legacyField = {
       componentName: matched.componentName,
       fieldId: props.fieldId || '',
       alias: aliasMaps.aliasByFieldId[props.fieldId] || '',
-      label,
+      label: fieldLabel,
       props,
     };
     chalkSuccess(t('get_schema.success'));
-    console.log(JSON.stringify(compact, null, 2));
+    console.log(JSON.stringify(legacyField, null, 2));
+    return;
+  }
+
+  if (parsed.compact) {
+    chalkSuccess(t('get_schema.success'));
+    console.log(JSON.stringify(buildFieldResolution(
+      parsed.appType,
+      parsed.formUuid,
+      result,
+      parsed.fields
+    ), null, 2));
     return;
   }
 
@@ -631,6 +681,7 @@ module.exports = {
   buildSchemaSummary,
   buildComponentAliasMaps,
   parseArgs,
+  appendFieldQueries,
   filterForms,
   mapLimit,
   fetchSchemaRecord,

package/lib/app/import-app.js

@@ -15,32 +15,37 @@ const {
   httpPost,
   requestWithAutoLogin,
 } = require('../core/utils');
-const { createAuthRef } = require('../core/yida-client');
+const { createAuthRef, isTokenAuthRef } = require('../core/yida-client');
 const { t } = require('../core/i18n');
 const { buildYidaI18n, resolveContentLocale } = require('../core/yida-i18n');
 const { banner, step, label, success, fail, warn, info, error, result, usage, hint } = require('../core/chalk');
 const { throwUsage } = require('../core/command-errors');
+const { getSchemaServerRevision } = require('../schema/server-revision');
+const {
+  assertLegacyDirectWriteAllowed,
+  extractLegacyGuardArgs,
+} = require('../core/legacy-schema-guard');
 
 // ── 创建新应用 ────────────────────────────────────────
 
 async function createApp(appName, authRef) {
   const contentLocale = resolveContentLocale({ baseUrl: authRef.baseUrl });
-  const postData = querystring.stringify({
-    appName: JSON.stringify(buildYidaI18n(appName, { en_US: appName, ja_JP: appName })),
-    description: JSON.stringify(buildYidaI18n(appName, { en_US: appName, ja_JP: appName })),
-    icon: 'xian-yingyong%%#0089FF',
-    iconUrl: 'xian-yingyong%%#0089FF',
-    colour: 'blue',
-    defaultLanguage: contentLocale,
-    openExclusive: 'n',
-    openPhysicColumn: 'n',
-    openIsolationDatabase: 'n',
-    openExclusiveUnit: 'n',
-    group: 'ALL',
-  });
-
   const result = await requestWithAutoLogin((auth) => {
-    return httpPost(auth.baseUrl, '/query/app/registerApp.json', postData);
+    const postData = querystring.stringify({
+      _csrf_token: auth.csrfToken,
+      appName: JSON.stringify(buildYidaI18n(appName, { en_US: appName, ja_JP: appName })),
+      description: JSON.stringify(buildYidaI18n(appName, { en_US: appName, ja_JP: appName })),
+      icon: 'xian-yingyong%%#0089FF',
+      iconUrl: 'xian-yingyong%%#0089FF',
+      colour: 'blue',
+      defaultLanguage: contentLocale,
+      openExclusive: 'n',
+      openPhysicColumn: 'n',
+      openIsolationDatabase: 'n',
+      openExclusiveUnit: 'n',
+      group: 'ALL',
+    });
+    return httpPost(auth.baseUrl, '/query/app/registerApp.json', postData, auth.cookies);
   }, authRef);
 
   if (!result || !result.success || !result.content) {
@@ -58,22 +63,30 @@ function normalizeImportFormType(formType) {
   return normalized;
 }
 
-function buildCreateFormPostData(formTitle, formType = 'receipt') {
-  return querystring.stringify({
+function buildCreateFormPayload(formTitle, formType = 'receipt') {
+  return {
     formType: normalizeImportFormType(formType),
     title: JSON.stringify(buildYidaI18n(formTitle, { en_US: formTitle, ja_JP: formTitle })),
-  });
+  };
+}
+
+function buildCreateFormPostData(formTitle, formType = 'receipt') {
+  return querystring.stringify(buildCreateFormPayload(formTitle, formType));
 }
 
 // ── 创建空白表单/页面/报表 ──────────────────────────────
 
 async function createBlankForm(appType, formTitle, authRef, formType = 'receipt') {
-  const postData = buildCreateFormPostData(formTitle, formType);
   const result = await requestWithAutoLogin((auth) => {
+    const postData = querystring.stringify({
+      _csrf_token: auth.csrfToken,
+      ...buildCreateFormPayload(formTitle, formType),
+    });
     return httpPost(
       auth.baseUrl,
       `/dingtalk/web/${appType}/query/formdesign/saveFormSchemaInfo.json`,
-      postData
+      postData,
+      auth.cookies
     );
   }, authRef);
 
@@ -87,44 +100,72 @@ async function createBlankForm(appType, formTitle, authRef, formType = 'receipt'
 
 // ── 保存表单 Schema ───────────────────────────────────
 
-async function saveFormSchema(appType, formUuid, schema, authRef, formType = 'receipt') {
+async function saveFormSchema(appType, formUuid, schema, authRef, formType = 'receipt', serverRevision) {
+  const tokenReady = isTokenAuthRef(authRef);
+  const cookieReady = !!(
+    authRef &&
+    typeof authRef.csrfToken === 'string' &&
+    authRef.csrfToken &&
+    Array.isArray(authRef.cookies)
+  );
+  if (!authRef || !authRef.baseUrl || (!tokenReady && !cookieReady)) {
+    const err = new Error('Import schema save requires an authenticated request context.');
+    err.code = 'IMPORT_SCHEMA_WRITE_PRECHECK_FAILED';
+    throw err;
+  }
+  if (!schema || typeof schema !== 'object' || !Array.isArray(schema.pages)) {
+    const err = new Error('Imported schema content must include a pages array before writing.');
+    err.code = 'SCHEMA_REMOTE_READ_FAILED';
+    throw err;
+  }
+  if (!Number.isFinite(serverRevision) || serverRevision < 0) {
+    const err = new Error('Imported schema revision is missing or invalid.');
+    err.code = 'SCHEMA_REMOTE_READ_FAILED';
+    throw err;
+  }
+
   const payload = {
     appType,
     formUuid,
     content: JSON.stringify(schema),
     schemaVersion: 'V5',
+    gmtModified: serverRevision,
   };
   if (normalizeImportFormType(formType) === 'report') {
     payload.importSchema = 'true';
   }
-  const postData = querystring.stringify(payload);
-
-  const result = await requestWithAutoLogin((auth) => {
-    return httpPost(
-      auth.baseUrl,
-      `/alibaba/web/${appType}/_view/query/formdesign/saveFormSchema.json`,
-      postData
-    );
-  }, authRef);
 
-  return result;
+  const postData = querystring.stringify(Object.assign(
+    {},
+    authRef.csrfToken ? { _csrf_token: authRef.csrfToken } : {},
+    payload
+  ));
+  const authOptions = { projectRoot: authRef.projectRoot };
+  return httpPost(
+    authRef.baseUrl,
+    `/alibaba/web/${appType}/_view/query/formdesign/saveFormSchema.json`,
+    postData,
+    Array.isArray(authRef.cookies) ? authRef.cookies : authOptions,
+    Array.isArray(authRef.cookies) ? authOptions : undefined
+  );
 }
 
 // ── 更新表单配置（发布表单）─────────────────────────────
 
 async function updateFormConfig(appType, formUuid, authRef) {
-  const postData = querystring.stringify({
-    appType,
-    formUuid,
-    setting: JSON.stringify({ MINI_RESOURCE: 0 }),
-    version: 1,
-  });
-
   const result = await requestWithAutoLogin((auth) => {
+    const postData = querystring.stringify({
+      _csrf_token: auth.csrfToken,
+      appType,
+      formUuid,
+      setting: JSON.stringify({ MINI_RESOURCE: 0 }),
+      version: 1,
+    });
     return httpPost(
       auth.baseUrl,
       `/dingtalk/web/${appType}/query/formdesign/updateFormConfig.json`,
-      postData
+      postData,
+      auth.cookies
     );
   }, authRef);
 
@@ -178,6 +219,8 @@ function extractSchemaContent(schemaResult) {
 // ── 主逻辑 ────────────────────────────────────────────
 
 async function run(args) {
+  const guardSplit = extractLegacyGuardArgs(args || []);
+  args = guardSplit.args;
   if (args.length < 1) {
     usage(t('import.usage'));
     hint(t('import.example1'));
@@ -216,6 +259,11 @@ async function run(args) {
   step(2, t('common.step_login_label'));
   const authRef = createAuthRef();
   success(t('common.login_ready', authRef.baseUrl));
+  assertLegacyDirectWriteAllowed({
+    command: 'import-app',
+    resourceType: 'app',
+    action: 'create',
+  }, { guardOptions: guardSplit.guardOptions });
 
   step(3, t('import.step_create_app'));
   let newAppType;
@@ -288,9 +336,10 @@ async function run(args) {
       oldFormUuid,
       newFormUuid
     );
+    const serverRevision = getSchemaServerRevision(formSchemaResult);
 
     // 4.3 保存 Schema
-    const saveResult = await saveFormSchema(newAppType, newFormUuid, adaptedSchema, authRef, formType);
+    const saveResult = await saveFormSchema(newAppType, newFormUuid, adaptedSchema, authRef, formType, serverRevision);
     if (!saveResult || !saveResult.success) {
       const errorMsg = saveResult ? saveResult.errorMsg || t('common.unknown_error') : t('common.request_failed');
       fail(t('import.save_schema_failed', errorMsg));
@@ -369,7 +418,9 @@ module.exports = {
   run,
   __test__: {
     normalizeImportFormType,
+    buildCreateFormPayload,
     buildCreateFormPostData,
+    saveFormSchema,
     adaptSchemaIdentifiers,
     extractSchemaContent,
   },