openyida 2026.7.21 → 2026.7.23-1

package/bin/yida.js

@@ -14,7 +14,7 @@ const { version: currentVersion } = require('../package.json');
 const { t } = require('../lib/core/i18n');
 const { warn } = require('../lib/core/chalk');
 const { CliError, isCliError, toErrorPayload } = require('../lib/core/cli-error');
-const { COMMAND_GROUPS, buildCommandManifest } = require('../lib/core/command-manifest');
+const { COMMAND_GROUPS, buildCommandManifest, findCommandSuggestion } = require('../lib/core/command-manifest');
 
 const command = process.argv[2];
 const args = process.argv.slice(3);
@@ -477,6 +477,33 @@ function throwCliUsage(...lines) {
   });
 }
 
+function formatSuggestionMessage(suggestion) {
+  if (!suggestion) {
+    return '';
+  }
+  if (suggestion.message_key) {
+    return t(suggestion.message_key, ...(suggestion.message_args || []));
+  }
+  return '';
+}
+
+function throwUnknownCommand(commandName, commandArgs = []) {
+  const suggestion = findCommandSuggestion([commandName, ...commandArgs]);
+  const lines = [t('cli.unknown_command', commandName)];
+  if (suggestion) {
+    lines.push(t('cli.command_suggestion', suggestion.suggested_usage));
+    const suggestionMessage = formatSuggestionMessage(suggestion);
+    if (suggestionMessage) {
+      lines.push(suggestionMessage);
+    }
+  }
+  lines.push(t('cli.run_help'));
+  throw new CliError(lines.filter(Boolean).join('\n'), {
+    code: 'INVALID_ARGUMENTS',
+    details: suggestion ? { suggestion } : undefined,
+  });
+}
+
 function hasHelpFlag(cliArgs = []) {
   return cliArgs.includes('--help') || cliArgs.includes('-h');
 }
@@ -1147,7 +1174,7 @@ async function main() {
     }
 
     default: {
-      throwCliUsage(t('cli.unknown_command', command), t('cli.run_help'));
+      throwUnknownCommand(command, args);
     }
   }
 }

package/lib/app/canvas-compile.js

@@ -35,8 +35,9 @@ const Babel = require('@babel/standalone');
  * 逐条镜像自 @ali/vc-deep-yida 的
  *   src/components/yida-code-canvas/dependencies.ts → getModuleAliasMap()
  * 只保留运行时真正用到的 windowAlias（资源 URL 由画布运行时按别名注入，
- * 本地编译不关心 CDN 地址）。若此处与物料白名单漂移，编译产物仍可运行，
- * 只是未收录的包会在浏览器端 `${name} is not found in dependencies map` 告警。
+ * 本地编译不关心 CDN 地址）。默认拒绝未收录依赖；如果宜搭物料依赖表已经
+ * 先于 CLI 升级，可临时设置 OPENYIDA_CANVAS_ALLOW_UNSUPPORTED_IMPORTS=1
+ * 退回旧的 window["pkg"] 映射，避免白名单漂移阻断发布。
  * @type {Record<string, string>}
  */
 const MODULE_ALIAS_MAP = {
@@ -59,6 +60,19 @@ const IMPORT_SIDE_EFFECT_PATTERN = /import\s+['"]([^'"]+)['"]/g;
 const REQUIRE_PATTERN = /require\(\s*['"]([^'"]+)['"]\s*\)/g;
 const DYNAMIC_IMPORT_PATTERN = /import\(\s*['"]([^'"]+)['"]\s*\)/g;
 
+function isTruthy(value) {
+  return ['1', 'true', 'yes', 'on'].includes(String(value || '').trim().toLowerCase());
+}
+
+function shouldAllowUnsupportedBareImports(options = {}, env = process.env) {
+  return options.allowUnsupportedBareImports === true ||
+    isTruthy(env.OPENYIDA_CANVAS_ALLOW_UNSUPPORTED_IMPORTS);
+}
+
+function packageTempName(pkg) {
+  return String(pkg || 'module').replace(/[^A-Za-z0-9_$]+/g, '_') || 'module';
+}
+
 function stripJsComments(code) {
   return String(code || '')
     .replace(/\/\*[\s\S]*?\*\//g, '')
@@ -113,16 +127,27 @@ function resolveWindowAlias(pkg) {
  *   export const x = ...            → const x = ...（去掉 export 关键字）
  * @param {{ types: import('@babel/types') }} babel
  */
-function esmToWindowPlugin({ types: t }) {
-  function moduleExpr(pkg) {
-    const alias = resolveWindowAlias(pkg);
+function esmToWindowPlugin({ types: t }, options = {}) {
+  const allowUnsupportedBareImports = options.allowUnsupportedBareImports === true;
+
+  function moduleExpr(pkg, alias) {
     if (alias) {
       return t.memberExpression(t.identifier('window'), t.identifier(alias));
     }
-    // 未收录包：退化为 window["pkg"]，运行时若未注入会自然报错（与线上一致）。
     return t.memberExpression(t.identifier('window'), t.stringLiteral(pkg), true);
   }
 
+  function buildUnsupportedBareImportError(path, pkg) {
+    return path.buildCodeFrameError(
+      `Code Canvas 不支持从裸包 "${pkg}" 导入绑定。`
+      + '只允许 MODULE_ALIAS_MAP 白名单依赖；'
+      + '宜搭平台运行态全局对象请显式使用 window.* 访问'
+      + '（例如 window.Deep、window.DeepYida、window.YidaNativeComponents），不要从包中 import。'
+      + '若已确认宜搭物料运行态已注入该包且 CLI 白名单滞后，可临时设置 '
+      + 'OPENYIDA_CANVAS_ALLOW_UNSUPPORTED_IMPORTS=1 退回 legacy window["pkg"] 映射。'
+    );
+  }
+
   return {
     name: 'yida-esm-to-window',
     visitor: {
@@ -140,10 +165,14 @@ function esmToWindowPlugin({ types: t }) {
           path.remove();
           return;
         }
+        const alias = resolveWindowAlias(pkg);
+        if (!alias && !allowUnsupportedBareImports) {
+          throw buildUnsupportedBareImportError(path, pkg);
+        }
 
         const decls = [];
-        const tmp = path.scope.generateUidIdentifier(resolveWindowAlias(pkg) || 'mod');
-        decls.push(t.variableDeclarator(t.cloneNode(tmp), moduleExpr(pkg)));
+        const tmp = path.scope.generateUidIdentifier(alias || packageTempName(pkg));
+        decls.push(t.variableDeclarator(t.cloneNode(tmp), moduleExpr(pkg, alias)));
 
         const namedProps = [];
         for (const spec of specifiers) {
@@ -230,7 +259,7 @@ function esmToWindowPlugin({ types: t }) {
  * @param {string} source 原始 React/JSX/TSX 源码
  * @returns {{ runtimeCode: string, importedModules: string }}
  */
-function compileCanvasLocal(source) {
+function compileCanvasLocal(source, options = {}) {
   const importedModules = extractImportedModules(source);
 
   // 第一步：剥类型 + 转 JSX（classic runtime，产出 React.createElement，
@@ -265,7 +294,9 @@ function compileCanvasLocal(source) {
   // 第二步：把 import/export 改写成 window 别名 + YidaComp。
   const stage2 = Babel.transform(intermediate, {
     filename: 'canvas.js',
-    plugins: [esmToWindowPlugin],
+    plugins: [[esmToWindowPlugin, {
+      allowUnsupportedBareImports: shouldAllowUnsupportedBareImports(options),
+    }]],
     sourceType: 'module',
     compact: false,
     babelrc: false,
@@ -286,14 +317,14 @@ function compileCanvasLocal(source) {
  * @param {object} [options] 兼容占位，未使用
  * @returns {Promise<{ runtimeCode: string, importedModules: string }>}
  */
-function compileCanvas(source, options = {}) { // eslint-disable-line no-unused-vars
+function compileCanvas(source, options = {}) {
   return new Promise((resolve, reject) => {
     if (typeof source !== 'string' || source.trim() === '') {
       reject(new Error('canvas 编译源码为空'));
       return;
     }
     try {
-      resolve(compileCanvasLocal(source));
+      resolve(compileCanvasLocal(source, options));
     } catch (compileError) {
       const detail = compileError && compileError.message ? compileError.message : String(compileError);
       reject(new Error(`Code Canvas 本地编译失败: ${detail}`));
@@ -306,5 +337,6 @@ module.exports = {
   compileCanvasLocal,
   extractImportedModules,
   resolveWindowAlias,
+  shouldAllowUnsupportedBareImports,
   MODULE_ALIAS_MAP,
 };

package/lib/app/create-form/definition-reader.js

@@ -17,6 +17,26 @@ function readJsonInput(value, options) {
   return fs.readFileSync(resolvedPath, 'utf-8');
 }
 
+function normalizeCreateFields(fields) {
+  if (
+    !Array.isArray(fields)
+    || fields.length === 0
+    || !fields.every((item) => (
+      item
+      && typeof item === 'object'
+      && !Array.isArray(item)
+      && String(item.action || '').toLowerCase() === 'add'
+      && item.field
+      && typeof item.field === 'object'
+      && !Array.isArray(item.field)
+    ))
+  ) {
+    return fields;
+  }
+
+  return fields.map((item) => item.field);
+}
+
 function createDefinitionReaders(dependencies) {
   const {
     fs,
@@ -43,9 +63,9 @@ function createDefinitionReaders(dependencies) {
       let columns = 1;
 
       if (Array.isArray(parsed)) {
-        fields = parsed;
+        fields = normalizeCreateFields(parsed);
       } else if (typeof parsed === 'object' && parsed !== null) {
-        fields = parsed.fields || [];
+        fields = normalizeCreateFields(parsed.fields || []);
         columns = parsed.columns !== undefined ? parsed.columns : 1;
         if (Array.isArray(parsed.validations)) {
           validations = parsed.validations;