openyida 2026.7.23 → 2026.7.25-beta.2

package/README.md

@@ -241,7 +241,6 @@ Most checks should stay offline, but OpenYida also includes an explicit real-env
 OPENYIDA_E2E=1 npm run test:e2e:real
 OPENYIDA_E2E=1 npm run test:e2e:real:full
 OPENYIDA_E2E=1 OPENYIDA_E2E_FULL_STAGES=auth,app,form,process npm run test:e2e:real:full
-npm run test:e2e:real:schema-source
 npm run test:e2e:real:skills
 ```
 
@@ -251,8 +250,6 @@ The runner creates a disposable app, form, and custom page with an `OY_E2E_*` pr
 
 `test:e2e:real:skills` enforces coverage for every directory under `yida-skills/skills/`. Each skill must be classified as real E2E, offline/unit, opt-in, or deprecated with an explicit reason. This prevents new skills from quietly bypassing the real-environment test plan.
 
-`test:e2e:real:schema-source` is a local process-level Schema-as-Code E2E for agent/source checkout validation. It reads `yida-skills/` in place, creates a temporary `openyida` launcher that executes the current checkout `bin/yida.js`, and runs CRM app/form/page/process create, managed-update, and noop scenarios through `schema validate -> plan -> apply -> noop` against a mock Yida service, including customer field updates and approval-flow/page changes. Report and integration automation manifests remain compatibility-boundary scenarios and must return unsupported.
-
 Each successful full run leaves a human-inspectable result app in the target organization. The final step publishes a dedicated `Full E2E Dashboard` custom page, renames the app to `OY_E2E_*_PASSED` by default, and prints direct links for the app, form, dashboard page, and report; the same links are saved under `resultApp` in the registry JSON.
 
 Useful options:
@@ -358,8 +355,6 @@ openyida append-chart APP_XXX REPORT_XXX .cache/openyida/reports/chart.json
 
 Run `openyida --help` or `openyida <command> --help` for detailed usage.
 
-Schema-as-Code Phase 1 manages app, form, process, and native/default display page resources. Use the single [Phase 1 Manifest guide](yida-skills/references/schema-as-code-phase1.md): create any referenced page source first, run `validate`, run the read-only `plan`, review its current `planId`, then explicitly approve and run `apply`. Error `nextAction`/`ask_human` never grants the first write; `stale_replanned` only returns a replacement plan for another explicit review. State is the only persisted bindings authority; report, automation, and page config/delete/pull remain outside Phase 1.
-
 <!-- OPENYIDA_COMMANDS_START -->
 <!-- This section is generated by `npm run docs:commands`. Do not edit command rows by hand. -->
 
@@ -412,14 +407,6 @@ Schema-as-Code Phase 1 manages app, form, process, and native/default display pa
 | `openyida update-form-config <appType> ...` | Update form configuration |
 | `openyida get-form-config <appType> <formUuid> [--json]` | Query form configuration |
 
-### Schema-as-Code
-
-| Command | Description |
-|---------|-------------|
-| `openyida schema validate <manifest> --json --quiet` | Validate Schema-as-Code manifest locally |
-| `openyida schema plan <manifest> --state <path> --json --quiet` | Plan Schema-as-Code changes with read-only remote observation |
-| `openyida schema apply <manifest> --state <path> --plan-id <planId> --json --quiet` | Apply a reviewed Schema-as-Code plan with checkpoints and recovery guards |
-
 ### Data & Permissions
 
 | Command | Description |

package/bin/yida.js

@@ -729,12 +729,6 @@ async function main() {
       break;
     }
 
-    case 'schema': {
-      const { run } = require('../lib/schema/command');
-      await run(args);
-      break;
-    }
-
     case 'formula': {
       const subCommand = args[0];
       const subArgs = args.slice(1);

package/lib/app/canvas-compile.js

@@ -25,10 +25,14 @@
  *      这些 UMD 依赖由画布运行时依据 importedModules 白名单按需注入。
  *
  * 因此本地编译 = Babel 把 JSX/TS 转成 ES5 → 把 import 改写成 window 别名引用、
- * 把 export default 改写成 `var YidaComp = ...` → 正则抽出依赖包名。
+ * 把 export default 改写成画布入口 `YidaComp` → 正则抽出依赖包名。
  */
 
 const Babel = require('@babel/standalone');
+const {
+  assertNoEmojiInArtifactName,
+  assertNoEmojiInText,
+} = require('../core/no-emoji-guard');
 
 /**
  * 依赖 → window 别名白名单。
@@ -148,6 +152,15 @@ function esmToWindowPlugin({ types: t }, options = {}) {
     );
   }
 
+  function hasProgramBinding(path, name) {
+    const program = path.findParent((parentPath) => parentPath.isProgram());
+    return Boolean(program && program.scope.hasBinding(name));
+  }
+
+  function isExistingYidaCompDefault(path, decl) {
+    return t.isIdentifier(decl, { name: 'YidaComp' }) && hasProgramBinding(path, 'YidaComp');
+  }
+
   return {
     name: 'yida-esm-to-window',
     visitor: {
@@ -213,6 +226,10 @@ function esmToWindowPlugin({ types: t }, options = {}) {
         const decl = path.node.declaration;
         if (t.isFunctionDeclaration(decl) || t.isClassDeclaration(decl)) {
           if (decl.id) {
+            if (decl.id.name === 'YidaComp') {
+              path.replaceWith(decl);
+              return;
+            }
             // 具名声明：保留声明本体，再补 `var YidaComp = <name>;`
             const idName = decl.id.name;
             path.replaceWithMultiple([
@@ -231,6 +248,10 @@ function esmToWindowPlugin({ types: t }, options = {}) {
           );
           return;
         }
+        if (isExistingYidaCompDefault(path, decl)) {
+          path.remove();
+          return;
+        }
         // export default <表达式>
         path.replaceWith(
           t.variableDeclaration('var', [t.variableDeclarator(t.identifier('YidaComp'), decl)])
@@ -254,12 +275,48 @@ function esmToWindowPlugin({ types: t }, options = {}) {
   };
 }
 
+function buildCanvasRuntimeWrapper(runtimeCode) {
+  return (
+    'return function(iframeWindow, parentWindow){ const window = iframeWindow; '
+    + runtimeCode
+    + ' return YidaComp; }'
+  );
+}
+
+function assertCanvasRuntimeParseable(runtimeCode, options = {}) {
+  try {
+    // 只编译 wrapper，不执行 factory 或用户组件，避免触发源码里的运行期副作用。
+    // eslint-disable-next-line no-new-func
+    new Function(buildCanvasRuntimeWrapper(runtimeCode));
+  } catch (error) {
+    const detail = error && error.message ? error.message : String(error);
+    const sourceLabel = options.sourcePath ? ` (${options.sourcePath})` : '';
+    const compileError = new Error(
+      `Code Canvas runtimeCode 无法通过画布运行时装配校验${sourceLabel}: ${detail}`
+      + '。请检查默认导出、YidaComp 入口或 window 等运行时保留变量是否重复声明。'
+    );
+    compileError.code = 'OPENYIDA_CANVAS_RUNTIME_PARSE_FAILED';
+    compileError.cause = error;
+    throw compileError;
+  }
+}
+
 /**
  * 本地编译 Code Canvas 源码。
  * @param {string} source 原始 React/JSX/TSX 源码
  * @returns {{ runtimeCode: string, importedModules: string }}
  */
 function compileCanvasLocal(source, options = {}) {
+  if (options.sourcePath) {
+    assertNoEmojiInArtifactName(options.sourcePath, {
+      code: 'OPENYIDA_PAGE_FILENAME_EMOJI_FORBIDDEN',
+    });
+  }
+  assertNoEmojiInText(source, {
+    artifact: options.sourcePath || 'Code Canvas source',
+    code: 'OPENYIDA_CANVAS_SOURCE_EMOJI_FORBIDDEN',
+  });
+
   const importedModules = extractImportedModules(source);
 
   // 第一步：剥类型 + 转 JSX（classic runtime，产出 React.createElement，
@@ -304,6 +361,11 @@ function compileCanvasLocal(source, options = {}) {
   });
 
   const runtimeCode = stage2.code || '';
+  assertNoEmojiInText(runtimeCode, {
+    artifact: options.sourcePath ? options.sourcePath + ' runtime' : 'Code Canvas runtime',
+    code: 'OPENYIDA_CANVAS_SOURCE_EMOJI_FORBIDDEN',
+  });
+  assertCanvasRuntimeParseable(runtimeCode, options);
   return {
     runtimeCode,
     importedModules: JSON.stringify(importedModules),
@@ -338,5 +400,6 @@ module.exports = {
   extractImportedModules,
   resolveWindowAlias,
   shouldAllowUnsupportedBareImports,
+  assertCanvasRuntimeParseable,
   MODULE_ALIAS_MAP,
 };

package/lib/app/create-app.js

@@ -18,10 +18,6 @@ const { t } = require('../core/i18n');
 const { buildYidaI18n, normalizeYidaLocale, resolveContentLocale } = require('../core/yida-i18n');
 const { parseOpenOption, withBrowserHandoff } = require('../core/browser-handoff');
 const { throwCommandError } = require('../core/command-errors');
-const {
-  assertLegacyDirectWriteAllowed,
-  extractLegacyGuardArgs,
-} = require('../core/legacy-schema-guard');
 const { assertPresetThemeKey } = require('./theme-presets');
 
 const DEFAULT_APP_OPTIONS = {
@@ -285,8 +281,7 @@ function buildCreateAppPayload(params, auth, contentLocale, openExclusive, openP
 
 async function run(args) {
   const openOption = parseOpenOption(args);
-  const guardSplit = extractLegacyGuardArgs(openOption.args);
-  args = guardSplit.args;
+  args = openOption.args;
 
   if (hasHelpFlag(args)) {
     printUsage();
@@ -306,12 +301,6 @@ async function run(args) {
     chalkError(t('create_app.usage'), { hint: t('create_app.example') });
   }
 
-  assertLegacyDirectWriteAllowed({
-    command: 'create-app',
-    resourceType: 'app',
-    action: 'create',
-  }, { guardOptions: guardSplit.guardOptions });
-
   const { appName, description, icon, iconColor, colour, navTheme, layoutDirection } = params;
 
   const { c, banner, step, label, success: chalkSuccess, result: chalkResult } = require('../core/chalk');

package/lib/app/create-form/args.js

@@ -85,7 +85,6 @@ function createParseArgs(dependencies) {
       labelAlign: 'top',
       contentLocale: null,
       browserOpenMode: openOption.mode,
-      legacyGuardOptions: openOption.legacyGuardOptions || null,
     };
 
     const args = [...rawArgs];