openyida 2026.8.25 → 2026.8.27-1

package/README.md

@@ -320,8 +320,6 @@ OPENYIDA_E2E=1 npm run eval:all -- --skill yida-dashboard --screenshot
 # whitelist. Use the Node version you start it with, so run `nvm use 20` first.
 npm run eval:dashboard          # http://127.0.0.1:4500
 
-# You can also run eval directly via the CLI:
-openyida eval --mode comprehensive --skill yida-dashboard
 ```
 
 Configuration precedence is `CLI flag > env (OPENYIDA_EVAL_*) > scripts/eval/eval.config.json > defaults`.
@@ -349,6 +347,9 @@ openyida connector list
 openyida integration create APP_XXX FORM_XXX "Sync customer data"
 openyida integration create APP_XXX FORM_XXX "Approval result notify" \
   --events processFinish --approval-actions agree,disagree --receivers 123456
+# Capability probe only; currently fails closed before auth/spec reads/remote writes
+openyida integration update APP_XXX FORM_XXX LPROC_XXX \
+  --spec .cache/openyida/integration/desired-spec.json
 openyida create-report APP_XXX "Sales Dashboard" .cache/openyida/reports/charts.json
 openyida append-chart APP_XXX REPORT_XXX .cache/openyida/reports/chart.json
 ```
@@ -461,7 +462,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | `openyida connector list` | List HTTP connectors |
 | `openyida connector create "name" "domain" ...` | Create a connector |
 | `openyida connector detail <id>` | View connector details |
-| `openyida connector delete <id>` | Delete a connector |
+| `openyida connector delete <id> [--force]` | Show manual deletion guidance (CLI does not delete) |
 | `openyida connector add-action --operations <file> --connector-id <id>` | Add an action |
 | `openyida connector list-actions <id>` | List actions |
 | `openyida connector delete-action <id> <operation-id>` | Delete an action |
@@ -477,6 +478,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | Command | Description |
 |---------|-------------|
 | `openyida integration create <appType> ... [--spec file.json]` | Create integration automation flow |
+| `openyida integration update <appType> <formUuid> <processCode> --spec <desired-spec.json> [--publish]` | Probe integration update capability (currently blocked without full readback) |
 | `openyida integration list <appType> [--form-uuid <uuid>] [--status y\|n] [--json]` | List integration automation flows |
 | `openyida integration enable <appType> <formUuid> <processCode>` | Enable integration automation flow |
 | `openyida integration disable <appType> <formUuid> <processCode>` | Disable integration automation flow |
@@ -497,7 +499,6 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | `openyida copy [--force]` | Copy project working directory |
 | `openyida sample [--list]` | Output code samples/templates |
 | `openyida doctor [--fix]` | Environment diagnostics & auto-fix |
-| `openyida eval --mode <mode> [--skill <name>] [--runs N]` | Multi-dimensional skill evaluation (doc quality, routing accuracy, safety, etc.) |
 | `openyida db-seq-fix [--fix]` | Detect and repair PostgreSQL sequence drift |
 | `openyida formula evaluate <formula\|file> [--schema file]` | Static-check Yida formula syntax and field refs |
 | `openyida update` | Check and update to latest version |
@@ -537,7 +538,7 @@ Form field definitions can include `alias` or `componentAlias` to populate Yida
 
 #### Workflow, Reports, and Integrations
 
-`openyida integration create` supports form events (`insert`, `update`, `delete`, `comment`) and approval events (`processFinish`, `activityTask`; aliases: `approval`, `approvalNode`). Approval events require `--approval-actions agree,disagree,terminated`; `activityTask` also requires `--approval-node-ids <nodeId,...>`.
+`openyida integration create` supports form events (`insert`, `update`, `delete`, `comment`) and approval events (`processFinish`, `activityTask`; aliases: `approval`, `approvalNode`). Approval events require `--approval-actions agree,disagree,terminated`; `activityTask` also requires `--approval-node-ids <nodeId,...>`. Passing `--process-code` selects a full graph replacement and now requires explicit `--replace`; it is not a safe update. `integration update` currently performs capability detection only: because full platform `processJson` + `viewJson` readback is unproven, it writes a redacted local probe artifact and returns `PLATFORM_PROBE_REQUIRED` before authentication, spec reading, or remote writes. It does not edit a flow.
 
 ## Agent Skills
 

package/bin/yida.js

@@ -1173,6 +1173,9 @@ async function main() {
       if (subCommand === 'create') {
         const { run: runIntegration } = require('../lib/integration/integration-create');
         await runIntegration(subArgs);
+      } else if (subCommand === 'update') {
+        const { run: runIntegrationUpdate } = require('../lib/integration/integration-update');
+        await runIntegrationUpdate(subArgs);
       } else if (subCommand === 'list') {
         const { runList } = require('../lib/integration/integration-list');
         await runList(subArgs);
@@ -1255,12 +1258,6 @@ async function main() {
       break;
     }
 
-    case 'eval': {
-      const { main: evalMain } = require('../scripts/eval/runner');
-      await evalMain(args);
-      break;
-    }
-
     default: {
       throwUnknownCommand(command, args);
     }

package/lib/aggregate-table/aggregate-table.js

@@ -8,16 +8,13 @@ const { t } = require('../core/i18n');
 const { buildYidaTitleI18n, normalizeYidaLocale, resolveContentLocale } = require('../core/yida-i18n');
 const { parseOpenOption, withBrowserHandoff } = require('../core/browser-handoff');
 const { fetchFormPageList, resolveLocalizedText } = require('../app/form-navigation');
+const {
+  DESIGN_KEYS,
+  assertAggregateDesignConfig,
+  assertAggregateDesignReadback,
+} = require('./contract');
 
 const FORM_TYPE_VIRTUAL_VIEW = 'virtualView';
-const DESIGN_KEYS = [
-  'relationForms',
-  'relationships',
-  'aggregatedFields',
-  'auxFields',
-  'formulaFields',
-  'validators',
-];
 
 function hasHelpFlag(args) {
   return (args || []).includes('--help') || (args || []).includes('-h');
@@ -133,7 +130,7 @@ async function checkVirtualViewFeature(authRef, appType) {
 }
 
 async function createEmptyVirtualView(authRef, appType, title) {
-  return createYidaClient({ authRef }).postForm(
+  return createYidaClient({ authRef }).postFormOnce(
     `/dingtalk/web/${appType}/query/formdesign/saveFormSchemaInfo.json`,
     buildCreateEmptyPostData(title)
   );
@@ -157,7 +154,11 @@ async function postVirtualViewDesign(authRef, appType, formUuid, designInfo, act
     throw new Error(`Unknown aggregate table action: ${action}`);
   }
 
-  return createYidaClient({ authRef }).postForm(
+  const client = createYidaClient({ authRef });
+  const post = action === 'save' || action === 'publish'
+    ? client.postFormOnce.bind(client)
+    : client.postForm.bind(client);
+  return post(
     `/alibaba/web/${appType}/query/virtualview/${endpoint}`,
     buildDesignPostData(formUuid, designInfo, gmtModified)
   );
@@ -318,6 +319,11 @@ async function runCreateEmpty(args) {
   const createResult = await createEmptyVirtualView(authRef, appType, name);
   const created = assertSuccess(createResult, t('aggregate_table.create_empty'));
   const formUuid = (created && created.formUuid) || created;
+  if ((typeof formUuid !== 'string' && typeof formUuid !== 'number') || String(formUuid).length === 0) {
+    const error = new Error('Aggregate table creation returned no recoverable identity.');
+    error.code = 'AGGREGATE_CREATE_IDENTITY_MISSING';
+    throw error;
+  }
   const designUrl = buildDesignUrl(authRef.baseUrl, appType, formUuid, { fromNew: true });
   const workbenchUrl = buildWorkbenchUrl(authRef.baseUrl, appType, formUuid);
 
@@ -401,6 +407,7 @@ async function runPreview(args) {
 
   const authRef = await createAuthRef();
   const designInfo = normalizeDesignConfig(readJsonInput(input), formUuid);
+  assertAggregateDesignConfig(designInfo, { mode: 'draft' });
   const result = await postVirtualViewDesign(authRef, appType, formUuid, designInfo, 'preview');
   const rows = assertSuccess(result, t('aggregate_table.preview'));
   const rowCount = Array.isArray(rows) ? rows.length : 0;
@@ -439,13 +446,28 @@ async function runSaveOrPublish(args, action) {
   }
 
   const authRef = await createAuthRef();
-  const { designInfo, gmtModified } = await loadDesignForMutation(authRef, appType, formUuid, input, action);
-  if (isPublish && designInfo.relationForms.length === 0) {
-    throw new Error(t('aggregate_table.publish_requires_source'));
-  }
+  const { designInfo, currentConfig, gmtModified } = await loadDesignForMutation(authRef, appType, formUuid, input, action);
+  assertAggregateDesignConfig(designInfo, { mode: isPublish ? 'publish' : 'draft' });
 
   const result = await postVirtualViewDesign(authRef, appType, formUuid, designInfo, action, gmtModified);
   const content = assertSuccess(result, isPublish ? t('aggregate_table.publish') : t('aggregate_table.save'));
+  const readbackResult = await getVirtualViewConfig(authRef, appType, formUuid);
+  const readback = assertSuccess(readbackResult, t('aggregate_table.inspect'));
+  assertAggregateDesignReadback(designInfo, readback);
+  const responseRevision = content && content.gmtModified;
+  const readbackRevision = readback && readback.gmtModified;
+  if ((responseRevision === undefined || responseRevision === null) &&
+      (readbackRevision === undefined || readbackRevision === null)) {
+    const error = new Error('AGGREGATE_WRITE_REVISION_MISSING');
+    error.code = 'AGGREGATE_WRITE_REVISION_MISSING';
+    throw error;
+  }
+  if ((responseRevision === undefined || responseRevision === null) &&
+      currentConfig && String(readbackRevision) === String(currentConfig.gmtModified)) {
+    const error = new Error('AGGREGATE_WRITE_REVISION_UNCHANGED');
+    error.code = 'AGGREGATE_WRITE_REVISION_UNCHANGED';
+    throw error;
+  }
   const designUrl = buildDesignUrl(authRef.baseUrl, appType, formUuid);
   const workbenchUrl = buildWorkbenchUrl(authRef.baseUrl, appType, formUuid);
 
@@ -465,6 +487,7 @@ async function runSaveOrPublish(args, action) {
     formUuid,
     gmtModified: content && content.gmtModified,
     response: content,
+    readbackVerified: true,
     designUrl,
     workbenchUrl,
   }, designUrl, { stage: `aggregate_table_${action}_success`, title: formUuid }, flags.openMode), null, 2));

package/lib/aggregate-table/contract.js

@@ -0,0 +1,234 @@
+'use strict';
+
+const { isDeepStrictEqual } = require('util');
+
+const DESIGN_KEYS = [
+  'relationForms',
+  'relationships',
+  'aggregatedFields',
+  'auxFields',
+  'formulaFields',
+  'validators',
+];
+
+// Mirrors the designer defaults read from configLimit. Only limits that map to
+// persisted design arrays are enforced here.
+const DEFAULT_LIMITS = Object.freeze({
+  relationForms: 10,
+  relationships: 10,
+  formulaFields: 10,
+  auxFields: 10,
+});
+
+function addError(errors, code, path) {
+  errors.push({ code, path });
+}
+
+function isNonEmptyValue(value) {
+  return value !== null && value !== undefined && String(value).length > 0;
+}
+
+function validateArrayShapes(config, errors) {
+  for (const key of DESIGN_KEYS) {
+    if (!Array.isArray(config && config[key])) {
+      addError(errors, 'AGGREGATE_DESIGN_ARRAY_REQUIRED', key);
+    }
+  }
+}
+
+function validateLimits(config, limits, errors) {
+  const limitCodes = {
+    relationForms: 'AGGREGATE_RELATION_FORMS_LIMIT',
+    relationships: 'AGGREGATE_RELATIONSHIPS_LIMIT',
+    formulaFields: 'AGGREGATE_FORMULA_FIELDS_LIMIT',
+    auxFields: 'AGGREGATE_AUX_FIELDS_LIMIT',
+  };
+
+  for (const [key, limit] of Object.entries(limits)) {
+    if (Array.isArray(config[key]) && config[key].length > limit) {
+      addError(errors, limitCodes[key] || 'AGGREGATE_DESIGN_LIMIT', key);
+    }
+  }
+}
+
+function validateEntries(config, errors) {
+  if (Array.isArray(config.relationForms)) {
+    config.relationForms.forEach((item, index) => {
+      if (!item || !isNonEmptyValue(item.formUuid)) {
+        addError(errors, 'AGGREGATE_RELATION_FORM_INVALID', `relationForms[${index}]`);
+      }
+    });
+  }
+
+  if (Array.isArray(config.relationships)) {
+    config.relationships.forEach((item, index) => {
+      const relationshipInfos = item && item.relationshipInfos;
+      if (!Array.isArray(relationshipInfos) || relationshipInfos.length === 0 ||
+          relationshipInfos.some((entry) => entry === null || entry === undefined)) {
+        addError(errors, 'AGGREGATE_RELATIONSHIP_INVALID', `relationships[${index}]`);
+      }
+    });
+  }
+
+  if (Array.isArray(config.aggregatedFields)) {
+    config.aggregatedFields.forEach((item, index) => {
+      if (!item || !isNonEmptyValue(item.name)) {
+        addError(errors, 'AGGREGATE_COLUMN_INVALID', `aggregatedFields[${index}]`);
+      }
+    });
+  }
+
+  if (Array.isArray(config.formulaFields)) {
+    config.formulaFields.forEach((item, index) => {
+      if (!item || !isNonEmptyValue(item.formula)) {
+        addError(errors, 'AGGREGATE_FORMULA_FIELD_INVALID', `formulaFields[${index}]`);
+      }
+    });
+  }
+
+  if (Array.isArray(config.validators)) {
+    config.validators.forEach((item, index) => {
+      if (!item || !isNonEmptyValue(item.formula)) {
+        addError(errors, 'AGGREGATE_VALIDATOR_INVALID', `validators[${index}]`);
+      }
+    });
+  }
+}
+
+function validatePublishCompleteness(config, errors) {
+  const required = [
+    ['relationForms', 'AGGREGATE_RELATION_FORMS_REQUIRED'],
+    ['relationships', 'AGGREGATE_RELATIONSHIPS_REQUIRED'],
+    ['aggregatedFields', 'AGGREGATE_COLUMNS_REQUIRED'],
+    ['formulaFields', 'AGGREGATE_FORMULA_FIELDS_REQUIRED'],
+  ];
+
+  for (const [key, code] of required) {
+    if (!Array.isArray(config[key]) || config[key].length === 0) {
+      addError(errors, code, key);
+    }
+  }
+}
+
+function validateAggregateDesignConfig(config, options = {}) {
+  const mode = options.mode || 'draft';
+  if (mode !== 'draft' && mode !== 'publish') {
+    throw new Error(`Unsupported aggregate contract mode: ${mode}`);
+  }
+
+  const safeConfig = config && typeof config === 'object' && !Array.isArray(config)
+    ? config
+    : {};
+  const limits = { ...DEFAULT_LIMITS, ...(options.limits || {}) };
+  const errors = [];
+
+  validateArrayShapes(safeConfig, errors);
+  validateLimits(safeConfig, limits, errors);
+  validateEntries(safeConfig, errors);
+  if (mode === 'publish') {
+    validatePublishCompleteness(safeConfig, errors);
+  }
+
+  return { valid: errors.length === 0, errors };
+}
+
+function assertAggregateDesignConfig(config, options = {}) {
+  const result = validateAggregateDesignConfig(config, options);
+  if (result.valid) {
+    return config;
+  }
+
+  const error = new Error(result.errors.map((item) => item.code).join(', '));
+  error.name = 'AggregateDesignContractError';
+  error.code = 'AGGREGATE_DESIGN_CONTRACT_INVALID';
+  error.details = result.errors;
+  throw error;
+}
+
+function projectAggregateDesignConfig(config) {
+  const safeConfig = config && typeof config === 'object' ? config : {};
+  const projected = {};
+  for (const key of DESIGN_KEYS) {
+    projected[key] = Array.isArray(safeConfig[key]) ? safeConfig[key] : [];
+  }
+  return projected;
+}
+
+function isI18nValue(value) {
+  return value && typeof value === 'object' && !Array.isArray(value) && (
+    value.type === 'i18n' ||
+    Object.prototype.hasOwnProperty.call(value, 'zh_CN') ||
+    Object.prototype.hasOwnProperty.call(value, 'en_US') ||
+    Object.prototype.hasOwnProperty.call(value, 'pureEn_US')
+  );
+}
+
+function canonicalizeI18nValue(value) {
+  const zhCN = value.zh_CN || value.value || '';
+  const enUS = value.en_US || value.pureEn_US || zhCN;
+  return {
+    type: value.type || 'i18n',
+    zh_CN: String(zhCN),
+    en_US: String(enUS),
+  };
+}
+
+function isEmptyFilter(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return false;
+  }
+  const rules = value.rules;
+  return (rules === undefined || rules === null || (Array.isArray(rules) && rules.length === 0)) &&
+    !value.logicOperator;
+}
+
+function canonicalizeAggregateValue(value, key = '') {
+  if (isI18nValue(value)) {
+    return canonicalizeI18nValue(value);
+  }
+  if (key === 'filter' && isEmptyFilter(value)) {
+    return {};
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => canonicalizeAggregateValue(item));
+  }
+  if (!value || typeof value !== 'object') {
+    if (key === 'precision' && value !== undefined && value !== null && value !== '') {
+      return String(value);
+    }
+    return value;
+  }
+
+  const result = {};
+  for (const childKey of Object.keys(value)) {
+    const childValue = value[childKey];
+    if ((childKey === 'filterState' && (childValue === null || childValue === undefined)) ||
+        (childKey === 'parentId' && (childValue === '' || childValue === null || childValue === undefined))) {
+      continue;
+    }
+    result[childKey] = canonicalizeAggregateValue(childValue, childKey);
+  }
+  return result;
+}
+
+function assertAggregateDesignReadback(expected, actual) {
+  const expectedProjection = canonicalizeAggregateValue(projectAggregateDesignConfig(expected));
+  const actualProjection = canonicalizeAggregateValue(projectAggregateDesignConfig(actual));
+  if (isDeepStrictEqual(expectedProjection, actualProjection)) {
+    return actualProjection;
+  }
+
+  const error = new Error('AGGREGATE_DESIGN_READBACK_MISMATCH');
+  error.name = 'AggregateDesignReadbackError';
+  error.code = 'AGGREGATE_DESIGN_READBACK_MISMATCH';
+  throw error;
+}
+
+module.exports = {
+  DEFAULT_LIMITS,
+  DESIGN_KEYS,
+  assertAggregateDesignConfig,
+  assertAggregateDesignReadback,
+  projectAggregateDesignConfig,
+  validateAggregateDesignConfig,
+};

package/lib/app/canvas-compile.js

@@ -29,6 +29,7 @@
  */
 
 const Babel = require('@babel/standalone');
+const globals = require('globals');
 const {
   assertNoEmojiInArtifactName,
   assertNoEmojiInText,
@@ -46,6 +47,7 @@ const {
   findFormDetailLinkIssues,
   formatFormDetailLinkMessage,
 } = require('./form-detail-link-guard');
+const { t } = require('../core/i18n');
 
 /**
  * 依赖 → window 别名白名单，用于把 import 改写到运行时全局对象。
@@ -132,6 +134,15 @@ const BARE_DEPENDENCY_GLOBALS = Object.freeze({
   },
 });
 
+// 以标准 ECMAScript + Browser 环境定义为完整白名单；Canvas 装配器额外
+// 注入 iframeWindow / parentWindow。Node 专属全局不属于页面运行时，不能放行。
+const CANVAS_RUNTIME_GLOBAL_IDENTIFIERS = new Set([
+  ...Object.keys(globals.builtin),
+  ...Object.keys(globals.browser),
+  'iframeWindow',
+  'parentWindow',
+]);
+
 const LUCIDE_REACT_PACKAGE = 'lucide-react';
 const LUCIDE_DYNAMIC_ICON_ALIAS = 'DynamicIcon';
 const LUCIDE_MODULE_ALIAS = 'LucideReact';
@@ -267,6 +278,159 @@ function assertNoBareDependencyGlobals(source, options = {}) {
   });
 }
 
+function findUnboundIdentifierIssues(source, options = {}) {
+  const issuesByName = new Map();
+  const allowedIdentifiers = new Set(CANVAS_RUNTIME_GLOBAL_IDENTIFIERS);
+  (options.implicitIdentifiers || []).forEach((name) => allowedIdentifiers.add(name));
+
+  const guardPlugin = () => ({
+    name: 'yida-canvas-unbound-identifier-guard',
+    visitor: {
+      ReferencedIdentifier(path) {
+        const name = path.node.name;
+        if (allowedIdentifiers.has(name) || path.scope.hasBinding(name) || issuesByName.has(name)) {
+          return;
+        }
+        issuesByName.set(name, {
+          name,
+          line: path.node.loc && path.node.loc.start ? path.node.loc.start.line : 0,
+          column: path.node.loc && path.node.loc.start ? path.node.loc.start.column : 0,
+        });
+      },
+    },
+  });
+
+  Babel.transform(source, {
+    filename: 'canvas.tsx',
+    presets: [
+      ['typescript', { allExtensions: true, isTSX: true, allowDeclareFields: true }],
+      ['react', { runtime: 'classic' }],
+    ],
+    plugins: [guardPlugin],
+    sourceType: 'module',
+    compact: false,
+    babelrc: false,
+    configFile: false,
+  });
+
+  return Array.from(issuesByName.values());
+}
+
+function formatUnboundIdentifierMessage(issues) {
+  const summary = issues
+    .map(issue => `${issue.name} (${issue.line}:${issue.column + 1})`)
+    .join(', ');
+  return t('publish.canvas_unbound_identifiers', summary);
+}
+
+function assertNoUnboundIdentifiers(source, options = {}) {
+  const issues = findUnboundIdentifierIssues(source, options);
+  if (issues.length === 0) {
+    return;
+  }
+  throw new CliError(formatUnboundIdentifierMessage(issues), {
+    code: 'OPENYIDA_CANVAS_UNBOUND_IDENTIFIER',
+    details: {
+      stage: 'canvas_compile',
+      sourcePath: options.sourcePath || '',
+      issues,
+    },
+  });
+}
+
+function findUnavailableCanvasInstanceApiIssues(source) {
+  const issues = [];
+  const seen = new Set();
+
+  function addIssue(path, api) {
+    if (seen.has(api)) {
+      return;
+    }
+    seen.add(api);
+    issues.push({
+      api,
+      line: path.node.loc && path.node.loc.start ? path.node.loc.start.line : 0,
+      column: path.node.loc && path.node.loc.start ? path.node.loc.start.column : 0,
+    });
+  }
+
+  const guardPlugin = ({ types: types }) => ({
+    name: 'yida-canvas-instance-api-guard',
+    visitor: {
+      MemberExpression(path) {
+        const object = path.node.object;
+        const property = path.node.property;
+        const propertyName = path.node.computed && types.isStringLiteral(property)
+          ? property.value
+          : (types.isIdentifier(property) ? property.name : '');
+
+        if (types.isMemberExpression(object)) {
+          const owner = object.object;
+          const ownerProperty = object.property;
+          const ownerPropertyName = object.computed && types.isStringLiteral(ownerProperty)
+            ? ownerProperty.value
+            : (types.isIdentifier(ownerProperty) ? ownerProperty.name : '');
+          if (
+            types.isIdentifier(owner, { name: 'props' }) &&
+            ownerPropertyName === 'utils' &&
+            propertyName === 'getDataList'
+          ) {
+            addIssue(path, 'props.utils.getDataList');
+            return;
+          }
+          if (
+            types.isThisExpression(owner) &&
+            ownerPropertyName === 'utils' &&
+            propertyName === 'yida'
+          ) {
+            addIssue(path, 'this.utils.yida');
+            return;
+          }
+        }
+        if (!types.isThisExpression(object)) {
+          return;
+        }
+        if (propertyName === 'dataSourceMap') {
+          addIssue(path, 'this.dataSourceMap');
+        } else if (propertyName === '$') {
+          addIssue(path, 'this.$');
+        }
+      },
+    },
+  });
+
+  Babel.transform(source, {
+    filename: 'canvas.tsx',
+    presets: [
+      ['typescript', { allExtensions: true, isTSX: true, allowDeclareFields: true }],
+      ['react', { runtime: 'classic' }],
+    ],
+    plugins: [guardPlugin],
+    sourceType: 'module',
+    compact: false,
+    babelrc: false,
+    configFile: false,
+  });
+
+  return issues;
+}
+
+function assertNoUnavailableCanvasInstanceApis(source, options = {}) {
+  const issues = findUnavailableCanvasInstanceApiIssues(source);
+  if (issues.length === 0) {
+    return;
+  }
+  const summary = issues.map(issue => issue.api).join(', ');
+  throw new CliError(t('publish.canvas_instance_api_unavailable', summary), {
+    code: 'OPENYIDA_CANVAS_INSTANCE_API_UNAVAILABLE',
+    details: {
+      stage: 'canvas_compile',
+      sourcePath: options.sourcePath || '',
+      issues,
+    },
+  });
+}
+
 /**
  * 从源码里正则抽取裸包名（过滤相对/绝对路径），去重排序。
  * 对齐画布运行时的依赖抽取行为。
@@ -617,6 +781,7 @@ function compileCanvasLocal(source, options = {}) {
       },
     });
   }
+  assertNoUnavailableCanvasInstanceApis(source, options);
   assertNoBareDependencyGlobals(source, options);
   assertNoManualDependencyGlobals(source, options);
 
@@ -643,6 +808,10 @@ function compileCanvasLocal(source, options = {}) {
   // 'react' 进入依赖清单（运行时据此注入 React UMD）。
   const usesJsxRuntime = /\bReact\.createElement\b|\bReact\.Fragment\b/.test(intermediate);
   const hasReactBinding = /\b(var|let|const)\s+React\b/.test(intermediate) || /\bimport\s+React\b/.test(intermediate);
+  assertNoUnboundIdentifiers(source, {
+    sourcePath: options.sourcePath,
+    implicitIdentifiers: usesJsxRuntime ? ['React'] : [],
+  });
   if (usesJsxRuntime && !hasReactBinding) {
     intermediate = "import React from 'react';\n" + intermediate;
     if (!importedModules.includes('react')) {

package/lib/app/create-form/api-path.js

@@ -10,14 +10,23 @@
  * @param {object} [options]       可选项
  * @param {string} [options.prefix]        额外的路径前缀（会以 / 拼接）
  * @param {string} [options.namespace]     命名空间，默认 dingtalk
+ * @param {'formdesign'|'formnav'} [options.queryModule] 查询模块，默认 formdesign
  * @param {boolean} [options.addTimestamp] 是否追加 _stamp 时间戳查询参数
  * @returns {string} 拼接完成的 API 请求路径
  */
 function buildApiPath(appType, apiName, options = {}) {
-  const { prefix = '', namespace = 'dingtalk', addTimestamp = false } = options;
+  const {
+    prefix = '',
+    namespace = 'dingtalk',
+    queryModule = 'formdesign',
+    addTimestamp = false,
+  } = options;
+  if (queryModule !== 'formdesign' && queryModule !== 'formnav') {
+    throw new Error(`Unsupported query module: ${queryModule}`);
+  }
   const prefixPath = prefix ? `/${prefix}` : '';
   const timestamp = addTimestamp ? `?_stamp=${Date.now()}` : '';
-  return `/${namespace}/web/${appType}${prefixPath}/query/formdesign/${apiName}.json${timestamp}`;
+  return `/${namespace}/web/${appType}${prefixPath}/query/${queryModule}/${apiName}.json${timestamp}`;
 }
 
 module.exports = {