openyida 2026.9.1 → 2026.9.2-beta.0

package/README.md

@@ -200,7 +200,7 @@ openyida configure-process APP_XXX FORM_XXX .cache/openyida/process/process.json
 openyida process preview APP_XXX PROC_INST_XXX --output .cache/openyida/process/process.html
 openyida data query form APP_XXX FORM_XXX --page 1 --size 20
 openyida data query form APP_XXX FORM_XXX --dynamic-order '{"dateField_xxx":"-"}'
-openyida data create form APP_XXX FORM_XXX --data-file .cache/openyida/data-import/record.json
+openyida data create form APP_XXX FORM_XXX --expect-form-name 客户 --expect-form-type receipt --data-file .cache/openyida/data-import/record.json
 openyida get-permission APP_XXX FORM_XXX
 ```
 
@@ -430,7 +430,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 
 | Command | Description |
 |---------|-------------|
-| `openyida data <query\|get\|create\|update> <resource> ... \| delete form <appType> <formUuid> --inst-id <id> --confirm [--json]` | Unified data management (form/process/task/subform) |
+| `openyida data <query\|get\|create\|update> <resource> ... \| delete form <appType> <formUuid> --inst-id <id> --expect-form-name <name> --expect-form-type receipt --confirm [--json]` | Unified data management (form/process/task/subform) |
 | `openyida task-center <type> [options]` | Global task center (todo/processed/cc etc.) |
 | `openyida basic-info <overview\|commodity\|grant\|capacity\|quota\|abs-path\|dataflow\|i18n\|domain>` | Query organization basic info, capacity, quotas, and domain settings |
 | `openyida read-dingtalk-doc <docUrl> [--output <file>] [--json]` | Fetch Markdown content from a DingTalk document |

package/lib/app/display-page-readback.js

@@ -23,10 +23,30 @@ function fingerprint(value) {
   return crypto.createHash('sha256').update(normalized).digest('hex');
 }
 
+function rawFingerprint(value) {
+  if (typeof value !== 'string' || !value) {
+    return '';
+  }
+  return crypto.createHash('sha256').update(value, 'utf8').digest('hex');
+}
+
+function positiveSize(value) {
+  const size = Number(value);
+  return Number.isFinite(size) && size > 0 ? size : 0;
+}
+
+function sha256(value) {
+  const digest = String(value || '').toLowerCase();
+  return /^[a-f0-9]{64}$/.test(digest) ? digest : '';
+}
+
 function createEmptyDisplayInfo() {
   return {
     hasYidaCodeCanvas: false,
+    hasCodeBundle: false,
     hasNativeJsx: false,
+    codeBundleCount: 0,
+    bundleIds: [],
     runtimeCodeBytes: 0,
     sourceCodeBytes: 0,
     compiledCodeBytes: 0,
@@ -34,6 +54,8 @@ function createEmptyDisplayInfo() {
     componentCount: 0,
     canvasRuntimeCode: '',
     canvasSourceCode: '',
+    canvasRuntimeSha256: '',
+    canvasSourceSha256: '',
     nativeCompiledCode: '',
     nativeSourceCode: '',
   };
@@ -79,12 +101,37 @@ function traverseDisplayNodes(node, info) {
 
   if (node.componentName === 'YidaCodeCanvas') {
     const props = node.props || {};
+    const codeBundle = props.codeBundle && typeof props.codeBundle === 'object'
+      ? props.codeBundle
+      : null;
     info.hasYidaCodeCanvas = true;
     info.componentCount++;
-    info.canvasRuntimeCode = props.runtimeCode || '';
-    info.canvasSourceCode = props.code || '';
+    if (typeof props.runtimeCode === 'string' && props.runtimeCode) {
+      info.canvasRuntimeCode = props.runtimeCode;
+    }
+    if (typeof props.code === 'string' && props.code) {
+      info.canvasSourceCode = props.code;
+    }
     info.runtimeCodeBytes += codeBytes(props.runtimeCode);
     info.sourceCodeBytes += codeBytes(props.code);
+    if (codeBundle) {
+      const bundleId = String(codeBundle.bundleId || '');
+      const runtime = codeBundle.runtime && typeof codeBundle.runtime === 'object'
+        ? codeBundle.runtime
+        : {};
+      const source = codeBundle.source && typeof codeBundle.source === 'object'
+        ? codeBundle.source
+        : {};
+      info.hasCodeBundle = true;
+      info.codeBundleCount++;
+      if (bundleId && !info.bundleIds.includes(bundleId)) {
+        info.bundleIds.push(bundleId);
+      }
+      info.runtimeCodeBytes += positiveSize(runtime.size);
+      info.sourceCodeBytes += positiveSize(source.size);
+      info.canvasRuntimeSha256 = sha256(runtime.sha256) || info.canvasRuntimeSha256;
+      info.canvasSourceSha256 = sha256(source.sha256) || info.canvasSourceSha256;
+    }
     addImportedModules(info.importedModules, props.importedModules);
   } else if (node.componentName === 'Jsx') {
     info.hasNativeJsx = true;
@@ -133,7 +180,9 @@ function hasExpectedDisplayComponent(info, publishMode) {
     return false;
   }
   if (publishMode === 'canvas') {
-    return info.hasYidaCodeCanvas && info.runtimeCodeBytes > 0;
+    return info.hasYidaCodeCanvas && (
+      info.runtimeCodeBytes > 0 || !!info.canvasRuntimeSha256
+    );
   }
   return info.hasNativeJsx && info.compiledCodeBytes > 0;
 }
@@ -144,7 +193,10 @@ function summarizeDisplayPublishInfo(info) {
   }
   return {
     hasYidaCodeCanvas: info.hasYidaCodeCanvas,
+    hasCodeBundle: info.hasCodeBundle,
     hasNativeJsx: info.hasNativeJsx,
+    codeBundleCount: info.codeBundleCount,
+    bundleIds: info.bundleIds.slice(),
     runtimeCodeBytes: info.runtimeCodeBytes,
     sourceCodeBytes: info.sourceCodeBytes,
     compiledCodeBytes: info.compiledCodeBytes,
@@ -159,8 +211,13 @@ function verifyPublishedContentMatch(readbackSchema, expectedSchemaContent, publ
   const displayComponentPresent = hasExpectedDisplayComponent(readbackInfo, publishMode);
   const readbackArtifact = getPublishArtifact(readbackInfo, publishMode);
   const expectedArtifact = getPublishArtifact(expectedInfo, publishMode);
-  const readbackFingerprint = fingerprint(readbackArtifact);
-  const expectedFingerprint = fingerprint(expectedArtifact);
+  const codeBundleReadback = publishMode === 'canvas' && readbackInfo && readbackInfo.hasCodeBundle;
+  const readbackFingerprint = codeBundleReadback
+    ? readbackInfo.canvasRuntimeSha256
+    : fingerprint(readbackArtifact);
+  const expectedFingerprint = codeBundleReadback
+    ? rawFingerprint(expectedArtifact)
+    : fingerprint(expectedArtifact);
 
   return {
     readbackInfo,
@@ -180,6 +237,7 @@ function verifyPublishedContentMatch(readbackSchema, expectedSchemaContent, publ
 module.exports = {
   extractDisplayPublishInfo,
   fingerprint,
+  rawFingerprint,
   hasExpectedDisplayComponent,
   parseSchemaContent,
   summarizeDisplayPublishInfo,

package/lib/app/get-schema.js

@@ -9,6 +9,7 @@
 
 'use strict';
 
+const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const {
@@ -16,6 +17,7 @@ const {
   triggerLogin,
   resolveBaseUrl,
   httpGet,
+  httpGetRedirectText,
   requestWithAutoLogin,
 } = require('../core/utils');
 const { t } = require('../core/i18n');
@@ -24,7 +26,7 @@ const { fetchFormPageList } = require('./form-navigation');
 const { buildFieldResolution } = require('./schema-field-resolution');
 const { buildSemanticAnalysis } = require('./schema-semantic-analysis');
 
-// 需要在报表 fieldCode 中加 _value 后缀的字段类型
+// 报表运行时可能暴露 raw fieldId 或 _value；最终值必须由报表查询探针确认。
 const FIELD_TYPES_NEEDING_VALUE_SUFFIX = new Set([
   'SelectField',
   'MultiSelectField',
@@ -44,9 +46,9 @@ const FIELD_COMPONENT_NAMES = new Set([
 ]);
 
 /**
- * 从 Schema 中提取字段摘要，列出每个字段的真实 fieldId、组件别名和报表用 reportFieldCode。
+ * 从 Schema 中提取字段摘要。表单 Schema 只能提供报表字段候选，不能代替 cube 运行时元数据。
  * @param {object} schemaResult - getFormSchema API 返回结果
- * @returns {Array<{label, componentName, fieldId, alias, reportFieldCode, options}>}
+ * @returns {Array<{label, componentName, fieldId, alias, reportFieldCode, reportFieldCodeCandidates, options}>}
  */
 function extractFieldSummary(schemaResult) {
   const fields = [];
@@ -67,9 +69,9 @@ function extractFieldSummary(schemaResult) {
         ? (typeof labelRaw === 'object' ? (labelRaw.zh_CN || labelRaw.en_US || '') : String(labelRaw))
         : '';
       const fieldId = props.fieldId || '';
-      const reportFieldCode = FIELD_TYPES_NEEDING_VALUE_SUFFIX.has(node.componentName)
-        ? `${fieldId}_value`
-        : fieldId;
+      const reportFieldCodeCandidates = FIELD_TYPES_NEEDING_VALUE_SUFFIX.has(node.componentName)
+        ? [fieldId, `${fieldId}_value`]
+        : [fieldId];
       if (fieldId) {
         const options = extractOptionSummary(props);
         const optionSource = getOptionSource(props) || [];
@@ -87,7 +89,8 @@ function extractFieldSummary(schemaResult) {
           componentName: node.componentName,
           fieldId,
           alias: aliasMaps.aliasByFieldId[fieldId] || '',
-          reportFieldCode,
+          reportFieldCode: fieldId,
+          reportFieldCodeCandidates,
           options,
           optionCount: optionSource.length,
           optionsTruncated: optionSource.length > options.length,
@@ -226,6 +229,122 @@ function resolveSchemaContent(schemaResult) {
   return parseJsonObject(content);
 }
 
+function validateCodeBundleDescriptor(codeBundle) {
+  const bundleId = String(codeBundle && codeBundle.bundleId || '');
+  const source = codeBundle && codeBundle.source;
+  const runtime = codeBundle && codeBundle.runtime;
+  const validSha256 = value => /^[a-f0-9]{64}$/.test(String(value || ''));
+  const validSize = value => Number.isFinite(Number(value)) && Number(value) > 0
+    && Number(value) <= 5 * 1024 * 1024;
+  if (!validSha256(bundleId)
+    || !source || !runtime
+    || !validSha256(source.sha256) || !validSize(source.size)
+    || !validSha256(runtime.sha256) || !validSize(runtime.size)
+    || Number(source.size) + Number(runtime.size) > 5 * 1024 * 1024) {
+    throw new Error('YidaCodeCanvas codeBundle 描述不合法');
+  }
+  return { bundleId, source, runtime };
+}
+
+function collectCodeBundleCanvases(content) {
+  const canvases = [];
+  function traverse(node) {
+    if (Array.isArray(node)) {
+      node.forEach(traverse);
+      return;
+    }
+    if (!node || typeof node !== 'object') {
+      return;
+    }
+    if (node.componentName === 'YidaCodeCanvas' && node.id && node.props
+      && node.props.codeBundle && typeof node.props.codeBundle === 'object') {
+      canvases.push({ props: node.props, descriptor: validateCodeBundleDescriptor(node.props.codeBundle) });
+    }
+    Object.values(node).forEach(traverse);
+  }
+  traverse(content);
+  return canvases;
+}
+
+async function downloadCodeBundleArtifact(appType, formUuid, bundleId, artifact, descriptor, authRef) {
+  let responseMetadata = null;
+  const expectedContentTypes = artifact === 'source'
+    ? ['text/plain']
+    : ['application/javascript', 'text/javascript', 'application/x-javascript'];
+  const value = await requestWithAutoLogin((auth) => httpGetRedirectText(
+    auth.baseUrl,
+    `/alibaba/web/${appType}/query/codeBundle/download.json`,
+    { formUuid, bundleId, artifact },
+    {
+      silentStatus: true,
+      maxBytes: 5 * 1024 * 1024,
+      expectedContentTypes,
+      onResponseMetadata: metadata => {
+        responseMetadata = metadata;
+      },
+    }
+  ), authRef);
+  if (typeof value !== 'string') {
+    const message = value && (value.errorMsg || value.message);
+    throw new Error(message || `下载 CodeBundle ${artifact} 失败`);
+  }
+  const size = Buffer.byteLength(value, 'utf8');
+  const digest = crypto.createHash('sha256').update(value, 'utf8').digest('hex');
+  if (size !== Number(descriptor.size) || digest !== descriptor.sha256) {
+    const context = responseMetadata && responseMetadata.context
+      ? responseMetadata.context
+      : `baseUrl=${authRef && authRef.baseUrl || 'unknown'}`;
+    const error = new Error(t('common.code_bundle_integrity_failed', artifact, context));
+    error.code = 'CODE_BUNDLE_INTEGRITY_MISMATCH';
+    error.details = {
+      artifact,
+      expectedSize: Number(descriptor.size),
+      actualSize: size,
+      expectedSha256: descriptor.sha256,
+      actualSha256: digest,
+      ...(responseMetadata || {}),
+    };
+    throw error;
+  }
+  return value;
+}
+
+async function resolveCodeBundleSchema(schemaResult, appType, formUuid, authRef) {
+  const content = resolveSchemaContent(schemaResult);
+  if (!content) {
+    return schemaResult;
+  }
+  const canvases = collectCodeBundleCanvases(content);
+  if (canvases.length === 0) {
+    return schemaResult;
+  }
+
+  const downloaded = new Map();
+  for (const canvas of canvases) {
+    const { bundleId, source, runtime } = canvas.descriptor;
+    let code = downloaded.get(bundleId);
+    if (!code) {
+      const [sourceCode, runtimeCode] = await Promise.all([
+        downloadCodeBundleArtifact(appType, formUuid, bundleId, 'source', source, authRef),
+        downloadCodeBundleArtifact(appType, formUuid, bundleId, 'runtime', runtime, authRef),
+      ]);
+      code = { sourceCode, runtimeCode };
+      downloaded.set(bundleId, code);
+    }
+    canvas.props.code = code.sourceCode;
+    canvas.props.runtimeCode = code.runtimeCode;
+    delete canvas.props.codeBundle;
+  }
+
+  if (schemaResult && Object.prototype.hasOwnProperty.call(schemaResult, 'content')) {
+    schemaResult.content = typeof schemaResult.content === 'string'
+      ? JSON.stringify(content)
+      : content;
+    return schemaResult;
+  }
+  return content;
+}
+
 function addImportedModules(target, value) {
   let modules = value;
   if (typeof modules === 'string') {
@@ -268,7 +387,10 @@ function extractDisplayPageSummary(schemaResult) {
 
   const displayPage = {
     hasYidaCodeCanvas: false,
+    hasCodeBundle: false,
     hasNativeJsx: false,
+    codeBundleCount: 0,
+    bundleIds: [],
     runtimeCodeBytes: 0,
     sourceCodeBytes: 0,
     compiledCodeBytes: 0,
@@ -290,10 +412,29 @@ function extractDisplayPageSummary(schemaResult) {
 
     if (node.componentName === 'YidaCodeCanvas' && isComponentInstance(node)) {
       const props = node.props || {};
+      const codeBundle = props.codeBundle && typeof props.codeBundle === 'object'
+        ? props.codeBundle
+        : null;
       displayPage.hasYidaCodeCanvas = true;
       displayPage.componentCount++;
       displayPage.runtimeCodeBytes += codeBytes(props.runtimeCode);
       displayPage.sourceCodeBytes += codeBytes(props.code);
+      if (codeBundle) {
+        const source = codeBundle.source && typeof codeBundle.source === 'object'
+          ? codeBundle.source
+          : {};
+        const runtime = codeBundle.runtime && typeof codeBundle.runtime === 'object'
+          ? codeBundle.runtime
+          : {};
+        const bundleId = String(codeBundle.bundleId || '');
+        displayPage.hasCodeBundle = true;
+        displayPage.codeBundleCount++;
+        displayPage.sourceCodeBytes += Number(source.size) || 0;
+        displayPage.runtimeCodeBytes += Number(runtime.size) || 0;
+        if (bundleId && !displayPage.bundleIds.includes(bundleId)) {
+          displayPage.bundleIds.push(bundleId);
+        }
+      }
       addImportedModules(displayPage.importedModules, props.importedModules);
     } else if (node.componentName === 'Jsx' && isComponentInstance(node)) {
       displayPage.hasNativeJsx = true;
@@ -512,7 +653,7 @@ function printFieldSummary(result) {
     return;
   }
 
-  process.stderr.write(`\n  ${c.bold}${c.cyan}📋 字段摘要${c.reset} ${c.dim}（报表配置请使用 reportFieldCode）${c.reset}\n`);
+  process.stderr.write(`\n  ${c.bold}${c.cyan}📋 字段摘要${c.reset} ${c.dim}（报表字段最终以运行时查询探针为准）${c.reset}\n`);
   process.stderr.write(`  ${c.dim}${'─'.repeat(80)}${c.reset}\n`);
   process.stderr.write(
     `  ${c.bold}${'label'.padEnd(16)}${'alias'.padEnd(18)}${'componentName'.padEnd(20)}${'fieldId'.padEnd(28)}reportFieldCode${c.reset}\n`
@@ -524,7 +665,7 @@ function printFieldSummary(result) {
     );
   }
   process.stderr.write(`  ${c.dim}${'─'.repeat(80)}${c.reset}\n`);
-  process.stderr.write(`  ${c.dim}注：SelectField/EmployeeField 在报表中需加 _value 后缀${c.reset}\n\n`);
+  process.stderr.write(`  ${c.dim}注：Select/Employee 等字段同时返回 raw 与 _value 候选；create-report 会用真实图表查询验证并在原 reportId 内窄修复${c.reset}\n\n`);
 }
 
 function buildSchemaSummary(appType, formUuid, schemaResult, meta = {}) {
@@ -580,12 +721,15 @@ async function mapLimit(items, limit, iterator) {
   return results;
 }
 
-async function fetchSchemaRecord(appType, form, authRef, retries) {
+async function fetchSchemaRecord(appType, form, authRef, retries, options = {}) {
   let lastError = null;
   for (let attempt = 0; attempt <= retries; attempt++) {
     try {
       const result = await fetchSchema(appType, form.formUuid, authRef);
       if (isSuccessfulSchemaResult(result)) {
+        const resolvedResult = options.resolveCodeBundles
+          ? await resolveCodeBundleSchema(result, appType, form.formUuid, authRef)
+          : result;
         const record = {
           formUuid: form.formUuid,
           formName: form.formName,
@@ -593,10 +737,10 @@ async function fetchSchemaRecord(appType, form, authRef, retries) {
           pathName: form.pathName,
           success: true,
           attempts: attempt + 1,
-          fieldSummary: extractFieldSummary(result),
-          schema: result,
+          fieldSummary: extractFieldSummary(resolvedResult),
+          schema: resolvedResult,
         };
-        const displayPage = extractDisplayPageSummary(result);
+        const displayPage = extractDisplayPageSummary(resolvedResult);
         if (displayPage) {
           record.displayPage = displayPage;
         }
@@ -693,6 +837,10 @@ async function runSingle(parsed, authRef) {
     throwCommandError(errorMsg);
   }
 
+  if (!parsed.field && !parsed.compact && !parsed.summaryJson) {
+    result = await resolveCodeBundleSchema(result, parsed.appType, parsed.formUuid, authRef);
+  }
+
   // 保留既有 --field 返回结构；新 contract 仅由 --compact / --resolve-fields 触发。
   if (parsed.field) {
     const allFieldNodes = collectFieldNodes(result);
@@ -781,7 +929,9 @@ async function runBatch(parsed, authRef) {
   info(`  批量获取 ${forms.length} 个表单 Schema，并发 ${parsed.concurrency}，重试 ${parsed.retries}`);
 
   const records = await mapLimit(forms, parsed.concurrency, async (form) => {
-    const record = await fetchSchemaRecord(parsed.appType, form, authRef, parsed.retries);
+    const record = await fetchSchemaRecord(parsed.appType, form, authRef, parsed.retries, {
+      resolveCodeBundles: !parsed.summaryJson,
+    });
     if (record.success && parsed.analysisJson) {
       record.semanticAnalysis = buildSemanticAnalysis(
         parsed.appType,
@@ -847,5 +997,9 @@ module.exports = {
   fetchSchemaRecord,
   collectFieldNodes,
   findFieldNode,
+  validateCodeBundleDescriptor,
+  collectCodeBundleCanvases,
+  downloadCodeBundleArtifact,
+  resolveCodeBundleSchema,
   run,
 };

package/lib/app/publish.js

@@ -10,9 +10,9 @@
  *
  * 流程：
  * 1. 读取源文件，通过内置 babel-transform 编译 + UglifyJS 压缩
- * 2. 用代码动态构建 Schema，将 source/compiled 填入 actions.module
+ * 2. 用代码动态构建 Schema；Canvas 页面拆出 source/runtime 后统一保存
  * 3. 读取 token session，在写前确认登录态
- * 4. 通过 HTTP POST 调用 saveFormSchema，token 失效时尝试 token refresh
+ * 4. Canvas 调统一保存接口；普通 JSX 页面仍调用原 saveFormSchema
  */
 
 const fs = require('fs');
@@ -21,6 +21,7 @@ const querystring = require('querystring');
 const {
   findProjectRoot,
   httpPost,
+  httpPostMultipart,
   httpGet,
   requestWithAutoLogin,
 } = require('../core/utils');
@@ -58,6 +59,8 @@ const {
 const SCHEMA_VERSION = 'V5';
 const DOMAIN_CODE = 'tEXDRG';
 const PREFIX = '_view';
+const MAX_CODE_BUNDLE_BYTES = 5 * 1024 * 1024;
+const MAX_CANVAS_SCHEMA_SKELETON_BYTES = 1024 * 1024;
 
 // ── 参数解析 ─────────────────────────────────────────
 
@@ -284,6 +287,61 @@ function buildCanvasSchemaContent(sourceCode, runtimeCode, importedModules, form
   return buildCanvasPageSchemaContent(sourceCode, runtimeCode, importedModules, formUuid);
 }
 
+function buildCanvasSavePayload(schemaContent, sourceCode, runtimeCode) {
+  if (typeof sourceCode !== 'string' || sourceCode.length === 0
+    || typeof runtimeCode !== 'string' || runtimeCode.length === 0) {
+    throw new Error('Canvas source/runtime 不能为空');
+  }
+  const totalCodeBytes = Buffer.byteLength(sourceCode, 'utf8')
+    + Buffer.byteLength(runtimeCode, 'utf8');
+  if (totalCodeBytes > MAX_CODE_BUNDLE_BYTES) {
+    throw new Error('Canvas source/runtime 总大小不能超过 5 MiB');
+  }
+
+  let schema;
+  try {
+    schema = JSON.parse(schemaContent);
+  } catch {
+    throw new Error('Canvas Schema 不是有效 JSON');
+  }
+
+  const canvases = [];
+  function traverse(node) {
+    if (Array.isArray(node)) {
+      node.forEach(traverse);
+      return;
+    }
+    if (!node || typeof node !== 'object') {
+      return;
+    }
+    if (node.componentName === 'YidaCodeCanvas' && node.id) {
+      canvases.push(node);
+    }
+    Object.values(node).forEach(traverse);
+  }
+  traverse(schema);
+  if (canvases.length !== 1) {
+    throw new Error('Canvas Schema 必须且只能包含一个 YidaCodeCanvas 节点');
+  }
+
+  const canvas = canvases[0];
+  canvas.props = canvas.props && typeof canvas.props === 'object' ? canvas.props : {};
+  delete canvas.props.code;
+  delete canvas.props.runtimeCode;
+  delete canvas.props.codeBundle;
+
+  const skeletonContent = JSON.stringify(schema);
+  if (Buffer.byteLength(skeletonContent, 'utf8') > MAX_CANVAS_SCHEMA_SKELETON_BYTES) {
+    throw new Error('Canvas Schema 骨架不能超过 1 MiB');
+  }
+  return {
+    canvasNodeId: canvas.id,
+    content: skeletonContent,
+    sourceCode,
+    runtimeCode,
+  };
+}
+
 
 // ── 4. 发送 saveFormSchema 请求 ──────────────────────
 
@@ -313,6 +371,40 @@ function sendSaveRequestWithAuth(authRef, schemaContent, appType, formUuid, serv
   return httpPost(authRef.baseUrl, saveSchemaPath, postData, { silentStatus: true });
 }
 
+function sendCanvasSaveRequestWithAuth(authRef, payload, appType, formUuid, serverRevision) {
+  if (
+    !authRef ||
+    typeof authRef.baseUrl !== 'string' ||
+    authRef.baseUrl.length === 0 ||
+    !isTokenAuthRef(authRef)
+  ) {
+    const authError = new Error('Publish Canvas write authentication is not ready.');
+    authError.code = 'PUBLISH_SCHEMA_WRITE_PRECHECK_FAILED';
+    return Promise.reject(authError);
+  }
+  const gmtModified = requireSchemaServerRevision({ gmtModified: serverRevision });
+  const savePath = `/alibaba/web/${appType}/query/codeBundle/save.json?_stamp=${Date.now()}`;
+  return httpPostMultipart(authRef.baseUrl, savePath, {
+    _csrf_token: authRef.csrfToken,
+    formUuid,
+    gmtModified,
+    canvasNodeId: payload.canvasNodeId,
+    content: payload.content,
+    importSchema: true,
+  }, {
+    source: {
+      content: payload.sourceCode,
+      fileName: 'source.jsx',
+      contentType: 'text/plain; charset=UTF-8',
+    },
+    runtime: {
+      content: payload.runtimeCode,
+      fileName: 'runtime.js',
+      contentType: 'application/javascript; charset=UTF-8',
+    },
+  }, { silentStatus: true });
+}
+
 function walkFiles(dir, results, limit) {
   if (!fs.existsSync(dir) || results.length >= limit) {
     return;
@@ -622,6 +714,8 @@ async function runMain(argv) {
   baseUrl = authRef.baseUrl;
 
   let schemaContent;
+  let expectedSchemaContent;
+  let canvasSavePayload;
   let serverRevision;
   if (isCanvas) {
     try {
@@ -631,7 +725,18 @@ async function runMain(argv) {
       process.exit(1);
     }
     // canvasResult 已在登录前本地编译完成，这里只需据其装配 Schema content。
-    schemaContent = buildCanvasSchemaContent(sourceCode, canvasResult.runtimeCode, canvasResult.importedModules, formUuid);
+    expectedSchemaContent = buildCanvasSchemaContent(
+      sourceCode,
+      canvasResult.runtimeCode,
+      canvasResult.importedModules,
+      formUuid
+    );
+    canvasSavePayload = buildCanvasSavePayload(
+      expectedSchemaContent,
+      sourceCode,
+      canvasResult.runtimeCode
+    );
+    schemaContent = canvasSavePayload.content;
   } else {
     let existingDataSource = null;
     try {
@@ -644,6 +749,7 @@ async function runMain(argv) {
     }
     baseUrl = authRef.baseUrl;
     schemaContent = buildSchemaContent(sourceCode, compiledCode, formUuid, { existingDataSource });
+    expectedSchemaContent = schemaContent;
   }
   success(t('publish.schema_built'));
 
@@ -654,7 +760,15 @@ async function runMain(argv) {
   label('Source:', sourcePath);
   label('Compiled:', compiledPath);
   step(3, t('publish.step_publish'));
-  const response = await sendSaveRequestWithAuth(authRef, schemaContent, appType, formUuid, serverRevision);
+  const response = isCanvas
+    ? await sendCanvasSaveRequestWithAuth(
+      authRef,
+      canvasSavePayload,
+      appType,
+      formUuid,
+      serverRevision
+    )
+    : await sendSaveRequestWithAuth(authRef, schemaContent, appType, formUuid, serverRevision);
 
   if (!response || !response.success) {
     const errorMsg = response ? response.errorMsg || t('common.unknown_error') : t('common.request_failed');
@@ -668,6 +782,9 @@ async function runMain(argv) {
   const content = response.content || {};
   const savedFormUuid = content.formUuid || formUuid;
   const version = content.version || 0;
+  const storageMode = isCanvas ? content.storageMode || null : undefined;
+  const bundleId = isCanvas ? content.bundleId || null : undefined;
+  const fallbackReason = isCanvas ? content.fallbackReason || null : undefined;
   success(t('publish.schema_published'));
   label('Form UUID:', savedFormUuid);
   label('Version:', String(version));
@@ -686,7 +803,7 @@ async function runMain(argv) {
         appType,
         savedFormUuid,
         authRef,
-        schemaContent,
+        expectedSchemaContent,
         isCanvas ? 'canvas' : 'native'
       );
     } catch (healthCheckError) {
@@ -733,7 +850,20 @@ async function runMain(argv) {
     ['URL', pageUrl],
   ]);
   console.log(JSON.stringify(withBrowserHandoff(
-    { success: true, appType, formUuid: savedFormUuid, version, url: pageUrl, publishMode, healthCheck: healthCheckResult, navOrder: navOrderResult, navOrderWarning },
+    {
+      success: true,
+      appType,
+      formUuid: savedFormUuid,
+      version,
+      url: pageUrl,
+      publishMode,
+      storageMode,
+      bundleId,
+      fallbackReason,
+      healthCheck: healthCheckResult,
+      navOrder: navOrderResult,
+      navOrderWarning,
+    },
     pageUrl,
     { stage: 'publish_page_success', title: savedFormUuid },
     browserOpenMode
@@ -767,5 +897,7 @@ if (require.main === module) {
   module.exports.countCustomPageDataSources = countCustomPageDataSources;
   module.exports.buildSchemaContent = buildSchemaContent;
   module.exports.buildCanvasSchemaContent = buildCanvasSchemaContent;
+  module.exports.buildCanvasSavePayload = buildCanvasSavePayload;
   module.exports.sendSaveRequestWithAuth = sendSaveRequestWithAuth;
+  module.exports.sendCanvasSaveRequestWithAuth = sendCanvasSaveRequestWithAuth;
 }