openyida 2026.9.12 → 2026.9.14

package/lib/app/canvas-compile.js

@@ -24,12 +24,13 @@
  *   3) 第三方依赖以 `window.<别名>` 形式引用（antd→window.antd、react→window.React …），
  *      这些 UMD 依赖由画布运行时依据 importedModules 白名单按需注入。
  *
- * 因此本地编译 = Babel 把 JSX/TS 转成 ES5 → 把 import 改写成 window 别名引用、
- * 把 export default 改写成画布入口 `YidaComp` → 正则抽出依赖包名。
+ * 因此本地编译 = Babel 把 JSX/TS 转成 JS → 把 import 改写成 window 别名引用、
+ * 把 export default 改写成画布入口 `YidaComp` → UglifyJS 压缩 → 正则抽出依赖包名。
  */
 
 const Babel = require('@babel/standalone');
 const globals = require('globals');
+const UglifyJS = require('uglify-js');
 const {
   assertNoEmojiInArtifactName,
   assertNoEmojiInText,
@@ -877,6 +878,36 @@ function assertCanvasRuntimeParseable(runtimeCode, options = {}) {
   }
 }
 
+/**
+ * 压缩画布运行态代码，并显式保留装配器读取的 YidaComp 入口名。
+ */
+function minifyCanvasRuntime(runtimeCode, options = {}) {
+  let result;
+  try {
+    result = UglifyJS.minify(runtimeCode, {
+      compress: true,
+      mangle: {
+        reserved: ['YidaComp'],
+      },
+    });
+  } catch (error) {
+    result = { error };
+  }
+  if (!result || result.error || typeof result.code !== 'string' || !result.code) {
+    const detail = result && result.error && result.error.message
+      ? result.error.message
+      : '压缩结果为空';
+    throw new CliError(`Code Canvas runtimeCode 压缩失败: ${detail}`, {
+      code: 'OPENYIDA_CANVAS_MINIFY_FAILED',
+      details: {
+        stage: 'canvas_minify',
+        sourcePath: options.sourcePath || '',
+      },
+    });
+  }
+  return result.code;
+}
+
 /**
  * 本地编译 Code Canvas 源码。
  * @param {string} source 原始 React/JSX/TSX 源码
@@ -984,11 +1015,12 @@ function compileCanvasLocal(source, options = {}) {
     configFile: false,
   });
 
-  const runtimeCode = stage2.code || '';
-  assertNoEmojiInText(runtimeCode, {
+  const unminifiedRuntimeCode = stage2.code || '';
+  assertNoEmojiInText(unminifiedRuntimeCode, {
     artifact: options.sourcePath ? options.sourcePath + ' runtime' : 'Code Canvas runtime',
     code: 'OPENYIDA_CANVAS_SOURCE_EMOJI_FORBIDDEN',
   });
+  const runtimeCode = minifyCanvasRuntime(unminifiedRuntimeCode, options);
   assertCanvasRuntimeParseable(runtimeCode, options);
   assertDependencyManifestConsistent(runtimeCode, importedModules, options);
   return {
@@ -1019,43 +1051,47 @@ function compileCanvas(source, options = {}) {
     try {
       resolve(compileCanvasLocal(source, options));
     } catch (compileError) {
-      if (isCliError(compileError)) {
-        reject(compileError);
-        return;
-      }
-      const detail = compileError && compileError.message ? compileError.message : String(compileError);
-      if (
-        compileError &&
-        /^OPENYIDA_/.test(String(compileError.code || '')) &&
-        compileError.details !== undefined
-      ) {
-        reject(new CliError(`Code Canvas 本地编译失败: ${detail}`, {
-          code: compileError.code,
-          details: compileError.details,
-        }));
-        return;
-      }
-      reject(new CliError(`Code Canvas 本地编译失败: ${detail}`, {
-        code: 'OPENYIDA_CANVAS_COMPILE_FAILED',
-        details: {
-          stage: 'canvas_compile',
-          sourcePath: options.sourcePath,
-          causeCode: compileError && compileError.code,
-          causeName: compileError && compileError.name,
-          loc: compileError && compileError.loc,
-        },
-      }));
+      reject(normalizeCanvasCompileError(compileError, options));
     }
   });
 }
 
+function normalizeCanvasCompileError(compileError, options = {}) {
+  if (isCliError(compileError)) {
+    return compileError;
+  }
+  const detail = compileError && compileError.message ? compileError.message : String(compileError);
+  if (
+    compileError &&
+    /^OPENYIDA_/.test(String(compileError.code || '')) &&
+    compileError.details !== undefined
+  ) {
+    return new CliError(`Code Canvas 本地编译失败: ${detail}`, {
+      code: compileError.code,
+      details: compileError.details,
+    });
+  }
+  return new CliError(`Code Canvas 本地编译失败: ${detail}`, {
+    code: 'OPENYIDA_CANVAS_COMPILE_FAILED',
+    details: {
+      stage: 'canvas_compile',
+      sourcePath: options.sourcePath,
+      causeCode: compileError && compileError.code,
+      causeName: compileError && compileError.name,
+      loc: compileError && compileError.loc,
+    },
+  });
+}
+
 module.exports = {
   compileCanvas,
   compileCanvasLocal,
+  normalizeCanvasCompileError,
   extractImportedModules,
   resolveWindowAlias,
   shouldAllowUnsupportedBareImports,
   assertCanvasRuntimeParseable,
+  minifyCanvasRuntime,
   findBareDependencyGlobalIssues,
   findSelfReferentialDependencyBindingIssues,
   findDependencyManifestIssues,

package/lib/app/display-page-readback.js

@@ -23,10 +23,30 @@ function fingerprint(value) {
   return crypto.createHash('sha256').update(normalized).digest('hex');
 }
 
+function rawFingerprint(value) {
+  if (typeof value !== 'string' || !value) {
+    return '';
+  }
+  return crypto.createHash('sha256').update(value, 'utf8').digest('hex');
+}
+
+function positiveSize(value) {
+  const size = Number(value);
+  return Number.isFinite(size) && size > 0 ? size : 0;
+}
+
+function sha256(value) {
+  const digest = String(value || '').toLowerCase();
+  return /^[a-f0-9]{64}$/.test(digest) ? digest : '';
+}
+
 function createEmptyDisplayInfo() {
   return {
     hasYidaCodeCanvas: false,
+    hasCodeBundle: false,
     hasNativeJsx: false,
+    codeBundleCount: 0,
+    bundleIds: [],
     runtimeCodeBytes: 0,
     sourceCodeBytes: 0,
     compiledCodeBytes: 0,
@@ -34,6 +54,8 @@ function createEmptyDisplayInfo() {
     componentCount: 0,
     canvasRuntimeCode: '',
     canvasSourceCode: '',
+    canvasRuntimeSha256: '',
+    canvasSourceSha256: '',
     nativeCompiledCode: '',
     nativeSourceCode: '',
   };
@@ -79,12 +101,37 @@ function traverseDisplayNodes(node, info) {
 
   if (node.componentName === 'YidaCodeCanvas') {
     const props = node.props || {};
+    const codeBundle = props.codeBundle && typeof props.codeBundle === 'object'
+      ? props.codeBundle
+      : null;
     info.hasYidaCodeCanvas = true;
     info.componentCount++;
-    info.canvasRuntimeCode = props.runtimeCode || '';
-    info.canvasSourceCode = props.code || '';
+    if (typeof props.runtimeCode === 'string' && props.runtimeCode) {
+      info.canvasRuntimeCode = props.runtimeCode;
+    }
+    if (typeof props.code === 'string' && props.code) {
+      info.canvasSourceCode = props.code;
+    }
     info.runtimeCodeBytes += codeBytes(props.runtimeCode);
     info.sourceCodeBytes += codeBytes(props.code);
+    if (codeBundle) {
+      const bundleId = String(codeBundle.bundleId || '');
+      const runtime = codeBundle.runtime && typeof codeBundle.runtime === 'object'
+        ? codeBundle.runtime
+        : {};
+      const source = codeBundle.source && typeof codeBundle.source === 'object'
+        ? codeBundle.source
+        : {};
+      info.hasCodeBundle = true;
+      info.codeBundleCount++;
+      if (bundleId && !info.bundleIds.includes(bundleId)) {
+        info.bundleIds.push(bundleId);
+      }
+      info.runtimeCodeBytes += positiveSize(runtime.size);
+      info.sourceCodeBytes += positiveSize(source.size);
+      info.canvasRuntimeSha256 = sha256(runtime.sha256) || info.canvasRuntimeSha256;
+      info.canvasSourceSha256 = sha256(source.sha256) || info.canvasSourceSha256;
+    }
     addImportedModules(info.importedModules, props.importedModules);
   } else if (node.componentName === 'Jsx') {
     info.hasNativeJsx = true;
@@ -133,7 +180,9 @@ function hasExpectedDisplayComponent(info, publishMode) {
     return false;
   }
   if (publishMode === 'canvas') {
-    return info.hasYidaCodeCanvas && info.runtimeCodeBytes > 0;
+    return info.hasYidaCodeCanvas && (
+      info.runtimeCodeBytes > 0 || !!info.canvasRuntimeSha256
+    );
   }
   return info.hasNativeJsx && info.compiledCodeBytes > 0;
 }
@@ -144,7 +193,10 @@ function summarizeDisplayPublishInfo(info) {
   }
   return {
     hasYidaCodeCanvas: info.hasYidaCodeCanvas,
+    hasCodeBundle: info.hasCodeBundle,
     hasNativeJsx: info.hasNativeJsx,
+    codeBundleCount: info.codeBundleCount,
+    bundleIds: info.bundleIds.slice(),
     runtimeCodeBytes: info.runtimeCodeBytes,
     sourceCodeBytes: info.sourceCodeBytes,
     compiledCodeBytes: info.compiledCodeBytes,
@@ -159,8 +211,13 @@ function verifyPublishedContentMatch(readbackSchema, expectedSchemaContent, publ
   const displayComponentPresent = hasExpectedDisplayComponent(readbackInfo, publishMode);
   const readbackArtifact = getPublishArtifact(readbackInfo, publishMode);
   const expectedArtifact = getPublishArtifact(expectedInfo, publishMode);
-  const readbackFingerprint = fingerprint(readbackArtifact);
-  const expectedFingerprint = fingerprint(expectedArtifact);
+  const codeBundleReadback = publishMode === 'canvas' && readbackInfo && readbackInfo.hasCodeBundle;
+  const readbackFingerprint = codeBundleReadback
+    ? readbackInfo.canvasRuntimeSha256
+    : fingerprint(readbackArtifact);
+  const expectedFingerprint = codeBundleReadback
+    ? rawFingerprint(expectedArtifact)
+    : fingerprint(expectedArtifact);
 
   return {
     readbackInfo,
@@ -180,6 +237,7 @@ function verifyPublishedContentMatch(readbackSchema, expectedSchemaContent, publ
 module.exports = {
   extractDisplayPublishInfo,
   fingerprint,
+  rawFingerprint,
   hasExpectedDisplayComponent,
   parseSchemaContent,
   summarizeDisplayPublishInfo,

package/lib/app/get-schema.js

@@ -9,6 +9,7 @@
 
 'use strict';
 
+const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const {
@@ -16,6 +17,7 @@ const {
   triggerLogin,
   resolveBaseUrl,
   httpGet,
+  httpGetCodeBundleText,
   requestWithAutoLogin,
 } = require('../core/utils');
 const { t } = require('../core/i18n');
@@ -227,6 +229,122 @@ function resolveSchemaContent(schemaResult) {
   return parseJsonObject(content);
 }
 
+function validateCodeBundleDescriptor(codeBundle) {
+  const bundleId = String(codeBundle && codeBundle.bundleId || '');
+  const source = codeBundle && codeBundle.source;
+  const runtime = codeBundle && codeBundle.runtime;
+  const validSha256 = value => /^[a-f0-9]{64}$/.test(String(value || ''));
+  const validSize = value => Number.isFinite(Number(value)) && Number(value) > 0
+    && Number(value) <= 5 * 1024 * 1024;
+  if (!validSha256(bundleId)
+    || !source || !runtime
+    || !validSha256(source.sha256) || !validSize(source.size)
+    || !validSha256(runtime.sha256) || !validSize(runtime.size)
+    || Number(source.size) + Number(runtime.size) > 5 * 1024 * 1024) {
+    throw new Error('YidaCodeCanvas codeBundle 描述不合法');
+  }
+  return { bundleId, source, runtime };
+}
+
+function collectCodeBundleCanvases(content) {
+  const canvases = [];
+  function traverse(node) {
+    if (Array.isArray(node)) {
+      node.forEach(traverse);
+      return;
+    }
+    if (!node || typeof node !== 'object') {
+      return;
+    }
+    if (node.componentName === 'YidaCodeCanvas' && node.id && node.props
+      && node.props.codeBundle && typeof node.props.codeBundle === 'object') {
+      canvases.push({ props: node.props, descriptor: validateCodeBundleDescriptor(node.props.codeBundle) });
+    }
+    Object.values(node).forEach(traverse);
+  }
+  traverse(content);
+  return canvases;
+}
+
+async function downloadCodeBundleArtifact(appType, formUuid, bundleId, artifact, descriptor, authRef) {
+  let responseMetadata = null;
+  const expectedContentTypes = artifact === 'source'
+    ? ['text/plain']
+    : ['application/javascript', 'text/javascript', 'application/x-javascript'];
+  const value = await requestWithAutoLogin((auth) => httpGetCodeBundleText(
+    auth.baseUrl,
+    `/alibaba/web/${appType}/query/codeBundle/download.json`,
+    { formUuid, bundleId, artifact },
+    {
+      silentStatus: true,
+      maxBytes: 5 * 1024 * 1024,
+      expectedContentTypes,
+      onResponseMetadata: metadata => {
+        responseMetadata = metadata;
+      },
+    }
+  ), authRef);
+  if (typeof value !== 'string') {
+    const message = value && (value.errorMsg || value.message);
+    throw new Error(message || `下载 CodeBundle ${artifact} 失败`);
+  }
+  const size = Buffer.byteLength(value, 'utf8');
+  const digest = crypto.createHash('sha256').update(value, 'utf8').digest('hex');
+  if (size !== Number(descriptor.size) || digest !== descriptor.sha256) {
+    const context = responseMetadata && responseMetadata.context
+      ? responseMetadata.context
+      : `baseUrl=${authRef && authRef.baseUrl || 'unknown'}`;
+    const error = new Error(t('common.code_bundle_integrity_failed', artifact, context));
+    error.code = 'CODE_BUNDLE_INTEGRITY_MISMATCH';
+    error.details = {
+      artifact,
+      expectedSize: Number(descriptor.size),
+      actualSize: size,
+      expectedSha256: descriptor.sha256,
+      actualSha256: digest,
+      ...(responseMetadata || {}),
+    };
+    throw error;
+  }
+  return value;
+}
+
+async function resolveCodeBundleSchema(schemaResult, appType, formUuid, authRef) {
+  const content = resolveSchemaContent(schemaResult);
+  if (!content) {
+    return schemaResult;
+  }
+  const canvases = collectCodeBundleCanvases(content);
+  if (canvases.length === 0) {
+    return schemaResult;
+  }
+
+  const downloaded = new Map();
+  for (const canvas of canvases) {
+    const { bundleId, source, runtime } = canvas.descriptor;
+    let code = downloaded.get(bundleId);
+    if (!code) {
+      const [sourceCode, runtimeCode] = await Promise.all([
+        downloadCodeBundleArtifact(appType, formUuid, bundleId, 'source', source, authRef),
+        downloadCodeBundleArtifact(appType, formUuid, bundleId, 'runtime', runtime, authRef),
+      ]);
+      code = { sourceCode, runtimeCode };
+      downloaded.set(bundleId, code);
+    }
+    canvas.props.code = code.sourceCode;
+    canvas.props.runtimeCode = code.runtimeCode;
+    delete canvas.props.codeBundle;
+  }
+
+  if (schemaResult && Object.prototype.hasOwnProperty.call(schemaResult, 'content')) {
+    schemaResult.content = typeof schemaResult.content === 'string'
+      ? JSON.stringify(content)
+      : content;
+    return schemaResult;
+  }
+  return content;
+}
+
 function addImportedModules(target, value) {
   let modules = value;
   if (typeof modules === 'string') {
@@ -269,7 +387,10 @@ function extractDisplayPageSummary(schemaResult) {
 
   const displayPage = {
     hasYidaCodeCanvas: false,
+    hasCodeBundle: false,
     hasNativeJsx: false,
+    codeBundleCount: 0,
+    bundleIds: [],
     runtimeCodeBytes: 0,
     sourceCodeBytes: 0,
     compiledCodeBytes: 0,
@@ -291,10 +412,29 @@ function extractDisplayPageSummary(schemaResult) {
 
     if (node.componentName === 'YidaCodeCanvas' && isComponentInstance(node)) {
       const props = node.props || {};
+      const codeBundle = props.codeBundle && typeof props.codeBundle === 'object'
+        ? props.codeBundle
+        : null;
       displayPage.hasYidaCodeCanvas = true;
       displayPage.componentCount++;
       displayPage.runtimeCodeBytes += codeBytes(props.runtimeCode);
       displayPage.sourceCodeBytes += codeBytes(props.code);
+      if (codeBundle) {
+        const source = codeBundle.source && typeof codeBundle.source === 'object'
+          ? codeBundle.source
+          : {};
+        const runtime = codeBundle.runtime && typeof codeBundle.runtime === 'object'
+          ? codeBundle.runtime
+          : {};
+        const bundleId = String(codeBundle.bundleId || '');
+        displayPage.hasCodeBundle = true;
+        displayPage.codeBundleCount++;
+        displayPage.sourceCodeBytes += Number(source.size) || 0;
+        displayPage.runtimeCodeBytes += Number(runtime.size) || 0;
+        if (bundleId && !displayPage.bundleIds.includes(bundleId)) {
+          displayPage.bundleIds.push(bundleId);
+        }
+      }
       addImportedModules(displayPage.importedModules, props.importedModules);
     } else if (node.componentName === 'Jsx' && isComponentInstance(node)) {
       displayPage.hasNativeJsx = true;
@@ -581,12 +721,15 @@ async function mapLimit(items, limit, iterator) {
   return results;
 }
 
-async function fetchSchemaRecord(appType, form, authRef, retries) {
+async function fetchSchemaRecord(appType, form, authRef, retries, options = {}) {
   let lastError = null;
   for (let attempt = 0; attempt <= retries; attempt++) {
     try {
       const result = await fetchSchema(appType, form.formUuid, authRef);
       if (isSuccessfulSchemaResult(result)) {
+        const resolvedResult = options.resolveCodeBundles
+          ? await resolveCodeBundleSchema(result, appType, form.formUuid, authRef)
+          : result;
         const record = {
           formUuid: form.formUuid,
           formName: form.formName,
@@ -594,10 +737,10 @@ async function fetchSchemaRecord(appType, form, authRef, retries) {
           pathName: form.pathName,
           success: true,
           attempts: attempt + 1,
-          fieldSummary: extractFieldSummary(result),
-          schema: result,
+          fieldSummary: extractFieldSummary(resolvedResult),
+          schema: resolvedResult,
         };
-        const displayPage = extractDisplayPageSummary(result);
+        const displayPage = extractDisplayPageSummary(resolvedResult);
         if (displayPage) {
           record.displayPage = displayPage;
         }
@@ -694,6 +837,10 @@ async function runSingle(parsed, authRef) {
     throwCommandError(errorMsg);
   }
 
+  if (!parsed.field && !parsed.compact && !parsed.summaryJson) {
+    result = await resolveCodeBundleSchema(result, parsed.appType, parsed.formUuid, authRef);
+  }
+
   // 保留既有 --field 返回结构；新 contract 仅由 --compact / --resolve-fields 触发。
   if (parsed.field) {
     const allFieldNodes = collectFieldNodes(result);
@@ -782,7 +929,9 @@ async function runBatch(parsed, authRef) {
   info(`  批量获取 ${forms.length} 个表单 Schema，并发 ${parsed.concurrency}，重试 ${parsed.retries}`);
 
   const records = await mapLimit(forms, parsed.concurrency, async (form) => {
-    const record = await fetchSchemaRecord(parsed.appType, form, authRef, parsed.retries);
+    const record = await fetchSchemaRecord(parsed.appType, form, authRef, parsed.retries, {
+      resolveCodeBundles: !parsed.summaryJson,
+    });
     if (record.success && parsed.analysisJson) {
       record.semanticAnalysis = buildSemanticAnalysis(
         parsed.appType,
@@ -848,5 +997,9 @@ module.exports = {
   fetchSchemaRecord,
   collectFieldNodes,
   findFieldNode,
+  validateCodeBundleDescriptor,
+  collectCodeBundleCanvases,
+  downloadCodeBundleArtifact,
+  resolveCodeBundleSchema,
   run,
 };