openyida 2026.9.13 → 2026.9.14

package/lib/app/canvas-compile.js

@@ -24,12 +24,13 @@
  *   3) 第三方依赖以 `window.<别名>` 形式引用（antd→window.antd、react→window.React …），
  *      这些 UMD 依赖由画布运行时依据 importedModules 白名单按需注入。
  *
- * 因此本地编译 = Babel 把 JSX/TS 转成 ES5 → 把 import 改写成 window 别名引用、
- * 把 export default 改写成画布入口 `YidaComp` → 正则抽出依赖包名。
+ * 因此本地编译 = Babel 把 JSX/TS 转成 JS → 把 import 改写成 window 别名引用、
+ * 把 export default 改写成画布入口 `YidaComp` → UglifyJS 压缩 → 正则抽出依赖包名。
  */
 
 const Babel = require('@babel/standalone');
 const globals = require('globals');
+const UglifyJS = require('uglify-js');
 const {
   assertNoEmojiInArtifactName,
   assertNoEmojiInText,
@@ -877,6 +878,36 @@ function assertCanvasRuntimeParseable(runtimeCode, options = {}) {
   }
 }
 
+/**
+ * 压缩画布运行态代码，并显式保留装配器读取的 YidaComp 入口名。
+ */
+function minifyCanvasRuntime(runtimeCode, options = {}) {
+  let result;
+  try {
+    result = UglifyJS.minify(runtimeCode, {
+      compress: true,
+      mangle: {
+        reserved: ['YidaComp'],
+      },
+    });
+  } catch (error) {
+    result = { error };
+  }
+  if (!result || result.error || typeof result.code !== 'string' || !result.code) {
+    const detail = result && result.error && result.error.message
+      ? result.error.message
+      : '压缩结果为空';
+    throw new CliError(`Code Canvas runtimeCode 压缩失败: ${detail}`, {
+      code: 'OPENYIDA_CANVAS_MINIFY_FAILED',
+      details: {
+        stage: 'canvas_minify',
+        sourcePath: options.sourcePath || '',
+      },
+    });
+  }
+  return result.code;
+}
+
 /**
  * 本地编译 Code Canvas 源码。
  * @param {string} source 原始 React/JSX/TSX 源码
@@ -984,11 +1015,12 @@ function compileCanvasLocal(source, options = {}) {
     configFile: false,
   });
 
-  const runtimeCode = stage2.code || '';
-  assertNoEmojiInText(runtimeCode, {
+  const unminifiedRuntimeCode = stage2.code || '';
+  assertNoEmojiInText(unminifiedRuntimeCode, {
     artifact: options.sourcePath ? options.sourcePath + ' runtime' : 'Code Canvas runtime',
     code: 'OPENYIDA_CANVAS_SOURCE_EMOJI_FORBIDDEN',
   });
+  const runtimeCode = minifyCanvasRuntime(unminifiedRuntimeCode, options);
   assertCanvasRuntimeParseable(runtimeCode, options);
   assertDependencyManifestConsistent(runtimeCode, importedModules, options);
   return {
@@ -1059,6 +1091,7 @@ module.exports = {
   resolveWindowAlias,
   shouldAllowUnsupportedBareImports,
   assertCanvasRuntimeParseable,
+  minifyCanvasRuntime,
   findBareDependencyGlobalIssues,
   findSelfReferentialDependencyBindingIssues,
   findDependencyManifestIssues,

package/lib/app/display-page-readback.js

@@ -23,10 +23,30 @@ function fingerprint(value) {
   return crypto.createHash('sha256').update(normalized).digest('hex');
 }
 
+function rawFingerprint(value) {
+  if (typeof value !== 'string' || !value) {
+    return '';
+  }
+  return crypto.createHash('sha256').update(value, 'utf8').digest('hex');
+}
+
+function positiveSize(value) {
+  const size = Number(value);
+  return Number.isFinite(size) && size > 0 ? size : 0;
+}
+
+function sha256(value) {
+  const digest = String(value || '').toLowerCase();
+  return /^[a-f0-9]{64}$/.test(digest) ? digest : '';
+}
+
 function createEmptyDisplayInfo() {
   return {
     hasYidaCodeCanvas: false,
+    hasCodeBundle: false,
     hasNativeJsx: false,
+    codeBundleCount: 0,
+    bundleIds: [],
     runtimeCodeBytes: 0,
     sourceCodeBytes: 0,
     compiledCodeBytes: 0,
@@ -34,6 +54,8 @@ function createEmptyDisplayInfo() {
     componentCount: 0,
     canvasRuntimeCode: '',
     canvasSourceCode: '',
+    canvasRuntimeSha256: '',
+    canvasSourceSha256: '',
     nativeCompiledCode: '',
     nativeSourceCode: '',
   };
@@ -79,12 +101,37 @@ function traverseDisplayNodes(node, info) {
 
   if (node.componentName === 'YidaCodeCanvas') {
     const props = node.props || {};
+    const codeBundle = props.codeBundle && typeof props.codeBundle === 'object'
+      ? props.codeBundle
+      : null;
     info.hasYidaCodeCanvas = true;
     info.componentCount++;
-    info.canvasRuntimeCode = props.runtimeCode || '';
-    info.canvasSourceCode = props.code || '';
+    if (typeof props.runtimeCode === 'string' && props.runtimeCode) {
+      info.canvasRuntimeCode = props.runtimeCode;
+    }
+    if (typeof props.code === 'string' && props.code) {
+      info.canvasSourceCode = props.code;
+    }
     info.runtimeCodeBytes += codeBytes(props.runtimeCode);
     info.sourceCodeBytes += codeBytes(props.code);
+    if (codeBundle) {
+      const bundleId = String(codeBundle.bundleId || '');
+      const runtime = codeBundle.runtime && typeof codeBundle.runtime === 'object'
+        ? codeBundle.runtime
+        : {};
+      const source = codeBundle.source && typeof codeBundle.source === 'object'
+        ? codeBundle.source
+        : {};
+      info.hasCodeBundle = true;
+      info.codeBundleCount++;
+      if (bundleId && !info.bundleIds.includes(bundleId)) {
+        info.bundleIds.push(bundleId);
+      }
+      info.runtimeCodeBytes += positiveSize(runtime.size);
+      info.sourceCodeBytes += positiveSize(source.size);
+      info.canvasRuntimeSha256 = sha256(runtime.sha256) || info.canvasRuntimeSha256;
+      info.canvasSourceSha256 = sha256(source.sha256) || info.canvasSourceSha256;
+    }
     addImportedModules(info.importedModules, props.importedModules);
   } else if (node.componentName === 'Jsx') {
     info.hasNativeJsx = true;
@@ -133,7 +180,9 @@ function hasExpectedDisplayComponent(info, publishMode) {
     return false;
   }
   if (publishMode === 'canvas') {
-    return info.hasYidaCodeCanvas && info.runtimeCodeBytes > 0;
+    return info.hasYidaCodeCanvas && (
+      info.runtimeCodeBytes > 0 || !!info.canvasRuntimeSha256
+    );
   }
   return info.hasNativeJsx && info.compiledCodeBytes > 0;
 }
@@ -144,7 +193,10 @@ function summarizeDisplayPublishInfo(info) {
   }
   return {
     hasYidaCodeCanvas: info.hasYidaCodeCanvas,
+    hasCodeBundle: info.hasCodeBundle,
     hasNativeJsx: info.hasNativeJsx,
+    codeBundleCount: info.codeBundleCount,
+    bundleIds: info.bundleIds.slice(),
     runtimeCodeBytes: info.runtimeCodeBytes,
     sourceCodeBytes: info.sourceCodeBytes,
     compiledCodeBytes: info.compiledCodeBytes,
@@ -159,8 +211,13 @@ function verifyPublishedContentMatch(readbackSchema, expectedSchemaContent, publ
   const displayComponentPresent = hasExpectedDisplayComponent(readbackInfo, publishMode);
   const readbackArtifact = getPublishArtifact(readbackInfo, publishMode);
   const expectedArtifact = getPublishArtifact(expectedInfo, publishMode);
-  const readbackFingerprint = fingerprint(readbackArtifact);
-  const expectedFingerprint = fingerprint(expectedArtifact);
+  const codeBundleReadback = publishMode === 'canvas' && readbackInfo && readbackInfo.hasCodeBundle;
+  const readbackFingerprint = codeBundleReadback
+    ? readbackInfo.canvasRuntimeSha256
+    : fingerprint(readbackArtifact);
+  const expectedFingerprint = codeBundleReadback
+    ? rawFingerprint(expectedArtifact)
+    : fingerprint(expectedArtifact);
 
   return {
     readbackInfo,
@@ -180,6 +237,7 @@ function verifyPublishedContentMatch(readbackSchema, expectedSchemaContent, publ
 module.exports = {
   extractDisplayPublishInfo,
   fingerprint,
+  rawFingerprint,
   hasExpectedDisplayComponent,
   parseSchemaContent,
   summarizeDisplayPublishInfo,

package/lib/app/get-schema.js

@@ -9,6 +9,7 @@
 
 'use strict';
 
+const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const {
@@ -16,6 +17,7 @@ const {
   triggerLogin,
   resolveBaseUrl,
   httpGet,
+  httpGetCodeBundleText,
   requestWithAutoLogin,
 } = require('../core/utils');
 const { t } = require('../core/i18n');
@@ -227,6 +229,122 @@ function resolveSchemaContent(schemaResult) {
   return parseJsonObject(content);
 }
 
+function validateCodeBundleDescriptor(codeBundle) {
+  const bundleId = String(codeBundle && codeBundle.bundleId || '');
+  const source = codeBundle && codeBundle.source;
+  const runtime = codeBundle && codeBundle.runtime;
+  const validSha256 = value => /^[a-f0-9]{64}$/.test(String(value || ''));
+  const validSize = value => Number.isFinite(Number(value)) && Number(value) > 0
+    && Number(value) <= 5 * 1024 * 1024;
+  if (!validSha256(bundleId)
+    || !source || !runtime
+    || !validSha256(source.sha256) || !validSize(source.size)
+    || !validSha256(runtime.sha256) || !validSize(runtime.size)
+    || Number(source.size) + Number(runtime.size) > 5 * 1024 * 1024) {
+    throw new Error('YidaCodeCanvas codeBundle 描述不合法');
+  }
+  return { bundleId, source, runtime };
+}
+
+function collectCodeBundleCanvases(content) {
+  const canvases = [];
+  function traverse(node) {
+    if (Array.isArray(node)) {
+      node.forEach(traverse);
+      return;
+    }
+    if (!node || typeof node !== 'object') {
+      return;
+    }
+    if (node.componentName === 'YidaCodeCanvas' && node.id && node.props
+      && node.props.codeBundle && typeof node.props.codeBundle === 'object') {
+      canvases.push({ props: node.props, descriptor: validateCodeBundleDescriptor(node.props.codeBundle) });
+    }
+    Object.values(node).forEach(traverse);
+  }
+  traverse(content);
+  return canvases;
+}
+
+async function downloadCodeBundleArtifact(appType, formUuid, bundleId, artifact, descriptor, authRef) {
+  let responseMetadata = null;
+  const expectedContentTypes = artifact === 'source'
+    ? ['text/plain']
+    : ['application/javascript', 'text/javascript', 'application/x-javascript'];
+  const value = await requestWithAutoLogin((auth) => httpGetCodeBundleText(
+    auth.baseUrl,
+    `/alibaba/web/${appType}/query/codeBundle/download.json`,
+    { formUuid, bundleId, artifact },
+    {
+      silentStatus: true,
+      maxBytes: 5 * 1024 * 1024,
+      expectedContentTypes,
+      onResponseMetadata: metadata => {
+        responseMetadata = metadata;
+      },
+    }
+  ), authRef);
+  if (typeof value !== 'string') {
+    const message = value && (value.errorMsg || value.message);
+    throw new Error(message || `下载 CodeBundle ${artifact} 失败`);
+  }
+  const size = Buffer.byteLength(value, 'utf8');
+  const digest = crypto.createHash('sha256').update(value, 'utf8').digest('hex');
+  if (size !== Number(descriptor.size) || digest !== descriptor.sha256) {
+    const context = responseMetadata && responseMetadata.context
+      ? responseMetadata.context
+      : `baseUrl=${authRef && authRef.baseUrl || 'unknown'}`;
+    const error = new Error(t('common.code_bundle_integrity_failed', artifact, context));
+    error.code = 'CODE_BUNDLE_INTEGRITY_MISMATCH';
+    error.details = {
+      artifact,
+      expectedSize: Number(descriptor.size),
+      actualSize: size,
+      expectedSha256: descriptor.sha256,
+      actualSha256: digest,
+      ...(responseMetadata || {}),
+    };
+    throw error;
+  }
+  return value;
+}
+
+async function resolveCodeBundleSchema(schemaResult, appType, formUuid, authRef) {
+  const content = resolveSchemaContent(schemaResult);
+  if (!content) {
+    return schemaResult;
+  }
+  const canvases = collectCodeBundleCanvases(content);
+  if (canvases.length === 0) {
+    return schemaResult;
+  }
+
+  const downloaded = new Map();
+  for (const canvas of canvases) {
+    const { bundleId, source, runtime } = canvas.descriptor;
+    let code = downloaded.get(bundleId);
+    if (!code) {
+      const [sourceCode, runtimeCode] = await Promise.all([
+        downloadCodeBundleArtifact(appType, formUuid, bundleId, 'source', source, authRef),
+        downloadCodeBundleArtifact(appType, formUuid, bundleId, 'runtime', runtime, authRef),
+      ]);
+      code = { sourceCode, runtimeCode };
+      downloaded.set(bundleId, code);
+    }
+    canvas.props.code = code.sourceCode;
+    canvas.props.runtimeCode = code.runtimeCode;
+    delete canvas.props.codeBundle;
+  }
+
+  if (schemaResult && Object.prototype.hasOwnProperty.call(schemaResult, 'content')) {
+    schemaResult.content = typeof schemaResult.content === 'string'
+      ? JSON.stringify(content)
+      : content;
+    return schemaResult;
+  }
+  return content;
+}
+
 function addImportedModules(target, value) {
   let modules = value;
   if (typeof modules === 'string') {
@@ -269,7 +387,10 @@ function extractDisplayPageSummary(schemaResult) {
 
   const displayPage = {
     hasYidaCodeCanvas: false,
+    hasCodeBundle: false,
     hasNativeJsx: false,
+    codeBundleCount: 0,
+    bundleIds: [],
     runtimeCodeBytes: 0,
     sourceCodeBytes: 0,
     compiledCodeBytes: 0,
@@ -291,10 +412,29 @@ function extractDisplayPageSummary(schemaResult) {
 
     if (node.componentName === 'YidaCodeCanvas' && isComponentInstance(node)) {
       const props = node.props || {};
+      const codeBundle = props.codeBundle && typeof props.codeBundle === 'object'
+        ? props.codeBundle
+        : null;
       displayPage.hasYidaCodeCanvas = true;
       displayPage.componentCount++;
       displayPage.runtimeCodeBytes += codeBytes(props.runtimeCode);
       displayPage.sourceCodeBytes += codeBytes(props.code);
+      if (codeBundle) {
+        const source = codeBundle.source && typeof codeBundle.source === 'object'
+          ? codeBundle.source
+          : {};
+        const runtime = codeBundle.runtime && typeof codeBundle.runtime === 'object'
+          ? codeBundle.runtime
+          : {};
+        const bundleId = String(codeBundle.bundleId || '');
+        displayPage.hasCodeBundle = true;
+        displayPage.codeBundleCount++;
+        displayPage.sourceCodeBytes += Number(source.size) || 0;
+        displayPage.runtimeCodeBytes += Number(runtime.size) || 0;
+        if (bundleId && !displayPage.bundleIds.includes(bundleId)) {
+          displayPage.bundleIds.push(bundleId);
+        }
+      }
       addImportedModules(displayPage.importedModules, props.importedModules);
     } else if (node.componentName === 'Jsx' && isComponentInstance(node)) {
       displayPage.hasNativeJsx = true;
@@ -581,12 +721,15 @@ async function mapLimit(items, limit, iterator) {
   return results;
 }
 
-async function fetchSchemaRecord(appType, form, authRef, retries) {
+async function fetchSchemaRecord(appType, form, authRef, retries, options = {}) {
   let lastError = null;
   for (let attempt = 0; attempt <= retries; attempt++) {
     try {
       const result = await fetchSchema(appType, form.formUuid, authRef);
       if (isSuccessfulSchemaResult(result)) {
+        const resolvedResult = options.resolveCodeBundles
+          ? await resolveCodeBundleSchema(result, appType, form.formUuid, authRef)
+          : result;
         const record = {
           formUuid: form.formUuid,
           formName: form.formName,
@@ -594,10 +737,10 @@ async function fetchSchemaRecord(appType, form, authRef, retries) {
           pathName: form.pathName,
           success: true,
           attempts: attempt + 1,
-          fieldSummary: extractFieldSummary(result),
-          schema: result,
+          fieldSummary: extractFieldSummary(resolvedResult),
+          schema: resolvedResult,
         };
-        const displayPage = extractDisplayPageSummary(result);
+        const displayPage = extractDisplayPageSummary(resolvedResult);
         if (displayPage) {
           record.displayPage = displayPage;
         }
@@ -694,6 +837,10 @@ async function runSingle(parsed, authRef) {
     throwCommandError(errorMsg);
   }
 
+  if (!parsed.field && !parsed.compact && !parsed.summaryJson) {
+    result = await resolveCodeBundleSchema(result, parsed.appType, parsed.formUuid, authRef);
+  }
+
   // 保留既有 --field 返回结构；新 contract 仅由 --compact / --resolve-fields 触发。
   if (parsed.field) {
     const allFieldNodes = collectFieldNodes(result);
@@ -782,7 +929,9 @@ async function runBatch(parsed, authRef) {
   info(`  批量获取 ${forms.length} 个表单 Schema，并发 ${parsed.concurrency}，重试 ${parsed.retries}`);
 
   const records = await mapLimit(forms, parsed.concurrency, async (form) => {
-    const record = await fetchSchemaRecord(parsed.appType, form, authRef, parsed.retries);
+    const record = await fetchSchemaRecord(parsed.appType, form, authRef, parsed.retries, {
+      resolveCodeBundles: !parsed.summaryJson,
+    });
     if (record.success && parsed.analysisJson) {
       record.semanticAnalysis = buildSemanticAnalysis(
         parsed.appType,
@@ -848,5 +997,9 @@ module.exports = {
   fetchSchemaRecord,
   collectFieldNodes,
   findFieldNode,
+  validateCodeBundleDescriptor,
+  collectCodeBundleCanvases,
+  downloadCodeBundleArtifact,
+  resolveCodeBundleSchema,
   run,
 };

package/lib/app/publish.js

@@ -10,9 +10,9 @@
  *
  * 流程：
  * 1. 读取源文件，通过内置 babel-transform 编译 + UglifyJS 压缩
- * 2. 用代码动态构建 Schema，将 source/compiled 填入 actions.module
+ * 2. 用代码动态构建 Schema；Canvas 页面拆出 source/runtime 后统一保存
  * 3. 读取 token session，在写前确认登录态
- * 4. 通过 HTTP POST 调用 saveFormSchema，token 失效时尝试 token refresh
+ * 4. Canvas 调统一保存接口；普通 JSX 页面仍调用原 saveFormSchema
  */
 
 const fs = require('fs');
@@ -21,6 +21,7 @@ const querystring = require('querystring');
 const {
   findProjectRoot,
   httpPost,
+  httpPostMultipart,
   httpGet,
   requestWithAutoLogin,
 } = require('../core/utils');
@@ -59,6 +60,8 @@ const {
 const SCHEMA_VERSION = 'V5';
 const DOMAIN_CODE = 'tEXDRG';
 const PREFIX = '_view';
+const MAX_CODE_BUNDLE_BYTES = 5 * 1024 * 1024;
+const MAX_CANVAS_SCHEMA_SKELETON_BYTES = 1024 * 1024;
 
 // ── 参数解析 ─────────────────────────────────────────
 
@@ -285,6 +288,61 @@ function buildCanvasSchemaContent(sourceCode, runtimeCode, importedModules, form
   return buildCanvasPageSchemaContent(sourceCode, runtimeCode, importedModules, formUuid);
 }
 
+function buildCanvasSavePayload(schemaContent, sourceCode, runtimeCode) {
+  if (typeof sourceCode !== 'string' || sourceCode.length === 0
+    || typeof runtimeCode !== 'string' || runtimeCode.length === 0) {
+    throw new Error('Canvas source/runtime 不能为空');
+  }
+  const totalCodeBytes = Buffer.byteLength(sourceCode, 'utf8')
+    + Buffer.byteLength(runtimeCode, 'utf8');
+  if (totalCodeBytes > MAX_CODE_BUNDLE_BYTES) {
+    throw new Error('Canvas source/runtime 总大小不能超过 5 MiB');
+  }
+
+  let schema;
+  try {
+    schema = JSON.parse(schemaContent);
+  } catch {
+    throw new Error('Canvas Schema 不是有效 JSON');
+  }
+
+  const canvases = [];
+  function traverse(node) {
+    if (Array.isArray(node)) {
+      node.forEach(traverse);
+      return;
+    }
+    if (!node || typeof node !== 'object') {
+      return;
+    }
+    if (node.componentName === 'YidaCodeCanvas' && node.id) {
+      canvases.push(node);
+    }
+    Object.values(node).forEach(traverse);
+  }
+  traverse(schema);
+  if (canvases.length !== 1) {
+    throw new Error('Canvas Schema 必须且只能包含一个 YidaCodeCanvas 节点');
+  }
+
+  const canvas = canvases[0];
+  canvas.props = canvas.props && typeof canvas.props === 'object' ? canvas.props : {};
+  delete canvas.props.code;
+  delete canvas.props.runtimeCode;
+  delete canvas.props.codeBundle;
+
+  const skeletonContent = JSON.stringify(schema);
+  if (Buffer.byteLength(skeletonContent, 'utf8') > MAX_CANVAS_SCHEMA_SKELETON_BYTES) {
+    throw new Error('Canvas Schema 骨架不能超过 1 MiB');
+  }
+  return {
+    canvasNodeId: canvas.id,
+    content: skeletonContent,
+    sourceCode,
+    runtimeCode,
+  };
+}
+
 
 // ── 4. 发送 saveFormSchema 请求 ──────────────────────
 
@@ -314,6 +372,40 @@ function sendSaveRequestWithAuth(authRef, schemaContent, appType, formUuid, serv
   return httpPost(authRef.baseUrl, saveSchemaPath, postData, { silentStatus: true });
 }
 
+function sendCanvasSaveRequestWithAuth(authRef, payload, appType, formUuid, serverRevision) {
+  if (
+    !authRef ||
+    typeof authRef.baseUrl !== 'string' ||
+    authRef.baseUrl.length === 0 ||
+    !isTokenAuthRef(authRef)
+  ) {
+    const authError = new Error('Publish Canvas write authentication is not ready.');
+    authError.code = 'PUBLISH_SCHEMA_WRITE_PRECHECK_FAILED';
+    return Promise.reject(authError);
+  }
+  const gmtModified = requireSchemaServerRevision({ gmtModified: serverRevision });
+  const savePath = `/alibaba/web/${appType}/query/codeBundle/save.json?_stamp=${Date.now()}`;
+  return httpPostMultipart(authRef.baseUrl, savePath, {
+    _csrf_token: authRef.csrfToken,
+    formUuid,
+    gmtModified,
+    canvasNodeId: payload.canvasNodeId,
+    content: payload.content,
+    importSchema: true,
+  }, {
+    source: {
+      content: payload.sourceCode,
+      fileName: 'source.jsx',
+      contentType: 'text/plain; charset=UTF-8',
+    },
+    runtime: {
+      content: payload.runtimeCode,
+      fileName: 'runtime.js',
+      contentType: 'application/javascript; charset=UTF-8',
+    },
+  }, { silentStatus: true });
+}
+
 function walkFiles(dir, results, limit) {
   if (!fs.existsSync(dir) || results.length >= limit) {
     return;
@@ -624,6 +716,8 @@ async function runMain(argv) {
   baseUrl = authRef.baseUrl;
 
   let schemaContent;
+  let expectedSchemaContent;
+  let canvasSavePayload;
   let serverRevision;
   if (isCanvas) {
     try {
@@ -633,7 +727,18 @@ async function runMain(argv) {
       process.exit(1);
     }
     // canvasResult 已在登录前本地编译完成，这里只需据其装配 Schema content。
-    schemaContent = buildCanvasSchemaContent(sourceCode, canvasResult.runtimeCode, canvasResult.importedModules, formUuid);
+    expectedSchemaContent = buildCanvasSchemaContent(
+      sourceCode,
+      canvasResult.runtimeCode,
+      canvasResult.importedModules,
+      formUuid
+    );
+    canvasSavePayload = buildCanvasSavePayload(
+      expectedSchemaContent,
+      sourceCode,
+      canvasResult.runtimeCode
+    );
+    schemaContent = canvasSavePayload.content;
   } else {
     let existingDataSource = null;
     try {
@@ -646,6 +751,7 @@ async function runMain(argv) {
     }
     baseUrl = authRef.baseUrl;
     schemaContent = buildSchemaContent(sourceCode, compiledCode, formUuid, { existingDataSource });
+    expectedSchemaContent = schemaContent;
   }
   success(t('publish.schema_built'));
 
@@ -656,7 +762,15 @@ async function runMain(argv) {
   label('Source:', sourcePath);
   label('Compiled:', compiledPath);
   step(3, t('publish.step_publish'));
-  const response = await sendSaveRequestWithAuth(authRef, schemaContent, appType, formUuid, serverRevision);
+  const response = isCanvas
+    ? await sendCanvasSaveRequestWithAuth(
+      authRef,
+      canvasSavePayload,
+      appType,
+      formUuid,
+      serverRevision
+    )
+    : await sendSaveRequestWithAuth(authRef, schemaContent, appType, formUuid, serverRevision);
 
   if (!response || !response.success) {
     const errorMsg = response ? response.errorMsg || t('common.unknown_error') : t('common.request_failed');
@@ -670,6 +784,9 @@ async function runMain(argv) {
   const content = response.content || {};
   const savedFormUuid = content.formUuid || formUuid;
   const version = content.version || 0;
+  const storageMode = isCanvas ? content.storageMode || null : undefined;
+  const bundleId = isCanvas ? content.bundleId || null : undefined;
+  const fallbackReason = isCanvas ? content.fallbackReason || null : undefined;
   success(t('publish.schema_published'));
   label('Form UUID:', savedFormUuid);
   label('Version:', String(version));
@@ -688,7 +805,7 @@ async function runMain(argv) {
         appType,
         savedFormUuid,
         authRef,
-        schemaContent,
+        expectedSchemaContent,
         isCanvas ? 'canvas' : 'native'
       );
     } catch (healthCheckError) {
@@ -754,6 +871,9 @@ async function runMain(argv) {
       version,
       url: pageUrl,
       publishMode,
+      storageMode,
+      bundleId,
+      fallbackReason,
       publishReadbackVerified: !!(healthCheckResult && healthCheckResult.ok === true),
       runtimeSmokeVerified: false,
       runtimeSmokeStatus: 'not_checked',
@@ -794,5 +914,7 @@ if (require.main === module) {
   module.exports.countCustomPageDataSources = countCustomPageDataSources;
   module.exports.buildSchemaContent = buildSchemaContent;
   module.exports.buildCanvasSchemaContent = buildCanvasSchemaContent;
+  module.exports.buildCanvasSavePayload = buildCanvasSavePayload;
   module.exports.sendSaveRequestWithAuth = sendSaveRequestWithAuth;
+  module.exports.sendCanvasSaveRequestWithAuth = sendCanvasSaveRequestWithAuth;
 }

package/lib/core/command-manifest.js

@@ -1569,8 +1569,8 @@ function summarizeLocalizedCommands(commands) {
         plan_command_ids: ['design-plan.init', 'design-plan.preview', 'design-plan.materialize', 'design-plan.patch'],
         theme_command_ids: ['sample', 'create-app', 'update-app'],
         navigation_command_ids: { platform: ['update-app', 'nav-group'], custom: ['update-app', 'update-form-config', 'get-form-config'] },
-        navigation_policy: 'Before PRD planning, reuse explicit navigation choices. During first-time intake, ask only when ownership is unknown and offer exactly two neutral options with no preselection: "宜搭原生导航" (使用宜搭自带的导航菜单。) and "自定义导航" (在自定义页面里定制菜单的样式和操作方式，替代宜搭自带的导航菜单。). Native means platform navigation. The agent chooses layout from module count, hierarchy, switching frequency, content width and target device; do not ask layout or presentation-style questions. Prefer top for few shallow modules and wide content, side for many frequently accessed modules, L-shaped/mixed for business domains with child modules, and custom dock for lightweight mobile entries. Preserve user-specified layouts. Store resolved type/source/reason/variant in the brief, distinguishing user ownership from agent layout reasoning. Platform navigation uses update-app --layout top|side|l_shape --show-app-nav, which writes layoutDirection=top|side|l_shape and hideAppNav=n. Preserve stored navType unchanged; do not derive or invent it and do not add a --nav-type option. Without --layout, normalize stored legacy layoutDirection and navType using the yc-utils application rules (hoz plus top_side means l_shape; missing layout uses top_fold/top_side for top/l_shape). Shell page-level top_fold/none overrides do not belong in app settings. Custom side/top/mixed/dock is a page layout and requires app and per-page navigation hiding with readback. Verify persisted layoutDirection and hideAppNav; updatedFields and themeVerification do not prove navigation persistence. Navigation tone is separate from layout.',
-        design_mode_policy: 'Analyze requirements first. First-time builds include new apps and existing apps without business pages. Reuse detailed supplied plans; if the mode is unspecified, ask whether to prepare a PRD for confirmation (Plan, more detailed and slower) or build from the supplied requirements (Fast). Without detailed requirements, offer Fast and Plan neutrally. Confirm unresolved navigation ownership, visual style and page scope before planning or resource creation; the agent determines navigation layout from the business context without a layout question. Existing business apps only clarify the current change. A named resource-only request with explicitScope.allowInferredResources=false skips unrelated navigation and visual questions. Standard Plan uses design-plan init parallelTasks, then executes the returned materialize.command exactly once with business-file and visual-file; preview and --from-preview are only for explicitly incremental large plans. Confirm the displayed revision before building, and do not materialize or patch again after confirmation.',
+        navigation_policy: 'Before PRD planning in Fast and Plan, the agent determines navigation ownership and layout from business context. Preserve explicit user requirements and existing navigation for local changes; resource-only scope must not trigger app setting changes. Use native navigation for form, approval and data-management workflows; use custom navigation for persistent menus and content state, branded menus or special interactions. Portal/dashboard/homepage labels and page-local tabs alone imply native navigation. Choose layout from module count, hierarchy, switching frequency, content width and device: top for few shallow modules and wide content, side for many frequent modules, L-shaped/mixed for two-level domains, custom dock for lightweight mobile entries. Preserve user-specified layouts. Store resolved type/source/reason/variant in the brief: ai_default for agent ownership decisions, user_selected for explicit user ownership; distinguish user requirements from agent reasoning. Include navigation in the overall Plan confirmation; Fast implements the recorded navigation decision. Platform navigation uses update-app --layout top|side|l_shape --show-app-nav, which writes layoutDirection=top|side|l_shape and hideAppNav=n. Preserve stored navType unchanged; do not derive or invent it and do not add a --nav-type option. Without --layout, normalize stored legacy layoutDirection and navType using the yc-utils application rules (hoz plus top_side means l_shape; missing layout uses top_fold/top_side for top/l_shape). Shell page-level top_fold/none overrides do not belong in app settings. Custom side/top/mixed/dock is a page layout and requires app and per-page navigation hiding with readback. Verify persisted layoutDirection and hideAppNav; updatedFields and themeVerification do not prove navigation persistence. Navigation tone is separate from layout.',
+        design_mode_policy: 'Analyze requirements first. First-time builds include new apps and existing apps without business pages. Reuse detailed supplied plans; if the mode is unspecified, ask whether to prepare a PRD for confirmation (Plan, more detailed and slower) or build from the supplied requirements (Fast). Without detailed requirements, offer Fast and Plan neutrally. Confirm unresolved visual style and page scope before planning; apply navigation_policy. Existing business apps only clarify the current change. A named resource-only request with explicitScope.allowInferredResources=false skips unrelated navigation and visual questions. Standard Plan uses design-plan init parallelTasks, then executes the returned materialize.command exactly once with business-file and visual-file; preview and --from-preview are only for explicitly incremental large plans. Confirm the displayed revision before building, and do not materialize or patch again after confirmation.',
         product_design_policy: 'yida-requirement-analysis owns shared facts and first-time intake. yida-prd owns business planning; yida-design owns visual design. Reuse the same confirmed brief and supplied details. Prepare business and base visuals concurrently, then bind visuals to settled page tasks. yida-app merges and checks the artifacts before creating resources. Plan uses the compact authoring contract and selected theme context; the CLI reads full templates and renders all artifacts.',
         ui_guidance_policy: 'Page implementation consumes yida-prd prd.md for positioning, information architecture, page prototype, native form entry policy, material strategy, business-specific checks, resource creation order, page implementation delivery order, navigation order, and acceptance criteria; it consumes yida-design design.md for app custom theme CSS delivery, themeColor/navTheme, visual states, visualScaffold, surface material, rounded rules, density rules, components, state styling, and page-level imageNeed. When a page is imageNeed=required, or beneficial with declared image slots, yida-image-assets prepares a traceable asset manifest before that page is implemented; imageNeed=none skips the branch. prd.md and design.md remain the only design sources of truth. Page implementation may extract page-spec.json as a derived implementation handoff from prd.md + design.md; conflicts are resolved by sending business conflicts to yida-prd and visual conflicts to yida-design before regenerating the spec. Core normal forms default to 1-3 business sample records before page implementation, followed by query readback. An explicit opt-out, configuration dictionary, sensitive data, or lack of safely constructible values requires a recorded skip reason. Screenshots, public sharing, data-source deep binding, and fine navigation grouping are optional after explicit user request or PRD acceptance criteria.',
         default_nav_order_policy: 'For custom navigation, implement PRD navigation order in the custom shell and verify app/page navigation hiding; skip platform nav-group ordering. For platform navigation: after the primary page is successfully published, perform exactly one navigation order operation. If the PRD names a navigation order, publish without --auto-nav-order and then call openyida nav-group order <appType> <items...>. If the PRD only gives broad groups or is missing navigation order, use openyida publish ... --auto-nav-order and do not call nav-group order or auto-order afterward. Explicit and automatic ordering are mutually exclusive; never generate per-item move loops. The fallback priority is portal/home/workbench entry > business handling > data management > business analytics > system configuration.',