openyida 2026.9.2-1 → 2026.9.2-beta.1

package/lib/app/display-page-readback.js

@@ -23,10 +23,30 @@ function fingerprint(value) {
   return crypto.createHash('sha256').update(normalized).digest('hex');
 }
 
+function rawFingerprint(value) {
+  if (typeof value !== 'string' || !value) {
+    return '';
+  }
+  return crypto.createHash('sha256').update(value, 'utf8').digest('hex');
+}
+
+function positiveSize(value) {
+  const size = Number(value);
+  return Number.isFinite(size) && size > 0 ? size : 0;
+}
+
+function sha256(value) {
+  const digest = String(value || '').toLowerCase();
+  return /^[a-f0-9]{64}$/.test(digest) ? digest : '';
+}
+
 function createEmptyDisplayInfo() {
   return {
     hasYidaCodeCanvas: false,
+    hasCodeBundle: false,
     hasNativeJsx: false,
+    codeBundleCount: 0,
+    bundleIds: [],
     runtimeCodeBytes: 0,
     sourceCodeBytes: 0,
     compiledCodeBytes: 0,
@@ -34,6 +54,8 @@ function createEmptyDisplayInfo() {
     componentCount: 0,
     canvasRuntimeCode: '',
     canvasSourceCode: '',
+    canvasRuntimeSha256: '',
+    canvasSourceSha256: '',
     nativeCompiledCode: '',
     nativeSourceCode: '',
   };
@@ -79,12 +101,37 @@ function traverseDisplayNodes(node, info) {
 
   if (node.componentName === 'YidaCodeCanvas') {
     const props = node.props || {};
+    const codeBundle = props.codeBundle && typeof props.codeBundle === 'object'
+      ? props.codeBundle
+      : null;
     info.hasYidaCodeCanvas = true;
     info.componentCount++;
-    info.canvasRuntimeCode = props.runtimeCode || '';
-    info.canvasSourceCode = props.code || '';
+    if (typeof props.runtimeCode === 'string' && props.runtimeCode) {
+      info.canvasRuntimeCode = props.runtimeCode;
+    }
+    if (typeof props.code === 'string' && props.code) {
+      info.canvasSourceCode = props.code;
+    }
     info.runtimeCodeBytes += codeBytes(props.runtimeCode);
     info.sourceCodeBytes += codeBytes(props.code);
+    if (codeBundle) {
+      const bundleId = String(codeBundle.bundleId || '');
+      const runtime = codeBundle.runtime && typeof codeBundle.runtime === 'object'
+        ? codeBundle.runtime
+        : {};
+      const source = codeBundle.source && typeof codeBundle.source === 'object'
+        ? codeBundle.source
+        : {};
+      info.hasCodeBundle = true;
+      info.codeBundleCount++;
+      if (bundleId && !info.bundleIds.includes(bundleId)) {
+        info.bundleIds.push(bundleId);
+      }
+      info.runtimeCodeBytes += positiveSize(runtime.size);
+      info.sourceCodeBytes += positiveSize(source.size);
+      info.canvasRuntimeSha256 = sha256(runtime.sha256) || info.canvasRuntimeSha256;
+      info.canvasSourceSha256 = sha256(source.sha256) || info.canvasSourceSha256;
+    }
     addImportedModules(info.importedModules, props.importedModules);
   } else if (node.componentName === 'Jsx') {
     info.hasNativeJsx = true;
@@ -133,7 +180,9 @@ function hasExpectedDisplayComponent(info, publishMode) {
     return false;
   }
   if (publishMode === 'canvas') {
-    return info.hasYidaCodeCanvas && info.runtimeCodeBytes > 0;
+    return info.hasYidaCodeCanvas && (
+      info.runtimeCodeBytes > 0 || !!info.canvasRuntimeSha256
+    );
   }
   return info.hasNativeJsx && info.compiledCodeBytes > 0;
 }
@@ -144,7 +193,10 @@ function summarizeDisplayPublishInfo(info) {
   }
   return {
     hasYidaCodeCanvas: info.hasYidaCodeCanvas,
+    hasCodeBundle: info.hasCodeBundle,
     hasNativeJsx: info.hasNativeJsx,
+    codeBundleCount: info.codeBundleCount,
+    bundleIds: info.bundleIds.slice(),
     runtimeCodeBytes: info.runtimeCodeBytes,
     sourceCodeBytes: info.sourceCodeBytes,
     compiledCodeBytes: info.compiledCodeBytes,
@@ -159,8 +211,13 @@ function verifyPublishedContentMatch(readbackSchema, expectedSchemaContent, publ
   const displayComponentPresent = hasExpectedDisplayComponent(readbackInfo, publishMode);
   const readbackArtifact = getPublishArtifact(readbackInfo, publishMode);
   const expectedArtifact = getPublishArtifact(expectedInfo, publishMode);
-  const readbackFingerprint = fingerprint(readbackArtifact);
-  const expectedFingerprint = fingerprint(expectedArtifact);
+  const codeBundleReadback = publishMode === 'canvas' && readbackInfo && readbackInfo.hasCodeBundle;
+  const readbackFingerprint = codeBundleReadback
+    ? readbackInfo.canvasRuntimeSha256
+    : fingerprint(readbackArtifact);
+  const expectedFingerprint = codeBundleReadback
+    ? rawFingerprint(expectedArtifact)
+    : fingerprint(expectedArtifact);
 
   return {
     readbackInfo,
@@ -180,6 +237,7 @@ function verifyPublishedContentMatch(readbackSchema, expectedSchemaContent, publ
 module.exports = {
   extractDisplayPublishInfo,
   fingerprint,
+  rawFingerprint,
   hasExpectedDisplayComponent,
   parseSchemaContent,
   summarizeDisplayPublishInfo,

package/lib/app/get-schema.js

@@ -9,6 +9,7 @@
 
 'use strict';
 
+const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const {
@@ -16,6 +17,7 @@ const {
   triggerLogin,
   resolveBaseUrl,
   httpGet,
+  httpGetRedirectText,
   requestWithAutoLogin,
 } = require('../core/utils');
 const { t } = require('../core/i18n');
@@ -227,6 +229,122 @@ function resolveSchemaContent(schemaResult) {
   return parseJsonObject(content);
 }
 
+function validateCodeBundleDescriptor(codeBundle) {
+  const bundleId = String(codeBundle && codeBundle.bundleId || '');
+  const source = codeBundle && codeBundle.source;
+  const runtime = codeBundle && codeBundle.runtime;
+  const validSha256 = value => /^[a-f0-9]{64}$/.test(String(value || ''));
+  const validSize = value => Number.isFinite(Number(value)) && Number(value) > 0
+    && Number(value) <= 5 * 1024 * 1024;
+  if (!validSha256(bundleId)
+    || !source || !runtime
+    || !validSha256(source.sha256) || !validSize(source.size)
+    || !validSha256(runtime.sha256) || !validSize(runtime.size)
+    || Number(source.size) + Number(runtime.size) > 5 * 1024 * 1024) {
+    throw new Error('YidaCodeCanvas codeBundle 描述不合法');
+  }
+  return { bundleId, source, runtime };
+}
+
+function collectCodeBundleCanvases(content) {
+  const canvases = [];
+  function traverse(node) {
+    if (Array.isArray(node)) {
+      node.forEach(traverse);
+      return;
+    }
+    if (!node || typeof node !== 'object') {
+      return;
+    }
+    if (node.componentName === 'YidaCodeCanvas' && node.id && node.props
+      && node.props.codeBundle && typeof node.props.codeBundle === 'object') {
+      canvases.push({ props: node.props, descriptor: validateCodeBundleDescriptor(node.props.codeBundle) });
+    }
+    Object.values(node).forEach(traverse);
+  }
+  traverse(content);
+  return canvases;
+}
+
+async function downloadCodeBundleArtifact(appType, formUuid, bundleId, artifact, descriptor, authRef) {
+  let responseMetadata = null;
+  const expectedContentTypes = artifact === 'source'
+    ? ['text/plain']
+    : ['application/javascript', 'text/javascript', 'application/x-javascript'];
+  const value = await requestWithAutoLogin((auth) => httpGetRedirectText(
+    auth.baseUrl,
+    `/alibaba/web/${appType}/query/codeBundle/download.json`,
+    { formUuid, bundleId, artifact },
+    {
+      silentStatus: true,
+      maxBytes: 5 * 1024 * 1024,
+      expectedContentTypes,
+      onResponseMetadata: metadata => {
+        responseMetadata = metadata;
+      },
+    }
+  ), authRef);
+  if (typeof value !== 'string') {
+    const message = value && (value.errorMsg || value.message);
+    throw new Error(message || `下载 CodeBundle ${artifact} 失败`);
+  }
+  const size = Buffer.byteLength(value, 'utf8');
+  const digest = crypto.createHash('sha256').update(value, 'utf8').digest('hex');
+  if (size !== Number(descriptor.size) || digest !== descriptor.sha256) {
+    const context = responseMetadata && responseMetadata.context
+      ? responseMetadata.context
+      : `baseUrl=${authRef && authRef.baseUrl || 'unknown'}`;
+    const error = new Error(t('common.code_bundle_integrity_failed', artifact, context));
+    error.code = 'CODE_BUNDLE_INTEGRITY_MISMATCH';
+    error.details = {
+      artifact,
+      expectedSize: Number(descriptor.size),
+      actualSize: size,
+      expectedSha256: descriptor.sha256,
+      actualSha256: digest,
+      ...(responseMetadata || {}),
+    };
+    throw error;
+  }
+  return value;
+}
+
+async function resolveCodeBundleSchema(schemaResult, appType, formUuid, authRef) {
+  const content = resolveSchemaContent(schemaResult);
+  if (!content) {
+    return schemaResult;
+  }
+  const canvases = collectCodeBundleCanvases(content);
+  if (canvases.length === 0) {
+    return schemaResult;
+  }
+
+  const downloaded = new Map();
+  for (const canvas of canvases) {
+    const { bundleId, source, runtime } = canvas.descriptor;
+    let code = downloaded.get(bundleId);
+    if (!code) {
+      const [sourceCode, runtimeCode] = await Promise.all([
+        downloadCodeBundleArtifact(appType, formUuid, bundleId, 'source', source, authRef),
+        downloadCodeBundleArtifact(appType, formUuid, bundleId, 'runtime', runtime, authRef),
+      ]);
+      code = { sourceCode, runtimeCode };
+      downloaded.set(bundleId, code);
+    }
+    canvas.props.code = code.sourceCode;
+    canvas.props.runtimeCode = code.runtimeCode;
+    delete canvas.props.codeBundle;
+  }
+
+  if (schemaResult && Object.prototype.hasOwnProperty.call(schemaResult, 'content')) {
+    schemaResult.content = typeof schemaResult.content === 'string'
+      ? JSON.stringify(content)
+      : content;
+    return schemaResult;
+  }
+  return content;
+}
+
 function addImportedModules(target, value) {
   let modules = value;
   if (typeof modules === 'string') {
@@ -269,7 +387,10 @@ function extractDisplayPageSummary(schemaResult) {
 
   const displayPage = {
     hasYidaCodeCanvas: false,
+    hasCodeBundle: false,
     hasNativeJsx: false,
+    codeBundleCount: 0,
+    bundleIds: [],
     runtimeCodeBytes: 0,
     sourceCodeBytes: 0,
     compiledCodeBytes: 0,
@@ -291,10 +412,29 @@ function extractDisplayPageSummary(schemaResult) {
 
     if (node.componentName === 'YidaCodeCanvas' && isComponentInstance(node)) {
       const props = node.props || {};
+      const codeBundle = props.codeBundle && typeof props.codeBundle === 'object'
+        ? props.codeBundle
+        : null;
       displayPage.hasYidaCodeCanvas = true;
       displayPage.componentCount++;
       displayPage.runtimeCodeBytes += codeBytes(props.runtimeCode);
       displayPage.sourceCodeBytes += codeBytes(props.code);
+      if (codeBundle) {
+        const source = codeBundle.source && typeof codeBundle.source === 'object'
+          ? codeBundle.source
+          : {};
+        const runtime = codeBundle.runtime && typeof codeBundle.runtime === 'object'
+          ? codeBundle.runtime
+          : {};
+        const bundleId = String(codeBundle.bundleId || '');
+        displayPage.hasCodeBundle = true;
+        displayPage.codeBundleCount++;
+        displayPage.sourceCodeBytes += Number(source.size) || 0;
+        displayPage.runtimeCodeBytes += Number(runtime.size) || 0;
+        if (bundleId && !displayPage.bundleIds.includes(bundleId)) {
+          displayPage.bundleIds.push(bundleId);
+        }
+      }
       addImportedModules(displayPage.importedModules, props.importedModules);
     } else if (node.componentName === 'Jsx' && isComponentInstance(node)) {
       displayPage.hasNativeJsx = true;
@@ -581,12 +721,15 @@ async function mapLimit(items, limit, iterator) {
   return results;
 }
 
-async function fetchSchemaRecord(appType, form, authRef, retries) {
+async function fetchSchemaRecord(appType, form, authRef, retries, options = {}) {
   let lastError = null;
   for (let attempt = 0; attempt <= retries; attempt++) {
     try {
       const result = await fetchSchema(appType, form.formUuid, authRef);
       if (isSuccessfulSchemaResult(result)) {
+        const resolvedResult = options.resolveCodeBundles
+          ? await resolveCodeBundleSchema(result, appType, form.formUuid, authRef)
+          : result;
         const record = {
           formUuid: form.formUuid,
           formName: form.formName,
@@ -594,10 +737,10 @@ async function fetchSchemaRecord(appType, form, authRef, retries) {
           pathName: form.pathName,
           success: true,
           attempts: attempt + 1,
-          fieldSummary: extractFieldSummary(result),
-          schema: result,
+          fieldSummary: extractFieldSummary(resolvedResult),
+          schema: resolvedResult,
         };
-        const displayPage = extractDisplayPageSummary(result);
+        const displayPage = extractDisplayPageSummary(resolvedResult);
         if (displayPage) {
           record.displayPage = displayPage;
         }
@@ -694,6 +837,10 @@ async function runSingle(parsed, authRef) {
     throwCommandError(errorMsg);
   }
 
+  if (!parsed.field && !parsed.compact && !parsed.summaryJson) {
+    result = await resolveCodeBundleSchema(result, parsed.appType, parsed.formUuid, authRef);
+  }
+
   // 保留既有 --field 返回结构；新 contract 仅由 --compact / --resolve-fields 触发。
   if (parsed.field) {
     const allFieldNodes = collectFieldNodes(result);
@@ -782,7 +929,9 @@ async function runBatch(parsed, authRef) {
   info(`  批量获取 ${forms.length} 个表单 Schema，并发 ${parsed.concurrency}，重试 ${parsed.retries}`);
 
   const records = await mapLimit(forms, parsed.concurrency, async (form) => {
-    const record = await fetchSchemaRecord(parsed.appType, form, authRef, parsed.retries);
+    const record = await fetchSchemaRecord(parsed.appType, form, authRef, parsed.retries, {
+      resolveCodeBundles: !parsed.summaryJson,
+    });
     if (record.success && parsed.analysisJson) {
       record.semanticAnalysis = buildSemanticAnalysis(
         parsed.appType,
@@ -848,5 +997,9 @@ module.exports = {
   fetchSchemaRecord,
   collectFieldNodes,
   findFieldNode,
+  validateCodeBundleDescriptor,
+  collectCodeBundleCanvases,
+  downloadCodeBundleArtifact,
+  resolveCodeBundleSchema,
   run,
 };

package/lib/app/publish.js

@@ -10,9 +10,9 @@
  *
  * 流程：
  * 1. 读取源文件，通过内置 babel-transform 编译 + UglifyJS 压缩
- * 2. 用代码动态构建 Schema，将 source/compiled 填入 actions.module
+ * 2. 用代码动态构建 Schema；Canvas 页面拆出 source/runtime 后统一保存
  * 3. 读取 token session，在写前确认登录态
- * 4. 通过 HTTP POST 调用 saveFormSchema，token 失效时尝试 token refresh
+ * 4. Canvas 调统一保存接口；普通 JSX 页面仍调用原 saveFormSchema
  */
 
 const fs = require('fs');
@@ -21,6 +21,7 @@ const querystring = require('querystring');
 const {
   findProjectRoot,
   httpPost,
+  httpPostMultipart,
   httpGet,
   requestWithAutoLogin,
 } = require('../core/utils');
@@ -58,6 +59,8 @@ const {
 const SCHEMA_VERSION = 'V5';
 const DOMAIN_CODE = 'tEXDRG';
 const PREFIX = '_view';
+const MAX_CODE_BUNDLE_BYTES = 5 * 1024 * 1024;
+const MAX_CANVAS_SCHEMA_SKELETON_BYTES = 1024 * 1024;
 
 // ── 参数解析 ─────────────────────────────────────────
 
@@ -284,6 +287,61 @@ function buildCanvasSchemaContent(sourceCode, runtimeCode, importedModules, form
   return buildCanvasPageSchemaContent(sourceCode, runtimeCode, importedModules, formUuid);
 }
 
+function buildCanvasSavePayload(schemaContent, sourceCode, runtimeCode) {
+  if (typeof sourceCode !== 'string' || sourceCode.length === 0
+    || typeof runtimeCode !== 'string' || runtimeCode.length === 0) {
+    throw new Error('Canvas source/runtime 不能为空');
+  }
+  const totalCodeBytes = Buffer.byteLength(sourceCode, 'utf8')
+    + Buffer.byteLength(runtimeCode, 'utf8');
+  if (totalCodeBytes > MAX_CODE_BUNDLE_BYTES) {
+    throw new Error('Canvas source/runtime 总大小不能超过 5 MiB');
+  }
+
+  let schema;
+  try {
+    schema = JSON.parse(schemaContent);
+  } catch {
+    throw new Error('Canvas Schema 不是有效 JSON');
+  }
+
+  const canvases = [];
+  function traverse(node) {
+    if (Array.isArray(node)) {
+      node.forEach(traverse);
+      return;
+    }
+    if (!node || typeof node !== 'object') {
+      return;
+    }
+    if (node.componentName === 'YidaCodeCanvas' && node.id) {
+      canvases.push(node);
+    }
+    Object.values(node).forEach(traverse);
+  }
+  traverse(schema);
+  if (canvases.length !== 1) {
+    throw new Error('Canvas Schema 必须且只能包含一个 YidaCodeCanvas 节点');
+  }
+
+  const canvas = canvases[0];
+  canvas.props = canvas.props && typeof canvas.props === 'object' ? canvas.props : {};
+  delete canvas.props.code;
+  delete canvas.props.runtimeCode;
+  delete canvas.props.codeBundle;
+
+  const skeletonContent = JSON.stringify(schema);
+  if (Buffer.byteLength(skeletonContent, 'utf8') > MAX_CANVAS_SCHEMA_SKELETON_BYTES) {
+    throw new Error('Canvas Schema 骨架不能超过 1 MiB');
+  }
+  return {
+    canvasNodeId: canvas.id,
+    content: skeletonContent,
+    sourceCode,
+    runtimeCode,
+  };
+}
+
 
 // ── 4. 发送 saveFormSchema 请求 ──────────────────────
 
@@ -313,6 +371,40 @@ function sendSaveRequestWithAuth(authRef, schemaContent, appType, formUuid, serv
   return httpPost(authRef.baseUrl, saveSchemaPath, postData, { silentStatus: true });
 }
 
+function sendCanvasSaveRequestWithAuth(authRef, payload, appType, formUuid, serverRevision) {
+  if (
+    !authRef ||
+    typeof authRef.baseUrl !== 'string' ||
+    authRef.baseUrl.length === 0 ||
+    !isTokenAuthRef(authRef)
+  ) {
+    const authError = new Error('Publish Canvas write authentication is not ready.');
+    authError.code = 'PUBLISH_SCHEMA_WRITE_PRECHECK_FAILED';
+    return Promise.reject(authError);
+  }
+  const gmtModified = requireSchemaServerRevision({ gmtModified: serverRevision });
+  const savePath = `/alibaba/web/${appType}/query/codeBundle/save.json?_stamp=${Date.now()}`;
+  return httpPostMultipart(authRef.baseUrl, savePath, {
+    _csrf_token: authRef.csrfToken,
+    formUuid,
+    gmtModified,
+    canvasNodeId: payload.canvasNodeId,
+    content: payload.content,
+    importSchema: true,
+  }, {
+    source: {
+      content: payload.sourceCode,
+      fileName: 'source.jsx',
+      contentType: 'text/plain; charset=UTF-8',
+    },
+    runtime: {
+      content: payload.runtimeCode,
+      fileName: 'runtime.js',
+      contentType: 'application/javascript; charset=UTF-8',
+    },
+  }, { silentStatus: true });
+}
+
 function walkFiles(dir, results, limit) {
   if (!fs.existsSync(dir) || results.length >= limit) {
     return;
@@ -622,6 +714,8 @@ async function runMain(argv) {
   baseUrl = authRef.baseUrl;
 
   let schemaContent;
+  let expectedSchemaContent;
+  let canvasSavePayload;
   let serverRevision;
   if (isCanvas) {
     try {
@@ -631,7 +725,18 @@ async function runMain(argv) {
       process.exit(1);
     }
     // canvasResult 已在登录前本地编译完成，这里只需据其装配 Schema content。
-    schemaContent = buildCanvasSchemaContent(sourceCode, canvasResult.runtimeCode, canvasResult.importedModules, formUuid);
+    expectedSchemaContent = buildCanvasSchemaContent(
+      sourceCode,
+      canvasResult.runtimeCode,
+      canvasResult.importedModules,
+      formUuid
+    );
+    canvasSavePayload = buildCanvasSavePayload(
+      expectedSchemaContent,
+      sourceCode,
+      canvasResult.runtimeCode
+    );
+    schemaContent = canvasSavePayload.content;
   } else {
     let existingDataSource = null;
     try {
@@ -644,6 +749,7 @@ async function runMain(argv) {
     }
     baseUrl = authRef.baseUrl;
     schemaContent = buildSchemaContent(sourceCode, compiledCode, formUuid, { existingDataSource });
+    expectedSchemaContent = schemaContent;
   }
   success(t('publish.schema_built'));
 
@@ -654,7 +760,15 @@ async function runMain(argv) {
   label('Source:', sourcePath);
   label('Compiled:', compiledPath);
   step(3, t('publish.step_publish'));
-  const response = await sendSaveRequestWithAuth(authRef, schemaContent, appType, formUuid, serverRevision);
+  const response = isCanvas
+    ? await sendCanvasSaveRequestWithAuth(
+      authRef,
+      canvasSavePayload,
+      appType,
+      formUuid,
+      serverRevision
+    )
+    : await sendSaveRequestWithAuth(authRef, schemaContent, appType, formUuid, serverRevision);
 
   if (!response || !response.success) {
     const errorMsg = response ? response.errorMsg || t('common.unknown_error') : t('common.request_failed');
@@ -668,6 +782,9 @@ async function runMain(argv) {
   const content = response.content || {};
   const savedFormUuid = content.formUuid || formUuid;
   const version = content.version || 0;
+  const storageMode = isCanvas ? content.storageMode || null : undefined;
+  const bundleId = isCanvas ? content.bundleId || null : undefined;
+  const fallbackReason = isCanvas ? content.fallbackReason || null : undefined;
   success(t('publish.schema_published'));
   label('Form UUID:', savedFormUuid);
   label('Version:', String(version));
@@ -686,7 +803,7 @@ async function runMain(argv) {
         appType,
         savedFormUuid,
         authRef,
-        schemaContent,
+        expectedSchemaContent,
         isCanvas ? 'canvas' : 'native'
       );
     } catch (healthCheckError) {
@@ -733,7 +850,20 @@ async function runMain(argv) {
     ['URL', pageUrl],
   ]);
   console.log(JSON.stringify(withBrowserHandoff(
-    { success: true, appType, formUuid: savedFormUuid, version, url: pageUrl, publishMode, healthCheck: healthCheckResult, navOrder: navOrderResult, navOrderWarning },
+    {
+      success: true,
+      appType,
+      formUuid: savedFormUuid,
+      version,
+      url: pageUrl,
+      publishMode,
+      storageMode,
+      bundleId,
+      fallbackReason,
+      healthCheck: healthCheckResult,
+      navOrder: navOrderResult,
+      navOrderWarning,
+    },
     pageUrl,
     { stage: 'publish_page_success', title: savedFormUuid },
     browserOpenMode
@@ -767,5 +897,7 @@ if (require.main === module) {
   module.exports.countCustomPageDataSources = countCustomPageDataSources;
   module.exports.buildSchemaContent = buildSchemaContent;
   module.exports.buildCanvasSchemaContent = buildCanvasSchemaContent;
+  module.exports.buildCanvasSavePayload = buildCanvasSavePayload;
   module.exports.sendSaveRequestWithAuth = sendSaveRequestWithAuth;
+  module.exports.sendCanvasSaveRequestWithAuth = sendCanvasSaveRequestWithAuth;
 }

package/lib/core/locales/en.js

@@ -869,6 +869,15 @@ Examples:
     response_body: '  Response body: {0}',
     response_detail: '  Response detail: {0}',
     response_not_json: 'response is not JSON',
+    code_bundle_download_failed: 'CodeBundle download failed: {0} ({1})',
+    code_bundle_forbidden: 'permission verification or OSS access was denied',
+    code_bundle_not_found: 'the file does not exist or has been removed',
+    code_bundle_http_error: 'HTTP {0}',
+    code_bundle_html_response: 'received an HTML error page; the environment or route may be incorrect',
+    code_bundle_json_response: 'the service returned a JSON error response: {0}',
+    code_bundle_unexpected_content_type: 'unexpected response Content-Type: {0}',
+    code_bundle_invalid_utf8: 'the response is not valid UTF-8 text',
+    code_bundle_integrity_failed: 'CodeBundle {0} integrity verification failed ({1})',
     login_expired: '  Login session expired: {0}',
     csrf_expired: '  CSRF token expired: {0}',
     csrf_refreshed: '  csrf_token refreshed',

package/lib/core/locales/zh.js

@@ -840,6 +840,15 @@ openyida - 宜搭命令行工具
     response_body: '  响应内容: {0}',
     response_detail: '  响应详情: {0}',
     response_not_json: '响应非 JSON',
+    code_bundle_download_failed: 'CodeBundle 下载失败：{0}（{1}）',
+    code_bundle_forbidden: '权限校验或 OSS 访问被拒绝',
+    code_bundle_not_found: '文件不存在或已被清理',
+    code_bundle_http_error: 'HTTP {0}',
+    code_bundle_html_response: '返回了 HTML 错误页，可能是环境或路由错误',
+    code_bundle_json_response: '服务端返回 JSON 错误响应：{0}',
+    code_bundle_unexpected_content_type: '响应 Content-Type 不符合预期：{0}',
+    code_bundle_invalid_utf8: '响应内容不是有效 UTF-8 文本',
+    code_bundle_integrity_failed: 'CodeBundle {0} 完整性校验失败（{1}）',
     login_expired: '  检测到登录过期: {0}',
     csrf_expired: '  检测到 csrf_token 过期: {0}',
     csrf_refreshed: '  csrf_token 已刷新',

package/lib/core/utils.js

@@ -1080,6 +1080,413 @@ function createNonJsonResponseResult(statusCode, data) {
   };
 }
 
+function buildRequestUrl(baseUrl, requestPath, queryParams) {
+  const normalizedBaseUrl = String(baseUrl || '').replace(/\/+$/, '') + '/';
+  const requestUrl = new URL(requestPath, normalizedBaseUrl);
+  if (queryParams) {
+    Object.entries(queryParams).forEach(([key, value]) => {
+      if (value !== undefined && value !== null) {
+        requestUrl.searchParams.set(key, String(value));
+      }
+    });
+  }
+  return requestUrl;
+}
+
+async function fetchWithTimeout(requestUrl, requestOptions, timeout) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeout || 30000);
+  try {
+    return await fetch(requestUrl, {
+      ...requestOptions,
+      signal: controller.signal,
+    });
+  } catch (error) {
+    if (error && error.name === 'AbortError') {
+      throw new Error(t('common.request_timeout'));
+    }
+    throw error;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+async function parseJsonFetchResponse(response, options = {}) {
+  const data = await response.text();
+  if (!options.silentStatus) {
+    warn(t('common.http_status', response.status));
+  }
+  if (isHttpRedirectStatus(response.status) || isHttpAuthStatus(response.status)) {
+    return {
+      __needLogin: true,
+      __httpStatus: response.status,
+      __location: response.headers.get('location') || '',
+    };
+  }
+  try {
+    const parsed = JSON.parse(data);
+    if (isLoginExpired(parsed)) {
+      return { __needLogin: true };
+    }
+    if (isCsrfTokenExpired(parsed)) {
+      return { __csrfExpired: true };
+    }
+    return parsed;
+  } catch {
+    if (!options.silentStatus) {
+      warn(t('common.http_response', data.substring(0, 500)));
+    }
+    return createNonJsonResponseResult(response.status, data);
+  }
+}
+
+function appendMultipartFile(form, fieldName, file) {
+  if (!file || file.content === undefined || file.content === null) {
+    throw new TypeError(`multipart file ${fieldName} is required`);
+  }
+  const content = Buffer.isBuffer(file.content)
+    ? file.content
+    : Buffer.from(String(file.content), 'utf8');
+  form.append(
+    fieldName,
+    new Blob([content], { type: file.contentType || 'application/octet-stream' }),
+    file.fileName || fieldName
+  );
+}
+
+/**
+ * 发送 multipart/form-data POST。Content-Type boundary 由 Node.js FormData 生成。
+ */
+async function httpPostMultipart(baseUrl, requestPath, fields, files, optionsOrLegacyCookies, maybeOptions) {
+  if (typeof fetch !== 'function' || typeof FormData !== 'function' || typeof Blob !== 'function') {
+    throw new Error('当前 Node.js 环境缺少 fetch/FormData/Blob，请使用 Node.js 18+');
+  }
+  const optionsOverride = resolveRequestOptions(optionsOrLegacyCookies, maybeOptions);
+  const authHeaders = await resolveRequestAuthHeaders(optionsOverride);
+  const form = new FormData();
+  Object.entries(fields || {}).forEach(([key, value]) => {
+    if (value !== undefined && value !== null) {
+      form.append(key, String(value));
+    }
+  });
+  Object.entries(files || {}).forEach(([key, file]) => appendMultipartFile(form, key, file));
+
+  const requestUrl = buildRequestUrl(baseUrl, requestPath);
+  const response = await fetchWithTimeout(requestUrl, {
+    method: 'POST',
+    redirect: 'manual',
+    headers: {
+      Accept: 'application/json, text/plain, */*',
+      Origin: requestUrl.origin,
+      Referer: optionsOverride.referer || requestUrl.origin + '/',
+      'x-requested-with': 'XMLHttpRequest',
+      ...authHeaders,
+    },
+    body: form,
+  }, optionsOverride.timeout);
+  return parseJsonFetchResponse(response, optionsOverride);
+}
+
+async function readFetchResponseBuffer(response, maxBytes, timeout) {
+  const limit = Number(maxBytes);
+  const timeoutMs = Number(timeout) || 30000;
+  const contentLength = Number(response.headers.get('content-length') || 0);
+  if (Number.isFinite(limit) && limit > 0 && contentLength > limit) {
+    const error = new Error(`响应内容超过允许大小 ${limit} bytes`);
+    error.code = 'HTTP_RESPONSE_TOO_LARGE';
+    throw error;
+  }
+
+  if (!response.body || typeof response.body.getReader !== 'function') {
+    let timer;
+    const arrayBuffer = await Promise.race([
+      response.arrayBuffer(),
+      new Promise((resolve, reject) => {
+        void resolve;
+        timer = setTimeout(() => reject(new Error(t('common.request_timeout'))), timeoutMs);
+      }),
+    ]).finally(() => clearTimeout(timer));
+    const buffer = Buffer.from(arrayBuffer);
+    if (Number.isFinite(limit) && limit > 0 && buffer.length > limit) {
+      const error = new Error(`响应内容超过允许大小 ${limit} bytes`);
+      error.code = 'HTTP_RESPONSE_TOO_LARGE';
+      throw error;
+    }
+    return buffer;
+  }
+
+  const chunks = [];
+  let size = 0;
+  const reader = response.body.getReader();
+  let timedOut = false;
+  const timer = setTimeout(() => {
+    timedOut = true;
+    void reader.cancel();
+  }, timeoutMs);
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      const chunk = Buffer.from(value);
+      size += chunk.length;
+      if (Number.isFinite(limit) && limit > 0 && size > limit) {
+        await reader.cancel();
+        const error = new Error(`响应内容超过允许大小 ${limit} bytes`);
+        error.code = 'HTTP_RESPONSE_TOO_LARGE';
+        throw error;
+      }
+      chunks.push(chunk);
+    }
+    if (timedOut) {
+      throw new Error(t('common.request_timeout'));
+    }
+  } finally {
+    clearTimeout(timer);
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks, size);
+}
+
+function normalizeResponseContentType(value) {
+  return String(value || '').split(';')[0].trim().toLowerCase();
+}
+
+function responseRequestId(response) {
+  return response.headers.get('x-oss-request-id')
+    || response.headers.get('x-request-id')
+    || '';
+}
+
+function buildCodeBundleResponseMetadata(initialUrl, currentUrl, response, firstPartyTraceId) {
+  const traceId = firstPartyTraceId
+    || response.headers.get('eagleeye-traceid')
+    || '';
+  const metadata = {
+    baseUrl: initialUrl.origin,
+    finalHost: currentUrl.host,
+    status: response.status,
+    contentType: normalizeResponseContentType(response.headers.get('content-type')),
+    eagleeyeTraceId: traceId,
+    requestId: responseRequestId(response),
+  };
+  metadata.context = [
+    `baseUrl=${metadata.baseUrl}`,
+    `finalHost=${metadata.finalHost}`,
+    `status=${metadata.status}`,
+    `contentType=${metadata.contentType || 'missing'}`,
+    metadata.eagleeyeTraceId ? `eagleeyeTraceId=${metadata.eagleeyeTraceId}` : '',
+    metadata.requestId ? `requestId=${metadata.requestId}` : '',
+  ].filter(Boolean).join(', ');
+  return metadata;
+}
+
+function createCodeBundleDownloadError(code, reason, metadata, responsePreview) {
+  const suffix = responsePreview ? `; response=${responsePreview}` : '';
+  const error = new Error(t('common.code_bundle_download_failed', reason, metadata.context) + suffix);
+  error.code = code;
+  error.details = {
+    ...metadata,
+    responsePreview: responsePreview || undefined,
+  };
+  return error;
+}
+
+function compactResponsePreview(buffer) {
+  return buffer.toString('utf8').replace(/\s+/g, ' ').trim().substring(0, 500);
+}
+
+async function readErrorResponsePreview(response, timeout) {
+  try {
+    return compactResponsePreview(await readFetchResponseBuffer(response, 4096, timeout));
+  } catch {
+    return '';
+  }
+}
+
+function looksLikeHtml(buffer) {
+  const prefix = buffer.toString('utf8', 0, Math.min(buffer.length, 256)).trimStart().toLowerCase();
+  return prefix.startsWith('<!doctype html')
+    || prefix.startsWith('<html')
+    || prefix.startsWith('<head')
+    || prefix.startsWith('<body');
+}
+
+function expectedContentTypeMatches(actualContentType, expectedContentTypes) {
+  if (!Array.isArray(expectedContentTypes) || expectedContentTypes.length === 0) {
+    return true;
+  }
+  return expectedContentTypes.some(value => normalizeResponseContentType(value) === actualContentType);
+}
+
+function jsonResponseReason(preview) {
+  if (!preview) {
+    return t('common.code_bundle_json_response', t('common.unknown_error'));
+  }
+  try {
+    const payload = JSON.parse(preview);
+    const message = payload && (payload.errorMsg || payload.message || payload.throwable || payload.errorCode);
+    return t('common.code_bundle_json_response', message || t('common.unknown_error'));
+  } catch {
+    return t('common.code_bundle_json_response', t('common.unknown_error'));
+  }
+}
+
+/**
+ * 获取文本并显式跟随受控 302。鉴权头只发送给初始宜搭域名，不转发到 OSS。
+ */
+async function httpGetRedirectText(baseUrl, requestPath, queryParams, optionsOrLegacyCookies, maybeOptions) {
+  if (typeof fetch !== 'function') {
+    throw new Error('当前 Node.js 环境缺少 fetch，请使用 Node.js 18+');
+  }
+  const optionsOverride = resolveRequestOptions(optionsOrLegacyCookies, maybeOptions);
+  const authHeaders = await resolveRequestAuthHeaders(optionsOverride);
+  const initialUrl = buildRequestUrl(baseUrl, requestPath, queryParams);
+  const maxRedirects = Number.isInteger(optionsOverride.maxRedirects)
+    ? optionsOverride.maxRedirects
+    : 3;
+  const maxBytes = Number(optionsOverride.maxBytes) || 5 * 1024 * 1024;
+  let currentUrl = initialUrl;
+  let firstPartyTraceId = '';
+
+  for (let redirectCount = 0; redirectCount <= maxRedirects; redirectCount++) {
+    const firstPartyRequest = currentUrl.origin === initialUrl.origin;
+    const response = await fetchWithTimeout(currentUrl, {
+      method: 'GET',
+      redirect: 'manual',
+      headers: firstPartyRequest
+        ? {
+          Accept: 'text/plain, application/javascript, */*',
+          Origin: initialUrl.origin,
+          Referer: initialUrl.origin + '/',
+          'x-requested-with': 'XMLHttpRequest',
+          ...authHeaders,
+        }
+        : {
+          Accept: 'text/plain, application/javascript, */*',
+        },
+    }, optionsOverride.timeout);
+
+    if (firstPartyRequest && response.headers.get('eagleeye-traceid')) {
+      firstPartyTraceId = response.headers.get('eagleeye-traceid');
+    }
+    const metadata = buildCodeBundleResponseMetadata(
+      initialUrl,
+      currentUrl,
+      response,
+      firstPartyTraceId
+    );
+
+    if (isHttpRedirectStatus(response.status)) {
+      const location = response.headers.get('location');
+      if (!location || redirectCount >= maxRedirects) {
+        throw new Error('CodeBundle 下载重定向无效或次数过多');
+      }
+      const nextUrl = new URL(location, currentUrl);
+      if (!['http:', 'https:'].includes(nextUrl.protocol)) {
+        throw new Error('CodeBundle 下载重定向协议不受支持');
+      }
+      if (currentUrl.protocol === 'https:' && nextUrl.protocol !== 'https:') {
+        throw new Error('CodeBundle 下载禁止从 HTTPS 降级到 HTTP');
+      }
+      if (redirectCount === 0 && nextUrl.origin === initialUrl.origin) {
+        return {
+          __needLogin: true,
+          __httpStatus: response.status,
+          __location: location,
+        };
+      }
+      currentUrl = nextUrl;
+      continue;
+    }
+
+    if (firstPartyRequest && response.status === 401) {
+      return { __needLogin: true, __httpStatus: response.status };
+    }
+    if (response.status < 200 || response.status >= 300) {
+      const preview = await readErrorResponsePreview(response, optionsOverride.timeout);
+      if ([401, 403].includes(response.status)) {
+        throw createCodeBundleDownloadError(
+          'CODE_BUNDLE_DOWNLOAD_FORBIDDEN',
+          t('common.code_bundle_forbidden'),
+          metadata,
+          preview
+        );
+      }
+      if (response.status === 404) {
+        throw createCodeBundleDownloadError(
+          'CODE_BUNDLE_DOWNLOAD_NOT_FOUND',
+          t('common.code_bundle_not_found'),
+          metadata,
+          preview
+        );
+      }
+      throw createCodeBundleDownloadError(
+        'CODE_BUNDLE_DOWNLOAD_HTTP_ERROR',
+        t('common.code_bundle_http_error', response.status),
+        metadata,
+        preview
+      );
+    }
+
+    const contentType = metadata.contentType;
+    const htmlResponse = contentType === 'text/html' || contentType === 'application/xhtml+xml';
+    const jsonResponse = contentType === 'application/json' || contentType.endsWith('+json');
+    if (htmlResponse || jsonResponse
+      || !expectedContentTypeMatches(contentType, optionsOverride.expectedContentTypes)) {
+      const preview = await readErrorResponsePreview(response, optionsOverride.timeout);
+      if (htmlResponse) {
+        throw createCodeBundleDownloadError(
+          'CODE_BUNDLE_DOWNLOAD_HTML_RESPONSE',
+          t('common.code_bundle_html_response'),
+          metadata,
+          preview
+        );
+      }
+      if (jsonResponse) {
+        throw createCodeBundleDownloadError(
+          'CODE_BUNDLE_DOWNLOAD_JSON_RESPONSE',
+          jsonResponseReason(preview),
+          metadata,
+          preview
+        );
+      }
+      throw createCodeBundleDownloadError(
+        'CODE_BUNDLE_DOWNLOAD_UNEXPECTED_CONTENT_TYPE',
+        t('common.code_bundle_unexpected_content_type', contentType || 'missing'),
+        metadata,
+        preview
+      );
+    }
+
+    const buffer = await readFetchResponseBuffer(response, maxBytes, optionsOverride.timeout);
+    if (looksLikeHtml(buffer)) {
+      throw createCodeBundleDownloadError(
+        'CODE_BUNDLE_DOWNLOAD_HTML_RESPONSE',
+        t('common.code_bundle_html_response'),
+        metadata,
+        compactResponsePreview(buffer)
+      );
+    }
+    let value;
+    try {
+      value = new TextDecoder('utf-8', { fatal: true }).decode(buffer);
+    } catch {
+      throw createCodeBundleDownloadError(
+        'CODE_BUNDLE_DOWNLOAD_INVALID_UTF8',
+        t('common.code_bundle_invalid_utf8'),
+        metadata
+      );
+    }
+    if (typeof optionsOverride.onResponseMetadata === 'function') {
+      optionsOverride.onResponseMetadata(metadata);
+    }
+    return value;
+  }
+  throw new Error('CodeBundle 下载重定向次数过多');
+}
+
 /**
  * 发送 HTTP POST 请求（application/x-www-form-urlencoded）
  * @param {string} baseUrl
@@ -1504,8 +1911,10 @@ module.exports = {
   isLoginExpired,
   isCsrfTokenExpired,
   httpPost,
+  httpPostMultipart,
   httpPostJson,
   httpGet,
+  httpGetRedirectText,
   requestWithAutoLogin,
   requestNonIdempotentWithAuthPreflight,
   getNpmExecutable,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openyida",
-  "version": "2026.9.2-1",
+  "version": "2026.9.2-beta.1",
   "description": "OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）",
   "bin": {
     "openyida": "bin/yida.js",