openyida 2026.9.20 → 2026.9.22-1

package/README.md

@@ -393,13 +393,15 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 
 | Command | Description |
 |---------|-------------|
+| `openyida app-entry get <appType> [--json]` | Read frontend and management runtime entries |
+| `openyida app-entry set <appType> [--frontend <url>] [--management <url>] [--clear-frontend] [--clear-management] [--json]` | Register application entries with partial update and readback |
 | `openyida app-list [--type managed\|created] [--page N] [--size N]` | Page through apps I manage or created |
 | `openyida corp-efficiency [overview\|details\|detail\|groups\|notify] [options] [--open\|--no-open]` | Query enterprise efficiency overview and detail reports |
 | `openyida create-app "<name>"\|--name <name> [options] [--locale zh_CN\|en_US\|ja_JP] [--open\|--no-open]` | Create a Yida app |
 | `openyida design-plan catalog [--json]` | List available planning themes and page patterns |
 | `openyida design-plan init <requirement-brief.json> [--theme-id <id>] [--output-dir <dir>] [--json]` | Initialize a plan draft from confirmed requirements |
 | `openyida design-plan preview <build-plan.json> --part-file <module.json> [--json]` | Update plan drafts by module |
-| `openyida design-plan materialize <build-plan.json> [--from-preview \| --business-file <json> --visual-file <json>] [--output-dir <dir>] [--check] [--json]` | Generate or update plan documents and theme with consistency checks |
+| `openyida design-plan materialize <build-plan.json> [--from-preview \| --business-file <json> --visual-file <json>] [--output-dir <dir>] [--rebase-parts] [--check] [--json]` | Generate or update plan documents and theme with consistency checks |
 | `openyida design-plan patch <build-plan.json> --set <path=value> [--set <path=value> ...] [--materialize] [--output-dir <dir>] [--json]` | Patch plan fields and optionally sync documents and theme |
 | `openyida update-app <appType> [--name "..."] [--desc "..."] [--icon <name>] [--icon-color <color>] [--colour <key>] [--theme-color <color>] [--theme-file <css>] [--nav-theme light\|dark\|white\|gray] [--logo-source appIcon\|customImage] [--layout side\|top\|l_shape] [--hide-app-nav\|--show-app-nav]` | Update app info |
 | `openyida app-online <appType> [--to-ding-app-center] [--show-app-center]` | Enable a Yida app |

package/bin/yida.js

@@ -733,6 +733,12 @@ async function main() {
       break;
     }
 
+    case 'app-entry': {
+      const { run } = require('../lib/app/app-entry');
+      await run(args);
+      break;
+    }
+
     case 'app-list': {
       const { run } = require('../lib/app/app-list');
       await run(args);

package/lib/app/app-entry.js

@@ -0,0 +1,118 @@
+'use strict';
+
+const { createAuthRef, createYidaClient, unwrapYidaResponse } = require('../core/yida-client');
+const { t } = require('../core/i18n');
+const { throwUsage } = require('../core/command-errors');
+
+/** Keep complete runtime URLs; the server verifies tenant and resource ownership. */
+function normalizeUrl(value, appType) {
+  const input = String(value || '').trim();
+  if (!input) { throw new Error(t('app_entry.invalid_url')); }
+  // eslint-disable-next-line no-control-regex -- reject control characters in persisted URLs
+  if (input.length > 2048 || /[\\\s\x00-\x1f\x7f]/.test(input)) {
+    throw new Error(t('app_entry.invalid_url'));
+  }
+  const match = /^https?:\/\/[^/?#]+(\/[^?#]*)(?:\?([^#]*))?(?:#(.*))?$/i.exec(input);
+  if (!match) { throw new Error(t('app_entry.invalid_url')); }
+  const url = new URL(input);
+  const route = match[1];
+  const prefix = `/${appType}/`;
+  const parts = route.startsWith(prefix) ? route.slice(prefix.length).split('/') : [];
+  const short = /^\/(?:s\/[A-Za-z0-9_-]+|o\/[A-Za-z0-9_-]+(?:\/FORM-[A-Za-z0-9_-]+)?)$/.test(route);
+  const runtime = ['custom', 'workbench', 'submission', 'manage'].includes(parts[0]) &&
+    ((parts.length === 1 && parts[0] === 'workbench') ||
+      (parts.length === 2 && /^[A-Za-z0-9_-]+$/.test(parts[1])));
+  if (url.username || url.password || url.pathname !== route || (!short && !runtime)) {
+    throw new Error(t('app_entry.invalid_url'));
+  }
+  if (match[2] !== undefined) {
+    const seen = new Set();
+    for (const parameter of match[2].split('&')) {
+      const pair = /^(corpid|locale|viewUuid|processCode|hideLeftNav|noShowTopBottom)=([A-Za-z0-9_-]+)$/.exec(parameter);
+      if (!pair || seen.has(pair[1]) ||
+        (['hideLeftNav', 'noShowTopBottom'].includes(pair[1]) && !/^(true|false|y|n|0|1)$/.test(pair[2]))) {
+        throw new Error(t('app_entry.invalid_url'));
+      }
+      seen.add(pair[1]);
+    }
+  }
+  if (match[3] !== undefined && !/^[A-Za-z0-9_/-]+$/.test(match[3])) {
+    throw new Error(t('app_entry.invalid_url'));
+  }
+  return input;
+}
+
+/** Reject duplicate or ambiguous flags; omissions never clear stored entries. */
+function parseArgs(args) {
+  const [action, appType, ...flags] = args;
+  if (!['get', 'set'].includes(action) || !/^[A-Za-z0-9_-]+$/.test(appType || '')) {
+    throwUsage(t('app_entry.usage'));
+  }
+  const values = {};
+  for (let index = 0; index < flags.length; index++) {
+    const flag = flags[index];
+    if (flag === '--json') {
+      continue;
+    }
+    const match = /^--(clear-)?(frontend|management)$/.exec(flag);
+    if (action !== 'set' || !match || Object.prototype.hasOwnProperty.call(values, match[2])) {
+      throwUsage(t('app_entry.usage'));
+    }
+    const value = match[1] ? null : flags[++index];
+    if (value !== null && (!value || value.startsWith('--'))) {
+      throwUsage(t('app_entry.usage'));
+    }
+    values[match[2]] = value;
+  }
+  if (action === 'set' && !Object.keys(values).length) {
+    throwUsage(t('app_entry.usage'));
+  }
+  return { action, appType, values };
+}
+
+/** Read the revision used for a conditional partial write. */
+async function readEntries(client, appType) {
+  const result = unwrapYidaResponse(await client.get(`/${appType}/query/app/getAccessEntries.json`));
+  if (!result || typeof result.revision !== 'string' || !result.revision ||
+      !result.accessEntries || typeof result.accessEntries !== 'object' || Array.isArray(result.accessEntries)) {
+    throw new Error(t('app_entry.invalid_response'));
+  }
+  return result;
+}
+
+/** Persist only supplied entries and verify them through a separate read. */
+async function run(args = []) {
+  if (args.includes('--help') || args.includes('-h')) {
+    console.log(t('app_entry.usage'));
+    return;
+  }
+  const { action, appType, values } = parseArgs(args);
+  const authRef = createAuthRef();
+  const client = createYidaClient({ authRef });
+  const patch = {};
+  for (const [key, value] of Object.entries(values)) {
+    patch[key] = value === null ? null : { url: normalizeUrl(value, appType) };
+  }
+  let result = await readEntries(client, appType);
+  if (action === 'set') {
+    unwrapYidaResponse(await client.postForm(`/${appType}/query/app/saveAccessEntries.json`, {
+      accessEntries: JSON.stringify(patch), revision: result.revision,
+    }));
+    result = await readEntries(client, appType);
+    for (const [key, entry] of Object.entries(patch)) {
+      if ((result.accessEntries[key]?.url || '') !== (entry?.url || '')) {
+        throw new Error(t('app_entry.readback_failed'));
+      }
+    }
+  }
+  const urls = {};
+  for (const key of ['frontend', 'management']) {
+    if (result.accessEntries[key]?.url) {
+      urls[key] = normalizeUrl(result.accessEntries[key].url, appType);
+    }
+  }
+  console.log(JSON.stringify({ appType, ...result, urls }, null, 2));
+  return result;
+}
+
+module.exports = { run, parseArgs, normalizeUrl };

package/lib/app/app-list.js

@@ -84,6 +84,7 @@ function formatApp(app, baseUrl) {
     appName: (app.appName && app.appName.zh_CN) || '',
     appType: app.appType || '',
     systemLink: app.systemLink || '',
+    ...(app.accessEntries ? { accessEntries: app.accessEntries } : {}),
     ...buildApplicationEntryUrls({ appType: app.appType, systemLink: app.systemLink, baseUrl }),
   };
 }

package/lib/app/application-style.js

@@ -13,6 +13,8 @@ const CREATIVE_TOKENS = [
   '--pod-page-footer-bg-color', '--pod-sticky-footer-box-shadow',
   '--oyd-content-width', '--oyd-content-padding', '--oyd-field-gap',
   '--oyd-heading-font', '--oyd-heading-size', '--oyd-rule-style',
+  '--pod-shell-theme-bg-color', '--pod-nav-item-text-color', '--pod-nav-item-text-hover-color',
+  '--pod-nav-item-text-selected-color', '--pod-nav-menu-bg-hover-color', '--pod-nav-menu-bg-selected-color',
 ];
 
 function validateCreativeDirection(direction, tokens) {
@@ -46,7 +48,7 @@ function applyApplicationStyle(css, metadata, tokens) {
 }
 
 function exportApplicationStyle(id, outputDirectory) {
-  const theme = loadThemeIndex().themes.find(item => item.themeId === id && item.collection === 'application-styles');
+  const theme = loadThemeIndex().themes.find(item => item.themeId === id);
   if (!theme) {throw new CliError(t('design_document.invalid', id || '--style-id', 'APPLICATION_STYLE_UNKNOWN'), { code: 'APPLICATION_STYLE_UNKNOWN' });}
   const directory = path.resolve(outputDirectory);
   const assets = [['design.md', theme.templatePath], ['app_theme.css', theme.cssTemplatePath], ['form-layout.json', theme.formLayoutPath]];

package/lib/app/canvas-theme-guard.js

@@ -2,8 +2,33 @@
 
 const Babel = require('@babel/standalone');
 const { CliError } = require('../core/cli-error');
+const { warn } = require('../core/chalk');
 const { t } = require('../core/i18n');
 
+// Whether provably fixed brand overrides should be downgraded from a hard
+// failure to a warning. Mirrors OPENYIDA_CANVAS_ALLOW_UNSUPPORTED_IMPORTS so
+// legacy pages can ship first and migrate to canvas-theme later.
+function isTruthy(value) {
+  return ['1', 'true', 'yes', 'on'].includes(String(value || '').trim().toLowerCase());
+}
+
+function allowFixedBrand(options = {}, env = process.env) {
+  return options.allowFixedBrand === true || isTruthy(env.OPENYIDA_CANVAS_ALLOW_FIXED_BRAND);
+}
+
+// Whether fixed brand overrides should hard-block publishing. Off by default so
+// users are never stuck: the guard warns and lets the app theme apply. Teams
+// that want CI enforcement opt in via --strict-theme / OPENYIDA_CANVAS_STRICT_THEME.
+function strictFixedBrand(options = {}, env = process.env) {
+  return options.strictBrand === true || isTruthy(env.OPENYIDA_CANVAS_STRICT_THEME);
+}
+
+function emitThemeWarning(options, message) {
+  if (typeof options.onThemeWarning === 'function') { options.onThemeWarning(message); return; }
+  warn(message);
+}
+
+
 // Check the maintained theme contract without executing business code.
 // Dynamic component factories and runtime branches still need browser verification.
 function assertCanvasThemeStructure(source, options = {}) {
@@ -123,9 +148,12 @@ function assertCanvasThemeStructure(source, options = {}) {
   }
 }
 
-// Only reject provably fixed brand colors passed to antd's ConfigProvider.
-// Semantic colors, layout tokens and dynamic theme resolvers remain supported.
-function assertBrandOverrides(ast, traverse, options) {
+// Collect every provably fixed brand color passed to antd's ConfigProvider.
+// Semantic colors, layout tokens and dynamic theme resolvers are ignored.
+// Each entry keeps the offending property's char offsets so the theme codemod
+// can surgically remove it while the guard reuses the same detection to fail.
+function collectBrandOverrides(ast, traverse) {
+  const violations = [];
   const resolve = (p, seen = new Set()) => {
     if (!p?.node || seen.has(p.node)) { return null; }
     seen.add(p.node);
@@ -147,10 +175,12 @@ function assertBrandOverrides(ast, traverse, options) {
     const color = val.isStringLiteral() ? val.node.value : val.node.quasis[0].value.cooked;
     if (!color) { return; }
     const line = val.node.loc?.start.line || 1;
-    throw new CliError(t('publish.canvas_theme_fixed_brand', line), {
-      code: 'OPENYIDA_CANVAS_THEME_FIXED_BRAND',
-      details: { stage: 'canvas_compile', sourcePath: options.sourcePath || '', line, field, value: color,
-        sample: 'openyida sample openyida-page-template canvas-theme' },
+    // Remove the override at its ConfigProvider usage site, not the resolved literal.
+    const property = p?.parentPath?.isObjectProperty() ? p.parentPath.node : null;
+    violations.push({
+      field, color, line,
+      start: property ? property.start : val.node.start,
+      end: property ? property.end : val.node.end,
     });
   };
   const tokens = p => properties(p).forEach(item => {
@@ -179,6 +209,46 @@ function assertBrandOverrides(ast, traverse, options) {
       }
     },
   });
+  return violations;
+}
+
+// Fixed brand colors passed to antd's ConfigProvider are relaxed by default:
+// warn and continue so users are never blocked (the app theme still applies at
+// runtime). --strict-theme / OPENYIDA_CANVAS_STRICT_THEME restores the hard fail
+// for CI enforcement; --allow-fixed-brand keeps its explicit ship-as-is warning.
+function assertBrandOverrides(ast, traverse, options) {
+  const explicitlyAllowed = allowFixedBrand(options);
+  const strict = strictFixedBrand(options);
+  for (const { field, color, line } of collectBrandOverrides(ast, traverse)) {
+    if (explicitlyAllowed) {
+      emitThemeWarning(options, t('publish.canvas_theme_fixed_brand_allowed', line, field));
+      continue;
+    }
+    if (!strict) {
+      emitThemeWarning(options, t('publish.canvas_theme_fixed_brand_relaxed', line, field));
+      continue;
+    }
+    throw new CliError(t('publish.canvas_theme_fixed_brand', line), {
+      code: 'OPENYIDA_CANVAS_THEME_FIXED_BRAND',
+      details: { stage: 'canvas_compile', sourcePath: options.sourcePath || '', line, field, value: color,
+        retryable: false, retrySafe: true, sideEffectState: 'none',
+        nextAction: { type: 'edit_source_then_recheck' },
+        sample: 'openyida sample openyida-page-template canvas-theme' },
+    });
+  }
+}
+
+// Parse a canvas source and return removable fixed-brand overrides (with char
+// offsets). Returns [] when the source has no theme markers or fails to parse,
+// mirroring the guard's own gate so the codemod never acts on unrelated code.
+function collectFixedBrandViolations(source) {
+  if (!/CanvasThemeProvider|useCanvasThemeContext|CanvasThemeContext|@canvas-theme-provider|antd/.test(source)) { return []; }
+  let ast;
+  try {
+    ast = Babel.packages.parser.parse(source, { sourceType: 'module', plugins: ['jsx', 'typescript'] });
+  } catch { return []; }
+  const traverse = Babel.packages.traverse.default || Babel.packages.traverse;
+  return collectBrandOverrides(ast, traverse);
 }
 
-module.exports = { assertCanvasThemeStructure };
+module.exports = { assertCanvasThemeStructure, collectFixedBrandViolations };

package/lib/app/fix-theme.js

@@ -0,0 +1,82 @@
+'use strict';
+
+/**
+ * fix-theme.js - Canvas 主题迁移 codemod（纯函数）
+ *
+ * 把写死在 antd `ConfigProvider` 里的品牌交互色覆盖（如 `colorPrimary: '#1677ff'`）
+ * 从源码中移除，交由外层应用主题（CanvasThemeProvider / 平台主题）解析。这是
+ * "un-pin" 迁移：移除硬编码覆盖后，品牌色由应用主题接管，正好满足主题守卫
+ * `OPENYIDA_CANVAS_THEME_FIXED_BRAND` 的要求。
+ *
+ * 本模块不做任何 IO，只接收源码字符串、返回改写后的源码，便于单测与复用。
+ */
+
+const { collectFixedBrandViolations } = require('./canvas-theme-guard');
+
+/**
+ * 计算某个对象属性的删除区间：优先连同其后的逗号一起删；若是最后一个属性，
+ * 则回退删除其前的逗号。属性独占一行时顺带清理该行缩进与换行，避免留下空行。
+ * @param {string} source
+ * @param {number} start - 属性节点起始偏移
+ * @param {number} end - 属性节点结束偏移
+ * @returns {{ start: number, end: number }}
+ */
+function expandRemovalSpan(source, start, end) {
+  let removeStart = start;
+  let removeEnd = end;
+  const trailing = source.slice(removeEnd).match(/^[ \t]*,/);
+  if (trailing) {
+    removeEnd += trailing[0].length;
+    const lineStart = source.lastIndexOf('\n', removeStart - 1) + 1;
+    const indent = source.slice(lineStart, removeStart);
+    if (/^[ \t]*$/.test(indent)) {
+      removeStart = lineStart;
+      const newline = source.slice(removeEnd).match(/^[ \t]*\r?\n/);
+      if (newline) { removeEnd += newline[0].length; }
+    }
+    return { start: removeStart, end: removeEnd };
+  }
+  // Last property in its object: drop the preceding comma instead.
+  const leading = source.slice(0, removeStart).match(/,[ \t\r\n]*$/);
+  if (leading) { removeStart -= leading[0].length; }
+  return { start: removeStart, end: removeEnd };
+}
+
+/**
+ * 移除源码中写死的品牌色覆盖。改写按偏移从后往前应用，避免前面的偏移失效。
+ * @param {string} source - canvas 源码
+ * @returns {{ changed: boolean, output: string, violations: Array<{field:string,color:string,line:number}> }}
+ */
+function transformFixedBrandTheme(source) {
+  const violations = collectFixedBrandViolations(source)
+    .filter(item => Number.isInteger(item.start) && Number.isInteger(item.end) && item.end > item.start);
+  if (!violations.length) {
+    return { changed: false, output: source, violations: [] };
+  }
+  const spans = violations
+    .map(item => expandRemovalSpan(source, item.start, item.end))
+    .sort((a, b) => a.start - b.start);
+
+  // Adjacent overrides can claim the same separating comma (one as trailing,
+  // the next as leading), so merge overlapping spans instead of dropping one.
+  const merged = [];
+  for (const span of spans) {
+    const last = merged[merged.length - 1];
+    if (last && span.start <= last.end) { last.end = Math.max(last.end, span.end); }
+    else { merged.push({ ...span }); }
+  }
+
+  let output = source;
+  // Apply from the back so earlier offsets stay valid.
+  for (let i = merged.length - 1; i >= 0; i -= 1) {
+    output = output.slice(0, merged[i].start) + output.slice(merged[i].end);
+  }
+
+  return {
+    changed: output !== source,
+    output,
+    violations: violations.map(({ field, color, line }) => ({ field, color, line })),
+  };
+}
+
+module.exports = { transformFixedBrandTheme, expandRemovalSpan };

package/lib/app/publish.js

@@ -99,9 +99,12 @@ function parseArgs(argv = process.argv.slice(2)) {
   const compat = args.includes('--compat') || args.includes('--modern');
   const force = args.includes('--force');
   const canvas = args.includes('--canvas');
+  const allowFixedBrand = args.includes('--allow-fixed-brand');
+  const fixTheme = args.includes('--fix-theme');
+  const strictTheme = args.includes('--strict-theme');
   const autoNavOrder = args.includes('--auto-nav-order');
   const help = args.includes('--help') || args.includes('-h');
-  const filteredArgs = args.filter(arg => arg !== '--skip-lint' && arg !== '--health-check' && arg !== '--check' && arg !== '--compat' && arg !== '--modern' && arg !== '--force' && arg !== '--canvas' && arg !== '--auto-nav-order' && arg !== '--json' && arg !== '--help' && arg !== '-h');
+  const filteredArgs = args.filter(arg => arg !== '--skip-lint' && arg !== '--health-check' && arg !== '--check' && arg !== '--compat' && arg !== '--modern' && arg !== '--force' && arg !== '--canvas' && arg !== '--allow-fixed-brand' && arg !== '--fix-theme' && arg !== '--strict-theme' && arg !== '--auto-nav-order' && arg !== '--json' && arg !== '--help' && arg !== '-h');
 
   if (help) {
     usage(t('publish.usage'), t('publish.example'));
@@ -122,6 +125,9 @@ function parseArgs(argv = process.argv.slice(2)) {
     compat,
     force,
     canvas,
+    allowFixedBrand,
+    fixTheme,
+    strictTheme,
     autoNavOrder,
     browserOpenMode: openOption.mode,
   };
@@ -146,6 +152,52 @@ function buildCanvasCompileCliError(errorObject, sourcePath) {
   });
 }
 
+// Ask the human (via stdin) whether to migrate. Returns false unless both the
+// input and the prompt's output stream are real TTYs, so agent/CI/piped runs
+// never block on a question nobody can answer and must opt in with --fix-theme.
+function canPromptInteractively() {
+  return Boolean(process.stdin.isTTY) && Boolean(process.stderr.isTTY);
+}
+
+function confirmFixedBrandMigration() {
+  if (!canPromptInteractively()) { return Promise.resolve(false); }
+  const readline = require('readline');
+  const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+  return new Promise((resolve) => {
+    rl.question(`${t('publish.fix_theme_confirm')} `, (answer) => {
+      rl.close();
+      resolve(/^(y|yes)$/i.test(String(answer).trim()));
+    });
+  });
+}
+
+// Offer to un-pin fixed brand colors so the app theme takes over. Confirms with
+// the user (or auto-applies when --fix-theme is set), rewrites the source file
+// in place, and returns the migrated source; returns null when nothing changed
+// or the user declined. Callers continue publishing regardless unless strict.
+async function offerFixedBrandThemeMigration(sourcePath, source, { autoConfirm, strict } = {}) {
+  const { transformFixedBrandTheme } = require('./fix-theme');
+  const result = transformFixedBrandTheme(source);
+  if (!result.changed) { return null; }
+
+  warn(t('publish.fix_theme_detected', result.violations.length));
+  result.violations.forEach((item) => hint(t('publish.fix_theme_item', item.line, item.field, item.color)));
+
+  const proceed = autoConfirm === true || await confirmFixedBrandMigration();
+  if (!proceed) {
+    // Only nudge harder in strict mode; the relaxed path prints its own note.
+    if (strict) {
+      if (!canPromptInteractively()) { info(t('publish.fix_theme_flag_hint')); }
+      else { info(t('publish.fix_theme_skipped')); }
+    }
+    return null;
+  }
+
+  fs.writeFileSync(sourcePath, result.output);
+  success(t('publish.fix_theme_applied', sourcePath));
+  return result.output;
+}
+
 function enableQuietForJson(argv = []) {
   if (!Array.isArray(argv) || !argv.includes('--json')) {
     return () => {};
@@ -614,7 +666,7 @@ async function runMain(argv) {
   if (options.help) {
     return options;
   }
-  const { appType, formUuid, sourceFile, skipLint, healthCheck, compat, force, canvas: canvasFlag, autoNavOrder, browserOpenMode } = options;
+  const { appType, formUuid, sourceFile, skipLint, healthCheck, compat, force, canvas: canvasFlag, allowFixedBrand, fixTheme, strictTheme, autoNavOrder, browserOpenMode } = options;
 
   let sourcePath = path.resolve(sourceFile);
   if (!fs.existsSync(sourcePath)) {
@@ -644,8 +696,20 @@ async function runMain(argv) {
     // （JSX/TS → runtimeCode + importedModules），无需登录态，可在开浏览器前失败快。
     step(1, t('publish.step_canvas_compile'));
     info(t('publish.canvas_compiling'));
+    // Offer to un-pin fixed brand colors before compiling so the ask-human /
+    // --fix-theme migration still runs now that the guard no longer blocks by
+    // default. Skipped when --allow-fixed-brand explicitly ships as-is. In
+    // non-TTY runs the prompt declines instead of hanging, and the guard warns
+    // (or hard-fails under --strict-theme) rather than blocking the user.
+    if (!allowFixedBrand) {
+      const migratedSource = await offerFixedBrandThemeMigration(sourcePath, initialSourceCode, {
+        autoConfirm: fixTheme,
+        strict: strictTheme,
+      });
+      if (migratedSource !== null) { sourceCode = migratedSource; }
+    }
     try {
-      canvasResult = await compileCanvas(initialSourceCode, { sourcePath });
+      canvasResult = await compileCanvas(sourceCode, { sourcePath, allowFixedBrand, strictBrand: strictTheme });
     } catch (canvasCompileError) {
       throw buildCanvasCompileCliError(canvasCompileError, sourcePath);
     }

package/lib/app/theme-from-design.js

@@ -5,7 +5,7 @@ const path = require('path');
 const { CliError } = require('../core/cli-error');
 const { REQUIRED_BRAND_SCALE_TOKENS, validateThemeCssContent, extractThemeColor } = require('./custom-theme');
 const { parseDesignDocument, extractDesignTokens } = require('../design/document');
-const NAVIGATION_TOKENS = [
+const NAVIGATION_COLOR_TOKENS = [
   '--pod-shell-theme-bg-color', '--pod-nav-item-text-color', '--pod-nav-item-text-hover-color',
   '--pod-nav-item-text-selected-color', '--pod-nav-menu-bg-hover-color', '--pod-nav-menu-bg-selected-color',
 ];
@@ -48,7 +48,7 @@ function resolveDesignTokens(metadata) {
 }
 
 function navigationTone(metadata, tokens) {
-  if (!NAVIGATION_TOKENS.every(name => tokens[name])) {return null;}
+  if (!NAVIGATION_COLOR_TOKENS.every(name => tokens[name])) {return null;}
   const tone = metadata.themeProfile?.navTheme;
   if (['light', 'dark'].includes(tone)) {return tone;}
   if (tone !== undefined) {throw new CliError('themeProfile.navTheme 必须是 light 或 dark', { code: 'DESIGN_THEME_NAVIGATION_INVALID' });}
@@ -91,7 +91,9 @@ function applyNavigationTokens(css, tokens, changed, tone, previousTone) {
   const source = fs.readFileSync(path.resolve(__dirname,
     '../../yida-skills/skills/yida-design/references/theme/app-custom-theme-template.css'), 'utf8');
   const defaults = Object.assign({}, ...[...source.matchAll(/^:root\s*\{([^}]+)\}/gm)].map(match => declarationValues(match[1])));
-  const navigationChanged = Object.fromEntries(NAVIGATION_TOKENS.filter(name => name in changed).map(name => [name, tokens[name]]));
+  const isNavigation = name => /^(--pod-nav-|--pod-shell-|--pod-page-header-)/.test(name);
+  const navigationNames = Object.keys(tokens).filter(isNavigation);
+  const navigationChanged = Object.fromEntries(navigationNames.filter(name => name in changed).map(name => [name, tokens[name]]));
   let output = css.replace(/(^:root\s*\{)([^}]+)(\})/gm,
     (block, start, body, close) => start + replaceDeclarations(body, navigationChanged) + close);
   for (const mode of ['light', 'dark']) {
@@ -102,19 +104,23 @@ function applyNavigationTokens(css, tokens, changed, tone, previousTone) {
     // A first application or a mode change establishes both palettes. Delta
     // updates otherwise leave unrelated, manually customized declarations alone.
     const resetMode = !previousTone || previousTone !== tone;
-    const names = resetMode ? NAVIGATION_TOKENS : (mode === tone ? Object.keys(navigationChanged) : []);
-    const values = Object.fromEntries(names.map(name => [name, mode === tone ? tokens[name] : modeDefaults[name]]));
+    // The selected marker is a mode-independent shape, not a navigation palette.
+    const names = (resetMode ? navigationNames : (mode === tone ? Object.keys(navigationChanged) : []))
+      .filter(name => name !== '--pod-nav-menu-item-selected-shadow');
+    const values = Object.fromEntries(names.map(name => [name, mode === tone ? tokens[name] : modeDefaults[name]])
+      .filter(([, value]) => value !== undefined));
     if (!Object.keys(values).length) {continue;}
+    const isForeground = name => name.startsWith('--pod-nav-') || name === '--pod-page-header-text-color';
+    const background = Object.fromEntries(Object.entries(values).filter(([name]) => !isForeground(name)));
     const shell = values['--pod-shell-theme-bg-color'];
-    if (shell) {
-      const background = {
-        '--pod-shell-theme-bg-color': shell,
-        '--pod-page-header-bg-color': mode === tone ? shell : modeDefaults['--pod-page-header-bg-color'],
-      };
+    if (shell && !tokens['--pod-page-header-bg-color']) {
+      background['--pod-page-header-bg-color'] = mode === tone ? shell : modeDefaults['--pod-page-header-bg-color'];
+    }
+    if (Object.keys(background).length) {
       output = output.replace(new RegExp(`(\\.pod-premium\\.nav-${mode}\\s*\\{)([^}]*)(\\})`, 'g'),
         (block, start, body, close) => start + replaceDeclarations(body, background, true) + close);
     }
-    const foregrounds = Object.fromEntries(Object.entries(values).filter(([name]) => name !== '--pod-shell-theme-bg-color'));
+    const foregrounds = Object.fromEntries(Object.entries(values).filter(([name]) => isForeground(name)));
     output = output.replace(new RegExp(`(\\.pod-premium\\.is-${mode}\\s*\\{)([^}]*)(\\})`, 'g'),
       (block, start, body, close) => start + replaceDeclarations(body, foregrounds, true) + close);
   }
@@ -122,11 +128,30 @@ function applyNavigationTokens(css, tokens, changed, tone, previousTone) {
 }
 
 function applyDesignTokens(template, markdown, previousMarkdown) {
-  // Reject damaged templates or existing stylesheets before the scope rewrite.
-  validateThemeCssContent(template);
   const metadata = designMetadata(markdown);
   const previousMetadata = previousMarkdown === markdown ? metadata : (previousMarkdown ? designMetadata(previousMarkdown) : null);
   const tokens = resolveDesignTokens(metadata);
+  // Bundled CSS is an authoring template. Fill only unresolved declarations from
+  // the completed design before validating and rewriting CSS scopes.
+  template = template.replace(/^([ \t]*)(--[\w-]+)(\s*:\s*)([^;\n]+);/gm,
+    (line, indent, name, separator, value) => {
+      if (!/\{\{PRIMARY_COLOR\}\}|<生成实际色值：/.test(value)) {return line;}
+      if (!tokens[name] || /\{\{|<生成实际色值：/.test(tokens[name])) {
+        throw new CliError(`design.md 缺少品牌 token：${name}`, { code: 'DESIGN_THEME_TOKENS_REQUIRED' });
+      }
+      return `${indent}${name}${separator}${tokens[name]};`;
+    });
+  // Reject damaged templates or existing stylesheets before the scope rewrite.
+  validateThemeCssContent(template);
+  // Older generated files have the selected-shadow rule only. Bring in the
+  // shared consumer once when a design opts into menu borders, retaining all
+  // existing project rules and declarations during incremental updates.
+  if (tokens['--pod-nav-menu-item-border'] && !template.includes('border: var(--pod-nav-menu-item-border,')) {
+    const source = fs.readFileSync(path.resolve(__dirname,
+      '../../yida-skills/skills/yida-design/references/theme/app-custom-theme-template.css'), 'utf8');
+    const shapeRules = source.match(/\/\* openyida-navigation-shape:start \*\/[\s\S]*?\/\* openyida-navigation-shape:end \*\//)[0];
+    template += `\n${shapeRules}\n`;
+  }
   const previous = previousMetadata === metadata ? tokens : (previousMetadata ? resolveDesignTokens(previousMetadata) : null);
   const tone = navigationTone(metadata, tokens);
   const previousTone = previous ? navigationTone(previousMetadata, previous) : null;