openyida 2026.9.4 → 2026.9.7-beta.0

package/README.md

@@ -168,8 +168,9 @@ For a user-facing list of supported features and matching CLI commands, see [Ope
 ```bash
 openyida create-app --name "CRM" --desc "Customer management"
 openyida sample yida-design app-theme --output .cache/openyida/crm/app-theme.css
+openyida create-app --name "CRM" --desc "Customer management" --theme-file .cache/openyida/crm/app-theme.css --nav-theme light --logo-source appIcon --layout l_shape
+openyida app-list --type managed --page 1 --size 16
 openyida update-app APP_XXX --theme-file .cache/openyida/crm/app-theme.css --nav-theme light --logo-source appIcon --layout l_shape
-openyida app-list --size 20
 openyida corp-efficiency
 openyida create-form create APP_XXX "Customer" .cache/openyida/forms/customer-fields.json
 openyida create-form update APP_XXX FORM_XXX .cache/openyida/forms/customer-changes.json
@@ -388,7 +389,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 
 | Command | Description |
 |---------|-------------|
-| `openyida app-list [--size N]` | List my Yida apps |
+| `openyida app-list [--type managed\|created] [--page N] [--size N]` | Page through apps I manage or created |
 | `openyida corp-efficiency [overview\|details\|detail\|groups\|notify] [options] [--open\|--no-open]` | Query enterprise efficiency overview and detail reports |
 | `openyida create-app "<name>"\|--name <name> [options] [--locale zh_CN\|en_US\|ja_JP] [--open\|--no-open]` | Create a Yida app |
 | `openyida design-plan init <requirement-brief.json> [--theme-id <id>] [--output-dir <dir>] [--json]` | Initialize a plan draft from confirmed requirements |
@@ -484,9 +485,9 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | `openyida connector update-action --connector-id <id> --action <operationId> --query-json JSON --confirm` | Safely update action query defaults |
 | `openyida connector list-actions <id>` | List actions |
 | `openyida connector delete-action <id> <operation-id>` | Delete an action |
-| `openyida connector test --connector-id <id> --action <actionId> [--path-json JSON] [--query-json JSON] [--header-json JSON] [--body-json JSON] [--account-id <id>]` | Test an action |
+| `openyida connector test --connector-id <id> --action <actionId> [--path-json JSON] [--query-json JSON] [--header-json JSON] [--body-json JSON] [--account-id <id>] [--system-token-app <appType>]` | Test an action |
 | `openyida connector list-connections <id>` | List auth connections |
-| `openyida connector create-connection <id> <name>` | Create an auth connection |
+| `openyida connector create-connection <id> <name> [--interactive]` | Create an auth connection |
 | `openyida connector smart-create --curl "..."` | Generate a redacted action draft from cURL (no remote create) |
 | `openyida connector parse-api [options]` | Parse API information |
 | `openyida connector gen-template [output]` | Generate API document template |
@@ -495,7 +496,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 
 | Command | Description |
 |---------|-------------|
-| `openyida integration create <appType> ... [--spec file.json]` | Create integration automation flow |
+| `openyida integration create <appType> ... [--spec file.json] [--connector-system-token-app <appType>]` | Create integration automation flow |
 | `openyida integration update <appType> <formUuid> <processCode> --spec <desired-spec.json> [--publish]` | Probe integration update capability (currently blocked without full readback) |
 | `openyida integration list <appType> [--flow-types 1,2,3,5,6] [--form-uuid <uuid>] [--status y\|n] [--json]` | List integration automation flows |
 | `openyida integration enable <appType> <formUuid> <processCode>` | Enable integration automation flow |
@@ -568,7 +569,7 @@ The CLI package ships the core UI languages `zh` and `en` by default. Other CLI
 
 #### Forms and Pages
 
-Form field definitions can include `alias` or `componentAlias` to populate Yida designer component aliases, stored as `pages[0].componentAlias.items`. Yida runtime resolves these aliases in page JS, so `this.$('phone')` can be used instead of `this.$('textField_xxx')`; OpenYida form rules, validations, and `openyida data ... --resolve-aliases` JSON inputs also accept aliases as field references. For server-side DingTalk OpenAPI calls, use `GET /v2.0/yida/forms/component/alias/{appType}/{formUuid}` to read the `{ fieldId, alias }` mapping, then translate aliases before sending form data/search JSON. That endpoint requires `systemToken`, `userId`, an access token, and the Yida form data read permission; grant that permission in DingTalk developer console API permissions and publish the DingTalk app. Yida app code and app secret are available under app settings > deployment/maintenance.
+Form field definitions can include `alias` or `componentAlias` to populate Yida designer component aliases, stored as `pages[0].componentAlias.items`. Yida runtime resolves these aliases in page JS, so `this.$('phone')` can be used instead of `this.$('textField_xxx')`; OpenYida form rules, validations, and `openyida data ... --resolve-aliases` JSON inputs also accept aliases as field references. For server-side DingTalk OpenAPI calls, use `GET /v2.0/yida/forms/component/alias/{appType}/{formUuid}` to read the `{ fieldId, alias }` mapping, then translate aliases before sending form data/search JSON. That endpoint requires `systemToken`, `userId`, an access token, and the Yida form data read permission. Use `connector test --system-token-app <appType>` for a transient test or `integration create --connector-system-token-app <appType>` for a server-side automation; OpenYida resolves `systemToken` internally and never prints it or stores it in page source and Action defaults.
 
 `openyida publish` preserves existing custom page data sources by default. Before saving the new compiled JSX Schema, it reads the current page Schema and merges the Page-level `dataSource` with the built-in `urlParams` and `timestamp` sources, so manually configured data sources are not deleted during republish.
 

package/bin/yida.js

@@ -1119,7 +1119,7 @@ async function main() {
   delete-action <connector-id> <operation-id>  删除执行动作
   test --connector-id <id> --action <actionId> [结构化 JSON 参数] 测试执行动作
   list-connections <connector-id>              列出鉴权账号
-  create-connection <connector-id> <name>      创建鉴权账号
+  create-connection <connector-id> <name> [--interactive] 创建鉴权账号；钉钉凭据可在本机隐藏输入
   smart-create --curl "curl命令"               生成脱敏连接器动作草稿（不创建远端资源）
   parse-api [选项]                             解析接口信息
   gen-template [输出路径]                       生成接口文档模板

package/lib/app/app-list.js

@@ -1,7 +1,7 @@
 /**
  * app-list.js - 查询我的应用列表
  *
- * 用法：openyida app-list [--page <页码>] [--size <每页数量>]
+ * 用法：openyida app-list [--type managed|created] [--page <页码>] [--size <每页数量>]
  *
  * 输出字段：
  *   appName    - 应用名称（zh_CN）
@@ -12,61 +12,65 @@
 'use strict';
 
 const { createAuthRef, createYidaClient } = require('../core/yida-client');
-const { throwCommandError } = require('../core/command-errors');
+const { t } = require('../core/i18n');
+const { throwCommandError, throwUsage } = require('../core/command-errors');
 
 const API_PATH = '/query/app/getAppList.json';
+const DEFAULT_PAGE_SIZE = 16;
+const DEFAULT_PAGE_INDEX = 1;
+const DEFAULT_TYPE = 'managed';
+const APP_TYPES = Object.freeze({
+  managed: true,
+  created: false,
+});
 
 /**
  * 拉取单页应用列表
  */
-function fetchAppListPage(auth, pageIndex, pageSize) {
+function fetchAppListPage(auth, pageIndex, pageSize, isAdmin) {
   return createYidaClient({ authRef: auth }).get(API_PATH, (ref) => ({
     _api: 'nattyFetch',
     _mock: 'false',
     pageIndex,
     pageSize,
     creator: ref.userId,
+    isAdmin,
     _stamp: Date.now(),
   }));
 }
 
-/**
- * 拉取全量应用列表（自动翻页）
- */
-async function fetchAllApps(auth, pageSize) {
-  const firstResult = await fetchAppListPage(auth, 1, pageSize);
-
-  // 如果首次请求就提示需要登录，直接返回原始结果让外层自动刷新 token 后重试。
-  if (firstResult.__needLogin) {
-    return firstResult;
+function parsePositiveInteger(value, optionName) {
+  if (!/^\d+$/.test(String(value || '')) || Number(value) < 1) {
+    throwUsage(t('app_list.invalid_positive_integer', optionName, value || ''));
   }
+  return Number(value);
+}
 
-  if (!firstResult.success) {
-    throw new Error(firstResult.errorMsg || '查询应用列表失败');
-  }
-
-  const { data: firstPageData, totalCount } = firstResult.content;
-  const allApps = [...firstPageData];
-
-  const totalPages = Math.ceil(totalCount / pageSize);
-  const remainingFetches = [];
-
-  for (let pageIndex = 2; pageIndex <= totalPages; pageIndex++) {
-    remainingFetches.push(fetchAppListPage(auth, pageIndex, pageSize));
-  }
+function parseArgs(args = []) {
+  const options = {
+    type: DEFAULT_TYPE,
+    pageIndex: DEFAULT_PAGE_INDEX,
+    pageSize: DEFAULT_PAGE_SIZE,
+  };
 
-  const remainingResults = await Promise.all(remainingFetches);
-  for (const result of remainingResults) {
-    // 如果后续翻页也出现登录态问题，同样返回标记对象
-    if (result.__needLogin) {
-      return result;
-    }
-    if (result.success && result.content && result.content.data) {
-      allApps.push(...result.content.data);
+  for (let index = 0; index < args.length; index++) {
+    const arg = args[index];
+    if (arg === '--type') {
+      const type = args[++index];
+      if (!Object.prototype.hasOwnProperty.call(APP_TYPES, type)) {
+        throwUsage(t('app_list.invalid_type', type || '', Object.keys(APP_TYPES).join(', ')));
+      }
+      options.type = type;
+    } else if (arg === '--page') {
+      options.pageIndex = parsePositiveInteger(args[++index], '--page');
+    } else if (arg === '--size') {
+      options.pageSize = parsePositiveInteger(args[++index], '--size');
+    } else {
+      throwUsage(t('app_list.invalid_argument', arg));
     }
   }
 
-  return allApps;
+  return options;
 }
 
 /**
@@ -86,11 +90,13 @@ function hasHelpFlag(args) {
 
 function printUsage() {
   process.stderr.write([
-    'Usage: openyida app-list [--size N]',
+    t('app_list.usage'),
     '',
-    'Options:',
-    '  --size N     Page size used when fetching apps, default: 20',
-    '  --help, -h   Show this help',
+    t('app_list.options'),
+    t('app_list.option_type'),
+    t('app_list.option_page'),
+    t('app_list.option_size'),
+    t('app_list.option_help'),
     '',
   ].join('\n'));
 }
@@ -105,41 +111,60 @@ async function run(args) {
     return;
   }
 
-  const pageSizeIndex = args.indexOf('--size');
-  const pageSize = pageSizeIndex !== -1 && args[pageSizeIndex + 1]
-    ? parseInt(args[pageSizeIndex + 1], 10)
-    : 20;
+  const options = parseArgs(args);
 
   const authRef = createAuthRef();
 
-  let apps;
+  let result;
   try {
-    apps = await fetchAllApps(authRef, pageSize);
+    result = await fetchAppListPage(
+      authRef,
+      options.pageIndex,
+      options.pageSize,
+      APP_TYPES[options.type]
+    );
   } catch (err) {
-    throwCommandError(`查询应用列表失败：${err.message}`);
+    throwCommandError(t('app_list.query_failed', err.message));
   }
 
   // 如果重试后仍然返回登录失效标记，说明登录态确实不可用
-  if (apps && apps.__needLogin) {
-    throwCommandError('登录态已失效，请重新登录', { code: 'CLI_AUTH_REQUIRED' });
+  if (result && result.__needLogin) {
+    throwCommandError(t('app_list.auth_required'), { code: 'CLI_AUTH_REQUIRED' });
   }
 
-  if (!apps || apps.length === 0) {
-    console.log('暂无应用');
-    return;
+  if (!result || !result.success) {
+    throwCommandError(t('app_list.query_failed', (result && result.errorMsg) || t('app_list.unknown_error')));
   }
 
+  const content = result.content || {};
+  const apps = Array.isArray(content.data) ? content.data : [];
+  const totalCount = Number.isFinite(Number(content.totalCount)) ? Number(content.totalCount) : apps.length;
+  const totalPages = Math.max(1, Math.ceil(totalCount / options.pageSize));
+  const scopeLabel = t(`app_list.scope_${options.type}`);
   const formattedApps = apps.map(formatApp);
 
   // stdout 输出 JSON，方便 AI 工具解析
   console.log(JSON.stringify(formattedApps, null, 2));
 
   // stderr 输出人类可读摘要
-  const { c, success: chalkSuccess, listItem } = require('../core/chalk');
-  chalkSuccess(`共找到 ${c.cyan}${formattedApps.length}${c.reset} 个应用`);
+  const { c, success: chalkSuccess, hint, listItem } = require('../core/chalk');
+  chalkSuccess(t(
+    'app_list.found',
+    scopeLabel,
+    options.pageIndex,
+    totalPages,
+    formattedApps.length,
+    totalCount
+  ));
   for (const app of formattedApps) {
     listItem(`${c.bold}${app.appName}${c.reset}  ${c.dim}[${app.appType}]${c.reset}  ${c.cyan}${app.systemLink}${c.reset}`);
   }
+  if (options.pageIndex < totalPages) {
+    hint(t(
+      'app_list.next_page',
+      `openyida app-list --type ${options.type} --page ${options.pageIndex + 1} --size ${options.pageSize}`
+    ));
+  }
 }
 
-module.exports = { run };
+module.exports = { parseArgs, run };

package/lib/app/canvas-compile.js

@@ -24,12 +24,13 @@
  *   3) 第三方依赖以 `window.<别名>` 形式引用（antd→window.antd、react→window.React …），
  *      这些 UMD 依赖由画布运行时依据 importedModules 白名单按需注入。
  *
- * 因此本地编译 = Babel 把 JSX/TS 转成 ES5 → 把 import 改写成 window 别名引用、
- * 把 export default 改写成画布入口 `YidaComp` → 正则抽出依赖包名。
+ * 因此本地编译 = Babel 把 JSX/TS 转成 JS → 把 import 改写成 window 别名引用、
+ * 把 export default 改写成画布入口 `YidaComp` → UglifyJS 压缩 → 正则抽出依赖包名。
  */
 
 const Babel = require('@babel/standalone');
 const globals = require('globals');
+const UglifyJS = require('uglify-js');
 const {
   assertNoEmojiInArtifactName,
   assertNoEmojiInText,
@@ -75,6 +76,7 @@ const MODULE_ALIAS_MAP = {
 
 const MANUAL_DEPENDENCY_GLOBALS = Object.freeze({
   React: 'react',
+  ReactDOM: 'react-dom',
   antd: 'antd',
   icons: '@ant-design/icons',
   ahooks: 'ahooks',
@@ -88,6 +90,12 @@ const MANUAL_DEPENDENCY_GLOBALS = Object.freeze({
   YidaMarkdown: 'yida-plugin-markdown',
 });
 
+const DEPENDENCY_RUNTIME_ALIASES = Object.freeze(Object.assign(
+  {},
+  Object.fromEntries(Object.entries(MODULE_ALIAS_MAP).map(([packageName, alias]) => [alias, packageName])),
+  { LucideReact: 'lucide-react' }
+));
+
 const BARE_DEPENDENCY_GLOBALS = Object.freeze({
   antd: {
     packageName: 'antd',
@@ -209,6 +217,141 @@ function assertNoManualDependencyGlobals(source, options = {}) {
   );
 }
 
+function findSelfReferentialDependencyBindingIssues(source) {
+  const issues = [];
+  const dependencyNames = new Set(Object.keys(MANUAL_DEPENDENCY_GLOBALS));
+
+  const guardPlugin = () => ({
+    name: 'yida-self-referential-dependency-binding-guard',
+    visitor: {
+      VariableDeclarator(path) {
+        if (!path.get('id').isIdentifier() || !path.node.init) {
+          return;
+        }
+        const name = path.node.id.name;
+        if (!dependencyNames.has(name)) {
+          return;
+        }
+        const binding = path.scope.getBinding(name);
+        let selfReference = null;
+        const initPath = path.get('init');
+        if (
+          initPath.isIdentifier({ name })
+          && initPath.scope.getBinding(name) === binding
+        ) {
+          selfReference = initPath.node;
+        }
+        initPath.traverse({
+          ReferencedIdentifier(referencePath) {
+            if (
+              !selfReference
+              && referencePath.node.name === name
+              && referencePath.scope.getBinding(name) === binding
+            ) {
+              selfReference = referencePath.node;
+            }
+          },
+        });
+        if (selfReference) {
+          issues.push({
+            name,
+            packageName: MANUAL_DEPENDENCY_GLOBALS[name],
+            line: selfReference.loc && selfReference.loc.start ? selfReference.loc.start.line : 0,
+            column: selfReference.loc && selfReference.loc.start ? selfReference.loc.start.column : 0,
+          });
+        }
+      },
+    },
+  });
+
+  Babel.transform(source, {
+    filename: 'canvas.tsx',
+    presets: [
+      ['typescript', { allExtensions: true, isTSX: true, allowDeclareFields: true }],
+      ['react', { runtime: 'classic' }],
+    ],
+    plugins: [guardPlugin],
+    sourceType: 'module',
+    compact: false,
+    babelrc: false,
+    configFile: false,
+  });
+  return issues;
+}
+
+function assertNoSelfReferentialDependencyBindings(source, options = {}) {
+  const issues = findSelfReferentialDependencyBindingIssues(source);
+  if (issues.length === 0) {
+    return;
+  }
+  const firstIssue = issues[0];
+  throw new CliError(
+    `Code Canvas 依赖绑定 ${firstIssue.name} 不能引用自身。请从 "${firstIssue.packageName}" 使用标准 import 引入。`,
+    {
+      code: 'OPENYIDA_CANVAS_SELF_REFERENTIAL_DEPENDENCY_BINDING',
+      details: {
+        stage: 'canvas_compile',
+        sourcePath: options.sourcePath || '',
+        line: firstIssue.line,
+        column: firstIssue.column,
+        globalName: firstIssue.name,
+        packageName: firstIssue.packageName,
+      },
+    }
+  );
+}
+
+function findDependencyManifestIssues(runtimeCode, importedModules) {
+  const importedBaseNames = new Set((importedModules || []).map(packageBaseName));
+  const observedAliases = new Set();
+  const guardPlugin = ({ types: types }) => ({
+    name: 'yida-runtime-dependency-manifest-guard',
+    visitor: {
+      MemberExpression(path) {
+        const node = path.node;
+        if (!types.isIdentifier(node.object, { name: 'window' })) {
+          return;
+        }
+        const alias = node.computed && types.isStringLiteral(node.property)
+          ? node.property.value
+          : (!node.computed && types.isIdentifier(node.property) ? node.property.name : '');
+        if (DEPENDENCY_RUNTIME_ALIASES[alias]) {
+          observedAliases.add(alias);
+        }
+      },
+    },
+  });
+  Babel.transform(runtimeCode, {
+    filename: 'canvas-runtime.js',
+    plugins: [guardPlugin],
+    sourceType: 'script',
+    compact: false,
+    babelrc: false,
+    configFile: false,
+  });
+  return Array.from(observedAliases)
+    .filter(alias => !importedBaseNames.has(packageBaseName(DEPENDENCY_RUNTIME_ALIASES[alias])))
+    .map(alias => ({ alias, packageName: DEPENDENCY_RUNTIME_ALIASES[alias] }));
+}
+
+function assertDependencyManifestConsistent(runtimeCode, importedModules, options = {}) {
+  const issues = findDependencyManifestIssues(runtimeCode, importedModules);
+  if (issues.length === 0) {
+    return;
+  }
+  throw new CliError(
+    `Code Canvas 运行时代码依赖 ${issues[0].alias}，但 importedModules 缺少 "${issues[0].packageName}"。`,
+    {
+      code: 'OPENYIDA_CANVAS_DEPENDENCY_MANIFEST_MISMATCH',
+      details: {
+        stage: 'canvas_compile',
+        sourcePath: options.sourcePath || '',
+        issues,
+      },
+    }
+  );
+}
+
 function findBareDependencyGlobalIssues(source) {
   const issues = [];
   const names = new Set(Object.keys(BARE_DEPENDENCY_GLOBALS));
@@ -735,6 +878,36 @@ function assertCanvasRuntimeParseable(runtimeCode, options = {}) {
   }
 }
 
+/**
+ * 压缩画布运行态代码，并显式保留装配器读取的 YidaComp 入口名。
+ */
+function minifyCanvasRuntime(runtimeCode, options = {}) {
+  let result;
+  try {
+    result = UglifyJS.minify(runtimeCode, {
+      compress: true,
+      mangle: {
+        reserved: ['YidaComp'],
+      },
+    });
+  } catch (error) {
+    result = { error };
+  }
+  if (!result || result.error || typeof result.code !== 'string' || !result.code) {
+    const detail = result && result.error && result.error.message
+      ? result.error.message
+      : '压缩结果为空';
+    throw new CliError(`Code Canvas runtimeCode 压缩失败: ${detail}`, {
+      code: 'OPENYIDA_CANVAS_MINIFY_FAILED',
+      details: {
+        stage: 'canvas_minify',
+        sourcePath: options.sourcePath || '',
+      },
+    });
+  }
+  return result.code;
+}
+
 /**
  * 本地编译 Code Canvas 源码。
  * @param {string} source 原始 React/JSX/TSX 源码
@@ -790,6 +963,7 @@ function compileCanvasLocal(source, options = {}) {
     });
   }
   assertNoUnavailableCanvasInstanceApis(source, options);
+  assertNoSelfReferentialDependencyBindings(source, options);
   assertNoBareDependencyGlobals(source, options);
   assertNoManualDependencyGlobals(source, options);
   assertInlineCssStructure(source, options);
@@ -841,12 +1015,14 @@ function compileCanvasLocal(source, options = {}) {
     configFile: false,
   });
 
-  const runtimeCode = stage2.code || '';
-  assertNoEmojiInText(runtimeCode, {
+  const unminifiedRuntimeCode = stage2.code || '';
+  assertNoEmojiInText(unminifiedRuntimeCode, {
     artifact: options.sourcePath ? options.sourcePath + ' runtime' : 'Code Canvas runtime',
     code: 'OPENYIDA_CANVAS_SOURCE_EMOJI_FORBIDDEN',
   });
+  const runtimeCode = minifyCanvasRuntime(unminifiedRuntimeCode, options);
   assertCanvasRuntimeParseable(runtimeCode, options);
+  assertDependencyManifestConsistent(runtimeCode, importedModules, options);
   return {
     runtimeCode,
     importedModules: JSON.stringify(importedModules),
@@ -912,6 +1088,10 @@ module.exports = {
   resolveWindowAlias,
   shouldAllowUnsupportedBareImports,
   assertCanvasRuntimeParseable,
+  minifyCanvasRuntime,
   findBareDependencyGlobalIssues,
+  findSelfReferentialDependencyBindingIssues,
+  findDependencyManifestIssues,
+  assertDependencyManifestConsistent,
   MODULE_ALIAS_MAP,
 };

package/lib/app/display-page-readback.js

@@ -23,10 +23,30 @@ function fingerprint(value) {
   return crypto.createHash('sha256').update(normalized).digest('hex');
 }
 
+function rawFingerprint(value) {
+  if (typeof value !== 'string' || !value) {
+    return '';
+  }
+  return crypto.createHash('sha256').update(value, 'utf8').digest('hex');
+}
+
+function positiveSize(value) {
+  const size = Number(value);
+  return Number.isFinite(size) && size > 0 ? size : 0;
+}
+
+function sha256(value) {
+  const digest = String(value || '').toLowerCase();
+  return /^[a-f0-9]{64}$/.test(digest) ? digest : '';
+}
+
 function createEmptyDisplayInfo() {
   return {
     hasYidaCodeCanvas: false,
+    hasCodeBundle: false,
     hasNativeJsx: false,
+    codeBundleCount: 0,
+    bundleIds: [],
     runtimeCodeBytes: 0,
     sourceCodeBytes: 0,
     compiledCodeBytes: 0,
@@ -34,6 +54,8 @@ function createEmptyDisplayInfo() {
     componentCount: 0,
     canvasRuntimeCode: '',
     canvasSourceCode: '',
+    canvasRuntimeSha256: '',
+    canvasSourceSha256: '',
     nativeCompiledCode: '',
     nativeSourceCode: '',
   };
@@ -79,12 +101,37 @@ function traverseDisplayNodes(node, info) {
 
   if (node.componentName === 'YidaCodeCanvas') {
     const props = node.props || {};
+    const codeBundle = props.codeBundle && typeof props.codeBundle === 'object'
+      ? props.codeBundle
+      : null;
     info.hasYidaCodeCanvas = true;
     info.componentCount++;
-    info.canvasRuntimeCode = props.runtimeCode || '';
-    info.canvasSourceCode = props.code || '';
+    if (typeof props.runtimeCode === 'string' && props.runtimeCode) {
+      info.canvasRuntimeCode = props.runtimeCode;
+    }
+    if (typeof props.code === 'string' && props.code) {
+      info.canvasSourceCode = props.code;
+    }
     info.runtimeCodeBytes += codeBytes(props.runtimeCode);
     info.sourceCodeBytes += codeBytes(props.code);
+    if (codeBundle) {
+      const bundleId = String(codeBundle.bundleId || '');
+      const runtime = codeBundle.runtime && typeof codeBundle.runtime === 'object'
+        ? codeBundle.runtime
+        : {};
+      const source = codeBundle.source && typeof codeBundle.source === 'object'
+        ? codeBundle.source
+        : {};
+      info.hasCodeBundle = true;
+      info.codeBundleCount++;
+      if (bundleId && !info.bundleIds.includes(bundleId)) {
+        info.bundleIds.push(bundleId);
+      }
+      info.runtimeCodeBytes += positiveSize(runtime.size);
+      info.sourceCodeBytes += positiveSize(source.size);
+      info.canvasRuntimeSha256 = sha256(runtime.sha256) || info.canvasRuntimeSha256;
+      info.canvasSourceSha256 = sha256(source.sha256) || info.canvasSourceSha256;
+    }
     addImportedModules(info.importedModules, props.importedModules);
   } else if (node.componentName === 'Jsx') {
     info.hasNativeJsx = true;
@@ -133,7 +180,9 @@ function hasExpectedDisplayComponent(info, publishMode) {
     return false;
   }
   if (publishMode === 'canvas') {
-    return info.hasYidaCodeCanvas && info.runtimeCodeBytes > 0;
+    return info.hasYidaCodeCanvas && (
+      info.runtimeCodeBytes > 0 || !!info.canvasRuntimeSha256
+    );
   }
   return info.hasNativeJsx && info.compiledCodeBytes > 0;
 }
@@ -144,7 +193,10 @@ function summarizeDisplayPublishInfo(info) {
   }
   return {
     hasYidaCodeCanvas: info.hasYidaCodeCanvas,
+    hasCodeBundle: info.hasCodeBundle,
     hasNativeJsx: info.hasNativeJsx,
+    codeBundleCount: info.codeBundleCount,
+    bundleIds: info.bundleIds.slice(),
     runtimeCodeBytes: info.runtimeCodeBytes,
     sourceCodeBytes: info.sourceCodeBytes,
     compiledCodeBytes: info.compiledCodeBytes,
@@ -159,8 +211,13 @@ function verifyPublishedContentMatch(readbackSchema, expectedSchemaContent, publ
   const displayComponentPresent = hasExpectedDisplayComponent(readbackInfo, publishMode);
   const readbackArtifact = getPublishArtifact(readbackInfo, publishMode);
   const expectedArtifact = getPublishArtifact(expectedInfo, publishMode);
-  const readbackFingerprint = fingerprint(readbackArtifact);
-  const expectedFingerprint = fingerprint(expectedArtifact);
+  const codeBundleReadback = publishMode === 'canvas' && readbackInfo && readbackInfo.hasCodeBundle;
+  const readbackFingerprint = codeBundleReadback
+    ? readbackInfo.canvasRuntimeSha256
+    : fingerprint(readbackArtifact);
+  const expectedFingerprint = codeBundleReadback
+    ? rawFingerprint(expectedArtifact)
+    : fingerprint(expectedArtifact);
 
   return {
     readbackInfo,
@@ -180,6 +237,7 @@ function verifyPublishedContentMatch(readbackSchema, expectedSchemaContent, publ
 module.exports = {
   extractDisplayPublishInfo,
   fingerprint,
+  rawFingerprint,
   hasExpectedDisplayComponent,
   parseSchemaContent,
   summarizeDisplayPublishInfo,