openyida 2026.10.21 → 2026.10.22-beta.0

package/lib/feedback/report.js

@@ -13,6 +13,15 @@ const MAX_INPUT_BYTES = 1024 * 1024;
 const REPOSITORY = 'openyida/openyida';
 const TEXT_FIELDS = ['title', 'summary', 'command', 'expected', 'actual', 'impact', 'tool', 'model'];
 const LIST_FIELDS = ['steps', 'evidence', 'attempts'];
+const INCIDENT_FIELDS = ['openyida', 'node', 'platform', 'arch', 'installation', 'browser', 'deployment', 'organizationContext'];
+
+function incidentEnvironment(value) {
+  if (value === undefined) {value = {};}
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {throw invalid('object');}
+  // Only explicit incident facts belong here. The reporting process may run
+  // after an upgrade or on another machine; never infer incident versions.
+  return Object.fromEntries(INCIDENT_FIELDS.map(key => [key, sanitizeText(value[key])]));
+}
 
 function comparisonRun(value) {
   if (value === undefined) {return { status: 'not_run', evidence: [] };}
@@ -98,6 +107,8 @@ function buildReport(input) {
     throw invalid('confirmed');
   }
   report.screenshots = [];
+  report.incidentEnvironment = incidentEnvironment(input.incidentEnvironment);
+  // Retain this output contract for existing consumers: generator context only.
   report.environment = {
     openyida: require('../../package.json').version,
     node: process.version,
@@ -114,17 +125,28 @@ function buildReport(input) {
 
 // Escape markup so copied diagnostics cannot inject images, links or HTML in an issue.
 function markdownText(value) {
-  return String(value || 'Unknown / not verified').replace(/[\\`*_{}[\]<>()#!|~]/g, '\\$&');
+  return String(value || t('feedback_report.body.unknown')).replace(/[\\`*_{}[\]<>()#!|~]/g, '\\$&');
 }
 
 function renderMarkdown(report) {
+  const label = key => t('feedback_report.body.' + key);
+  const incident = report.incidentEnvironment || {};
+  const environmentLines = Object.entries({
+    openyida: incident.openyida, node: incident.node, platform: incident.platform, arch: incident.arch,
+    installation: incident.installation, tool: report.tool, model: report.model,
+    ...Object.fromEntries(['browser', 'deployment', 'organizationContext']
+      .filter(key => incident[key]).map(key => [key, incident[key]])),
+  }).map(([key, value]) => `${key}: ${value || label('unknown')}`);
   const sections = [
-    ['Summary', report.summary], ['Command scenario', report.command],
-    ['Steps to reproduce', report.steps], ['Expected', report.expected], ['Actual', report.actual],
-    ['Impact', report.impact], ['Evidence (observed)', report.evidence], ['Attempts and results', report.attempts],
-    ['Root cause assessment', `${report.cause.category} / ${report.cause.status}\n${report.cause.summary || 'Not established'}`],
-    ['Evidence for assessment', report.cause.evidence], ['Next verification', report.cause.nextSteps],
-    ['Reproduction screenshots', report.screenshots.map(item => `${item.file}: ${item.description || 'Review image before sharing'}`)],
+    [label('summary'), report.summary || label('unknown')],
+    [label('actual'), report.actual], [label('expected'), report.expected || label('unknown')],
+    [label('incident'), environmentLines],
+    [label('command'), report.command], [label('steps'), report.steps],
+    [label('impact'), report.impact], [label('evidence'), report.evidence], [label('attempts'), report.attempts],
+    ...(report.cause.summary || report.cause.status !== 'unknown' || report.cause.category !== 'unknown'
+      ? [[label('cause'), `${report.cause.category} / ${report.cause.status}\n${report.cause.summary}`]] : []),
+    [label('cause_evidence'), report.cause.evidence], [label('next'), report.cause.nextSteps],
+    [label('screenshots'), report.screenshots.map(item => `${item.file}: ${item.description || label('review_image')}`)],
     ...(['before', 'after', 'regression'].some(key => report.comparison[key].status !== 'not_run') || report.comparison.limitations.length ? ['before', 'after', 'regression'] : []).map(key => [
       `Test comparison: ${key}`, [
         `Status: ${report.comparison[key].status}`,
@@ -134,19 +156,17 @@ function renderMarkdown(report) {
         ...(report.comparison[key].evidence || []),
       ],
     ]),
-    ...(report.comparison.limitations.length ? [['Test limitations', report.comparison.limitations]] : []),
-  ];
+    ...(report.comparison.limitations.length ? [[label('limitations'), report.comparison.limitations]] : []),
+    [label('generator'), Object.entries(report.environment).map(([key, value]) => `${key}: ${value}`)],
+  ].filter(([, value]) => Array.isArray(value) ? value.length : Boolean(value));
   return [
     `# ${markdownText(report.title)}`, '',
-    'Local draft — not submitted. Review business data and private repository information before sharing.', '',
-    `Fingerprint: ${report.fingerprint}`, `Observed occurrences: ${report.occurrenceCount || 'Unknown'}`, '',
-    '## Environment', '',
-    ...Object.entries({ ...report.environment, tool: report.tool, model: report.model })
-      .map(([key, value]) => `- ${key}: ${markdownText(value)}`), '',
+    label('draft'), '',
     ...sections.flatMap(([heading, value]) => [
       `## ${heading}`, '',
-      Array.isArray(value) ? (value.length ? value.map(item => `- ${markdownText(item)}`).join('\n') : 'Unknown / not verified') : markdownText(value), '',
+      Array.isArray(value) ? value.map(item => `- ${markdownText(item)}`).join('\n') : markdownText(value), '',
     ]),
+    `Fingerprint: ${report.fingerprint}`, `Observed occurrences: ${report.occurrenceCount || label('unknown')}`, '',
   ].join('\n');
 }
 

package/lib/integration/integration-triggers.js

@@ -18,11 +18,16 @@ function scheduleNodes(schedule, id, nextId) {
   if (!/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:00$/.test(startDate || '')
     || !Number.isFinite(Date.parse(startDate.replace(' ', 'T') + '+08:00'))
     || !['ONCE', 'DAILY', 'WORKDAY', 'WEEKLY', 'BI_WEEKLY', 'MONTHLY', 'LAST_DAY_PER_MONTH'].includes(repeat)
-    || maxCount !== undefined && (!Number.isInteger(maxCount) || maxCount < 1)
+    || maxCount !== undefined && (!Number.isInteger(maxCount) || maxCount < 1 || maxCount > 100)
     || expireDate !== undefined && (!Number.isFinite(expireDate)
       || expireDate <= Date.parse(startDate.replace(' ', 'T') + '+08:00'))
     || maxCount !== undefined && expireDate !== undefined
     || repeat === 'ONCE' && (maxCount !== undefined || expireDate !== undefined)) { invalid('schedule values'); }
+  if (repeat !== 'ONCE' && maxCount === undefined && expireDate === undefined) {
+    throw new CliError(t('integration_triggers.end_required'), {
+      code: 'INTEGRATION_TRIGGER_INVALID', details: { reason: 'schedule end condition', remoteWrites: 0 },
+    });
+  }
   const startTimestamp = Date.parse(startDate.replace(' ', 'T') + '+08:00');
   if (new Date(startTimestamp + 8 * 3600000).toISOString().slice(0, 19).replace('T', ' ') !== startDate) {
     invalid('invalid calendar date');
@@ -37,8 +42,8 @@ function scheduleNodes(schedule, id, nextId) {
     viewNode: { componentName: 'StartNode', id, props: { nodeName: 'StartNode', name, nodeError: '',
       start: { type: 'trigger', triggerType: 'TimerEvent', startDate: startTimestamp, repeatRuleType: repeat,
         startTrigger: { startTriggerTime: 'specifiedTime' },
-        overTimeType: maxCount !== undefined ? 'count' : expireDate !== undefined ? 'time' : 'never',
-        ...(maxCount !== undefined ? { overCount: maxCount } : {}),
+        overTimeType: expireDate !== undefined ? 'time' : 'count',
+        ...(expireDate === undefined ? { overCount: maxCount ?? 1 } : {}),
         ...(expireDate !== undefined ? { overTime: expireDate } : {}), rules: true } } },
     formEventTypes: [],
   };

package/lib/process/configure-process.js

@@ -19,6 +19,7 @@ const {
 } = require('./services/process-compiler');
 const { verifyPlatformView } = require('./services/process-view-verifier');
 const { inspectProcessFields, assertPermissionFields } = require('./services/process-form-fields');
+const { collectFormMemberIds, assertFormMemberFields } = require('./services/process-dynamic-actors');
 const { completeSubtablePermissions } = require('./services/process-field-permissions');
 const {
   getProcessById,
@@ -365,6 +366,7 @@ async function run(args, options) {
       'build_definition',
       error,
       {
+        ...(error.code === 'PROCESS_DYNAMIC_ACTOR_INVALID' ? error.details : {}),
         retryable: false,
         nextAction: 'fix_definition_file',
         diagnostics: [summarizeRemoteResult(error)],
@@ -417,13 +419,17 @@ async function run(args, options) {
   }
   stageTracker.complete('preflight_form_mode');
 
-  if (Object.keys(compiled.processJson.flowConfig).length) {
+  const memberFieldIds = collectFormMemberIds(compiled.viewJson);
+  if (Object.keys(compiled.processJson.flowConfig).length || memberFieldIds.length) {
     try {
       const fieldInspection = await inspectProcessFields(authRef, { appType, formUuid, processCode }, { binding: initialMode });
       assertPermissionFields(compiled.processJson.flowConfig, fieldInspection.fields);
+      assertFormMemberFields(memberFieldIds, fieldInspection.fields);
       completeSubtablePermissions(compiled, fieldInspection.fields);
     } catch (error) {
-      failure(error.code || 'PROCESS_FORM_FIELDS_READ_FAILED', error.message, 'preflight_form_fields', error, { remoteWrites: 0 });
+      failure(error.code || 'PROCESS_FORM_FIELDS_READ_FAILED', error.message, 'preflight_form_fields', error, {
+        ...(error.code === 'PROCESS_DYNAMIC_ACTOR_INVALID' ? error.details : {}), remoteWrites: 0,
+      });
     }
   }
 

package/lib/process/process-tasks.js

@@ -0,0 +1,175 @@
+'use strict';
+
+const { CliError } = require('../core/cli-error');
+const { t } = require('../core/i18n');
+
+function fail(code, key, details = {}) {
+  throw new CliError(t(`process_tasks.${key}`), {
+    code,
+    details: { retryable: false, retrySafe: true, sideEffectState: 'none', ...details },
+  });
+}
+
+function taskId(value) {
+  if (typeof value === 'number' && (!Number.isSafeInteger(value) || value <= 0)) {return null;}
+  const id = typeof value === 'number' ? String(value) : value;
+  return typeof id === 'string' && /^[1-9][0-9]*$/.test(id) ? id : null;
+}
+
+function validateArguments(positionals, options, transfer = false) {
+  const required = ['process_inst_id', ...(transfer
+    ? ['to_user_id', 'form_uuid', 'expect_form_name', 'expect_form_type'] : [])];
+  const allowed = [...required, 'json', ...(transfer ? ['task_id', 'remark'] : [])];
+  if (positionals.length !== 1 || !/^APP_[A-Za-z0-9_-]+$/.test(positionals[0])) {
+    fail('DATA_INVALID_ARGUMENTS', 'arguments_invalid');
+  }
+  if (Object.keys(options).some(key => !allowed.includes(key))
+    || required.some(key => typeof options[key] !== 'string' || !options[key].trim())
+    || (options.remark !== undefined && (typeof options.remark !== 'string' || !options.remark.trim()))
+    || !/^[A-Za-z0-9_-]+$/.test(options.process_inst_id)
+    || (transfer && !/^FORM[-_][A-Za-z0-9_-]+$/.test(options.form_uuid))
+    || ['process_inst_id', 'form_uuid', 'to_user_id'].some(key =>
+      typeof options[key] === 'string' && /\s/.test(options[key]))
+    || (options.task_id !== undefined && !taskId(options.task_id))) {
+    fail('DATA_INVALID_ARGUMENTS', 'arguments_invalid');
+  }
+}
+
+function successful(response) {
+  return response && response.success === true && !response.__needLogin && !response.__csrfExpired
+    && [undefined, null, '', 0, '0'].includes(response.errorCode);
+}
+
+async function queryProcessTasks(client, appType, processInstanceId) {
+  const response = await client.get(
+    `/dingtalk/web/${appType}/query/formProcInstData/getInstTaskDatas.json`,
+    {
+      _api: 'DataManage.getInstTasks', _mock: 'false', _stamp: String(Date.now()),
+      _locale_time_zone_offset: '28800000', procInstId: processInstanceId,
+    }
+  );
+  if (!successful(response)) {
+    fail('DATA_PROCESS_TASK_QUERY_FAILED', 'query_failed', {
+      causeCode: response && response.errorCode,
+    });
+  }
+  if (!Array.isArray(response.content)) {
+    fail('DATA_PROCESS_TASK_RESPONSE_INVALID', 'response_invalid');
+  }
+  const ids = new Set();
+  const tasks = response.content.map(task => {
+    const id = task && taskId(task.id);
+    if (!id || task.processInstanceId !== processInstanceId || ids.has(id)
+      || typeof task.status !== 'string' || !task.status) {
+      fail('DATA_PROCESS_TASK_RESPONSE_INVALID', 'response_invalid');
+    }
+    ids.add(id);
+    return { ...task, taskId: id };
+  });
+  return { ...response, content: tasks };
+}
+
+function selectTask(tasks, requestedId) {
+  const running = tasks.filter(task => task.status === 'RUNNING');
+  if (requestedId !== undefined) {
+    const selected = running.find(task => task.taskId === requestedId);
+    if (!selected) {fail('DATA_PROCESS_TASK_NOT_RUNNING', 'not_running', { taskId: requestedId });}
+    return selected;
+  }
+  if (!running.length) {fail('DATA_PROCESS_TASK_NOT_RUNNING', 'not_running');}
+  if (running.length !== 1) {
+    fail('DATA_PROCESS_TASK_AMBIGUOUS', 'ambiguous', {
+      tasks: running.map(task => ({ taskId: task.taskId, groupName: task.groupName,
+        activityCode: task.activityCode, actualActionerId: task.actualActionerId })),
+    });
+  }
+  return running[0];
+}
+
+function verifiedTask(before, selected, after, toUserId) {
+  const original = after.find(task => task.taskId === selected.taskId);
+  if (original && original.status === 'RUNNING') {
+    return original.actualActionerId === toUserId ? original : null;
+  }
+  // A recipient's existing parallel task is not evidence of this transfer.
+  // Require the old task to close and a uniquely new task in the same node/group.
+  if (!selected.activityCode || !taskId(selected.taskGroupId)) {return null;}
+  const previousIds = new Set(before.map(task => task.taskId));
+  const candidates = after.filter(task => task.status === 'RUNNING'
+    && !previousIds.has(task.taskId)
+    && task.activityCode === selected.activityCode
+    && String(task.taskGroupId) === String(selected.taskGroupId));
+  return candidates.length === 1 && candidates[0].actualActionerId === toUserId ? candidates[0] : null;
+}
+
+async function transferTask(client, input) {
+  const { appType, formUuid, processInstanceId, toUserId, remark = '转交' } = input;
+  const before = (await queryProcessTasks(client, appType, processInstanceId)).content;
+  const selected = selectTask(before, input.taskId);
+  if (typeof selected.actualActionerId !== 'string' || !selected.actualActionerId.trim()) {
+    fail('DATA_PROCESS_TASK_RESPONSE_INVALID', 'response_invalid');
+  }
+  const target = { appType, formUuid, processInstanceId, taskId: selected.taskId, toUserId };
+  const nextStep = `openyida data query process-tasks ${appType} --process-inst-id ${processInstanceId} --json`;
+  const result = {
+    ...target, target, previousActionerId: selected.actualActionerId,
+    mutationPerformed: false, mutationAccepted: false, readbackVerified: false,
+  };
+  if (selected.actualActionerId === toUserId) {
+    return { ...result, success: true, status: 'ALREADY_ASSIGNED', alreadyAssigned: true,
+      transferred: false, readbackVerified: true, sideEffectState: 'none' };
+  }
+  let response;
+  try {
+    const query = new URLSearchParams({
+      _api: 'DataManage.redirectTask', _mock: 'false', _stamp: String(Date.now()),
+    });
+    response = await client.postFormOnce(
+      `/dingtalk/web/${appType}/query/instance/redirectTask.json?${query}`,
+      { _locale_time_zone_offset: '28800000', taskId: selected.taskId,
+        procInstId: processInstanceId, nowActionerId: toUserId, remark, byManager: 'true' },
+      { referer: `${client.getAuthRef().baseUrl}/${appType}/admin/${formUuid}/dataManage` }
+    );
+  } catch (error) {
+    fail('DATA_PROCESS_TRANSFER_RESULT_UNKNOWN', 'result_unknown', {
+      ...result, mutationPerformed: true, status: 'RESULT_UNKNOWN', mutationAccepted: null,
+      retrySafe: false, sideEffectState: 'unknown', readbackAllowed: true, nextStep,
+      causeCode: error.code || 'TRANSFER_TRANSPORT_FAILED',
+    });
+  }
+  if (!successful(response)) {
+    const rejected = response && response.success === false && !response.__needLogin
+      && !response.__csrfExpired && !response.__nonJsonResponse;
+    fail(rejected ? 'DATA_PROCESS_TRANSFER_REJECTED' : 'DATA_PROCESS_TRANSFER_RESULT_UNKNOWN',
+      rejected ? 'rejected' : 'result_unknown', {
+        ...result, mutationPerformed: true, mutationAccepted: rejected ? false : null,
+        status: rejected ? 'REJECTED' : 'RESULT_UNKNOWN', retrySafe: false,
+        sideEffectState: rejected ? 'none' : 'unknown', readbackAllowed: true, nextStep,
+        causeCode: response && response.errorCode,
+      });
+  }
+  let verified;
+  try {
+    const after = (await queryProcessTasks(client, appType, processInstanceId)).content;
+    verified = verifiedTask(before, selected, after, toUserId);
+  } catch (error) {
+    fail('DATA_PROCESS_TRANSFER_UNVERIFIED', 'unverified', {
+      ...result, mutationPerformed: true, mutationAccepted: true, status: 'UNVERIFIED',
+      retrySafe: false, sideEffectState: 'unknown', readbackAllowed: true, nextStep,
+      causeCode: error.code || 'TRANSFER_READBACK_FAILED',
+    });
+  }
+  if (!verified) {
+    fail('DATA_PROCESS_TRANSFER_UNVERIFIED', 'unverified', {
+      ...result, mutationPerformed: true, mutationAccepted: true, status: 'UNVERIFIED',
+      retrySafe: false, sideEffectState: 'unknown', readbackAllowed: true, nextStep,
+      causeCode: 'TRANSFER_READBACK_MISMATCH',
+    });
+  }
+  return { ...result, success: true, transferred: true, status: 'TRANSFERRED',
+    mutationPerformed: true, mutationAccepted: true, readbackVerified: true,
+    currentTaskId: verified.taskId, actualActionerId: verified.actualActionerId,
+    retryable: false, sideEffectState: 'committed' };
+}
+
+module.exports = { validateArguments, queryProcessTasks, transferTask };

package/lib/process/services/process-actor-config.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { verifyDynamicActors } = require('./process-dynamic-actors');
+
 // The native MultiApproval setter stores flat UI rules, while runtime rules
 // are grouped by status. Keep the two representations separate.
 function buildMultiApproverRules(config, legacyRules) {
@@ -26,6 +28,7 @@ function verifyActorRoles(expectedNodes, actualNodes, errors) {
   }
   (expectedNodes || []).forEach((node, index) => {
     const actual = (actualNodes || [])[index];
+    verifyDynamicActors(node, actual, errors);
     const expectedConditional = node.props?.approverRules;
     if (expectedConditional?.mode === 'ApprovalNode_rules_multiple'
       && JSON.stringify(expectedConditional) !== JSON.stringify(actual?.props?.approverRules)) {

package/lib/process/services/process-compiler.js

@@ -11,6 +11,7 @@ const { t } = require('../../core/i18n');
 const { buildNodeActions } = require('./process-actions');
 const { buildFlowConfig, normalizeBehaviorList } = require('./process-field-permissions');
 const { buildMultiApproverRules } = require('./process-actor-config');
+const { buildDynamicActor, validateNativeActor, assertNativeActorTypes } = require('./process-dynamic-actors');
 
 const KEY_PATTERN = /^[A-Za-z][A-Za-z0-9_]*$/;
 
@@ -369,6 +370,8 @@ function getFriendlyApproverKind(approver) {
   }
   const normalized = rawKind.toLowerCase().replace(/[-_\s]/g, '');
   const kindMap = {
+    formfield: 'formField',
+    selfselect: 'selfSelect',
     originator: 'originator',
     self: 'originator',
     starter: 'originator',
@@ -638,6 +641,11 @@ function buildFriendlyApproverConfig(node, approver) {
     return null;
   }
   const raw = isPlainObject(approver) ? approver : {};
+  if (kind === 'formField' || kind === 'selfSelect') {
+    return buildDynamicActor(node, raw, kind, normalizeNodeType(node), {
+      createBaseApproverRules, normalizeApprovalMode, normalizeUserApprovers, normalizeRoleApprovers,
+    });
+  }
   if (kind === 'originator') {
     return buildOriginatorApproverConfig(node, raw);
   }
@@ -1066,8 +1074,12 @@ function buildApproverConfig(node) {
     return friendlyApprover;
   }
 
+  if (typeof approverInput === 'string') {
+    validateNativeActor({ kind: approverInput }, nodeType);
+  }
   const rawApprover = node.approverConfig || (approverInput && typeof approverInput === 'object' ? approverInput : null);
   if (rawApprover) {
+    validateNativeActor(rawApprover, nodeType, node._nodeId);
     return {
       approvalType: rawApprover.approvalType || rawApprover.type || 'ext_target_approval_originator',
       approvals: rawApprover.approvals || [['originator']],
@@ -1086,6 +1098,7 @@ function buildApproverConfig(node) {
   }
 
   if (node.approvalType || node.approvals || node.approverRules || node.processProps) {
+    validateNativeActor({ ...node, type: node.approvalType }, nodeType, node._nodeId);
     return {
       approvalType: node.approvalType || 'ext_target_approval_originator',
       approvals: node.approvals || [['originator']],
@@ -2053,6 +2066,8 @@ function buildProcessAndViewJson(definition, processCode, formUuid, baseUrl, app
     },
   };
 
+  assertNativeActorTypes(processJson.nodes);
+  assertNativeActorTypes(viewJson.schema.children);
   processJson.flowConfig = buildFlowConfig(viewJson);
   const result = {
     processJson,

package/lib/process/services/process-dynamic-actors.js

@@ -0,0 +1,165 @@
+'use strict';
+
+const { CliError } = require('../../core/cli-error');
+const { t } = require('../../core/i18n');
+
+const FORM_MEMBER = 'ext_target_approval_variable';
+const SELF_SELECT = 'ext_target_optional_approval';
+// Native designer ApproverType, plus the existing conditional-actors adapter.
+const NATIVE_TYPES = new Set(['ext_target_noset', 'ext_target_approval', 'ext_target_approval_role',
+  'ext_target_approval_originator', 'ext_target_approval_liaison', 'ext_target_dept_leader',
+  'ext_target_direct_leader', 'ext_target_multi_management', SELF_SELECT, FORM_MEMBER,
+  'ext_target_approval_invoke', 'ext_target_approval_connector', 'ext_target_approval_matrix',
+  'ext_target_approval_condition']);
+
+function invalid(reason, details = {}) {
+  throw new CliError(t('process_dynamic_actors.invalid'), {
+    code: 'PROCESS_DYNAMIC_ACTOR_INVALID', details: { reason, ...details, remoteWrites: 0 },
+  });
+}
+
+function buildDynamicActor(node, input, kind, nodeType, helpers) {
+  const allowed = ['kind', 'type', 'approverType', 'approvalMode', 'multiApproverType', 'description'];
+  allowed.push(...(kind === 'formField' ? ['fieldId', 'fieldIds'] : ['range']));
+  if (Object.keys(input).some(key => !allowed.includes(key))) { invalid('unsupported property'); }
+  if (input.kind && input.type && input.kind !== input.type) { invalid('conflicting kind/type'); }
+  const mode = helpers.normalizeApprovalMode(input.approvalMode || input.multiApproverType || 'all');
+  if (!['all', 'or', 'oneByOne'].includes(mode)) { invalid('approvalMode'); }
+  const approvalType = kind === 'formField' ? FORM_MEMBER : SELF_SELECT;
+  const description = input.description || kind;
+  const approverRules = helpers.createBaseApproverRules(approvalType, description, {});
+  approverRules.multiApproverType = mode;
+  approverRules['approvalType_' + approvalType] = mode;
+  if (kind === 'formField') {
+    if (input.fieldId !== undefined && input.fieldIds !== undefined) { invalid('use fieldId or fieldIds'); }
+    const ids = input.fieldId === undefined ? input.fieldIds : [input.fieldId];
+    if (!Array.isArray(ids) || !ids.length || ids.some(id => typeof id !== 'string' || !id.trim() || id !== id.trim())
+      || new Set(ids).size !== ids.length) { invalid('fieldId/fieldIds'); }
+    approverRules.formMember = ids.map(value => ({ value, label: value }));
+    return { approvalType, approvals: [ids], approverRules, description,
+      processProps: { multiApprove: mode }, carbonReceiver: { type: 'VARIABLE', value: [ids] } };
+  }
+  // Carbon self-selection needs a separate non-free entitlement and feature flag.
+  // MultiApproval deliberately excludes this source in the native designer.
+  if (!['approval', 'operator'].includes(nodeType)) { invalid('selfSelect requires approval/operator', { nodeType }); }
+  const range = input.range === undefined ? { type: 'ALL' } : input.range;
+  if (!range || typeof range !== 'object' || Array.isArray(range)
+    || !['ALL', 'USER', 'ROLE'].includes(range.type)) { invalid('range.type'); }
+  const rangeKey = range.type === 'USER' ? 'users' : range.type === 'ROLE' ? 'roles' : null;
+  if (Object.keys(range).some(key => key !== 'type' && key !== rangeKey)) { invalid('range properties'); }
+  const runtimeRange = { type: range.type };
+  const viewRange = { type: range.type };
+  if (rangeKey) {
+    if (!Array.isArray(range[rangeKey]) || !range[rangeKey].length) { invalid('range must be nonempty'); }
+    let items;
+    try {
+      items = rangeKey === 'users' ? helpers.normalizeUserApprovers({ users: range.users })
+        : helpers.normalizeRoleApprovers({ roles: range.roles });
+    } catch { invalid('range member/role requires a real ID'); }
+    if (items.some(item => !item.id.trim() || !['YIDA', 'DINGTALK'].includes(item.roleType))) { invalid('range ID/roleType'); }
+    if (new Set(items.map(item => String(item.id))).size !== items.length) { invalid('duplicate range ID'); }
+    const key = rangeKey === 'users' ? 'approvalRange' : 'roleRange';
+    viewRange[key] = items;
+    runtimeRange[key] = rangeKey === 'users' ? items.map(item => item.id) : items;
+  }
+  approverRules.approvalOptionalRange = viewRange;
+  return { approvalType, approvals: ['__optionalApproval_' + node._nodeId], approverRules, description,
+    processProps: { multiApprove: mode, optionalApprovalRange: runtimeRange } };
+}
+
+function validateNativeActor(raw, nodeType, nodeId) {
+  if (Array.isArray(raw)) { invalid('actor must be an object'); }
+  if (raw.kind || raw.approverType) { invalid('unknown friendly actor kind', { kind: raw.kind || raw.approverType }); }
+  const type = raw.approvalType || raw.type || 'ext_target_approval_originator';
+  if (!NATIVE_TYPES.has(type)) { invalid('unknown native approvalType', { approvalType: type }); }
+  if (raw.approverRules?.type && raw.approverRules.type !== type) { invalid('runtime/view approvalType mismatch'); }
+  // Dynamic native payloads need both halves. Never default their runtime to originator.
+  if (type === FORM_MEMBER || type === SELF_SELECT) {
+    if (!raw.approvals || !raw.approverRules) { invalid('dynamic native actors require approvals and approverRules'); }
+    if (type === SELF_SELECT && !['approval', 'operator'].includes(nodeType)) {
+      invalid('selfSelect requires approval/operator', { nodeType });
+    }
+    if (type === FORM_MEMBER) {
+      const members = raw.approverRules.formMember;
+      const ids = Array.isArray(members) ? members.map(item => item?.value) : [];
+      if (!ids?.length || ids.some(id => typeof id !== 'string' || !id.trim())
+        || JSON.stringify(raw.approvals) !== JSON.stringify([ids])) { invalid('formMember/runtime mismatch'); }
+      if (nodeType === 'carbon' && (raw.carbonReceiver?.type !== 'VARIABLE'
+        || JSON.stringify(raw.carbonReceiver.value) !== JSON.stringify([ids]))) { invalid('carbonReceiver mismatch'); }
+    } else {
+      const view = raw.approverRules.approvalOptionalRange;
+      const runtime = (raw.processProps || raw.props || {}).optionalApprovalRange;
+      if (!view || !runtime || !['ALL', 'USER', 'ROLE'].includes(view.type) || view.type !== runtime.type
+        || JSON.stringify(raw.approvals) !== JSON.stringify(['__optionalApproval_' + nodeId])) {
+        invalid('selfSelect runtime/view range or generated node ID mismatch');
+      }
+      const key = view.type === 'USER' ? 'approvalRange' : view.type === 'ROLE' ? 'roleRange' : null;
+      if (key) {
+        const members = view[key];
+        if (!Array.isArray(members) || !members.length || members.some(item => !item?.id)) { invalid('selfSelect range IDs'); }
+        const ids = members.map(item => item.id);
+        const runtimeIds = view.type === 'USER' ? runtime[key] : runtime[key]?.map(item => item.id);
+        if (JSON.stringify(ids) !== JSON.stringify(runtimeIds)) { invalid('selfSelect runtime/view range IDs mismatch'); }
+      }
+    }
+  }
+}
+
+// Check both emitted contracts, including legacy multiRules and nested branches.
+function assertNativeActorTypes(value) {
+  if (!value || typeof value !== 'object') { return; }
+  if (Array.isArray(value)) { value.forEach(assertNativeActorTypes); return; }
+  for (const [key, item] of Object.entries(value)) {
+    if (['type', 'approvalType'].includes(key) && typeof item === 'string' && item.startsWith('ext_target_')
+      && item !== 'ext_target_activity' && !NATIVE_TYPES.has(item)) {
+      invalid('unknown native approvalType', { approvalType: item });
+    }
+    if (item && typeof item === 'object') { assertNativeActorTypes(item); }
+  }
+}
+
+function actorRules(node) {
+  const props = node?.props || {};
+  return props.multiApproverRules ? props.multiApproverRules.multiRules || [] : [props.approverRules].filter(Boolean);
+}
+
+function collectFormMemberIds(view) {
+  const ids = new Set();
+  function visit(nodes) {
+    for (const node of nodes || []) {
+      for (const rule of actorRules(node)) {
+        if (rule.type === FORM_MEMBER) { (rule.formMember || []).forEach(item => ids.add(item.value)); }
+      }
+      visit(node.children);
+    }
+  }
+  visit(view?.schema?.children);
+  return [...ids];
+}
+
+function assertFormMemberFields(ids, fields) {
+  for (const fieldId of ids) {
+    const field = fields.find(item => item.fieldId === fieldId);
+    if (!field || field.componentName !== 'EmployeeField' || field.parentFieldId) {
+      invalid('formField requires an existing top-level EmployeeField', { fieldId, componentName: field?.componentName });
+    }
+  }
+}
+
+function verifyDynamicActors(expected, actual, errors) {
+  function signature(node) {
+    return actorRules(node).filter(rule => [FORM_MEMBER, SELF_SELECT].includes(rule.type)).map(rule => {
+      if (rule.type === FORM_MEMBER) { return { type: rule.type, mode: rule['approvalType_' + rule.type], ids: (rule.formMember || []).map(item => item.value) }; }
+      const range = rule.approvalOptionalRange || {};
+      return { type: rule.type, mode: rule['approvalType_' + rule.type], rangeType: range.type,
+        users: range.type === 'USER' ? (range.approvalRange || []).map(item => String(item.id)) : [],
+        roles: range.type === 'ROLE' ? (range.roleRange || []).map(item => ({ id: String(item.id), roleType: item.roleType || 'YIDA' })) : [] };
+    });
+  }
+  const wanted = signature(expected);
+  if (wanted.length && JSON.stringify(wanted) !== JSON.stringify(signature(actual))) {
+    errors.push({ code: 'PROCESS_PLATFORM_VIEW_DYNAMIC_ACTORS_MISMATCH', nodeId: expected.id });
+  }
+}
+
+module.exports = { assertNativeActorTypes, buildDynamicActor, validateNativeActor, collectFormMemberIds, assertFormMemberFields, verifyDynamicActors };

package/lib/samples/openyida-scaffold/canvas-nav/mixed.jsx

@@ -12,7 +12,7 @@ function CanvasNav({ items = [], activeKey, onSelect, title, logo, actions, chil
       .oy-canvas-nav.oy-nav-mixed .oy-nav-sidebar { padding: var(--pod-nav-l-aside-padding, 8px); }
       .oy-nav-mixed .oy-nav-content { flex: 1; }
       .oy-nav-mixed .oy-nav-menu { display: flex; flex-direction: column; gap: var(--pod-nav-menu-gap, 8px); }
-      @media (max-width: 767px) {
+      @container (max-width: 767px) {
         .oy-nav-mixed .oy-nav-groups { flex-basis: 100%; }
         .oy-nav-mixed .oy-nav-body { display: block; }
         .oy-nav-mixed .oy-nav-menu { flex-direction: row; overflow-x: auto; border-right: 0; border-bottom: 1px solid var(--pod-nav-sub-divider-color, var(--color-line1-1, #ddd)); }

package/lib/samples/openyida-scaffold/canvas-nav/shared.jsx

@@ -4,7 +4,7 @@ import React from 'react';
 // 这是可选实现示例；导航外观按 design.md 设计，已有 UI 无需替换成示例默认样式。
 // 选中菜单标识当前页面，main 用 aria-label 命名，children 直接承载业务内容。
 const CANVAS_NAV_CSS = `
-  .oy-canvas-nav { display: flow-root; min-width: 0; min-height: 100vh; background: var(--pod-page-bg-color, var(--color-white, #fff)); }
+  .oy-canvas-nav { container-type: inline-size; display: flow-root; min-width: 0; min-height: 100vh; background: var(--pod-page-bg-color, var(--color-white, #fff)); }
   .oy-canvas-nav .oy-nav-surface {
     background: var(--pod-shell-theme-bg-color, var(--pod-nav-popup-bg-color, var(--color-white, #fff)));
     color: var(--pod-nav-item-text-color, var(--color-text1-4, #1f2329));

package/lib/samples/openyida-scaffold/canvas-nav/side.jsx

@@ -6,7 +6,7 @@ function CanvasNav({ items = [], activeKey, onSelect, title, logo, actions, chil
       .oy-nav-side .oy-nav-content { flex: 1; }
       .oy-nav-side .oy-nav-brand { min-height: var(--pod-nav-platform-header-height, 48px); }
       .oy-nav-side .oy-nav-menu { display: flex; flex-direction: column; gap: var(--pod-nav-menu-gap, 8px); }
-      @media (max-width: 767px) { .oy-nav-side { display: block; } }
+      @container (max-width: 767px) { .oy-nav-side { display: block; } }
     `}</style>
     <CanvasSidebar title={title} logo={logo} actions={actions} activeKey={activeKey} defaultWidth={sidebarWidth} defaultCollapsed={defaultCollapsed}>
       <nav aria-label="应用导航" className="oy-nav-menu">