openyida 2026.9.19 → 2026.9.20

package/README.md

@@ -183,7 +183,7 @@ openyida get-schema APP_XXX FORM_XXX --compact --resolve-fields "Customer Name,S
 openyida get-schema APP_XXX --all --output-dir .cache/schemas
 ```
 
-Form definitions support 19 business field types plus verified presentation/layout components. Prefer `Divider` for section titles and `ColumnContainer` (mapped to `ColumnsLayout` + `Column`) for multi-column layout; use `GroupContainer` / `PageSection` only when an actual grouping container is needed.
+Native forms use a component tree: business fields capture data, tabs switch content, action groups trigger business actions, images establish visual focus, status areas provide feedback, and `Divider` plus `ColumnContainer` organize hierarchy and columns. `create-form` field definitions create 19 business field types plus `Divider` and `ColumnContainer` (mapped to `ColumnsLayout` + `Column`), while updates retain other existing components.
 
 ### Custom Page Development
 
@@ -415,7 +415,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | Command | Description |
 |---------|-------------|
 | `openyida create-form batch <appType> <plan.json> [--concurrency 1..4] [--check] [--json]` | Create forms concurrently by dependency |
-| `openyida create-form create <appType> "<formTitle>" <fieldsJsonFile> [--icon auto\|<iconName>] [--locale zh_CN\|en_US\|ja_JP] [--open\|--no-open]` | Create a form page |
+| `openyida create-form create <appType> "<formTitle>" <fieldsJsonFile> [--layout single\|double\|card\|section] [--theme default\|compact\|comfortable] [--label-align top\|left\|right] [--icon auto\|<iconName>] [--locale zh_CN\|en_US\|ja_JP] [--open\|--no-open]` | Create a form page |
 | `openyida create-form icons [--json]` | List available form navigation icons |
 | `openyida create-form validate-fields <fieldsJsonOrFile> [--json]` | Validate form field JSON locally |
 | `openyida create-form update <appType> <formUuid> (<changesJsonOrFile> \| --data-file <changesJsonOrFile>) [--locale zh_CN\|en_US\|ja_JP] [--open\|--no-open]` | Update a form page |
@@ -523,7 +523,7 @@ Run `openyida --help` or `openyida <command> --help` for detailed usage.
 | `openyida a2a <serve\|agent-card> [options]` | Start local read-only A2A adapter or print Agent Card |
 | `openyida bridge start [--token <pair-token>] [--port 6736] [--origin https://demo.aliwork.com] [--open\|--no-open]` | Start OpenYida local web bridge service |
 | `openyida copy [--force]` | Copy project working directory |
-| `openyida sample [--list] [<skill> <name>] [--output <file>] [--var KEY=VALUE ...] [--design-file <design.md>]` | Output code samples/templates |
+| `openyida sample [--list] [<skill> <name>] [--output <file-or-directory>] [--var KEY=VALUE ...] [--design-file <design.md>] [--style-id <themeId\|free-creative>]` | Output code samples/templates |
 | `openyida doctor [--fix]` | Environment diagnostics & auto-fix |
 | `openyida db-seq-fix [--fix]` | Detect and repair PostgreSQL sequence drift |
 | `openyida formula evaluate <formula\|file> [--schema file]` | Static-check Yida formula syntax and field refs |

package/lib/app/application-style.js

@@ -0,0 +1,67 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { CliError } = require('../core/cli-error');
+const { t } = require('../core/i18n');
+const { DESIGN_SKILL_ROOT, loadThemeIndex } = require('../design-plan/themes');
+const START = '/* OPENYIDA APPLICATION STYLE RECIPES START';
+const END = '/* OPENYIDA APPLICATION STYLE RECIPES END */';
+const CREATIVE_TOKENS = [
+  '--pod-page-bg-color', '--pod-card-bg-color', '--color-text1-4',
+  '--form-element-medium-corner', '--form-element-medium-height',
+  '--pod-page-footer-bg-color', '--pod-sticky-footer-box-shadow',
+  '--oyd-content-width', '--oyd-content-padding', '--oyd-field-gap',
+  '--oyd-heading-font', '--oyd-heading-size', '--oyd-rule-style',
+];
+
+function validateCreativeDirection(direction, tokens) {
+  const missing = ['businessRationale', 'composition', 'typography', 'material', 'formLayout']
+    .filter(key => typeof direction?.[key] !== 'string' || !direction[key].trim());
+  missing.push(...CREATIVE_TOKENS.filter(key => typeof tokens?.[key] !== 'string' || !tokens[key].trim()));
+  if (missing.length) {
+    throw new CliError(t('design_document.invalid', 'creativeDirection', missing.join(', ')), {
+      code: 'APPLICATION_STYLE_CREATIVE_INCOMPLETE', details: { missing },
+    });
+  }
+}
+
+function applyApplicationStyle(css, metadata, tokens) {
+  const style = metadata.applicationStyle;
+  if (style && (style.recipe !== 'application-style-v1' || !['template', 'creative'].includes(style.mode))) {
+    throw new CliError(t('design_document.invalid', 'applicationStyle', 'APPLICATION_STYLE_INVALID'), { code: 'APPLICATION_STYLE_INVALID' });
+  }
+  if (style?.mode === 'creative') {validateCreativeDirection(metadata.creativeDirection, tokens);}
+  const first = css.indexOf(START);
+  const last = css.indexOf(END);
+  if (first >= 0 && last < first) {
+    throw new CliError(t('design_document.invalid', 'app_theme.css', 'APPLICATION_STYLE_CSS_INVALID'), { code: 'APPLICATION_STYLE_CSS_INVALID' });
+  }
+  const recipe = style
+    ? fs.readFileSync(path.join(DESIGN_SKILL_ROOT, 'references/theme/application-style-recipes.css'), 'utf8').trim()
+    : '';
+  // Only the managed recipe block is replaced. User-authored rules stay intact.
+  if (first >= 0) {return css.slice(0, first) + recipe + css.slice(last + END.length);}
+  return recipe ? `${css.trimEnd()}\n\n${recipe}\n` : css;
+}
+
+function exportApplicationStyle(id, outputDirectory) {
+  const theme = loadThemeIndex().themes.find(item => item.themeId === id && item.collection === 'application-styles');
+  if (!theme) {throw new CliError(t('design_document.invalid', id || '--style-id', 'APPLICATION_STYLE_UNKNOWN'), { code: 'APPLICATION_STYLE_UNKNOWN' });}
+  const directory = path.resolve(outputDirectory);
+  const assets = [['design.md', theme.templatePath], ['app_theme.css', theme.cssTemplatePath], ['form-layout.json', theme.formLayoutPath]];
+  const outputs = assets.map(([name, relative]) => {
+    const source = path.resolve(DESIGN_SKILL_ROOT, relative);
+    const target = path.join(directory, name);
+    const root = path.resolve(DESIGN_SKILL_ROOT, 'templates/design-themes') + path.sep;
+    if (!source.startsWith(root) || fs.existsSync(target)) {
+      throw new CliError(t('design_document.invalid', target, 'APPLICATION_STYLE_OUTPUT_CONFLICT'), { code: 'APPLICATION_STYLE_OUTPUT_CONFLICT' });
+    }
+    return { source, target, content: fs.readFileSync(source, 'utf8') };
+  });
+  fs.mkdirSync(directory, { recursive: true });
+  for (const item of outputs) {fs.writeFileSync(item.target, item.content, { flag: 'wx' });}
+  return { success: true, mode: theme.mode, themeId: id, authoringRequired: true, outputs: outputs.map(item => item.target) };
+}
+
+module.exports = { applyApplicationStyle, validateCreativeDirection, CREATIVE_TOKENS, exportApplicationStyle };

package/lib/app/create-form/args.js

@@ -2,6 +2,10 @@
 
 const { detectDeprecatedCreateFormInvocation } = require('../../core/command-contract');
 
+const CREATE_FORM_LAYOUTS = new Set(['single', '1', 'double', '2', 'card', 'section']);
+const CREATE_FORM_THEMES = new Set(['default', 'compact', 'comfortable']);
+const CREATE_FORM_LABEL_ALIGNS = new Set(['top', 'left', 'right']);
+
 function parseMaybeJsonValue(value) {
   if (typeof value !== 'string') {
     return value;
@@ -94,24 +98,38 @@ function createParseArgs(dependencies) {
     const args = [...rawArgs];
 
     for (let i = 0; i < args.length; i++) {
-      if (args[i] === '--layout' && i + 1 < args.length) {
-        options.layout = args[i + 1];
+      if (args[i] === '--layout') {
+        const value = args[i + 1];
+        if (!value || value.startsWith('--') || !CREATE_FORM_LAYOUTS.has(value)) {
+          throwCreateFormError('--layout must be one of: single, double, card, section', 'CREATE_FORM_INVALID_ARGUMENTS');
+        }
+        options.layout = value;
         args.splice(i, 2);
         i--;
-      } else if (args[i] === '--theme' && i + 1 < args.length) {
-        options.theme = args[i + 1];
+      } else if (args[i] === '--theme') {
+        const value = args[i + 1];
+        if (!value || value.startsWith('--') || !CREATE_FORM_THEMES.has(value)) {
+          throwCreateFormError('--theme must be one of: default, compact, comfortable', 'CREATE_FORM_INVALID_ARGUMENTS');
+        }
+        options.theme = value;
         args.splice(i, 2);
         i--;
-      } else if (args[i] === '--label-align' && i + 1 < args.length) {
-        options.labelAlign = args[i + 1];
+      } else if (args[i] === '--label-align') {
+        const value = args[i + 1];
+        if (!value || value.startsWith('--') || !CREATE_FORM_LABEL_ALIGNS.has(value)) {
+          throwCreateFormError('--label-align must be one of: top, left, right', 'CREATE_FORM_INVALID_ARGUMENTS');
+        }
+        options.labelAlign = value;
         args.splice(i, 2);
         i--;
-      } else if (args[i] === '--icon' && i + 1 < args.length) {
-        options.icon = args[i + 1];
+      } else if (args[i] === '--icon') {
+        const value = args[i + 1];
+        if (!value || value.startsWith('--')) {
+          throwCreateFormError('--icon requires a value', 'CREATE_FORM_INVALID_ARGUMENTS');
+        }
+        options.icon = value;
         args.splice(i, 2);
         i--;
-      } else if (args[i] === '--icon') {
-        throwCreateFormError('--icon requires a value', 'CREATE_FORM_INVALID_ARGUMENTS');
       } else if (args[i] === '--data-file') {
         const next = args[i + 1];
         if (dataFileInput !== undefined || !next || next.startsWith('--')) {
@@ -120,8 +138,12 @@ function createParseArgs(dependencies) {
         dataFileInput = next;
         args.splice(i, 2);
         i--;
-      } else if ((args[i] === '--locale' || args[i] === '--content-locale' || args[i] === '--lang') && i + 1 < args.length) {
-        options.contentLocale = args[i + 1];
+      } else if (args[i] === '--locale' || args[i] === '--content-locale' || args[i] === '--lang') {
+        const value = args[i + 1];
+        if (!value || value.startsWith('--')) {
+          throwCreateFormError(`${args[i]} requires a value`, 'CREATE_FORM_INVALID_ARGUMENTS');
+        }
+        options.contentLocale = value;
         if (!normalizeYidaLocale(options.contentLocale)) {
           error(`Unsupported locale: ${options.contentLocale}`);
           throwCreateFormError(`Unsupported locale: ${options.contentLocale}`, 'CREATE_FORM_INVALID_ARGUMENTS');
@@ -361,4 +383,7 @@ module.exports = {
   createParseArgs,
   parseInlineValidationOptions,
   parseMaybeJsonValue,
+  CREATE_FORM_LAYOUTS,
+  CREATE_FORM_THEMES,
+  CREATE_FORM_LABEL_ALIGNS,
 };

package/lib/app/create-form/batch.js

@@ -9,10 +9,15 @@ const { t } = require('../../core/i18n');
 const { usage, hint } = require('../../core/chalk');
 const { assertNoEmojiInText, assertNoEmojiInValue } = require('../../core/no-emoji-guard');
 const { normalizeYidaLocale } = require('../../core/yida-i18n');
+const {
+  CREATE_FORM_LAYOUTS,
+  CREATE_FORM_THEMES,
+  CREATE_FORM_LABEL_ALIGNS,
+} = require('./args');
 const { FORM_NAV_ICONS, resolveFormNavIcon } = require('./nav-icon');
 
 const BATCH_USAGE = 'openyida create-form batch <appType> <plan.json> [--concurrency 1..4] [--check] [--json]';
-const BATCH_PLAN_EXAMPLE = '{"forms":[{"key":"customer","title":"客户","fieldsFile":"customer-fields.json"},{"key":"order","title":"订单","fieldsFile":"order-fields.json","dependsOn":["customer"]}]}';
+const BATCH_PLAN_EXAMPLE = '{"forms":[{"key":"customer","title":"客户","fieldsFile":"customer-fields.json","layout":"section","theme":"comfortable","labelAlign":"left"},{"key":"order","title":"订单","fieldsFile":"order-fields.json","dependsOn":["customer"]}]}';
 
 function invalid(reason) {
   throw new CliError(t('create_form.batch_invalid'), { code: 'FORM_BATCH_INVALID', details: { reason } });
@@ -46,6 +51,20 @@ function validateStaticDefinition(form, fields) {
       locale: form.locale,
     });
   }
+  for (const [key, values] of [
+    ['layout', CREATE_FORM_LAYOUTS],
+    ['theme', CREATE_FORM_THEMES],
+    ['labelAlign', CREATE_FORM_LABEL_ALIGNS],
+  ]) {
+    if (form[key] !== undefined && !values.has(form[key])) {
+      invalid({
+        formKey: form.key,
+        errorCode: 'CREATE_FORM_INVALID_ARGUMENTS',
+        errorMsg: `Unsupported ${key}: ${form[key]}`,
+        [key]: form[key],
+      });
+    }
+  }
 }
 
 function parseArgs(args) {
@@ -126,9 +145,9 @@ function loadPlan(file, options = {}) {
     if (!form || !/^[a-zA-Z][\w-]*$/.test(form.key || '') || typeof form.title !== 'string' || !form.title.trim() ||
       (form.fields === undefined) === (form.fieldsFile === undefined) ||
       (form.dependsOn !== undefined && (!Array.isArray(form.dependsOn) || form.dependsOn.some(key => typeof key !== 'string')))) { invalid('form'); }
-    if (Object.keys(form).some(key => !['key', 'title', 'fields', 'fieldsFile', 'dependsOn', 'formUuid', 'icon', 'locale'].includes(key))) { invalid(form.key); }
+    if (Object.keys(form).some(key => !['key', 'title', 'fields', 'fieldsFile', 'dependsOn', 'formUuid', 'layout', 'theme', 'labelAlign', 'icon', 'locale'].includes(key))) { invalid(form.key); }
     if (form.formUuid !== undefined && (typeof form.formUuid !== 'string' || !form.formUuid.startsWith('FORM'))) { invalid(form.key); }
-    for (const key of ['icon', 'locale']) { if (form[key] !== undefined && typeof form[key] !== 'string') { invalid(key); } }
+    for (const key of ['layout', 'theme', 'labelAlign', 'icon', 'locale']) { if (form[key] !== undefined && typeof form[key] !== 'string') { invalid(key); } }
     const rawFields = form.fieldsFile === undefined ? form.fields : JSON.parse(fs.readFileSync(path.resolve(path.dirname(file), form.fieldsFile), 'utf8'));
     const fields = normalizeAssociationReferences(rawFields, options.appType);
     validateStaticDefinition(form, fields);
@@ -192,7 +211,7 @@ function expectedReadbackFields(fields) {
       expected.push(...expectedReadbackFields(field.children));
       continue;
     }
-    if (['Divider', 'RichText', 'PageSection', 'GroupContainer'].includes(field.type)) { continue; }
+    if (['Divider', 'RichText'].includes(field.type)) { continue; }
     if (typeof field.label === 'string' && field.label.trim()) {
       expected.push({ label: field.label.trim(), componentName: field.type });
     }
@@ -361,7 +380,15 @@ async function run(args, dependencies = {}) {
       const resolvedFields = mapReferences(form.fields, resolve);
       if (!formUuid) {
         const argv = ['create-form', 'create', options.appType, form.title, JSON.stringify(resolvedFields), '--no-open'];
-        for (const key of ['icon', 'locale']) { if (form[key]) { argv.push(`--${key}`, form[key]); } }
+        for (const [key, option] of Object.entries({
+          layout: '--layout',
+          theme: '--theme',
+          labelAlign: '--label-align',
+          icon: '--icon',
+          locale: '--locale',
+        })) {
+          if (form[key]) { argv.push(option, form[key]); }
+        }
         try {
           const created = await call(argv);
           if (typeof created.formUuid !== 'string' || !created.formUuid.startsWith('FORM')) { invalid(`create result: ${form.key}`); }

package/lib/app/create-form.js

@@ -288,13 +288,9 @@ const FORM_PRESENTATION_TYPE_ALIAS = {
   columnContainer: 'ColumnsLayout',
   Column: 'Column',
   column: 'Column',
-  GroupContainer: 'PageSection',
-  groupContainer: 'PageSection',
-  PageSection: 'PageSection',
-  pageSection: 'PageSection',
 };
 
-const FORM_PRESENTATION_COMPONENTS = ['Divider', 'ColumnsLayout', 'Column', 'PageSection'];
+const FORM_PRESENTATION_COMPONENTS = ['Divider', 'ColumnsLayout', 'Column'];
 
 const COMPONENT_ALIAS_META = Symbol('openyida.componentAlias');
 
@@ -521,13 +517,6 @@ function normalizeI18nValue(value, fallback) {
   return i18n(text, text, text);
 }
 
-function normalizeStyleChoice(value, fallback) {
-  if (value && typeof value === 'object') {
-    return value;
-  }
-  return { value: value || fallback };
-}
-
 function buildSchemaNode(componentName, props, children, options) {
   const node = {
     componentName: componentName,
@@ -596,41 +585,6 @@ function buildDividerComponent(field) {
   return buildSchemaNode('Divider', props, undefined, { fieldId: props.fieldId || fieldId });
 }
 
-function buildPageSectionComponent(field) {
-  const fieldId = field.fieldId || field.id || generateFieldId('PageSection');
-  const props = mergeExtraProps({
-    fieldId,
-    behavior: field.behavior || 'NORMAL',
-    visibility: field.visibility || ['PC', 'MOBILE'],
-    showHeader: field.showHeader !== undefined ? !!field.showHeader : true,
-    title: normalizeI18nValue(field.title !== undefined ? field.title : field.label, '分组'),
-    tooltip: normalizeI18nValue(field.tooltip || field.tips, ''),
-    showHeadDivider: field.showHeadDivider !== undefined ? !!field.showHeadDivider : true,
-    sectionHeaderStyle: field.sectionHeaderStyle || 'origin',
-    sectionHeaderBgColor: field.sectionHeaderBgColor || '#0089ff',
-    sectionHeaderTitleColor: field.sectionHeaderTitleColor || '#171A1D',
-    pcStyle: normalizeStyleChoice(field.pcStyle, 'origin'),
-    showBorder: !!field.showBorder,
-    withMargin: !!field.withMargin,
-    withPadding: field.withPadding !== undefined ? !!field.withPadding : true,
-    mobileStyle: normalizeStyleChoice(field.mobileStyle, 'origin'),
-    showBorderMobile: !!field.showBorderMobile,
-    withMarginMobile: !!field.withMarginMobile,
-    withPaddingMobile: !!field.withPaddingMobile,
-  }, field);
-
-  if (field.newIcon !== undefined) {
-    props.newIcon = field.newIcon;
-  }
-
-  return buildSchemaNode(
-    'PageSection',
-    props,
-    buildFormNodeComponents(field.children || []),
-    { fieldId: props.fieldId || fieldId }
-  );
-}
-
 function countLayoutColumns(layout) {
   const parts = String(layout || '12').split(':').filter(Boolean);
   return parts.length || 1;
@@ -684,9 +638,6 @@ function buildFormNodeComponent(field) {
   if (componentName === 'Divider') {
     return buildDividerComponent(field);
   }
-  if (componentName === 'PageSection') {
-    return buildPageSectionComponent(field);
-  }
   if (componentName === 'ColumnsLayout') {
     return buildColumnsLayoutComponent(field);
   }
@@ -1734,7 +1685,6 @@ function buildFormSchema(formTitle, fields, formUuid, corpId, appType, layout, t
         labelWeightMobile: 'normal',
       },
       condition: true,
-      css: 'body{background-color:transparent}',
       methods: {
         __initMethods__: {
           type: 'js',
@@ -1944,7 +1894,6 @@ function buildEmptyFormSchema() {
             contentBgColorMobile: 'white',
           },
           condition: true,
-          css: 'body{background-color:transparent}',
           methods: {
             __initMethods__: {
               type: 'js',
@@ -2609,6 +2558,84 @@ function findFieldByIdOrLabelDeep(fields, identifier) {
   return null;
 }
 
+function normalizeFormInjectionKey(key) {
+  return String(key || '').replace(/[^a-z0-9]/gi, '').toLowerCase();
+}
+
+function isRawFormInjectionKey(key) {
+  const normalized = normalizeFormInjectionKey(key);
+  return normalized === 'srcdoc'
+    || normalized === 'stylesheet'
+    || normalized === 'stylesheets'
+    || normalized === 'styletext'
+    || normalized === 'styletag'
+    || normalized.includes('innerhtml')
+    || normalized.includes('outerhtml')
+    || normalized.includes('dangerouslysetinnerhtml')
+    || normalized.startsWith('css')
+    || normalized.endsWith('css')
+    || normalized.startsWith('html')
+    || normalized.endsWith('html');
+}
+
+function isRawMarkupComponent(componentName) {
+  return ['html', 'iframe'].includes(String(componentName || '').toLowerCase());
+}
+
+function assertNoFormInjectionValue(value, location) {
+  if (Array.isArray(value)) {
+    value.forEach(function (item, index) {
+      assertNoFormInjectionValue(item, location + '[' + index + ']');
+    });
+    return;
+  }
+  if (!value || typeof value !== 'object') {
+    return;
+  }
+  Object.keys(value).forEach(function (key) {
+    if (isRawFormInjectionKey(key)) {
+      throw new Error('表单补丁不支持 CSS/HTML 注入: ' + location + '.' + key);
+    }
+    if (normalizeFormInjectionKey(key) === 'componentname' && isRawMarkupComponent(value[key])) {
+      throw new Error('表单补丁不支持 CSS/HTML 注入组件: ' + value[key]);
+    }
+    assertNoFormInjectionValue(value[key], location + '.' + key);
+  });
+}
+
+function assertNoFormInjectionPath(pointer, value) {
+  if (!pointer) {
+    return;
+  }
+  const segments = splitJsonPointer(pointer);
+  const blockedSegment = segments.find(isRawFormInjectionKey);
+  if (blockedSegment) {
+    throw new Error('表单补丁不支持 CSS/HTML 注入路径: ' + pointer);
+  }
+  const lastSegment = normalizeFormInjectionKey(segments[segments.length - 1]);
+  if (lastSegment === 'componentname' && isRawMarkupComponent(value)) {
+    throw new Error('表单补丁不支持 CSS/HTML 注入组件: ' + value);
+  }
+}
+
+function assertNoFormInjectionSource(source, location) {
+  if (typeof source !== 'string' || source.length === 0) {
+    return;
+  }
+  const forbiddenPatterns = [
+    /\b(?:innerHTML|outerHTML|insertAdjacentHTML|dangerouslySetInnerHTML|srcdoc|cssText|insertRule|adoptedStyleSheets)\b/i,
+    /\bdocument\s*\.\s*(?:write|writeln)\s*\(/i,
+    /\bcreateElement\s*\(\s*['"`](?:style|script|iframe|link)['"`]\s*\)/i,
+    /\bsetAttribute\s*\(\s*['"`](?:style|srcdoc)['"`]/i,
+    /\.\s*style\s*(?:\.|\[)/i,
+    /<\s*(?:style|script|iframe|html|body)\b/i,
+    /openyida:theme|yida-global-theme/i,
+  ];
+  if (forbiddenPatterns.some(function (pattern) { return pattern.test(source); })) {
+    throw new Error('表单动作不支持 CSS/HTML 注入: ' + location);
+  }
+}
+
 function resolveJsonPointerParent(target, pointer) {
   const segments = splitJsonPointer(pointer);
   if (segments.length === 0) {
@@ -2764,6 +2791,7 @@ function applyAtomicFieldAction(schema, formContainer, operation) {
   const actions = ensureActionModule(schema);
   const source = readOptionalSource(operation, 'source', 'sourceFile');
   if (source !== undefined) {
+    assertNoFormInjectionSource(source, 'field-action ' + actionName);
     if (!extractExportedActionFunctionNames(source).includes(actionName)) {
       throw createCreateFormError(
         t('create_form.action_source_export_missing', actionName),
@@ -2779,12 +2807,14 @@ function applyAtomicFieldAction(schema, formContainer, operation) {
     }
     const blockStart = '/* openyida:field-action:start:' + actionName + ' */';
     const blockEnd = '/* openyida:field-action:end:' + actionName + ' */';
-    actions.module.source = upsertGeneratedSourceBlockWithBounds(
+    const nextActionSource = upsertGeneratedSourceBlockWithBounds(
       actions.module.source || '',
       source,
       blockStart,
       blockEnd
     );
+    assertNoFormInjectionSource(nextActionSource, 'field-action module');
+    actions.module.source = nextActionSource;
     actions.module.compiled = compileActionSource(actions.module.source);
     actions.type = actions.type || 'FUNCTION';
   } else if (!extractExportedActionFunctionNames(actions.module.source || '').includes(actionName)) {
@@ -2829,6 +2859,14 @@ function applySchemaPatchOperations(schema, operations) {
       throw new Error('补丁[' + index + '] 缺少 action/op');
     }
 
+    assertNoFormInjectionPath(operation.path, operation.value);
+    if (Object.prototype.hasOwnProperty.call(operation, 'value')) {
+      assertNoFormInjectionValue(operation.value, '补丁[' + index + '].value');
+    }
+    if (operation.props !== undefined) {
+      assertNoFormInjectionValue(operation.props, '补丁[' + index + '].props');
+    }
+
     if (['add', 'replace', 'remove'].includes(action)) {
       applyJsonPointerOperation(schema, operation);
       applied.push({ action, path: operation.path });
@@ -2888,6 +2926,8 @@ function applySchemaPatchOperations(schema, operations) {
       const source = readOptionalSource(operation, 'source', 'sourceFile');
       const compiled = readOptionalSource(operation, 'compiled', 'compiledFile')
         || (source ? compileActionSource(source) : undefined);
+      assertNoFormInjectionSource(source, 'actions-module source');
+      assertNoFormInjectionSource(compiled, 'actions-module compiled');
       if (source !== undefined) {
         actions.module.source = source;
       }
@@ -4351,10 +4391,6 @@ function applyFieldChanges(component, changes) {
     props.tips = i18n(changes.tips);
   }
 
-  if (changes.tooltip !== undefined && component.componentName === 'PageSection') {
-    props.tooltip = i18n(changes.tooltip);
-  }
-
   // ── 特殊处理：required（操作 validation 数组）
   if (changes.required !== undefined && !isFormPresentationComponent(component.componentName)) {
     if (changes.required) {
@@ -6518,6 +6554,7 @@ module.exports = {
   parseArgs,
   _private: {
     buildFormSchema,
+    buildEmptyFormSchema,
     buildFormNodeComponent,
     countDataFieldDefinitions,
     collectComponentNames,

package/lib/app/form-field-validator.js

@@ -58,10 +58,6 @@ const PRESENTATION_TYPE_ALIAS = Object.freeze({
   columnContainer: 'ColumnContainer',
   Column: 'Column',
   column: 'Column',
-  GroupContainer: 'GroupContainer',
-  groupContainer: 'GroupContainer',
-  PageSection: 'PageSection',
-  pageSection: 'PageSection',
 });
 
 const BUSINESS_FIELD_TYPES = Object.freeze([
@@ -90,8 +86,6 @@ const PRESENTATION_FIELD_TYPES = Object.freeze([
   'Divider',
   'ColumnContainer',
   'Column',
-  'GroupContainer',
-  'PageSection',
 ]);
 
 const OPTION_FIELD_TYPES = Object.freeze([
@@ -372,11 +366,6 @@ function validateFieldDefinition(field, path, diagnostics, options) {
     return;
   }
 
-  if (type === 'GroupContainer' || type === 'PageSection') {
-    validateOneDimensionalChildren(field, path, diagnostics, type);
-    return;
-  }
-
   if (type === 'TableField') {
     validateTableField(field, path, diagnostics);
   }
@@ -496,31 +485,6 @@ function validateColumnContainer(field, path, diagnostics) {
   });
 }
 
-function validateOneDimensionalChildren(field, path, diagnostics, type) {
-  if (!validateChildrenPropertyShape(field, path, diagnostics, 'FieldDefinition[]')) {
-    return;
-  }
-  if (field.children === undefined || field.children === null) {
-    return;
-  }
-  field.children.forEach(function (child, childIndex) {
-    const childPath = path + '.children[' + childIndex + ']';
-    if (Array.isArray(child)) {
-      pushDiagnostic(
-        diagnostics,
-        'INVALID_' + type.toUpperCase() + '_CHILDREN_DEPTH',
-        childPath,
-        'FieldDefinition object',
-        'array',
-        type + '.children must be a one-dimensional field array.',
-        'Remove extra array nesting from ' + type + '.children.'
-      );
-      return;
-    }
-    validateFieldDefinition(child, childPath, diagnostics);
-  });
-}
-
 function validateTableField(field, path, diagnostics) {
   if (!validateChildrenPropertyShape(field, path, diagnostics, 'FieldDefinition[]')) {
     return;

package/lib/app/services/form-compiler.js

@@ -1638,7 +1638,6 @@ function buildFormSchema(formTitle, fields, formUuid, corpId, appType, layout, t
         labelWeightMobile: 'normal',
       },
       condition: true,
-      css: 'body{background-color:transparent}',
       methods: {
         __initMethods__: {
           type: 'js',
@@ -1844,7 +1843,6 @@ function buildEmptyFormSchema() {
             contentBgColorMobile: 'white',
           },
           condition: true,
-          css: 'body{background-color:transparent}',
           methods: {
             __initMethods__: {
               type: 'js',

package/lib/app/theme-from-design.js

@@ -133,7 +133,7 @@ function applyDesignTokens(template, markdown, previousMarkdown) {
   const changed = Object.fromEntries(Object.entries(tokens).filter(([name, value]) => !previous || previous[name] !== value));
   if (!Object.keys(changed).length && tone === previousTone) {
     extractThemeColor(template);
-    return template;
+    return require('./application-style').applyApplicationStyle(template, metadata, tokens);
   }
   const root = /^:root\s*\{([\s\S]*?)^\}/m.exec(template);
   if (!root) {throw new Error('应用主题模板缺少 :root');}
@@ -157,6 +157,7 @@ function applyDesignTokens(template, markdown, previousMarkdown) {
   }
   let css = `${template.slice(0, root.index)}:root {${body}}${tail}`;
   if (tone) {css = applyNavigationTokens(css, tokens, changed, tone, previousTone);}
+  css = require('./application-style').applyApplicationStyle(css, metadata, tokens);
   validateThemeCssContent(css);
   extractThemeColor(css);
   return css;