weaver-e9-assistant-cli 1.1.4 → 1.1.11

package/dist/todosubmit.js

@@ -1,6 +1,479 @@
 import { createApiFromProfile } from './client.js';
 import { getWfList } from './workflow.js';
 import { todayStr, nowTimeStr } from './util.js';
+import { findNonEditableFields } from './wfstart.js';
+import { getBrowserOptions, isCustomBrowserField, browserNameSeparator, normalizeSelectValue } from './wfform.js';
+import { applyFormulas } from './formula.js';
+import { uploadFile, fieldListType, uploadFieldValue } from './wfupload.js';
+import {
+    parseDetailFileSpec, fetchTodoDetailRows, planTodoDetails, buildDetailBodyKeys,
+    countDetailUnEmpty, countMainUnEmpty, isDetailValueKey, isDetailTableKey,
+    detailIndexFromKey, normalizeFieldId,
+} from './tododetail.js';
+
+/**
+ * 构造待办当前节点的公式上下文（主表当前值 + 明细当前行 + 本次 --field-values 覆盖），
+ * 执行 formulaCfg 后返回需要写进提交体的公式字段值。
+ */
+function buildTodoFormulaOverrides(j0, fieldValues) {
+    const maindata = j0?.maindata ?? {};
+    const values = {};
+    for (const [key, cell] of Object.entries(maindata)) {
+        const m = String(key).match(/^field(-?\d+)$/);
+        if (m)
+            values[m[1]] = cell?.value ?? '';
+    }
+    for (const [key, value] of Object.entries(fieldValues ?? {})) {
+        const raw = String(key).replace(/^field/, '');
+        if (/^\d+$/.test(raw))
+            values[raw] = value;
+    }
+    const details = [];
+    for (const [tableKey, table] of Object.entries(j0?.tableInfo ?? {})) {
+        if (!tableKey.startsWith('detail_'))
+            continue;
+        const index = Number(tableKey.slice('detail_'.length)) - 1;
+        const fieldIds = new Set(Object.keys(table?.fieldinfomap ?? {}));
+        const rowsMap = new Map();
+        for (const [key, cell] of Object.entries(maindata)) {
+            const m = String(key).match(/^field(\d+)_(\d+)$/);
+            if (!m || !fieldIds.has(m[1]))
+                continue;
+            const row = Number(m[2]);
+            if (!rowsMap.has(row))
+                rowsMap.set(row, {});
+            rowsMap.get(row)[m[1]] = cell?.value ?? '';
+        }
+        for (const [key, value] of Object.entries(fieldValues ?? {})) {
+            const m = String(key).replace(/^field/, '').match(/^(\d+)_(\d+)$/);
+            if (!m || !fieldIds.has(m[1]))
+                continue;
+            const row = Number(m[2]);
+            if (!rowsMap.has(row))
+                rowsMap.set(row, {});
+            rowsMap.get(row)[m[1]] = value;
+        }
+        const rows = [...rowsMap.entries()].sort((a, b) => a[0] - b[0]).map(([, row]) => row);
+        if (rows.length > 0)
+            details.push({ index, rows });
+    }
+    const result = applyFormulas(j0, values, details);
+    const overrides = {};
+    for (const item of result.applied) {
+        const fieldId = item.dest.split('.').pop();
+        if (item.table === 'main')
+            overrides[`field${fieldId}`] = item.value;
+        else
+            overrides[`field${fieldId}_${item.row}`] = item.value;
+    }
+    return { overrides, result };
+}
+
+/**
+ * 只做「当前节点字段属性」校验，不提交——供 CLI dry-run 提前拦截，避免"预览通过、提交才报错"。
+ * 返回被违规填值的只读/隐藏字段清单（空数组 = 通过）。
+ */
+export async function validateFieldValuesAtNode(cfg, requestId, fieldValues) {
+    if (!fieldValues || !Object.keys(fieldValues).length)
+        return [];
+    const api = await createApiFromProfile(cfg);
+    const r = await api.post('/api/workflow/reqform/loadForm', { iscreate: '0', requestid: requestId });
+    return findNonEditableFields({ tables: nodeFieldTables(r.json ?? {}) }, fieldValues);
+}
+
+/**
+ * 从 loadForm 响应的 tableInfo 抽出字段定义，供 findNonEditableFields 判定。
+ * ⚠️ 这里用的是 **iscreate=0（处理态）** 的属性——即**当前节点**的字段权限，
+ *   而非 create 路径的表单设计态（iscreate=1）。
+ */
+function nodeFieldTables(json) {
+    const tables = [];
+    for (const key of Object.keys(json?.tableInfo ?? {})) {
+        const fmap = json.tableInfo[key]?.fieldinfomap;
+        if (!fmap || typeof fmap !== 'object')
+            continue;
+        tables.push({
+            key,
+            attr: json.tableInfo[key]?.detailtableattr ?? null,
+            fields: Object.values(fmap).map((f) => ({
+                id: String(f?.fieldid ?? ''),
+                label: String(f?.fieldlabel ?? ''),
+                // 服务端已带出的默认值/当前值：只读但有默认值时展示层会提示"自动带出"
+                currentValue: (() => {
+                    const v = json?.maindata?.[`field${f?.fieldid}`]?.value;
+                    return (v === undefined || v === null || v === '') ? undefined : String(v);
+                })(),
+                // 字段属性：viewattr 0隐藏/1只读/2可编辑/3必填 + isonlyshow/isedit/isview（判据见 fieldNonEditableReason）。
+                viewattr: (f?.viewattr === undefined || f?.viewattr === null || f?.viewattr === '') ? null : Number(f.viewattr),
+                isonlyshow: (f?.isonlyshow === undefined || f?.isonlyshow === null || f?.isonlyshow === '') ? null : Number(f.isonlyshow),
+                isedit: (f?.isedit === undefined || f?.isedit === null || f?.isedit === '') ? null : Number(f.isedit),
+                isview: (f?.isview === undefined || f?.isview === null || f?.isview === '') ? null : Number(f.isview),
+                // 明细规划/附件上传需要：字段类型、明细表归属、附件目录（fileattr.docCategory）
+                htmltype: (f?.htmltype === undefined || f?.htmltype === null || f?.htmltype === '') ? null : Number(f.htmltype),
+                detailtype: (f?.detailtype === undefined || f?.detailtype === null || f?.detailtype === '') ? null : String(f.detailtype),
+                table: key,
+                raw: f ?? {},
+            })),
+        });
+    }
+    return tables;
+}
+
+/** 字段元数据：fieldId → { id,label,table,htmltype,detailtype,raw } + 明细表列表。 */
+function collectFormMeta(json) {
+    const fieldById = new Map();
+    const detailTables = [];
+    for (const [key, table] of Object.entries(json?.tableInfo ?? {})) {
+        const fmap = table?.fieldinfomap;
+        if (fmap && typeof fmap === 'object') {
+            for (const [fid, f] of Object.entries(fmap)) {
+                fieldById.set(String(fid), {
+                    id: String(fid),
+                    label: f?.fieldlabel,
+                    table: key,
+                    htmltype: (f?.htmltype === undefined || f?.htmltype === null || f?.htmltype === '') ? undefined : Number(f.htmltype),
+                    detailtype: (f?.detailtype === undefined || f?.detailtype === null || f?.detailtype === '') ? undefined : String(f.detailtype),
+                    raw: f ?? {},
+                });
+            }
+        }
+        if (isDetailTableKey(key)) {
+            detailTables.push({
+                key,
+                idx: detailIndexFromKey(key),
+                attr: table?.detailtableattr ?? {},
+            });
+        }
+    }
+    return { fieldById, detailTables };
+}
+
+/** 是否涉及明细行（明细键 / 明细表 --detail-file / 明细附件）。 */
+function hasDetailInputs(fieldValues, fieldById, detailFile, files) {
+    if ((detailFile ?? []).length > 0)
+        return true;
+    if (Object.keys(fieldValues ?? {}).some((k) => isDetailValueKey(k, fieldById)))
+        return true;
+    return (files ?? []).some((fl) => {
+        const m = String(fl?.fieldId ?? '').match(/^(?:field)?(\d+)(?:_(\d+))?$/);
+        return Boolean(m && isDetailTableKey(fieldById.get(m[1])?.table));
+    });
+}
+
+/** 无明细规划时的主表值：排除真正的明细键，保留旧用法（主表字段带 _<row> 后缀）。 */
+function buildLegacyMainValues(fieldValues, fieldById) {
+    const out = {};
+    for (const [k, v] of Object.entries(fieldValues ?? {})) {
+        if (isDetailValueKey(k, fieldById))
+            continue;
+        out[k.startsWith('field') ? k.slice('field'.length) : k] = v;
+    }
+    return out;
+}
+
+/**
+ * 当前主表业务字段值（id>0）。
+ * 浏览器 generateFormData 会提交**全部主表字段**；只发改动字段会被服务端判定
+ * 「主表数据信息异常/存在数据丢失风险」（674 真机实证），因此以当前值为底再覆盖改动。
+ */
+function currentMainValues(j1) {
+    const out = {};
+    for (const [key, cell] of Object.entries(j1?.maindata ?? {})) {
+        const m = String(key).match(/^field(-?\d+)$/);
+        if (!m)
+            continue;
+        const id = Number(m[1]);
+        if (id <= 0)
+            continue; // 系统字段 -1/-2/-4/-9/-10 由 requestname/remark/field-10 等专门处理
+        out[m[1]] = cell?.value === undefined || cell?.value === null ? '' : String(cell.value);
+    }
+    return out;
+}
+
+/** 主表选择框/自定义浏览框规范化；返回需要额外写入 body 的 name 键。 */
+async function normalizeMainValues(cfg, workflowId, tableInfo, mainValues, browserParams) {
+    const overrides = {};
+    const custom = await resolveCustomBrowserValues(cfg, workflowId, tableInfo, mainValues, browserParams);
+    for (const [k, v] of Object.entries(custom)) {
+        if (k.replace(/^field/, '').endsWith('name'))
+            overrides[k] = v;
+        else
+            mainValues[normalizeFieldId(k)] = v;
+    }
+    const select = resolveSelectValues(tableInfo, mainValues);
+    for (const [k, v] of Object.entries(select)) {
+        overrides[k] = v;
+        mainValues[normalizeFieldId(k)] = v;
+    }
+    return overrides;
+}
+
+/** 明细改动行的选择框 / 浏览框规范化（显示名→ID，并补 name）。 */
+async function normalizeDetailPlan(cfg, workflowId, fieldById, plan, browserParams) {
+    const optionCache = new Map();
+    for (const t of plan?.tables ?? []) {
+        // 全量存活行都要规范化：浏览器提交时每行都会带 field<id>_<row> 与 name
+        for (const rowIndex of t.rowOrder ?? [...t.rows.keys()].sort((a, b) => a - b)) {
+            const row = t.rows.get(rowIndex);
+            for (const [fid, raw] of Object.entries(row.send ?? {})) {
+                const field = fieldById.get(String(fid));
+                if (!field)
+                    continue;
+                const value = String(raw ?? '').trim();
+                if (value === '')
+                    continue;
+                if (field.htmltype === 5) {
+                    const normalized = normalizeSelectValue(field, value);
+                    if (normalized !== undefined) {
+                        row.send[fid] = normalized;
+                        row.values[fid] = normalized;
+                    }
+                    continue;
+                }
+                if (field.htmltype !== 3)
+                    continue;
+                // 日期/时间浏览框直接填值，不做选项转换
+                if (/^\d{4}-\d{2}-\d{2}/.test(value) || /^\d{2}:\d{2}/.test(value))
+                    continue;
+                try {
+                    let opts = optionCache.get(String(fid));
+                    if (!opts) {
+                        opts = await getBrowserOptions(cfg, workflowId, String(fid), 500, undefined, {}, null, {
+                            detailtype: field.raw?.detailtype,
+                            fielddbtype: field.raw?.fielddbtype,
+                            params: browserParams,
+                        });
+                        optionCache.set(String(fid), opts);
+                    }
+                    if (!Array.isArray(opts) || opts.length === 0)
+                        continue;
+                    const rawValues = value.split(',').map((x) => x.trim()).filter(Boolean);
+                    const ids = [];
+                    const names = [];
+                    let resolvedAll = true;
+                    for (const v of rawValues) {
+                        const byId = opts.find((o) => String(o.id) === v);
+                        const sameName = opts.filter((o) => String(o.name) === v);
+                        const hit = byId ?? (sameName.length === 1 ? sameName[0] : null);
+                        if (!hit) { resolvedAll = false; break; }
+                        ids.push(String(hit.id));
+                        names.push(String(hit.name));
+                    }
+                    if (!resolvedAll)
+                        continue;
+                    row.send[fid] = ids.join(',');
+                    row.values[fid] = ids.join(',');
+                    row.names = row.names ?? {};
+                    row.names[fid] = names.join(browserNameSeparator(field));
+                }
+                catch { /* 选项解析失败不阻断提交 */ }
+            }
+        }
+    }
+}
+
+/**
+ * 明细公式：用主表当前值 + 本次改动 + 明细规划行做四则运算，
+ * 结果写回 mainValues / plan 行（并标记为改动行，确保进入提交体）。
+ */
+function applyPlanFormulas(j1, mainValues, plan) {
+    const values = {};
+    for (const [k, cell] of Object.entries(j1?.maindata ?? {})) {
+        const m = String(k).match(/^field(-?\d+)$/);
+        if (m)
+            values[m[1]] = cell?.value ?? '';
+    }
+    Object.assign(values, mainValues);
+    const details = plan.tables.map((t) => {
+        const rowIndexes = [...t.rows.keys()].sort((a, b) => a - b);
+        return { index: t.idx, rowIndexes, rows: rowIndexes.map((ri) => ({ ...t.rows.get(ri).values })) };
+    });
+    const result = applyFormulas(j1, values, details.map(({ index, rows }) => ({ index, rows })));
+    const applied = [];
+    for (const item of result.applied) {
+        const destId = String(item.dest).split('.').pop();
+        if (item.table === 'main') {
+            mainValues[destId] = item.value;
+            applied.push(item);
+            continue;
+        }
+        const idx = Number(String(item.table).replace(/^detail_/, '')) - 1;
+        const detail = details.find((x) => x.index === idx);
+        const table = plan.tables.find((x) => x.idx === idx);
+        const rowIndex = detail?.rowIndexes?.[item.row];
+        if (!table || rowIndex === undefined)
+            continue;
+        const row = table.rows.get(rowIndex);
+        row.values[destId] = item.value;
+        row.send[destId] = item.value;
+        row.changed = true;
+        table.changedRowIndexes.add(rowIndex);
+        table.changedKeys.add(`field${destId}_${rowIndex}`);
+        applied.push(item);
+    }
+    return { applied, skipped: result.skipped };
+}
+
+/** dry-run：附件字段写入占位值（不真正上传）。 */
+function applyFilePlaceholders(fileTargets, mainValues, plan) {
+    const ph = (p) => `<待上传:${String(p ?? '').split(/[\\/]/).pop() || 'file'}>`;
+    for (const target of fileTargets ?? []) {
+        const value = ph(target.filePath);
+        if (target.rowIndex === null || target.rowIndex === undefined) {
+            mainValues[target.fieldId] = value;
+            continue;
+        }
+        const idx = detailIndexFromKey(target.meta?.table);
+        const table = plan?.tables.find((x) => x.idx === idx);
+        const row = table?.rows.get(target.rowIndex);
+        if (row) {
+            row.values[target.fieldId] = value;
+            row.send[target.fieldId] = value;
+        }
+    }
+}
+
+/** 无明细规划时，把 --file 转成主表附件目标（明细附件此时应已走规划分支）。 */
+function mainFileTargets(meta, files) {
+    const out = [];
+    const seen = new Set();
+    for (const fl of files ?? []) {
+        const raw = String(fl?.fieldId ?? '').trim();
+        const m = raw.match(/^(?:field)?(\d+)$/);
+        if (!m)
+            throw new Error(`--file 字段目标非法：${raw}（主表附件应为 <字段id>=<路径>）`);
+        const fid = m[1];
+        if (seen.has(fid))
+            throw new Error(`同一附件字段重复指定文件：field${fid}（当前仅支持单文件）`);
+        seen.add(fid);
+        const field = meta.fieldById.get(fid);
+        if (!field)
+            throw new Error(`附件字段 ${fid} 不在当前表单`);
+        if (isDetailTableKey(field.table))
+            throw new Error(`明细附件必须写成 <字段id>_<行号>（如 ${fid}_0=${fl.filePath}）`);
+        if (field.htmltype !== 6)
+            throw new Error(`字段 ${field.label ?? fid}（${fid}）不是附件/图片字段（htmltype=${field.htmltype ?? '?'}）`);
+        out.push({ key: `field${fid}`, fieldId: fid, rowIndex: null, filePath: fl.filePath, meta: field });
+    }
+    return out;
+}
+
+/** 真正上传附件（全部校验通过后才调用）。 */
+async function uploadTodoFiles(cfg, prep) {
+    const targets = prep.plan?.fileTargets ?? mainFileTargets(prep.meta, prep.files);
+    for (const target of targets) {
+        const field = target.meta ?? prep.meta.fieldById.get(target.fieldId);
+        const category = field?.raw?.fileattr?.docCategory || undefined;
+        // 附件字段走 list、图片字段走 img（E9 前端按 detailtype=2 判定），不能只看扩展名
+        const listType = target.listType ?? fieldListType(field);
+        const up = await uploadFile(cfg, {
+            workflowId: String(prep.wfId ?? ''),
+            fieldId: String(target.fieldId),
+            filePath: target.filePath,
+            listType,
+            category,
+        });
+        const fileValue = uploadFieldValue(up, listType);
+        if (target.rowIndex === null || target.rowIndex === undefined) {
+            prep.mainValues[target.fieldId] = fileValue;
+            continue;
+        }
+        const idx = detailIndexFromKey(field?.table);
+        const table = prep.plan?.tables.find((x) => x.idx === idx);
+        const row = table?.rows.get(target.rowIndex);
+        if (!row)
+            throw new Error(`明细表 ${table?.key ?? ''} 第 ${target.rowIndex} 行不存在，附件无法写入`);
+        row.values[target.fieldId] = fileValue;
+        row.send[target.fieldId] = fileValue;
+        row.changed = true;
+        table.changedRowIndexes.add(target.rowIndex);
+        table.changedKeys.add(`field${target.fieldId}_${target.rowIndex}`);
+    }
+}
+/**
+ * 解析 --field-values 里的自定义浏览框(htmltype=3, detailtype=161/162)：
+ * 补 field<id>name（多选分隔符 `##~~@@~~##`），并把用户传的「显示名」规范化为选项 id。
+ * E9 前端 generateFormData 实证：该类字段提交后展示依赖 field<id>name；
+ * 只发 field<id> 会导致提交后看起来「数据为空」。
+ * 解析失败不阻断提交（保留用户原值），返回可覆盖 body 的键值。
+ */
+async function resolveCustomBrowserValues(cfg, workflowId, tableInfo, fieldValues, browserParams) {
+    const meta = new Map();
+    for (const table of Object.values(tableInfo ?? {}))
+        for (const [fid, f] of Object.entries(table?.fieldinfomap ?? {}))
+            meta.set(String(fid), f);
+    const overrides = {};
+    for (const [k, v] of Object.entries(fieldValues ?? {})) {
+        const rawKey = String(k).replace(/^field/, '');
+        const m = rawKey.match(/^(\d+)(_\d+)?$/);
+        if (!m)
+            continue;
+        const fid = m[1];
+        const suffix = m[2] ?? '';
+        const f = meta.get(fid);
+        if (!f || !isCustomBrowserField(f))
+            continue;
+        const rawValues = String(v ?? '').split(',').map((x) => x.trim()).filter(Boolean);
+        if (rawValues.length === 0)
+            continue;
+        try {
+            // 解析名称时取大页：自定义浏览框的选中项可能不在前 10/100 条
+            // metaOverride 走第 8 位（6=relateValues 7=formData 均为空）
+            const opts = await getBrowserOptions(cfg, workflowId, fid, Math.max(500, rawValues.length), undefined, {}, null, {
+                detailtype: f.detailtype,
+                fielddbtype: f.fielddbtype,
+                params: browserParams,
+            });
+            const ids = [];
+            const names = [];
+            let resolvedAll = true;
+            for (const value of rawValues) {
+                const byId = opts.find((o) => String(o.id) === value);
+                const sameName = opts.filter((o) => String(o.name) === value);
+                const hit = byId ?? (sameName.length === 1 ? sameName[0] : null);
+                if (!hit) { resolvedAll = false; break; }
+                ids.push(String(hit.id));
+                names.push(String(hit.name));
+            }
+            if (!resolvedAll)
+                continue;
+            overrides[`field${fid}${suffix}`] = ids.join(',');
+            overrides[`field${fid}${suffix}name`] = names.join(browserNameSeparator(f));
+        }
+        catch { /* 选项解析失败不阻断提交 */ }
+    }
+    return overrides;
+}
+
+/**
+ * 规范化 --field-values 里的选择框(htmltype=5)：
+ * 允许传选项显示名，按 selectattr.selectitemlist 转成 selectvalue。
+ * 不转的话服务端存的是显示名，回显时匹配不到选项 → 下拉框显示为空。
+ * 全部值都能匹配才覆盖；否则保留用户原值。
+ */
+function resolveSelectValues(tableInfo, fieldValues) {
+    const meta = new Map();
+    for (const table of Object.values(tableInfo ?? {}))
+        for (const [fid, f] of Object.entries(table?.fieldinfomap ?? {}))
+            meta.set(String(fid), f);
+    const overrides = {};
+    for (const [k, v] of Object.entries(fieldValues ?? {})) {
+        const rawKey = String(k).replace(/^field/, '');
+        const m = rawKey.match(/^(\d+)(_\d+)?$/);
+        if (!m)
+            continue;
+        const fid = m[1];
+        const suffix = m[2] ?? '';
+        const f = meta.get(fid);
+        if (!f || Number(f.htmltype) !== 5)
+            continue;
+        const normalized = normalizeSelectValue(f, v);
+        if (normalized !== undefined)
+            overrides[`field${fid}${suffix}`] = normalized;
+    }
+    return overrides;
+}
+
 /**
  * 提交待办到下一节点。POST requestOperation（iscreate=0）。
  * 两步 loadForm 拿签名（先取 wf+node，再带 wf+node 取 per-request 签名）。
@@ -8,8 +481,15 @@ import { todayStr, nowTimeStr } from './util.js';
  * 修复（P0-5）：submit_token key 旧硬编码 `1_<rid>_...`（前缀=1=sysadmin），非 sysadmin 取不到 token；
  *   改用 `p.f_weaver_belongto_userid` 动态拼 key，并兜底 `1_` 旧前缀，与 wfstart.js create 路径一致。
  */
-export async function submitTodo(cfg, opts) {
-    const { requestId } = opts;
+/**
+ * 准备待办提交（dry-run 与真提交共用）：
+ *   loadForm ×2 → 字段权限校验 → 明细 detailData/规划 → 选项规范化 → 公式。
+ * 不做任何上传，返回值可交给 buildTodoSubmitBody / uploadTodoFiles。
+ */
+export async function prepareTodoSubmission(cfg, opts) {
+    const requestId = String(opts.requestId ?? '');
+    if (!requestId)
+        throw new Error('缺少 requestId');
     const remarkText = opts.remark ?? 'OK';
     const remarkHtml = remarkText.split(/\r?\n/).map((l) => `<p>${l}</p>`).join('');
     const api = await createApiFromProfile(cfg);
@@ -20,21 +500,161 @@ export async function submitTodo(cfg, opts) {
     const sp0 = j0.submitParams ?? {};
     const wfId = String(p0.workflowid ?? '');
     const nodeId = String(p0.nodeid ?? '');
+    // ★字段属性硬规则（当前节点）：--field-values/--file/明细改动只允许动该节点可编辑的字段。
+    //   依据本次 iscreate=0 的 loadForm（处理态=当前节点字段权限）。
+    const assertEditable = (json, extra = {}) => {
+        const fv = { ...(opts.fieldValues ?? {}), ...extra };
+        if (!Object.keys(fv).length)
+            return;
+        const bad = findNonEditableFields({ tables: nodeFieldTables(json) }, fv);
+        if (bad.length)
+            throw new Error(`拒绝填写当前节点禁止编辑的字段：${bad.map((b) => `${b.label || b.id}(${b.reason}${b.currentValue ? `, 已有默认值 ${b.currentValue} 自动带出` : ''})`).join('、')}。本节点只允许修改「可编辑」字段，不得绕过节点字段权限自行填值。`);
+    };
+    assertEditable(j0);
     // 第二步 loadForm（带 wf+node）→ 拿 per-request 签名
     let p = p0;
     let sp = sp0;
+    let j1 = j0;
     if (wfId && nodeId) {
         const r1 = await api.post('/api/workflow/reqform/loadForm', { iscreate: '0', requestid: requestId, workflowid: wfId, nodeid: nodeId });
-        const j1 = r1.json ?? {};
+        j1 = r1.json ?? {};
+        // 第二次 loadForm 才是带 wf+node 的最终节点权限；再校验一次，防止两次响应权限位不一致时漏拦
+        assertEditable(j1);
         p = j1.params ?? p0;
         sp = j1.submitParams ?? sp0;
     }
+    const tableInfo = j1.tableInfo ?? j0.tableInfo ?? {};
+    const meta = collectFormMeta(j1);
+    const detailFile = parseDetailFileSpec(opts.detailFile ?? []);
+    const files = opts.files ?? [];
+    const hasDetail = hasDetailInputs(opts.fieldValues, meta.fieldById, detailFile, files);
+    let plan = null;
+    let fileTargets = [];
+
+    if (hasDetail) {
+        const detailRows = await fetchTodoDetailRows(api, { ...p, requestid: requestId }, tableInfo);
+        plan = planTodoDetails({
+            tableInfo,
+            detailRows,
+            fieldValues: opts.fieldValues ?? {},
+            detailFile,
+            files,
+        });
+        // 明细改动字段 + 附件目标同样要过当前节点字段权限
+        const extra = {};
+        for (const t of plan.tables) {
+            for (const rowIndex of t.changedRowIndexes) {
+                const row = t.rows.get(rowIndex);
+                for (const fid of Object.keys(row.send ?? {}))
+                    extra[`field${fid}_${rowIndex}`] = row.send[fid];
+            }
+        }
+        for (const target of plan.fileTargets)
+            extra[target.key] = '<file>';
+        assertEditable(j1, extra);
+        fileTargets = plan.fileTargets;
+    }
+    else if (files.length > 0) {
+        fileTargets = mainFileTargets(meta, files);
+        const extra = {};
+        for (const target of fileTargets)
+            extra[target.key] = '<file>';
+        assertEditable(j1, extra);
+    }
+
+    // 以当前主表全量值为底，再覆盖本次改动（与浏览器提交体一致，避免服务端判「数据丢失」）
+    const mainValues = currentMainValues(j1);
+    if (plan)
+        Object.assign(mainValues, plan.mainChanges);
+    else
+        Object.assign(mainValues, buildLegacyMainValues(opts.fieldValues, meta.fieldById));
+    const bodyOverrides = {};
+    const browserParams = {
+        ...p,
+        billid: String(sp.billid ?? p.billid ?? sp.formid ?? p.formid ?? ''),
+        formid: String(sp.formid ?? p.formid ?? ''),
+        isbill: String(sp.isbill ?? p.isbill ?? '1'),
+    };
+
+    // 选择框 / 浏览框规范化（主表 + 明细改动行）
+    if (plan) {
+        Object.assign(bodyOverrides, await normalizeMainValues(cfg, wfId, tableInfo, mainValues, browserParams));
+        await normalizeDetailPlan(cfg, wfId, meta.fieldById, plan, browserParams);
+    }
+    else {
+        const custom = await resolveCustomBrowserValues(cfg, wfId, tableInfo, opts.fieldValues ?? {}, browserParams);
+        const select = resolveSelectValues(tableInfo, opts.fieldValues ?? {});
+        Object.assign(bodyOverrides, custom, select);
+        for (const [k, v] of Object.entries(custom)) {
+            const id = normalizeFieldId(k);
+            if (!id.endsWith('name') && !id.includes('_'))
+                mainValues[id] = v;
+        }
+        for (const [k, v] of Object.entries(select)) {
+            const id = normalizeFieldId(k);
+            if (!id.includes('_'))
+                mainValues[id] = v;
+        }
+    }
+
+    // 公式字段
+    const formula = { applied: [], skipped: [] };
+    if (plan) {
+        const result = applyPlanFormulas(j1, mainValues, plan);
+        formula.applied.push(...result.applied);
+        formula.skipped.push(...result.skipped);
+    }
+    else {
+        const result = buildTodoFormulaOverrides(j0, opts.fieldValues ?? {});
+        formula.applied.push(...result.result.applied);
+        formula.skipped.push(...result.result.skipped);
+        for (const [k, v] of Object.entries(result.overrides ?? {})) {
+            bodyOverrides[k] = v;
+            const id = normalizeFieldId(k);
+            if (!id.includes('_'))
+                mainValues[id] = v;
+        }
+    }
+
+    if (opts.preview)
+        applyFilePlaceholders(fileTargets, mainValues, plan);
+
+    // existChangeRange 只记本次改动，不包含为通过完整性校验而全量重发的原值
+    const changedMain = new Set();
+    if (plan) {
+        for (const k of plan.changedMainKeys)
+            changedMain.add(k);
+    }
+    else {
+        for (const k of Object.keys(opts.fieldValues ?? {})) {
+            if (!isDetailValueKey(k, meta.fieldById))
+                changedMain.add(`field${normalizeFieldId(k)}`);
+        }
+    }
+    for (const target of fileTargets) {
+        if (target.rowIndex === null)
+            changedMain.add(target.key);
+    }
+    for (const item of formula.applied) {
+        if (item.table === 'main')
+            changedMain.add(`field${String(item.dest).split('.').pop()}`);
+    }
+
+    return {
+        api, requestId, remarkText, remarkHtml, j0, j1, p, sp, wfId, nodeId,
+        tableInfo, meta, plan, mainValues, bodyOverrides, files, fileTargets,
+        formula, changedMainKeys: [...changedMain], warnings: plan?.warnings ?? [],
+    };
+}
+
+/** 构造 requestOperation 提交体（不含上传；附件真实 id 由 uploadTodoFiles 写入）。 */
+export function buildTodoSubmitBody(prep) {
+    const { requestId, remarkHtml, j0, p, sp, mainValues, bodyOverrides, plan, wfId, nodeId } = prep;
     const userId = String(p.f_weaver_belongto_userid ?? '1');
     // submit_token：loadForm 的 submitParams 对部分待办不返回 token（实跑发现 node 5967 待办没有），
     //   E9 校验的是"客户端现生成的较新时间戳"防重复提交；故用 Date.now() 现生成，兜底 loadForm 值。
     const submitTokenKey = `${userId}_${requestId}_request_submit_token`;
     const submitToken = String(sp[submitTokenKey] ?? sp[`1_${requestId}_request_submit_token`] ?? Date.now());
-    // 构造提交体
     // 从 signatureAttributesStr 解码提取 lastOperateDate 等运行时字段
     const sigDecoded = Buffer.from(String(p.signatureAttributesStr ?? ''), 'base64').toString('utf8');
     const lastOpDate = (sigDecoded.match(/lastOperateDate=([^|]*)/)?.[1] ?? '').trim();
@@ -102,9 +722,10 @@ export async function submitTodo(cfg, opts) {
         currentdate: todayStrVal,
         // ★ 0.5.1 修复：submit 必须带 needwfback。E9 bundle 实证：
         //   doSubmitBack()→needwfback:"1"（提交后流程退回当前节点）、doSubmitNoBack()→needwfback:"0"（正常流转）。
-        //   旧 body 缺此字段时服务端把"提交"当不流转处理（停在原节点）。
-        //   取 loadForm 回传值兜底 '0'（默认不回退=正常流转到下一节点）。
-        needwfback: String(sp.needwfback === undefined || sp.needwfback === null ? '0' : sp.needwfback),
+        //   loadForm 可能回传空串（674 实测），空串按未返回处理，兜底 '0'（正常流转到下一节点）。
+        needwfback: String(sp.needwfback === undefined || sp.needwfback === null || sp.needwfback === ''
+            ? (p.needwfback === undefined || p.needwfback === null || p.needwfback === '' ? '0' : p.needwfback)
+            : sp.needwfback),
         remark: remarkHtml,
         'field-annexupload': '',
         signdocids: '',
@@ -134,17 +755,36 @@ export async function submitTodo(cfg, opts) {
         openDataVerify: '0',
         wfTestStr: '',
     };
-    // 修改字段值（可选）
-    if (opts.fieldValues) {
-        let count = 0;
-        for (const [k, v] of Object.entries(opts.fieldValues)) {
-            const id = k.startsWith('field') ? k.replace(/^field/, '') : k;
-            body[`field${id}`] = v;
-            count++;
-        }
-        body.mainFieldUnEmptyCount = String(count);
+    // 主表字段值（不发送 null 占位；附件真实 id 已在上传后写入 mainValues）
+    for (const [key, value] of Object.entries(mainValues ?? {})) {
+        if (value === undefined || value === null)
+            continue;
+        const id = key.startsWith('field') ? key.slice('field'.length) : key;
+        body[`field${id}`] = value;
+    }
+    // 自定义浏览框 name / 选择框规范化 / 旧路径公式覆盖
+    Object.assign(body, bodyOverrides ?? {});
+    // 明细行控制 + 改动行字段
+    if (plan) {
+        Object.assign(body, buildDetailBodyKeys(plan));
+        body.detailFieldUnEmptyCount = String(countDetailUnEmpty(plan));
     }
-    return api.post('/api/workflow/reqform/requestOperation', body);
+    body.mainFieldUnEmptyCount = String(countMainUnEmpty(j0?.maindata, mainValues));
+    const changed = [
+        ...(prep.changedMainKeys ?? []),
+        ...(plan?.changedDetailKeys ?? []),
+    ];
+    body.existChangeRange = [...new Set(changed)].join(',');
+    return body;
+}
+
+/** 提交待办：准备 → （全部校验通过后）上传附件 → 构造 body → requestOperation。 */
+export async function submitTodo(cfg, opts) {
+    const prep = await prepareTodoSubmission(cfg, opts);
+    if ((prep.fileTargets ?? []).length > 0)
+        await uploadTodoFiles(cfg, prep);
+    const body = buildTodoSubmitBody(prep);
+    return prep.api.post('/api/workflow/reqform/requestOperation', body);
 }
 async function readMineListEvidence(cfg, requestId, before = {}) {
     const query = {