@gadmin2n/schematics 0.0.139 → 0.0.141

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/workflow/workflow.service.ts

@@ -1,4 +1,3 @@
-import { validateDslHandles } from '@gadmin2n/nest-common/workflow-dsl';
 import {
   BadRequestException,
   Injectable,
@@ -8,9 +7,19 @@ import {
 } from '@nestjs/common';
 import { Prisma } from '@prisma/client';
 import { PrismaService } from 'nestjs-prisma';
+import { HumanApprovalService } from '../humanApproval/human-approval.service';
 import { validateDslGraph } from './dsl-validate.util';
 import { TemporalService } from './temporal.service';
 import { verifyWebhookSignature } from './webhook-signature.util';
+import { describeCallableWorkflow } from './workflow-callable';
+import { WorkflowCompilerService } from './workflow-compiler.service';
+import { DraftWorkflowDsl } from './workflow-compiler.types';
+import { validateWorkflowDataEdges } from './workflow-data-edge.util';
+import { areWorkflowDslSourcesEqual } from './workflow-dsl-comparison';
+import {
+  NodeOutputsMap,
+  validateWorkflowHandles,
+} from './workflow-handle-validator';
 
 @Injectable()
 export class WorkflowService {
@@ -19,6 +28,8 @@ export class WorkflowService {
   constructor(
     private prisma: PrismaService,
     private temporalService: TemporalService,
+    private humanApprovalService: HumanApprovalService,
+    private workflowCompiler: WorkflowCompilerService,
   ) {}
 
   /**
@@ -37,9 +48,14 @@ export class WorkflowService {
    * Find all webhook_trigger configs in a DSL.
    * Each entry includes path + method; used for collision detection on publish.
    */
-  private extractWebhookConfigs(
-    dsl: any,
-  ): Array<{ path: string; method: string; secret?: string }> {
+  private extractWebhookConfigs(dsl: any): Array<{
+    path: string;
+    method: string;
+    secret?: string;
+    verificationMode: 'HMAC' | 'NONE';
+    responseMode: 'IMMEDIATE' | 'WAIT_FOR_RESULT';
+    responseTimeoutSeconds: number;
+  }> {
     if (!Array.isArray(dsl?.nodes)) return [];
     return dsl.nodes
       .filter(
@@ -50,6 +66,18 @@ export class WorkflowService {
         path: n.config.path,
         method: n.config.method,
         secret: n.config.secret,
+        verificationMode:
+          n.config.verificationMode === 'NONE' ? 'NONE' : 'HMAC',
+        responseMode:
+          n.config.responseMode === 'WAIT_FOR_RESULT'
+            ? 'WAIT_FOR_RESULT'
+            : 'IMMEDIATE',
+        responseTimeoutSeconds:
+          Number.isInteger(n.config.responseTimeoutSeconds) &&
+          n.config.responseTimeoutSeconds >= 1 &&
+          n.config.responseTimeoutSeconds <= 300
+            ? n.config.responseTimeoutSeconds
+            : 60,
       }));
   }
 
@@ -142,6 +170,87 @@ export class WorkflowService {
     return { items: enrichedItems, total };
   }
 
+  async findCallableWorkflows(resultType = 'APPROVAL_SUBJECTS') {
+    const workflows = await this.prisma.workflow.findMany({
+      where: { status: 'PUBLISHED', isEnabled: true },
+      orderBy: { name: 'asc' },
+      include: {
+        versions: {
+          orderBy: { version: 'desc' },
+          take: 1,
+          select: { dsl: true },
+        },
+      },
+    });
+    return workflows.flatMap((workflow) => {
+      try {
+        const descriptor = describeCallableWorkflow(workflow.versions[0]?.dsl);
+        if (
+          !descriptor ||
+          descriptor.mode !== 'RETURN' ||
+          descriptor.resultType !== resultType
+        )
+          return [];
+        return [
+          {
+            id: String(workflow.id),
+            name: workflow.name,
+            description: workflow.description,
+            inputParameters: descriptor.inputParameters,
+            resultType: descriptor.resultType,
+          },
+        ];
+      } catch {
+        return [];
+      }
+    });
+  }
+
+  async findExternalInteractionOptions() {
+    const workflows = await this.prisma.workflow.findMany({
+      where: { status: 'PUBLISHED', isEnabled: true },
+      orderBy: { name: 'asc' },
+      include: {
+        versions: {
+          orderBy: { version: 'desc' },
+          take: 1,
+          select: { dsl: true },
+        },
+      },
+    });
+    const dispatchWorkflows: Array<{ id: string; name: string }> = [];
+    const callbackWorkflows: Array<{ id: string; name: string }> = [];
+    for (const workflow of workflows) {
+      const dsl = workflow.versions[0]?.dsl;
+      try {
+        if (describeCallableWorkflow(dsl)?.mode === 'ONE_WAY') {
+          dispatchWorkflows.push({
+            id: String(workflow.id),
+            name: workflow.name,
+          });
+        }
+      } catch {
+        // Invalid callable Workflows are not selectable.
+      }
+      const nodes =
+        dsl &&
+        typeof dsl === 'object' &&
+        !Array.isArray(dsl) &&
+        Array.isArray((dsl as { nodes?: unknown }).nodes)
+          ? (dsl as { nodes: Array<{ type?: string }> }).nodes ?? []
+          : [];
+      if (
+        nodes.filter((node) => node.type === 'webhook_trigger').length === 1
+      ) {
+        callbackWorkflows.push({
+          id: String(workflow.id),
+          name: workflow.name,
+        });
+      }
+    }
+    return { dispatchWorkflows, callbackWorkflows };
+  }
+
   async findOne(id: bigint) {
     const workflow = await this.prisma.workflow.findUnique({
       where: { id },
@@ -179,11 +288,25 @@ export class WorkflowService {
   }
 
   async saveDraft(id: bigint, dsl: any) {
-    const workflow = await this.prisma.workflow.findUnique({ where: { id } });
+    const workflow = await this.prisma.workflow.findUnique({
+      where: { id },
+      include: {
+        versions: {
+          orderBy: { version: 'desc' },
+          take: 1,
+          select: { dsl: true },
+        },
+      },
+    });
     if (!workflow) throw new NotFoundException('Workflow not found');
+    const latestPublishedDsl = workflow.versions?.[0]?.dsl;
+    const status =
+      latestPublishedDsl && areWorkflowDslSourcesEqual(dsl, latestPublishedDsl)
+        ? 'PUBLISHED'
+        : 'DRAFT';
     return this.prisma.workflow.update({
       where: { id },
-      data: { dsl, status: 'DRAFT' },
+      data: { dsl, status },
     });
   }
 
@@ -228,7 +351,29 @@ export class WorkflowService {
       );
     }
 
-    return this.prisma.workflow.delete({ where: { id } });
+    return this.prisma.$transaction(async (tx) => {
+      const interactions = await tx.externalInteraction.findMany({
+        where: {
+          OR: [
+            { workflowInstance: { workflowId: id } },
+            { workflowVersion: { workflowId: id } },
+          ],
+        },
+        select: { id: true },
+      });
+      const interactionIds = interactions.map((interaction) => interaction.id);
+
+      if (interactionIds.length) {
+        const where = { interactionId: { in: interactionIds } };
+        await tx.externalInteractionSignalOutbox.deleteMany({ where });
+        await tx.externalInteractionEvent.deleteMany({ where });
+        await tx.externalInteraction.deleteMany({
+          where: { id: { in: interactionIds } },
+        });
+      }
+
+      return tx.workflow.delete({ where: { id } });
+    });
   }
 
   async getVersions(workflowId: bigint) {
@@ -261,22 +406,34 @@ export class WorkflowService {
   ) {
     const workflow = await this.prisma.workflow.findUnique({
       where: { id: workflowId },
+      include: {
+        versions: {
+          orderBy: { version: 'desc' },
+          take: 1,
+          select: { dsl: true },
+        },
+      },
     });
     if (!workflow) throw new NotFoundException('Workflow not found');
 
     // Use workflow.dsl if available; otherwise fall back to latest version's DSL
     let dslToPublish = workflow.dsl;
     if (!dslToPublish) {
-      const latestVersion = await this.prisma.workflowVersion.findFirst({
-        where: { workflowId },
-        orderBy: { version: 'desc' },
-        select: { dsl: true },
-      });
-      dslToPublish = latestVersion?.dsl ?? null;
+      dslToPublish = workflow.versions?.[0]?.dsl ?? null;
     }
     if (!dslToPublish) {
       throw new NotFoundException('No draft DSL to publish');
     }
+    const latestPublishedDsl = workflow.versions?.[0]?.dsl;
+    if (
+      latestPublishedDsl &&
+      areWorkflowDslSourcesEqual(dslToPublish, latestPublishedDsl)
+    ) {
+      throw new BadRequestException({
+        code: 'WORKFLOW_DSL_UNCHANGED',
+        message: '保存后的 Workflow DSL 与最新发布版本相同，无需再次发布',
+      });
+    }
 
     // Structural + cycle validation. Reject malformed/cyclic DSL up-front so the
     // worker's executeGraph never has to deal with them at runtime.
@@ -286,11 +443,38 @@ export class WorkflowService {
       throw new BadRequestException(`Invalid DSL: ${err?.message ?? err}`);
     }
 
-    // Per-edge sourceHandle validation against node-type outputs declared in
-    // @gadmin2n/nest-common (NODE_TYPE_META). nest-common is the single source
-    // of truth for handle metadata; the seeded t_workflow_node_type.outputs
-    // column mirrors it (verified at seed time in workflow-node-types.ts).
-    const handleErrors = validateDslHandles(dslToPublish as any);
+    // Validate source handles against the same node-type metadata consumed by
+    // the canvas. This also supports project-specific node types and output
+    // declarations without requiring a nest-common release.
+    const handleDsl = dslToPublish as any;
+    const nodeTypes = await this.prisma.workflowNodeType.findMany({
+      select: { type: true, outputs: true },
+    });
+    const outputsMap = Object.fromEntries(
+      nodeTypes.map((nodeType) => [
+        nodeType.type,
+        nodeType.outputs === null
+          ? null
+          : Array.isArray(nodeType.outputs)
+          ? nodeType.outputs.filter(
+              (output): output is string => typeof output === 'string',
+            )
+          : [],
+      ]),
+    ) as NodeOutputsMap;
+    const handleErrors = validateWorkflowHandles(
+      {
+        ...handleDsl,
+        edges: (handleDsl.edges ?? [])
+          .filter((edge: any) => !edge.kind || edge.kind === 'FLOW')
+          .map((edge: any) =>
+            ['response-out', 'result-out'].includes(edge.sourceHandle)
+              ? { ...edge, sourceHandle: undefined }
+              : edge,
+          ),
+      },
+      outputsMap,
+    );
     if (handleErrors.length > 0) {
       throw new BadRequestException({
         message: 'DSL validation failed: invalid edge sourceHandle(s)',
@@ -299,21 +483,43 @@ export class WorkflowService {
       });
     }
 
+    const compiledDsl = await this.workflowCompiler.compile(
+      dslToPublish as unknown as DraftWorkflowDsl,
+      { userId: creator, username: creator },
+    );
+    try {
+      validateWorkflowDataEdges(compiledDsl as any);
+    } catch (error) {
+      throw new BadRequestException(
+        `Invalid node dependency: ${
+          error instanceof Error ? error.message : error
+        }`,
+      );
+    }
+
     // Validate webhook path collisions across other published workflows
-    const webhookConfigs = this.extractWebhookConfigs(dslToPublish);
+    const webhookConfigs = this.extractWebhookConfigs(compiledDsl);
     if (webhookConfigs.length > 0) {
       const otherPublished = await this.prisma.workflow.findMany({
         where: { status: 'PUBLISHED', id: { not: workflowId } },
-        select: { id: true, name: true, dsl: true },
+        select: {
+          id: true,
+          name: true,
+          versions: {
+            orderBy: { version: 'desc' },
+            take: 1,
+            select: { dsl: true },
+          },
+        },
       });
       for (const cfg of webhookConfigs) {
-        if (!cfg.secret) {
+        if (cfg.verificationMode === 'HMAC' && !cfg.secret) {
           throw new Error(
             `webhook_trigger path="${cfg.method} ${cfg.path}" requires a secret (HMAC strict mode)`,
           );
         }
         const conflict = otherPublished.find((w) =>
-          this.extractWebhookConfigs(w.dsl).some(
+          this.extractWebhookConfigs(w.versions[0]?.dsl).some(
             (other) => other.path === cfg.path && other.method === cfg.method,
           ),
         );
@@ -337,7 +543,7 @@ export class WorkflowService {
         data: {
           workflowId,
           version: nextVersion,
-          dsl: dslToPublish,
+          dsl: compiledDsl as unknown as Prisma.InputJsonValue,
           prompt: data.changeSummary,
           changeSummary: data.changeSummary,
           creator,
@@ -349,17 +555,34 @@ export class WorkflowService {
         data: { status: 'PUBLISHED' },
       });
 
+      await tx.audit.create({
+        data: {
+          creator,
+          authorName: creator,
+          action: 'PUBLISH_WORKFLOW_VERSION',
+          resource: 'workflow',
+          resourceId: String(workflowId),
+          data: JSON.stringify({
+            workflowVersionId: String(version.id),
+            version: nextVersion,
+            configHashes: compiledDsl.nodes.flatMap((node) =>
+              node.source?.configHash ? [node.source.configHash] : [],
+            ),
+          }),
+        },
+      });
+
       return version;
     });
 
     // Cron schedule lifecycle: register/update if cron_trigger present, delete otherwise
-    const cronConfig = this.extractCronConfig(dslToPublish);
+    const cronConfig = this.extractCronConfig(result.dsl);
     try {
       if (cronConfig) {
         await this.temporalService.upsertCronSchedule({
           workflowId: Number(workflowId),
           versionId: Number(result.id),
-          dsl: dslToPublish,
+          dsl: result.dsl,
           cron: cronConfig.cron,
           timezone: cronConfig.timezone,
         });
@@ -498,7 +721,11 @@ export class WorkflowService {
 
   async executeWorkflow(
     workflowId: bigint,
-    dto: { context?: Record<string, any>; versionId?: number },
+    dto: {
+      workflow?: Record<string, any>;
+      versionId?: number;
+      workflowVersionId?: bigint;
+    },
     creator: string,
     temporalService: any,
   ) {
@@ -523,7 +750,11 @@ export class WorkflowService {
 
     // Determine which version to use
     let version;
-    if (dto.versionId) {
+    if (dto.workflowVersionId) {
+      version = await this.prisma.workflowVersion.findFirst({
+        where: { id: dto.workflowVersionId, workflowId },
+      });
+    } else if (dto.versionId) {
       version = await this.prisma.workflowVersion.findFirst({
         where: { workflowId, version: dto.versionId },
       });
@@ -533,13 +764,15 @@ export class WorkflowService {
 
     if (!version) throw new NotFoundException('No published version found');
 
+    const executionContext = createWorkflowExecutionState(dto.workflow);
+
     // Create a WorkflowInstance record
     const instance = await this.prisma.workflowInstance.create({
       data: {
         workflowId,
         versionId: version.id,
         status: 'PENDING',
-        context: dto.context || {},
+        context: executionContext,
         creator,
       },
     });
@@ -550,7 +783,7 @@ export class WorkflowService {
       workflowId: Number(workflowId),
       versionId: Number(version.id),
       dsl: version.dsl,
-      context: dto.context || {},
+      context: executionContext,
     });
 
     // Update instance with Temporal run ID
@@ -562,14 +795,15 @@ export class WorkflowService {
     return {
       instanceId: instance.id.toString(),
       temporalRunId,
+      workflowVersionId: version.id.toString(),
       status: 'PENDING',
     };
   }
 
   /**
    * Webhook trigger entry point. Looks up published workflows whose DSL contains a
-   * webhook_trigger node matching (path, method), verifies HMAC signature against
-   * each match's secret, and starts a workflow instance per verified match.
+   * webhook_trigger node matching (path, method), applies the trigger's configured
+   * request verification, and starts a workflow instance per accepted match.
    *
    * Returns the list of created instance IDs. Throws:
    * - NotFoundException when no published workflow listens on this path/method
@@ -584,20 +818,16 @@ export class WorkflowService {
     body: any;
     headers: Record<string, any>;
     query: Record<string, any>;
-  }): Promise<{ instanceIds: string[] }> {
-    // 1) Timestamp window — reject stale requests (±5 min)
-    const tsMs = Number(input.timestampHeader) * 1000;
-    if (
-      !input.timestampHeader ||
-      !Number.isFinite(tsMs) ||
-      Math.abs(Date.now() - tsMs) > 5 * 60 * 1000
-    ) {
-      throw new UnauthorizedException(
-        'Invalid or expired X-Workflow-Timestamp',
-      );
-    }
-
-    // 2) Lookup matching published + enabled workflows
+  }): Promise<{
+    instanceIds: string[];
+    response?: {
+      statusCode: number;
+      headers: Record<string, string>;
+      body: unknown;
+    };
+  }> {
+    // 1) Lookup matching published + enabled workflows. Verification is configured
+    // per trigger, so the matching trigger must be known before headers are checked.
     const published = await this.prisma.workflow.findMany({
       where: { status: 'PUBLISHED', isEnabled: true },
       include: {
@@ -609,23 +839,30 @@ export class WorkflowService {
       workflowId: bigint;
       versionId: bigint;
       dsl: any;
-      secret: string;
+      secret?: string;
+      verificationMode: 'HMAC' | 'NONE';
+      responseMode: 'IMMEDIATE' | 'WAIT_FOR_RESULT';
+      responseTimeoutSeconds: number;
     };
     const matches: Match[] = [];
     for (const wf of published) {
       const version = wf.versions[0];
-      const dsl = version?.dsl ?? wf.dsl;
-      if (!dsl) continue;
+      if (!version) continue;
+      const dsl = version.dsl;
       const cfgs = this.extractWebhookConfigs(dsl);
       const cfg = cfgs.find(
         (c) => c.path === input.path && c.method === input.method,
       );
-      if (!cfg || !cfg.secret) continue;
+      if (!cfg) continue;
+      if (cfg.verificationMode === 'HMAC' && !cfg.secret) continue;
       matches.push({
         workflowId: wf.id,
-        versionId: version?.id ?? wf.id,
+        versionId: version.id,
         dsl,
         secret: cfg.secret,
+        verificationMode: cfg.verificationMode,
+        responseMode: cfg.responseMode,
+        responseTimeoutSeconds: cfg.responseTimeoutSeconds,
       });
     }
 
@@ -635,10 +872,26 @@ export class WorkflowService {
       );
     }
 
-    // 3) Verify HMAC against each match's secret. Strict mode: every match must verify.
-    for (const m of matches) {
+    // 2) Preserve strict HMAC verification for existing triggers. A missing
+    // verificationMode is normalized to HMAC by extractWebhookConfigs.
+    const signedMatches = matches.filter(
+      (match) => match.verificationMode === 'HMAC',
+    );
+    if (signedMatches.length > 0) {
+      const tsMs = Number(input.timestampHeader) * 1000;
+      if (
+        !input.timestampHeader ||
+        !Number.isFinite(tsMs) ||
+        Math.abs(Date.now() - tsMs) > 5 * 60 * 1000
+      ) {
+        throw new UnauthorizedException(
+          'Invalid or expired X-Workflow-Timestamp',
+        );
+      }
+    }
+    for (const m of signedMatches) {
       const ok = verifyWebhookSignature(
-        m.secret,
+        m.secret!,
         input.timestampHeader!,
         input.rawBody,
         input.signatureHeader,
@@ -648,8 +901,8 @@ export class WorkflowService {
       }
     }
 
-    // 4) Trigger executions in parallel
-    const context = {
+    // 3) Trigger executions in parallel
+    const workflowData = {
       headers: input.headers,
       query: input.query,
       body: input.body,
@@ -659,21 +912,82 @@ export class WorkflowService {
       matches.map((m) =>
         this.executeWorkflow(
           m.workflowId,
-          { context },
+          { workflow: workflowData, workflowVersionId: m.versionId },
           'webhook',
           this.temporalService,
         ),
       ),
     );
 
-    return { instanceIds: results.map((r) => r.instanceId) };
+    const instanceIds = results.map((result) => result.instanceId);
+    const waitingIndex = matches.findIndex(
+      (match) => match.responseMode === 'WAIT_FOR_RESULT',
+    );
+    if (waitingIndex === -1) return { instanceIds };
+
+    const match = matches[waitingIndex];
+    const execution = results[waitingIndex];
+    try {
+      const waited = await this.temporalService.waitForWorkflowResult(
+        execution.temporalRunId,
+        match.responseTimeoutSeconds * 1000,
+      );
+      if (waited.kind === 'TIMED_OUT') {
+        return {
+          instanceIds,
+          response: {
+            statusCode: 504,
+            headers: {},
+            body: {
+              code: 'WORKFLOW_RESPONSE_TIMEOUT',
+              message: `Workflow did not return a result within ${match.responseTimeoutSeconds} seconds`,
+              instanceId: execution.instanceId,
+            },
+          },
+        };
+      }
+
+      const workflowResult = asRecord(waited.result);
+      if (
+        workflowResult.status !== 'COMPLETED' ||
+        !Object.prototype.hasOwnProperty.call(workflowResult, 'output')
+      ) {
+        throw new Error('Workflow completed without a return result');
+      }
+      const httpResponse = asRecord(workflowResult.httpResponse);
+      return {
+        instanceIds,
+        response: {
+          statusCode: normalizeHttpStatusCode(httpResponse.statusCode),
+          headers: normalizeHttpHeaders(httpResponse.headers),
+          body: workflowResult.output,
+        },
+      };
+    } catch (error) {
+      this.logger.error(
+        `Workflow ${execution.instanceId} failed while waiting for an HTTP response`,
+        error instanceof Error ? error.stack : String(error),
+      );
+      return {
+        instanceIds,
+        response: {
+          statusCode: 500,
+          headers: {},
+          body: {
+            code: 'WORKFLOW_EXECUTION_FAILED',
+            message: 'Workflow execution failed',
+            instanceId: execution.instanceId,
+          },
+        },
+      };
+    }
   }
 
   async getInstanceDetail(instanceId: bigint) {
     const instance = await this.prisma.workflowInstance.findUnique({
       where: { id: instanceId },
       include: {
-        workflow: { select: { name: true, dsl: true } },
+        workflow: { select: { name: true } },
         nodeExecutions: {
           orderBy: { createdAt: 'asc' },
         },
@@ -692,11 +1006,6 @@ export class WorkflowService {
       dsl = version?.dsl || null;
     }
 
-    // Fallback: use DSL from the workflow itself
-    if (!dsl && instance.workflow.dsl) {
-      dsl = instance.workflow.dsl;
-    }
-
     return {
       ...instance,
       workflow: { name: instance.workflow.name },
@@ -740,12 +1049,18 @@ export class WorkflowService {
       throw new Error('Can only retry FAILED instances');
     }
 
-    // Create a new instance with the same context
+    const executionState = instance.context as Record<string, any>;
+    // Create a new instance with the same immutable Workflow data.
     return this.executeWorkflow(
       instance.workflowId,
       {
-        context: instance.context as Record<string, any>,
-        versionId: undefined,
+        workflow:
+          executionState.workflow &&
+          typeof executionState.workflow === 'object' &&
+          !Array.isArray(executionState.workflow)
+            ? executionState.workflow
+            : {},
+        workflowVersionId: instance.versionId,
       },
       creator,
       temporalService,
@@ -778,34 +1093,55 @@ export class WorkflowService {
     instanceId: bigint,
     dto: { nodeId: string; approved: boolean; comment?: string },
     approverId: string,
-    temporalService: any,
+    _temporalService: any,
   ) {
-    const instance = await this.prisma.workflowInstance.findUnique({
-      where: { id: instanceId },
+    const request = await this.prisma.approvalRequest.findUnique({
+      where: {
+        workflowInstanceId_nodeId: {
+          workflowInstanceId: instanceId,
+          nodeId: dto.nodeId,
+        },
+      },
     });
-    if (!instance) throw new NotFoundException('Instance not found');
-    if (!instance.temporalRunId) {
-      throw new Error('Instance has no Temporal run ID');
+    if (!request || request.status !== 'PENDING') {
+      throw new NotFoundException('Open approval request not found');
     }
+    return this.humanApprovalService.submitDecision(
+      request.id,
+      { decision: dto.approved ? 'APPROVE' : 'REJECT', comment: dto.comment },
+      { userId: approverId },
+    );
+  }
+}
 
-    const nodeExecution = await this.prisma.workflowNodeExecution.findUnique({
-      where: { instanceId_nodeId: { instanceId, nodeId: dto.nodeId } },
-    });
-    if (!nodeExecution) throw new NotFoundException('Node execution not found');
+function createWorkflowExecutionState(
+  value: Record<string, any> | undefined,
+): Record<string, any> {
+  return {
+    workflow: value ?? {},
+    nodes: {},
+  };
+}
 
-    const approvers: string[] = (nodeExecution.input as any)?.approvers || [];
-    if (!approvers.includes(approverId)) {
-      throw new UnauthorizedException(
-        `${approverId} is not an approver for this node`,
-      );
-    }
+function asRecord(value: unknown): Record<string, unknown> {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : {};
+}
 
-    await temporalService.signalWorkflow(instance.temporalRunId, 'approval', {
-      nodeId: dto.nodeId,
-      approved: dto.approved,
-      approvedBy: approverId,
-      comment: dto.comment,
-    });
-    return { success: true };
-  }
+function normalizeHttpStatusCode(value: unknown): number {
+  return typeof value === 'number' &&
+    Number.isInteger(value) &&
+    value >= 100 &&
+    value <= 599
+    ? value
+    : 200;
+}
+
+function normalizeHttpHeaders(value: unknown): Record<string, string> {
+  return Object.fromEntries(
+    Object.entries(asRecord(value)).filter(
+      (entry): entry is [string, string] => typeof entry[1] === 'string',
+    ),
+  );
 }