@gadmin2n/schematics 0.0.144 → 0.0.145

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/workflow/workflow.service.spec.ts

@@ -11,17 +11,21 @@ describe('WorkflowService — cron lifecycle hooks', () => {
   let service: WorkflowService;
   let prisma: any;
   let temporal: any;
+  let compiler: any;
 
   beforeEach(async () => {
     prisma = {
       workflow: {
         findUnique: jest.fn(),
+        findUniqueOrThrow: jest.fn(),
         update: jest.fn(),
+        updateMany: jest.fn().mockResolvedValue({ count: 1 }),
         delete: jest.fn(),
         findMany: jest.fn(),
       },
       workflowVersion: {
         findFirst: jest.fn(),
+        findMany: jest.fn().mockResolvedValue([]),
         create: jest.fn(),
       },
       workflowNodeType: {
@@ -30,12 +34,19 @@ describe('WorkflowService — cron lifecycle hooks', () => {
           { type: 'manual_trigger', outputs: [] },
           { type: 'webhook_trigger', outputs: [] },
           { type: 'http_request', outputs: [] },
+          { type: 'code', outputs: [] },
           { type: 'if_else', outputs: ['true', 'false'] },
           { type: 'switch', outputs: null },
           { type: 'approval', outputs: ['true', 'false'] },
           { type: 'custom_branch', outputs: ['success', 'failure'] },
         ]),
       },
+      workflowNodeInstance: {
+        findMany: jest.fn().mockResolvedValue([]),
+      },
+      workflowInstance: {
+        count: jest.fn().mockResolvedValue(0),
+      },
       externalInteraction: {
         findMany: jest.fn().mockResolvedValue([]),
         deleteMany: jest.fn(),
@@ -44,17 +55,31 @@ describe('WorkflowService — cron lifecycle hooks', () => {
       externalInteractionSignalOutbox: { deleteMany: jest.fn() },
       $transaction: jest.fn(async (cb: any) =>
         cb({
+          $queryRaw: jest.fn().mockImplementation(async () => [
+            {
+              isEnabled:
+                prisma.workflow.updateMany.mock.calls.at(-1)?.[0]?.data
+                  ?.isEnabled ?? true,
+              status: 'PUBLISHED',
+            },
+          ]),
           workflowVersion: {
             findFirst: prisma.workflowVersion.findFirst,
+            findMany: prisma.workflowVersion.findMany,
             create: async (args: any) => ({
               ...(await prisma.workflowVersion.create(args)),
               dsl: args.data.dsl,
             }),
           },
           workflow: {
+            findUnique: prisma.workflow.findUnique,
+            findUniqueOrThrow: prisma.workflow.findUniqueOrThrow,
             update: prisma.workflow.update,
+            updateMany: prisma.workflow.updateMany,
             delete: prisma.workflow.delete,
+            findMany: prisma.workflow.findMany,
           },
+          workflowInstance: prisma.workflowInstance,
           externalInteraction: prisma.externalInteraction,
           externalInteractionEvent: prisma.externalInteractionEvent,
           externalInteractionSignalOutbox:
@@ -63,12 +88,18 @@ describe('WorkflowService — cron lifecycle hooks', () => {
         }),
       ),
     };
+    prisma.workflow.findUniqueOrThrow.mockImplementation((args: any) =>
+      prisma.workflow.findUnique(args),
+    );
     temporal = {
       upsertCronSchedule: jest.fn(),
       pauseCronSchedule: jest.fn(),
       unpauseCronSchedule: jest.fn(),
       deleteCronSchedule: jest.fn(),
+      getCronScheduleStatus: jest.fn().mockResolvedValue('ACTIVE'),
+      inspectWorkflow: jest.fn(),
     };
+    compiler = { compile: jest.fn(async (dsl: any) => dsl) };
 
     const module: TestingModule = await Test.createTestingModule({
       providers: [
@@ -76,10 +107,7 @@ describe('WorkflowService — cron lifecycle hooks', () => {
         { provide: PrismaService, useValue: prisma },
         { provide: TemporalService, useValue: temporal },
         { provide: HumanApprovalService, useValue: {} },
-        {
-          provide: WorkflowCompilerService,
-          useValue: { compile: jest.fn(async (dsl: any) => dsl) },
-        },
+        { provide: WorkflowCompilerService, useValue: compiler },
       ],
     }).compile();
 
@@ -119,21 +147,24 @@ describe('WorkflowService — cron lifecycle hooks', () => {
       edges: [],
     };
 
-    it('keeps a saved workflow published when its DSL matches the latest version', async () => {
+    it('uses the locked latest version when a first publication races with saving the draft', async () => {
       prisma.workflow.findUnique.mockResolvedValueOnce({
         id: BigInt(42),
-        versions: [{ dsl: publishedDsl }],
+        versions: [],
       });
       prisma.workflow.update.mockImplementationOnce(({ data }: any) =>
         Promise.resolve(data),
       );
+      prisma.workflowVersion.findFirst.mockResolvedValueOnce({
+        dsl: publishedDsl,
+      });
 
       const result = await service.saveDraft(BigInt(42), savedDsl);
 
       expect(result).toMatchObject({ dsl: savedDsl, status: 'PUBLISHED' });
     });
 
-    it('marks a saved workflow as draft when a node configuration changed', async () => {
+    it('keeps the published version executable while marking saved changes as unpublished', async () => {
       prisma.workflow.findUnique.mockResolvedValueOnce({
         id: BigInt(42),
         versions: [{ dsl: publishedDsl }],
@@ -141,6 +172,9 @@ describe('WorkflowService — cron lifecycle hooks', () => {
       prisma.workflow.update.mockImplementationOnce(({ data }: any) =>
         Promise.resolve(data),
       );
+      prisma.workflowVersion.findFirst.mockResolvedValueOnce({
+        dsl: publishedDsl,
+      });
       const changedDsl = {
         ...savedDsl,
         nodes: [
@@ -153,17 +187,31 @@ describe('WorkflowService — cron lifecycle hooks', () => {
 
       const result = await service.saveDraft(BigInt(42), changedDsl);
 
-      expect(result).toMatchObject({ dsl: changedDsl, status: 'DRAFT' });
+      expect(result).toMatchObject({
+        dsl: changedDsl,
+        status: 'PUBLISHED',
+        hasUnpublishedChanges: true,
+      });
     });
 
-    it('rejects saving an internally callable Workflow without a return node', async () => {
+    it('saves an incomplete internally callable Workflow as a draft', async () => {
       prisma.workflow.findUnique.mockResolvedValueOnce({
         id: BigInt(42),
         versions: [],
       });
+      prisma.workflow.update.mockImplementationOnce(({ data }: any) =>
+        Promise.resolve(data),
+      );
+      prisma.workflowVersion.findFirst.mockResolvedValueOnce(null);
       const callableDsl = {
         nodes: [
-          { id: 'input', type: 'callable_trigger', config: {} },
+          {
+            id: 'input',
+            type: 'callable_trigger',
+            config: {
+              inputParameters: [{ key: 'orderId' }, { key: 'orderId' }],
+            },
+          },
           { id: 'work', type: 'code', config: {} },
         ],
         edges: [{ source: 'input', target: 'work', kind: 'FLOW' }],
@@ -171,16 +219,10 @@ describe('WorkflowService — cron lifecycle hooks', () => {
 
       await expect(
         service.saveDraft(BigInt(42), callableDsl),
-      ).rejects.toMatchObject({
-        response: expect.objectContaining({
-          code: 'CALLABLE_WORKFLOW_INVALID',
-          message: '可调用 Workflow 必须且只能包含一个“返回调用”节点',
-        }),
-      });
-      expect(prisma.workflow.update).not.toHaveBeenCalled();
+      ).resolves.toMatchObject({ dsl: callableDsl, status: 'DRAFT' });
     });
 
-    it('does not create a version when the saved DSL is already published', async () => {
+    it('does not touch Temporal scheduling when an unchanged Workflow has no cron history', async () => {
       prisma.workflow.findUnique.mockResolvedValueOnce({
         id: BigInt(42),
         dsl: savedDsl,
@@ -200,26 +242,141 @@ describe('WorkflowService — cron lifecycle hooks', () => {
 
       await expect(
         service.publish(BigInt(42), { changeSummary: 'duplicate' }, 'tester'),
-      ).rejects.toMatchObject({
-        response: expect.objectContaining({
-          code: 'WORKFLOW_DSL_UNCHANGED',
-        }),
-      });
+      ).resolves.toMatchObject({ version: 1 });
       expect(prisma.workflowVersion.create).not.toHaveBeenCalled();
+      expect(temporal.deleteCronSchedule).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('schedule observability', () => {
+    it('returns the live Temporal schedule state for a cron workflow', async () => {
+      prisma.workflow.findUnique.mockResolvedValueOnce({
+        id: BigInt(42),
+        dsl: null,
+        versions: [
+          {
+            dsl: {
+              nodes: [
+                {
+                  id: 'cron',
+                  type: 'cron_trigger',
+                  config: { cronExpressions: ['0 2 * * *'] },
+                },
+              ],
+              edges: [],
+            },
+          },
+        ],
+      });
+      temporal.getCronScheduleStatus.mockResolvedValueOnce('MISSING');
+
+      await expect(service.findOne(BigInt(42))).resolves.toMatchObject({
+        scheduleStatus: 'MISSING',
+      });
+      expect(temporal.getCronScheduleStatus).toHaveBeenCalledWith(42);
     });
   });
 
+  it('lists every callable version and marks the latest explicit version', async () => {
+    prisma.workflow.findMany.mockResolvedValueOnce([
+      {
+        id: BigInt(42),
+        name: '审批查询',
+        description: null,
+        versions: [
+          {
+            id: BigInt(102),
+            version: 2,
+            dsl: {
+              nodes: [
+                {
+                  id: 'input',
+                  type: 'callable_trigger',
+                  config: {
+                    inputParameters: [{ key: 'employeeId', required: true }],
+                  },
+                },
+              ],
+              edges: [],
+            },
+          },
+          {
+            id: BigInt(101),
+            version: 1,
+            dsl: {
+              nodes: [
+                {
+                  id: 'input',
+                  type: 'callable_trigger',
+                  config: {
+                    inputParameters: [{ key: 'userId', required: true }],
+                  },
+                },
+              ],
+              edges: [],
+            },
+          },
+        ],
+      },
+    ]);
+
+    await expect(service.findCallableWorkflows()).resolves.toEqual([
+      {
+        id: '42',
+        name: '审批查询',
+        description: null,
+        latestVersionId: '102',
+        versions: [
+          {
+            id: '102',
+            version: 2,
+            inputParameters: [{ key: 'employeeId', required: true }],
+          },
+          {
+            id: '101',
+            version: 1,
+            inputParameters: [{ key: 'userId', required: true }],
+          },
+        ],
+      },
+    ]);
+    expect(prisma.workflow.findMany).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: { isEnabled: true, versions: { some: {} } },
+      }),
+    );
+  });
+
   describe('publish — cron schedule sync', () => {
     const ID = BigInt(42);
     const mkWorkflow = (dsl: any) => ({ id: ID, dsl, status: 'DRAFT' });
 
+    it('rejects publication after deletion has started', async () => {
+      prisma.workflow.findUnique.mockResolvedValueOnce({
+        id: ID,
+        dsl: { nodes: [], edges: [] },
+        status: 'DELETING',
+        versions: [],
+      });
+
+      await expect(
+        service.publish(ID, { changeSummary: 'late publish' }, 'tester'),
+      ).rejects.toMatchObject({
+        response: expect.objectContaining({ code: 'WORKFLOW_DELETING' }),
+      });
+      expect(compiler.compile).not.toHaveBeenCalled();
+    });
+
     it('upserts cron schedule when DSL contains cron_trigger', async () => {
       const dsl = {
         nodes: [
           {
             id: 't1',
             type: 'cron_trigger',
-            config: { cron: '0 2 * * *', timezone: 'Asia/Shanghai' },
+            config: {
+              cronExpressions: ['0 2 * * *', '0 14 * * *'],
+              timezone: 'Asia/Shanghai',
+            },
           },
         ],
         edges: [],
@@ -230,6 +387,9 @@ describe('WorkflowService — cron lifecycle hooks', () => {
         id: BigInt(1),
         version: 1,
       });
+      prisma.workflowVersion.findMany.mockResolvedValueOnce([
+        { id: BigInt(1), dsl },
+      ]);
       prisma.workflow.update.mockResolvedValueOnce({});
 
       await service.publish(ID, { changeSummary: 'init' }, 'tester');
@@ -237,20 +397,98 @@ describe('WorkflowService — cron lifecycle hooks', () => {
       expect(temporal.upsertCronSchedule).toHaveBeenCalledWith(
         expect.objectContaining({
           workflowId: 42,
-          cron: '0 2 * * *',
+          cronExpressions: ['0 2 * * *', '0 14 * * *'],
           timezone: 'Asia/Shanghai',
         }),
       );
       expect(temporal.deleteCronSchedule).not.toHaveBeenCalled();
     });
 
-    it('deletes cron schedule when published DSL has no cron_trigger', async () => {
+    it('rejects an invalid Cron expression or IANA timezone before publishing', async () => {
+      const dsl = {
+        nodes: [
+          {
+            id: 't1',
+            type: 'cron_trigger',
+            config: {
+              cronExpressions: ['0 9 * * *', 'not-a-cron'],
+              timezone: 'Asia/Shanghai',
+            },
+          },
+        ],
+        edges: [],
+      };
+      prisma.workflow.findUnique.mockResolvedValueOnce(mkWorkflow(dsl));
+
+      await expect(
+        service.publish(ID, { changeSummary: 'invalid schedule' }, 'tester'),
+      ).rejects.toMatchObject({
+        response: expect.objectContaining({ code: 'WORKFLOW_CRON_INVALID' }),
+      });
+      expect(prisma.workflowVersion.create).not.toHaveBeenCalled();
+    });
+
+    it('surfaces schedule sync failure and allows the same DSL to reconcile on retry', async () => {
+      const dsl = {
+        nodes: [
+          {
+            id: 't1',
+            type: 'cron_trigger',
+            config: {
+              cronExpressions: ['0 2 * * *'],
+              timezone: 'Asia/Shanghai',
+            },
+          },
+        ],
+        edges: [],
+      };
+      prisma.workflow.findUnique
+        .mockResolvedValueOnce(mkWorkflow(dsl))
+        .mockResolvedValueOnce({
+          id: ID,
+          dsl,
+          status: 'PUBLISHED',
+          versions: [{ id: BigInt(1), version: 1, dsl }],
+        });
+      prisma.workflowVersion.findFirst
+        .mockResolvedValueOnce(null)
+        .mockResolvedValue({ id: BigInt(1), version: 1, dsl });
+      prisma.workflowVersion.create.mockResolvedValueOnce({
+        id: BigInt(1),
+        version: 1,
+      });
+      prisma.workflowVersion.findMany.mockResolvedValue([
+        { id: BigInt(1), dsl },
+      ]);
+      prisma.workflow.update.mockResolvedValueOnce({});
+      temporal.upsertCronSchedule
+        .mockRejectedValueOnce(new Error('Temporal unavailable'))
+        .mockResolvedValueOnce(undefined);
+
+      await expect(
+        service.publish(ID, { changeSummary: 'schedule' }, 'tester'),
+      ).rejects.toThrow('Temporal unavailable');
+      await expect(
+        service.publish(ID, { changeSummary: 'schedule retry' }, 'tester'),
+      ).resolves.toMatchObject({ id: BigInt(1), version: 1 });
+      expect(prisma.workflowVersion.create).toHaveBeenCalledTimes(1);
+      expect(temporal.upsertCronSchedule).toHaveBeenCalledTimes(2);
+    });
+
+    it('does not touch Temporal scheduling when a Workflow has never used cron', async () => {
       const dsl = {
         nodes: [
           { id: 't1', type: 'manual_trigger', config: {} },
           { id: 'n1', type: 'http_request', config: {} },
         ],
-        edges: [{ source: 't1', target: 'n1' }],
+        edges: [
+          {
+            id: 't1-n1',
+            source: 't1',
+            target: 'n1',
+            targetHandle: 'request-in',
+          },
+        ],
       };
       prisma.workflow.findUnique.mockResolvedValueOnce(mkWorkflow(dsl));
       prisma.workflowVersion.findFirst.mockResolvedValueOnce(null);
@@ -262,6 +500,38 @@ describe('WorkflowService — cron lifecycle hooks', () => {
 
       await service.publish(ID, { changeSummary: 'init' }, 'tester');
 
+      expect(temporal.upsertCronSchedule).not.toHaveBeenCalled();
+      expect(temporal.deleteCronSchedule).not.toHaveBeenCalled();
+    });
+
+    it('deletes an existing schedule when the latest publication removes cron', async () => {
+      const dsl = {
+        nodes: [{ id: 't1', type: 'manual_trigger', config: {} }],
+        edges: [],
+      };
+      const oldCronDsl = {
+        nodes: [
+          {
+            id: 'cron',
+            type: 'cron_trigger',
+            config: { cronExpressions: ['0 2 * * *'] },
+          },
+        ],
+        edges: [],
+      };
+      prisma.workflow.findUnique.mockResolvedValueOnce(mkWorkflow(dsl));
+      prisma.workflowVersion.findFirst.mockResolvedValueOnce(null);
+      prisma.workflowVersion.create.mockResolvedValueOnce({
+        id: BigInt(9),
+        version: 2,
+      });
+      prisma.workflowVersion.findMany.mockResolvedValueOnce([
+        { id: BigInt(9), dsl },
+        { id: BigInt(8), dsl: oldCronDsl },
+      ]);
+
+      await service.publish(ID, { changeSummary: 'remove cron' }, 'tester');
+
       expect(temporal.upsertCronSchedule).not.toHaveBeenCalled();
       expect(temporal.deleteCronSchedule).toHaveBeenCalledWith(42);
     });
@@ -285,6 +555,32 @@ describe('WorkflowService — cron lifecycle hooks', () => {
       ).rejects.toThrow(/requires a secret/);
     });
 
+    it.each(['', 'foo/bar'])('rejects webhook path %j', async (path) => {
+      const dsl = {
+        nodes: [
+          {
+            id: 't1',
+            type: 'webhook_trigger',
+            config: {
+              path,
+              method: 'POST',
+              verificationMode: 'NONE',
+            },
+          },
+        ],
+        edges: [],
+      };
+      prisma.workflow.findUnique.mockResolvedValueOnce(mkWorkflow(dsl));
+
+      await expect(
+        service.publish(ID, { changeSummary: 'invalid webhook' }, 'tester'),
+      ).rejects.toMatchObject({
+        response: expect.objectContaining({
+          code: 'WORKFLOW_WEBHOOK_PATH_INVALID',
+        }),
+      });
+    });
+
     it('allows a direct webhook trigger to publish without an HMAC secret', async () => {
       const dsl = {
         nodes: [
@@ -314,7 +610,7 @@ describe('WorkflowService — cron lifecycle hooks', () => {
       ).resolves.toBeDefined();
     });
 
-    it('rejects webhook path collision with another published workflow', async () => {
+    it('allows multiple published Workflows to subscribe to one webhook path', async () => {
       const dsl = {
         nodes: [
           {
@@ -350,9 +646,16 @@ describe('WorkflowService — cron lifecycle hooks', () => {
         },
       ]);
 
+      prisma.workflowVersion.findFirst.mockResolvedValueOnce(null);
+      prisma.workflowVersion.create.mockResolvedValueOnce({
+        id: BigInt(1),
+        version: 1,
+      });
+      prisma.workflow.update.mockResolvedValueOnce({});
+
       await expect(
         service.publish(ID, { changeSummary: 'init' }, 'tester'),
-      ).rejects.toThrow(/already used by workflow #999/);
+      ).resolves.toBeDefined();
     });
 
     it('proceeds when webhook path differs from existing one', async () => {
@@ -417,12 +720,14 @@ describe('WorkflowService — cron lifecycle hooks', () => {
             source: 'approval1',
             target: 'approved',
             sourceHandle: 'true',
+            targetHandle: 'data-in',
           },
           {
             id: 'e3',
             source: 'approval1',
             target: 'rejected',
             sourceHandle: 'false',
+            targetHandle: 'data-in',
           },
         ],
       };
@@ -439,23 +744,38 @@ describe('WorkflowService — cron lifecycle hooks', () => {
       ).resolves.toBeDefined();
     });
 
-    it('rejects an output handle not declared by Workflow node metadata', async () => {
+    it('validates dynamic switch handles from the compiled effective config', async () => {
       const dsl = {
         nodes: [
           { id: 't1', type: 'manual_trigger', config: {} },
-          { id: 'branch1', type: 'custom_branch', config: {} },
+          {
+            id: 'switch1',
+            type: 'switch',
+            config: { cases: [{ id: 'stale-case' }] },
+            configOverride: { cases: [{ id: 'effective-case' }] },
+            instanceRef: { instanceId: '7', instanceCode: 'SWITCH_TEMPLATE' },
+          },
           { id: 'next', type: 'code', config: {} },
         ],
         edges: [
-          { id: 'e1', source: 't1', target: 'branch1' },
+          { id: 'e1', source: 't1', target: 'switch1' },
           {
             id: 'e2',
-            source: 'branch1',
+            source: 'switch1',
             target: 'next',
-            sourceHandle: 'unknown',
+            sourceHandle: 'effective-case',
+            targetHandle: 'data-in',
           },
         ],
       };
+      compiler.compile.mockImplementationOnce(async (draft: any) => ({
+        ...draft,
+        nodes: draft.nodes.map((node: any) => ({
+          ...node,
+          config: node.configOverride ?? node.config,
+          runtimeKey: node.type,
+        })),
+      }));
       prisma.workflow.findUnique.mockResolvedValueOnce(mkWorkflow(dsl));
       prisma.workflowVersion.findFirst.mockResolvedValueOnce(null);
       prisma.workflowVersion.create.mockResolvedValueOnce({
@@ -466,33 +786,67 @@ describe('WorkflowService — cron lifecycle hooks', () => {
 
       await expect(
         service.publish(ID, { changeSummary: 'init' }, 'tester'),
-      ).rejects.toMatchObject({
-        status: 400,
-        response: expect.objectContaining({
-          code: 'DSL_HANDLE_VALIDATION',
-          errors: expect.arrayContaining([
-            expect.objectContaining({
-              edgeId: 'e2',
-              code: 'UNKNOWN_HANDLE',
-            }),
-          ]),
-        }),
+      ).resolves.toBeDefined();
+      expect(compiler.compile).toHaveBeenCalledTimes(1);
+    });
+
+    it('accepts the canonical HTTP and Code main-flow ports', async () => {
+      const dsl = {
+        nodes: [
+          { id: 't1', type: 'manual_trigger', config: {} },
+          { id: 'request', type: 'http_request', config: {} },
+          { id: 'transform', type: 'code', config: {} },
+          { id: 'next', type: 'http_request', config: {} },
+        ],
+        edges: [
+          {
+            id: 'e1',
+            source: 't1',
+            target: 'request',
+            targetHandle: 'request-in',
+          },
+          {
+            id: 'e2',
+            source: 'request',
+            target: 'transform',
+            sourceHandle: 'response-out',
+            targetHandle: 'data-in',
+          },
+          {
+            id: 'e3',
+            source: 'transform',
+            target: 'next',
+            sourceHandle: 'result-out',
+            targetHandle: 'request-in',
+          },
+        ],
+      };
+      prisma.workflow.findUnique.mockResolvedValueOnce(mkWorkflow(dsl));
+      prisma.workflowVersion.findFirst.mockResolvedValueOnce(null);
+      prisma.workflowVersion.create.mockResolvedValueOnce({
+        id: BigInt(1),
+        version: 1,
       });
+      prisma.workflow.update.mockResolvedValueOnce({});
+
+      await expect(
+        service.publish(ID, { changeSummary: 'init' }, 'tester'),
+      ).resolves.toBeDefined();
     });
 
-    it('rejects with 400 BadRequestException when DSL has invalid sourceHandle', async () => {
-      // if_else node has enumerated outputs ['true','false']; sending 'maybe'
-      // must trigger the new sourceHandle validator and produce a 400 with a
-      // structured error payload the frontend can use to highlight bad edges.
+    it('rejects a runtime main-flow port forged by a manual trigger', async () => {
       const dsl = {
         nodes: [
           { id: 't1', type: 'manual_trigger', config: {} },
-          { id: 'if1', type: 'if_else', config: {} },
-          { id: 'h1', type: 'http_request', config: {} },
+          { id: 'next', type: 'code', config: {} },
         ],
         edges: [
-          { id: 'e1', source: 't1', target: 'if1' },
-          { id: 'e2', source: 'if1', target: 'h1', sourceHandle: 'maybe' },
+          {
+            id: 'e1',
+            source: 't1',
+            target: 'next',
+            sourceHandle: 'response-out',
+          },
         ],
       };
       prisma.workflow.findUnique.mockResolvedValueOnce(mkWorkflow(dsl));
@@ -504,24 +858,210 @@ describe('WorkflowService — cron lifecycle hooks', () => {
         response: expect.objectContaining({
           code: 'DSL_HANDLE_VALIDATION',
           errors: expect.arrayContaining([
-            expect.objectContaining({
-              edgeId: 'e2',
-              code: 'UNKNOWN_HANDLE',
-            }),
+            expect.objectContaining({ edgeId: 'e1', code: 'EXTRA_HANDLE' }),
           ]),
         }),
       });
-
-      // Status flip must NOT have happened
-      expect(prisma.workflow.update).not.toHaveBeenCalled();
     });
-  });
-
-  describe('toggleEnabled', () => {
-    const ID = BigInt(42);
+
+    it('rejects an output handle not declared by Workflow node metadata', async () => {
+      const dsl = {
+        nodes: [
+          { id: 't1', type: 'manual_trigger', config: {} },
+          { id: 'branch1', type: 'custom_branch', config: {} },
+          { id: 'next', type: 'code', config: {} },
+        ],
+        edges: [
+          { id: 'e1', source: 't1', target: 'branch1' },
+          {
+            id: 'e2',
+            source: 'branch1',
+            target: 'next',
+            sourceHandle: 'unknown',
+          },
+        ],
+      };
+      prisma.workflow.findUnique.mockResolvedValueOnce(mkWorkflow(dsl));
+      prisma.workflowVersion.findFirst.mockResolvedValueOnce(null);
+      prisma.workflowVersion.create.mockResolvedValueOnce({
+        id: BigInt(1),
+        version: 1,
+      });
+      prisma.workflow.update.mockResolvedValueOnce({});
+
+      await expect(
+        service.publish(ID, { changeSummary: 'init' }, 'tester'),
+      ).rejects.toMatchObject({
+        status: 400,
+        response: expect.objectContaining({
+          code: 'DSL_HANDLE_VALIDATION',
+          errors: expect.arrayContaining([
+            expect.objectContaining({
+              edgeId: 'e2',
+              code: 'UNKNOWN_HANDLE',
+            }),
+          ]),
+        }),
+      });
+    });
+
+    it('rejects with 400 BadRequestException when DSL has invalid sourceHandle', async () => {
+      // if_else node has enumerated outputs ['true','false']; sending 'maybe'
+      // must trigger the new sourceHandle validator and produce a 400 with a
+      // structured error payload the frontend can use to highlight bad edges.
+      const dsl = {
+        nodes: [
+          { id: 't1', type: 'manual_trigger', config: {} },
+          { id: 'if1', type: 'if_else', config: {} },
+          { id: 'h1', type: 'http_request', config: {} },
+        ],
+        edges: [
+          { id: 'e1', source: 't1', target: 'if1' },
+          { id: 'e2', source: 'if1', target: 'h1', sourceHandle: 'maybe' },
+        ],
+      };
+      prisma.workflow.findUnique.mockResolvedValueOnce(mkWorkflow(dsl));
+
+      await expect(
+        service.publish(ID, { changeSummary: 'init' }, 'tester'),
+      ).rejects.toMatchObject({
+        status: 400,
+        response: expect.objectContaining({
+          code: 'DSL_HANDLE_VALIDATION',
+          errors: expect.arrayContaining([
+            expect.objectContaining({
+              edgeId: 'e2',
+              code: 'UNKNOWN_HANDLE',
+            }),
+          ]),
+        }),
+      });
+
+      // Status flip must NOT have happened
+      expect(prisma.workflow.update).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('toggleEnabled', () => {
+    const ID = BigInt(42);
+
+    it('does not require Temporal for a Workflow that has never used cron', async () => {
+      prisma.workflow.findUnique.mockResolvedValueOnce({
+        id: ID,
+        isEnabled: true,
+        versions: [
+          {
+            id: BigInt(9),
+            dsl: { nodes: [{ type: 'manual_trigger', config: {} }], edges: [] },
+          },
+        ],
+      });
+      prisma.workflowVersion.findMany.mockResolvedValueOnce([
+        {
+          id: BigInt(10),
+          dsl: { nodes: [{ type: 'manual_trigger', config: {} }], edges: [] },
+        },
+      ]);
+
+      await expect(service.toggleEnabled(ID, true)).resolves.toMatchObject({
+        id: ID,
+        isEnabled: true,
+      });
+
+      expect(temporal.upsertCronSchedule).not.toHaveBeenCalled();
+      expect(temporal.unpauseCronSchedule).not.toHaveBeenCalled();
+      expect(temporal.pauseCronSchedule).not.toHaveBeenCalled();
+      expect(temporal.deleteCronSchedule).not.toHaveBeenCalled();
+    });
+
+    it('cleans up a historical cron schedule when the latest version is not cron', async () => {
+      prisma.workflow.findUnique.mockResolvedValueOnce({
+        id: ID,
+        versions: [
+          {
+            id: BigInt(10),
+            dsl: { nodes: [{ type: 'manual_trigger', config: {} }], edges: [] },
+          },
+          {
+            id: BigInt(9),
+            dsl: {
+              nodes: [
+                {
+                  type: 'cron_trigger',
+                  config: { cronExpressions: ['0 2 * * *'] },
+                },
+              ],
+              edges: [],
+            },
+          },
+        ],
+      });
+      prisma.workflowVersion.findMany.mockResolvedValueOnce([
+        {
+          id: BigInt(10),
+          dsl: { nodes: [{ type: 'manual_trigger', config: {} }], edges: [] },
+        },
+        {
+          id: BigInt(9),
+          dsl: {
+            nodes: [
+              {
+                type: 'cron_trigger',
+                config: { cronExpressions: ['0 2 * * *'] },
+              },
+            ],
+            edges: [],
+          },
+        },
+      ]);
+
+      await service.toggleEnabled(ID, false);
+
+      expect(temporal.deleteCronSchedule).toHaveBeenCalledWith(42);
+      expect(temporal.pauseCronSchedule).not.toHaveBeenCalled();
+    });
+
+    it('rejects changes after deletion has started', async () => {
+      prisma.workflow.updateMany.mockResolvedValueOnce({ count: 0 });
+      prisma.workflow.findUnique.mockResolvedValueOnce({
+        id: ID,
+        status: 'DELETING',
+      });
+      await expect(service.toggleEnabled(ID, true)).rejects.toMatchObject({
+        response: expect.objectContaining({ code: 'WORKFLOW_DELETING' }),
+      });
+      expect(temporal.upsertCronSchedule).not.toHaveBeenCalled();
+    });
 
     it('pauses cron schedule when disabling', async () => {
-      prisma.workflow.findUnique.mockResolvedValueOnce({ id: ID });
+      prisma.workflow.findUnique.mockResolvedValueOnce({
+        id: ID,
+        versions: [
+          {
+            dsl: {
+              nodes: [
+                {
+                  type: 'cron_trigger',
+                  config: { cronExpressions: ['0 2 * * *'] },
+                },
+              ],
+            },
+          },
+        ],
+      });
+      prisma.workflowVersion.findMany.mockResolvedValueOnce([
+        {
+          id: BigInt(9),
+          dsl: {
+            nodes: [
+              {
+                type: 'cron_trigger',
+                config: { cronExpressions: ['0 2 * * *'] },
+              },
+            ],
+          },
+        },
+      ]);
       prisma.workflow.update.mockResolvedValueOnce({});
 
       await service.toggleEnabled(ID, false);
@@ -531,27 +1071,297 @@ describe('WorkflowService — cron lifecycle hooks', () => {
     });
 
     it('unpauses cron schedule when enabling', async () => {
-      prisma.workflow.findUnique.mockResolvedValueOnce({ id: ID });
+      let transactionDepth = 0;
+      const runTransaction = prisma.$transaction.getMockImplementation();
+      prisma.$transaction.mockImplementation(async (callback: any) => {
+        transactionDepth++;
+        try {
+          return await runTransaction(callback);
+        } finally {
+          transactionDepth--;
+        }
+      });
+      temporal.upsertCronSchedule.mockImplementation(async () => {
+        expect(transactionDepth).toBe(0);
+      });
+      prisma.workflow.findUnique.mockResolvedValueOnce({
+        id: ID,
+        versions: [
+          {
+            id: BigInt(9),
+            dsl: {
+              nodes: [
+                {
+                  id: 'cron',
+                  type: 'cron_trigger',
+                  config: {
+                    cronExpressions: ['0 2 * * *'],
+                    timezone: 'Asia/Shanghai',
+                  },
+                },
+              ],
+              edges: [],
+            },
+          },
+        ],
+      });
+      prisma.workflowVersion.findMany.mockResolvedValueOnce([
+        {
+          id: BigInt(9),
+          dsl: {
+            nodes: [
+              {
+                id: 'cron',
+                type: 'cron_trigger',
+                config: {
+                  cronExpressions: ['0 2 * * *'],
+                  timezone: 'Asia/Shanghai',
+                },
+              },
+            ],
+            edges: [],
+          },
+        },
+      ]);
       prisma.workflow.update.mockResolvedValueOnce({});
 
       await service.toggleEnabled(ID, true);
 
+      expect(temporal.upsertCronSchedule).toHaveBeenCalled();
       expect(temporal.unpauseCronSchedule).toHaveBeenCalledWith(42);
       expect(temporal.pauseCronSchedule).not.toHaveBeenCalled();
     });
 
-    it('does not throw if schedule operation fails', async () => {
-      prisma.workflow.findUnique.mockResolvedValueOnce({ id: ID });
+    it('surfaces a schedule operation failure', async () => {
+      prisma.workflow.findUnique.mockResolvedValueOnce({
+        id: ID,
+        versions: [
+          {
+            dsl: {
+              nodes: [
+                {
+                  type: 'cron_trigger',
+                  config: { cronExpressions: ['0 2 * * *'] },
+                },
+              ],
+            },
+          },
+        ],
+      });
+      prisma.workflowVersion.findMany.mockResolvedValueOnce([
+        {
+          id: BigInt(9),
+          dsl: {
+            nodes: [
+              {
+                type: 'cron_trigger',
+                config: { cronExpressions: ['0 2 * * *'] },
+              },
+            ],
+          },
+        },
+      ]);
       prisma.workflow.update.mockResolvedValueOnce({});
       temporal.pauseCronSchedule.mockRejectedValueOnce(new Error('boom'));
 
-      await expect(service.toggleEnabled(ID, false)).resolves.toBeDefined();
+      await expect(service.toggleEnabled(ID, false)).rejects.toThrow('boom');
+    });
+  });
+
+  describe('cron reconciliation', () => {
+    it('recreates and unpauses an enabled cron schedule from the latest published version', async () => {
+      const dsl = {
+        nodes: [
+          {
+            id: 'cron',
+            type: 'cron_trigger',
+            config: {
+              cronExpressions: ['0 2 * * *'],
+              timezone: 'Asia/Shanghai',
+            },
+          },
+        ],
+        edges: [],
+      };
+      prisma.workflow.findMany.mockResolvedValueOnce([
+        {
+          id: BigInt(42),
+          isEnabled: true,
+          versions: [{ id: BigInt(9), dsl }],
+        },
+      ]);
+      prisma.workflowVersion.findMany.mockResolvedValueOnce([
+        { id: BigInt(9), dsl },
+      ]);
+
+      await service.reconcileCronSchedules();
+
+      expect(temporal.upsertCronSchedule).toHaveBeenCalledWith(
+        expect.objectContaining({
+          workflowId: 42,
+          versionId: 9,
+          dsl,
+          cronExpressions: ['0 2 * * *'],
+          timezone: 'Asia/Shanghai',
+        }),
+      );
+      expect(temporal.unpauseCronSchedule).toHaveBeenCalledWith(42);
+    });
+
+    it('re-reads the latest version under lock before restoring a schedule', async () => {
+      const staleCronDsl = {
+        nodes: [
+          {
+            id: 'cron',
+            type: 'cron_trigger',
+            config: {
+              cronExpressions: ['0 2 * * *'],
+              timezone: 'Asia/Shanghai',
+            },
+          },
+        ],
+        edges: [],
+      };
+      const latestManualDsl = {
+        nodes: [{ id: 'manual', type: 'manual_trigger', config: {} }],
+        edges: [],
+      };
+      prisma.workflow.findMany.mockResolvedValueOnce([
+        {
+          id: BigInt(42),
+          isEnabled: true,
+          versions: [{ id: BigInt(9), dsl: staleCronDsl }],
+        },
+      ]);
+      prisma.workflowVersion.findMany.mockResolvedValueOnce([
+        { id: BigInt(10), dsl: latestManualDsl },
+        { id: BigInt(9), dsl: staleCronDsl },
+      ]);
+
+      await service.reconcileCronSchedules();
+
+      expect(temporal.deleteCronSchedule).toHaveBeenCalledWith(42);
+      expect(temporal.upsertCronSchedule).not.toHaveBeenCalled();
+      expect(temporal.unpauseCronSchedule).not.toHaveBeenCalled();
     });
   });
 
   describe('remove', () => {
     const ID = BigInt(42);
 
+    it('rejects deletion while another Workflow still calls it', async () => {
+      prisma.workflow.findUnique.mockResolvedValueOnce({ id: ID });
+      prisma.workflow.findMany.mockResolvedValueOnce([
+        {
+          id: BigInt(7),
+          name: '采购审批',
+          dsl: {
+            nodes: [
+              {
+                type: 'sub_workflow',
+                config: { workflowId: '42', workflowVersionId: '101' },
+              },
+            ],
+          },
+          versions: [],
+        },
+      ]);
+
+      await expect(service.remove(ID)).rejects.toMatchObject({
+        response: expect.objectContaining({
+          code: 'WORKFLOW_IS_REFERENCED',
+          callers: [
+            expect.objectContaining({
+              workflowId: '7',
+              workflowName: '采购审批',
+              source: 'DRAFT',
+            }),
+          ],
+        }),
+      });
+      expect(prisma.workflow.update).not.toHaveBeenCalled();
+      expect(prisma.workflow.delete).not.toHaveBeenCalled();
+    });
+
+    it('uses a caller draft config override when checking deletion', async () => {
+      prisma.workflow.findUnique.mockResolvedValueOnce({ id: ID });
+      prisma.workflow.findMany.mockResolvedValueOnce([
+        {
+          id: BigInt(7),
+          name: '采购审批',
+          dsl: {
+            nodes: [
+              {
+                type: 'sub_workflow',
+                config: { workflowId: '99', workflowVersionId: '201' },
+                configOverride: {
+                  workflowId: '42',
+                  workflowVersionId: '101',
+                },
+              },
+            ],
+          },
+          versions: [],
+        },
+      ]);
+
+      await expect(service.remove(ID)).rejects.toMatchObject({
+        response: expect.objectContaining({ code: 'WORKFLOW_IS_REFERENCED' }),
+      });
+      expect(prisma.workflow.delete).not.toHaveBeenCalled();
+    });
+
+    it('uses a shared caller node instance config when checking deletion', async () => {
+      prisma.workflow.findUnique.mockResolvedValueOnce({ id: ID });
+      prisma.workflow.findMany.mockResolvedValueOnce([
+        {
+          id: BigInt(7),
+          name: '采购审批',
+          dsl: {
+            nodes: [
+              {
+                type: 'sub_workflow',
+                config: {},
+                instanceRef: {
+                  instanceId: '12',
+                  instanceCode: 'CALL_PURCHASE',
+                },
+              },
+            ],
+          },
+          versions: [],
+        },
+      ]);
+      prisma.workflowNodeInstance.findMany.mockResolvedValueOnce([
+        {
+          id: BigInt(12),
+          config: { workflowId: '42', workflowVersionId: '101' },
+        },
+      ]);
+
+      await expect(service.remove(ID)).rejects.toMatchObject({
+        response: expect.objectContaining({ code: 'WORKFLOW_IS_REFERENCED' }),
+      });
+      expect(prisma.workflowNodeInstance.findMany).toHaveBeenCalledWith({
+        where: { id: { in: [BigInt(12)] } },
+        select: { id: true, config: true },
+      });
+      expect(prisma.workflow.delete).not.toHaveBeenCalled();
+    });
+
+    it('deletes a never-cron Workflow without calling Temporal', async () => {
+      prisma.workflow.findUnique.mockResolvedValueOnce({ id: ID });
+      prisma.workflow.delete.mockResolvedValueOnce({ id: ID });
+      temporal.deleteCronSchedule.mockRejectedValueOnce(
+        new Error('Temporal unavailable'),
+      );
+
+      await expect(service.remove(ID)).resolves.toEqual({ id: ID });
+
+      expect(temporal.deleteCronSchedule).not.toHaveBeenCalled();
+      expect(prisma.workflow.delete).toHaveBeenCalled();
+    });
+
     it('deletes external interaction history before deleting the workflow', async () => {
       const rows = {
         interactionEvents: 1,
@@ -567,8 +1377,9 @@ describe('WorkflowService — cron lifecycle hooks', () => {
       });
       prisma.workflow.findUnique.mockResolvedValueOnce({ id: ID });
       prisma.workflow.delete.mockImplementationOnce(deleteWorkflow);
-      prisma.$transaction.mockImplementationOnce(async (callback: any) =>
+      prisma.$transaction.mockImplementation(async (callback: any) =>
         callback({
+          workflowInstance: prisma.workflowInstance,
           externalInteraction: {
             findMany: jest.fn(async () => [{ id: BigInt(100) }]),
             deleteMany: jest.fn(async () => {
@@ -587,7 +1398,13 @@ describe('WorkflowService — cron lifecycle hooks', () => {
               rows.signalOutboxes = 0;
             }),
           },
-          workflow: { delete: deleteWorkflow },
+          workflow: {
+            update: prisma.workflow.update,
+            delete: deleteWorkflow,
+          },
+          workflowVersion: {
+            findMany: prisma.workflowVersion.findMany,
+          },
         }),
       );
 
@@ -600,8 +1417,33 @@ describe('WorkflowService — cron lifecycle hooks', () => {
       });
     });
 
+    it('rejects deletion while an instance is still active', async () => {
+      prisma.workflow.findUnique.mockResolvedValueOnce({ id: ID });
+      prisma.workflowInstance.count.mockResolvedValueOnce(1);
+
+      await expect(service.remove(ID)).rejects.toMatchObject({
+        response: expect.objectContaining({
+          code: 'WORKFLOW_HAS_ACTIVE_INSTANCES',
+        }),
+      });
+      expect(temporal.deleteCronSchedule).not.toHaveBeenCalled();
+      expect(prisma.workflow.delete).not.toHaveBeenCalled();
+    });
+
     it('deletes cron schedule before deleting workflow', async () => {
       prisma.workflow.findUnique.mockResolvedValueOnce({ id: ID });
+      prisma.workflowVersion.findMany.mockResolvedValueOnce([
+        {
+          dsl: {
+            nodes: [
+              {
+                type: 'cron_trigger',
+                config: { cronExpressions: ['0 2 * * *'] },
+              },
+            ],
+          },
+        },
+      ]);
       prisma.workflow.delete.mockResolvedValueOnce({});
 
       await service.remove(ID);
@@ -610,14 +1452,30 @@ describe('WorkflowService — cron lifecycle hooks', () => {
       expect(prisma.workflow.delete).toHaveBeenCalled();
     });
 
-    it('still deletes the workflow even if schedule deletion fails', async () => {
+    it('keeps the disabled workflow when schedule deletion fails', async () => {
       prisma.workflow.findUnique.mockResolvedValueOnce({ id: ID });
+      prisma.workflowVersion.findMany.mockResolvedValueOnce([
+        {
+          dsl: {
+            nodes: [
+              {
+                type: 'cron_trigger',
+                config: { cronExpressions: ['0 2 * * *'] },
+              },
+            ],
+          },
+        },
+      ]);
       temporal.deleteCronSchedule.mockRejectedValueOnce(new Error('boom'));
       prisma.workflow.delete.mockResolvedValueOnce({});
 
-      await service.remove(ID);
+      await expect(service.remove(ID)).rejects.toThrow('boom');
 
-      expect(prisma.workflow.delete).toHaveBeenCalled();
+      expect(prisma.workflow.update).toHaveBeenCalledWith({
+        where: { id: ID },
+        data: { isEnabled: false, status: 'DELETING' },
+      });
+      expect(prisma.workflow.delete).not.toHaveBeenCalled();
     });
   });
 });
@@ -636,12 +1494,19 @@ describe('WorkflowService — receiveWebhook', () => {
       workflowVersion: { findFirst: jest.fn() },
       workflowInstance: {
         create: jest.fn(),
+        findUnique: jest.fn(),
         update: jest.fn(),
+        updateMany: jest.fn(),
       },
     };
+    prisma.$transaction = jest.fn(async (callback: any) =>
+      callback({
+        $queryRaw: jest.fn().mockResolvedValue([{ isEnabled: true }]),
+        workflowInstance: prisma.workflowInstance,
+      }),
+    );
     temporal = {
       startWorkflow: jest.fn(async () => ({ temporalRunId: 'run-1' })),
-      waitForWorkflowResult: jest.fn(),
     };
 
     const module: TestingModule = await Test.createTestingModule({
@@ -665,6 +1530,7 @@ describe('WorkflowService — receiveWebhook', () => {
   const METHOD = 'POST';
   const BODY = '{"orderId":42}';
   const RAW = Buffer.from(BODY);
+  const WEBHOOK_HEADERS = { 'idempotency-key': 'webhook-event-1' };
 
   const nowSec = () => Math.floor(Date.now() / 1000).toString();
 
@@ -673,8 +1539,6 @@ describe('WorkflowService — receiveWebhook', () => {
     secret = SECRET,
     path = PATH,
     verificationMode?: 'HMAC' | 'NONE',
-    responseMode?: 'IMMEDIATE' | 'WAIT_FOR_RESULT',
-    responseTimeoutSeconds?: number,
   ) => ({
     id: BigInt(id),
     status: 'PUBLISHED',
@@ -694,8 +1558,6 @@ describe('WorkflowService — receiveWebhook', () => {
                 method: METHOD,
                 secret,
                 ...(verificationMode && { verificationMode }),
-                ...(responseMode && { responseMode }),
-                ...(responseTimeoutSeconds && { responseTimeoutSeconds }),
               },
             },
           ],
@@ -724,8 +1586,20 @@ describe('WorkflowService — receiveWebhook', () => {
       version: 1,
       dsl: { nodes: [], edges: [] },
     }));
-    prisma.workflowInstance.create.mockResolvedValueOnce({ id: BigInt(7777) });
-    prisma.workflowInstance.update.mockResolvedValueOnce({});
+    let createdInstance: any;
+    prisma.workflowInstance.create.mockImplementation(({ data }: any) => {
+      createdInstance = {
+        id: BigInt(7777),
+        ...data,
+        temporalRunId: null,
+      };
+      return createdInstance;
+    });
+    prisma.workflowInstance.updateMany.mockResolvedValue({ count: 1 });
+    prisma.workflowInstance.findUnique.mockImplementation(() => ({
+      ...createdInstance,
+      temporalRunId: 'wf-1-7777',
+    }));
   };
 
   it('returns 401 (UnauthorizedException) when timestamp is missing', async () => {
@@ -739,7 +1613,7 @@ describe('WorkflowService — receiveWebhook', () => {
         timestampHeader: undefined,
         rawBody: RAW,
         body: { orderId: 42 },
-        headers: {},
+        headers: WEBHOOK_HEADERS,
         query: {},
       }),
     ).rejects.toBeInstanceOf(UnauthorizedException);
@@ -757,7 +1631,7 @@ describe('WorkflowService — receiveWebhook', () => {
         timestampHeader: oldTs,
         rawBody: RAW,
         body: {},
-        headers: {},
+        headers: WEBHOOK_HEADERS,
         query: {},
       }),
     ).rejects.toBeInstanceOf(UnauthorizedException);
@@ -775,7 +1649,7 @@ describe('WorkflowService — receiveWebhook', () => {
         timestampHeader: ts,
         rawBody: RAW,
         body: {},
-        headers: {},
+        headers: WEBHOOK_HEADERS,
         query: {},
       }),
     ).rejects.toBeInstanceOf(NotFoundException);
@@ -792,7 +1666,7 @@ describe('WorkflowService — receiveWebhook', () => {
         timestampHeader: ts,
         rawBody: RAW,
         body: {},
-        headers: {},
+        headers: WEBHOOK_HEADERS,
         query: {},
       }),
     ).rejects.toBeInstanceOf(UnauthorizedException);
@@ -812,7 +1686,7 @@ describe('WorkflowService — receiveWebhook', () => {
       timestampHeader: ts,
       rawBody: RAW,
       body: { orderId: 42 },
-      headers: { 'x-workflow-signature': sig },
+      headers: { ...WEBHOOK_HEADERS, 'x-workflow-signature': sig },
       query: { foo: 'bar' },
     });
 
@@ -841,7 +1715,7 @@ describe('WorkflowService — receiveWebhook', () => {
       timestampHeader: undefined,
       rawBody: RAW,
       body: { id: 'myoa-work-item-1' },
-      headers: { 'content-type': 'text/json' },
+      headers: { ...WEBHOOK_HEADERS, 'content-type': 'text/json' },
       query: {},
     });
 
@@ -854,126 +1728,6 @@ describe('WorkflowService — receiveWebhook', () => {
     });
   });
 
-  it('waits for the Workflow return result when the trigger uses function mode', async () => {
-    prisma.workflow.findMany.mockResolvedValueOnce([
-      mkPublishedWorkflow(1, '', PATH, 'NONE', 'WAIT_FOR_RESULT', 45),
-    ]);
-    mkExecuteSetup();
-    temporal.waitForWorkflowResult.mockResolvedValueOnce({
-      kind: 'COMPLETED',
-      result: {
-        status: 'COMPLETED',
-        output: {
-          ticketId: 'T-42',
-          accepted: true,
-        },
-        httpResponse: {
-          statusCode: 201,
-          headers: {
-            'x-workflow-result': 'created',
-          },
-        },
-      },
-    });
-
-    const result = await service.receiveWebhook({
-      path: PATH,
-      method: METHOD,
-      signatureHeader: undefined,
-      timestampHeader: undefined,
-      rawBody: RAW,
-      body: { orderId: 42 },
-      headers: {},
-      query: {},
-    });
-
-    expect(result).toEqual({
-      instanceIds: ['7777'],
-      response: {
-        statusCode: 201,
-        headers: {
-          'x-workflow-result': 'created',
-        },
-        body: {
-          ticketId: 'T-42',
-          accepted: true,
-        },
-      },
-    });
-    expect(temporal.waitForWorkflowResult).toHaveBeenCalledWith(
-      'run-1',
-      45_000,
-    );
-  });
-
-  it('returns a gateway timeout without cancelling a still-running Workflow', async () => {
-    prisma.workflow.findMany.mockResolvedValueOnce([
-      mkPublishedWorkflow(1, '', PATH, 'NONE', 'WAIT_FOR_RESULT', 60),
-    ]);
-    mkExecuteSetup();
-    temporal.waitForWorkflowResult.mockResolvedValueOnce({
-      kind: 'TIMED_OUT',
-    });
-
-    const result = await service.receiveWebhook({
-      path: PATH,
-      method: METHOD,
-      signatureHeader: undefined,
-      timestampHeader: undefined,
-      rawBody: RAW,
-      body: {},
-      headers: {},
-      query: {},
-    });
-
-    expect(result).toEqual({
-      instanceIds: ['7777'],
-      response: {
-        statusCode: 504,
-        headers: {},
-        body: {
-          code: 'WORKFLOW_RESPONSE_TIMEOUT',
-          message: 'Workflow did not return a result within 60 seconds',
-          instanceId: '7777',
-        },
-      },
-    });
-  });
-
-  it('returns an internal error response when the Workflow execution fails', async () => {
-    prisma.workflow.findMany.mockResolvedValueOnce([
-      mkPublishedWorkflow(1, '', PATH, 'NONE', 'WAIT_FOR_RESULT'),
-    ]);
-    mkExecuteSetup();
-    temporal.waitForWorkflowResult.mockRejectedValueOnce(
-      new Error('private Temporal failure'),
-    );
-
-    const result = await service.receiveWebhook({
-      path: PATH,
-      method: METHOD,
-      signatureHeader: undefined,
-      timestampHeader: undefined,
-      rawBody: RAW,
-      body: {},
-      headers: {},
-      query: {},
-    });
-
-    expect(result).toEqual({
-      instanceIds: ['7777'],
-      response: {
-        statusCode: 500,
-        headers: {},
-        body: {
-          code: 'WORKFLOW_EXECUTION_FAILED',
-          message: 'Workflow execution failed',
-          instanceId: '7777',
-        },
-      },
-    });
-  });
-
   it('rejects with 401 when one of multiple matches has a different secret', async () => {
     // Strict mode: every match must verify against the same signature
     prisma.workflow.findMany.mockResolvedValueOnce([
@@ -1002,31 +1756,35 @@ describe('WorkflowService — approveInstance', () => {
   let service: WorkflowService;
   let prisma: any;
   let temporal: any;
+  let humanApproval: any;
 
   beforeEach(async () => {
     prisma = {
-      workflowInstance: { findUnique: jest.fn() },
-      workflowNodeExecution: { findUnique: jest.fn() },
+      approvalRequest: { findUnique: jest.fn() },
     };
     temporal = { signalWorkflow: jest.fn() };
+    humanApproval = { submitDecision: jest.fn() };
     const module: TestingModule = await Test.createTestingModule({
       providers: [
         WorkflowService,
         { provide: PrismaService, useValue: prisma },
         { provide: TemporalService, useValue: temporal },
+        { provide: HumanApprovalService, useValue: humanApproval },
+        { provide: WorkflowCompilerService, useValue: {} },
       ],
     }).compile();
     service = module.get(WorkflowService);
   });
 
   it('rejects when caller is not in the resolved approver list', async () => {
-    prisma.workflowInstance.findUnique.mockResolvedValue({
-      id: BigInt(1),
-      temporalRunId: 'run-1',
-    });
-    prisma.workflowNodeExecution.findUnique.mockResolvedValue({
-      input: { approvers: ['alice'] },
+    prisma.approvalRequest.findUnique.mockResolvedValue({
+      id: BigInt(7),
+      status: 'PENDING',
     });
+    humanApproval.submitDecision.mockRejectedValue(
+      new Error('not an approver'),
+    );
+
     await expect(
       service.approveInstance(
         BigInt(1),
@@ -1036,36 +1794,38 @@ describe('WorkflowService — approveInstance', () => {
       ),
     ).rejects.toThrow('not an approver');
     expect(temporal.signalWorkflow).not.toHaveBeenCalled();
+    expect(humanApproval.submitDecision).toHaveBeenCalledWith(
+      BigInt(7),
+      { decision: 'APPROVE', comment: undefined },
+      { userId: 'bob' },
+    );
   });
 
-  it('forwards signal with real approverId when caller is authorized', async () => {
-    prisma.workflowInstance.findUnique.mockResolvedValue({
-      id: BigInt(1),
-      temporalRunId: 'run-1',
-    });
-    prisma.workflowNodeExecution.findUnique.mockResolvedValue({
-      input: { approvers: ['alice'] },
+  it('submits the real approver identity through the approval service', async () => {
+    prisma.approvalRequest.findUnique.mockResolvedValue({
+      id: BigInt(7),
+      status: 'PENDING',
     });
-    await service.approveInstance(
-      BigInt(1),
-      { nodeId: 'n1', approved: true, comment: 'ok' },
-      'alice',
-      temporal,
+    humanApproval.submitDecision.mockResolvedValue({ status: 'APPROVED' });
+
+    await expect(
+      service.approveInstance(
+        BigInt(1),
+        { nodeId: 'n1', approved: true, comment: 'ok' },
+        'alice',
+        temporal,
+      ),
+    ).resolves.toEqual({ status: 'APPROVED' });
+    expect(humanApproval.submitDecision).toHaveBeenCalledWith(
+      BigInt(7),
+      { decision: 'APPROVE', comment: 'ok' },
+      { userId: 'alice' },
     );
-    expect(temporal.signalWorkflow).toHaveBeenCalledWith('run-1', 'approval', {
-      nodeId: 'n1',
-      approved: true,
-      approvedBy: 'alice',
-      comment: 'ok',
-    });
   });
 
-  it('throws NotFoundException when no node execution exists for nodeId', async () => {
-    prisma.workflowInstance.findUnique.mockResolvedValue({
-      id: BigInt(1),
-      temporalRunId: 'run-1',
-    });
-    prisma.workflowNodeExecution.findUnique.mockResolvedValue(null);
+  it('throws NotFoundException when no open approval request exists', async () => {
+    prisma.approvalRequest.findUnique.mockResolvedValue(null);
+
     await expect(
       service.approveInstance(
         BigInt(1),
@@ -1073,6 +1833,6 @@ describe('WorkflowService — approveInstance', () => {
         'alice',
         temporal,
       ),
-    ).rejects.toThrow('Node execution not found');
+    ).rejects.toThrow('Open approval request not found');
   });
 });