@rytass/bpm-core-nestjs-module 0.1.2 → 0.1.3

package/src/lib/workflow-engine/workflow-engine.service.ts

@@ -0,0 +1,4707 @@
+import {
+  FormDefinitionSchema,
+  FormFieldDefinition,
+  NumberFieldDefinition,
+} from '@rytass/bpm-core-shared/form';
+import {
+  WorkflowDefinition,
+  WorkflowEdge,
+  DecisionPolicy,
+  WorkflowNode,
+  UserTaskNode,
+  ServiceTaskNode,
+  ApproverResolver,
+  ApproverResolverFallback,
+  ReturnResubmitStrategy,
+} from '@rytass/bpm-core-shared/workflow';
+import {
+  BadRequestException,
+  ConflictException,
+  Inject,
+  Injectable,
+  NotFoundException,
+  Optional,
+} from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+import {
+  EntityManager,
+  In,
+  IsNull,
+  Repository,
+  SelectQueryBuilder,
+} from 'typeorm';
+import { AttachmentService } from '../attachment/attachment.service';
+import {
+  DelegationService,
+  DelegationStep,
+} from '../delegation/delegation.service';
+import { FormDefinitionVersionEntity } from '../form/form-definition-version.entity';
+import { FormDefinitionVersionStatusEnum } from '../form/form.enums';
+import {
+  calculateTaskSlaDueAt,
+  NotificationService,
+} from '../notification/notification.service';
+import { NotificationEntity } from '../notification/notification.entity';
+import { SignatureService } from '../signature/signature.service';
+import { ConditionService } from '../condition/condition.service';
+import { BPMAuthContext } from '../bpm-auth';
+import { ManagerResolutionEntity } from '../organization/manager-resolution.entity';
+import { MembershipEntity } from '../organization/membership.entity';
+import { OrgUnitEntity } from '../organization/org-unit.entity';
+import { ManagerResolutionScopeTypeEnum } from '../organization/organization.enums';
+import { ApprovalTemplateVersionEntity } from '../template/approval-template-version.entity';
+import { ApprovalTemplateEntity } from '../template/approval-template.entity';
+import { CancelApprovalInstanceInput } from './dto/cancel-approval-instance.input';
+import { ApprovalTemplateVersionStatusEnum } from '../template/template.enums';
+import { DecideTaskInput } from './dto/decide-task.input';
+import { DryRunApprovalWorkflowInput } from './dto/dry-run-approval-workflow.input';
+import { ResubmitApprovalInstanceInput } from './dto/resubmit-approval-instance.input';
+import { SubmitApprovalInstanceInput } from './dto/submit-approval-instance.input';
+import { ActivityLogEntity } from './activity-log.entity';
+import { ApprovalInstanceEntity } from './approval-instance.entity';
+import { TaskDecisionEntity } from './task-decision.entity';
+import { TaskCandidateEntity } from './task-candidate.entity';
+import { TaskEntity } from './task.entity';
+import {
+  ActivityLogEventTypeEnum,
+  ApprovalInstanceListViewEnum,
+  ApprovalInstanceStateEnum,
+  TaskAssignmentTypeEnum,
+  TaskCandidateStatusEnum,
+  TaskDecisionActionEnum,
+  TaskStatusEnum,
+  WorkflowTokenStatusEnum,
+} from './workflow-engine.enums';
+import { evaluateWorkflowEdgeCondition } from './workflow-condition-evaluator';
+import {
+  WorkflowDryRunResultObject,
+  WorkflowDryRunStepObject,
+} from './workflow-dry-run.object';
+import {
+  BPM_WORKFLOW_SERVICE_TASK_DISPATCHER,
+  BPMWorkflowServiceTaskDispatcher,
+  BPMWorkflowWebhookDispatchResult,
+  DefaultWorkflowServiceTaskDispatcher,
+} from './workflow-service-task-dispatcher.token';
+import { WorkflowTokenEntity } from './workflow-token.entity';
+
+const MAX_PROCESSING_STEPS = 500;
+const DEFAULT_APPROVAL_HISTORY_TASK_LIMIT = 50;
+const SYSTEM_DRY_RUN_INSTANCE_ID = 'dry-run-instance';
+
+interface DryRunSimulationInput {
+  readonly formData: Readonly<Record<string, unknown>>;
+  readonly initiatorMemberId: string;
+  readonly initiatorMetadataSnapshot: Readonly<Record<string, unknown>>;
+  readonly workflowDefinition: WorkflowDefinition;
+}
+
+interface DryRunPathInput extends DryRunSimulationInput {
+  readonly depth: number;
+  readonly incomingEdge: WorkflowEdge | null;
+  readonly lastDecision: Readonly<Record<string, unknown>> | null;
+  readonly nodeId: string;
+  readonly steps: readonly WorkflowDryRunStepObject[];
+  readonly visitedNodeIds: ReadonlySet<string>;
+}
+
+interface ReturnedInstanceContext {
+  readonly resubmitStrategy: ReturnResubmitStrategy;
+  readonly returnedFromNodeId: string;
+  readonly returnToNodeId: string;
+}
+
+interface ResolvedApproverCandidate {
+  readonly memberId: string;
+  readonly sourceType: ApproverResolver['type'];
+}
+
+interface RuntimeTaskCandidate {
+  readonly delegationChain: readonly DelegationStep[];
+  readonly memberId: string;
+  readonly originalMemberId: string;
+  readonly sourceType: ApproverResolver['type'];
+}
+
+interface ListApprovalInstancesOptions {
+  readonly page?: number;
+  readonly pageSize?: number;
+  readonly searchText?: string;
+  readonly state?: readonly ApprovalInstanceStateEnum[];
+  readonly templateId?: string;
+  readonly view?: ApprovalInstanceListViewEnum;
+}
+
+interface WorkflowDashboardSummaryOptions {
+  readonly from?: Date;
+  readonly to?: Date;
+}
+
+type WorkflowReadScope = BPMAuthContext;
+type FormConditionOperator =
+  | 'equals'
+  | 'greaterThan'
+  | 'greaterThanOrEqual'
+  | 'lessThan'
+  | 'lessThanOrEqual'
+  | 'notEquals';
+
+const WORKFLOW_READ_ALL_PERMISSIONS = new Set([
+  'bpm:*',
+  'bpm.workflow.read_all',
+  'bpm:workflow:read_all',
+  'workflow.read_all',
+]);
+
+@Injectable()
+export class WorkflowEngineService {
+  constructor(
+    @InjectRepository(ApprovalInstanceEntity)
+    private readonly approvalInstanceRepository: Repository<ApprovalInstanceEntity>,
+    @InjectRepository(WorkflowTokenEntity)
+    private readonly workflowTokenRepository: Repository<WorkflowTokenEntity>,
+    @InjectRepository(TaskEntity)
+    private readonly taskRepository: Repository<TaskEntity>,
+    @InjectRepository(TaskCandidateEntity)
+    private readonly taskCandidateRepository: Repository<TaskCandidateEntity>,
+    @InjectRepository(TaskDecisionEntity)
+    private readonly taskDecisionRepository: Repository<TaskDecisionEntity>,
+    @InjectRepository(NotificationEntity)
+    private readonly notificationRepository: Repository<NotificationEntity>,
+    @InjectRepository(ActivityLogEntity)
+    private readonly activityLogRepository: Repository<ActivityLogEntity>,
+    @InjectRepository(ApprovalTemplateEntity)
+    private readonly approvalTemplateRepository: Repository<ApprovalTemplateEntity>,
+    @InjectRepository(ApprovalTemplateVersionEntity)
+    private readonly approvalTemplateVersionRepository: Repository<ApprovalTemplateVersionEntity>,
+    @InjectRepository(FormDefinitionVersionEntity)
+    private readonly formDefinitionVersionRepository: Repository<FormDefinitionVersionEntity>,
+    private readonly attachmentService: AttachmentService,
+    private readonly conditionService: ConditionService,
+    private readonly delegationService: DelegationService,
+    private readonly notificationService: NotificationService,
+    private readonly signatureService: SignatureService,
+    @Optional()
+    @Inject(BPM_WORKFLOW_SERVICE_TASK_DISPATCHER)
+    private readonly serviceTaskDispatcher: BPMWorkflowServiceTaskDispatcher = new DefaultWorkflowServiceTaskDispatcher(),
+  ) {}
+
+  async submitApprovalInstance(
+    input: SubmitApprovalInstanceInput,
+  ): Promise<ApprovalInstanceEntity> {
+    const formData = parseJsonObject(input.formDataJson, 'formDataJson');
+    const template = await this.getTemplateOrThrow(input.templateId);
+
+    if (!template.currentVersionId) {
+      throw new ConflictException(
+        'Approval template does not have a published version',
+      );
+    }
+
+    const templateVersion = await this.getPublishedTemplateVersionOrThrow(
+      template.currentVersionId,
+    );
+    const formDefinitionVersion = await this.getPublishedFormVersionOrThrow(
+      templateVersion.formDefinitionVersionId,
+    );
+    validateSubmittedFormData(formDefinitionVersion.schema, formData);
+    const initiatorMetadataSnapshot = input.initiatorMetadataSnapshotJson
+      ? parseJsonObject(
+          input.initiatorMetadataSnapshotJson,
+          'initiatorMetadataSnapshotJson',
+        )
+      : await this.readDefaultInitiatorMetadataSnapshot(
+          input.initiatorMemberId,
+        );
+
+    if (
+      !this.conditionService.evaluateBoolean(
+        templateVersion.initiatorPolicyCel,
+        buildInitiatorPolicyContext(initiatorMetadataSnapshot),
+        'initiatorPolicyCel',
+      )
+    ) {
+      throw new ConflictException(
+        'Current member is not allowed to start this approval template',
+      );
+    }
+
+    const startedAt = new Date();
+    const startNode = templateVersion.workflowDefinition.nodes.find(
+      (node) => node.type === 'startEvent',
+    );
+
+    if (!startNode) {
+      throw new BadRequestException(
+        'Published workflow does not include a startEvent',
+      );
+    }
+
+    return this.approvalInstanceRepository.manager.transaction(
+      async (manager): Promise<ApprovalInstanceEntity> => {
+        const instanceRepository = manager.getRepository(
+          ApprovalInstanceEntity,
+        );
+        const tokenRepository = manager.getRepository(WorkflowTokenEntity);
+        const activityRepository = manager.getRepository(ActivityLogEntity);
+        const instance = await instanceRepository.save(
+          instanceRepository.create({
+            completedAt: null,
+            formData,
+            formDefinitionSnapshot: {
+              formDefinitionVersionId: formDefinitionVersion.id,
+              schema: formDefinitionVersion.schema,
+              uiSchema: formDefinitionVersion.uiSchema,
+              version: formDefinitionVersion.version,
+            },
+            initiatorMemberId: input.initiatorMemberId,
+            initiatorMetadataSnapshot,
+            startedAt,
+            state: ApprovalInstanceStateEnum.RUNNING,
+            templateId: template.id,
+            templateVersionId: templateVersion.id,
+            title: input.title?.trim() || template.name,
+            workflowSnapshot: templateVersion.workflowDefinition,
+          }),
+        );
+        await this.attachmentService.bindFormDataAttachmentsToInstance(
+          manager,
+          {
+            formData,
+            instanceId: instance.id,
+          },
+        );
+        const token = await tokenRepository.save(
+          tokenRepository.create({
+            consumedAt: null,
+            currentNodeId: startNode.id,
+            instanceId: instance.id,
+            parentTokenId: null,
+            status: WorkflowTokenStatusEnum.ACTIVE,
+          }),
+        );
+
+        await activityRepository.save([
+          activityRepository.create({
+            actorMemberId: input.initiatorMemberId,
+            eventType: ActivityLogEventTypeEnum.INSTANCE_STARTED,
+            instanceId: instance.id,
+            nodeId: startNode.id,
+            payload: {
+              templateId: template.id,
+              templateVersionId: templateVersion.id,
+            },
+            taskId: null,
+          }),
+          activityRepository.create({
+            actorMemberId: null,
+            eventType: ActivityLogEventTypeEnum.TOKEN_CREATED,
+            instanceId: instance.id,
+            nodeId: startNode.id,
+            payload: {
+              tokenId: token.id,
+            },
+            taskId: null,
+          }),
+        ]);
+        await this.processRunningInstance(manager, instance);
+
+        return instance;
+      },
+    );
+  }
+
+  async processInstance(instanceId: string): Promise<void> {
+    await this.approvalInstanceRepository.manager.transaction(
+      async (manager): Promise<void> => {
+        await manager.query('SELECT pg_advisory_xact_lock(hashtext($1))', [
+          instanceId,
+        ]);
+
+        const instance = await manager
+          .getRepository(ApprovalInstanceEntity)
+          .findOne({ where: { id: instanceId } });
+
+        if (!instance) {
+          throw new NotFoundException(
+            `Approval instance ${instanceId} was not found`,
+          );
+        }
+
+        await manager.getRepository(ActivityLogEntity).save(
+          manager.getRepository(ActivityLogEntity).create({
+            actorMemberId: null,
+            eventType: ActivityLogEventTypeEnum.ENGINE_PROCESS_REQUESTED,
+            instanceId,
+            nodeId: null,
+            payload: {
+              state: instance.state,
+            },
+            taskId: null,
+          }),
+        );
+
+        if (instance.state !== ApprovalInstanceStateEnum.RUNNING) {
+          return;
+        }
+
+        await this.processRunningInstance(manager, instance);
+      },
+    );
+  }
+
+  async decideTask(input: DecideTaskInput): Promise<TaskDecisionEntity> {
+    return this.approvalInstanceRepository.manager.transaction(
+      async (manager): Promise<TaskDecisionEntity> => {
+        const taskRepository = manager.getRepository(TaskEntity);
+        const taskCandidateRepository =
+          manager.getRepository(TaskCandidateEntity);
+        const taskDecisionRepository =
+          manager.getRepository(TaskDecisionEntity);
+        const activityRepository = manager.getRepository(ActivityLogEntity);
+        const tokenRepository = manager.getRepository(WorkflowTokenEntity);
+        const instanceRepository = manager.getRepository(
+          ApprovalInstanceEntity,
+        );
+        const task = await taskRepository.findOne({
+          where: { id: input.taskId },
+        });
+
+        if (!task) {
+          throw new NotFoundException(`Task ${input.taskId} was not found`);
+        }
+
+        await manager.query('SELECT pg_advisory_xact_lock(hashtext($1))', [
+          task.instanceId,
+        ]);
+
+        if (
+          task.status !== TaskStatusEnum.PENDING &&
+          task.status !== TaskStatusEnum.IN_PROGRESS
+        ) {
+          throw new ConflictException(`Task ${task.id} is not pending`);
+        }
+
+        const taskCandidates = await taskCandidateRepository.find({
+          where: { taskId: task.id },
+        });
+        const actorCandidate = taskCandidates.find(
+          (candidate) => candidate.memberId === input.decidedByMemberId,
+        );
+        const isDirectAssignee =
+          task.assigneeMemberId === input.decidedByMemberId;
+
+        if (!isDirectAssignee && !actorCandidate) {
+          throw new ConflictException(
+            `Task ${task.id} is assigned to another member`,
+          );
+        }
+
+        if (
+          actorCandidate &&
+          actorCandidate.status !== TaskCandidateStatusEnum.PENDING &&
+          actorCandidate.status !== TaskCandidateStatusEnum.CLAIMED
+        ) {
+          throw new ConflictException(
+            `Task ${task.id} was already decided by this member`,
+          );
+        }
+
+        if (
+          input.action !== TaskDecisionActionEnum.APPROVED &&
+          input.action !== TaskDecisionActionEnum.REJECTED &&
+          input.action !== TaskDecisionActionEnum.RETURNED &&
+          input.action !== TaskDecisionActionEnum.TRANSFERRED
+        ) {
+          throw new ConflictException(
+            `Task decision action ${input.action} is not supported yet`,
+          );
+        }
+        const decisionComment = input.comment?.trim() || null;
+
+        if (
+          input.action === TaskDecisionActionEnum.REJECTED &&
+          !decisionComment
+        ) {
+          throw new BadRequestException('Reject decision comment is required');
+        }
+        const transferToMemberId = input.transferToMemberId?.trim() || null;
+
+        if (
+          input.action === TaskDecisionActionEnum.TRANSFERRED &&
+          !transferToMemberId
+        ) {
+          throw new BadRequestException('Transfer target member is required');
+        }
+
+        if (
+          input.action === TaskDecisionActionEnum.TRANSFERRED &&
+          transferToMemberId === input.decidedByMemberId
+        ) {
+          throw new ConflictException(
+            'Transfer target must be a different member',
+          );
+        }
+
+        const instance = await instanceRepository.findOne({
+          where: { id: task.instanceId },
+        });
+
+        if (!instance) {
+          throw new NotFoundException(
+            `Approval instance ${task.instanceId} was not found`,
+          );
+        }
+
+        if (instance.state !== ApprovalInstanceStateEnum.RUNNING) {
+          throw new ConflictException(
+            `Approval instance ${instance.id} is not running`,
+          );
+        }
+
+        const returnToNodeId =
+          input.action === TaskDecisionActionEnum.RETURNED
+            ? readReturnTargetNodeId(
+                instance.workflowSnapshot,
+                task.nodeId,
+                input.returnToNodeId,
+              )
+            : null;
+        const decidedAt = new Date();
+        const claimedTask = await taskRepository.save({
+          ...task,
+          assigneeMemberId: task.assigneeMemberId ?? input.decidedByMemberId,
+          openedAt: task.openedAt ?? decidedAt,
+          originalAssigneeMemberId:
+            task.originalAssigneeMemberId ??
+            actorCandidate?.originalMemberId ??
+            input.decidedByMemberId,
+          status: TaskStatusEnum.IN_PROGRESS,
+        });
+        const claimedCandidate = actorCandidate
+          ? await taskCandidateRepository.save({
+              ...actorCandidate,
+              claimedAt: actorCandidate.claimedAt ?? decidedAt,
+              status: TaskCandidateStatusEnum.CLAIMED,
+            })
+          : null;
+        const signature = await this.signatureService.signTaskDecision(
+          manager,
+          {
+            action: input.action,
+            comment: decisionComment,
+            decidedAt,
+            instance,
+            returnToNodeId,
+            signerMemberId: input.decidedByMemberId,
+            task: claimedTask,
+            transferToMemberId,
+          },
+        );
+        const decision = await taskDecisionRepository.save(
+          taskDecisionRepository.create({
+            action: input.action,
+            comment: decisionComment,
+            decidedAt,
+            decidedByMemberId: input.decidedByMemberId,
+            returnToNodeId,
+            signatureId: signature.id,
+            taskId: task.id,
+            transferToMemberId,
+          }),
+        );
+
+        if (input.action === TaskDecisionActionEnum.TRANSFERRED) {
+          await this.transferTask(
+            manager,
+            instance,
+            claimedTask,
+            decision,
+            signature,
+            transferToMemberId,
+            decisionComment,
+            decidedAt,
+            claimedCandidate,
+          );
+
+          return decision;
+        }
+
+        const nextCandidateRows = await this.markTaskCandidateDecision({
+          action: input.action,
+          candidate: claimedCandidate,
+          candidates: taskCandidates,
+          decidedAt,
+          manager,
+          task: claimedTask,
+        });
+        const shouldCompleteTask = shouldCompleteTaskAfterDecision({
+          action: input.action,
+          candidates: nextCandidateRows,
+          decisionPolicy: readDecisionPolicySnapshot(claimedTask),
+        });
+        const completedTask = shouldCompleteTask
+          ? await taskRepository.save({
+              ...claimedTask,
+              completedAt: decidedAt,
+              status: TaskStatusEnum.COMPLETED,
+            })
+          : await taskRepository.save({
+              ...claimedTask,
+              status: TaskStatusEnum.IN_PROGRESS,
+            });
+
+        await activityRepository.save(
+          activityRepository.create({
+            actorMemberId: input.decidedByMemberId,
+            eventType: ActivityLogEventTypeEnum.TASK_DECIDED,
+            instanceId: instance.id,
+            nodeId: claimedTask.nodeId,
+            payload: {
+              action: input.action,
+              comment: decisionComment,
+              decisionId: decision.id,
+              signatureId: signature.id,
+              signedPayloadHash: signature.signedPayloadHash,
+            },
+            taskId: completedTask.id,
+          }),
+        );
+
+        if (
+          input.action === TaskDecisionActionEnum.APPROVED &&
+          shouldCompleteTask
+        ) {
+          const token = await tokenRepository.findOne({
+            where: { id: claimedTask.tokenId },
+          });
+
+          if (!token) {
+            throw new NotFoundException(
+              `Workflow token ${claimedTask.tokenId} was not found`,
+            );
+          }
+
+          if (token.status !== WorkflowTokenStatusEnum.WAITING) {
+            throw new ConflictException(
+              `Workflow token ${token.id} is not waiting for a task decision`,
+            );
+          }
+
+          const activeToken = await tokenRepository.save({
+            ...token,
+            consumedAt: null,
+            status: WorkflowTokenStatusEnum.ACTIVE,
+          });
+
+          await this.advanceTokenToOutgoingNodes(
+            manager,
+            instance,
+            activeToken,
+            readWorkflowNodeOrThrow(
+              instance.workflowSnapshot,
+              claimedTask.nodeId,
+            ),
+          );
+          await this.processRunningInstance(manager, instance);
+
+          return decision;
+        }
+
+        if (input.action === TaskDecisionActionEnum.APPROVED) {
+          return decision;
+        }
+
+        if (input.action === TaskDecisionActionEnum.RETURNED) {
+          await this.returnInstanceToNode(
+            manager,
+            instance,
+            completedTask,
+            returnToNodeId,
+            decidedAt,
+          );
+
+          return decision;
+        }
+
+        await this.rejectInstance(manager, instance, completedTask, decidedAt);
+
+        return decision;
+      },
+    );
+  }
+
+  async cancelApprovalInstance(
+    input: CancelApprovalInstanceInput,
+  ): Promise<ApprovalInstanceEntity> {
+    return this.approvalInstanceRepository.manager.transaction(
+      async (manager): Promise<ApprovalInstanceEntity> => {
+        await manager.query('SELECT pg_advisory_xact_lock(hashtext($1))', [
+          input.instanceId,
+        ]);
+
+        const instanceRepository = manager.getRepository(
+          ApprovalInstanceEntity,
+        );
+        const instance = await instanceRepository.findOne({
+          where: { id: input.instanceId },
+        });
+
+        if (!instance) {
+          throw new NotFoundException(
+            `Approval instance ${input.instanceId} was not found`,
+          );
+        }
+
+        if (instance.initiatorMemberId !== input.cancelledByMemberId) {
+          throw new ConflictException(
+            `Approval instance ${instance.id} can only be cancelled by its initiator`,
+          );
+        }
+
+        if (
+          instance.state !== ApprovalInstanceStateEnum.RUNNING &&
+          instance.state !== ApprovalInstanceStateEnum.RETURNED
+        ) {
+          throw new ConflictException(
+            `Approval instance ${instance.id} is not cancellable`,
+          );
+        }
+
+        const cancelledAt = new Date();
+        await this.consumeOpenRuntimeState(
+          manager,
+          instance,
+          cancelledAt,
+          TaskStatusEnum.CANCELLED,
+        );
+        const cancelledInstance = await instanceRepository.save({
+          ...instance,
+          completedAt: cancelledAt,
+          state: ApprovalInstanceStateEnum.CANCELLED,
+        });
+
+        await manager.getRepository(ActivityLogEntity).save(
+          manager.getRepository(ActivityLogEntity).create({
+            actorMemberId: input.cancelledByMemberId,
+            eventType: ActivityLogEventTypeEnum.INSTANCE_CANCELLED,
+            instanceId: instance.id,
+            nodeId: null,
+            payload: {
+              comment: input.comment?.trim() || null,
+            },
+            taskId: null,
+          }),
+        );
+
+        return cancelledInstance;
+      },
+    );
+  }
+
+  async resubmitApprovalInstance(
+    input: ResubmitApprovalInstanceInput,
+  ): Promise<ApprovalInstanceEntity> {
+    const formData = parseJsonObject(input.formDataJson, 'formDataJson');
+
+    return this.approvalInstanceRepository.manager.transaction(
+      async (manager): Promise<ApprovalInstanceEntity> => {
+        await manager.query('SELECT pg_advisory_xact_lock(hashtext($1))', [
+          input.instanceId,
+        ]);
+
+        const instanceRepository = manager.getRepository(
+          ApprovalInstanceEntity,
+        );
+        const instance = await instanceRepository.findOne({
+          where: { id: input.instanceId },
+        });
+
+        if (!instance) {
+          throw new NotFoundException(
+            `Approval instance ${input.instanceId} was not found`,
+          );
+        }
+
+        if (instance.initiatorMemberId !== input.initiatorMemberId) {
+          throw new ConflictException(
+            `Approval instance ${instance.id} can only be resubmitted by its initiator`,
+          );
+        }
+
+        if (instance.state !== ApprovalInstanceStateEnum.RETURNED) {
+          throw new ConflictException(
+            `Approval instance ${instance.id} is not returned`,
+          );
+        }
+
+        validateSubmittedFormData(
+          readFormDefinitionSnapshotSchema(instance.formDefinitionSnapshot),
+          formData,
+        );
+
+        const resubmittedInstance = await instanceRepository.save({
+          ...instance,
+          completedAt: null,
+          formData,
+          state: ApprovalInstanceStateEnum.RUNNING,
+          title: input.title?.trim() || instance.title,
+        });
+        await this.attachmentService.bindFormDataAttachmentsToInstance(
+          manager,
+          {
+            formData,
+            instanceId: instance.id,
+          },
+        );
+        const returnedContext = await this.readLatestReturnedInstanceContext(
+          manager,
+          instance.id,
+        );
+        const runtimeInstance =
+          returnedContext?.resubmitStrategy === 'FROM_RETURN_POINT'
+            ? await this.resumeReturnedInstanceFromReturnPoint(
+                manager,
+                resubmittedInstance,
+                returnedContext,
+                new Date(),
+              )
+            : resubmittedInstance;
+
+        await manager.getRepository(ActivityLogEntity).save(
+          manager.getRepository(ActivityLogEntity).create({
+            actorMemberId: input.initiatorMemberId,
+            eventType: ActivityLogEventTypeEnum.INSTANCE_RESUBMITTED,
+            instanceId: instance.id,
+            nodeId: null,
+            payload: {
+              resubmitStrategy: returnedContext?.resubmitStrategy ?? 'RESTART',
+            },
+            taskId: null,
+          }),
+        );
+        await this.processRunningInstance(manager, runtimeInstance);
+
+        return runtimeInstance;
+      },
+    );
+  }
+
+  dryRunApprovalWorkflow(
+    input: DryRunApprovalWorkflowInput,
+  ): WorkflowDryRunResultObject {
+    const workflowDefinition = parseWorkflowDefinition(
+      input.workflowDefinitionJson,
+    );
+    const formData = parseJsonObject(input.formDataJson, 'formDataJson');
+    const initiatorMetadataSnapshot = input.initiatorMetadataSnapshotJson
+      ? parseJsonObject(
+          input.initiatorMetadataSnapshotJson,
+          'initiatorMetadataSnapshotJson',
+        )
+      : readDefaultInitiatorMetadataSnapshot(input.initiatorMemberId);
+
+    try {
+      return Object.assign(new WorkflowDryRunResultObject(), {
+        errors: [],
+        steps: this.simulateWorkflow({
+          formData,
+          initiatorMemberId: input.initiatorMemberId,
+          initiatorMetadataSnapshot,
+          workflowDefinition,
+        }),
+        valid: true,
+      });
+    } catch (error: unknown) {
+      return Object.assign(new WorkflowDryRunResultObject(), {
+        errors: [error instanceof Error ? error.message : 'Dry run failed'],
+        steps: [],
+        valid: false,
+      });
+    }
+  }
+
+  private simulateWorkflow(
+    input: DryRunSimulationInput,
+  ): readonly WorkflowDryRunStepObject[] {
+    const startNode = input.workflowDefinition.nodes.find(
+      (node) => node.type === 'startEvent',
+    );
+
+    if (!startNode) {
+      throw new BadRequestException('Workflow does not include a startEvent');
+    }
+
+    return this.simulateWorkflowPath({
+      ...input,
+      depth: 0,
+      incomingEdge: null,
+      lastDecision: null,
+      nodeId: startNode.id,
+      steps: [],
+      visitedNodeIds: new Set(),
+    });
+  }
+
+  private simulateWorkflowPath(
+    input: DryRunPathInput,
+  ): readonly WorkflowDryRunStepObject[] {
+    if (input.depth > MAX_PROCESSING_STEPS) {
+      throw new ConflictException('Dry run exceeded maximum processing steps');
+    }
+
+    const node = readWorkflowNodeOrThrow(
+      input.workflowDefinition,
+      input.nodeId,
+    );
+    const visitKey = `${input.nodeId}:${input.incomingEdge?.id ?? 'start'}`;
+    const entryCondition = readNodeEntryCondition(node);
+
+    if (input.visitedNodeIds.has(visitKey)) {
+      return [
+        ...input.steps,
+        createDryRunStep({
+          assigneeMemberId: null,
+          edge: input.incomingEdge,
+          edgeMatched: null,
+          edgeReason: null,
+          entryCondition,
+          entryConditionMet: null,
+          message: '偵測到循環路徑，已停止此分支。',
+          node,
+          status: 'STOPPED',
+          stepIndex: input.steps.length,
+        }),
+      ];
+    }
+
+    const nextVisitedNodeIds = new Set([...input.visitedNodeIds, visitKey]);
+    const entryConditionMet = this.conditionService.evaluateBoolean(
+      entryCondition,
+      buildDryRunExpressionContext(input, input.lastDecision),
+      `workflow.nodes.${node.id}.data.entryCondition`,
+    );
+    const assigneeMemberId =
+      entryConditionMet && node.type === 'userTask'
+        ? this.resolveDryRunAssigneeMemberId(
+            input,
+            node.data.approverResolver,
+            `workflow.nodes.${node.id}.data.approverResolver`,
+          )
+        : null;
+    const nextLastDecision =
+      entryConditionMet && node.type === 'userTask'
+        ? {
+            action: TaskDecisionActionEnum.APPROVED,
+            assigneeMemberId,
+            nodeId: node.id,
+          }
+        : input.lastDecision;
+    const nextSteps = [
+      ...input.steps,
+      createDryRunStep({
+        assigneeMemberId,
+        edge: input.incomingEdge,
+        edgeMatched: input.incomingEdge ? true : null,
+        edgeReason: readDryRunEdgeReason(input.incomingEdge),
+        entryCondition,
+        entryConditionMet,
+        message: readDryRunStepMessage(node, entryConditionMet),
+        node,
+        status: readDryRunStepStatus(node, entryConditionMet),
+        stepIndex: input.steps.length,
+      }),
+    ];
+
+    if (!entryConditionMet || node.type === 'endEvent') {
+      if (node.type === 'endEvent') {
+        return nextSteps;
+      }
+
+      return readOutgoingEdgesOrThrow(input.workflowDefinition, node.id).reduce(
+        (steps, edge) =>
+          this.simulateWorkflowPath({
+            ...input,
+            depth: input.depth + 1,
+            incomingEdge: edge,
+            lastDecision: nextLastDecision,
+            nodeId: edge.target,
+            steps,
+            visitedNodeIds: nextVisitedNodeIds,
+          }),
+        nextSteps,
+      );
+    }
+
+    const outgoingEdges = this.readDryRunAvailableOutgoingEdges(
+      input,
+      node,
+      nextLastDecision,
+    );
+
+    return outgoingEdges.reduce(
+      (steps, edge) =>
+        this.simulateWorkflowPath({
+          ...input,
+          depth: input.depth + 1,
+          incomingEdge: edge,
+          lastDecision: nextLastDecision,
+          nodeId: edge.target,
+          steps,
+          visitedNodeIds: nextVisitedNodeIds,
+        }),
+      nextSteps,
+    );
+  }
+
+  private readDryRunAvailableOutgoingEdges(
+    input: DryRunSimulationInput,
+    node: WorkflowNode,
+    lastDecision: Readonly<Record<string, unknown>> | null,
+  ): readonly WorkflowEdge[] {
+    if (node.type === 'endEvent') {
+      return [];
+    }
+
+    const outgoingEdges = readOutgoingEdgesOrThrow(
+      input.workflowDefinition,
+      node.id,
+    );
+    const conditionalEdges = outgoingEdges.filter(
+      (edge) => !edge.data.isDefault && edgeHasCondition(edge),
+    );
+
+    if (conditionalEdges.length === 0) {
+      return outgoingEdges;
+    }
+
+    const matchingEdges = conditionalEdges.filter((edge) =>
+      this.evaluateDryRunEdge(input, edge, lastDecision),
+    );
+
+    if (matchingEdges.length > 0) {
+      return node.type === 'exclusiveGateway'
+        ? [matchingEdges[0]]
+        : matchingEdges;
+    }
+
+    const defaultEdges = outgoingEdges.filter((edge) => edge.data.isDefault);
+
+    if (defaultEdges.length > 0) {
+      return node.type === 'exclusiveGateway'
+        ? [defaultEdges[0]]
+        : defaultEdges;
+    }
+
+    throw new ConflictException(
+      `Workflow node ${node.id} has no matching outgoing edge`,
+    );
+  }
+
+  private evaluateDryRunEdge(
+    input: DryRunSimulationInput,
+    edge: WorkflowEdge,
+    lastDecision: Readonly<Record<string, unknown>> | null,
+  ): boolean {
+    const expression = edge.data.condition?.trim();
+
+    if (expression) {
+      return this.conditionService.evaluateBoolean(
+        expression,
+        buildDryRunExpressionContext(input, lastDecision),
+        `workflow.edges.${edge.id}.data.condition`,
+      );
+    }
+
+    return evaluateWorkflowEdgeCondition(edge, { formData: input.formData });
+  }
+
+  private resolveDryRunAssigneeMemberId(
+    input: DryRunSimulationInput,
+    resolver: ApproverResolver,
+    label: string,
+  ): string {
+    if (resolver.type === 'DIRECT') {
+      return readMemberIdFromValue(resolver.memberIds, label);
+    }
+
+    if (resolver.type === 'DYNAMIC_FORM') {
+      return readMemberIdFromValue(
+        readValueAtPath(input.formData, resolver.formPath),
+        `${label}.formPath`,
+      );
+    }
+
+    if (resolver.type === 'EXPRESSION') {
+      return readMemberIdFromValue(
+        this.conditionService.evaluateValue(
+          resolver.expression,
+          buildDryRunExpressionContext(input, null),
+          `${label}.expression`,
+        ),
+        `${label}.expression`,
+      );
+    }
+
+    if (resolver.type === 'POSITION') {
+      return `position:${resolver.positionId}`;
+    }
+
+    if (resolver.type === 'ORG_UNIT_MEMBER') {
+      return `orgUnitMember:${resolver.orgUnitId}`;
+    }
+
+    if (resolver.type === 'ORG_UNIT_POSITION') {
+      return `orgUnitPosition:${resolver.orgUnitId}:${resolver.positionId}`;
+    }
+
+    if (resolver.type === 'ORG_UNIT_MANAGER') {
+      return `orgUnitManager:${resolver.orgUnitId}`;
+    }
+
+    return readMemberIdFromValue(
+      readManagerMemberIdFromInitiatorSnapshot(
+        input.initiatorMetadataSnapshot,
+        resolver.levelsUp,
+      ),
+      label,
+    );
+  }
+
+  async getApprovalInstance(
+    id: string,
+    scope?: WorkflowReadScope,
+  ): Promise<ApprovalInstanceEntity> {
+    const instance = await this.approvalInstanceRepository.findOne({
+      where: { id },
+    });
+
+    if (!instance) {
+      throw new NotFoundException(`Approval instance ${id} was not found`);
+    }
+
+    if (
+      scope &&
+      !canReadAllWorkflows(scope) &&
+      !(await this.isApprovalInstanceReadableByMember(instance, scope.memberId))
+    ) {
+      throw new NotFoundException(`Approval instance ${id} was not found`);
+    }
+
+    return instance;
+  }
+
+  async listApprovalInstances(
+    scope?: WorkflowReadScope,
+    options: ListApprovalInstancesOptions = {},
+  ): Promise<readonly ApprovalInstanceEntity[]> {
+    const queryBuilder = await this.createFilteredApprovalInstanceQueryBuilder(
+      scope,
+      options,
+    );
+
+    if (!queryBuilder) {
+      return [];
+    }
+
+    queryBuilder.orderBy('"approvalInstance"."created_at"', 'DESC');
+
+    if (shouldPaginateList(options)) {
+      queryBuilder
+        .skip(readPageOffset(options.page, options.pageSize))
+        .take(normalizePageSize(options.pageSize));
+    }
+
+    return queryBuilder.getMany();
+  }
+
+  async countApprovalInstances(
+    scope?: WorkflowReadScope,
+    options: Omit<ListApprovalInstancesOptions, 'page' | 'pageSize'> = {},
+  ): Promise<number> {
+    const queryBuilder = await this.createFilteredApprovalInstanceQueryBuilder(
+      scope,
+      options,
+    );
+
+    return queryBuilder ? queryBuilder.getCount() : 0;
+  }
+
+  async readApprovalInstancePageInfo(
+    scope?: WorkflowReadScope,
+    options: ListApprovalInstancesOptions = {},
+  ): Promise<{
+    readonly hasNextPage: boolean;
+    readonly hasPreviousPage: boolean;
+    readonly page: number;
+    readonly pageSize: number;
+    readonly totalCount: number;
+    readonly totalPages: number;
+  }> {
+    const totalCount = await this.countApprovalInstances(scope, options);
+    const page = normalizePage(options.page);
+    const pageSize = normalizePageSize(options.pageSize);
+    const totalPages = Math.max(Math.ceil(totalCount / pageSize), 1);
+
+    return {
+      hasNextPage: page < totalPages,
+      hasPreviousPage: page > 1,
+      page,
+      pageSize,
+      totalCount,
+      totalPages,
+    };
+  }
+
+  private async createFilteredApprovalInstanceQueryBuilder(
+    scope?: WorkflowReadScope,
+    options: Omit<ListApprovalInstancesOptions, 'page' | 'pageSize'> = {},
+  ): Promise<SelectQueryBuilder<ApprovalInstanceEntity> | null> {
+    const queryBuilder =
+      this.approvalInstanceRepository.createQueryBuilder('approvalInstance');
+    const hasReadableInstances = this.applyReadableInstanceFilter(
+      queryBuilder,
+      scope,
+      options,
+    );
+
+    if (!hasReadableInstances) {
+      return null;
+    }
+
+    const templateId = normalizeText(options.templateId);
+
+    if (options.state?.length) {
+      queryBuilder.andWhere('"approvalInstance"."state" IN (:...states)', {
+        states: [...options.state],
+      });
+    }
+
+    if (templateId) {
+      queryBuilder.andWhere('"approvalInstance"."template_id" = :templateId', {
+        templateId,
+      });
+    }
+
+    applyApprovalInstanceSearchFilter(queryBuilder, options.searchText);
+
+    return queryBuilder;
+  }
+
+  private applyReadableInstanceFilter(
+    queryBuilder: SelectQueryBuilder<ApprovalInstanceEntity>,
+    scope: WorkflowReadScope | undefined,
+    options: Omit<ListApprovalInstancesOptions, 'page' | 'pageSize'>,
+  ): boolean {
+    if (!scope) {
+      return true;
+    }
+
+    const view = options.view ?? ApprovalInstanceListViewEnum.ALL;
+
+    if (view === ApprovalInstanceListViewEnum.SENT) {
+      queryBuilder.andWhere(
+        '"approvalInstance"."initiator_member_id" = :readableMemberId',
+        {
+          readableMemberId: scope.memberId,
+        },
+      );
+
+      return true;
+    }
+
+    if (view === ApprovalInstanceListViewEnum.CC) {
+      queryBuilder.andWhere(
+        `
+          EXISTS (
+            SELECT 1
+            FROM "notifications" "readableNotification"
+            WHERE "readableNotification"."instance_id" = "approvalInstance"."id"
+              AND "readableNotification"."recipient_member_id" = :readableMemberId
+          )
+        `,
+        {
+          readableMemberId: scope.memberId,
+        },
+      );
+
+      return true;
+    }
+
+    if (canReadAllWorkflows(scope)) {
+      return true;
+    }
+
+    queryBuilder.andWhere(
+      `
+        (
+          "approvalInstance"."initiator_member_id" = :readableMemberId
+          OR EXISTS (
+            SELECT 1
+            FROM "tasks" "readableTask"
+            WHERE "readableTask"."instance_id" = "approvalInstance"."id"
+              AND (
+                "readableTask"."assignee_member_id" = :readableMemberId
+                OR "readableTask"."original_assignee_member_id" = :readableMemberId
+              )
+          )
+          OR EXISTS (
+            SELECT 1
+            FROM "task_candidates" "readableCandidate"
+            INNER JOIN "tasks" "readableCandidateTask"
+              ON "readableCandidateTask"."id" = "readableCandidate"."task_id"
+            WHERE "readableCandidateTask"."instance_id" = "approvalInstance"."id"
+              AND (
+                "readableCandidate"."member_id" = :readableMemberId
+                OR "readableCandidate"."original_member_id" = :readableMemberId
+              )
+          )
+          OR EXISTS (
+            SELECT 1
+            FROM "task_decisions" "readableDecision"
+            INNER JOIN "tasks" "readableDecisionTask"
+              ON "readableDecisionTask"."id" = "readableDecision"."task_id"
+            WHERE "readableDecisionTask"."instance_id" = "approvalInstance"."id"
+              AND "readableDecision"."decided_by_member_id" = :readableMemberId
+          )
+        )
+      `,
+      {
+        readableMemberId: scope.memberId,
+      },
+    );
+
+    return true;
+  }
+
+  async readWorkflowDashboardSummary(
+    scope?: WorkflowReadScope,
+    options: WorkflowDashboardSummaryOptions = {},
+  ): Promise<{
+    readonly activeInstanceCount: number;
+    readonly completedInstanceCount: number;
+    readonly overdueTaskCount: number;
+    readonly pendingTaskCount: number;
+    readonly rejectedInstanceCount: number;
+    readonly totalInstanceCount: number;
+  }> {
+    const instances = (
+      await this.listApprovalInstances(scope, {
+        view: ApprovalInstanceListViewEnum.ALL,
+      })
+    ).filter((instance) => isInstanceWithinRange(instance, options));
+    const instanceIds = instances.map((instance) => instance.id);
+    const openTasks = instanceIds.length
+      ? await this.taskRepository.find({
+          where: {
+            instanceId: In(instanceIds),
+            status: In([TaskStatusEnum.PENDING, TaskStatusEnum.IN_PROGRESS]),
+          },
+        })
+      : [];
+    const now = Date.now();
+
+    return {
+      activeInstanceCount: instances.filter(
+        (instance) => instance.state === ApprovalInstanceStateEnum.RUNNING,
+      ).length,
+      completedInstanceCount: instances.filter(
+        (instance) => instance.state === ApprovalInstanceStateEnum.APPROVED,
+      ).length,
+      overdueTaskCount: openTasks.filter(
+        (task) => task.slaDueAt && task.slaDueAt.getTime() <= now,
+      ).length,
+      pendingTaskCount: openTasks.length,
+      rejectedInstanceCount: instances.filter(
+        (instance) => instance.state === ApprovalInstanceStateEnum.REJECTED,
+      ).length,
+      totalInstanceCount: instances.length,
+    };
+  }
+
+  async listLaunchableApprovalTemplates(
+    memberId: string,
+  ): Promise<readonly ApprovalTemplateEntity[]> {
+    const templates = await this.approvalTemplateRepository.find({
+      order: { updatedAt: 'DESC' },
+    });
+    const currentVersionIds = templates
+      .map((template) => template.currentVersionId)
+      .filter((versionId): versionId is string => Boolean(versionId));
+
+    if (!currentVersionIds.length) {
+      return [];
+    }
+
+    const versions = await this.approvalTemplateVersionRepository.find({
+      where: {
+        id: In(currentVersionIds),
+        status: ApprovalTemplateVersionStatusEnum.PUBLISHED,
+      },
+    });
+    const versionById = new Map(
+      versions.map(
+        (version): readonly [string, ApprovalTemplateVersionEntity] => [
+          version.id,
+          version,
+        ],
+      ),
+    );
+    const initiatorMetadataSnapshot =
+      await this.readDefaultInitiatorMetadataSnapshot(memberId);
+
+    return templates.filter((template) => {
+      const currentVersion = template.currentVersionId
+        ? (versionById.get(template.currentVersionId) ?? null)
+        : null;
+
+      if (!currentVersion?.formDefinitionVersionId) {
+        return false;
+      }
+
+      return this.conditionService.evaluateBoolean(
+        currentVersion.initiatorPolicyCel,
+        buildInitiatorPolicyContext(initiatorMetadataSnapshot),
+        'initiatorPolicyCel',
+      );
+    });
+  }
+
+  async listWorkflowTokens(
+    instanceId: string,
+    scope?: WorkflowReadScope,
+  ): Promise<readonly WorkflowTokenEntity[]> {
+    await this.getApprovalInstance(instanceId, scope);
+
+    return this.workflowTokenRepository.find({
+      order: { createdAt: 'ASC' },
+      where: { instanceId },
+    });
+  }
+
+  async listTasks(
+    instanceId: string,
+    scope?: WorkflowReadScope,
+  ): Promise<readonly TaskEntity[]> {
+    await this.getApprovalInstance(instanceId, scope);
+
+    return this.attachTaskCandidateSummaries(
+      await this.taskRepository.find({
+        order: { createdAt: 'ASC' },
+        where: { instanceId },
+      }),
+    );
+  }
+
+  async listInboxTasks(
+    assigneeMemberId: string,
+  ): Promise<readonly TaskEntity[]> {
+    const directTasks = await this.taskRepository.find({
+      order: { createdAt: 'DESC' },
+      where: [
+        {
+          assigneeMemberId,
+          status: In([TaskStatusEnum.PENDING, TaskStatusEnum.IN_PROGRESS]),
+        },
+      ],
+    });
+    const candidateRows = await this.taskCandidateRepository.find({
+      where: {
+        memberId: assigneeMemberId,
+        status: In([
+          TaskCandidateStatusEnum.PENDING,
+          TaskCandidateStatusEnum.CLAIMED,
+        ]),
+      },
+    });
+    const candidateTasks = candidateRows.length
+      ? await this.taskRepository.find({
+          order: { createdAt: 'DESC' },
+          where: {
+            id: In(candidateRows.map((candidate) => candidate.taskId)),
+            status: In([TaskStatusEnum.PENDING, TaskStatusEnum.IN_PROGRESS]),
+          },
+        })
+      : [];
+
+    return this.attachTaskCandidateSummaries(
+      uniqueTasksById([...directTasks, ...candidateTasks]),
+    );
+  }
+
+  async listApprovalHistoryTasks(
+    assigneeMemberId: string,
+  ): Promise<readonly TaskEntity[]> {
+    const directTasks = await this.taskRepository.find({
+      order: { completedAt: 'DESC', createdAt: 'DESC' },
+      take: DEFAULT_APPROVAL_HISTORY_TASK_LIMIT,
+      where: { assigneeMemberId, status: TaskStatusEnum.COMPLETED },
+    });
+    const candidateRows = await this.taskCandidateRepository.find({
+      where: {
+        memberId: assigneeMemberId,
+        status: TaskCandidateStatusEnum.COMPLETED,
+      },
+    });
+    const candidateTasks = candidateRows.length
+      ? await this.taskRepository.find({
+          order: { completedAt: 'DESC', createdAt: 'DESC' },
+          take: DEFAULT_APPROVAL_HISTORY_TASK_LIMIT,
+          where: {
+            id: In(candidateRows.map((candidate) => candidate.taskId)),
+            status: TaskStatusEnum.COMPLETED,
+          },
+        })
+      : [];
+
+    return this.attachTaskCandidateSummaries(
+      uniqueTasksById([...directTasks, ...candidateTasks]),
+    );
+  }
+
+  async listTaskDecisions(
+    taskId: string,
+    scope?: WorkflowReadScope,
+  ): Promise<readonly TaskDecisionEntity[]> {
+    await this.assertTaskReadable(taskId, scope);
+
+    return this.taskDecisionRepository.find({
+      order: { decidedAt: 'ASC' },
+      where: { taskId },
+    });
+  }
+
+  async listTaskCandidates(
+    taskId: string,
+    scope?: WorkflowReadScope,
+  ): Promise<readonly TaskCandidateEntity[]> {
+    await this.assertTaskReadable(taskId, scope);
+
+    return this.taskCandidateRepository.find({
+      order: { createdAt: 'ASC', id: 'ASC' },
+      where: { taskId },
+    });
+  }
+
+  private async attachTaskCandidateSummaries(
+    tasks: readonly TaskEntity[],
+  ): Promise<readonly TaskEntity[]> {
+    if (!tasks.length) {
+      return tasks;
+    }
+
+    const candidates = await this.taskCandidateRepository.find({
+      order: { createdAt: 'ASC', id: 'ASC' },
+      where: { taskId: In(tasks.map((task) => task.id)) },
+    });
+    const candidatesByTaskId = candidates.reduce<
+      ReadonlyMap<string, readonly string[]>
+    >((currentMap, candidate) => {
+      const nextMap = new Map(currentMap);
+      const memberIds = nextMap.get(candidate.taskId) ?? [];
+
+      nextMap.set(candidate.taskId, [...memberIds, candidate.memberId]);
+
+      return nextMap;
+    }, new Map<string, readonly string[]>());
+
+    return tasks.map((task) =>
+      Object.assign(new TaskEntity(), task, {
+        candidateMemberIds: candidatesByTaskId.get(task.id) ?? [],
+      }),
+    );
+  }
+
+  private async readDefaultInitiatorMetadataSnapshot(
+    memberId: string,
+  ): Promise<Readonly<Record<string, unknown>>> {
+    const today = toDateOnlyString(new Date());
+    const memberships = (
+      await this.approvalInstanceRepository.manager
+        .getRepository(MembershipEntity)
+        .find({ where: { memberId } })
+    )
+      .filter((membership) => isDateRangeActive(membership, today))
+      .sort(compareMembership);
+    const primaryMembership = memberships[0] ?? null;
+    const positionIds = uniqueTexts(
+      memberships
+        .map((membership) => membership.positionId)
+        .filter((positionId): positionId is string => Boolean(positionId)),
+    );
+
+    return {
+      customFields: {},
+      memberId,
+      orgUnitIds: uniqueTexts(
+        memberships.map((membership) => membership.orgUnitId),
+      ),
+      positionId: primaryMembership?.positionId ?? null,
+      positionIds,
+      primaryOrgUnitId: primaryMembership?.orgUnitId ?? null,
+    };
+  }
+
+  async listActivityLogs(
+    instanceId: string,
+    scope?: WorkflowReadScope,
+  ): Promise<readonly ActivityLogEntity[]> {
+    await this.getApprovalInstance(instanceId, scope);
+
+    return this.activityLogRepository.find({
+      order: { createdAt: 'ASC' },
+      where: { instanceId },
+    });
+  }
+
+  private async assertTaskReadable(
+    taskId: string,
+    scope?: WorkflowReadScope,
+  ): Promise<TaskEntity> {
+    const task = await this.taskRepository.findOne({ where: { id: taskId } });
+
+    if (!task) {
+      throw new NotFoundException(`Task ${taskId} was not found`);
+    }
+
+    await this.getApprovalInstance(task.instanceId, scope);
+
+    return task;
+  }
+
+  private async isApprovalInstanceReadableByMember(
+    instance: ApprovalInstanceEntity,
+    memberId: string,
+  ): Promise<boolean> {
+    if (instance.initiatorMemberId === memberId) {
+      return true;
+    }
+
+    const tasks = await this.taskRepository.find({
+      where: { instanceId: instance.id },
+    });
+
+    if (tasks.some((task) => isTaskRelatedToMember(task, memberId))) {
+      return true;
+    }
+
+    const taskIds = tasks.map((task) => task.id);
+
+    if (!taskIds.length) {
+      return false;
+    }
+
+    const candidates = await this.taskCandidateRepository.find({
+      where: { taskId: In(taskIds) },
+    });
+
+    if (
+      candidates.some(
+        (candidate) =>
+          candidate.memberId === memberId ||
+          candidate.originalMemberId === memberId,
+      )
+    ) {
+      return true;
+    }
+
+    const decisions = await this.taskDecisionRepository.find({
+      where: { taskId: In(taskIds) },
+    });
+
+    return decisions.some(
+      (decision) => decision.decidedByMemberId === memberId,
+    );
+  }
+
+  private async processActiveToken(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    token: WorkflowTokenEntity,
+  ): Promise<void> {
+    const node = readWorkflowNodeOrThrow(
+      instance.workflowSnapshot,
+      token.currentNodeId,
+    );
+
+    if (!(await this.isNodeEntryReady(manager, instance, token, node))) {
+      return;
+    }
+
+    if (!this.isNodeEntryConditionMet(instance, node)) {
+      await this.skipNodeByEntryCondition(manager, instance, token, node);
+
+      return;
+    }
+
+    if (node.type === 'startEvent') {
+      await this.advanceTokenToOutgoingNodes(manager, instance, token, node);
+
+      return;
+    }
+
+    if (node.type === 'endEvent') {
+      await this.completeTokenAtEndNode(manager, instance, token, node);
+
+      return;
+    }
+
+    if (node.type === 'userTask') {
+      await this.createUserTaskForToken(manager, instance, token, node);
+
+      return;
+    }
+
+    if (node.type === 'serviceTask') {
+      await this.executeServiceTask(manager, instance, token, node);
+
+      return;
+    }
+
+    if (node.type === 'exclusiveGateway') {
+      await this.processExclusiveGateway(manager, instance, token, node);
+
+      return;
+    }
+
+    if (node.type === 'parallelGateway') {
+      await this.advanceTokenToOutgoingNodes(manager, instance, token, node);
+
+      return;
+    }
+
+    return;
+  }
+
+  private async processRunningInstance(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+  ): Promise<void> {
+    for (let step = 0; step < MAX_PROCESSING_STEPS; step += 1) {
+      const token = await manager.getRepository(WorkflowTokenEntity).findOne({
+        order: { createdAt: 'ASC' },
+        where: {
+          instanceId: instance.id,
+          status: WorkflowTokenStatusEnum.ACTIVE,
+        },
+      });
+
+      if (!token) {
+        await this.completeInstanceIfNoOpenRuntimeState(manager, instance);
+
+        return;
+      }
+
+      await this.processActiveToken(manager, instance, token);
+    }
+
+    throw new ConflictException(
+      `Approval instance ${instance.id} exceeded maximum processing steps`,
+    );
+  }
+
+  private async completeInstanceIfNoOpenRuntimeState(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+  ): Promise<void> {
+    if (instance.state !== ApprovalInstanceStateEnum.RUNNING) {
+      return;
+    }
+
+    const waitingTokens = await manager
+      .getRepository(WorkflowTokenEntity)
+      .find({
+        where: {
+          instanceId: instance.id,
+          status: WorkflowTokenStatusEnum.WAITING,
+        },
+      });
+
+    if (waitingTokens.length > 0) {
+      return;
+    }
+
+    const completedAt = new Date();
+    const completedInstance = await manager
+      .getRepository(ApprovalInstanceEntity)
+      .save({
+        ...instance,
+        completedAt,
+        state: ApprovalInstanceStateEnum.APPROVED,
+      });
+
+    await this.notificationService.createInstanceCompletedNotification({
+      instance: completedInstance,
+      manager,
+    });
+  }
+
+  private async isNodeEntryReady(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    token: WorkflowTokenEntity,
+    node: WorkflowNode,
+  ): Promise<boolean> {
+    if (node.type === 'startEvent') {
+      return true;
+    }
+
+    const incomingEdges = readIncomingEdges(instance.workflowSnapshot, node.id);
+
+    if (incomingEdges.length < 2) {
+      return true;
+    }
+
+    const tokenRepository = manager.getRepository(WorkflowTokenEntity);
+    const activityRepository = manager.getRepository(ActivityLogEntity);
+    const activeOrWaitingTokens = (
+      await tokenRepository.find({
+        where: { instanceId: instance.id },
+      })
+    ).filter(
+      (candidate) =>
+        candidate.currentNodeId === node.id &&
+        (candidate.status === WorkflowTokenStatusEnum.ACTIVE ||
+          candidate.status === WorkflowTokenStatusEnum.WAITING),
+    );
+    const arrivedTokens = activeOrWaitingTokens.some(
+      (candidate) => candidate.id === token.id,
+    )
+      ? activeOrWaitingTokens
+      : [...activeOrWaitingTokens, token];
+
+    if ((node.data.triggerMode ?? 'AND') === 'OR') {
+      await this.cancelAlternativeTokensForOrTrigger(
+        manager,
+        instance,
+        token,
+        node.id,
+      );
+      await this.consumeJoinedTokens(
+        manager,
+        arrivedTokens.filter((candidate) => candidate.id !== token.id),
+      );
+
+      return true;
+    }
+
+    const pendingTokensThatMayReachNode = (
+      await tokenRepository.find({
+        where: { instanceId: instance.id },
+      })
+    ).filter(
+      (candidate) =>
+        candidate.id !== token.id &&
+        !arrivedTokens.some(
+          (arrivedToken) => arrivedToken.id === candidate.id,
+        ) &&
+        (candidate.status === WorkflowTokenStatusEnum.ACTIVE ||
+          candidate.status === WorkflowTokenStatusEnum.WAITING) &&
+        hasPathToNode(
+          instance.workflowSnapshot,
+          candidate.currentNodeId,
+          node.id,
+        ),
+    );
+
+    if (
+      arrivedTokens.length < incomingEdges.length &&
+      pendingTokensThatMayReachNode.length > 0
+    ) {
+      await tokenRepository.save({
+        ...token,
+        status: WorkflowTokenStatusEnum.WAITING,
+      });
+      await activityRepository.save(
+        activityRepository.create({
+          actorMemberId: null,
+          eventType: ActivityLogEventTypeEnum.TOKEN_ADVANCED,
+          instanceId: instance.id,
+          nodeId: node.id,
+          payload: {
+            arrivedCount: arrivedTokens.length,
+            requiredCount: incomingEdges.length,
+            tokenId: token.id,
+            triggerMode: 'AND',
+          },
+          taskId: null,
+        }),
+      );
+
+      return false;
+    }
+
+    await this.consumeJoinedTokens(
+      manager,
+      arrivedTokens.filter((candidate) => candidate.id !== token.id),
+    );
+
+    return true;
+  }
+
+  private async advanceTokenToOutgoingNodes(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    token: WorkflowTokenEntity,
+    node: WorkflowNode,
+  ): Promise<void> {
+    const edges = await this.readAvailableOutgoingEdges(
+      manager,
+      instance,
+      node,
+    );
+
+    if (edges.length === 1) {
+      await this.advanceTokenAlongEdge(
+        manager,
+        instance,
+        token,
+        node,
+        edges[0],
+      );
+
+      return;
+    }
+
+    await this.forkTokenAlongEdges(manager, instance, token, node, edges);
+  }
+
+  private isNodeEntryConditionMet(
+    instance: ApprovalInstanceEntity,
+    node: WorkflowNode,
+  ): boolean {
+    const entryCondition = readNodeEntryCondition(node);
+
+    return this.conditionService.evaluateBoolean(
+      entryCondition,
+      buildWorkflowExpressionContext(instance),
+      `workflow.nodes.${node.id}.data.entryCondition`,
+    );
+  }
+
+  private async skipNodeByEntryCondition(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    token: WorkflowTokenEntity,
+    node: WorkflowNode,
+  ): Promise<void> {
+    await manager.getRepository(ActivityLogEntity).save(
+      manager.getRepository(ActivityLogEntity).create({
+        actorMemberId: null,
+        eventType: ActivityLogEventTypeEnum.TOKEN_ADVANCED,
+        instanceId: instance.id,
+        nodeId: node.id,
+        payload: {
+          skippedByEntryCondition: true,
+          tokenId: token.id,
+        },
+        taskId: null,
+      }),
+    );
+    await this.advanceTokenToOutgoingNodes(manager, instance, token, node);
+  }
+
+  private async readAvailableOutgoingEdges(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    node: WorkflowNode,
+  ): Promise<readonly WorkflowEdge[]> {
+    const outgoingEdges = readOutgoingEdgesOrThrow(
+      instance.workflowSnapshot,
+      node.id,
+    );
+    const conditionalEdges = outgoingEdges.filter(
+      (edge) => !edge.data.isDefault && edgeHasCondition(edge),
+    );
+
+    if (conditionalEdges.length === 0) {
+      return outgoingEdges;
+    }
+
+    const matchingEdges = (
+      await Promise.all(
+        conditionalEdges.map(
+          async (edge): Promise<WorkflowEdge | null> =>
+            (await this.evaluateWorkflowEdge(manager, instance, node, edge))
+              ? edge
+              : null,
+        ),
+      )
+    ).filter((edge): edge is WorkflowEdge => edge !== null);
+
+    if (matchingEdges.length > 0) {
+      return node.type === 'exclusiveGateway'
+        ? [matchingEdges[0]]
+        : matchingEdges;
+    }
+
+    const defaultEdges = outgoingEdges.filter((edge) => edge.data.isDefault);
+
+    if (defaultEdges.length > 0) {
+      return node.type === 'exclusiveGateway'
+        ? [defaultEdges[0]]
+        : defaultEdges;
+    }
+
+    throw new ConflictException(
+      `Workflow node ${node.id} has no matching outgoing edge`,
+    );
+  }
+
+  private async evaluateWorkflowEdge(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    node: WorkflowNode,
+    edge: WorkflowEdge,
+  ): Promise<boolean> {
+    const expression = edge.data.condition?.trim();
+
+    if (expression) {
+      return this.conditionService.evaluateBoolean(
+        expression,
+        {
+          ...buildWorkflowExpressionContext(instance),
+          lastDecision: await this.readLastDecisionContext(
+            manager,
+            instance.id,
+            node.id,
+          ),
+        },
+        `workflow.edges.${edge.id}.data.condition`,
+      );
+    }
+
+    return evaluateWorkflowEdgeCondition(edge, { formData: instance.formData });
+  }
+
+  private async readLastDecisionContext(
+    manager: EntityManager,
+    instanceId: string,
+    nodeId: string,
+  ): Promise<Readonly<Record<string, unknown>> | null> {
+    const tasks = await manager.getRepository(TaskEntity).find({
+      where: { instanceId, nodeId },
+    });
+    const taskIds = tasks.map((task) => task.id);
+
+    if (taskIds.length === 0) {
+      return null;
+    }
+
+    const decision = (
+      await manager.getRepository(TaskDecisionEntity).find({
+        order: { decidedAt: 'DESC' },
+        where: { taskId: In(taskIds) },
+      })
+    )[0];
+
+    if (!decision) {
+      return null;
+    }
+
+    return {
+      action: decision.action,
+      comment: decision.comment,
+      decidedAt: decision.decidedAt.toISOString(),
+      decidedByMemberId: decision.decidedByMemberId,
+      returnToNodeId: decision.returnToNodeId,
+      taskId: decision.taskId,
+      transferToMemberId: decision.transferToMemberId,
+    };
+  }
+
+  private async advanceTokenAlongEdge(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    token: WorkflowTokenEntity,
+    node: WorkflowNode,
+    edge: WorkflowEdge,
+  ): Promise<void> {
+    const tokenRepository = manager.getRepository(WorkflowTokenEntity);
+    const activityRepository = manager.getRepository(ActivityLogEntity);
+    const nextToken = await tokenRepository.save({
+      ...token,
+      currentNodeId: edge.target,
+    });
+
+    await activityRepository.save(
+      activityRepository.create({
+        actorMemberId: null,
+        eventType: ActivityLogEventTypeEnum.TOKEN_ADVANCED,
+        instanceId: instance.id,
+        nodeId: edge.target,
+        payload: {
+          edgeId: edge.id,
+          fromNodeId: node.id,
+          tokenId: nextToken.id,
+          toNodeId: edge.target,
+        },
+        taskId: null,
+      }),
+    );
+  }
+
+  private async forkTokenAlongEdges(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    token: WorkflowTokenEntity,
+    node: WorkflowNode,
+    edges: readonly WorkflowEdge[],
+  ): Promise<void> {
+    const forkedAt = new Date();
+    const tokenRepository = manager.getRepository(WorkflowTokenEntity);
+    const activityRepository = manager.getRepository(ActivityLogEntity);
+
+    await tokenRepository.save({
+      ...token,
+      consumedAt: forkedAt,
+      status: WorkflowTokenStatusEnum.CONSUMED,
+    });
+
+    const childTokens = await tokenRepository.save(
+      edges.map((edge) =>
+        tokenRepository.create({
+          consumedAt: null,
+          currentNodeId: edge.target,
+          instanceId: instance.id,
+          parentTokenId: token.id,
+          status: WorkflowTokenStatusEnum.ACTIVE,
+        }),
+      ),
+    );
+
+    await activityRepository.save([
+      activityRepository.create({
+        actorMemberId: null,
+        eventType: ActivityLogEventTypeEnum.TOKEN_ADVANCED,
+        instanceId: instance.id,
+        nodeId: node.id,
+        payload: {
+          edgeIds: edges.map((edge) => edge.id),
+          fromNodeId: node.id,
+          tokenId: token.id,
+          toNodeIds: edges.map((edge) => edge.target),
+        },
+        taskId: null,
+      }),
+      ...childTokens.map((childToken, index) =>
+        activityRepository.create({
+          actorMemberId: null,
+          eventType: ActivityLogEventTypeEnum.TOKEN_CREATED,
+          instanceId: instance.id,
+          nodeId: childToken.currentNodeId,
+          payload: {
+            edgeId: edges[index]?.id,
+            parentTokenId: token.id,
+            tokenId: childToken.id,
+          },
+          taskId: null,
+        }),
+      ),
+    ]);
+  }
+
+  private async completeTokenAtEndNode(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    token: WorkflowTokenEntity,
+    node: Extract<WorkflowNode, { readonly type: 'endEvent' }>,
+  ): Promise<void> {
+    const completedAt = new Date();
+    const tokenRepository = manager.getRepository(WorkflowTokenEntity);
+    const instanceRepository = manager.getRepository(ApprovalInstanceEntity);
+    const activityRepository = manager.getRepository(ActivityLogEntity);
+    const endState = node.data.endState ?? 'APPROVED';
+    const instanceState =
+      endState === 'REJECTED'
+        ? ApprovalInstanceStateEnum.REJECTED
+        : ApprovalInstanceStateEnum.APPROVED;
+
+    await tokenRepository.save({
+      ...token,
+      consumedAt: completedAt,
+      status: WorkflowTokenStatusEnum.CONSUMED,
+    });
+    const hasOpenToken = (
+      await tokenRepository.find({
+        where: { instanceId: instance.id },
+      })
+    ).some(
+      (candidate) =>
+        candidate.id !== token.id &&
+        (candidate.status === WorkflowTokenStatusEnum.ACTIVE ||
+          candidate.status === WorkflowTokenStatusEnum.WAITING),
+    );
+
+    if (!hasOpenToken) {
+      const completedInstance = await instanceRepository.save({
+        ...instance,
+        completedAt,
+        state: instanceState,
+      });
+
+      if (instanceState === ApprovalInstanceStateEnum.APPROVED) {
+        await this.notificationService.createInstanceCompletedNotification({
+          instance: completedInstance,
+          manager,
+        });
+      }
+    }
+    await activityRepository.save(
+      activityRepository.create({
+        actorMemberId: null,
+        eventType: ActivityLogEventTypeEnum.TOKEN_ADVANCED,
+        instanceId: instance.id,
+        nodeId: node.id,
+        payload: {
+          endState,
+          instanceState,
+          tokenId: token.id,
+        },
+        taskId: null,
+      }),
+    );
+  }
+
+  private async createUserTaskForToken(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    token: WorkflowTokenEntity,
+    node: UserTaskNode,
+  ): Promise<void> {
+    const taskRepository = manager.getRepository(TaskEntity);
+    const taskCandidateRepository = manager.getRepository(TaskCandidateEntity);
+    const tokenRepository = manager.getRepository(WorkflowTokenEntity);
+    const activityRepository = manager.getRepository(ActivityLogEntity);
+    const existingTask = await taskRepository.findOne({
+      where: {
+        nodeId: node.id,
+        tokenId: token.id,
+      },
+    });
+
+    if (existingTask) {
+      await tokenRepository.save({
+        ...token,
+        status: WorkflowTokenStatusEnum.WAITING,
+      });
+
+      return;
+    }
+
+    const candidates = await this.resolveRuntimeTaskCandidates(
+      manager,
+      instance,
+      node,
+    );
+    const primaryCandidate = candidates[0];
+    const now = new Date();
+    const task = await taskRepository.save(
+      taskRepository.create({
+        assigneeMemberId:
+          candidates.length === 1 ? primaryCandidate.memberId : null,
+        assignmentType:
+          candidates.length === 1
+            ? TaskAssignmentTypeEnum.DIRECT_MEMBER
+            : TaskAssignmentTypeEnum.CANDIDATE_GROUP,
+        completedAt: null,
+        createdAt: now,
+        decisionPolicySnapshot: node.data.decisionPolicy,
+        delegationChain:
+          candidates.length === 1 ? primaryCandidate.delegationChain : [],
+        instanceId: instance.id,
+        nodeId: node.id,
+        openedAt: null,
+        originalAssigneeMemberId:
+          candidates.length === 1 ? primaryCandidate.originalMemberId : null,
+        slaDueAt: calculateTaskSlaDueAt({ node, now }),
+        status: TaskStatusEnum.PENDING,
+        tokenId: token.id,
+      }),
+    );
+    const savedCandidates = await taskCandidateRepository.save(
+      candidates.map((candidate) =>
+        taskCandidateRepository.create({
+          claimedAt: null,
+          createdAt: now,
+          decidedAt: null,
+          delegationChain: candidate.delegationChain,
+          memberId: candidate.memberId,
+          originalMemberId: candidate.originalMemberId,
+          sourceType: candidate.sourceType,
+          status: TaskCandidateStatusEnum.PENDING,
+          taskId: task.id,
+        }),
+      ),
+    );
+    task.candidateMemberIds = savedCandidates.map(
+      (candidate) => candidate.memberId,
+    );
+    const singleCandidate =
+      savedCandidates.length === 1 ? savedCandidates[0] : null;
+
+    await tokenRepository.save({
+      ...token,
+      status: WorkflowTokenStatusEnum.WAITING,
+    });
+    await activityRepository.save(
+      activityRepository.create({
+        actorMemberId: null,
+        eventType: ActivityLogEventTypeEnum.TASK_CREATED,
+        instanceId: instance.id,
+        nodeId: node.id,
+        payload: {
+          assignmentType: task.assignmentType,
+          assigneeMemberId: singleCandidate?.memberId ?? null,
+          candidateMemberIds: savedCandidates.map(
+            (candidate) => candidate.memberId,
+          ),
+          originalAssigneeMemberId: singleCandidate?.originalMemberId ?? null,
+          tokenId: token.id,
+        },
+        taskId: task.id,
+      }),
+    );
+    await savedCandidates.reduce<Promise<void>>(
+      async (previous, candidate): Promise<void> => {
+        await previous;
+        await this.notificationService.createTaskAssignedNotification({
+          instance,
+          manager,
+          node,
+          task: Object.assign(new TaskEntity(), task, {
+            assigneeMemberId: candidate.memberId,
+            delegationChain: candidate.delegationChain,
+            originalAssigneeMemberId: candidate.originalMemberId,
+          }),
+        });
+      },
+      Promise.resolve(),
+    );
+  }
+
+  private async markTaskCandidateDecision({
+    action,
+    candidate,
+    candidates,
+    decidedAt,
+    manager,
+    task,
+  }: {
+    readonly action: TaskDecisionActionEnum;
+    readonly candidate: TaskCandidateEntity | null;
+    readonly candidates: readonly TaskCandidateEntity[];
+    readonly decidedAt: Date;
+    readonly manager: EntityManager;
+    readonly task: TaskEntity;
+  }): Promise<readonly TaskCandidateEntity[]> {
+    const taskCandidateRepository = manager.getRepository(TaskCandidateEntity);
+
+    if (!candidate && candidates.length === 0 && task.assigneeMemberId) {
+      const legacyCandidate = await taskCandidateRepository.save(
+        taskCandidateRepository.create({
+          claimedAt: task.openedAt ?? decidedAt,
+          createdAt: task.createdAt,
+          decidedAt,
+          delegationChain: task.delegationChain,
+          memberId: task.assigneeMemberId,
+          originalMemberId:
+            task.originalAssigneeMemberId ?? task.assigneeMemberId,
+          sourceType: 'DIRECT',
+          status: TaskCandidateStatusEnum.COMPLETED,
+          taskId: task.id,
+        }),
+      );
+
+      return [legacyCandidate];
+    }
+
+    const completedCandidate = candidate
+      ? Object.assign(new TaskCandidateEntity(), candidate, {
+          claimedAt: candidate.claimedAt ?? decidedAt,
+          decidedAt,
+          status: TaskCandidateStatusEnum.COMPLETED,
+        })
+      : null;
+    const decisionPolicy = readDecisionPolicySnapshot(task);
+    const shouldCancelOpenCandidates =
+      action !== TaskDecisionActionEnum.APPROVED ||
+      decisionPolicy.type === 'SINGLE' ||
+      decisionPolicy.type === 'PARALLEL_ANY';
+    const nextCandidates = candidates.map((currentCandidate) => {
+      if (currentCandidate.id === completedCandidate?.id) {
+        return completedCandidate;
+      }
+
+      if (
+        shouldCancelOpenCandidates &&
+        (currentCandidate.status === TaskCandidateStatusEnum.PENDING ||
+          currentCandidate.status === TaskCandidateStatusEnum.CLAIMED)
+      ) {
+        return Object.assign(new TaskCandidateEntity(), currentCandidate, {
+          decidedAt,
+          status: TaskCandidateStatusEnum.CANCELLED,
+        });
+      }
+
+      return currentCandidate;
+    });
+
+    if (nextCandidates.length > 0) {
+      await taskCandidateRepository.save(nextCandidates);
+    }
+
+    return nextCandidates;
+  }
+
+  private async transferTask(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    task: TaskEntity,
+    decision: TaskDecisionEntity,
+    signature: { readonly id: string; readonly signedPayloadHash: string },
+    transferToMemberId: string | null,
+    decisionComment: string | null,
+    decidedAt: Date,
+    actorCandidate: TaskCandidateEntity | null,
+  ): Promise<void> {
+    if (!transferToMemberId) {
+      throw new BadRequestException('Transfer target member is required');
+    }
+
+    const taskRepository = manager.getRepository(TaskEntity);
+    const taskCandidateRepository = manager.getRepository(TaskCandidateEntity);
+    const activityRepository = manager.getRepository(ActivityLogEntity);
+    const transferringMemberId = task.assigneeMemberId;
+
+    if (!transferringMemberId) {
+      throw new ConflictException('Task must be claimed before transfer');
+    }
+
+    const nextDelegationChain: readonly DelegationStep[] = [
+      ...readDelegationSteps(task.delegationChain),
+      {
+        from: transferringMemberId,
+        reason: 'MANUAL_TRANSFER',
+        ruleId: null,
+        to: transferToMemberId,
+      },
+    ];
+    const transferredTask = await taskRepository.save({
+      ...task,
+      completedAt: decidedAt,
+      delegationChain: nextDelegationChain,
+      status: TaskStatusEnum.TRANSFERRED,
+    });
+    const nextTask = await taskRepository.save(
+      taskRepository.create({
+        assigneeMemberId: transferToMemberId,
+        assignmentType: TaskAssignmentTypeEnum.DIRECT_MEMBER,
+        completedAt: null,
+        decisionPolicySnapshot: { type: 'SINGLE' },
+        delegationChain: nextDelegationChain,
+        instanceId: task.instanceId,
+        nodeId: task.nodeId,
+        openedAt: null,
+        originalAssigneeMemberId: task.originalAssigneeMemberId,
+        slaDueAt: task.slaDueAt,
+        status: TaskStatusEnum.PENDING,
+        tokenId: task.tokenId,
+      }),
+    );
+    await taskCandidateRepository.save([
+      ...(actorCandidate
+        ? [
+            taskCandidateRepository.create({
+              ...actorCandidate,
+              decidedAt,
+              status: TaskCandidateStatusEnum.TRANSFERRED,
+            }),
+          ]
+        : []),
+      taskCandidateRepository.create({
+        claimedAt: null,
+        createdAt: decidedAt,
+        decidedAt: null,
+        delegationChain: nextDelegationChain,
+        memberId: transferToMemberId,
+        originalMemberId: task.originalAssigneeMemberId ?? transferToMemberId,
+        sourceType: 'DIRECT',
+        status: TaskCandidateStatusEnum.PENDING,
+        taskId: nextTask.id,
+      }),
+    ]);
+
+    await activityRepository.save([
+      activityRepository.create({
+        actorMemberId: task.assigneeMemberId,
+        eventType: ActivityLogEventTypeEnum.TASK_DECIDED,
+        instanceId: instance.id,
+        nodeId: task.nodeId,
+        payload: {
+          action: TaskDecisionActionEnum.TRANSFERRED,
+          comment: decisionComment,
+          decisionId: decision.id,
+          signatureId: signature.id,
+          signedPayloadHash: signature.signedPayloadHash,
+          transferToMemberId,
+        },
+        taskId: transferredTask.id,
+      }),
+      activityRepository.create({
+        actorMemberId: transferringMemberId,
+        eventType: ActivityLogEventTypeEnum.TASK_CREATED,
+        instanceId: instance.id,
+        nodeId: task.nodeId,
+        payload: {
+          assigneeMemberId: transferToMemberId,
+          delegationChain: nextDelegationChain,
+          originalAssigneeMemberId: task.originalAssigneeMemberId,
+          tokenId: task.tokenId,
+          transferredFromTaskId: task.id,
+        },
+        taskId: nextTask.id,
+      }),
+    ]);
+    const node = readWorkflowNodeOrThrow(
+      instance.workflowSnapshot,
+      task.nodeId,
+    );
+
+    if (node.type === 'userTask') {
+      await this.notificationService.createTaskAssignedNotification({
+        instance,
+        manager,
+        node,
+        task: nextTask,
+        transferred: true,
+      });
+    }
+  }
+
+  private async resolveRuntimeTaskCandidates(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    node: UserTaskNode,
+  ): Promise<readonly RuntimeTaskCandidate[]> {
+    const resolvedCandidates = await this.resolveApproverResolver(
+      manager,
+      instance,
+      node.data.approverResolver,
+      `簽核節點「${node.data.label}」`,
+    );
+    const context = {
+      formData: instance.formData,
+      initiatorMemberId: instance.initiatorMemberId,
+      initiatorMetadataSnapshot: instance.initiatorMetadataSnapshot,
+      instanceId: instance.id,
+      nodeId: node.id,
+      state: instance.state,
+      templateId: instance.templateId,
+      templateVersionId: instance.templateVersionId,
+      title: instance.title,
+    };
+    const delegatedCandidates = await Promise.all(
+      resolvedCandidates.map(
+        async (candidate): Promise<RuntimeTaskCandidate> => {
+          const delegationResolution =
+            await this.delegationService.resolveAssignee(
+              candidate.memberId,
+              context,
+            );
+
+          return {
+            delegationChain: delegationResolution.delegationChain,
+            memberId: delegationResolution.finalAssigneeMemberId,
+            originalMemberId: candidate.memberId,
+            sourceType: candidate.sourceType,
+          };
+        },
+      ),
+    );
+    const uniqueCandidates = uniqueRuntimeCandidates(delegatedCandidates);
+
+    if (uniqueCandidates.length === 0) {
+      throw new ConflictException(
+        `簽核節點「${node.data.label}」 did not resolve to any member id`,
+      );
+    }
+
+    return uniqueCandidates;
+  }
+
+  private async resolveApproverResolver(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    resolver: ApproverResolver,
+    label: string,
+  ): Promise<readonly ResolvedApproverCandidate[]> {
+    if (resolver.type === 'DIRECT') {
+      return readMemberIdsFromValue(resolver.memberIds, label).map(
+        (memberId) => ({ memberId, sourceType: resolver.type }),
+      );
+    }
+
+    if (resolver.type === 'DYNAMIC_FORM') {
+      return readMemberIdsFromValue(
+        readValueAtPath(instance.formData, resolver.formPath),
+        `${label}.formPath`,
+      ).map((memberId) => ({ memberId, sourceType: resolver.type }));
+    }
+
+    if (resolver.type === 'EXPRESSION') {
+      return readMemberIdsFromValue(
+        this.conditionService.evaluateValue(
+          resolver.expression,
+          buildWorkflowExpressionContext(instance),
+          `${label}.expression`,
+        ),
+        `${label}.expression`,
+      ).map((memberId) => ({ memberId, sourceType: resolver.type }));
+    }
+
+    if (resolver.type === 'POSITION') {
+      return this.resolvePositionCandidates(
+        manager,
+        resolver.positionId,
+        label,
+      ).then((memberIds) =>
+        memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })),
+      );
+    }
+
+    if (resolver.type === 'ORG_UNIT_MEMBER') {
+      return this.resolveOrgUnitMemberCandidates(
+        manager,
+        resolver.orgUnitId,
+        Boolean(resolver.includeDescendants),
+        label,
+      ).then((memberIds) =>
+        memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })),
+      );
+    }
+
+    if (resolver.type === 'ORG_UNIT_POSITION') {
+      return this.resolveOrgUnitPositionCandidates(
+        manager,
+        resolver.orgUnitId,
+        resolver.positionId,
+        Boolean(resolver.includeDescendants),
+        label,
+      ).then((memberIds) =>
+        memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })),
+      );
+    }
+
+    if (resolver.type === 'ORG_UNIT_MANAGER') {
+      return this.resolveOrgUnitManagerCandidates(
+        manager,
+        instance,
+        resolver.orgUnitId,
+        resolver.fallback,
+        label,
+      ).then((memberIds) =>
+        memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })),
+      );
+    }
+
+    return this.resolveInitiatorManagerCandidates(
+      manager,
+      instance,
+      resolver.levelsUp,
+      resolver.fallback,
+      label,
+    ).then((memberIds) =>
+      memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })),
+    );
+  }
+
+  private async resolvePositionCandidates(
+    manager: EntityManager,
+    positionId: string,
+    label: string,
+  ): Promise<readonly string[]> {
+    const today = toDateOnlyString(new Date());
+    const memberships = await manager.getRepository(MembershipEntity).find({
+      where: { positionId },
+    });
+    const activeMemberships = memberships
+      .filter(
+        (membership) =>
+          membership.effectiveFrom <= today &&
+          (!membership.effectiveTo || membership.effectiveTo >= today),
+      )
+      .sort((first, second) => {
+        if (first.isPrimary !== second.isPrimary) {
+          return first.isPrimary ? -1 : 1;
+        }
+
+        return second.effectiveFrom.localeCompare(first.effectiveFrom);
+      });
+
+    if (!activeMemberships.length) {
+      throw new ConflictException(
+        `${label} position ${positionId} has no active membership`,
+      );
+    }
+
+    return uniqueTexts(
+      activeMemberships.map((membership) => membership.memberId),
+    );
+  }
+
+  private async resolveInitiatorManagerCandidates(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    levelsUp: number,
+    fallback: ApproverResolverFallback | undefined,
+    label: string,
+  ): Promise<readonly string[]> {
+    const normalizedLevelsUp = Math.max(Math.trunc(levelsUp), 1);
+    const resolvedManagerMemberIds =
+      await this.resolveManagerMemberIdsFromOrganization(
+        manager,
+        instance.initiatorMemberId,
+        normalizedLevelsUp,
+      );
+
+    if (resolvedManagerMemberIds.length) {
+      return resolvedManagerMemberIds;
+    }
+
+    return [
+      this.resolveFallbackAssignee(
+        instance,
+        fallback,
+        label,
+        `找不到發起人的第 ${normalizedLevelsUp} 層主管`,
+      ),
+    ];
+  }
+
+  private resolveFallbackAssignee(
+    instance: ApprovalInstanceEntity,
+    fallback: ApproverResolverFallback | undefined,
+    label: string,
+    failureReason: string,
+  ): string {
+    if (!fallback || fallback.type === 'NONE') {
+      throw new ConflictException(
+        `${label} 無法建立待簽任務：${failureReason}，且未設定改派固定人。請聯絡流程管理員調整主管規則或模板 fallback。`,
+      );
+    }
+
+    if (!fallback.memberId.trim()) {
+      throw new ConflictException(
+        `${label} 無法建立待簽任務：改派固定人未設定。`,
+      );
+    }
+
+    if (
+      fallback.memberId === instance.initiatorMemberId &&
+      !fallback.allowInitiatorSelfApproval
+    ) {
+      throw new ConflictException(
+        `${label} 無法建立待簽任務：改派固定人是申請人本人，且此節點未允許申請人自簽。`,
+      );
+    }
+
+    return fallback.memberId;
+  }
+
+  private async resolveManagerMemberIdsFromOrganization(
+    manager: EntityManager,
+    memberId: string,
+    levelsUp: number,
+  ): Promise<readonly string[]> {
+    return this.resolveManagerMemberIdsAtLevel(
+      manager,
+      memberId,
+      toDateOnlyString(new Date()),
+      levelsUp,
+    );
+  }
+
+  private async resolveManagerMemberIdsAtLevel(
+    manager: EntityManager,
+    memberId: string,
+    date: string,
+    remainingLevels: number,
+  ): Promise<readonly string[]> {
+    const directManagerMemberIds = await this.resolveDirectManagerMemberIds(
+      manager,
+      memberId,
+      date,
+    );
+
+    if (remainingLevels <= 1 || directManagerMemberIds.length === 0) {
+      return directManagerMemberIds;
+    }
+
+    const nextLevelGroups = await Promise.all(
+      directManagerMemberIds.map((managerMemberId) =>
+        this.resolveManagerMemberIdsAtLevel(
+          manager,
+          managerMemberId,
+          date,
+          remainingLevels - 1,
+        ),
+      ),
+    );
+
+    return uniqueTexts(nextLevelGroups.flat());
+  }
+
+  private async resolveDirectManagerMemberIds(
+    manager: EntityManager,
+    memberId: string,
+    date: string,
+  ): Promise<readonly string[]> {
+    const memberships = await manager.getRepository(MembershipEntity).find({
+      where: { memberId },
+    });
+    const activeMemberships = memberships.filter((membership) =>
+      isDateRangeActive(membership, date),
+    );
+    const directOrgUnitIds = activeMemberships.map(
+      (membership) => membership.orgUnitId,
+    );
+    const positionIds = activeMemberships
+      .map((membership) => membership.positionId)
+      .filter((positionId): positionId is string => Boolean(positionId));
+    const orgUnitIds = await this.readOrgUnitAndAncestorIds(
+      manager,
+      directOrgUnitIds,
+    );
+    const candidatePairs = [
+      { scopeId: memberId, scopeType: ManagerResolutionScopeTypeEnum.MEMBER },
+      ...orgUnitIds.map((scopeId) => ({
+        scopeId,
+        scopeType: ManagerResolutionScopeTypeEnum.ORG_UNIT,
+      })),
+      ...positionIds.map((scopeId) => ({
+        scopeId,
+        scopeType: ManagerResolutionScopeTypeEnum.POSITION,
+      })),
+    ];
+
+    return this.resolveManagerResolutionCandidates(
+      manager,
+      candidatePairs,
+      date,
+    );
+  }
+
+  private async resolveOrgUnitManagerCandidates(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    orgUnitId: string,
+    fallback: ApproverResolverFallback | undefined,
+    label: string,
+  ): Promise<readonly string[]> {
+    const date = toDateOnlyString(new Date());
+    const orgUnitIds = await this.readOrgUnitAndAncestorIds(manager, [
+      orgUnitId,
+    ]);
+    const managerMemberIds = await this.resolveManagerResolutionCandidates(
+      manager,
+      orgUnitIds.map((scopeId) => ({
+        scopeId,
+        scopeType: ManagerResolutionScopeTypeEnum.ORG_UNIT,
+      })),
+      date,
+    );
+
+    if (!managerMemberIds.length) {
+      return [
+        this.resolveFallbackAssignee(
+          instance,
+          fallback,
+          label,
+          `找不到指定組織的主管規則`,
+        ),
+      ];
+    }
+
+    return managerMemberIds;
+  }
+
+  private async readOrgUnitAndAncestorIds(
+    manager: EntityManager,
+    orgUnitIds: readonly string[],
+  ): Promise<readonly string[]> {
+    if (!orgUnitIds.length) {
+      return [];
+    }
+
+    const orgUnitRepository = manager.getRepository(OrgUnitEntity);
+    const directOrgUnits = await orgUnitRepository.find({
+      where: { deletedAt: IsNull(), id: In([...orgUnitIds]) },
+    });
+    const ancestorGroups = await Promise.all(
+      directOrgUnits.map((orgUnit) =>
+        orgUnitRepository
+          .createQueryBuilder('orgUnit')
+          .where('orgUnit.deleted_at IS NULL')
+          .andWhere('orgUnit.path @> :path', { path: orgUnit.path })
+          .getMany(),
+      ),
+    );
+    const byId = new Map(
+      [...directOrgUnits, ...ancestorGroups.flat()].map(
+        (orgUnit): readonly [string, OrgUnitEntity] => [orgUnit.id, orgUnit],
+      ),
+    );
+
+    return [...byId.keys()];
+  }
+
+  private async resolveManagerResolutionCandidates(
+    manager: EntityManager,
+    candidatePairs: readonly {
+      readonly scopeId: string;
+      readonly scopeType: ManagerResolutionScopeTypeEnum;
+    }[],
+    date: string,
+  ): Promise<readonly string[]> {
+    const scopeIds = candidatePairs.map((pair) => pair.scopeId);
+
+    if (!scopeIds.length) {
+      return [];
+    }
+
+    const resolutions = await manager
+      .getRepository(ManagerResolutionEntity)
+      .find({
+        where: {
+          scopeId: In([...scopeIds]),
+          scopeType: In([
+            ManagerResolutionScopeTypeEnum.MEMBER,
+            ManagerResolutionScopeTypeEnum.ORG_UNIT,
+            ManagerResolutionScopeTypeEnum.POSITION,
+          ]),
+        },
+      });
+    const active = resolutions
+      .filter((resolution) =>
+        candidatePairs.some(
+          (pair) =>
+            pair.scopeId === resolution.scopeId &&
+            pair.scopeType === resolution.scopeType,
+        ),
+      )
+      .filter((resolution) => isDateRangeActive(resolution, date))
+      .sort(compareManagerResolution);
+
+    return uniqueTexts(active.map((resolution) => resolution.managerMemberId));
+  }
+
+  private async resolveOrgUnitMemberCandidates(
+    manager: EntityManager,
+    orgUnitId: string,
+    includeDescendants: boolean,
+    label: string,
+  ): Promise<readonly string[]> {
+    const orgUnitIds = await this.readOrgUnitScopeIds(
+      manager,
+      orgUnitId,
+      includeDescendants,
+    );
+    const today = toDateOnlyString(new Date());
+    const memberships = await manager.getRepository(MembershipEntity).find({
+      where: { orgUnitId: In([...orgUnitIds]) },
+    });
+    const memberIds = memberships
+      .filter((membership) => isDateRangeActive(membership, today))
+      .sort(compareMembership)
+      .map((membership) => membership.memberId);
+
+    if (memberIds.length === 0) {
+      throw new ConflictException(
+        `${label} orgUnit ${orgUnitId} has no active member`,
+      );
+    }
+
+    return uniqueTexts(memberIds);
+  }
+
+  private async resolveOrgUnitPositionCandidates(
+    manager: EntityManager,
+    orgUnitId: string,
+    positionId: string,
+    includeDescendants: boolean,
+    label: string,
+  ): Promise<readonly string[]> {
+    const orgUnitIds = await this.readOrgUnitScopeIds(
+      manager,
+      orgUnitId,
+      includeDescendants,
+    );
+    const today = toDateOnlyString(new Date());
+    const memberships = await manager.getRepository(MembershipEntity).find({
+      where: { orgUnitId: In([...orgUnitIds]), positionId },
+    });
+    const memberIds = memberships
+      .filter((membership) => isDateRangeActive(membership, today))
+      .sort(compareMembership)
+      .map((membership) => membership.memberId);
+
+    if (memberIds.length === 0) {
+      throw new ConflictException(
+        `${label} orgUnit ${orgUnitId} and position ${positionId} has no active membership`,
+      );
+    }
+
+    return uniqueTexts(memberIds);
+  }
+
+  private async readOrgUnitScopeIds(
+    manager: EntityManager,
+    orgUnitId: string,
+    includeDescendants: boolean,
+  ): Promise<readonly string[]> {
+    const orgUnitRepository = manager.getRepository(OrgUnitEntity);
+    const orgUnit = await orgUnitRepository.findOne({
+      where: { deletedAt: IsNull(), id: orgUnitId },
+    });
+
+    if (!orgUnit) {
+      throw new ConflictException(`Org unit ${orgUnitId} was not found`);
+    }
+
+    if (!includeDescendants) {
+      return [orgUnit.id];
+    }
+
+    const descendants = await orgUnitRepository
+      .createQueryBuilder('orgUnit')
+      .where('orgUnit.deleted_at IS NULL')
+      .andWhere('orgUnit.path <@ :path', { path: orgUnit.path })
+      .getMany();
+
+    return uniqueTexts([orgUnit.id, ...descendants.map((unit) => unit.id)]);
+  }
+
+  private async processExclusiveGateway(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    token: WorkflowTokenEntity,
+    node: Extract<WorkflowNode, { readonly type: 'exclusiveGateway' }>,
+  ): Promise<void> {
+    if (node.data.direction !== 'split') {
+      await this.advanceTokenToOutgoingNodes(manager, instance, token, node);
+
+      return;
+    }
+
+    const edge = (
+      await this.readAvailableOutgoingEdges(manager, instance, node)
+    )[0];
+
+    await this.advanceTokenAlongEdge(manager, instance, token, node, edge);
+  }
+
+  private async executeServiceTask(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    token: WorkflowTokenEntity,
+    node: ServiceTaskNode,
+  ): Promise<void> {
+    const activityRepository = manager.getRepository(ActivityLogEntity);
+    const action = node.data.action;
+
+    if (action.type === 'WEBHOOK') {
+      const payload =
+        typeof action.payload === 'string' && action.payload.trim()
+          ? this.conditionService.evaluateValue(
+              action.payload,
+              buildWorkflowExpressionContext(instance),
+              `workflow.nodes.${node.id}.data.action.payload`,
+            )
+          : {
+              instance: buildWorkflowExpressionContext(instance).instance,
+              triggeredAt: new Date().toISOString(),
+            };
+      const result = await executeWebhookServiceAction(
+        this.serviceTaskDispatcher,
+        action,
+        payload,
+      );
+
+      await activityRepository.save(
+        activityRepository.create({
+          actorMemberId: null,
+          eventType: result.ok
+            ? ActivityLogEventTypeEnum.SERVICE_TASK_EXECUTED
+            : ActivityLogEventTypeEnum.SERVICE_TASK_FAILED,
+          instanceId: instance.id,
+          nodeId: node.id,
+          payload: {
+            action: 'WEBHOOK',
+            error: result.error,
+            ok: result.ok,
+            status: result.status,
+            tokenId: token.id,
+            url: action.url,
+          },
+          taskId: null,
+        }),
+      );
+      await this.advanceTokenToOutgoingNodes(manager, instance, token, node);
+
+      return;
+    }
+
+    if (action.type === 'SET_FORM_FIELD') {
+      const value = this.conditionService.evaluateValue(
+        action.value,
+        buildWorkflowExpressionContext(instance),
+        `workflow.nodes.${node.id}.data.action.value`,
+      );
+      const updatedFormData = writeValueAtPath(
+        instance.formData,
+        action.fieldPath,
+        value,
+      );
+      const updatedInstance = await manager
+        .getRepository(ApprovalInstanceEntity)
+        .save({
+          ...instance,
+          formData: updatedFormData,
+        });
+
+      Object.assign(instance, updatedInstance);
+      await activityRepository.save(
+        activityRepository.create({
+          actorMemberId: null,
+          eventType: ActivityLogEventTypeEnum.SERVICE_TASK_EXECUTED,
+          instanceId: instance.id,
+          nodeId: node.id,
+          payload: {
+            action: 'SET_FORM_FIELD',
+            fieldPath: action.fieldPath,
+            tokenId: token.id,
+          },
+          taskId: null,
+        }),
+      );
+      await this.advanceTokenToOutgoingNodes(
+        manager,
+        updatedInstance,
+        token,
+        node,
+      );
+
+      return;
+    }
+
+    const recipients = await this.resolveApproverResolver(
+      manager,
+      instance,
+      action.recipients,
+      `知會節點「${node.data.label}」`,
+    );
+    const recipientMemberIds = uniqueTexts(
+      recipients.map((recipient) => recipient.memberId),
+    );
+
+    await this.notificationService.createServiceTaskNotifications({
+      instance,
+      manager,
+      node,
+      recipientMemberIds,
+    });
+    await manager.getRepository(WorkflowTokenEntity).save({
+      ...token,
+      consumedAt: new Date(),
+      status: WorkflowTokenStatusEnum.CONSUMED,
+    });
+    await activityRepository.save(
+      activityRepository.create({
+        actorMemberId: null,
+        eventType: ActivityLogEventTypeEnum.TOKEN_ADVANCED,
+        instanceId: instance.id,
+        nodeId: node.id,
+        payload: {
+          action: 'NOTIFY',
+          recipientMemberIds,
+          tokenId: token.id,
+        },
+        taskId: null,
+      }),
+    );
+  }
+
+  private async rejectInstance(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    task: TaskEntity,
+    rejectedAt: Date,
+  ): Promise<void> {
+    const tokenRepository = manager.getRepository(WorkflowTokenEntity);
+    const instanceRepository = manager.getRepository(ApprovalInstanceEntity);
+    const activeTokens = await tokenRepository.find({
+      where: { instanceId: instance.id },
+    });
+    const consumedTokens = activeTokens
+      .filter(
+        (token) =>
+          token.status === WorkflowTokenStatusEnum.ACTIVE ||
+          token.status === WorkflowTokenStatusEnum.WAITING,
+      )
+      .map(
+        (token): WorkflowTokenEntity => ({
+          ...token,
+          consumedAt: rejectedAt,
+          status: WorkflowTokenStatusEnum.CONSUMED,
+        }),
+      );
+
+    if (consumedTokens.length) {
+      await tokenRepository.save(consumedTokens);
+    }
+
+    await instanceRepository.save({
+      ...instance,
+      completedAt: rejectedAt,
+      state: ApprovalInstanceStateEnum.REJECTED,
+    });
+    await manager.getRepository(ActivityLogEntity).save(
+      manager.getRepository(ActivityLogEntity).create({
+        actorMemberId: task.assigneeMemberId,
+        eventType: ActivityLogEventTypeEnum.TOKEN_ADVANCED,
+        instanceId: instance.id,
+        nodeId: task.nodeId,
+        payload: {
+          action: 'REJECTED',
+          taskId: task.id,
+        },
+        taskId: task.id,
+      }),
+    );
+  }
+
+  private async returnInstanceToNode(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    task: TaskEntity,
+    returnToNodeId: string | null,
+    returnedAt: Date,
+  ): Promise<void> {
+    if (!returnToNodeId) {
+      throw new ConflictException('Return target node is required');
+    }
+
+    const targetNode = readWorkflowNodeOrThrow(
+      instance.workflowSnapshot,
+      returnToNodeId,
+    );
+    const tokenRepository = manager.getRepository(WorkflowTokenEntity);
+    const instanceRepository = manager.getRepository(ApprovalInstanceEntity);
+    const activityRepository = manager.getRepository(ActivityLogEntity);
+
+    await this.consumeOpenRuntimeState(
+      manager,
+      instance,
+      returnedAt,
+      TaskStatusEnum.CANCELLED,
+    );
+
+    const returnedInstance = await instanceRepository.save({
+      ...instance,
+      completedAt: null,
+      state:
+        targetNode.type === 'startEvent'
+          ? ApprovalInstanceStateEnum.RETURNED
+          : ApprovalInstanceStateEnum.RUNNING,
+    });
+    const resubmitStrategy = readReturnResubmitStrategy(task, instance);
+    const returnToken = await tokenRepository.save(
+      tokenRepository.create({
+        consumedAt: null,
+        currentNodeId: targetNode.id,
+        instanceId: instance.id,
+        parentTokenId: null,
+        status: WorkflowTokenStatusEnum.ACTIVE,
+      }),
+    );
+
+    await activityRepository.save([
+      activityRepository.create({
+        actorMemberId: task.assigneeMemberId,
+        eventType: ActivityLogEventTypeEnum.INSTANCE_RETURNED,
+        instanceId: instance.id,
+        nodeId: task.nodeId,
+        payload: {
+          resubmitStrategy,
+          returnedFromNodeId: task.nodeId,
+          returnToNodeId: targetNode.id,
+          taskId: task.id,
+        },
+        taskId: task.id,
+      }),
+      activityRepository.create({
+        actorMemberId: null,
+        eventType: ActivityLogEventTypeEnum.TOKEN_CREATED,
+        instanceId: instance.id,
+        nodeId: targetNode.id,
+        payload: {
+          returnedFromNodeId: task.nodeId,
+          tokenId: returnToken.id,
+        },
+        taskId: null,
+      }),
+    ]);
+
+    if (returnedInstance.state === ApprovalInstanceStateEnum.RUNNING) {
+      await this.processRunningInstance(manager, returnedInstance);
+    }
+  }
+
+  private async readLatestReturnedInstanceContext(
+    manager: EntityManager,
+    instanceId: string,
+  ): Promise<ReturnedInstanceContext | null> {
+    const activity = await manager.getRepository(ActivityLogEntity).findOne({
+      order: { createdAt: 'DESC' },
+      where: {
+        eventType: ActivityLogEventTypeEnum.INSTANCE_RETURNED,
+        instanceId,
+      },
+    });
+
+    if (!activity) {
+      return null;
+    }
+
+    const returnToNodeId = readStringPayloadValue(
+      activity.payload,
+      'returnToNodeId',
+    );
+    const returnedFromNodeId =
+      readStringPayloadValue(activity.payload, 'returnedFromNodeId') ??
+      activity.nodeId;
+
+    if (!returnToNodeId || !returnedFromNodeId) {
+      return null;
+    }
+
+    return {
+      resubmitStrategy: readReturnResubmitStrategyFromPayload(activity.payload),
+      returnedFromNodeId,
+      returnToNodeId,
+    };
+  }
+
+  private async resumeReturnedInstanceFromReturnPoint(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    context: ReturnedInstanceContext,
+    resubmittedAt: Date,
+  ): Promise<ApprovalInstanceEntity> {
+    const targetNode = readWorkflowNodeOrThrow(
+      instance.workflowSnapshot,
+      context.returnToNodeId,
+    );
+
+    if (targetNode.type !== 'startEvent') {
+      return instance;
+    }
+
+    readWorkflowNodeOrThrow(
+      instance.workflowSnapshot,
+      context.returnedFromNodeId,
+    );
+
+    await this.consumeOpenRuntimeState(
+      manager,
+      instance,
+      resubmittedAt,
+      TaskStatusEnum.CANCELLED,
+    );
+
+    const tokenRepository = manager.getRepository(WorkflowTokenEntity);
+    const returnPointToken = await tokenRepository.save(
+      tokenRepository.create({
+        consumedAt: null,
+        currentNodeId: context.returnedFromNodeId,
+        instanceId: instance.id,
+        parentTokenId: null,
+        status: WorkflowTokenStatusEnum.ACTIVE,
+      }),
+    );
+
+    await manager.getRepository(ActivityLogEntity).save(
+      manager.getRepository(ActivityLogEntity).create({
+        actorMemberId: null,
+        eventType: ActivityLogEventTypeEnum.TOKEN_CREATED,
+        instanceId: instance.id,
+        nodeId: context.returnedFromNodeId,
+        payload: {
+          resubmitStrategy: context.resubmitStrategy,
+          resumedFromNodeId: context.returnToNodeId,
+          tokenId: returnPointToken.id,
+        },
+        taskId: null,
+      }),
+    );
+
+    return instance;
+  }
+
+  private async consumeOpenRuntimeState(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    consumedAt: Date,
+    taskStatus: TaskStatusEnum,
+  ): Promise<void> {
+    const tokenRepository = manager.getRepository(WorkflowTokenEntity);
+    const taskRepository = manager.getRepository(TaskEntity);
+    const tokens = await tokenRepository.find({
+      where: { instanceId: instance.id },
+    });
+    const openTokens = tokens.filter(
+      (token) =>
+        token.status === WorkflowTokenStatusEnum.ACTIVE ||
+        token.status === WorkflowTokenStatusEnum.WAITING,
+    );
+    const tasks = await taskRepository.find({
+      where: { instanceId: instance.id },
+    });
+    const openTasks = tasks.filter(
+      (task) =>
+        task.status === TaskStatusEnum.PENDING ||
+        task.status === TaskStatusEnum.IN_PROGRESS,
+    );
+
+    if (openTokens.length > 0) {
+      await tokenRepository.save(
+        openTokens.map(
+          (token): WorkflowTokenEntity => ({
+            ...token,
+            consumedAt,
+            status: WorkflowTokenStatusEnum.CONSUMED,
+          }),
+        ),
+      );
+    }
+
+    if (openTasks.length > 0) {
+      await taskRepository.save(
+        openTasks.map(
+          (openTask): TaskEntity =>
+            Object.assign(new TaskEntity(), openTask, {
+              completedAt: consumedAt,
+              status: taskStatus,
+            }),
+        ),
+      );
+      await this.closeTaskCandidates(
+        manager,
+        openTasks.map((task) => task.id),
+        readCandidateStatusForClosedTask(taskStatus),
+      );
+    }
+  }
+
+  private async consumeJoinedTokens(
+    manager: EntityManager,
+    tokens: readonly WorkflowTokenEntity[],
+  ): Promise<void> {
+    if (tokens.length === 0) {
+      return;
+    }
+
+    const consumedAt = new Date();
+
+    await manager.getRepository(WorkflowTokenEntity).save(
+      tokens.map(
+        (token): WorkflowTokenEntity => ({
+          ...token,
+          consumedAt,
+          status: WorkflowTokenStatusEnum.CONSUMED,
+        }),
+      ),
+    );
+  }
+
+  private async cancelAlternativeTokensForOrTrigger(
+    manager: EntityManager,
+    instance: ApprovalInstanceEntity,
+    token: WorkflowTokenEntity,
+    targetNodeId: string,
+  ): Promise<void> {
+    const tokenRepository = manager.getRepository(WorkflowTokenEntity);
+    const taskRepository = manager.getRepository(TaskEntity);
+    const consumedAt = new Date();
+    const tokens = await tokenRepository.find({
+      where: { instanceId: instance.id },
+    });
+    const alternativeTokens = tokens.filter(
+      (candidate) =>
+        candidate.id !== token.id &&
+        (candidate.status === WorkflowTokenStatusEnum.ACTIVE ||
+          candidate.status === WorkflowTokenStatusEnum.WAITING) &&
+        hasPathToNode(
+          instance.workflowSnapshot,
+          candidate.currentNodeId,
+          targetNodeId,
+        ),
+    );
+
+    if (alternativeTokens.length === 0) {
+      return;
+    }
+
+    const alternativeTokenIds = alternativeTokens.map(
+      (candidate) => candidate.id,
+    );
+    const cancellableTasks = (
+      await taskRepository.find({
+        where: { instanceId: instance.id },
+      })
+    ).filter(
+      (task) =>
+        alternativeTokenIds.includes(task.tokenId) &&
+        (task.status === TaskStatusEnum.PENDING ||
+          task.status === TaskStatusEnum.IN_PROGRESS),
+    );
+
+    await tokenRepository.save(
+      alternativeTokens.map(
+        (candidate): WorkflowTokenEntity => ({
+          ...candidate,
+          consumedAt,
+          status: WorkflowTokenStatusEnum.CONSUMED,
+        }),
+      ),
+    );
+
+    if (cancellableTasks.length) {
+      await taskRepository.save(
+        cancellableTasks.map(
+          (task): TaskEntity =>
+            Object.assign(new TaskEntity(), task, {
+              completedAt: consumedAt,
+              status: TaskStatusEnum.CANCELLED,
+            }),
+        ),
+      );
+      await this.closeTaskCandidates(
+        manager,
+        cancellableTasks.map((task) => task.id),
+        TaskCandidateStatusEnum.SUPERSEDED,
+      );
+    }
+  }
+
+  private async closeTaskCandidates(
+    manager: EntityManager,
+    taskIds: readonly string[],
+    status: TaskCandidateStatusEnum,
+  ): Promise<void> {
+    if (taskIds.length === 0) {
+      return;
+    }
+
+    const candidateRepository = manager.getRepository(TaskCandidateEntity);
+    const candidates = (
+      await candidateRepository.find({ where: { taskId: In([...taskIds]) } })
+    ).filter(
+      (candidate) =>
+        candidate.status === TaskCandidateStatusEnum.PENDING ||
+        candidate.status === TaskCandidateStatusEnum.CLAIMED,
+    );
+
+    if (candidates.length === 0) {
+      return;
+    }
+
+    await candidateRepository.save(
+      candidates.map(
+        (candidate): TaskCandidateEntity =>
+          Object.assign(new TaskCandidateEntity(), candidate, { status }),
+      ),
+    );
+  }
+
+  private async getTemplateOrThrow(
+    templateId: string,
+  ): Promise<ApprovalTemplateEntity> {
+    const template = await this.approvalTemplateRepository.findOne({
+      where: { deletedAt: IsNull(), id: templateId },
+    });
+
+    if (!template) {
+      throw new NotFoundException(
+        `Approval template ${templateId} was not found`,
+      );
+    }
+
+    return template;
+  }
+
+  private async getPublishedTemplateVersionOrThrow(
+    versionId: string,
+  ): Promise<ApprovalTemplateVersionEntity> {
+    const version = await this.approvalTemplateVersionRepository.findOne({
+      where: { id: versionId },
+    });
+
+    if (!version) {
+      throw new NotFoundException(
+        `Approval template version ${versionId} was not found`,
+      );
+    }
+
+    if (version.status !== ApprovalTemplateVersionStatusEnum.PUBLISHED) {
+      throw new ConflictException(
+        'Approval template current version must be published',
+      );
+    }
+
+    return version;
+  }
+
+  private async getPublishedFormVersionOrThrow(
+    versionId: string | null,
+  ): Promise<FormDefinitionVersionEntity> {
+    if (!versionId) {
+      throw new ConflictException(
+        'Approval template version does not bind a form version',
+      );
+    }
+
+    const version = await this.formDefinitionVersionRepository.findOne({
+      where: { id: versionId },
+    });
+
+    if (!version) {
+      throw new NotFoundException(
+        `Form definition version ${versionId} was not found`,
+      );
+    }
+
+    if (version.status !== FormDefinitionVersionStatusEnum.PUBLISHED) {
+      throw new ConflictException(
+        'Approval template must bind a published form version',
+      );
+    }
+
+    return version;
+  }
+}
+
+function parseJsonObject(
+  value: string,
+  label: string,
+): Readonly<Record<string, unknown>> {
+  try {
+    const parsedValue = JSON.parse(value) as unknown;
+
+    if (isRecord(parsedValue)) {
+      return parsedValue;
+    }
+
+    throw new BadRequestException(`${label} must be a JSON object`);
+  } catch (error: unknown) {
+    if (error instanceof BadRequestException) {
+      throw error;
+    }
+
+    throw new BadRequestException(
+      error instanceof Error ? error.message : `${label} is invalid JSON`,
+    );
+  }
+}
+
+function readDefaultInitiatorMetadataSnapshot(
+  memberId: string,
+): Readonly<Record<string, unknown>> {
+  return {
+    customFields: {},
+    memberId,
+  };
+}
+
+function parseWorkflowDefinition(value: string): WorkflowDefinition {
+  try {
+    const parsedValue = JSON.parse(value) as unknown;
+
+    if (
+      isRecord(parsedValue) &&
+      Array.isArray(parsedValue.nodes) &&
+      Array.isArray(parsedValue.edges) &&
+      isRecord(parsedValue.meta)
+    ) {
+      return parsedValue as unknown as WorkflowDefinition;
+    }
+
+    throw new BadRequestException(
+      'workflowDefinitionJson must be a workflow definition object',
+    );
+  } catch (error: unknown) {
+    if (error instanceof BadRequestException) {
+      throw error;
+    }
+
+    throw new BadRequestException(
+      error instanceof Error
+        ? error.message
+        : 'workflowDefinitionJson is invalid JSON',
+    );
+  }
+}
+
+function buildInitiatorPolicyContext(
+  initiatorMetadataSnapshot: Readonly<Record<string, unknown>>,
+): Readonly<Record<string, unknown>> {
+  return {
+    env: {
+      now: new Date().toISOString(),
+    },
+    initiator: initiatorMetadataSnapshot,
+    subject: initiatorMetadataSnapshot,
+  };
+}
+
+function buildWorkflowExpressionContext(
+  instance: ApprovalInstanceEntity,
+): Readonly<Record<string, unknown>> {
+  return {
+    env: {
+      now: new Date().toISOString(),
+    },
+    form: instance.formData,
+    formData: instance.formData,
+    initiator: {
+      ...instance.initiatorMetadataSnapshot,
+      memberId: instance.initiatorMemberId,
+    },
+    instance: {
+      id: instance.id,
+      state: instance.state,
+      templateId: instance.templateId,
+      templateVersionId: instance.templateVersionId,
+      title: instance.title,
+    },
+  };
+}
+
+function readDelegationSteps(
+  value: readonly Readonly<Record<string, unknown>>[],
+): readonly DelegationStep[] {
+  return value
+    .map((step): DelegationStep | null => {
+      const from = readStringValue(step.from);
+      const to = readStringValue(step.to);
+      const reason = readStringValue(step.reason);
+
+      if (!from || !to || !reason) {
+        return null;
+      }
+
+      return {
+        from,
+        reason,
+        ruleId: readStringValue(step.ruleId),
+        to,
+      };
+    })
+    .filter((step): step is DelegationStep => step !== null);
+}
+
+function readStringValue(value: unknown): string | null {
+  return typeof value === 'string' && value.trim() ? value : null;
+}
+
+function buildDryRunExpressionContext(
+  input: DryRunSimulationInput,
+  lastDecision: Readonly<Record<string, unknown>> | null,
+): Readonly<Record<string, unknown>> {
+  return {
+    env: {
+      now: new Date().toISOString(),
+    },
+    form: input.formData,
+    formData: input.formData,
+    initiator: {
+      ...input.initiatorMetadataSnapshot,
+      memberId: input.initiatorMemberId,
+    },
+    instance: {
+      id: SYSTEM_DRY_RUN_INSTANCE_ID,
+      state: ApprovalInstanceStateEnum.RUNNING,
+      title: 'Dry Run',
+    },
+    lastDecision,
+  };
+}
+
+function isRecord(value: unknown): value is Readonly<Record<string, unknown>> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function readWorkflowNodeOrThrow(
+  workflow: WorkflowDefinition,
+  nodeId: string,
+): WorkflowNode {
+  const node = workflow.nodes.find((candidate) => candidate.id === nodeId);
+
+  if (!node) {
+    throw new ConflictException(`Workflow node ${nodeId} was not found`);
+  }
+
+  return node;
+}
+
+function readOutgoingEdgesOrThrow(
+  workflow: WorkflowDefinition,
+  nodeId: string,
+): readonly WorkflowEdge[] {
+  const edges = workflow.edges.filter((edge) => edge.source === nodeId);
+
+  if (edges.length === 0) {
+    throw new ConflictException(`Workflow node ${nodeId} has no outgoing edge`);
+  }
+
+  return edges;
+}
+
+function readIncomingEdges(
+  workflow: WorkflowDefinition,
+  nodeId: string,
+): readonly WorkflowEdge[] {
+  return workflow.edges.filter((edge) => edge.target === nodeId);
+}
+
+function hasPathToNode(
+  workflow: WorkflowDefinition,
+  sourceNodeId: string,
+  targetNodeId: string,
+): boolean {
+  return visitPathToNode(workflow, sourceNodeId, targetNodeId, new Set());
+}
+
+function visitPathToNode(
+  workflow: WorkflowDefinition,
+  sourceNodeId: string,
+  targetNodeId: string,
+  visitedNodeIds: ReadonlySet<string>,
+): boolean {
+  if (sourceNodeId === targetNodeId) {
+    return true;
+  }
+
+  if (visitedNodeIds.has(sourceNodeId)) {
+    return false;
+  }
+
+  const nextVisitedNodeIds = new Set([...visitedNodeIds, sourceNodeId]);
+
+  return workflow.edges
+    .filter((edge) => edge.source === sourceNodeId)
+    .some((edge) =>
+      visitPathToNode(workflow, edge.target, targetNodeId, nextVisitedNodeIds),
+    );
+}
+
+function readReturnTargetNodeId(
+  workflow: WorkflowDefinition,
+  currentNodeId: string,
+  requestedNodeId?: string | null,
+): string {
+  const currentNode = readWorkflowNodeOrThrow(workflow, currentNodeId);
+
+  if (currentNode.type !== 'userTask') {
+    throw new ConflictException(
+      `Workflow node ${currentNodeId} does not support return decisions`,
+    );
+  }
+
+  if (!currentNode.data.returnBehavior.allowReturn) {
+    throw new ConflictException(
+      `User task ${currentNodeId} does not allow return decisions`,
+    );
+  }
+
+  const trimmedRequestedNodeId = requestedNodeId?.trim() || null;
+  const defaultTargetNodeId = readDefaultReturnTargetNodeId(
+    workflow,
+    currentNode,
+  );
+
+  if (currentNode.data.returnBehavior.allowedTargets === 'ANY') {
+    if (!trimmedRequestedNodeId) {
+      throw new BadRequestException('returnToNodeId is required');
+    }
+
+    readWorkflowNodeOrThrow(workflow, trimmedRequestedNodeId);
+
+    return trimmedRequestedNodeId;
+  }
+
+  if (
+    trimmedRequestedNodeId &&
+    trimmedRequestedNodeId !== defaultTargetNodeId
+  ) {
+    throw new ConflictException(
+      `User task ${currentNodeId} can only return to ${defaultTargetNodeId}`,
+    );
+  }
+
+  return defaultTargetNodeId;
+}
+
+function readDefaultReturnTargetNodeId(
+  workflow: WorkflowDefinition,
+  currentNode: UserTaskNode,
+): string {
+  if (currentNode.data.returnBehavior.allowedTargets === 'INITIATOR') {
+    const startNode = workflow.nodes.find((node) => node.type === 'startEvent');
+
+    if (!startNode) {
+      throw new ConflictException('Workflow does not include a startEvent');
+    }
+
+    return startNode.id;
+  }
+
+  const previousNodeId = readIncomingEdges(workflow, currentNode.id)[0]?.source;
+
+  if (!previousNodeId) {
+    throw new ConflictException(
+      `User task ${currentNode.id} does not have a previous node to return to`,
+    );
+  }
+
+  return previousNodeId;
+}
+
+function readReturnResubmitStrategy(
+  task: TaskEntity,
+  instance: ApprovalInstanceEntity,
+): ReturnResubmitStrategy {
+  const node = readWorkflowNodeOrThrow(instance.workflowSnapshot, task.nodeId);
+
+  if (node.type !== 'userTask') {
+    return 'RESTART';
+  }
+
+  return node.data.returnBehavior.resubmitStrategy ?? 'RESTART';
+}
+
+function readReturnResubmitStrategyFromPayload(
+  payload: Readonly<Record<string, unknown>>,
+): ReturnResubmitStrategy {
+  return payload.resubmitStrategy === 'FROM_RETURN_POINT'
+    ? 'FROM_RETURN_POINT'
+    : 'RESTART';
+}
+
+function readStringPayloadValue(
+  payload: Readonly<Record<string, unknown>>,
+  key: string,
+): string | null {
+  const value = payload[key];
+
+  return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+
+function readNodeEntryCondition(node: WorkflowNode): string | null {
+  if (node.type === 'userTask' || node.type === 'serviceTask') {
+    return node.data.entryCondition?.trim() || null;
+  }
+
+  return null;
+}
+
+function edgeHasCondition(edge: WorkflowEdge): boolean {
+  return Boolean(
+    edge.data.condition?.trim() ||
+    (edge.data.conditionFieldKey && edge.data.conditionOperator),
+  );
+}
+
+function readMemberIdFromValue(value: unknown, label: string): string {
+  return readMemberIdsFromValue(value, label)[0] ?? '';
+}
+
+function readMemberIdsFromValue(
+  value: unknown,
+  label: string,
+): readonly string[] {
+  if (typeof value === 'string' && value.trim()) {
+    return [value.trim()];
+  }
+
+  if (Array.isArray(value)) {
+    const memberIds = value
+      .filter(
+        (candidate): candidate is string =>
+          typeof candidate === 'string' && Boolean(candidate.trim()),
+      )
+      .map((candidate) => candidate.trim());
+
+    if (memberIds.length > 0) {
+      return uniqueTexts(memberIds);
+    }
+  }
+
+  throw new ConflictException(`${label} did not resolve to a member id`);
+}
+
+function uniqueTexts(values: readonly string[]): readonly string[] {
+  return [...new Set(values.filter((value) => value.trim()))];
+}
+
+function uniqueRuntimeCandidates(
+  candidates: readonly RuntimeTaskCandidate[],
+): readonly RuntimeTaskCandidate[] {
+  const seen = new Set<string>();
+
+  return candidates.filter((candidate) => {
+    if (seen.has(candidate.memberId)) {
+      return false;
+    }
+
+    seen.add(candidate.memberId);
+
+    return true;
+  });
+}
+
+function uniqueTasksById(tasks: readonly TaskEntity[]): readonly TaskEntity[] {
+  const seen = new Set<string>();
+
+  return tasks.filter((task) => {
+    if (seen.has(task.id)) {
+      return false;
+    }
+
+    seen.add(task.id);
+
+    return true;
+  });
+}
+
+function normalizeText(value: string | null | undefined): string | null {
+  return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+
+function readPageOffset(
+  page: number | null | undefined,
+  pageSize: number | null | undefined,
+): number {
+  const normalizedPageSize = normalizePageSize(pageSize);
+
+  return (normalizePage(page) - 1) * normalizedPageSize;
+}
+
+function shouldPaginateList(options: ListApprovalInstancesOptions): boolean {
+  return (
+    typeof options.page !== 'undefined' ||
+    typeof options.pageSize !== 'undefined'
+  );
+}
+
+function normalizePage(value: number | null | undefined): number {
+  return Number.isInteger(value) && Number(value) > 0 ? Number(value) : 1;
+}
+
+function normalizePageSize(value: number | null | undefined): number {
+  if (!Number.isInteger(value) || Number(value) <= 0) {
+    return 20;
+  }
+
+  return Math.min(Number(value), 100);
+}
+
+function applyApprovalInstanceSearchFilter(
+  queryBuilder: SelectQueryBuilder<ApprovalInstanceEntity>,
+  searchTextValue: string | null | undefined,
+): void {
+  const searchText = normalizeText(searchTextValue)?.toLocaleLowerCase();
+
+  if (!searchText) {
+    return;
+  }
+
+  queryBuilder.andWhere(
+    [
+      '(',
+      'LOWER("approvalInstance"."title") LIKE :approvalInstanceSearchText',
+      'OR LOWER("approvalInstance"."initiator_member_id") LIKE :approvalInstanceSearchText',
+      'OR LOWER(CAST("approvalInstance"."id" AS text)) LIKE :approvalInstanceSearchText',
+      ')',
+    ].join(' '),
+    {
+      approvalInstanceSearchText: `%${escapeLikePattern(searchText)}%`,
+    },
+  );
+}
+
+function escapeLikePattern(value: string): string {
+  return value
+    .replace(/\\/gu, '\\\\')
+    .replace(/%/gu, '\\%')
+    .replace(/_/gu, '\\_');
+}
+
+function isInstanceWithinRange(
+  instance: ApprovalInstanceEntity,
+  options: WorkflowDashboardSummaryOptions,
+): boolean {
+  const fromTime = options.from?.getTime() ?? null;
+  const toTime = options.to?.getTime() ?? null;
+  const candidateTime = (
+    instance.completedAt ??
+    instance.startedAt ??
+    instance.createdAt
+  ).getTime();
+
+  return (
+    (fromTime === null || candidateTime >= fromTime) &&
+    (toTime === null || candidateTime <= toTime)
+  );
+}
+
+function readDecisionPolicySnapshot(task: TaskEntity): DecisionPolicy {
+  const value = task.decisionPolicySnapshot;
+
+  if (
+    isRecord(value) &&
+    typeof value.type === 'string' &&
+    (value.type === 'SINGLE' ||
+      value.type === 'SEQUENTIAL' ||
+      value.type === 'PARALLEL_ALL' ||
+      value.type === 'PARALLEL_ANY')
+  ) {
+    return { type: value.type };
+  }
+
+  if (
+    isRecord(value) &&
+    value.type === 'QUORUM' &&
+    typeof value.threshold === 'number' &&
+    (value.thresholdType === 'COUNT' || value.thresholdType === 'PERCENTAGE')
+  ) {
+    return {
+      threshold: value.threshold,
+      thresholdType: value.thresholdType,
+      type: 'QUORUM',
+    };
+  }
+
+  return { type: 'SINGLE' };
+}
+
+function shouldCompleteTaskAfterDecision({
+  action,
+  candidates,
+  decisionPolicy,
+}: {
+  readonly action: TaskDecisionActionEnum;
+  readonly candidates: readonly TaskCandidateEntity[];
+  readonly decisionPolicy: DecisionPolicy;
+}): boolean {
+  if (action !== TaskDecisionActionEnum.APPROVED) {
+    return true;
+  }
+
+  if (
+    decisionPolicy.type === 'SINGLE' ||
+    decisionPolicy.type === 'PARALLEL_ANY'
+  ) {
+    return true;
+  }
+
+  const completedCount = candidates.filter(
+    (candidate) => candidate.status === TaskCandidateStatusEnum.COMPLETED,
+  ).length;
+  const totalCount = Math.max(candidates.length, 1);
+
+  if (
+    decisionPolicy.type === 'PARALLEL_ALL' ||
+    decisionPolicy.type === 'SEQUENTIAL'
+  ) {
+    return completedCount >= totalCount;
+  }
+
+  const threshold =
+    decisionPolicy.thresholdType === 'PERCENTAGE'
+      ? Math.ceil((totalCount * decisionPolicy.threshold) / 100)
+      : decisionPolicy.threshold;
+
+  return completedCount >= Math.max(threshold, 1);
+}
+
+function readValueAtPath(
+  value: Readonly<Record<string, unknown>>,
+  path: string,
+): unknown {
+  return path
+    .split('.')
+    .filter((segment) => segment.trim())
+    .reduce<unknown>((currentValue, segment) => {
+      if (!isRecord(currentValue)) {
+        return undefined;
+      }
+
+      return currentValue[segment];
+    }, value);
+}
+
+function writeValueAtPath(
+  value: Readonly<Record<string, unknown>>,
+  path: string,
+  nextValue: unknown,
+): Readonly<Record<string, unknown>> {
+  const segments = normalizeFormFieldPath(path);
+
+  if (segments.length === 0) {
+    return value;
+  }
+
+  return writeNestedValue(value, segments, nextValue);
+}
+
+function writeNestedValue(
+  value: Readonly<Record<string, unknown>>,
+  segments: readonly string[],
+  nextValue: unknown,
+): Readonly<Record<string, unknown>> {
+  const [currentSegment, ...remainingSegments] = segments;
+
+  if (!currentSegment) {
+    return value;
+  }
+
+  if (remainingSegments.length === 0) {
+    return { ...value, [currentSegment]: nextValue };
+  }
+
+  const currentValue = value[currentSegment];
+  const nestedValue = isRecord(currentValue) ? currentValue : {};
+
+  return {
+    ...value,
+    [currentSegment]: writeNestedValue(
+      nestedValue,
+      remainingSegments,
+      nextValue,
+    ),
+  };
+}
+
+function normalizeFormFieldPath(path: string): readonly string[] {
+  const segments = path
+    .split('.')
+    .map((segment) => segment.trim())
+    .filter(Boolean);
+
+  if (segments[0] === 'form' || segments[0] === 'formData') {
+    return segments.slice(1);
+  }
+
+  return segments;
+}
+
+async function executeWebhookServiceAction(
+  serviceTaskDispatcher: BPMWorkflowServiceTaskDispatcher,
+  action: Extract<
+    ServiceTaskNode['data']['action'],
+    { readonly type: 'WEBHOOK' }
+  >,
+  payload: unknown,
+): Promise<BPMWorkflowWebhookDispatchResult> {
+  try {
+    return await serviceTaskDispatcher.dispatchWebhook({
+      headers: action.headers,
+      payload,
+      url: action.url,
+    });
+  } catch (error: unknown) {
+    return {
+      error: error instanceof Error ? error.message : 'Unknown webhook error',
+      ok: false,
+      status: null,
+    };
+  }
+}
+
+function readManagerMemberIdFromInitiatorSnapshot(
+  initiatorMetadataSnapshot: Readonly<Record<string, unknown>>,
+  levelsUp: number,
+): unknown {
+  const managerChain = initiatorMetadataSnapshot.managerChain;
+
+  if (Array.isArray(managerChain)) {
+    return managerChain[Math.max(levelsUp - 1, 0)];
+  }
+
+  const managerMemberIds = initiatorMetadataSnapshot.managerMemberIds;
+
+  if (Array.isArray(managerMemberIds)) {
+    return managerMemberIds[Math.max(levelsUp - 1, 0)];
+  }
+
+  const customFields = initiatorMetadataSnapshot.customFields;
+
+  if (isRecord(customFields)) {
+    return customFields.managerMemberId;
+  }
+
+  return initiatorMetadataSnapshot.managerMemberId;
+}
+
+function isDateRangeActive(
+  value: Pick<
+    MembershipEntity | ManagerResolutionEntity,
+    'effectiveFrom' | 'effectiveTo'
+  >,
+  date: string,
+): boolean {
+  return (
+    value.effectiveFrom <= date &&
+    (!value.effectiveTo || value.effectiveTo >= date)
+  );
+}
+
+function compareManagerResolution(
+  left: ManagerResolutionEntity,
+  right: ManagerResolutionEntity,
+): number {
+  const priorityDiff = right.priority - left.priority;
+
+  if (priorityDiff !== 0) {
+    return priorityDiff;
+  }
+
+  return (
+    readManagerResolutionScopeRank(right.scopeType) -
+      readManagerResolutionScopeRank(left.scopeType) ||
+    right.effectiveFrom.localeCompare(left.effectiveFrom)
+  );
+}
+
+function readManagerResolutionScopeRank(
+  scopeType: ManagerResolutionScopeTypeEnum,
+): number {
+  const ranks: Readonly<Record<ManagerResolutionScopeTypeEnum, number>> = {
+    [ManagerResolutionScopeTypeEnum.MEMBER]: 3,
+    [ManagerResolutionScopeTypeEnum.ORG_UNIT]: 2,
+    [ManagerResolutionScopeTypeEnum.POSITION]: 1,
+  };
+
+  return ranks[scopeType];
+}
+
+function compareMembership(
+  left: MembershipEntity,
+  right: MembershipEntity,
+): number {
+  if (left.isPrimary !== right.isPrimary) {
+    return left.isPrimary ? -1 : 1;
+  }
+
+  return right.effectiveFrom.localeCompare(left.effectiveFrom);
+}
+
+function toDateOnlyString(value: Date): string {
+  return value.toISOString().slice(0, 10);
+}
+
+function canReadAllWorkflows(scope: WorkflowReadScope): boolean {
+  return (
+    scope.roles.includes('BPM_ADMIN') ||
+    scope.permissions.some((permission) =>
+      WORKFLOW_READ_ALL_PERMISSIONS.has(permission),
+    )
+  );
+}
+
+function isTaskRelatedToMember(task: TaskEntity, memberId: string): boolean {
+  return (
+    task.assigneeMemberId === memberId ||
+    task.originalAssigneeMemberId === memberId
+  );
+}
+
+function readCandidateStatusForClosedTask(
+  taskStatus: TaskStatusEnum,
+): TaskCandidateStatusEnum {
+  if (taskStatus === TaskStatusEnum.TRANSFERRED) {
+    return TaskCandidateStatusEnum.TRANSFERRED;
+  }
+
+  if (taskStatus === TaskStatusEnum.COMPLETED) {
+    return TaskCandidateStatusEnum.COMPLETED;
+  }
+
+  return TaskCandidateStatusEnum.CANCELLED;
+}
+
+function validateSubmittedFormData(
+  schema: FormDefinitionSchema,
+  formData: Readonly<Record<string, unknown>>,
+): void {
+  const missingFields = schema.fields.filter((field) => {
+    const fieldValue = formData[field.fieldKey];
+
+    return (
+      isSubmittedFormFieldVisible(field, schema.fields, formData) &&
+      isSubmittedFormFieldRequired(field, schema.fields, formData) &&
+      !isSubmittedFieldValuePresent(fieldValue)
+    );
+  });
+
+  if (missingFields.length > 0) {
+    throw new BadRequestException(
+      `Form data is missing required fields: ${missingFields
+        .map((field) => field.label || field.fieldKey)
+        .join(', ')}`,
+    );
+  }
+}
+
+function readFormDefinitionSnapshotSchema(
+  snapshot: Readonly<Record<string, unknown>>,
+): FormDefinitionSchema {
+  const schema = snapshot.schema;
+
+  if (isFormDefinitionSchema(schema)) {
+    return schema;
+  }
+
+  throw new BadRequestException('Approval instance form schema is invalid');
+}
+
+function isFormDefinitionSchema(value: unknown): value is FormDefinitionSchema {
+  return (
+    isRecord(value) && value.schemaVersion === 1 && Array.isArray(value.fields)
+  );
+}
+
+function isSubmittedFormFieldVisible(
+  field: FormFieldDefinition,
+  fields: readonly FormFieldDefinition[],
+  values: Readonly<Record<string, unknown>>,
+): boolean {
+  return field.visibleWhen
+    ? evaluateFormConditionExpression(field.visibleWhen, fields, values, true)
+    : true;
+}
+
+function isSubmittedFormFieldRequired(
+  field: FormFieldDefinition,
+  fields: readonly FormFieldDefinition[],
+  values: Readonly<Record<string, unknown>>,
+): boolean {
+  return (
+    field.required ||
+    Boolean(
+      field.requiredWhen
+        ? evaluateFormConditionExpression(
+            field.requiredWhen,
+            fields,
+            values,
+            false,
+          )
+        : false,
+    )
+  );
+}
+
+function evaluateFormConditionExpression(
+  expression: string,
+  fields: readonly FormFieldDefinition[],
+  values: Readonly<Record<string, unknown>>,
+  fallback: boolean,
+): boolean {
+  const rule = parseFormConditionRule(expression);
+
+  if (!rule) {
+    return fallback;
+  }
+
+  const field = fields.find(
+    (candidate) => candidate.fieldKey === rule.fieldKey,
+  );
+
+  if (!field) {
+    return fallback;
+  }
+
+  return evaluateFormConditionRule(rule, field, values[field.fieldKey]);
+}
+
+function parseFormConditionRule(expression: string): {
+  readonly fieldKey: string;
+  readonly operator: FormConditionOperator;
+  readonly value: string;
+} | null {
+  const match = expression
+    .trim()
+    .match(/^form\.([A-Za-z][A-Za-z0-9_]*)\s*(==|!=|>=|<=|>|<)\s*(.+)$/u);
+
+  if (!match) {
+    return null;
+  }
+
+  const operator = readFormConditionOperatorFromSymbol(match[2]);
+
+  if (!operator) {
+    return null;
+  }
+
+  return {
+    fieldKey: match[1],
+    operator,
+    value: parseFormConditionLiteral(match[3]),
+  };
+}
+
+function evaluateFormConditionRule(
+  rule: {
+    readonly operator: FormConditionOperator;
+    readonly value: string;
+  },
+  field: FormFieldDefinition,
+  value: unknown,
+): boolean {
+  if (Array.isArray(value)) {
+    return evaluateArrayFormCondition(value, rule);
+  }
+
+  if (field.type === 'boolean') {
+    return compareFormConditionValues(
+      value === true ? 'true' : 'false',
+      rule.value,
+      rule.operator,
+    );
+  }
+
+  if (isNumberFormField(field)) {
+    return compareNumericFormCondition(value, rule);
+  }
+
+  return compareFormConditionValues(
+    typeof value === 'undefined' || value === null ? '' : String(value),
+    rule.value,
+    rule.operator,
+  );
+}
+
+function evaluateArrayFormCondition(
+  value: readonly unknown[],
+  rule: {
+    readonly operator: FormConditionOperator;
+    readonly value: string;
+  },
+): boolean {
+  const stringValues = value.filter(
+    (entry): entry is string => typeof entry === 'string',
+  );
+
+  if (rule.operator === 'equals') {
+    return stringValues.includes(rule.value);
+  }
+
+  if (rule.operator === 'notEquals') {
+    return !stringValues.includes(rule.value);
+  }
+
+  return false;
+}
+
+function compareNumericFormCondition(
+  value: unknown,
+  rule: {
+    readonly operator: FormConditionOperator;
+    readonly value: string;
+  },
+): boolean {
+  const actualValue = typeof value === 'number' ? value : Number(value);
+  const expectedValue = Number(rule.value);
+
+  if (!Number.isFinite(actualValue) || !Number.isFinite(expectedValue)) {
+    return false;
+  }
+
+  return compareFormConditionValues(actualValue, expectedValue, rule.operator);
+}
+
+function compareFormConditionValues(
+  actualValue: number | string,
+  expectedValue: number | string,
+  operator: FormConditionOperator,
+): boolean {
+  if (operator === 'equals') {
+    return actualValue === expectedValue;
+  }
+
+  if (operator === 'notEquals') {
+    return actualValue !== expectedValue;
+  }
+
+  if (operator === 'greaterThan') {
+    return actualValue > expectedValue;
+  }
+
+  if (operator === 'greaterThanOrEqual') {
+    return actualValue >= expectedValue;
+  }
+
+  if (operator === 'lessThan') {
+    return actualValue < expectedValue;
+  }
+
+  return actualValue <= expectedValue;
+}
+
+function readFormConditionOperatorFromSymbol(
+  symbol: string | undefined,
+): FormConditionOperator | null {
+  const operators: Readonly<Record<string, FormConditionOperator>> = {
+    '!=': 'notEquals',
+    '<': 'lessThan',
+    '<=': 'lessThanOrEqual',
+    '==': 'equals',
+    '>': 'greaterThan',
+    '>=': 'greaterThanOrEqual',
+  };
+
+  return symbol ? (operators[symbol] ?? null) : null;
+}
+
+function parseFormConditionLiteral(value: string): string {
+  const trimmedValue = value.trim();
+
+  if (
+    (trimmedValue.startsWith('"') && trimmedValue.endsWith('"')) ||
+    (trimmedValue.startsWith("'") && trimmedValue.endsWith("'"))
+  ) {
+    return trimmedValue.slice(1, -1);
+  }
+
+  return trimmedValue;
+}
+
+function isSubmittedFieldValuePresent(value: unknown): boolean {
+  if (typeof value === 'undefined' || value === null) {
+    return false;
+  }
+
+  if (typeof value === 'string') {
+    return value.trim().length > 0;
+  }
+
+  if (Array.isArray(value)) {
+    return value.length > 0;
+  }
+
+  return true;
+}
+
+function isNumberFormField(
+  field: FormFieldDefinition,
+): field is NumberFieldDefinition {
+  return field.type === 'number' || field.type === 'money';
+}
+
+function createDryRunStep(input: {
+  readonly assigneeMemberId: string | null;
+  readonly edge: WorkflowEdge | null;
+  readonly edgeMatched: boolean | null;
+  readonly edgeReason: string | null;
+  readonly entryCondition: string | null;
+  readonly entryConditionMet: boolean | null;
+  readonly message: string;
+  readonly node: WorkflowNode;
+  readonly status: string;
+  readonly stepIndex: number;
+}): WorkflowDryRunStepObject {
+  return Object.assign(new WorkflowDryRunStepObject(), {
+    assigneeMemberId: input.assigneeMemberId,
+    edgeDefault: input.edge ? Boolean(input.edge.data.isDefault) : null,
+    edgeId: input.edge?.id ?? null,
+    edgeLabel: input.edge ? readDryRunEdgeLabel(input.edge) : null,
+    edgeMatched: input.edgeMatched,
+    edgeReason: input.edgeReason,
+    entryCondition: input.entryCondition,
+    entryConditionMatched: input.entryConditionMet,
+    id: `dry-run-step-${input.stepIndex + 1}`,
+    message: input.message,
+    nodeId: input.node.id,
+    nodeLabel: input.node.data.label,
+    nodeType: input.node.type,
+    status: input.status,
+  });
+}
+
+function readDryRunEdgeLabel(edge: WorkflowEdge): string {
+  return edge.data.label?.trim() || edge.id;
+}
+
+function readDryRunEdgeReason(edge: WorkflowEdge | null): string | null {
+  if (!edge) {
+    return null;
+  }
+
+  if (edge.data.isDefault) {
+    return '其他條件不符合時採用預設路徑。';
+  }
+
+  const expression = edge.data.condition?.trim();
+
+  if (expression) {
+    return `條件成立：${expression}`;
+  }
+
+  if (edge.data.conditionFieldKey && edge.data.conditionOperator) {
+    return `條件成立：${edge.data.conditionFieldKey} ${edge.data.conditionOperator}${
+      edge.data.conditionValue ? ` ${edge.data.conditionValue}` : ''
+    }`;
+  }
+
+  return '無條件路徑。';
+}
+
+function readDryRunStepStatus(
+  node: WorkflowNode,
+  entryConditionMet: boolean,
+): string {
+  if (!entryConditionMet) {
+    return 'SKIPPED';
+  }
+
+  if (node.type === 'userTask') {
+    return 'WAITING';
+  }
+
+  if (node.type === 'endEvent') {
+    return 'COMPLETED';
+  }
+
+  return 'PASSED';
+}
+
+function readDryRunStepMessage(
+  node: WorkflowNode,
+  entryConditionMet: boolean,
+): string {
+  if (!entryConditionMet) {
+    return '進入條件不符合，略過節點。';
+  }
+
+  if (node.type === 'userTask') {
+    return '將建立待簽任務。';
+  }
+
+  if (node.type === 'endEvent') {
+    return `流程結束：${node.data.endState ?? 'APPROVED'}`;
+  }
+
+  return '節點條件通過。';
+}