@rytass/bpm-core-nestjs-module 0.17.9 → 0.18.1

package/src/lib/workflow-engine/workflow-engine.service.js

@@ -18,6 +18,7 @@ const form_definition_version_entity_1 = require("../form/form-definition-versio
 const form_enums_1 = require("../form/form.enums");
 const form_data_source_errors_1 = require("../form-data-source/form-data-source.errors");
 const form_member_value_validator_1 = require("../form/form-member-value.validator");
+const form_org_unit_value_validator_1 = require("../form/form-org-unit-value.validator");
 const form_data_source_types_1 = require("../form-data-source/form-data-source.types");
 const sla_schedule_service_1 = require("../calendar/sla-schedule.service");
 const notification_service_1 = require("../notification/notification.service");
@@ -38,6 +39,7 @@ const activity_log_entity_1 = require("./activity-log.entity");
 const adhoc_directive_entity_1 = require("./adhoc-directive.entity");
 const adhoc_enums_1 = require("./adhoc.enums");
 const approval_instance_entity_1 = require("./approval-instance.entity");
+const text_field_pattern_test_1 = require("./text-field-pattern-test");
 const form_data_fingerprint_1 = require("./form-data-fingerprint");
 const instance_submitter_1 = require("./instance-submitter");
 const task_decision_entity_1 = require("./task-decision.entity");
@@ -681,6 +683,9 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
                     decisionId: decision.id,
                     signatureId: signature.id,
                     signedPayloadHash: signature.signedPayloadHash,
+                    // Absent for a person's decision, so "who actually signed" can
+                    // tell the engine's own timeout approvals apart.
+                    ...(options.automatic ? { automatic: options.automatic } : {}),
                     // Keys only: this payload is forwarded to hosts, and the values
                     // can be tax IDs or amounts.
                     ...(changedFieldKeys.length > 0 ? { changedFieldKeys } : {}),
@@ -1825,6 +1830,16 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
     resolveDryRunAssignment(input, node) {
         const resolver = node.data.approverResolver;
         const excludeInitiator = node.data.excludeInitiator;
+        const unsupportedType = (0, workflow_1.readUnsupportedApproverResolverType)(resolver);
+        // A source from a newer engine cannot be simulated. Say so and end the
+        // branch instead of showing its type name as if it were a person.
+        if (unsupportedType !== null) {
+            return {
+                assigneeMemberId: null,
+                message: `簽核節點「${readDryRunNodeName(node)}」此引擎版本不支援簽核人來源「${unsupportedType}」，請升級 BPMCore 後再試`,
+                outcome: 'STOPPED',
+            };
+        }
         const memberIds = this.readDryRunMemberIds(input, resolver, `workflow.nodes.${node.id}.data.approverResolver`);
         if (memberIds === null) {
             return {
@@ -1910,6 +1925,8 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
                 ? managerMemberIds
                 : readDryRunFallbackMemberIds(input, resolver.fallback);
         }
+        // The form pick, the unit's rules and an earlier node's outcome are not
+        // known before the instance runs: these stand in as placeholders.
         return null;
     }
     async getApprovalInstance(id, scope) {
@@ -3840,11 +3857,13 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
     // Not deduplicated: a node that excludes the initiator filters first, so a
     // first-seen entry that must be dropped cannot shadow a legitimate one.
     async delegateResolvedCandidates(manager, instance, nodeId, resolvedCandidates, gradeGated) {
-        const context = this.buildDelegationContext(instance, nodeId);
-        const resolved = await Promise.all(resolvedCandidates.map(async (candidate) => ({
+        // One batch for the node, so the host directory is asked once for every
+        // candidate's delegation agents rather than once per candidate.
+        const resolutions = await this.delegationService.resolveAssignees(resolvedCandidates.map((candidate) => candidate.memberId), this.buildDelegationContext(instance, nodeId));
+        const resolved = resolvedCandidates.map((candidate, index) => ({
             candidate,
-            resolution: await this.delegationService.resolveAssignee(candidate.memberId, context),
-        })));
+            resolution: resolutions[index],
+        }));
         // One batch of grade lookups for the whole node, not two per delegate.
         const levels = gradeGated
             ? await this.readMemberPositionLevels(manager, resolved.flatMap(({ candidate, resolution }) => readGradeGateMemberIds(candidate.memberId, resolution)), this.readOrganizationToday())
@@ -3903,31 +3922,175 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
             : null;
     }
     async resolveApproverResolver(manager, instance, resolver, label, subject = '簽核人', skippedChainMemberIds = []) {
+        const memberIds = await this.resolveApproverMemberIds(manager, instance, resolver, label, subject, skippedChainMemberIds);
+        return memberIds.map((memberId) => ({
+            memberId,
+            sourceType: resolver.type,
+        }));
+    }
+    /** The member ids `resolver` routes to; every source type, one branch each. */
+    async resolveApproverMemberIds(manager, instance, resolver, label, subject, skippedChainMemberIds) {
         if (resolver.type === 'DIRECT') {
-            return readMemberIdsFromValue(resolver.memberIds, label, subject).map((memberId) => ({ memberId, sourceType: resolver.type }));
+            return readMemberIdsFromValue(resolver.memberIds, label, subject);
         }
         if (resolver.type === 'DYNAMIC_FORM') {
-            return readMemberIdsFromValue(readValueAtPath(instance.formData, resolver.formPath), label, subject, `依表單欄位「${resolver.formPath}」`).map((memberId) => ({ memberId, sourceType: resolver.type }));
+            return readMemberIdsFromValue(readValueAtPath(instance.formData, resolver.formPath), label, subject, `依表單欄位「${resolver.formPath}」`);
         }
         if (resolver.type === 'EXPRESSION') {
-            return readMemberIdsFromValue(this.conditionService.evaluateValue(resolver.expression, buildWorkflowExpressionContext(instance), `${label}.expression`), label, subject, '依運算式').map((memberId) => ({ memberId, sourceType: resolver.type }));
+            return readMemberIdsFromValue(this.conditionService.evaluateValue(resolver.expression, buildWorkflowExpressionContext(instance), `${label}.expression`), label, subject, '依運算式');
         }
         if (resolver.type === 'POSITION') {
-            return this.resolvePositionCandidates(manager, resolver.positionId, label, subject).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
+            return this.resolvePositionCandidates(manager, resolver.positionId, label, subject);
         }
         if (resolver.type === 'ORG_UNIT_MEMBER') {
-            return this.resolveOrgUnitMemberCandidates(manager, resolver.orgUnitId, Boolean(resolver.includeDescendants), label, subject).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
+            return this.resolveOrgUnitMemberCandidates(manager, resolver.orgUnitId, Boolean(resolver.includeDescendants), label, subject);
         }
         if (resolver.type === 'ORG_UNIT_POSITION') {
-            return this.resolveOrgUnitPositionCandidates(manager, resolver.orgUnitId, resolver.positionId, Boolean(resolver.includeDescendants), label, subject).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
+            return this.resolveOrgUnitPositionCandidates(manager, resolver.orgUnitId, resolver.positionId, Boolean(resolver.includeDescendants), label, subject);
         }
         if (resolver.type === 'ORG_UNIT_MANAGER') {
-            return this.resolveOrgUnitManagerCandidates(manager, instance, resolver.orgUnitId, resolver.fallback, label, resolver.preferClosestOrgUnit === true, subject).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
+            return this.resolveOrgUnitManagerCandidates(manager, instance, resolver.orgUnitId, resolver.fallback, label, resolver.preferClosestOrgUnit === true, subject);
         }
         if (resolver.type === 'ORG_MANAGER_CHAIN') {
-            return this.resolveOrgManagerChainCandidates(manager, instance, resolver.minPositionLevel, resolver.fallback, label, subject, skippedChainMemberIds).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
+            return this.resolveOrgManagerChainCandidates(manager, instance, resolver.minPositionLevel, resolver.fallback, label, subject, skippedChainMemberIds);
+        }
+        if (resolver.type === 'ORG_MANAGER') {
+            return this.resolveInitiatorManagerCandidates(manager, instance, resolver.levelsUp, resolver.fallback, label, resolver.preferClosestOrgUnit === true, subject);
+        }
+        if (resolver.type === 'FORM_MEMBER_MANAGER') {
+            return this.resolveFormMemberManagerCandidates(manager, instance, resolver, label, subject);
+        }
+        if (resolver.type === 'FORM_ORG_UNIT_MANAGER') {
+            return this.resolveFormOrgUnitManagerCandidates(manager, instance, resolver, label, subject);
+        }
+        if (resolver.type === 'NODE_ACTOR') {
+            return this.resolveNodeActorCandidates(manager, instance, resolver, label, subject);
+        }
+        if (resolver.type === 'NODE_ACTOR_MANAGER') {
+            return this.resolveNodeActorManagerCandidates(manager, instance, resolver, label, subject);
+        }
+        // A template saved by a newer engine can carry an approver source this
+        // engine does not know. Refuse it by name instead of quietly resolving it
+        // as the initiator's manager, which would route the task to the wrong
+        // person. That holds as well for a source a newer shared package knows
+        // and this engine does not route yet, so the type is named either way.
+        const unresolvedType = resolver.type;
+        throw new common_1.ConflictException(`${label} 無法建立${subject === '通知對象' ? '通知' : '待簽任務'}：此引擎版本不支援簽核人來源「${unresolvedType}」。請升級 BPMCore 後再發佈或執行此流程。`);
+    }
+    /**
+     * FORM_MEMBER_MANAGER: the manager of the one person picked on the form.
+     * The picked person is the starting point and is kept out of every level's
+     * result, so a unit head who is picked is handed to the tier above instead
+     * of coming back as his own manager.
+     */
+    async resolveFormMemberManagerCandidates(manager, instance, resolver, label, subject) {
+        const source = `依表單欄位「${resolver.formPath}」`;
+        const pickedMemberIds = readMemberIdsFromValue(readValueAtPath(instance.formData, resolver.formPath), label, subject, source);
+        // Picking one silently would route the document by accident.
+        if (pickedMemberIds.length > 1) {
+            throw new common_1.ConflictException(`${label} ${source}只能選一位人員`);
+        }
+        const levelsUp = readManagerLevelsUp(resolver.levelsUp);
+        const managerMemberIds = await this.resolveManagerMemberIdsExcludingSubject(manager, pickedMemberIds[0], levelsUp, resolver.preferClosestOrgUnit === true);
+        if (managerMemberIds.length > 0) {
+            return managerMemberIds;
+        }
+        return this.resolveFallbackAssignees(manager, instance, resolver.fallback, label, subject, `找不到表單欄位「${resolver.formPath}」所選人員的第 ${levelsUp} 層主管`);
+    }
+    /**
+     * FORM_ORG_UNIT_MANAGER: the manager of the organisation unit picked on the
+     * form, through the same rules as a fixed ORG_UNIT_MANAGER. A deleted unit
+     * resolves to nobody and takes the "no manager" path.
+     */
+    async resolveFormOrgUnitManagerCandidates(manager, instance, resolver, label, subject) {
+        const orgUnitValue = readValueAtPath(instance.formData, resolver.formPath);
+        // A value that is not a uuid would reach the uuid column of the org unit
+        // lookup and surface as a database error instead of this refusal.
+        if (typeof orgUnitValue !== 'string' ||
+            !(0, form_org_unit_value_validator_1.isSubmittableOrgUnitValue)(orgUnitValue)) {
+            throw new common_1.ConflictException(`${label} 依表單欄位「${resolver.formPath}」找不到所選組織`);
         }
-        return this.resolveInitiatorManagerCandidates(manager, instance, resolver.levelsUp, resolver.fallback, label, resolver.preferClosestOrgUnit === true, subject).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
+        return this.resolveOrgUnitManagerCandidates(manager, instance, orgUnitValue.trim(), resolver.fallback, label, resolver.preferClosestOrgUnit === true, subject);
+    }
+    /**
+     * NODE_ACTOR: the people who actually approved the listed earlier nodes.
+     * A node nobody approved (never ran, cancelled, or approved only by the SLA
+     * timeout) is an error rather than an empty list: handing the task to
+     * nobody would stall the instance without saying why.
+     */
+    async resolveNodeActorCandidates(manager, instance, resolver, label, subject) {
+        const actorMemberIds = await this.readNodeActorMemberIds(manager, instance, resolver.nodeIds);
+        if (actorMemberIds.length === 0) {
+            throw new common_1.ConflictException(`${label} 找不到${subject}：${readNodeActorNodeNames(instance, resolver.nodeIds)}沒有實際同意的簽核紀錄`);
+        }
+        return actorMemberIds;
+    }
+    /**
+     * NODE_ACTOR_MANAGER: the managers `levelsUp` tiers above each person who
+     * actually approved the listed nodes, as one set. An approver without a
+     * manager is skipped; the fallback runs only when nobody is left.
+     */
+    async resolveNodeActorManagerCandidates(manager, instance, resolver, label, subject) {
+        const levelsUp = readManagerLevelsUp(resolver.levelsUp);
+        const actorMemberIds = await this.readNodeActorMemberIds(manager, instance, resolver.nodeIds);
+        const managerGroups = await Promise.all(actorMemberIds.map((actorMemberId) => this.resolveManagerMemberIdsExcludingSubject(manager, actorMemberId, levelsUp, resolver.preferClosestOrgUnit === true)));
+        const managerMemberIds = uniqueTexts(managerGroups.flat());
+        if (managerMemberIds.length > 0) {
+            return managerMemberIds;
+        }
+        return this.resolveFallbackAssignees(manager, instance, resolver.fallback, label, subject, actorMemberIds.length === 0
+            ? `${readNodeActorNodeNames(instance, resolver.nodeIds)}沒有實際同意的簽核紀錄`
+            : `找不到前面關卡實際簽核人的第 ${levelsUp} 層主管`);
+    }
+    /**
+     * The people who approved the most recent batch of tasks among `nodeIds`,
+     * earliest decision first, each once. Read through `manager` so an approval
+     * written earlier in the same transaction (the one that is advancing the
+     * instance right now) is visible.
+     *
+     * A batch is the non-ad-hoc tasks of one node on one token: a token never
+     * passes a node twice (a return opens a new token, a transfer's replacement
+     * task keeps the token), so a later round is a later batch. Tasks created in
+     * the same transaction share a `created_at`, so every (node, token) tied for
+     * newest counts as one batch. An older batch is never used in place of a
+     * newest one nobody approved. Ad-hoc approvals, approvals on cancelled
+     * tasks and approvals the SLA timeout made do not count.
+     */
+    async readNodeActorMemberIds(manager, instance, nodeIds) {
+        const tasks = await manager.getRepository(task_entity_1.TaskEntity).find({
+            where: { instanceId: instance.id, isAdhoc: false, nodeId: (0, typeorm_2.In)([...nodeIds]) },
+        });
+        if (tasks.length === 0) {
+            return [];
+        }
+        const newestCreatedAt = Math.max(...tasks.map((task) => task.createdAt.getTime()));
+        const newestTasks = tasks.filter((task) => task.createdAt.getTime() === newestCreatedAt);
+        const batchTaskIds = tasks
+            .filter((task) => task.status !== workflow_engine_enums_1.TaskStatusEnum.CANCELLED &&
+            newestTasks.some((newest) => newest.nodeId === task.nodeId && newest.tokenId === task.tokenId))
+            .map((task) => task.id);
+        if (batchTaskIds.length === 0) {
+            return [];
+        }
+        const [decisions, decidedLogs] = await Promise.all([
+            manager.getRepository(task_decision_entity_1.TaskDecisionEntity).find({
+                where: { action: workflow_engine_enums_1.TaskDecisionActionEnum.APPROVED, taskId: (0, typeorm_2.In)(batchTaskIds) },
+            }),
+            manager.getRepository(activity_log_entity_1.ActivityLogEntity).find({
+                where: {
+                    eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TASK_DECIDED,
+                    instanceId: instance.id,
+                    taskId: (0, typeorm_2.In)(batchTaskIds),
+                },
+            }),
+        ]);
+        const automaticDecisionIds = new Set(decidedLogs
+            .filter((log) => log.payload['automatic'] === SLA_AUTO_APPROVE_MARK)
+            .map((log) => log.payload['decisionId']));
+        return uniqueTexts([...decisions]
+            .filter((decision) => !automaticDecisionIds.has(decision.id))
+            .sort((first, second) => first.decidedAt.getTime() - second.decidedAt.getTime())
+            .map((decision) => decision.decidedByMemberId));
     }
     async resolvePositionCandidates(manager, positionId, label, subject) {
         const memberIds = await this.readActivePositionMemberIds(manager, positionId);
@@ -4112,6 +4275,29 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
         const nextLevelGroups = await Promise.all(directManagerMemberIds.map((managerMemberId) => this.resolveManagerMemberIdsAtLevel(manager, managerMemberId, date, remainingLevels - 1, preferClosestOrgUnit)));
         return uniqueTexts(nextLevelGroups.flat());
     }
+    /**
+     * The managers `levelsUp` tiers above `startMemberId`. Every tier is looked
+     * up with the person it starts from excluded (as the manager chain does), so
+     * a unit head falls through to the tier above, and anyone already walked
+     * past — the starting person included — counts as nobody, so a pair of
+     * mutual managers cannot loop back. Nobody at any tier returns `[]`; the
+     * caller applies its own fallback.
+     */
+    async resolveManagerMemberIdsExcludingSubject(manager, startMemberId, levelsUp, preferClosestOrgUnit) {
+        const date = this.readOrganizationToday();
+        let walkedMemberIds = [startMemberId];
+        let currentMemberIds = [startMemberId];
+        for (let level = 0; level < levelsUp; level += 1) {
+            const managerGroups = await Promise.all(currentMemberIds.map((memberId) => this.resolveDirectManagerMemberIds(manager, memberId, date, preferClosestOrgUnit, [memberId])));
+            const nextMemberIds = uniqueTexts(managerGroups.flat()).filter((memberId) => !walkedMemberIds.includes(memberId));
+            if (nextMemberIds.length === 0) {
+                return [];
+            }
+            walkedMemberIds = [...walkedMemberIds, ...nextMemberIds];
+            currentMemberIds = nextMemberIds;
+        }
+        return currentMemberIds;
+    }
     async resolveDirectManagerMemberIds(manager, memberId, date, preferClosestOrgUnit, excludedManagerMemberIds = []) {
         const memberships = await manager.getRepository(membership_entity_1.MembershipEntity).find({
             where: { memberId },
@@ -4301,6 +4487,7 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
         }
         if (action.type === 'SET_FORM_FIELD') {
             const value = this.conditionService.evaluateValue(action.value, buildWorkflowExpressionContext(instance), `workflow.nodes.${node.id}.data.action.value`);
+            assertServiceTaskTextValue(instance.formDefinitionSnapshot, action.fieldPath, value, node.data.label);
             const updatedFormData = writeValueAtPath(instance.formData, action.fieldPath, value);
             // A service task runs inside this transaction, so it cannot call a host
             // provider to re-resolve the label. Rather than leave the previous
@@ -4334,6 +4521,14 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
             await this.advanceTokenToOutgoingNodes(manager, updatedInstance, token, node);
             return;
         }
+        // The sources that read the form or an earlier node's outcome are not
+        // offered to a notify node (the publish lint refuses them); a definition
+        // that reaches here with one anyway is refused by name. A type this
+        // engine does not know is left to the resolver's own refusal below.
+        if ((0, workflow_1.readUnsupportedApproverResolverType)(action.recipients) === null &&
+            !(0, workflow_1.isNotifyRecipientResolverType)(action.recipients.type)) {
+            throw new common_1.ConflictException(`知會節點「${node.data.label}」不能使用簽核人來源「${action.recipients.type}」當收件人，請改用指定人員、職位、組織或主管`);
+        }
         // A webhook-only NOTIFY node names nobody. Resolving its empty DIRECT
         // resolver would throw and roll back the submit or decision that reached
         // it, so skip member resolution; webhooks are delivered separately.
@@ -4752,6 +4947,34 @@ function readDataSourceFieldKeyAtPath(snapshot, fieldPath) {
     const field = schema.fields.find((candidate) => isRecord(candidate) && candidate.fieldKey === fieldKey);
     return field && (0, form_1.isFormDataSourceFieldDefinition)(field) ? field.fieldKey : null;
 }
+/**
+ * Holds a `SET_FORM_FIELD` write to the length and format rules the form
+ * applies to a filler, so a service task cannot store text the field would
+ * have refused. Breaking them throws, which rolls back the submit or decision
+ * that reached the node: the value is never half-written, and the node's value
+ * has to be corrected. Only a top-level field can carry those rules — the
+ * writer ignores an indexed path, and a nested record path names no field —
+ * and an unreadable snapshot is left alone, as in
+ * `readDataSourceFieldKeyAtPath`.
+ */
+function assertServiceTaskTextValue(snapshot, fieldPath, value, nodeLabel) {
+    const schema = snapshot?.schema;
+    const segments = normalizeFormFieldPath(fieldPath);
+    if (!isFormDefinitionSchema(schema) || segments.length !== 1) {
+        return;
+    }
+    const field = schema.fields.find((candidate) => candidate.fieldKey === segments[0]);
+    const errors = field
+        ? readSubmittedTextValueErrors(field, value, {
+            testPattern: (0, text_field_pattern_test_1.createTimedTextFieldPatternTest)(),
+        })
+        : [];
+    if (!field || errors.length === 0) {
+        return;
+    }
+    throw new common_1.BadRequestException(`系統節點「${nodeLabel}」要寫入欄位「${field.label || field.fieldKey}」的值不符合該欄位的規則` +
+        `（${errors.join('; ')}），這次操作沒有生效；請聯絡流程管理者修正此節點的寫入值`);
+}
 function readSnapshotWithoutField(snapshots, fieldKey) {
     return Object.fromEntries(Object.entries(snapshots ?? {}).filter(([key]) => key !== fieldKey));
 }
@@ -4951,6 +5174,17 @@ function readWorkflowNodeLabel(workflow, nodeId) {
         ?.data.label;
     return typeof label === 'string' && label.trim() ? label : null;
 }
+/** A stored `levelsUp` as a whole number of tiers, at least one. */
+function readManagerLevelsUp(levelsUp) {
+    return Number.isFinite(levelsUp) ? Math.max(Math.trunc(levelsUp), 1) : 1;
+}
+const SLA_AUTO_APPROVE_MARK = 'SLA_AUTO_APPROVE';
+/** 關卡「名稱」(、關卡「名稱」…) for an error line; a missing node shows its id. */
+function readNodeActorNodeNames(instance, nodeIds) {
+    return nodeIds
+        .map((nodeId) => `關卡「${readWorkflowNodeLabel(instance.workflowSnapshot, nodeId) ?? nodeId}」`)
+        .join('、');
+}
 function readWorkflowNodeOrThrow(workflow, nodeId) {
     const node = workflow.nodes.find((candidate) => candidate.id === nodeId);
     if (!node) {
@@ -4998,6 +5232,12 @@ function readReturnTargetNodeId(workflow, currentNodeId, requestedNodeId) {
             throw new common_1.BadRequestException('returnToNodeId is required');
         }
         readWorkflowNodeOrThrow(workflow, trimmedRequestedNodeId);
+        // Only the applicant or a stage the case can already have passed: every
+        // other node would skip ahead, re-run a gateway, or — the end event —
+        // approve the case outright.
+        if (!(0, workflow_graph_1.readSelectableReturnTargetNodeIds)(workflow, currentNodeId).includes(trimmedRequestedNodeId)) {
+            throw new common_1.ConflictException(`User task ${currentNodeId} can only return to the applicant or an earlier user task, not ${trimmedRequestedNodeId}`);
+        }
         return trimmedRequestedNodeId;
     }
     if (trimmedRequestedNodeId &&
@@ -5645,11 +5885,13 @@ function readCandidateStatusForClosedTask(taskStatus) {
 /**
  * `deferredFieldKeys` are fields an approver fills in later: they are checked
  * for shape (a table is an array of well-formed rows, a member value is a
- * member id) but never for being present, so an empty one cannot block a
- * submission that has nobody to fill it yet.
+ * member id, an org unit value is an organization unit id) but never for
+ * being present, so an empty one cannot block a submission that has nobody to
+ * fill it yet.
  */
 function validateSubmittedFormData(schema, formData, options = {}) {
     const deferredFieldKeys = options.deferredFieldKeys ?? new Set();
+    const testPattern = (0, text_field_pattern_test_1.createTimedTextFieldPatternTest)();
     const visibleFields = schema.fields.filter((field) => isSubmittedFormFieldVisible(field, schema.fields, formData));
     // Tables answer "is this filled?" by row count and report per-row problems
     // with an instance path, so they get their own pass instead of the flat
@@ -5660,35 +5902,60 @@ function validateSubmittedFormData(schema, formData, options = {}) {
         !isSubmittedFieldValuePresent(formData[field.fieldKey]));
     throwFirstFormDataFieldError({
         missingFields,
+        // A field an approver fills in later is held to its rules when they fill
+        // it, not here: the applicant cannot see or change it, so only its type is
+        // checked, the same as a table nobody fills in.
+        readTextErrors: () => [
+            ...visibleFields.flatMap((field) => readSubmittedTextValueErrors(field, formData[field.fieldKey], {
+                shapeOnly: deferredFieldKeys.has(field.fieldKey),
+                testPattern,
+            })),
+            // A field nobody can fill in right now — hidden (store-only), or one
+            // whose `visibleWhen` is false — keeps its submitted value, so its value
+            // is checked for its type. Only the type: its length and format apply
+            // once the field is shown and the filler can correct it.
+            ...schema.fields
+                .filter((field) => !visibleFields.includes(field))
+                .flatMap((field) => readSubmittedTextValueErrors(field, formData[field.fieldKey], {
+                shapeOnly: true,
+                testPattern,
+            })),
+        ],
         // A `DYNAMIC_FORM` resolver reads a member value whether or not its field
         // is visible, so a hidden field still holding a value must be well-formed
         // too. Whether a hidden field is *required* stays a visibility question
         // above.
         readMemberErrors: () => (0, form_member_value_validator_1.readSubmittedMemberValueErrors)(schema.fields.filter((field) => visibleFields.includes(field) ||
             isSubmittedFieldValuePresent(formData[field.fieldKey])), formData),
+        // A `FORM_ORG_UNIT_MANAGER` resolver reads the unit whether or not its
+        // field is visible, so a hidden field still holding a value is checked too.
+        readOrgUnitErrors: () => (0, form_org_unit_value_validator_1.readSubmittedOrgUnitValueErrors)(schema.fields.filter((field) => visibleFields.includes(field) ||
+            isSubmittedFieldValuePresent(formData[field.fieldKey])), formData),
         readTableErrors: () => [
             ...visibleFields
                 .filter(form_1.isTableFieldDefinition)
-                .flatMap((field) => validateSubmittedTableValue(field, formData[field.fieldKey], isSubmittedFormFieldRequired(field, schema.fields, formData), deferredFieldKeys.has(field.fieldKey))),
+                .flatMap((field) => validateSubmittedTableValue(field, formData[field.fieldKey], isSubmittedFormFieldRequired(field, schema.fields, formData), testPattern, deferredFieldKeys.has(field.fieldKey))),
             // A hidden table is not "visible", but its stored value still has to be
             // a well-formed table under the row cap: only the required / minimum
             // checks are skipped, since nobody can fill the table in.
             ...schema.fields
                 .filter(form_1.isTableFieldDefinition)
                 .filter((field) => field.hidden === true)
-                .flatMap((field) => validateSubmittedTableValue(field, formData[field.fieldKey], false, true)),
+                .flatMap((field) => validateSubmittedTableValue(field, formData[field.fieldKey], false, testPattern, true)),
         ],
     });
 }
 /**
  * What an approval at a node has to leave behind: every field the node lets the
  * approver fill in is well-formed (a table is an array of well-formed rows with
- * its required columns and minimum rows, a member value is a member id) and
+ * its required columns and minimum rows, a member value is a member id, an
+ * org unit value is an organization unit id) and
  * every one the node marks `required` is present. The messages are the submit
  * ones: a host tells the two entry points apart by which call it made.
  */
 function validateFilledFormFields(schema, formData, fieldKeys, requiredFieldKeys) {
     const fields = schema.fields.filter((field) => fieldKeys.has(field.fieldKey));
+    const testPattern = (0, text_field_pattern_test_1.createTimedTextFieldPatternTest)();
     // `readRowCellValue` is used below as an own-property reader for top-level
     // form keys: a key like `constructor` must not read off the prototype chain.
     throwFirstFormDataFieldError({
@@ -5696,27 +5963,39 @@ function validateFilledFormFields(schema, formData, fieldKeys, requiredFieldKeys
         missingFields: fields.filter((field) => !(0, form_1.isTableFieldDefinition)(field) &&
             requiredFieldKeys.has(field.fieldKey) &&
             (0, bpm_core_shared_1.isFormDataValueEmpty)(readRowCellValue(formData, field.fieldKey))),
+        readTextErrors: () => fields.flatMap((field) => readSubmittedTextValueErrors(field, readRowCellValue(formData, field.fieldKey), { testPattern })),
         readMemberErrors: () => (0, form_member_value_validator_1.readSubmittedMemberValueErrors)(fields, formData),
+        readOrgUnitErrors: () => (0, form_org_unit_value_validator_1.readSubmittedOrgUnitValueErrors)(fields, formData),
         readTableErrors: () => fields
             .filter(form_1.isTableFieldDefinition)
-            .flatMap((field) => validateSubmittedTableValue(field, readRowCellValue(formData, field.fieldKey), requiredFieldKeys.has(field.fieldKey))),
+            .flatMap((field) => validateSubmittedTableValue(field, readRowCellValue(formData, field.fieldKey), requiredFieldKeys.has(field.fieldKey), testPattern)),
     });
 }
 /**
  * The shared tail of submit and approver-fill validation: a missing required
- * field wins over a malformed member value, which wins over a table problem,
- * and the later checks are only evaluated when the earlier ones pass.
+ * field wins over a text value breaking its length or format rule, which wins
+ * over a malformed member value, which wins over a malformed org unit value,
+ * which wins over a table problem, and the later checks are only evaluated
+ * when the earlier ones pass.
  */
-function throwFirstFormDataFieldError({ missingFields, readMemberErrors, readTableErrors, }) {
+function throwFirstFormDataFieldError({ missingFields, readMemberErrors, readOrgUnitErrors, readTableErrors, readTextErrors, }) {
     if (missingFields.length > 0) {
         throw new common_1.BadRequestException(`Form data is missing required fields: ${missingFields
             .map((field) => field.label || field.fieldKey)
             .join(', ')}`);
     }
+    const textErrors = readTextErrors();
+    if (textErrors.length > 0) {
+        throw new common_1.BadRequestException(textErrors.join('; '));
+    }
     const memberErrors = readMemberErrors();
     if (memberErrors.length > 0) {
         throw new common_1.BadRequestException(memberErrors.join('; '));
     }
+    const orgUnitErrors = readOrgUnitErrors();
+    if (orgUnitErrors.length > 0) {
+        throw new common_1.BadRequestException(orgUnitErrors.join('; '));
+    }
     const tableErrors = readTableErrors();
     if (tableErrors.length > 0) {
         throw new common_1.BadRequestException(tableErrors.join('; '));
@@ -5724,11 +6003,10 @@ function throwFirstFormDataFieldError({ missingFields, readMemberErrors, readTab
 }
 /**
  * Authoritative shape, row-count and per-row required checks for one table
- * value (ADR 16 §3.7). Depth stops here on purpose: like the flat fields, only
- * required / shape / row count are enforced server side; `minimum`, `maxLength`
- * and friends stay a frontend hint.
+ * value (ADR 16 §3.7), plus the length and format rules of text columns, which
+ * the flat text fields share. `minimum` / `maximum` stay a frontend hint.
  */
-function validateSubmittedTableValue(field, value, required, shapeOnly = false) {
+function validateSubmittedTableValue(field, value, required, testPattern, shapeOnly = false) {
     const path = `formData.${field.fieldKey}`;
     if (typeof value === 'undefined' || value === null) {
         return shapeOnly
@@ -5740,31 +6018,32 @@ function validateSubmittedTableValue(field, value, required, shapeOnly = false)
     if (!Array.isArray(value)) {
         return [`${path} must be an array of rows`];
     }
-    const rowErrors = value.flatMap((row, index) => validateSubmittedTableRow(field, row, `${path}[${index}]`, shapeOnly));
-    // A malformed row cannot be counted against min/max meaningfully; report the
-    // shape problem first so the submitter fixes the real cause.
+    // Too many rows is refused before any row is checked: the rows a submitter
+    // sends would otherwise decide how many cells the text patterns run on.
+    const maxRows = readTableMaxRows(field);
+    if (value.length > maxRows) {
+        return [`${path} must include at most ${maxRows} row(s)`];
+    }
+    const rowErrors = value.flatMap((row, index) => validateSubmittedTableRow(field, row, `${path}[${index}]`, testPattern, shapeOnly));
+    // A malformed row cannot be counted against the minimum meaningfully; report
+    // the shape problem first so the submitter fixes the real cause.
     if (rowErrors.length > 0) {
         return rowErrors;
     }
     return validateSubmittedTableRowCount(field, value.length, required, path, shapeOnly);
 }
+/** The minimum only: the maximum is refused before any row is checked. */
 function validateSubmittedTableRowCount(field, rowCount, required, path, shapeOnly = false) {
     const minRows = shapeOnly
         ? 0
         : required
             ? Math.max(readTableMinRows(field), 1)
             : readTableMinRows(field);
-    const maxRows = readTableMaxRows(field);
-    return [
-        ...(rowCount < minRows
-            ? [`${path} must include at least ${minRows} row(s)`]
-            : []),
-        ...(rowCount > maxRows
-            ? [`${path} must include at most ${maxRows} row(s)`]
-            : []),
-    ];
-}
-function validateSubmittedTableRow(field, row, path, shapeOnly = false) {
+    return rowCount < minRows
+        ? [`${path} must include at least ${minRows} row(s)`]
+        : [];
+}
+function validateSubmittedTableRow(field, row, path, testPattern, shapeOnly = false) {
     if (!isRecord(row)) {
         return [`${path} must be an object`];
     }
@@ -5781,7 +6060,61 @@ function validateSubmittedTableRow(field, row, path, shapeOnly = false) {
             .filter((column) => isSubmittedTableColumnRequired(column) &&
             !isSubmittedFieldValuePresent(readRowCellValue(row, column.fieldKey)))
             .map((column) => `${path}.${column.fieldKey} is required`);
-    return [...unknownKeyErrors, ...cellErrors, ...requiredErrors];
+    // A shape-only pass covers a table nobody fills in, so the filler-facing
+    // rules do not apply to it, the same as the required check above; only a
+    // cell of the wrong type is still refused.
+    const textErrors = field.columns.flatMap((column) => readSubmittedTextValueErrors(column, readRowCellValue(row, column.fieldKey), {
+        path: `${path}.${column.fieldKey}`,
+        shapeOnly,
+        testPattern,
+    }));
+    return [...unknownKeyErrors, ...cellErrors, ...requiredErrors, ...textErrors];
+}
+/**
+ * The server half of the text length and format rules: the same
+ * `readTextFieldValueIssue` the renderer runs before it lets the filler send,
+ * so a crafted request cannot store what the form would have refused — a
+ * number or an array sent for a text field with rules included. `shapeOnly`
+ * keeps only that type check, for a value nobody fills in at this step, and
+ * does not run the pattern at all. `testPattern` is the validation pass's
+ * timed pattern test (see `createTimedTextFieldPatternTest`); once its time
+ * budget is spent, a value is reported as not checked rather than as a
+ * format error.
+ */
+function readSubmittedTextValueErrors(field, value, { path = `formData.${field.fieldKey}`, shapeOnly = false, testPattern, }) {
+    if (field.type !== 'text' && field.type !== 'textarea') {
+        return [];
+    }
+    const readIssue = () => {
+        try {
+            return (0, form_1.readTextFieldValueIssue)(field, value, {
+                testPattern: shapeOnly ? () => true : testPattern,
+            });
+        }
+        catch (error) {
+            if (error instanceof text_field_pattern_test_1.TextFieldPatternTimeoutError) {
+                return 'timeout';
+            }
+            throw error;
+        }
+    };
+    const issue = readIssue();
+    if (issue === 'timeout') {
+        return [`${path} could not be checked against the required format in time`];
+    }
+    if (!issue || (shapeOnly && issue.kind !== 'type')) {
+        return [];
+    }
+    if (issue.kind === 'type') {
+        return [`${path} must be text`];
+    }
+    if (issue.kind === 'minLength') {
+        return [`${path} must be at least ${issue.limit} characters`];
+    }
+    if (issue.kind === 'maxLength') {
+        return [`${path} must be at most ${issue.limit} characters`];
+    }
+    return [`${path} does not match the required format`];
 }
 /**
  * Own-property read. `constructor`, `toString` and friends all satisfy the
@@ -6015,6 +6348,18 @@ function readDryRunPlaceholderAssignee(resolver) {
     if (resolver.type === 'ORG_UNIT_MANAGER') {
         return `orgUnitManager:${resolver.orgUnitId}`;
     }
+    if (resolver.type === 'FORM_MEMBER_MANAGER') {
+        return `formMemberManager:${resolver.formPath}:${resolver.levelsUp}`;
+    }
+    if (resolver.type === 'FORM_ORG_UNIT_MANAGER') {
+        return `formOrgUnitManager:${resolver.formPath}`;
+    }
+    if (resolver.type === 'NODE_ACTOR') {
+        return `nodeActor:${resolver.nodeIds.join(',')}`;
+    }
+    if (resolver.type === 'NODE_ACTOR_MANAGER') {
+        return `nodeActorManager:${resolver.nodeIds.join(',')}:${resolver.levelsUp}`;
+    }
     return resolver.type === 'ORG_MANAGER_CHAIN'
         ? `orgManagerChain:${resolver.minPositionLevel}`
         : resolver.type;