@rytass/bpm-core-nestjs-module 0.18.1 → 0.20.0

package/src/lib/workflow-engine/workflow-engine.service.js

@@ -48,9 +48,17 @@ const task_entity_1 = require("./task.entity");
 const workflow_engine_enums_1 = require("./workflow-engine.enums");
 const workflow_condition_evaluator_1 = require("./workflow-condition-evaluator");
 const workflow_dry_run_object_1 = require("./workflow-dry-run.object");
+const time_budget_1 = require("./time-budget");
+const expression_budget_1 = require("../condition/expression-budget");
+const expression_errors_1 = require("../condition/expression-errors");
+const expression_dialect_1 = require("../condition/expression-dialect");
 const workflow_service_task_dispatcher_token_1 = require("./workflow-service-task-dispatcher.token");
 const workflow_token_entity_1 = require("./workflow-token.entity");
 const bpm_root_options_1 = require("../bpm/bpm-root-options");
+const MAX_DRY_RUN_INPUT_LENGTH = 1_048_576;
+const MAX_DRY_RUN_VISITS = 10_000;
+const DRY_RUN_TIME_BUDGET_MS = 2_000;
+const DRY_RUN_TOO_COMPLEX_MESSAGE = '流程或條件的運算量過大，無法完成試跑，請減少連續的閘道分支或簡化條件';
 const MAX_PROCESSING_STEPS = 500;
 exports.MAX_APPROVAL_INSTANCE_BUSINESS_KEY_LENGTH = 200;
 const APPROVAL_INSTANCE_BUSINESS_KEY_INDEX = 'approval_instances_business_key_key';
@@ -58,6 +66,40 @@ const APPROVAL_INSTANCE_BUSINESS_KEY_INDEX = 'approval_instances_business_key_ke
 const ORG_MANAGER_CHAIN_MAX_HOPS = 20;
 const DEFAULT_APPROVAL_HISTORY_TASK_LIMIT = 50;
 const SYSTEM_DRY_RUN_INSTANCE_ID = 'dry-run-instance';
+// The dry run checks each expression against the roots its use point may read,
+// as publish does. Keep these in step with `WORKFLOW_EXPRESSION_ROOT_IDENTIFIERS`
+// in template.service.ts; P2 moves both to one place.
+const DRY_RUN_WORKFLOW_ROOT_IDENTIFIERS = [
+    'env',
+    'form',
+    'formData',
+    'initiator',
+    'instance',
+];
+const DRY_RUN_EDGE_ROOT_IDENTIFIERS = [
+    ...DRY_RUN_WORKFLOW_ROOT_IDENTIFIERS,
+    'lastDecision',
+];
+const hasExpressionText = (expression) => typeof expression === 'string' && expression.trim() !== '';
+/**
+ * Whether a definition's dialect can be read: missing (`cel-legacy`) or one
+ * this version knows. Never throws, unlike `readWorkflowExpressionDialect`.
+ */
+const isReadableExpressionDialect = (definition) => {
+    const dialect = definition?.expressionDialect;
+    return (dialect === undefined || dialect === null || (0, expression_dialect_1.isExpressionDialect)(dialect));
+};
+/**
+ * Options for evaluating an expression that may be blank. The dialect is read
+ * only when there is an expression: an unknown dialect is refused because the
+ * expression cannot be evaluated as its author tested it, and a blank one is
+ * never evaluated at all. Publishing does not check the field yet (Phase 23
+ * P2), so reading it eagerly would turn a stray field on a version with no
+ * expressions into an error, where before dialects existed it was ignored.
+ */
+const readExpressionDialectOptions = (expression, definition) => hasExpressionText(expression)
+    ? { dialect: (0, expression_dialect_1.readWorkflowExpressionDialect)(definition) }
+    : {};
 /**
  * Delegation-chain reason recorded for an approver-initiated transfer, as
  * opposed to {@link SLA_ESCALATION_DELEGATION_REASON}.
@@ -152,6 +194,8 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
         this.formDataSourceValueResolver = formDataSourceValueResolver;
         this.webhookDeliveryService = webhookDeliveryService;
         this.logger = new common_1.Logger(WorkflowEngineService_1.name);
+        /** Webhooks each open engine transaction will send once it has committed. */
+        this.deferredWebhookDispatches = new WeakMap();
         // A binding under the token wins: that is either the host's own provider
         // or `workflowServiceTaskDispatcherProvider`, both of them deliberate. The
         // runtime instance from `BPMRootModule`'s async factory comes next.
@@ -177,6 +221,59 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
     readOrganizationToday() {
         return (0, organization_time_zone_1.formatDateOnlyInTimeZone)(new Date(), this.organizationTimeZone);
     }
+    /**
+     * Opens an engine transaction whose webhooks wait for its commit. A webhook
+     * sent from inside would hold the case lock and a pooled connection for as
+     * long as the far end takes to answer, so a slow endpoint could stall the
+     * case and then, a connection at a time, the whole API. A transaction that
+     * rolls back sends nothing.
+     *
+     * The caller still waits for the sends, so the outcome is in the activity log
+     * by the time a mutation returns, as it always has been.
+     */
+    async runEngineTransaction(work) {
+        // Mutable on purpose: every step of the transaction appends to it, and
+        // threading it through each of them would change a dozen signatures.
+        const dispatches = [];
+        // One transaction is one operation: its evaluations share one budget.
+        const result = await (0, expression_budget_1.runExpressionOperation)(() => this.approvalInstanceRepository.manager.transaction((manager) => {
+            this.deferredWebhookDispatches.set(manager, dispatches);
+            return work(manager);
+        }));
+        await dispatches.reduce(async (previous, dispatch) => {
+            await previous;
+            await this.sendCommittedWebhook(dispatch);
+        }, Promise.resolve());
+        return result;
+    }
+    /**
+     * Queues a webhook for after the commit. A manager this service did not open
+     * has no queue and no commit it can see, so that webhook goes out on the spot
+     * rather than being dropped.
+     */
+    async dispatchWebhookAfterCommit(manager, dispatch) {
+        const queue = this.deferredWebhookDispatches.get(manager);
+        if (queue) {
+            queue.push(dispatch);
+            return;
+        }
+        const activityRepository = manager.getRepository(activity_log_entity_1.ActivityLogEntity);
+        const result = await dispatch.send();
+        await activityRepository.save(activityRepository.create(dispatch.readActivityLog(result)));
+    }
+    /**
+     * The transaction has committed and the mutation has succeeded, so nothing
+     * here may fail it: a result that cannot be recorded is only logged.
+     */
+    async sendCommittedWebhook(dispatch) {
+        try {
+            const result = await dispatch.send();
+            await this.activityLogRepository.save(this.activityLogRepository.create(dispatch.readActivityLog(result)));
+        }
+        catch (error) {
+            this.logger.error(`Could not record a webhook result for instance ${dispatch.instanceId}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
     async submitApprovalInstance(input, authContext) {
         if (input.submittedByMemberId !== undefined &&
             input.submittedByMemberId !== null &&
@@ -219,7 +316,9 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
         const initiatorMetadataSnapshot = input.initiatorMetadataSnapshotJson
             ? parseJsonObject(input.initiatorMetadataSnapshotJson, 'initiatorMetadataSnapshotJson')
             : await this.readDefaultInitiatorMetadataSnapshot(input.initiatorMemberId);
-        if (!this.conditionService.evaluateBoolean(templateVersion.initiatorPolicyCel, buildInitiatorPolicyContext(initiatorMetadataSnapshot), 'initiatorPolicyCel')) {
+        if (!this.conditionService.evaluateBoolean(templateVersion.initiatorPolicyCel, buildInitiatorPolicyContext(initiatorMetadataSnapshot), 'initiatorPolicyCel', 
+        // The policy is written in its version's dialect (ADR 22 §3.3).
+        readExpressionDialectOptions(templateVersion.initiatorPolicyCel, templateVersion.workflowDefinition))) {
             throw new common_1.ConflictException('Current member is not allowed to start this approval template');
         }
         // Named here, before the transaction, so the completion notice that later
@@ -233,7 +332,7 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
         if (!startNode) {
             throw new common_1.BadRequestException('Published workflow does not include a startEvent');
         }
-        return this.approvalInstanceRepository.manager.transaction(async (manager) => {
+        return this.runEngineTransaction(async (manager) => {
             const instanceRepository = manager.getRepository(approval_instance_entity_1.ApprovalInstanceEntity);
             const tokenRepository = manager.getRepository(workflow_token_entity_1.WorkflowTokenEntity);
             const activityRepository = manager.getRepository(activity_log_entity_1.ActivityLogEntity);
@@ -261,6 +360,7 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
             await this.attachmentService.bindFormDataAttachmentsToInstance(manager, {
                 formData,
                 instanceId: instance.id,
+                schema: formDefinitionVersion.schema,
             });
             const token = await tokenRepository.save(tokenRepository.create({
                 consumedAt: null,
@@ -369,7 +469,7 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
         return { formDataOptionSnapshot, instance };
     }
     async processInstance(instanceId) {
-        await this.approvalInstanceRepository.manager.transaction(async (manager) => {
+        await this.runEngineTransaction(async (manager) => {
             await manager.query('SELECT pg_advisory_xact_lock(hashtext($1))', [
                 instanceId,
             ]);
@@ -396,7 +496,7 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
         });
     }
     async decideTask(input, options = {}) {
-        return this.approvalInstanceRepository.manager.transaction(async (manager) => {
+        return this.runEngineTransaction(async (manager) => {
             const taskRepository = manager.getRepository(task_entity_1.TaskEntity);
             const taskCandidateRepository = manager.getRepository(task_candidate_entity_1.TaskCandidateEntity);
             const taskDecisionRepository = manager.getRepository(task_decision_entity_1.TaskDecisionEntity);
@@ -759,7 +859,7 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
         });
     }
     async cancelApprovalInstance(input) {
-        return this.approvalInstanceRepository.manager.transaction(async (manager) => {
+        return this.runEngineTransaction(async (manager) => {
             await manager.query('SELECT pg_advisory_xact_lock(hashtext($1))', [
                 input.instanceId,
             ]);
@@ -800,7 +900,7 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
      * returned unchanged.
      */
     async expireApprovalInstance(input) {
-        return this.approvalInstanceRepository.manager.transaction(async (manager) => {
+        return this.runEngineTransaction(async (manager) => {
             await manager.query('SELECT pg_advisory_xact_lock(hashtext($1))', [
                 input.instanceId,
             ]);
@@ -857,7 +957,7 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
         const preparation = this.formDataSourceValueResolver
             ? await this.prepareResubmitFormDataOptions(input, submittedFormData, authContext ?? createWorkflowAuthContext(input.initiatorMemberId))
             : null;
-        return this.approvalInstanceRepository.manager.transaction(async (manager) => {
+        return this.runEngineTransaction(async (manager) => {
             await manager.query('SELECT pg_advisory_xact_lock(hashtext($1))', [
                 input.instanceId,
             ]);
@@ -911,6 +1011,14 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
             await this.attachmentService.bindFormDataAttachmentsToInstance(manager, {
                 formData,
                 instanceId: instance.id,
+                schema: resubmitSchema,
+            });
+            // A file the applicant removed from a field leaves the instance too,
+            // so its attachment list matches the form it was resubmitted with.
+            await this.attachmentService.releaseUnreferencedFormAttachments(manager, {
+                formData,
+                instanceId: instance.id,
+                schema: resubmitSchema,
             });
             const returnedContext = await this.readLatestReturnedInstanceContext(manager, instance.id);
             const runtimeInstance = returnedContext?.resubmitStrategy === 'FROM_RETURN_POINT'
@@ -938,7 +1046,7 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
         });
     }
     async requestAdhocCountersign({ comment, requestedByMemberId, target, taskId, }) {
-        return this.approvalInstanceRepository.manager.transaction(async (manager) => {
+        return this.runEngineTransaction(async (manager) => {
             const { instance, node, task } = await this.loadAdhocOperationContext(manager, taskId, requestedByMemberId, { requireAllowAddSigner: true });
             const targetValue = buildAdhocTargetValue(target);
             // Rejects WEBHOOK targets — countersigners must be members.
@@ -970,7 +1078,7 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
         });
     }
     async requestAdhocPreApproval({ comment, onReject, requestedByMemberId, target, taskId, }) {
-        return this.approvalInstanceRepository.manager.transaction(async (manager) => {
+        return this.runEngineTransaction(async (manager) => {
             const { instance, node, task } = await this.loadAdhocOperationContext(manager, taskId, requestedByMemberId, { requireAllowAddSigner: true });
             const targetValue = buildAdhocTargetValue(target);
             // Rejects WEBHOOK targets — pre-approvers must be members.
@@ -997,7 +1105,7 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
         });
     }
     async configureAdhocNotification({ channels, requestedByMemberId, target, taskId, type, }) {
-        return this.approvalInstanceRepository.manager.transaction(async (manager) => {
+        return this.runEngineTransaction(async (manager) => {
             const { instance, node, task } = await this.loadAdhocOperationContext(manager, taskId, requestedByMemberId, { requireAllowAddSigner: false });
             const targetValue = buildAdhocTargetValue(target);
             const directiveRepository = manager.getRepository(adhoc_directive_entity_1.AdhocDirectiveEntity);
@@ -1020,7 +1128,7 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
         });
     }
     async cancelAdhocDirective({ cancelledByMemberId, directiveId, }) {
-        return this.approvalInstanceRepository.manager.transaction(async (manager) => {
+        return this.runEngineTransaction(async (manager) => {
             const directiveRepository = manager.getRepository(adhoc_directive_entity_1.AdhocDirectiveEntity);
             const directive = await directiveRepository.findOne({
                 where: { id: directiveId },
@@ -1584,30 +1692,34 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
         const targetValue = readAdhocTargetValue(directive);
         const activityRepository = manager.getRepository(activity_log_entity_1.ActivityLogEntity);
         if (targetValue.kind === adhoc_enums_1.AdhocTargetKindEnum.WEBHOOK) {
-            const result = await executeAdhocWebhookDispatch(this.serviceTaskDispatcher, targetValue, {
+            const webhookPayload = {
                 ...payload,
                 instanceId: instance.id,
                 instanceTitle: instance.title,
                 message,
                 triggeredAt: new Date().toISOString(),
-            });
-            await activityRepository.save(activityRepository.create({
-                actorMemberId: null,
-                eventType: result.ok
-                    ? workflow_engine_enums_1.ActivityLogEventTypeEnum.SERVICE_TASK_EXECUTED
-                    : workflow_engine_enums_1.ActivityLogEventTypeEnum.SERVICE_TASK_FAILED,
+            };
+            await this.dispatchWebhookAfterCommit(manager, {
                 instanceId: instance.id,
-                nodeId: directive.originNodeId,
-                payload: {
-                    action: 'ADHOC_WEBHOOK',
-                    directiveId: directive.id,
-                    error: result.error,
-                    ok: result.ok,
-                    status: result.status,
-                    url: targetValue.webhookUrl,
-                },
-                taskId: null,
-            }));
+                readActivityLog: (result) => ({
+                    actorMemberId: null,
+                    eventType: result.ok
+                        ? workflow_engine_enums_1.ActivityLogEventTypeEnum.SERVICE_TASK_EXECUTED
+                        : workflow_engine_enums_1.ActivityLogEventTypeEnum.SERVICE_TASK_FAILED,
+                    instanceId: instance.id,
+                    nodeId: directive.originNodeId,
+                    payload: {
+                        action: 'ADHOC_WEBHOOK',
+                        directiveId: directive.id,
+                        error: result.error,
+                        ok: result.ok,
+                        status: result.status,
+                        url: targetValue.webhookUrl,
+                    },
+                    taskId: null,
+                }),
+                send: () => executeAdhocWebhookDispatch(this.serviceTaskDispatcher, targetValue, webhookPayload),
+            });
             return;
         }
         try {
@@ -1658,29 +1770,38 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
         })));
     }
     dryRunApprovalWorkflow(input) {
+        // Checked first: parsing happens outside the time budget below.
+        if ([
+            input.workflowDefinitionJson,
+            input.formDataJson,
+            input.initiatorMetadataSnapshotJson ?? '',
+        ].some((json) => json.length > MAX_DRY_RUN_INPUT_LENGTH)) {
+            return createFailedDryRunResult('試跑資料過大，請縮小流程或測試資料後再試');
+        }
         const workflowDefinition = parseWorkflowDefinition(input.workflowDefinitionJson);
         const formData = parseJsonObject(input.formDataJson, 'formDataJson');
         const initiatorMetadataSnapshot = input.initiatorMetadataSnapshotJson
             ? parseJsonObject(input.initiatorMetadataSnapshotJson, 'initiatorMetadataSnapshotJson')
             : readDefaultInitiatorMetadataSnapshot(input.initiatorMemberId);
         try {
+            // The CEL engine loads outside the budget so an interrupt can never land
+            // halfway through loading a module.
+            this.conditionService.prepareEngine((0, expression_dialect_1.readWorkflowExpressionDialect)(workflowDefinition));
+            // The outer budget bounds the whole walk, and the operation budget
+            // bounds the expressions inside it. Both are charged to this dry run only.
             return Object.assign(new workflow_dry_run_object_1.WorkflowDryRunResultObject(), {
                 errors: [],
-                steps: this.simulateWorkflow({
+                steps: (0, expression_budget_1.runExpressionOperation)(() => (0, time_budget_1.runWithinTimeBudget)(() => this.simulateWorkflow({
                     formData,
                     initiatorMemberId: input.initiatorMemberId,
                     initiatorMetadataSnapshot,
                     workflowDefinition,
-                }),
+                }), DRY_RUN_TIME_BUDGET_MS)),
                 valid: true,
             });
         }
         catch (error) {
-            return Object.assign(new workflow_dry_run_object_1.WorkflowDryRunResultObject(), {
-                errors: [error instanceof Error ? error.message : 'Dry run failed'],
-                steps: [],
-                valid: false,
-            });
+            return createFailedDryRunResult(readDryRunFailureMessage(error));
         }
     }
     simulateWorkflow(input) {
@@ -1688,8 +1809,18 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
         if (!startNode) {
             throw new common_1.BadRequestException('Workflow does not include a startEvent');
         }
+        // Every branch re-walks whatever follows it, so a chain of gateways doubles
+        // the work at each one while the depth limit never trips. Closure state
+        // because all the branches of one dry run share this one count.
+        let visits = 0;
         return this.simulateWorkflowPath({
             ...input,
+            chargeVisit: () => {
+                visits += 1;
+                if (visits > MAX_DRY_RUN_VISITS) {
+                    throw new common_1.ConflictException(DRY_RUN_TOO_COMPLEX_MESSAGE);
+                }
+            },
             depth: 0,
             incomingEdge: null,
             lastDecision: null,
@@ -1702,6 +1833,7 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
         if (input.depth > MAX_PROCESSING_STEPS) {
             throw new common_1.ConflictException('Dry run exceeded maximum processing steps');
         }
+        input.chargeVisit();
         const node = readWorkflowNodeOrThrow(input.workflowDefinition, input.nodeId);
         const visitKey = `${input.nodeId}:${input.incomingEdge?.id ?? 'start'}`;
         const entryCondition = readNodeEntryCondition(node);
@@ -1723,7 +1855,10 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
             ];
         }
         const nextVisitedNodeIds = new Set([...input.visitedNodeIds, visitKey]);
-        const entryConditionMet = this.conditionService.evaluateBoolean(entryCondition, buildDryRunExpressionContext(input, input.lastDecision), `workflow.nodes.${node.id}.data.entryCondition`);
+        const entryConditionMet = this.conditionService.evaluateBoolean(entryCondition, buildDryRunExpressionContext(input, input.lastDecision), `workflow.nodes.${node.id}.data.entryCondition`, {
+            allowedRootIdentifiers: DRY_RUN_WORKFLOW_ROOT_IDENTIFIERS,
+            dialect: (0, expression_dialect_1.readWorkflowExpressionDialect)(input.workflowDefinition),
+        });
         const assignment = entryConditionMet && node.type === 'userTask'
             ? this.resolveDryRunAssignment(input, node)
             : null;
@@ -1817,7 +1952,10 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
     evaluateDryRunEdge(input, edge, lastDecision) {
         const expression = edge.data.condition?.trim();
         if (expression && !isListValuedStructuredCondition(edge, input.formData)) {
-            return this.conditionService.evaluateBoolean(expression, buildDryRunExpressionContext(input, lastDecision), `workflow.edges.${edge.id}.data.condition`);
+            return this.conditionService.evaluateBoolean(expression, buildDryRunExpressionContext(input, lastDecision), `workflow.edges.${edge.id}.data.condition`, {
+                allowedRootIdentifiers: DRY_RUN_EDGE_ROOT_IDENTIFIERS,
+                dialect: (0, expression_dialect_1.readWorkflowExpressionDialect)(input.workflowDefinition),
+            });
         }
         return (0, workflow_condition_evaluator_1.evaluateWorkflowEdgeCondition)(edge, { formData: input.formData });
     }
@@ -1917,7 +2055,10 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
             return findMemberIdsInValue(readValueAtPath(input.formData, resolver.formPath));
         }
         if (resolver.type === 'EXPRESSION') {
-            return findMemberIdsInValue(this.conditionService.evaluateValue(resolver.expression, buildDryRunExpressionContext(input, null), `${label}.expression`));
+            return findMemberIdsInValue(this.conditionService.evaluateValue(resolver.expression, buildDryRunExpressionContext(input, null), `${label}.expression`, {
+                allowedRootIdentifiers: DRY_RUN_WORKFLOW_ROOT_IDENTIFIERS,
+                dialect: (0, expression_dialect_1.readWorkflowExpressionDialect)(input.workflowDefinition),
+            }));
         }
         if (resolver.type === 'ORG_MANAGER') {
             const managerMemberIds = findMemberIdsInValue(readManagerMemberIdFromInitiatorSnapshot(input.initiatorMetadataSnapshot, resolver.levelsUp));
@@ -2129,7 +2270,18 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
             if (!currentVersion?.formDefinitionVersionId) {
                 return false;
             }
-            return this.conditionService.evaluateBoolean(currentVersion.initiatorPolicyCel, buildInitiatorPolicyContext(initiatorMetadataSnapshot), 'initiatorPolicyCel');
+            // A policy in a dialect this version does not know cannot be evaluated,
+            // so the template is not launchable (fail closed), but only that one:
+            // publishing does not check the field yet (Phase 23 P2), and one such
+            // version must not break the list for every member.
+            if (hasExpressionText(currentVersion.initiatorPolicyCel) &&
+                !isReadableExpressionDialect(currentVersion.workflowDefinition)) {
+                this.logger.warn(`template=${template.id} version=${currentVersion.id} left out of launchable templates: unknown expression dialect`);
+                return false;
+            }
+            // Each template is its own operation, so one slow template cannot use
+            // up the allowance of the rest of the list.
+            return (0, expression_budget_1.runExpressionOperation)(() => this.conditionService.evaluateBoolean(currentVersion.initiatorPolicyCel, buildInitiatorPolicyContext(initiatorMetadataSnapshot), 'initiatorPolicyCel', readExpressionDialectOptions(currentVersion.initiatorPolicyCel, currentVersion.workflowDefinition)));
         });
     }
     async listWorkflowTokens(instanceId, scope) {
@@ -2583,7 +2735,7 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
     }
     isNodeEntryConditionMet(instance, node) {
         const entryCondition = readNodeEntryCondition(node);
-        return this.conditionService.evaluateBoolean(entryCondition, buildWorkflowExpressionContext(instance), `workflow.nodes.${node.id}.data.entryCondition`);
+        return this.conditionService.evaluateBoolean(entryCondition, buildWorkflowExpressionContext(instance), `workflow.nodes.${node.id}.data.entryCondition`, readExpressionDialectOptions(entryCondition, instance.workflowSnapshot));
     }
     async skipNodeByEntryCondition(manager, instance, token, node) {
         await this.skipNode(manager, instance, token, node, {
@@ -2656,7 +2808,7 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
             return this.conditionService.evaluateBoolean(expression, {
                 ...buildWorkflowExpressionContext(instance),
                 lastDecision: await this.readLastDecisionContext(manager, instance.id, node.id),
-            }, `workflow.edges.${edge.id}.data.condition`);
+            }, `workflow.edges.${edge.id}.data.condition`, { dialect: (0, expression_dialect_1.readWorkflowExpressionDialect)(instance.workflowSnapshot) });
         }
         return (0, workflow_condition_evaluator_1.evaluateWorkflowEdgeCondition)(edge, { formData: instance.formData });
     }
@@ -3482,7 +3634,7 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
         });
     }
     async executeTaskReassignment(preRead, options) {
-        return this.approvalInstanceRepository.manager.transaction(async (manager) => {
+        return this.runEngineTransaction(async (manager) => {
             try {
                 const plan = await this.planTaskReassignment(manager, preRead.id, options);
                 if (options.dryRun) {
@@ -3859,7 +4011,7 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
     async delegateResolvedCandidates(manager, instance, nodeId, resolvedCandidates, gradeGated) {
         // One batch for the node, so the host directory is asked once for every
         // candidate's delegation agents rather than once per candidate.
-        const resolutions = await this.delegationService.resolveAssignees(resolvedCandidates.map((candidate) => candidate.memberId), this.buildDelegationContext(instance, nodeId));
+        const resolutions = await this.delegationService.resolveAssignees(resolvedCandidates.map((candidate) => candidate.memberId), { ...this.buildDelegationContext(instance, nodeId), manager });
         const resolved = resolvedCandidates.map((candidate, index) => ({
             candidate,
             resolution: resolutions[index],
@@ -3881,7 +4033,7 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
     }
     /** One member's delegation, grade-gated as {@link applyGradeGate} says. */
     async resolveDelegation(manager, principalMemberId, context, gradeGated) {
-        const resolution = await this.delegationService.resolveAssignee(principalMemberId, context);
+        const resolution = await this.delegationService.resolveAssignee(principalMemberId, { ...context, manager });
         const memberIds = gradeGated
             ? readGradeGateMemberIds(principalMemberId, resolution)
             : [];
@@ -3937,7 +4089,7 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
             return readMemberIdsFromValue(readValueAtPath(instance.formData, resolver.formPath), label, subject, `依表單欄位「${resolver.formPath}」`);
         }
         if (resolver.type === 'EXPRESSION') {
-            return readMemberIdsFromValue(this.conditionService.evaluateValue(resolver.expression, buildWorkflowExpressionContext(instance), `${label}.expression`), label, subject, '依運算式');
+            return readMemberIdsFromValue(this.conditionService.evaluateValue(resolver.expression, buildWorkflowExpressionContext(instance), `${label}.expression`, { dialect: (0, expression_dialect_1.readWorkflowExpressionDialect)(instance.workflowSnapshot) }), label, subject, '依運算式');
         }
         if (resolver.type === 'POSITION') {
             return this.resolvePositionCandidates(manager, resolver.positionId, label, subject);
@@ -4459,34 +4611,39 @@ let WorkflowEngineService = WorkflowEngineService_1 = class WorkflowEngineServic
         const action = node.data.action;
         if (action.type === 'WEBHOOK') {
             const payload = typeof action.payload === 'string' && action.payload.trim()
-                ? this.conditionService.evaluateValue(action.payload, buildWorkflowExpressionContext(instance), `workflow.nodes.${node.id}.data.action.payload`)
+                ? this.conditionService.evaluateValue(action.payload, buildWorkflowExpressionContext(instance), `workflow.nodes.${node.id}.data.action.payload`, {
+                    dialect: (0, expression_dialect_1.readWorkflowExpressionDialect)(instance.workflowSnapshot),
+                })
                 : {
                     instance: buildWorkflowExpressionContext(instance).instance,
                     triggeredAt: new Date().toISOString(),
                 };
-            const result = await executeWebhookServiceAction(this.serviceTaskDispatcher, action, payload);
-            await activityRepository.save(activityRepository.create({
-                actorMemberId: null,
-                eventType: result.ok
-                    ? workflow_engine_enums_1.ActivityLogEventTypeEnum.SERVICE_TASK_EXECUTED
-                    : workflow_engine_enums_1.ActivityLogEventTypeEnum.SERVICE_TASK_FAILED,
+            await this.dispatchWebhookAfterCommit(manager, {
                 instanceId: instance.id,
-                nodeId: node.id,
-                payload: {
-                    action: 'WEBHOOK',
-                    error: result.error,
-                    ok: result.ok,
-                    status: result.status,
-                    tokenId: token.id,
-                    url: action.url,
-                },
-                taskId: null,
-            }));
+                readActivityLog: (result) => ({
+                    actorMemberId: null,
+                    eventType: result.ok
+                        ? workflow_engine_enums_1.ActivityLogEventTypeEnum.SERVICE_TASK_EXECUTED
+                        : workflow_engine_enums_1.ActivityLogEventTypeEnum.SERVICE_TASK_FAILED,
+                    instanceId: instance.id,
+                    nodeId: node.id,
+                    payload: {
+                        action: 'WEBHOOK',
+                        error: result.error,
+                        ok: result.ok,
+                        status: result.status,
+                        tokenId: token.id,
+                        url: action.url,
+                    },
+                    taskId: null,
+                }),
+                send: () => executeWebhookServiceAction(this.serviceTaskDispatcher, action, payload),
+            });
             await this.advanceTokenToOutgoingNodes(manager, instance, token, node);
             return;
         }
         if (action.type === 'SET_FORM_FIELD') {
-            const value = this.conditionService.evaluateValue(action.value, buildWorkflowExpressionContext(instance), `workflow.nodes.${node.id}.data.action.value`);
+            const value = this.conditionService.evaluateValue(action.value, buildWorkflowExpressionContext(instance), `workflow.nodes.${node.id}.data.action.value`, { dialect: (0, expression_dialect_1.readWorkflowExpressionDialect)(instance.workflowSnapshot) });
             assertServiceTaskTextValue(instance.formDefinitionSnapshot, action.fieldPath, value, node.data.label);
             const updatedFormData = writeValueAtPath(instance.formData, action.fieldPath, value);
             // A service task runs inside this transaction, so it cannot call a host
@@ -5608,6 +5765,33 @@ function normalizeFormFieldPath(path) {
     }
     return segments;
 }
+/**
+ * The message a failed dry run shows its caller. Only the fixed budget text, an
+ * HTTP exception's own message, or an expression error's label and code reach
+ * this point. Any other error is replaced with a generic message, since its text
+ * may carry engine or context details.
+ */
+function readDryRunFailureMessage(error) {
+    if (error instanceof time_budget_1.TimeBudgetExceededError) {
+        return DRY_RUN_TOO_COMPLEX_MESSAGE;
+    }
+    if (error instanceof expression_errors_1.ExpressionRuntimeError) {
+        return error.keyName
+            ? `${error.message}（找不到「${error.keyName}」）`
+            : error.message;
+    }
+    if (error instanceof common_1.HttpException) {
+        return error.message;
+    }
+    return 'Dry run failed';
+}
+function createFailedDryRunResult(message) {
+    return Object.assign(new workflow_dry_run_object_1.WorkflowDryRunResultObject(), {
+        errors: [message],
+        steps: [],
+        valid: false,
+    });
+}
 async function executeWebhookServiceAction(serviceTaskDispatcher, action, payload) {
     try {
         return await serviceTaskDispatcher.dispatchWebhook({