@rytass/bpm-core-nestjs-module 0.20.1 → 0.21.1

package/src/lib/template/filterable-field.queries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filterable-field.queries.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/template/filterable-field.queries.ts"],"names":[],"mappings":";;;;AAAA,6CAA4D;AAC5D,6CAAmD;AACnD,6DAAuE;AAEvE,qCAAoD;AACpD,0CAA8C;AAC9C,yEAAoE;AACpE,mFAGyC;AACzC,qEAKkC;AAElC;;;;;;;GAOG;AAGI,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YAEmB,kBAAsD;QAAtD,uBAAkB,GAAlB,kBAAkB,CAAoC;IACtE,CAAC;IAEJ;;;OAGG;IAEG,AAAN,KAAK,CAAC,qBAAqB,CAEzB,UAAqC,EAErC,gBAA2C,EACC,UAAkB;QAE9D,MAAM,MAAM,GAAG,IAAA,0DAAiC,EAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAEhD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CACpC,OAAO,EACP,UAAU,IAAI,IAAI,EAClB,gBAAgB,IAAI,IAAI,EACxB,MAAM,CACP,CAAC;QAEF,OAAO,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AA9BY,wDAAsB;AAW3B;IADL,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,CAAC,0DAA0B,CAAC,CAAC;IAEvC,mBAAA,IAAA,cAAI,EAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,YAAE,EAAE,CAAC,CAAA;IAEtD,mBAAA,IAAA,cAAI,EAAC,kBAAkB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,YAAE,EAAE,CAAC,CAAA;IAE5D,mBAAA,IAAA,cAAI,EAAC,YAAY,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;;;;mEAa5C;iCA7BU,sBAAsB;IAFlC,IAAA,kBAAQ,GAAE;IACV,IAAA,0BAAe,GAAE;IAGb,mBAAA,IAAA,0BAAgB,EAAC,iDAAsB,CAAC,CAAA;6CACJ,oBAAU;GAHtC,sBAAsB,CA8BlC;AAED,KAAK,UAAU,gBAAgB,CAC7B,OAAsB,EACtB,UAAyB,EACzB,gBAA+B,EAC/B,MAA4B;IAE5B,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,IAAA,0DAAiC,EAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,IAAA,gEAAuC,EAC5C,OAAO,EACP,gBAAgB,EAChB,MAAM,CACP,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,4BAA4B,CACnC,MAAkC;IAElC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAEzB,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,0DAA0B,EAAE,EAAE;QACrD,sBAAsB,EACpB,KAAK,CAAC,IAAI,KAAK,cAAc;YAC3B,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC;YAC3D,CAAC,CAAC,EAAE;QACR,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,oBAAoB,EAClB,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;QAClE,IAAI,EAAE,wDAAwB,CAAC,KAAK,CAAC,IAAI,CAAC;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,IAAA,8CAA4B,EAAC,KAAK,CAAC;QAC5C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,iBAAiB,EACf,KAAK,CAAC,IAAI,KAAK,gBAAgB;YAC7B,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAChE,CAAC,CAAC,EAAE;QACR,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC,CAAC;AACL,CAAC"}

package/src/lib/template/index.d.ts

@@ -6,6 +6,7 @@ export * from './dto/approval-template.input';
 export * from './dto/compose-approval-template.input';
 export * from './dto/expression-designer.dto';
 export * from './expression-designer.service';
+export * from './filterable-field-issue.object';
 export * from './template-observer.token';
 export * from './template.enums';
 export * from './template.module';

package/src/lib/template/index.js

@@ -9,6 +9,7 @@ tslib_1.__exportStar(require("./dto/approval-template.input"), exports);
 tslib_1.__exportStar(require("./dto/compose-approval-template.input"), exports);
 tslib_1.__exportStar(require("./dto/expression-designer.dto"), exports);
 tslib_1.__exportStar(require("./expression-designer.service"), exports);
+tslib_1.__exportStar(require("./filterable-field-issue.object"), exports);
 tslib_1.__exportStar(require("./template-observer.token"), exports);
 tslib_1.__exportStar(require("./template.enums"), exports);
 tslib_1.__exportStar(require("./template.module"), exports);

package/src/lib/template/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/template/index.ts"],"names":[],"mappings":";;;AAAA,8EAAoD;AACpD,6EAAmD;AACnD,qEAA2C;AAC3C,6EAAmD;AACnD,wEAA8C;AAC9C,gFAAsD;AACtD,wEAA8C;AAC9C,wEAA8C;AAC9C,oEAA0C;AAC1C,2DAAiC;AACjC,4DAAkC;AAClC,6DAAmC;AACnC,0EAAgD"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/template/index.ts"],"names":[],"mappings":";;;AAAA,8EAAoD;AACpD,6EAAmD;AACnD,qEAA2C;AAC3C,6EAAmD;AACnD,wEAA8C;AAC9C,gFAAsD;AACtD,wEAA8C;AAC9C,wEAA8C;AAC9C,0EAAgD;AAChD,oEAA0C;AAC1C,2DAAiC;AACjC,4DAAkC;AAClC,6DAAmC;AACnC,0EAAgD"}

package/src/lib/template/template.module.js

@@ -13,6 +13,7 @@ const approval_template_version_entity_1 = require("./approval-template-version.
 const compose_template_mutations_1 = require("./compose-template.mutations");
 const expression_designer_queries_1 = require("./expression-designer.queries");
 const expression_designer_service_1 = require("./expression-designer.service");
+const filterable_field_queries_1 = require("./filterable-field.queries");
 const template_mutations_1 = require("./template.mutations");
 const template_queries_1 = require("./template.queries");
 const template_service_1 = require("./template.service");
@@ -35,6 +36,7 @@ exports.TemplateModule = TemplateModule = tslib_1.__decorate([
             compose_template_mutations_1.ComposeTemplateMutations,
             expression_designer_queries_1.ExpressionDesignerQueries,
             expression_designer_service_1.ExpressionDesignerService,
+            filterable_field_queries_1.FilterableFieldQueries,
             template_mutations_1.TemplateMutations,
             template_queries_1.TemplateQueries,
             template_service_1.TemplateService,

package/src/lib/template/template.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"template.module.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/template/template.module.ts"],"names":[],"mappings":";;;;AAAA,2CAAwC;AACxC,6CAAgD;AAChD,oEAAgE;AAChE,2FAAqF;AACrF,qDAAiD;AACjD,2FAAqF;AACrF,yEAAoE;AACpE,yFAAmF;AACnF,6EAAwE;AACxE,+EAA0E;AAC1E,+EAA0E;AAC1E,6DAAyD;AACzD,yDAAqD;AACrD,yDAAqD;AAuB9C,IAAM,cAAc,GAApB,MAAM,cAAc;CAAG,CAAA;AAAjB,wCAAc;yBAAd,cAAc;IArB1B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,kCAAe;YACf,wBAAU;YACV,uBAAa,CAAC,UAAU,CAAC;gBACvB,kEAA8B;gBAC9B,iDAAsB;gBACtB,gEAA6B;gBAC7B,4DAA2B;aAC5B,CAAC;SACH;QACD,SAAS,EAAE;YACT,qDAAwB;YACxB,uDAAyB;YACzB,uDAAyB;YACzB,sCAAiB;YACjB,kCAAe;YACf,kCAAe;SAChB;QACD,OAAO,EAAE,CAAC,kCAAe,CAAC;KAC3B,CAAC;GACW,cAAc,CAAG"}
+{"version":3,"file":"template.module.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/template/template.module.ts"],"names":[],"mappings":";;;;AAAA,2CAAwC;AACxC,6CAAgD;AAChD,oEAAgE;AAChE,2FAAqF;AACrF,qDAAiD;AACjD,2FAAqF;AACrF,yEAAoE;AACpE,yFAAmF;AACnF,6EAAwE;AACxE,+EAA0E;AAC1E,+EAA0E;AAC1E,yEAAoE;AACpE,6DAAyD;AACzD,yDAAqD;AACrD,yDAAqD;AAwB9C,IAAM,cAAc,GAApB,MAAM,cAAc;CAAG,CAAA;AAAjB,wCAAc;yBAAd,cAAc;IAtB1B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,kCAAe;YACf,wBAAU;YACV,uBAAa,CAAC,UAAU,CAAC;gBACvB,kEAA8B;gBAC9B,iDAAsB;gBACtB,gEAA6B;gBAC7B,4DAA2B;aAC5B,CAAC;SACH;QACD,SAAS,EAAE;YACT,qDAAwB;YACxB,uDAAyB;YACzB,uDAAyB;YACzB,iDAAsB;YACtB,sCAAiB;YACjB,kCAAe;YACf,kCAAe;SAChB;QACD,OAAO,EAAE,CAAC,kCAAe,CAAC;KAC3B,CAAC;GACW,cAAc,CAAG"}

package/src/lib/template/template.service.d.ts

@@ -73,7 +73,19 @@ export declare class TemplateService {
     listApprovalTemplateVersions(templateId: string): Promise<readonly ApprovalTemplateVersionEntity[]>;
     getApprovalTemplateVersion(id: string): Promise<ApprovalTemplateVersionEntity>;
     updateApprovalTemplateDraft(input: UpdateApprovalTemplateDraftInput, manager?: EntityManager): Promise<ApprovalTemplateVersionEntity>;
+    /**
+     * Runs `run` in the caller's transaction when one is passed, otherwise in a
+     * new one, so a template lock taken inside it is held until the write
+     * commits.
+     */
+    private runInTemplateTransaction;
     forkApprovalTemplate(templateId: string, manager?: EntityManager): Promise<ApprovalTemplateVersionEntity>;
+    /**
+     * Forks under the template row lock (ADR 25 §15): the draft check, the
+     * source read and the insert see the template as no concurrent publish or
+     * fork can change it until this commits.
+     */
+    private forkApprovalTemplateLocked;
     publishApprovalTemplateVersion(versionId: string, publishedByMemberId?: string, manager?: EntityManager): Promise<ApprovalTemplateVersionEntity>;
     /**
      * The publish itself, without the observer notification. Split out so
@@ -81,6 +93,11 @@ export declare class TemplateService {
      * and still report a single `COMPOSED` event rather than two.
      */
     private publishVersion;
+    /**
+     * Reads one template row, optionally locked. Locks are only taken inside a
+     * transaction; the caller passes the transaction's manager.
+     */
+    private lockTemplateRow;
     private publishApprovalTemplateVersionWithManager;
     rollbackApprovalTemplateVersion(versionId: string, rolledBackByMemberId?: string): Promise<ApprovalTemplateVersionEntity>;
     /**
@@ -90,6 +107,10 @@ export declare class TemplateService {
      */
     private notifyTemplateObserver;
     private readHostObserver;
+    /**
+     * Returns the bound form schema so the publish can run the filterable-field
+     * check against it without loading the form version a second time.
+     */
     private validatePublishableVersion;
     /** The cel-legacy publish lint, unchanged (docs/24 §1). */
     private lintCelLegacyExpressions;
@@ -121,9 +142,27 @@ export declare class TemplateService {
     private templateVersions;
     private templateCategories;
     private formVersions;
+    /**
+     * The form schema of the template's current version: the one whose
+     * filterable fields the stored instances already satisfy. Null when the
+     * template has no published version yet. Read under the caller's template
+     * row lock, so no write can change what it guarantees before the publish
+     * commits.
+     */
+    private readInForceFormSchema;
+    private readFormSchemaOfVersion;
     private getTemplateOrThrow;
     private getTemplateCategoryOrThrow;
     private setApprovalTemplateActive;
+    /**
+     * Locks the template row FOR UPDATE, the lock a publish, compose or rollback
+     * takes (ADR 25 §15), then reads the row with its category. A template edit
+     * saves the whole entity it read, so reading it unlocked would let a publish
+     * that commits in between be overwritten with the pre-publish
+     * `currentVersionId`; under the lock the read is the latest committed row
+     * and a publish waits for this edit instead.
+     */
+    private readLockedTemplateOrThrow;
     private setApprovalTemplateCategoryActive;
     private getTemplateVersionOrThrow;
     private readNextVersionNumber;

package/src/lib/template/template.service.js

@@ -22,6 +22,7 @@ const form_enums_1 = require("../form/form.enums");
 const form_service_1 = require("../form/form.service");
 const workflow_webhook_validator_1 = require("../workflow-webhook/workflow-webhook.validator");
 const workflow_webhook_service_1 = require("../workflow-webhook/workflow-webhook.service");
+const filterable_field_guard_1 = require("./filterable-field-guard");
 const approval_template_category_entity_1 = require("./approval-template-category.entity");
 const approval_template_entity_1 = require("./approval-template.entity");
 const approval_template_version_entity_1 = require("./approval-template-version.entity");
@@ -108,6 +109,14 @@ let TemplateService = TemplateService_1 = class TemplateService {
      */
     async composeApprovalTemplateWithForm(input, currentMemberId) {
         const { event, result } = await this.templateRepository.manager.transaction(async (manager) => {
+            // ADR 25 §15: an existing template's row is locked before anything
+            // else, so this compose takes the template lock before it forks or
+            // writes the draft row, the same order a standalone publish uses.
+            // Taking it later (after the draft write, inside publishVersion) let a
+            // concurrent publish of the same draft deadlock against this one.
+            if (input.templateId) {
+                await this.readLockedTemplateOrThrow(manager, input.templateId);
+            }
             const formDefinitionVersion = await this.resolveComposedFormVersion(manager, input, currentMemberId);
             const templateDraftVersion = await this.resolveComposedTemplateDraftVersion(manager, input, currentMemberId);
             let templateVersion = await this.updateApprovalTemplateDraft({
@@ -218,27 +227,30 @@ let TemplateService = TemplateService_1 = class TemplateService {
         });
     }
     async updateApprovalTemplate(input) {
-        const existing = await this.getTemplateOrThrow(input.id);
         const category = input.categoryId === undefined
             ? undefined
             : await this.validateOptionalTemplateCategory(input.categoryId);
-        const next = this.templateRepository.merge(existing, {
-            category: input.category !== undefined
-                ? input.category
-                : category !== undefined
-                    ? (category?.name ?? null)
-                    : existing.category,
-            description: input.description ?? existing.description,
-            name: input.name ?? existing.name,
+        await this.templateRepository.manager.transaction(async (manager) => {
+            const existing = await this.readLockedTemplateOrThrow(manager, input.id);
+            const templates = manager.getRepository(approval_template_entity_1.ApprovalTemplateEntity);
+            const next = templates.merge(existing, {
+                category: input.category !== undefined
+                    ? input.category
+                    : category !== undefined
+                        ? (category?.name ?? null)
+                        : existing.category,
+                description: input.description ?? existing.description,
+                name: input.name ?? existing.name,
+            });
+            // Assigned outside `merge` because the relation, not the `categoryId`
+            // scalar, owns `category_id`. Leaving `categoryDetail` untouched when the
+            // caller omitted `categoryId` keeps the loaded relation, which persists
+            // the current category unchanged.
+            if (category !== undefined) {
+                next.categoryDetail = category;
+            }
+            await templates.save(next);
         });
-        // Assigned outside `merge` because the relation, not the `categoryId`
-        // scalar, owns `category_id`. Leaving `categoryDetail` untouched when the
-        // caller omitted `categoryId` keeps the loaded relation, which persists
-        // the current category unchanged.
-        if (category !== undefined) {
-            next.categoryDetail = category;
-        }
-        await this.templateRepository.save(next);
         // Re-read rather than returning the saved entity: `categoryId` is not
         // written by `save()` any more, so the in-memory copy would still carry
         // the previous category alongside the new `categoryDetail` — the same
@@ -364,25 +376,51 @@ let TemplateService = TemplateService_1 = class TemplateService {
         return this.getTemplateVersionOrThrow(id);
     }
     async updateApprovalTemplateDraft(input, manager) {
-        const versionRepository = this.templateVersions(manager);
-        const existing = await this.getTemplateVersionOrThrow(input.versionId, manager);
-        if (existing.status !== template_enums_1.ApprovalTemplateVersionStatusEnum.DRAFT) {
-            throw new common_1.ConflictException('Only draft approval template versions can be updated');
-        }
-        await this.validateOptionalFormDefinitionVersion(input.formDefinitionVersionId, manager);
-        const workflowDefinition = this.parseWorkflowDefinitionOrThrow(input.workflowDefinitionJson);
-        const next = versionRepository.merge(existing, {
-            formDefinitionVersionId: input.formDefinitionVersionId,
-            initiatorPolicyCel: input.initiatorPolicyCel,
-            notificationConfig: parseOptionalJsonObject(input.notificationConfigJson),
-            slaDefaults: parseOptionalJsonObject(input.slaDefaultsJson),
-            workflowDefinition,
+        return this.runInTemplateTransaction(manager, async (txManager) => {
+            const versionRepository = this.templateVersions(txManager);
+            // Read once to learn the template, lock its row (ADR 25 §15), then read
+            // the draft again: a publish that committed before the lock has turned
+            // it PUBLISHED, and saving the copy read before would write the old
+            // DRAFT status and empty publish fields back over it.
+            const unlocked = await this.getTemplateVersionOrThrow(input.versionId, txManager);
+            await this.readLockedTemplateOrThrow(txManager, unlocked.templateId);
+            const existing = await this.getTemplateVersionOrThrow(input.versionId, txManager);
+            if (existing.status !== template_enums_1.ApprovalTemplateVersionStatusEnum.DRAFT) {
+                throw new common_1.ConflictException('Only draft approval template versions can be updated');
+            }
+            await this.validateOptionalFormDefinitionVersion(input.formDefinitionVersionId, txManager);
+            const workflowDefinition = this.parseWorkflowDefinitionOrThrow(input.workflowDefinitionJson);
+            const next = versionRepository.merge(existing, {
+                formDefinitionVersionId: input.formDefinitionVersionId,
+                initiatorPolicyCel: input.initiatorPolicyCel,
+                notificationConfig: parseOptionalJsonObject(input.notificationConfigJson),
+                slaDefaults: parseOptionalJsonObject(input.slaDefaultsJson),
+                workflowDefinition,
+            });
+            return versionRepository.save(next);
         });
-        return versionRepository.save(next);
+    }
+    /**
+     * Runs `run` in the caller's transaction when one is passed, otherwise in a
+     * new one, so a template lock taken inside it is held until the write
+     * commits.
+     */
+    runInTemplateTransaction(manager, run) {
+        return manager
+            ? run(manager)
+            : this.templateRepository.manager.transaction(run);
     }
     async forkApprovalTemplate(templateId, manager) {
+        return this.runInTemplateTransaction(manager, (txManager) => this.forkApprovalTemplateLocked(templateId, txManager));
+    }
+    /**
+     * Forks under the template row lock (ADR 25 §15): the draft check, the
+     * source read and the insert see the template as no concurrent publish or
+     * fork can change it until this commits.
+     */
+    async forkApprovalTemplateLocked(templateId, manager) {
         const versionRepository = this.templateVersions(manager);
-        const template = await this.getTemplateOrThrow(templateId, manager);
+        const template = await this.readLockedTemplateOrThrow(manager, templateId);
         const existingDraft = await versionRepository.findOne({
             where: {
                 status: template_enums_1.ApprovalTemplateVersionStatusEnum.DRAFT,
@@ -433,18 +471,45 @@ let TemplateService = TemplateService_1 = class TemplateService {
         if (version.status !== template_enums_1.ApprovalTemplateVersionStatusEnum.DRAFT) {
             throw new common_1.ConflictException('Only draft approval template versions can be published');
         }
+        // Early refusals only: they run outside the lock and are repeated below.
         await this.validatePublishableVersion(version, manager);
-        const run = (txManager) => this.publishApprovalTemplateVersionWithManager(txManager, version, publishedByMemberId);
+        // ADR 25 §5.4 and §15: the template row is locked before the enable check
+        // and before the draft is read again, so a concurrent form-data write
+        // (which takes FOR SHARE on the same row) cannot slip between the check
+        // and the commit, and the draft is judged as it is under the lock.
+        const run = async (txManager) => {
+            const lockedTemplate = await this.lockTemplateRow(txManager, version.templateId, 'pessimistic_write');
+            if (!lockedTemplate) {
+                throw new common_1.NotFoundException(`Approval template ${version.templateId} was not found`);
+            }
+            const lockedVersion = await this.getTemplateVersionOrThrow(versionId, txManager);
+            if (lockedVersion.status !== template_enums_1.ApprovalTemplateVersionStatusEnum.DRAFT) {
+                throw new common_1.ConflictException('Only draft approval template versions can be published');
+            }
+            const formSchema = await this.validatePublishableVersion(lockedVersion, txManager);
+            return this.publishApprovalTemplateVersionWithManager(txManager, lockedVersion, publishedByMemberId, formSchema);
+        };
         return manager
             ? run(manager)
             : this.templateRepository.manager.transaction(run);
     }
-    async publishApprovalTemplateVersionWithManager(manager, version, publishedByMemberId) {
+    /**
+     * Reads one template row, optionally locked. Locks are only taken inside a
+     * transaction; the caller passes the transaction's manager.
+     */
+    async lockTemplateRow(manager, templateId, mode) {
+        return manager.getRepository(approval_template_entity_1.ApprovalTemplateEntity).findOne({
+            lock: { mode },
+            where: { deletedAt: (0, typeorm_2.IsNull)(), id: templateId },
+        });
+    }
+    async publishApprovalTemplateVersionWithManager(manager, version, publishedByMemberId, formSchema) {
         const templateRepository = manager.getRepository(approval_template_entity_1.ApprovalTemplateEntity);
         const versionRepository = manager.getRepository(approval_template_version_entity_1.ApprovalTemplateVersionEntity);
-        const template = await templateRepository.findOne({
-            where: { deletedAt: (0, typeorm_2.IsNull)(), id: version.templateId },
-        });
+        // Already locked by the caller (`publishVersion`); the lock is taken again
+        // here so this method is safe on its own, and the lock is re-entrant
+        // within one transaction.
+        const template = await this.lockTemplateRow(manager, version.templateId, 'pessimistic_write');
         if (!template) {
             throw new common_1.NotFoundException(`Approval template ${version.templateId} was not found`);
         }
@@ -454,6 +519,11 @@ let TemplateService = TemplateService_1 = class TemplateService {
         if (!template.isActive) {
             throw new common_1.ConflictException('Approval template is deactivated');
         }
+        // ADR 25 §5.4: a field that becomes filterable must not hold values the
+        // template's existing instances cannot satisfy. Checked here, inside the
+        // publish transaction, so the instances it reads are the ones it archives.
+        // Only what this publish makes filterable is scanned (ADR 25 §15).
+        await (0, filterable_field_guard_1.assertTemplateFilterableFieldsEnabled)(manager, template.id, formSchema, () => this.readInForceFormSchema(manager, template));
         const previousVersionId = template.currentVersionId;
         if (template.currentVersionId) {
             await versionRepository.update({ id: template.currentVersionId }, {
@@ -486,6 +556,8 @@ let TemplateService = TemplateService_1 = class TemplateService {
         // and is not linted again, since a rule tightened since could refuse it
         // (ADR 22 §5, docs/24 §1). The one check is that every function it calls
         // is still registered; without it every case would fail on evaluation.
+        // The filterable-field check (ADR 25 §5.4) is the exception: it reads the
+        // instances stored now, so it runs again inside the transaction below.
         const unregisteredFunctionErrors = this.lintRegisteredFunctions(target.workflowDefinition, target.initiatorPolicyCel);
         if (unregisteredFunctionErrors.length) {
             throw new common_1.BadRequestException(unregisteredFunctionErrors.join('; '));
@@ -493,9 +565,9 @@ let TemplateService = TemplateService_1 = class TemplateService {
         const rolledBack = await this.templateRepository.manager.transaction(async (manager) => {
             const templateRepository = manager.getRepository(approval_template_entity_1.ApprovalTemplateEntity);
             const versionRepository = manager.getRepository(approval_template_version_entity_1.ApprovalTemplateVersionEntity);
-            const template = await templateRepository.findOne({
-                where: { deletedAt: (0, typeorm_2.IsNull)(), id: target.templateId },
-            });
+            // ADR 25 §5.4 and §15: lock the template row before the enable check,
+            // the same lock a publish takes (see `publishVersion`).
+            const template = await this.lockTemplateRow(manager, target.templateId, 'pessimistic_write');
             if (!template) {
                 throw new common_1.NotFoundException(`Approval template ${target.templateId} was not found`);
             }
@@ -504,6 +576,9 @@ let TemplateService = TemplateService_1 = class TemplateService {
             if (!template.isActive) {
                 throw new common_1.ConflictException('Approval template is deactivated');
             }
+            // The target becomes the current version again, so its filterable
+            // fields are checked against the instances stored now (ADR 25 §5.4).
+            await (0, filterable_field_guard_1.assertTemplateFilterableFieldsEnabled)(manager, template.id, await this.readFormSchemaOfVersion(manager, target.formDefinitionVersionId), () => this.readInForceFormSchema(manager, template));
             const previousVersionId = template.currentVersionId;
             if (template.currentVersionId &&
                 template.currentVersionId !== target.id) {
@@ -561,6 +636,10 @@ let TemplateService = TemplateService_1 = class TemplateService {
             return null;
         }
     }
+    /**
+     * Returns the bound form schema so the publish can run the filterable-field
+     * check against it without loading the form version a second time.
+     */
     async validatePublishableVersion(version, manager) {
         if (!version.formDefinitionVersionId) {
             throw new common_1.BadRequestException('Approval template version must bind a form definition version before publishing');
@@ -599,6 +678,9 @@ let TemplateService = TemplateService_1 = class TemplateService {
         const nodeActorSourceErrors = workflowResult.valid
             ? lintWorkflowNodeActorSources(version.workflowDefinition)
             : [];
+        const excludeNodeActorsErrors = workflowResult.valid
+            ? lintWorkflowExcludeNodeActors(version.workflowDefinition)
+            : [];
         const approverFilledFieldErrors = (0, bpm_core_shared_1.readFormFieldAccessIssues)(version.workflowDefinition, formVersion.schema).map((issue) => issue.message);
         const approverFilledReadErrors = lintApproverFilledFieldReads(version.workflowDefinition, fieldReader);
         const webhookErrors = await this.lintWorkflowWebhooks(version.workflowDefinition, formVersion.schema);
@@ -610,6 +692,7 @@ let TemplateService = TemplateService_1 = class TemplateService {
             ...memberReferenceErrors,
             ...orgUnitReferenceErrors,
             ...nodeActorSourceErrors,
+            ...excludeNodeActorsErrors,
             ...approverFilledFieldErrors,
             ...approverFilledReadErrors,
             ...webhookErrors,
@@ -617,6 +700,7 @@ let TemplateService = TemplateService_1 = class TemplateService {
         if (errors.length) {
             throw new common_1.BadRequestException(errors.join('; '));
         }
+        return formVersion.schema;
     }
     /** The cel-legacy publish lint, unchanged (docs/24 §1). */
     lintCelLegacyExpressions(version) {
@@ -748,6 +832,31 @@ let TemplateService = TemplateService_1 = class TemplateService {
             ? manager.getRepository(form_definition_version_entity_1.FormDefinitionVersionEntity)
             : this.formDefinitionVersionRepository;
     }
+    /**
+     * The form schema of the template's current version: the one whose
+     * filterable fields the stored instances already satisfy. Null when the
+     * template has no published version yet. Read under the caller's template
+     * row lock, so no write can change what it guarantees before the publish
+     * commits.
+     */
+    async readInForceFormSchema(manager, template) {
+        if (!template.currentVersionId) {
+            return null;
+        }
+        const current = await manager
+            .getRepository(approval_template_version_entity_1.ApprovalTemplateVersionEntity)
+            .findOne({ where: { id: template.currentVersionId } });
+        return this.readFormSchemaOfVersion(manager, current?.formDefinitionVersionId ?? null);
+    }
+    async readFormSchemaOfVersion(manager, formDefinitionVersionId) {
+        if (!formDefinitionVersionId) {
+            return null;
+        }
+        const formVersion = await manager
+            .getRepository(form_definition_version_entity_1.FormDefinitionVersionEntity)
+            .findOne({ where: { id: formDefinitionVersionId } });
+        return formVersion?.schema ?? null;
+    }
     async getTemplateOrThrow(id, manager) {
         const entity = await this.templates(manager).findOne({
             relations: { categoryDetail: true },
@@ -768,10 +877,28 @@ let TemplateService = TemplateService_1 = class TemplateService {
         return entity;
     }
     async setApprovalTemplateActive(id, isActive) {
-        const template = await this.getTemplateOrThrow(id);
-        return this.templateRepository.save(this.templateRepository.merge(template, {
-            isActive,
-        }));
+        return this.templateRepository.manager.transaction(async (manager) => {
+            const template = await this.readLockedTemplateOrThrow(manager, id);
+            const templates = manager.getRepository(approval_template_entity_1.ApprovalTemplateEntity);
+            return templates.save(templates.merge(template, { isActive }));
+        });
+    }
+    /**
+     * Locks the template row FOR UPDATE, the lock a publish, compose or rollback
+     * takes (ADR 25 §15), then reads the row with its category. A template edit
+     * saves the whole entity it read, so reading it unlocked would let a publish
+     * that commits in between be overwritten with the pre-publish
+     * `currentVersionId`; under the lock the read is the latest committed row
+     * and a publish waits for this edit instead.
+     */
+    async readLockedTemplateOrThrow(manager, id) {
+        // The lock is taken without the category join: Postgres refuses FOR
+        // UPDATE on the nullable side of an outer join.
+        const locked = await this.lockTemplateRow(manager, id, 'pessimistic_write');
+        if (!locked) {
+            throw new common_1.NotFoundException(`Approval template ${id} was not found`);
+        }
+        return this.getTemplateOrThrow(id, manager);
     }
     async setApprovalTemplateCategoryActive(id, isActive) {
         const category = await this.getTemplateCategoryOrThrow(id);
@@ -937,12 +1064,15 @@ function lintWorkflowTableReferences(definition, initiatorPolicyCel, schema, fie
  * approver resolver reads one member id there. A path that names no
  * member field of the bound form version resolves to nothing at runtime, which
  * throws while the task is created and can strand the case — so it is caught
- * here instead. The same throw happens when the field is merely empty, and on a
+ * here instead. The same throw happens when the field is merely empty (a
+ * manager chain with a `FORM_MEMBER` start is the exception: an empty field
+ * sends it to its fallback, and it throws only when it has none), and on a
  * node past the first one it lands inside the previous approver's decision,
  * which then can never commit. So the field must also be one the submit
  * validation guarantees a value for: required, with no `visibleWhen` that can
  * hide it and not a store-only `hidden` field. `FORM_MEMBER_MANAGER` looks one
- * person's manager up, so its field must not be `multiple` either.
+ * person's manager up, so its field must not be `multiple` either; so does an
+ * `ORG_MANAGER_CHAIN` whose `startFrom` is a `FORM_MEMBER`.
  */
 function lintWorkflowMemberReferences(definition, schema) {
     const memberFields = new Map((schema?.fields ?? [])
@@ -961,6 +1091,19 @@ function lintWorkflowMemberReferences(definition, schema) {
                 },
             ];
         }
+        // A manager chain that starts from a form pick reads one person there,
+        // the same as FORM_MEMBER_MANAGER.
+        if (node.type === 'userTask' &&
+            node.data.approverResolver?.type === 'ORG_MANAGER_CHAIN' &&
+            node.data.approverResolver.startFrom?.type === 'FORM_MEMBER') {
+            return [
+                {
+                    formPath: node.data.approverResolver.startFrom.formPath,
+                    label: `workflow.nodes.${node.id}.approverResolver.startFrom.formPath`,
+                    single: true,
+                },
+            ];
+        }
         if (node.type === 'serviceTask' &&
             node.data.action?.type === 'NOTIFY' &&
             node.data.action.recipients?.type === 'DYNAMIC_FORM') {
@@ -1032,19 +1175,45 @@ function lintWorkflowOrgUnitReferences(definition, schema) {
     });
 }
 /**
- * The graph checks behind `NODE_ACTOR` / `NODE_ACTOR_MANAGER` nodes (shared
- * with the designer): every source is an unskippable, upstream, non-parallel
- * user task and every path to the node passes one.
+ * The graph checks behind `NODE_ACTOR` / `NODE_ACTOR_MANAGER` nodes, and the
+ * `NODE_ACTOR` start of an `ORG_MANAGER_CHAIN` (shared with the designer):
+ * every source is an unskippable, upstream, non-parallel user task and every
+ * path to the node passes one.
  */
 function lintWorkflowNodeActorSources(definition) {
     return definition.nodes.flatMap((node) => {
         const resolver = node.type === 'userTask' ? node.data.approverResolver : null;
+        // A manager chain that starts from an earlier stage reads that stage's
+        // signer the way NODE_ACTOR does, so it meets the same graph rules. It
+        // also needs that signer to be one person: when the last of several
+        // signers approves, the engine's "which one?" Conflict would land in that
+        // approval's own transaction and it could never commit. NODE_ACTOR and
+        // NODE_ACTOR_MANAGER take every signer and are not held to this.
+        if (resolver?.type === 'ORG_MANAGER_CHAIN' &&
+            resolver.startFrom?.type === 'NODE_ACTOR') {
+            return [
+                ...(0, workflow_graph_1.readNodeActorSourceIssues)(definition, node.id, resolver.startFrom.nodeIds),
+                ...(0, workflow_graph_1.readSingleApproverSourceIssues)(definition, resolver.startFrom.nodeIds),
+            ].map((issue) => `workflow.nodes.${node.id}.approverResolver.startFrom.nodeIds: ${issue}`);
+        }
         if (resolver?.type !== 'NODE_ACTOR' && resolver?.type !== 'NODE_ACTOR_MANAGER') {
             return [];
         }
         return (0, workflow_graph_1.readNodeActorSourceIssues)(definition, node.id, resolver.nodeIds).map((issue) => `workflow.nodes.${node.id}.approverResolver.nodeIds: ${issue}`);
     });
 }
+/**
+ * The graph checks behind `excludeNodeActors` (shared with the designer): every
+ * listed node, on its own, is an upstream user task that is on every path to
+ * the node and always has a person sign (the `NODE_ACTOR` source rules, worded
+ * for the exclusion). Runs after the structural lint, like the `NODE_ACTOR`
+ * checks.
+ */
+function lintWorkflowExcludeNodeActors(definition) {
+    return definition.nodes.flatMap((node) => node.type === 'userTask'
+        ? (0, workflow_graph_1.readExcludeNodeActorsIssues)(definition, node.id, node.data.excludeNodeActors).map((issue) => `workflow.nodes.${node.id}.excludeNodeActors: ${issue}`)
+        : []);
+}
 /**
  * A condition that reads a field an approver fills in, before that approver
  * has filled it in, finds the field absent: the applicant's form is submitted