@rytass/bpm-core-nestjs-module 0.5.0 → 0.5.1

package/src/lib/workflow-engine/workflow-engine.service.js

@@ -0,0 +1,3561 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkflowEngineService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const attachment_service_1 = require("../attachment/attachment.service");
+const delegation_service_1 = require("../delegation/delegation.service");
+const form_definition_version_entity_1 = require("../form/form-definition-version.entity");
+const form_enums_1 = require("../form/form.enums");
+const notification_service_1 = require("../notification/notification.service");
+const notification_entity_1 = require("../notification/notification.entity");
+const notification_enums_1 = require("../notification/notification.enums");
+const signature_service_1 = require("../signature/signature.service");
+const condition_service_1 = require("../condition/condition.service");
+const manager_resolution_entity_1 = require("../organization/manager-resolution.entity");
+const membership_entity_1 = require("../organization/membership.entity");
+const org_unit_entity_1 = require("../organization/org-unit.entity");
+const organization_enums_1 = require("../organization/organization.enums");
+const approval_template_version_entity_1 = require("../template/approval-template-version.entity");
+const approval_template_entity_1 = require("../template/approval-template.entity");
+const template_enums_1 = require("../template/template.enums");
+const activity_log_entity_1 = require("./activity-log.entity");
+const adhoc_directive_entity_1 = require("./adhoc-directive.entity");
+const adhoc_enums_1 = require("./adhoc.enums");
+const approval_instance_entity_1 = require("./approval-instance.entity");
+const task_decision_entity_1 = require("./task-decision.entity");
+const task_candidate_entity_1 = require("./task-candidate.entity");
+const task_entity_1 = require("./task.entity");
+const workflow_engine_enums_1 = require("./workflow-engine.enums");
+const workflow_condition_evaluator_1 = require("./workflow-condition-evaluator");
+const workflow_dry_run_object_1 = require("./workflow-dry-run.object");
+const workflow_service_task_dispatcher_token_1 = require("./workflow-service-task-dispatcher.token");
+const workflow_token_entity_1 = require("./workflow-token.entity");
+const MAX_PROCESSING_STEPS = 500;
+const DEFAULT_APPROVAL_HISTORY_TASK_LIMIT = 50;
+const SYSTEM_DRY_RUN_INSTANCE_ID = 'dry-run-instance';
+const WORKFLOW_READ_ALL_PERMISSIONS = new Set([
+    'bpm:*',
+    'bpm.workflow.read_all',
+    'bpm:workflow:read_all',
+    'workflow.read_all',
+]);
+let WorkflowEngineService = class WorkflowEngineService {
+    constructor(approvalInstanceRepository, workflowTokenRepository, taskRepository, taskCandidateRepository, taskDecisionRepository, notificationRepository, activityLogRepository, adhocDirectiveRepository, approvalTemplateRepository, approvalTemplateVersionRepository, formDefinitionVersionRepository, attachmentService, conditionService, delegationService, notificationService, signatureService, serviceTaskDispatcher = new workflow_service_task_dispatcher_token_1.DefaultWorkflowServiceTaskDispatcher()) {
+        this.approvalInstanceRepository = approvalInstanceRepository;
+        this.workflowTokenRepository = workflowTokenRepository;
+        this.taskRepository = taskRepository;
+        this.taskCandidateRepository = taskCandidateRepository;
+        this.taskDecisionRepository = taskDecisionRepository;
+        this.notificationRepository = notificationRepository;
+        this.activityLogRepository = activityLogRepository;
+        this.adhocDirectiveRepository = adhocDirectiveRepository;
+        this.approvalTemplateRepository = approvalTemplateRepository;
+        this.approvalTemplateVersionRepository = approvalTemplateVersionRepository;
+        this.formDefinitionVersionRepository = formDefinitionVersionRepository;
+        this.attachmentService = attachmentService;
+        this.conditionService = conditionService;
+        this.delegationService = delegationService;
+        this.notificationService = notificationService;
+        this.signatureService = signatureService;
+        this.serviceTaskDispatcher = serviceTaskDispatcher;
+    }
+    async submitApprovalInstance(input) {
+        const formData = parseJsonObject(input.formDataJson, 'formDataJson');
+        const template = await this.getTemplateOrThrow(input.templateId);
+        if (!template.currentVersionId) {
+            throw new common_1.ConflictException('Approval template does not have a published version');
+        }
+        const templateVersion = await this.getPublishedTemplateVersionOrThrow(template.currentVersionId);
+        const formDefinitionVersion = await this.getPublishedFormVersionOrThrow(templateVersion.formDefinitionVersionId);
+        validateSubmittedFormData(formDefinitionVersion.schema, formData);
+        const initiatorMetadataSnapshot = input.initiatorMetadataSnapshotJson
+            ? parseJsonObject(input.initiatorMetadataSnapshotJson, 'initiatorMetadataSnapshotJson')
+            : await this.readDefaultInitiatorMetadataSnapshot(input.initiatorMemberId);
+        if (!this.conditionService.evaluateBoolean(templateVersion.initiatorPolicyCel, buildInitiatorPolicyContext(initiatorMetadataSnapshot), 'initiatorPolicyCel')) {
+            throw new common_1.ConflictException('Current member is not allowed to start this approval template');
+        }
+        const startedAt = new Date();
+        const startNode = templateVersion.workflowDefinition.nodes.find((node) => node.type === 'startEvent');
+        if (!startNode) {
+            throw new common_1.BadRequestException('Published workflow does not include a startEvent');
+        }
+        return this.approvalInstanceRepository.manager.transaction(async (manager) => {
+            const instanceRepository = manager.getRepository(approval_instance_entity_1.ApprovalInstanceEntity);
+            const tokenRepository = manager.getRepository(workflow_token_entity_1.WorkflowTokenEntity);
+            const activityRepository = manager.getRepository(activity_log_entity_1.ActivityLogEntity);
+            const instance = await instanceRepository.save(instanceRepository.create({
+                completedAt: null,
+                formData,
+                formDefinitionSnapshot: {
+                    formDefinitionVersionId: formDefinitionVersion.id,
+                    schema: formDefinitionVersion.schema,
+                    uiSchema: formDefinitionVersion.uiSchema,
+                    version: formDefinitionVersion.version,
+                },
+                initiatorMemberId: input.initiatorMemberId,
+                initiatorMetadataSnapshot,
+                startedAt,
+                state: workflow_engine_enums_1.ApprovalInstanceStateEnum.RUNNING,
+                templateId: template.id,
+                templateVersionId: templateVersion.id,
+                title: input.title?.trim() || template.name,
+                workflowSnapshot: templateVersion.workflowDefinition,
+            }));
+            await this.attachmentService.bindFormDataAttachmentsToInstance(manager, {
+                formData,
+                instanceId: instance.id,
+            });
+            const token = await tokenRepository.save(tokenRepository.create({
+                consumedAt: null,
+                currentNodeId: startNode.id,
+                instanceId: instance.id,
+                parentTokenId: null,
+                status: workflow_engine_enums_1.WorkflowTokenStatusEnum.ACTIVE,
+            }));
+            await activityRepository.save([
+                activityRepository.create({
+                    actorMemberId: input.initiatorMemberId,
+                    eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.INSTANCE_STARTED,
+                    instanceId: instance.id,
+                    nodeId: startNode.id,
+                    payload: {
+                        templateId: template.id,
+                        templateVersionId: templateVersion.id,
+                    },
+                    taskId: null,
+                }),
+                activityRepository.create({
+                    actorMemberId: null,
+                    eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TOKEN_CREATED,
+                    instanceId: instance.id,
+                    nodeId: startNode.id,
+                    payload: {
+                        tokenId: token.id,
+                    },
+                    taskId: null,
+                }),
+            ]);
+            await this.processRunningInstance(manager, instance);
+            return instance;
+        });
+    }
+    async processInstance(instanceId) {
+        await this.approvalInstanceRepository.manager.transaction(async (manager) => {
+            await manager.query('SELECT pg_advisory_xact_lock(hashtext($1))', [
+                instanceId,
+            ]);
+            const instance = await manager
+                .getRepository(approval_instance_entity_1.ApprovalInstanceEntity)
+                .findOne({ where: { id: instanceId } });
+            if (!instance) {
+                throw new common_1.NotFoundException(`Approval instance ${instanceId} was not found`);
+            }
+            await manager.getRepository(activity_log_entity_1.ActivityLogEntity).save(manager.getRepository(activity_log_entity_1.ActivityLogEntity).create({
+                actorMemberId: null,
+                eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.ENGINE_PROCESS_REQUESTED,
+                instanceId,
+                nodeId: null,
+                payload: {
+                    state: instance.state,
+                },
+                taskId: null,
+            }));
+            if (instance.state !== workflow_engine_enums_1.ApprovalInstanceStateEnum.RUNNING) {
+                return;
+            }
+            await this.processRunningInstance(manager, instance);
+        });
+    }
+    async decideTask(input) {
+        return this.approvalInstanceRepository.manager.transaction(async (manager) => {
+            const taskRepository = manager.getRepository(task_entity_1.TaskEntity);
+            const taskCandidateRepository = manager.getRepository(task_candidate_entity_1.TaskCandidateEntity);
+            const taskDecisionRepository = manager.getRepository(task_decision_entity_1.TaskDecisionEntity);
+            const activityRepository = manager.getRepository(activity_log_entity_1.ActivityLogEntity);
+            const tokenRepository = manager.getRepository(workflow_token_entity_1.WorkflowTokenEntity);
+            const instanceRepository = manager.getRepository(approval_instance_entity_1.ApprovalInstanceEntity);
+            const task = await taskRepository.findOne({
+                where: { id: input.taskId },
+            });
+            if (!task) {
+                throw new common_1.NotFoundException(`Task ${input.taskId} was not found`);
+            }
+            await manager.query('SELECT pg_advisory_xact_lock(hashtext($1))', [
+                task.instanceId,
+            ]);
+            if (task.status !== workflow_engine_enums_1.TaskStatusEnum.PENDING &&
+                task.status !== workflow_engine_enums_1.TaskStatusEnum.IN_PROGRESS) {
+                throw new common_1.ConflictException(`Task ${task.id} is not pending`);
+            }
+            const { actorCandidate, taskCandidates } = await this.readTaskActorContext(manager, task, input.decidedByMemberId);
+            if (input.action !== workflow_engine_enums_1.TaskDecisionActionEnum.APPROVED &&
+                input.action !== workflow_engine_enums_1.TaskDecisionActionEnum.REJECTED &&
+                input.action !== workflow_engine_enums_1.TaskDecisionActionEnum.RETURNED &&
+                input.action !== workflow_engine_enums_1.TaskDecisionActionEnum.TRANSFERRED) {
+                throw new common_1.ConflictException(`Task decision action ${input.action} is not supported yet`);
+            }
+            const decisionComment = input.comment?.trim() || null;
+            if (input.action === workflow_engine_enums_1.TaskDecisionActionEnum.REJECTED &&
+                !decisionComment) {
+                throw new common_1.BadRequestException('Reject decision comment is required');
+            }
+            const transferToMemberId = input.transferToMemberId?.trim() || null;
+            if (input.action === workflow_engine_enums_1.TaskDecisionActionEnum.TRANSFERRED &&
+                !transferToMemberId) {
+                throw new common_1.BadRequestException('Transfer target member is required');
+            }
+            if (input.action === workflow_engine_enums_1.TaskDecisionActionEnum.TRANSFERRED &&
+                transferToMemberId === input.decidedByMemberId) {
+                throw new common_1.ConflictException('Transfer target must be a different member');
+            }
+            const instance = await instanceRepository.findOne({
+                where: { id: task.instanceId },
+            });
+            if (!instance) {
+                throw new common_1.NotFoundException(`Approval instance ${task.instanceId} was not found`);
+            }
+            if (instance.state !== workflow_engine_enums_1.ApprovalInstanceStateEnum.RUNNING) {
+                throw new common_1.ConflictException(`Approval instance ${instance.id} is not running`);
+            }
+            const returnToNodeId = input.action === workflow_engine_enums_1.TaskDecisionActionEnum.RETURNED
+                ? readReturnTargetNodeId(instance.workflowSnapshot, task.nodeId, input.returnToNodeId)
+                : null;
+            const decidedAt = new Date();
+            const claimedTask = await taskRepository.save({
+                ...task,
+                assigneeMemberId: task.assigneeMemberId ?? input.decidedByMemberId,
+                openedAt: task.openedAt ?? decidedAt,
+                originalAssigneeMemberId: task.originalAssigneeMemberId ??
+                    actorCandidate?.originalMemberId ??
+                    input.decidedByMemberId,
+                status: workflow_engine_enums_1.TaskStatusEnum.IN_PROGRESS,
+            });
+            const claimedCandidate = actorCandidate
+                ? await taskCandidateRepository.save({
+                    ...actorCandidate,
+                    claimedAt: actorCandidate.claimedAt ?? decidedAt,
+                    status: workflow_engine_enums_1.TaskCandidateStatusEnum.CLAIMED,
+                })
+                : null;
+            const signature = await this.signatureService.signTaskDecision(manager, {
+                action: input.action,
+                comment: decisionComment,
+                decidedAt,
+                instance,
+                returnToNodeId,
+                signerMemberId: input.decidedByMemberId,
+                task: claimedTask,
+                transferToMemberId,
+            });
+            const decision = await taskDecisionRepository.save(taskDecisionRepository.create({
+                action: input.action,
+                comment: decisionComment,
+                decidedAt,
+                decidedByMemberId: input.decidedByMemberId,
+                returnToNodeId,
+                signatureId: signature.id,
+                taskId: task.id,
+                transferToMemberId,
+            }));
+            if (input.action === workflow_engine_enums_1.TaskDecisionActionEnum.TRANSFERRED) {
+                await this.transferTask(manager, instance, claimedTask, decision, signature, transferToMemberId, decisionComment, decidedAt, claimedCandidate);
+                await this.notificationService.resolveTaskNotifications({
+                    actingMemberId: input.decidedByMemberId,
+                    manager,
+                    resolution: notification_enums_1.NotificationResolutionEnum.TRANSFERRED,
+                    supersedeOthers: true,
+                    taskId: claimedTask.id,
+                });
+                return decision;
+            }
+            const nextCandidateRows = await this.markTaskCandidateDecision({
+                action: input.action,
+                candidate: claimedCandidate,
+                candidates: taskCandidates,
+                decidedAt,
+                manager,
+                task: claimedTask,
+            });
+            const shouldCompleteTask = shouldCompleteTaskAfterDecision({
+                action: input.action,
+                candidates: nextCandidateRows,
+                decisionPolicy: readDecisionPolicySnapshot(claimedTask),
+            });
+            const completedTask = shouldCompleteTask
+                ? await taskRepository.save({
+                    ...claimedTask,
+                    completedAt: decidedAt,
+                    status: workflow_engine_enums_1.TaskStatusEnum.COMPLETED,
+                })
+                : await taskRepository.save({
+                    ...claimedTask,
+                    status: workflow_engine_enums_1.TaskStatusEnum.IN_PROGRESS,
+                });
+            await activityRepository.save(activityRepository.create({
+                actorMemberId: input.decidedByMemberId,
+                eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TASK_DECIDED,
+                instanceId: instance.id,
+                nodeId: claimedTask.nodeId,
+                payload: {
+                    action: input.action,
+                    comment: decisionComment,
+                    decisionId: decision.id,
+                    signatureId: signature.id,
+                    signedPayloadHash: signature.signedPayloadHash,
+                },
+                taskId: completedTask.id,
+            }));
+            // Resolve the recipient's "待簽" notification so its inline 同意/拒絕
+            // actions disappear once the task is decided. When the task has ended
+            // (rejected / returned, or an approval that completed it), every other
+            // candidate's notification is superseded too; a non-completing approval
+            // on a multi-approver task leaves the remaining approvers' open.
+            const taskEnded = input.action !== workflow_engine_enums_1.TaskDecisionActionEnum.APPROVED || shouldCompleteTask;
+            await this.notificationService.resolveTaskNotifications({
+                actingMemberId: input.decidedByMemberId,
+                manager,
+                resolution: mapDecisionToResolution(input.action),
+                supersedeOthers: taskEnded,
+                taskId: completedTask.id,
+            });
+            if (input.action === workflow_engine_enums_1.TaskDecisionActionEnum.APPROVED &&
+                shouldCompleteTask) {
+                // Ad-hoc gate: the token may only advance once every task bound to
+                // this token+node (the original task plus any ad-hoc countersign /
+                // pre-approval tasks) has reached a terminal state. Nodes without
+                // ad-hoc tasks keep the original single-task behaviour.
+                if (await this.hasOpenTasksForTokenNode(manager, claimedTask.tokenId, claimedTask.nodeId)) {
+                    return decision;
+                }
+                const token = await tokenRepository.findOne({
+                    where: { id: claimedTask.tokenId },
+                });
+                if (!token) {
+                    throw new common_1.NotFoundException(`Workflow token ${claimedTask.tokenId} was not found`);
+                }
+                if (token.status !== workflow_engine_enums_1.WorkflowTokenStatusEnum.WAITING) {
+                    throw new common_1.ConflictException(`Workflow token ${token.id} is not waiting for a task decision`);
+                }
+                const activeToken = await tokenRepository.save({
+                    ...token,
+                    consumedAt: null,
+                    status: workflow_engine_enums_1.WorkflowTokenStatusEnum.ACTIVE,
+                });
+                await this.dispatchAdhocStageNotifications(manager, instance, claimedTask.nodeId, 'APPROVED');
+                await this.advanceTokenToOutgoingNodes(manager, instance, activeToken, readWorkflowNodeOrThrow(instance.workflowSnapshot, claimedTask.nodeId));
+                await this.processRunningInstance(manager, instance);
+                return decision;
+            }
+            if (input.action === workflow_engine_enums_1.TaskDecisionActionEnum.APPROVED) {
+                return decision;
+            }
+            if (input.action === workflow_engine_enums_1.TaskDecisionActionEnum.RETURNED) {
+                await this.returnInstanceToNode(manager, instance, completedTask, returnToNodeId, decidedAt);
+                return decision;
+            }
+            if (await this.handleAdhocPreApprovalRejection(manager, instance, completedTask, decidedAt, decisionComment)) {
+                return decision;
+            }
+            await this.rejectInstance(manager, instance, completedTask, decidedAt);
+            return decision;
+        });
+    }
+    async cancelApprovalInstance(input) {
+        return this.approvalInstanceRepository.manager.transaction(async (manager) => {
+            await manager.query('SELECT pg_advisory_xact_lock(hashtext($1))', [
+                input.instanceId,
+            ]);
+            const instanceRepository = manager.getRepository(approval_instance_entity_1.ApprovalInstanceEntity);
+            const instance = await instanceRepository.findOne({
+                where: { id: input.instanceId },
+            });
+            if (!instance) {
+                throw new common_1.NotFoundException(`Approval instance ${input.instanceId} was not found`);
+            }
+            if (instance.initiatorMemberId !== input.cancelledByMemberId) {
+                throw new common_1.ConflictException(`Approval instance ${instance.id} can only be cancelled by its initiator`);
+            }
+            if (instance.state !== workflow_engine_enums_1.ApprovalInstanceStateEnum.RUNNING &&
+                instance.state !== workflow_engine_enums_1.ApprovalInstanceStateEnum.RETURNED) {
+                throw new common_1.ConflictException(`Approval instance ${instance.id} is not cancellable`);
+            }
+            const cancelledAt = new Date();
+            await this.consumeOpenRuntimeState(manager, instance, cancelledAt, workflow_engine_enums_1.TaskStatusEnum.CANCELLED);
+            await this.notificationService.supersedeInstanceTaskNotifications({
+                instanceId: instance.id,
+                manager,
+            });
+            const cancelledInstance = await instanceRepository.save({
+                ...instance,
+                completedAt: cancelledAt,
+                state: workflow_engine_enums_1.ApprovalInstanceStateEnum.CANCELLED,
+            });
+            await this.dispatchAdhocCompletionNotifications(manager, cancelledInstance, workflow_engine_enums_1.ApprovalInstanceStateEnum.CANCELLED);
+            await this.cancelPendingAdhocDirectives(manager, instance.id, null);
+            await manager.getRepository(activity_log_entity_1.ActivityLogEntity).save(manager.getRepository(activity_log_entity_1.ActivityLogEntity).create({
+                actorMemberId: input.cancelledByMemberId,
+                eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.INSTANCE_CANCELLED,
+                instanceId: instance.id,
+                nodeId: null,
+                payload: {
+                    comment: input.comment?.trim() || null,
+                },
+                taskId: null,
+            }));
+            return cancelledInstance;
+        });
+    }
+    async resubmitApprovalInstance(input) {
+        const formData = parseJsonObject(input.formDataJson, 'formDataJson');
+        return this.approvalInstanceRepository.manager.transaction(async (manager) => {
+            await manager.query('SELECT pg_advisory_xact_lock(hashtext($1))', [
+                input.instanceId,
+            ]);
+            const instanceRepository = manager.getRepository(approval_instance_entity_1.ApprovalInstanceEntity);
+            const instance = await instanceRepository.findOne({
+                where: { id: input.instanceId },
+            });
+            if (!instance) {
+                throw new common_1.NotFoundException(`Approval instance ${input.instanceId} was not found`);
+            }
+            if (instance.initiatorMemberId !== input.initiatorMemberId) {
+                throw new common_1.ConflictException(`Approval instance ${instance.id} can only be resubmitted by its initiator`);
+            }
+            if (instance.state !== workflow_engine_enums_1.ApprovalInstanceStateEnum.RETURNED) {
+                throw new common_1.ConflictException(`Approval instance ${instance.id} is not returned`);
+            }
+            validateSubmittedFormData(readFormDefinitionSnapshotSchema(instance.formDefinitionSnapshot), formData);
+            const resubmittedInstance = await instanceRepository.save({
+                ...instance,
+                completedAt: null,
+                formData,
+                state: workflow_engine_enums_1.ApprovalInstanceStateEnum.RUNNING,
+                title: input.title?.trim() || instance.title,
+            });
+            await this.attachmentService.bindFormDataAttachmentsToInstance(manager, {
+                formData,
+                instanceId: instance.id,
+            });
+            const returnedContext = await this.readLatestReturnedInstanceContext(manager, instance.id);
+            const runtimeInstance = returnedContext?.resubmitStrategy === 'FROM_RETURN_POINT'
+                ? await this.resumeReturnedInstanceFromReturnPoint(manager, resubmittedInstance, returnedContext, new Date())
+                : resubmittedInstance;
+            await manager.getRepository(activity_log_entity_1.ActivityLogEntity).save(manager.getRepository(activity_log_entity_1.ActivityLogEntity).create({
+                actorMemberId: input.initiatorMemberId,
+                eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.INSTANCE_RESUBMITTED,
+                instanceId: instance.id,
+                nodeId: null,
+                payload: {
+                    resubmitStrategy: returnedContext?.resubmitStrategy ?? 'RESTART',
+                },
+                taskId: null,
+            }));
+            await this.processRunningInstance(manager, runtimeInstance);
+            return runtimeInstance;
+        });
+    }
+    async requestAdhocCountersign({ comment, requestedByMemberId, target, taskId, }) {
+        return this.approvalInstanceRepository.manager.transaction(async (manager) => {
+            const { instance, node, task } = await this.loadAdhocOperationContext(manager, taskId, requestedByMemberId, { requireAllowAddSigner: true });
+            const targetValue = buildAdhocTargetValue(target);
+            // Rejects WEBHOOK targets — countersigners must be members.
+            buildAdhocApproverResolver(targetValue);
+            const directiveRepository = manager.getRepository(adhoc_directive_entity_1.AdhocDirectiveEntity);
+            const directive = await directiveRepository.save(directiveRepository.create({
+                channels: null,
+                comment: comment?.trim() || null,
+                consumedAt: null,
+                createdByMemberId: requestedByMemberId,
+                instanceId: instance.id,
+                onReject: null,
+                originNodeId: task.nodeId,
+                originTaskId: task.id,
+                status: adhoc_enums_1.AdhocDirectiveStatusEnum.PENDING,
+                targetKind: targetValue.kind,
+                targetValue: { ...targetValue },
+                type: adhoc_enums_1.AdhocDirectiveTypeEnum.COUNTERSIGN,
+            }));
+            await this.recordAdhocDirectiveActivity(manager, directive, workflow_engine_enums_1.ActivityLogEventTypeEnum.ADHOC_DIRECTIVE_CREATED, requestedByMemberId, { nodeLabel: node.data.label });
+            return directive;
+        });
+    }
+    async requestAdhocPreApproval({ comment, onReject, requestedByMemberId, target, taskId, }) {
+        return this.approvalInstanceRepository.manager.transaction(async (manager) => {
+            const { instance, node, task } = await this.loadAdhocOperationContext(manager, taskId, requestedByMemberId, { requireAllowAddSigner: true });
+            const targetValue = buildAdhocTargetValue(target);
+            // Rejects WEBHOOK targets — pre-approvers must be members.
+            buildAdhocApproverResolver(targetValue);
+            const now = new Date();
+            const directiveRepository = manager.getRepository(adhoc_directive_entity_1.AdhocDirectiveEntity);
+            const directive = await directiveRepository.save(directiveRepository.create({
+                channels: null,
+                comment: comment?.trim() || null,
+                consumedAt: now,
+                createdByMemberId: requestedByMemberId,
+                instanceId: instance.id,
+                onReject,
+                originNodeId: task.nodeId,
+                originTaskId: task.id,
+                status: adhoc_enums_1.AdhocDirectiveStatusEnum.CONSUMED,
+                targetKind: targetValue.kind,
+                targetValue: { ...targetValue },
+                type: adhoc_enums_1.AdhocDirectiveTypeEnum.PRE_APPROVAL,
+            }));
+            const adhocTask = await this.createAdhocTaskForDirective(manager, instance, task.tokenId, node, directive, now);
+            await this.recordAdhocDirectiveActivity(manager, directive, workflow_engine_enums_1.ActivityLogEventTypeEnum.ADHOC_DIRECTIVE_CREATED, requestedByMemberId, { adhocTaskId: adhocTask.id, nodeLabel: node.data.label, onReject });
+            return adhocTask;
+        });
+    }
+    async configureAdhocNotification({ channels, requestedByMemberId, target, taskId, type, }) {
+        return this.approvalInstanceRepository.manager.transaction(async (manager) => {
+            const { instance, node, task } = await this.loadAdhocOperationContext(manager, taskId, requestedByMemberId, { requireAllowAddSigner: false });
+            const targetValue = buildAdhocTargetValue(target);
+            const directiveRepository = manager.getRepository(adhoc_directive_entity_1.AdhocDirectiveEntity);
+            const directive = await directiveRepository.save(directiveRepository.create({
+                channels: channels?.length ? [...channels] : null,
+                comment: null,
+                consumedAt: null,
+                createdByMemberId: requestedByMemberId,
+                instanceId: instance.id,
+                onReject: null,
+                originNodeId: task.nodeId,
+                originTaskId: task.id,
+                status: adhoc_enums_1.AdhocDirectiveStatusEnum.PENDING,
+                targetKind: targetValue.kind,
+                targetValue: { ...targetValue },
+                type,
+            }));
+            await this.recordAdhocDirectiveActivity(manager, directive, workflow_engine_enums_1.ActivityLogEventTypeEnum.ADHOC_DIRECTIVE_CREATED, requestedByMemberId, { nodeLabel: node.data.label });
+            return directive;
+        });
+    }
+    async cancelAdhocDirective({ cancelledByMemberId, directiveId, }) {
+        return this.approvalInstanceRepository.manager.transaction(async (manager) => {
+            const directiveRepository = manager.getRepository(adhoc_directive_entity_1.AdhocDirectiveEntity);
+            const directive = await directiveRepository.findOne({
+                where: { id: directiveId },
+            });
+            if (!directive) {
+                throw new common_1.NotFoundException(`Ad-hoc directive ${directiveId} was not found`);
+            }
+            await manager.query('SELECT pg_advisory_xact_lock(hashtext($1))', [
+                directive.instanceId,
+            ]);
+            if (directive.createdByMemberId !== cancelledByMemberId) {
+                throw new common_1.ConflictException(`Ad-hoc directive ${directive.id} can only be cancelled by its creator`);
+            }
+            if (directive.status !== adhoc_enums_1.AdhocDirectiveStatusEnum.PENDING) {
+                throw new common_1.ConflictException(`Ad-hoc directive ${directive.id} is not pending`);
+            }
+            const cancelledDirective = await directiveRepository.save({
+                ...directive,
+                status: adhoc_enums_1.AdhocDirectiveStatusEnum.CANCELLED,
+            });
+            await this.recordAdhocDirectiveActivity(manager, cancelledDirective, workflow_engine_enums_1.ActivityLogEventTypeEnum.ADHOC_DIRECTIVE_CANCELLED, cancelledByMemberId);
+            return cancelledDirective;
+        });
+    }
+    async listAdhocDirectives(instanceId, scope) {
+        await this.getApprovalInstance(instanceId, scope);
+        return this.adhocDirectiveRepository.find({
+            order: { createdAt: 'ASC' },
+            where: { instanceId },
+        });
+    }
+    async readTaskActorContext(manager, task, actingMemberId) {
+        const taskCandidates = await manager
+            .getRepository(task_candidate_entity_1.TaskCandidateEntity)
+            .find({ where: { taskId: task.id } });
+        const actorCandidate = taskCandidates.find((candidate) => candidate.memberId === actingMemberId) ?? null;
+        const isDirectAssignee = task.assigneeMemberId === actingMemberId;
+        if (!isDirectAssignee && !actorCandidate) {
+            throw new common_1.ConflictException(`Task ${task.id} is assigned to another member`);
+        }
+        if (actorCandidate &&
+            actorCandidate.status !== workflow_engine_enums_1.TaskCandidateStatusEnum.PENDING &&
+            actorCandidate.status !== workflow_engine_enums_1.TaskCandidateStatusEnum.CLAIMED) {
+            throw new common_1.ConflictException(`Task ${task.id} was already decided by this member`);
+        }
+        return { actorCandidate, taskCandidates };
+    }
+    async loadAdhocOperationContext(manager, taskId, actingMemberId, options) {
+        const task = await manager
+            .getRepository(task_entity_1.TaskEntity)
+            .findOne({ where: { id: taskId } });
+        if (!task) {
+            throw new common_1.NotFoundException(`Task ${taskId} was not found`);
+        }
+        await manager.query('SELECT pg_advisory_xact_lock(hashtext($1))', [
+            task.instanceId,
+        ]);
+        if (task.status !== workflow_engine_enums_1.TaskStatusEnum.PENDING &&
+            task.status !== workflow_engine_enums_1.TaskStatusEnum.IN_PROGRESS) {
+            throw new common_1.ConflictException(`Task ${task.id} is not pending`);
+        }
+        await this.readTaskActorContext(manager, task, actingMemberId);
+        const instance = await manager
+            .getRepository(approval_instance_entity_1.ApprovalInstanceEntity)
+            .findOne({ where: { id: task.instanceId } });
+        if (!instance) {
+            throw new common_1.NotFoundException(`Approval instance ${task.instanceId} was not found`);
+        }
+        if (instance.state !== workflow_engine_enums_1.ApprovalInstanceStateEnum.RUNNING) {
+            throw new common_1.ConflictException(`Approval instance ${instance.id} is not running`);
+        }
+        const node = readWorkflowNodeOrThrow(instance.workflowSnapshot, task.nodeId);
+        if (node.type !== 'userTask') {
+            throw new common_1.ConflictException(`Task ${task.id} is not bound to a user task node`);
+        }
+        if (options.requireAllowAddSigner && !node.data.allowAddSigner) {
+            throw new common_1.ForbiddenException(`簽核節點「${node.data.label}」does not allow ad-hoc signers`);
+        }
+        return { instance, node, task };
+    }
+    async recordAdhocDirectiveActivity(manager, directive, eventType, actorMemberId, extraPayload = {}) {
+        const activityRepository = manager.getRepository(activity_log_entity_1.ActivityLogEntity);
+        await activityRepository.save(activityRepository.create({
+            actorMemberId,
+            eventType,
+            instanceId: directive.instanceId,
+            nodeId: directive.originNodeId,
+            payload: {
+                ...extraPayload,
+                directiveId: directive.id,
+                directiveStatus: directive.status,
+                directiveType: directive.type,
+                targetKind: directive.targetKind,
+            },
+            taskId: directive.originTaskId,
+        }));
+    }
+    async createAdhocTaskForDirective(manager, instance, tokenId, node, directive, now) {
+        const taskRepository = manager.getRepository(task_entity_1.TaskEntity);
+        const taskCandidateRepository = manager.getRepository(task_candidate_entity_1.TaskCandidateEntity);
+        const activityRepository = manager.getRepository(activity_log_entity_1.ActivityLogEntity);
+        const label = directive.type === adhoc_enums_1.AdhocDirectiveTypeEnum.COUNTERSIGN
+            ? '臨時會簽'
+            : '臨時加簽';
+        const resolvedCandidates = await this.resolveApproverResolver(manager, instance, buildAdhocApproverResolver(readAdhocTargetValue(directive)), `${label}「${node.data.label}」`);
+        const candidates = await this.applyDelegationToResolvedCandidates(instance, node.id, resolvedCandidates);
+        if (candidates.length === 0) {
+            throw new common_1.ConflictException(`${label}「${node.data.label}」 did not resolve to any member id`);
+        }
+        const primaryCandidate = candidates[0];
+        const task = await taskRepository.save(taskRepository.create({
+            adhocDirectiveId: directive.id,
+            adhocOriginTaskId: directive.originTaskId,
+            adhocType: directive.type,
+            assigneeMemberId: candidates.length === 1 ? primaryCandidate.memberId : null,
+            assignmentType: candidates.length === 1
+                ? workflow_engine_enums_1.TaskAssignmentTypeEnum.DIRECT_MEMBER
+                : workflow_engine_enums_1.TaskAssignmentTypeEnum.CANDIDATE_GROUP,
+            completedAt: null,
+            createdAt: now,
+            decisionPolicySnapshot: { type: 'SINGLE' },
+            delegationChain: candidates.length === 1 ? primaryCandidate.delegationChain : [],
+            instanceId: instance.id,
+            isAdhoc: true,
+            nodeId: node.id,
+            openedAt: null,
+            originalAssigneeMemberId: candidates.length === 1 ? primaryCandidate.originalMemberId : null,
+            slaDueAt: null,
+            status: workflow_engine_enums_1.TaskStatusEnum.PENDING,
+            tokenId,
+        }));
+        const savedCandidates = await taskCandidateRepository.save(candidates.map((candidate) => taskCandidateRepository.create({
+            claimedAt: null,
+            createdAt: now,
+            decidedAt: null,
+            delegationChain: candidate.delegationChain,
+            memberId: candidate.memberId,
+            originalMemberId: candidate.originalMemberId,
+            sourceType: candidate.sourceType,
+            status: workflow_engine_enums_1.TaskCandidateStatusEnum.PENDING,
+            taskId: task.id,
+        })));
+        task.candidateMemberIds = savedCandidates.map((candidate) => candidate.memberId);
+        await activityRepository.save(activityRepository.create({
+            actorMemberId: directive.createdByMemberId,
+            eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TASK_CREATED,
+            instanceId: instance.id,
+            nodeId: node.id,
+            payload: {
+                adhocDirectiveId: directive.id,
+                adhocType: directive.type,
+                assigneeMemberId: task.assigneeMemberId,
+                assignmentType: task.assignmentType,
+                candidateMemberIds: savedCandidates.map((candidate) => candidate.memberId),
+                originTaskId: directive.originTaskId,
+                tokenId,
+            },
+            taskId: task.id,
+        }));
+        await savedCandidates.reduce(async (previous, candidate) => {
+            await previous;
+            await this.notificationService.createTaskAssignedNotification({
+                instance,
+                manager,
+                node,
+                task: Object.assign(new task_entity_1.TaskEntity(), task, {
+                    assigneeMemberId: candidate.memberId,
+                    delegationChain: candidate.delegationChain,
+                    originalAssigneeMemberId: candidate.originalMemberId,
+                }),
+            });
+        }, Promise.resolve());
+        return task;
+    }
+    async spawnCountersignTasksForNode(manager, instance, token, node, now) {
+        const directiveRepository = manager.getRepository(adhoc_directive_entity_1.AdhocDirectiveEntity);
+        const directives = await directiveRepository.find({
+            order: { createdAt: 'ASC' },
+            where: {
+                instanceId: instance.id,
+                status: adhoc_enums_1.AdhocDirectiveStatusEnum.PENDING,
+                type: adhoc_enums_1.AdhocDirectiveTypeEnum.COUNTERSIGN,
+            },
+        });
+        if (directives.length === 0) {
+            return;
+        }
+        await directives.reduce(async (previous, directive) => {
+            await previous;
+            try {
+                await this.createAdhocTaskForDirective(manager, instance, token.id, node, directive, now);
+                await directiveRepository.save({
+                    ...directive,
+                    consumedAt: now,
+                    status: adhoc_enums_1.AdhocDirectiveStatusEnum.CONSUMED,
+                });
+            }
+            catch (error) {
+                // A countersign target that no longer resolves must not block the
+                // main flow — cancel the directive and record the failure.
+                await directiveRepository.save({
+                    ...directive,
+                    status: adhoc_enums_1.AdhocDirectiveStatusEnum.CANCELLED,
+                });
+                await this.recordAdhocDirectiveActivity(manager, directive, workflow_engine_enums_1.ActivityLogEventTypeEnum.ADHOC_DIRECTIVE_CANCELLED, null, {
+                    error: error instanceof Error
+                        ? error.message
+                        : 'Countersign target resolution failed',
+                });
+            }
+        }, Promise.resolve());
+    }
+    async hasOpenTasksForTokenNode(manager, tokenId, nodeId) {
+        const tasks = await manager.getRepository(task_entity_1.TaskEntity).find({
+            where: { nodeId, tokenId },
+        });
+        return tasks.some((task) => task.tokenId === tokenId &&
+            task.nodeId === nodeId &&
+            (task.status === workflow_engine_enums_1.TaskStatusEnum.PENDING ||
+                task.status === workflow_engine_enums_1.TaskStatusEnum.IN_PROGRESS));
+    }
+    async handleAdhocPreApprovalRejection(manager, instance, task, decidedAt, decisionComment) {
+        if (!task.isAdhoc ||
+            task.adhocType !== adhoc_enums_1.AdhocDirectiveTypeEnum.PRE_APPROVAL ||
+            !task.adhocDirectiveId) {
+            return false;
+        }
+        const directive = await manager
+            .getRepository(adhoc_directive_entity_1.AdhocDirectiveEntity)
+            .findOne({ where: { id: task.adhocDirectiveId } });
+        if (directive?.onReject !==
+            adhoc_enums_1.AdhocPreApprovalRejectBehaviorEnum.RETURN_TO_ORIGIN) {
+            return false;
+        }
+        const taskRepository = manager.getRepository(task_entity_1.TaskEntity);
+        const taskCandidateRepository = manager.getRepository(task_candidate_entity_1.TaskCandidateEntity);
+        const activityRepository = manager.getRepository(activity_log_entity_1.ActivityLogEntity);
+        const originTask = task.adhocOriginTaskId
+            ? await taskRepository.findOne({ where: { id: task.adhocOriginTaskId } })
+            : null;
+        const originTaskIsOpen = originTask?.status === workflow_engine_enums_1.TaskStatusEnum.PENDING ||
+            originTask?.status === workflow_engine_enums_1.TaskStatusEnum.IN_PROGRESS;
+        // Safety: when there is nobody to hand the decision back to (origin task
+        // missing, or already closed without a resolvable assignee), fall back to
+        // the default rejection path instead of leaving the token stuck WAITING
+        // with no open task.
+        if (!originTask || (!originTaskIsOpen && !originTask.assigneeMemberId)) {
+            return false;
+        }
+        const node = readWorkflowNodeOrThrow(instance.workflowSnapshot, task.nodeId);
+        if (!originTaskIsOpen && originTask.assigneeMemberId) {
+            // The origin approver already decided — reopen a fresh decision task so
+            // the stage can be re-decided after the rejected pre-approval.
+            const reopenedTask = await taskRepository.save(taskRepository.create({
+                assigneeMemberId: originTask.assigneeMemberId,
+                assignmentType: workflow_engine_enums_1.TaskAssignmentTypeEnum.DIRECT_MEMBER,
+                completedAt: null,
+                createdAt: decidedAt,
+                decisionPolicySnapshot: { type: 'SINGLE' },
+                delegationChain: originTask.delegationChain,
+                instanceId: instance.id,
+                nodeId: originTask.nodeId,
+                openedAt: null,
+                originalAssigneeMemberId: originTask.originalAssigneeMemberId,
+                slaDueAt: null,
+                status: workflow_engine_enums_1.TaskStatusEnum.PENDING,
+                tokenId: originTask.tokenId,
+            }));
+            await taskCandidateRepository.save(taskCandidateRepository.create({
+                claimedAt: null,
+                createdAt: decidedAt,
+                decidedAt: null,
+                delegationChain: originTask.delegationChain,
+                memberId: originTask.assigneeMemberId,
+                originalMemberId: originTask.originalAssigneeMemberId ?? originTask.assigneeMemberId,
+                sourceType: 'DIRECT',
+                status: workflow_engine_enums_1.TaskCandidateStatusEnum.PENDING,
+                taskId: reopenedTask.id,
+            }));
+            await activityRepository.save(activityRepository.create({
+                actorMemberId: task.assigneeMemberId,
+                eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TASK_CREATED,
+                instanceId: instance.id,
+                nodeId: originTask.nodeId,
+                payload: {
+                    adhocDirectiveId: directive.id,
+                    assigneeMemberId: originTask.assigneeMemberId,
+                    reopenedFromTaskId: originTask.id,
+                    rejectedAdhocTaskId: task.id,
+                    tokenId: originTask.tokenId,
+                },
+                taskId: reopenedTask.id,
+            }));
+            if (node.type === 'userTask') {
+                await this.notificationService.createTaskAssignedNotification({
+                    instance,
+                    manager,
+                    node,
+                    task: reopenedTask,
+                });
+            }
+        }
+        const recipientMemberIds = await this.readOpenTaskRecipientMemberIds(manager, originTask);
+        if (recipientMemberIds.length > 0) {
+            await this.notificationService.createAdhocWorkflowNotifications({
+                channels: null,
+                instance,
+                manager,
+                message: `案件「${instance.title}」的臨時加簽已被拒絕${decisionComment ? `：${decisionComment}` : '。'}`,
+                payload: {
+                    adhocTaskId: task.id,
+                    directiveId: directive.id,
+                    nodeId: task.nodeId,
+                    originTaskId: originTask.id,
+                    type: 'PRE_APPROVAL_RETURNED',
+                },
+                recipientMemberIds,
+            });
+        }
+        await activityRepository.save(activityRepository.create({
+            actorMemberId: task.assigneeMemberId,
+            eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.ADHOC_PRE_APPROVAL_RETURNED,
+            instanceId: instance.id,
+            nodeId: task.nodeId,
+            payload: {
+                comment: decisionComment,
+                directiveId: directive.id,
+                originTaskId: originTask.id,
+                rejectedAdhocTaskId: task.id,
+            },
+            taskId: task.id,
+        }));
+        return true;
+    }
+    async readOpenTaskRecipientMemberIds(manager, task) {
+        if (task.assigneeMemberId) {
+            return [task.assigneeMemberId];
+        }
+        const candidates = await manager
+            .getRepository(task_candidate_entity_1.TaskCandidateEntity)
+            .find({ where: { taskId: task.id } });
+        return uniqueTexts(candidates
+            .filter((candidate) => candidate.status === workflow_engine_enums_1.TaskCandidateStatusEnum.PENDING ||
+            candidate.status === workflow_engine_enums_1.TaskCandidateStatusEnum.CLAIMED)
+            .map((candidate) => candidate.memberId));
+    }
+    async dispatchAdhocStageNotifications(manager, instance, nodeId, outcome) {
+        const directiveRepository = manager.getRepository(adhoc_directive_entity_1.AdhocDirectiveEntity);
+        const directives = await directiveRepository.find({
+            order: { createdAt: 'ASC' },
+            where: {
+                instanceId: instance.id,
+                originNodeId: nodeId,
+                status: adhoc_enums_1.AdhocDirectiveStatusEnum.PENDING,
+                type: adhoc_enums_1.AdhocDirectiveTypeEnum.STAGE_NOTIFY,
+            },
+        });
+        if (directives.length === 0) {
+            return;
+        }
+        const node = readWorkflowNodeOrThrow(instance.workflowSnapshot, nodeId);
+        const nodeLabel = node.data.label;
+        const outcomeLabel = readAdhocStageOutcomeLabel(outcome);
+        const consumedAt = new Date();
+        await directives.reduce(async (previous, directive) => {
+            await previous;
+            await this.dispatchAdhocDirectiveNotification(manager, instance, directive, `案件「${instance.title}」的階段「${nodeLabel}」已${outcomeLabel}。`, {
+                nodeId,
+                nodeLabel,
+                outcome,
+                type: adhoc_enums_1.AdhocDirectiveTypeEnum.STAGE_NOTIFY,
+            });
+            await directiveRepository.save({
+                ...directive,
+                consumedAt,
+                status: adhoc_enums_1.AdhocDirectiveStatusEnum.CONSUMED,
+            });
+        }, Promise.resolve());
+    }
+    async dispatchAdhocCompletionNotifications(manager, instance, finalState) {
+        const directiveRepository = manager.getRepository(adhoc_directive_entity_1.AdhocDirectiveEntity);
+        const directives = await directiveRepository.find({
+            order: { createdAt: 'ASC' },
+            where: {
+                instanceId: instance.id,
+                status: adhoc_enums_1.AdhocDirectiveStatusEnum.PENDING,
+                type: adhoc_enums_1.AdhocDirectiveTypeEnum.COMPLETION_NOTIFY,
+            },
+        });
+        if (directives.length === 0) {
+            return;
+        }
+        const finalStateLabel = readInstanceFinalStateLabel(finalState);
+        const consumedAt = new Date();
+        await directives.reduce(async (previous, directive) => {
+            await previous;
+            await this.dispatchAdhocDirectiveNotification(manager, instance, directive, `案件「${instance.title}」已結案（${finalStateLabel}）。`, {
+                finalState,
+                type: adhoc_enums_1.AdhocDirectiveTypeEnum.COMPLETION_NOTIFY,
+            });
+            await directiveRepository.save({
+                ...directive,
+                consumedAt,
+                status: adhoc_enums_1.AdhocDirectiveStatusEnum.CONSUMED,
+            });
+        }, Promise.resolve());
+    }
+    async dispatchAdhocDirectiveNotification(manager, instance, directive, message, payload) {
+        const targetValue = readAdhocTargetValue(directive);
+        const activityRepository = manager.getRepository(activity_log_entity_1.ActivityLogEntity);
+        if (targetValue.kind === adhoc_enums_1.AdhocTargetKindEnum.WEBHOOK) {
+            const result = await executeAdhocWebhookDispatch(this.serviceTaskDispatcher, targetValue, {
+                ...payload,
+                instanceId: instance.id,
+                instanceTitle: instance.title,
+                message,
+                triggeredAt: new Date().toISOString(),
+            });
+            await activityRepository.save(activityRepository.create({
+                actorMemberId: null,
+                eventType: result.ok
+                    ? workflow_engine_enums_1.ActivityLogEventTypeEnum.SERVICE_TASK_EXECUTED
+                    : workflow_engine_enums_1.ActivityLogEventTypeEnum.SERVICE_TASK_FAILED,
+                instanceId: instance.id,
+                nodeId: directive.originNodeId,
+                payload: {
+                    action: 'ADHOC_WEBHOOK',
+                    directiveId: directive.id,
+                    error: result.error,
+                    ok: result.ok,
+                    status: result.status,
+                    url: targetValue.webhookUrl,
+                },
+                taskId: null,
+            }));
+            return;
+        }
+        try {
+            const recipients = await this.resolveApproverResolver(manager, instance, buildAdhocApproverResolver(targetValue), '臨時通知對象');
+            await this.notificationService.createAdhocWorkflowNotifications({
+                channels: directive.channels,
+                instance,
+                manager,
+                message,
+                payload: { ...payload, directiveId: directive.id },
+                recipientMemberIds: recipients.map((recipient) => recipient.memberId),
+            });
+        }
+        catch (error) {
+            // Notification target resolution must never block the workflow
+            // transition that triggered it — record the failure instead.
+            await activityRepository.save(activityRepository.create({
+                actorMemberId: null,
+                eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.SERVICE_TASK_FAILED,
+                instanceId: instance.id,
+                nodeId: directive.originNodeId,
+                payload: {
+                    action: 'ADHOC_NOTIFY',
+                    directiveId: directive.id,
+                    error: error instanceof Error
+                        ? error.message
+                        : 'Ad-hoc notification dispatch failed',
+                },
+                taskId: null,
+            }));
+        }
+    }
+    async cancelPendingAdhocDirectives(manager, instanceId, types) {
+        const directiveRepository = manager.getRepository(adhoc_directive_entity_1.AdhocDirectiveEntity);
+        const directives = await directiveRepository.find({
+            where: {
+                instanceId,
+                status: adhoc_enums_1.AdhocDirectiveStatusEnum.PENDING,
+                ...(types ? { type: (0, typeorm_2.In)([...types]) } : {}),
+            },
+        });
+        if (directives.length === 0) {
+            return;
+        }
+        await directiveRepository.save(directives.map((directive) => ({
+            ...directive,
+            status: adhoc_enums_1.AdhocDirectiveStatusEnum.CANCELLED,
+        })));
+    }
+    dryRunApprovalWorkflow(input) {
+        const workflowDefinition = parseWorkflowDefinition(input.workflowDefinitionJson);
+        const formData = parseJsonObject(input.formDataJson, 'formDataJson');
+        const initiatorMetadataSnapshot = input.initiatorMetadataSnapshotJson
+            ? parseJsonObject(input.initiatorMetadataSnapshotJson, 'initiatorMetadataSnapshotJson')
+            : readDefaultInitiatorMetadataSnapshot(input.initiatorMemberId);
+        try {
+            return Object.assign(new workflow_dry_run_object_1.WorkflowDryRunResultObject(), {
+                errors: [],
+                steps: this.simulateWorkflow({
+                    formData,
+                    initiatorMemberId: input.initiatorMemberId,
+                    initiatorMetadataSnapshot,
+                    workflowDefinition,
+                }),
+                valid: true,
+            });
+        }
+        catch (error) {
+            return Object.assign(new workflow_dry_run_object_1.WorkflowDryRunResultObject(), {
+                errors: [error instanceof Error ? error.message : 'Dry run failed'],
+                steps: [],
+                valid: false,
+            });
+        }
+    }
+    simulateWorkflow(input) {
+        const startNode = input.workflowDefinition.nodes.find((node) => node.type === 'startEvent');
+        if (!startNode) {
+            throw new common_1.BadRequestException('Workflow does not include a startEvent');
+        }
+        return this.simulateWorkflowPath({
+            ...input,
+            depth: 0,
+            incomingEdge: null,
+            lastDecision: null,
+            nodeId: startNode.id,
+            steps: [],
+            visitedNodeIds: new Set(),
+        });
+    }
+    simulateWorkflowPath(input) {
+        if (input.depth > MAX_PROCESSING_STEPS) {
+            throw new common_1.ConflictException('Dry run exceeded maximum processing steps');
+        }
+        const node = readWorkflowNodeOrThrow(input.workflowDefinition, input.nodeId);
+        const visitKey = `${input.nodeId}:${input.incomingEdge?.id ?? 'start'}`;
+        const entryCondition = readNodeEntryCondition(node);
+        if (input.visitedNodeIds.has(visitKey)) {
+            return [
+                ...input.steps,
+                createDryRunStep({
+                    assigneeMemberId: null,
+                    edge: input.incomingEdge,
+                    edgeMatched: null,
+                    edgeReason: null,
+                    entryCondition,
+                    entryConditionMet: null,
+                    message: '偵測到循環路徑，已停止此分支。',
+                    node,
+                    status: 'STOPPED',
+                    stepIndex: input.steps.length,
+                }),
+            ];
+        }
+        const nextVisitedNodeIds = new Set([...input.visitedNodeIds, visitKey]);
+        const entryConditionMet = this.conditionService.evaluateBoolean(entryCondition, buildDryRunExpressionContext(input, input.lastDecision), `workflow.nodes.${node.id}.data.entryCondition`);
+        const assigneeMemberId = entryConditionMet && node.type === 'userTask'
+            ? this.resolveDryRunAssigneeMemberId(input, node.data.approverResolver, `workflow.nodes.${node.id}.data.approverResolver`)
+            : null;
+        const nextLastDecision = entryConditionMet && node.type === 'userTask'
+            ? {
+                action: workflow_engine_enums_1.TaskDecisionActionEnum.APPROVED,
+                assigneeMemberId,
+                nodeId: node.id,
+            }
+            : input.lastDecision;
+        const nextSteps = [
+            ...input.steps,
+            createDryRunStep({
+                assigneeMemberId,
+                edge: input.incomingEdge,
+                edgeMatched: input.incomingEdge ? true : null,
+                edgeReason: readDryRunEdgeReason(input.incomingEdge),
+                entryCondition,
+                entryConditionMet,
+                message: readDryRunStepMessage(node, entryConditionMet),
+                node,
+                status: readDryRunStepStatus(node, entryConditionMet),
+                stepIndex: input.steps.length,
+            }),
+        ];
+        if (!entryConditionMet || node.type === 'endEvent') {
+            if (node.type === 'endEvent') {
+                return nextSteps;
+            }
+            return readOutgoingEdgesOrThrow(input.workflowDefinition, node.id).reduce((steps, edge) => this.simulateWorkflowPath({
+                ...input,
+                depth: input.depth + 1,
+                incomingEdge: edge,
+                lastDecision: nextLastDecision,
+                nodeId: edge.target,
+                steps,
+                visitedNodeIds: nextVisitedNodeIds,
+            }), nextSteps);
+        }
+        const outgoingEdges = this.readDryRunAvailableOutgoingEdges(input, node, nextLastDecision);
+        return outgoingEdges.reduce((steps, edge) => this.simulateWorkflowPath({
+            ...input,
+            depth: input.depth + 1,
+            incomingEdge: edge,
+            lastDecision: nextLastDecision,
+            nodeId: edge.target,
+            steps,
+            visitedNodeIds: nextVisitedNodeIds,
+        }), nextSteps);
+    }
+    readDryRunAvailableOutgoingEdges(input, node, lastDecision) {
+        if (node.type === 'endEvent') {
+            return [];
+        }
+        const outgoingEdges = readOutgoingEdgesOrThrow(input.workflowDefinition, node.id);
+        const conditionalEdges = outgoingEdges.filter((edge) => !edge.data.isDefault && edgeHasCondition(edge));
+        if (conditionalEdges.length === 0) {
+            return outgoingEdges;
+        }
+        const matchingEdges = conditionalEdges.filter((edge) => this.evaluateDryRunEdge(input, edge, lastDecision));
+        if (matchingEdges.length > 0) {
+            return node.type === 'exclusiveGateway'
+                ? [matchingEdges[0]]
+                : matchingEdges;
+        }
+        const defaultEdges = outgoingEdges.filter((edge) => edge.data.isDefault);
+        if (defaultEdges.length > 0) {
+            return node.type === 'exclusiveGateway'
+                ? [defaultEdges[0]]
+                : defaultEdges;
+        }
+        throw new common_1.ConflictException(`Workflow node ${node.id} has no matching outgoing edge`);
+    }
+    evaluateDryRunEdge(input, edge, lastDecision) {
+        const expression = edge.data.condition?.trim();
+        if (expression) {
+            return this.conditionService.evaluateBoolean(expression, buildDryRunExpressionContext(input, lastDecision), `workflow.edges.${edge.id}.data.condition`);
+        }
+        return (0, workflow_condition_evaluator_1.evaluateWorkflowEdgeCondition)(edge, { formData: input.formData });
+    }
+    resolveDryRunAssigneeMemberId(input, resolver, label) {
+        if (resolver.type === 'DIRECT') {
+            return readMemberIdFromValue(resolver.memberIds, label);
+        }
+        if (resolver.type === 'DYNAMIC_FORM') {
+            return readMemberIdFromValue(readValueAtPath(input.formData, resolver.formPath), `${label}.formPath`);
+        }
+        if (resolver.type === 'EXPRESSION') {
+            return readMemberIdFromValue(this.conditionService.evaluateValue(resolver.expression, buildDryRunExpressionContext(input, null), `${label}.expression`), `${label}.expression`);
+        }
+        if (resolver.type === 'POSITION') {
+            return `position:${resolver.positionId}`;
+        }
+        if (resolver.type === 'ORG_UNIT_MEMBER') {
+            return `orgUnitMember:${resolver.orgUnitId}`;
+        }
+        if (resolver.type === 'ORG_UNIT_POSITION') {
+            return `orgUnitPosition:${resolver.orgUnitId}:${resolver.positionId}`;
+        }
+        if (resolver.type === 'ORG_UNIT_MANAGER') {
+            return `orgUnitManager:${resolver.orgUnitId}`;
+        }
+        return readMemberIdFromValue(readManagerMemberIdFromInitiatorSnapshot(input.initiatorMetadataSnapshot, resolver.levelsUp), label);
+    }
+    async getApprovalInstance(id, scope) {
+        const instance = await this.approvalInstanceRepository.findOne({
+            where: { id },
+        });
+        if (!instance) {
+            throw new common_1.NotFoundException(`Approval instance ${id} was not found`);
+        }
+        if (scope &&
+            !canReadAllWorkflows(scope) &&
+            !(await this.isApprovalInstanceReadableByMember(instance, scope.memberId))) {
+            throw new common_1.NotFoundException(`Approval instance ${id} was not found`);
+        }
+        return instance;
+    }
+    async listApprovalInstances(scope, options = {}) {
+        const queryBuilder = await this.createFilteredApprovalInstanceQueryBuilder(scope, options);
+        if (!queryBuilder) {
+            return [];
+        }
+        queryBuilder.orderBy('"approvalInstance"."created_at"', 'DESC');
+        if (shouldPaginateList(options)) {
+            queryBuilder
+                .skip(readPageOffset(options.page, options.pageSize))
+                .take(normalizePageSize(options.pageSize));
+        }
+        return queryBuilder.getMany();
+    }
+    async countApprovalInstances(scope, options = {}) {
+        const queryBuilder = await this.createFilteredApprovalInstanceQueryBuilder(scope, options);
+        return queryBuilder ? queryBuilder.getCount() : 0;
+    }
+    async readApprovalInstancePageInfo(scope, options = {}) {
+        const totalCount = await this.countApprovalInstances(scope, options);
+        const page = normalizePage(options.page);
+        const pageSize = normalizePageSize(options.pageSize);
+        const totalPages = Math.max(Math.ceil(totalCount / pageSize), 1);
+        return {
+            hasNextPage: page < totalPages,
+            hasPreviousPage: page > 1,
+            page,
+            pageSize,
+            totalCount,
+            totalPages,
+        };
+    }
+    async createFilteredApprovalInstanceQueryBuilder(scope, options = {}) {
+        const queryBuilder = this.approvalInstanceRepository.createQueryBuilder('approvalInstance');
+        const hasReadableInstances = this.applyReadableInstanceFilter(queryBuilder, scope, options);
+        if (!hasReadableInstances) {
+            return null;
+        }
+        const templateId = normalizeText(options.templateId);
+        if (options.state?.length) {
+            queryBuilder.andWhere('"approvalInstance"."state" IN (:...states)', {
+                states: [...options.state],
+            });
+        }
+        if (templateId) {
+            queryBuilder.andWhere('"approvalInstance"."template_id" = :templateId', {
+                templateId,
+            });
+        }
+        applyApprovalInstanceSearchFilter(queryBuilder, options.searchText);
+        return queryBuilder;
+    }
+    applyReadableInstanceFilter(queryBuilder, scope, options) {
+        if (!scope) {
+            return true;
+        }
+        const view = options.view ?? workflow_engine_enums_1.ApprovalInstanceListViewEnum.ALL;
+        if (view === workflow_engine_enums_1.ApprovalInstanceListViewEnum.SENT) {
+            queryBuilder.andWhere('"approvalInstance"."initiator_member_id" = :readableMemberId', {
+                readableMemberId: scope.memberId,
+            });
+            return true;
+        }
+        if (view === workflow_engine_enums_1.ApprovalInstanceListViewEnum.CC) {
+            queryBuilder.andWhere(`
+          EXISTS (
+            SELECT 1
+            FROM "notifications" "readableNotification"
+            WHERE "readableNotification"."instance_id" = "approvalInstance"."id"
+              AND "readableNotification"."recipient_member_id" = :readableMemberId
+          )
+        `, {
+                readableMemberId: scope.memberId,
+            });
+            return true;
+        }
+        if (canReadAllWorkflows(scope)) {
+            return true;
+        }
+        queryBuilder.andWhere(`
+        (
+          "approvalInstance"."initiator_member_id" = :readableMemberId
+          OR EXISTS (
+            SELECT 1
+            FROM "tasks" "readableTask"
+            WHERE "readableTask"."instance_id" = "approvalInstance"."id"
+              AND (
+                "readableTask"."assignee_member_id" = :readableMemberId
+                OR "readableTask"."original_assignee_member_id" = :readableMemberId
+              )
+          )
+          OR EXISTS (
+            SELECT 1
+            FROM "task_candidates" "readableCandidate"
+            INNER JOIN "tasks" "readableCandidateTask"
+              ON "readableCandidateTask"."id" = "readableCandidate"."task_id"
+            WHERE "readableCandidateTask"."instance_id" = "approvalInstance"."id"
+              AND (
+                "readableCandidate"."member_id" = :readableMemberId
+                OR "readableCandidate"."original_member_id" = :readableMemberId
+              )
+          )
+          OR EXISTS (
+            SELECT 1
+            FROM "task_decisions" "readableDecision"
+            INNER JOIN "tasks" "readableDecisionTask"
+              ON "readableDecisionTask"."id" = "readableDecision"."task_id"
+            WHERE "readableDecisionTask"."instance_id" = "approvalInstance"."id"
+              AND "readableDecision"."decided_by_member_id" = :readableMemberId
+          )
+        )
+      `, {
+            readableMemberId: scope.memberId,
+        });
+        return true;
+    }
+    async readWorkflowDashboardSummary(scope, options = {}) {
+        const instances = (await this.listApprovalInstances(scope, {
+            view: workflow_engine_enums_1.ApprovalInstanceListViewEnum.ALL,
+        })).filter((instance) => isInstanceWithinRange(instance, options));
+        const instanceIds = instances.map((instance) => instance.id);
+        const openTasks = instanceIds.length
+            ? await this.taskRepository.find({
+                where: {
+                    instanceId: (0, typeorm_2.In)(instanceIds),
+                    status: (0, typeorm_2.In)([workflow_engine_enums_1.TaskStatusEnum.PENDING, workflow_engine_enums_1.TaskStatusEnum.IN_PROGRESS]),
+                },
+            })
+            : [];
+        const now = Date.now();
+        return {
+            activeInstanceCount: instances.filter((instance) => instance.state === workflow_engine_enums_1.ApprovalInstanceStateEnum.RUNNING).length,
+            completedInstanceCount: instances.filter((instance) => instance.state === workflow_engine_enums_1.ApprovalInstanceStateEnum.APPROVED).length,
+            overdueTaskCount: openTasks.filter((task) => task.slaDueAt && task.slaDueAt.getTime() <= now).length,
+            pendingTaskCount: openTasks.length,
+            rejectedInstanceCount: instances.filter((instance) => instance.state === workflow_engine_enums_1.ApprovalInstanceStateEnum.REJECTED).length,
+            totalInstanceCount: instances.length,
+        };
+    }
+    async listLaunchableApprovalTemplates(memberId) {
+        const templates = await this.approvalTemplateRepository.find({
+            order: { updatedAt: 'DESC' },
+        });
+        const currentVersionIds = templates
+            .map((template) => template.currentVersionId)
+            .filter((versionId) => Boolean(versionId));
+        if (!currentVersionIds.length) {
+            return [];
+        }
+        const versions = await this.approvalTemplateVersionRepository.find({
+            where: {
+                id: (0, typeorm_2.In)(currentVersionIds),
+                status: template_enums_1.ApprovalTemplateVersionStatusEnum.PUBLISHED,
+            },
+        });
+        const versionById = new Map(versions.map((version) => [
+            version.id,
+            version,
+        ]));
+        const initiatorMetadataSnapshot = await this.readDefaultInitiatorMetadataSnapshot(memberId);
+        return templates.filter((template) => {
+            const currentVersion = template.currentVersionId
+                ? (versionById.get(template.currentVersionId) ?? null)
+                : null;
+            if (!currentVersion?.formDefinitionVersionId) {
+                return false;
+            }
+            return this.conditionService.evaluateBoolean(currentVersion.initiatorPolicyCel, buildInitiatorPolicyContext(initiatorMetadataSnapshot), 'initiatorPolicyCel');
+        });
+    }
+    async listWorkflowTokens(instanceId, scope) {
+        await this.getApprovalInstance(instanceId, scope);
+        return this.workflowTokenRepository.find({
+            order: { createdAt: 'ASC' },
+            where: { instanceId },
+        });
+    }
+    async listTasks(instanceId, scope) {
+        await this.getApprovalInstance(instanceId, scope);
+        return this.attachTaskCandidateSummaries(await this.taskRepository.find({
+            order: { createdAt: 'ASC' },
+            where: { instanceId },
+        }));
+    }
+    async listInboxTasks(assigneeMemberId) {
+        const directTasks = await this.taskRepository.find({
+            order: { createdAt: 'DESC' },
+            where: [
+                {
+                    assigneeMemberId,
+                    status: (0, typeorm_2.In)([workflow_engine_enums_1.TaskStatusEnum.PENDING, workflow_engine_enums_1.TaskStatusEnum.IN_PROGRESS]),
+                },
+            ],
+        });
+        const candidateRows = await this.taskCandidateRepository.find({
+            where: {
+                memberId: assigneeMemberId,
+                status: (0, typeorm_2.In)([
+                    workflow_engine_enums_1.TaskCandidateStatusEnum.PENDING,
+                    workflow_engine_enums_1.TaskCandidateStatusEnum.CLAIMED,
+                ]),
+            },
+        });
+        const candidateTasks = candidateRows.length
+            ? await this.taskRepository.find({
+                order: { createdAt: 'DESC' },
+                where: {
+                    id: (0, typeorm_2.In)(candidateRows.map((candidate) => candidate.taskId)),
+                    status: (0, typeorm_2.In)([workflow_engine_enums_1.TaskStatusEnum.PENDING, workflow_engine_enums_1.TaskStatusEnum.IN_PROGRESS]),
+                },
+            })
+            : [];
+        return this.attachTaskCandidateSummaries(uniqueTasksById([...directTasks, ...candidateTasks]));
+    }
+    async listApprovalHistoryTasks(assigneeMemberId) {
+        const directTasks = await this.taskRepository.find({
+            order: { completedAt: 'DESC', createdAt: 'DESC' },
+            take: DEFAULT_APPROVAL_HISTORY_TASK_LIMIT,
+            where: { assigneeMemberId, status: workflow_engine_enums_1.TaskStatusEnum.COMPLETED },
+        });
+        const candidateRows = await this.taskCandidateRepository.find({
+            where: {
+                memberId: assigneeMemberId,
+                status: workflow_engine_enums_1.TaskCandidateStatusEnum.COMPLETED,
+            },
+        });
+        const candidateTasks = candidateRows.length
+            ? await this.taskRepository.find({
+                order: { completedAt: 'DESC', createdAt: 'DESC' },
+                take: DEFAULT_APPROVAL_HISTORY_TASK_LIMIT,
+                where: {
+                    id: (0, typeorm_2.In)(candidateRows.map((candidate) => candidate.taskId)),
+                    status: workflow_engine_enums_1.TaskStatusEnum.COMPLETED,
+                },
+            })
+            : [];
+        return this.attachTaskCandidateSummaries(uniqueTasksById([...directTasks, ...candidateTasks]));
+    }
+    async listTaskDecisions(taskId, scope) {
+        await this.assertTaskReadable(taskId, scope);
+        return this.taskDecisionRepository.find({
+            order: { decidedAt: 'ASC' },
+            where: { taskId },
+        });
+    }
+    async listTaskCandidates(taskId, scope) {
+        await this.assertTaskReadable(taskId, scope);
+        return this.taskCandidateRepository.find({
+            order: { createdAt: 'ASC', id: 'ASC' },
+            where: { taskId },
+        });
+    }
+    async attachTaskCandidateSummaries(tasks) {
+        if (!tasks.length) {
+            return tasks;
+        }
+        const candidates = await this.taskCandidateRepository.find({
+            order: { createdAt: 'ASC', id: 'ASC' },
+            where: { taskId: (0, typeorm_2.In)(tasks.map((task) => task.id)) },
+        });
+        const candidatesByTaskId = candidates.reduce((currentMap, candidate) => {
+            const nextMap = new Map(currentMap);
+            const memberIds = nextMap.get(candidate.taskId) ?? [];
+            nextMap.set(candidate.taskId, [...memberIds, candidate.memberId]);
+            return nextMap;
+        }, new Map());
+        return tasks.map((task) => Object.assign(new task_entity_1.TaskEntity(), task, {
+            candidateMemberIds: candidatesByTaskId.get(task.id) ?? [],
+        }));
+    }
+    async readDefaultInitiatorMetadataSnapshot(memberId) {
+        const today = toDateOnlyString(new Date());
+        const memberships = (await this.approvalInstanceRepository.manager
+            .getRepository(membership_entity_1.MembershipEntity)
+            .find({ where: { memberId } }))
+            .filter((membership) => isDateRangeActive(membership, today))
+            .sort(compareMembership);
+        const primaryMembership = memberships[0] ?? null;
+        const positionIds = uniqueTexts(memberships
+            .map((membership) => membership.positionId)
+            .filter((positionId) => Boolean(positionId)));
+        return {
+            customFields: {},
+            memberId,
+            orgUnitIds: uniqueTexts(memberships.map((membership) => membership.orgUnitId)),
+            positionId: primaryMembership?.positionId ?? null,
+            positionIds,
+            primaryOrgUnitId: primaryMembership?.orgUnitId ?? null,
+        };
+    }
+    async listActivityLogs(instanceId, scope) {
+        await this.getApprovalInstance(instanceId, scope);
+        return this.activityLogRepository.find({
+            order: { createdAt: 'ASC' },
+            where: { instanceId },
+        });
+    }
+    async assertTaskReadable(taskId, scope) {
+        const task = await this.taskRepository.findOne({ where: { id: taskId } });
+        if (!task) {
+            throw new common_1.NotFoundException(`Task ${taskId} was not found`);
+        }
+        await this.getApprovalInstance(task.instanceId, scope);
+        return task;
+    }
+    async isApprovalInstanceReadableByMember(instance, memberId) {
+        if (instance.initiatorMemberId === memberId) {
+            return true;
+        }
+        const tasks = await this.taskRepository.find({
+            where: { instanceId: instance.id },
+        });
+        if (tasks.some((task) => isTaskRelatedToMember(task, memberId))) {
+            return true;
+        }
+        const taskIds = tasks.map((task) => task.id);
+        if (!taskIds.length) {
+            return false;
+        }
+        const candidates = await this.taskCandidateRepository.find({
+            where: { taskId: (0, typeorm_2.In)(taskIds) },
+        });
+        if (candidates.some((candidate) => candidate.memberId === memberId ||
+            candidate.originalMemberId === memberId)) {
+            return true;
+        }
+        const decisions = await this.taskDecisionRepository.find({
+            where: { taskId: (0, typeorm_2.In)(taskIds) },
+        });
+        if (decisions.some((decision) => decision.decidedByMemberId === memberId)) {
+            return true;
+        }
+        // Members who received any notification for this instance (e.g. ad-hoc
+        // stage / completion notify recipients, CC'd service-task recipients) may
+        // open the instance they were notified about.
+        const notification = await this.notificationRepository.findOne({
+            where: { instanceId: instance.id, recipientMemberId: memberId },
+        });
+        return Boolean(notification);
+    }
+    async processActiveToken(manager, instance, token) {
+        const node = readWorkflowNodeOrThrow(instance.workflowSnapshot, token.currentNodeId);
+        if (!(await this.isNodeEntryReady(manager, instance, token, node))) {
+            return;
+        }
+        if (!this.isNodeEntryConditionMet(instance, node)) {
+            await this.skipNodeByEntryCondition(manager, instance, token, node);
+            return;
+        }
+        if (node.type === 'startEvent') {
+            await this.advanceTokenToOutgoingNodes(manager, instance, token, node);
+            return;
+        }
+        if (node.type === 'endEvent') {
+            await this.completeTokenAtEndNode(manager, instance, token, node);
+            return;
+        }
+        if (node.type === 'userTask') {
+            await this.createUserTaskForToken(manager, instance, token, node);
+            return;
+        }
+        if (node.type === 'serviceTask') {
+            await this.executeServiceTask(manager, instance, token, node);
+            return;
+        }
+        if (node.type === 'exclusiveGateway') {
+            await this.processExclusiveGateway(manager, instance, token, node);
+            return;
+        }
+        if (node.type === 'parallelGateway') {
+            await this.advanceTokenToOutgoingNodes(manager, instance, token, node);
+            return;
+        }
+        return;
+    }
+    async processRunningInstance(manager, instance) {
+        for (let step = 0; step < MAX_PROCESSING_STEPS; step += 1) {
+            const token = await manager.getRepository(workflow_token_entity_1.WorkflowTokenEntity).findOne({
+                order: { createdAt: 'ASC' },
+                where: {
+                    instanceId: instance.id,
+                    status: workflow_engine_enums_1.WorkflowTokenStatusEnum.ACTIVE,
+                },
+            });
+            if (!token) {
+                await this.completeInstanceIfNoOpenRuntimeState(manager, instance);
+                return;
+            }
+            await this.processActiveToken(manager, instance, token);
+        }
+        throw new common_1.ConflictException(`Approval instance ${instance.id} exceeded maximum processing steps`);
+    }
+    async completeInstanceIfNoOpenRuntimeState(manager, instance) {
+        if (instance.state !== workflow_engine_enums_1.ApprovalInstanceStateEnum.RUNNING) {
+            return;
+        }
+        const waitingTokens = await manager
+            .getRepository(workflow_token_entity_1.WorkflowTokenEntity)
+            .find({
+            where: {
+                instanceId: instance.id,
+                status: workflow_engine_enums_1.WorkflowTokenStatusEnum.WAITING,
+            },
+        });
+        if (waitingTokens.length > 0) {
+            return;
+        }
+        const completedAt = new Date();
+        const completedInstance = await manager
+            .getRepository(approval_instance_entity_1.ApprovalInstanceEntity)
+            .save({
+            ...instance,
+            completedAt,
+            state: workflow_engine_enums_1.ApprovalInstanceStateEnum.APPROVED,
+        });
+        await this.notificationService.createInstanceCompletedNotification({
+            instance: completedInstance,
+            manager,
+        });
+        await this.dispatchAdhocCompletionNotifications(manager, completedInstance, workflow_engine_enums_1.ApprovalInstanceStateEnum.APPROVED);
+        await this.cancelPendingAdhocDirectives(manager, instance.id, null);
+    }
+    async isNodeEntryReady(manager, instance, token, node) {
+        if (node.type === 'startEvent') {
+            return true;
+        }
+        const incomingEdges = readIncomingEdges(instance.workflowSnapshot, node.id);
+        if (incomingEdges.length < 2) {
+            return true;
+        }
+        const tokenRepository = manager.getRepository(workflow_token_entity_1.WorkflowTokenEntity);
+        const activityRepository = manager.getRepository(activity_log_entity_1.ActivityLogEntity);
+        const activeOrWaitingTokens = (await tokenRepository.find({
+            where: { instanceId: instance.id },
+        })).filter((candidate) => candidate.currentNodeId === node.id &&
+            (candidate.status === workflow_engine_enums_1.WorkflowTokenStatusEnum.ACTIVE ||
+                candidate.status === workflow_engine_enums_1.WorkflowTokenStatusEnum.WAITING));
+        const arrivedTokens = activeOrWaitingTokens.some((candidate) => candidate.id === token.id)
+            ? activeOrWaitingTokens
+            : [...activeOrWaitingTokens, token];
+        if ((node.data.triggerMode ?? 'AND') === 'OR') {
+            await this.cancelAlternativeTokensForOrTrigger(manager, instance, token, node.id);
+            await this.consumeJoinedTokens(manager, arrivedTokens.filter((candidate) => candidate.id !== token.id));
+            return true;
+        }
+        const pendingTokensThatMayReachNode = (await tokenRepository.find({
+            where: { instanceId: instance.id },
+        })).filter((candidate) => candidate.id !== token.id &&
+            !arrivedTokens.some((arrivedToken) => arrivedToken.id === candidate.id) &&
+            (candidate.status === workflow_engine_enums_1.WorkflowTokenStatusEnum.ACTIVE ||
+                candidate.status === workflow_engine_enums_1.WorkflowTokenStatusEnum.WAITING) &&
+            hasPathToNode(instance.workflowSnapshot, candidate.currentNodeId, node.id));
+        if (arrivedTokens.length < incomingEdges.length &&
+            pendingTokensThatMayReachNode.length > 0) {
+            await tokenRepository.save({
+                ...token,
+                status: workflow_engine_enums_1.WorkflowTokenStatusEnum.WAITING,
+            });
+            await activityRepository.save(activityRepository.create({
+                actorMemberId: null,
+                eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TOKEN_ADVANCED,
+                instanceId: instance.id,
+                nodeId: node.id,
+                payload: {
+                    arrivedCount: arrivedTokens.length,
+                    requiredCount: incomingEdges.length,
+                    tokenId: token.id,
+                    triggerMode: 'AND',
+                },
+                taskId: null,
+            }));
+            return false;
+        }
+        await this.consumeJoinedTokens(manager, arrivedTokens.filter((candidate) => candidate.id !== token.id));
+        return true;
+    }
+    async advanceTokenToOutgoingNodes(manager, instance, token, node) {
+        const edges = await this.readAvailableOutgoingEdges(manager, instance, node);
+        if (edges.length === 1) {
+            await this.advanceTokenAlongEdge(manager, instance, token, node, edges[0]);
+            return;
+        }
+        await this.forkTokenAlongEdges(manager, instance, token, node, edges);
+    }
+    isNodeEntryConditionMet(instance, node) {
+        const entryCondition = readNodeEntryCondition(node);
+        return this.conditionService.evaluateBoolean(entryCondition, buildWorkflowExpressionContext(instance), `workflow.nodes.${node.id}.data.entryCondition`);
+    }
+    async skipNodeByEntryCondition(manager, instance, token, node) {
+        await manager.getRepository(activity_log_entity_1.ActivityLogEntity).save(manager.getRepository(activity_log_entity_1.ActivityLogEntity).create({
+            actorMemberId: null,
+            eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TOKEN_ADVANCED,
+            instanceId: instance.id,
+            nodeId: node.id,
+            payload: {
+                skippedByEntryCondition: true,
+                tokenId: token.id,
+            },
+            taskId: null,
+        }));
+        await this.advanceTokenToOutgoingNodes(manager, instance, token, node);
+    }
+    async readAvailableOutgoingEdges(manager, instance, node) {
+        const outgoingEdges = readOutgoingEdgesOrThrow(instance.workflowSnapshot, node.id);
+        const conditionalEdges = outgoingEdges.filter((edge) => !edge.data.isDefault && edgeHasCondition(edge));
+        if (conditionalEdges.length === 0) {
+            return outgoingEdges;
+        }
+        const matchingEdges = (await Promise.all(conditionalEdges.map(async (edge) => (await this.evaluateWorkflowEdge(manager, instance, node, edge))
+            ? edge
+            : null))).filter((edge) => edge !== null);
+        if (matchingEdges.length > 0) {
+            return node.type === 'exclusiveGateway'
+                ? [matchingEdges[0]]
+                : matchingEdges;
+        }
+        const defaultEdges = outgoingEdges.filter((edge) => edge.data.isDefault);
+        if (defaultEdges.length > 0) {
+            return node.type === 'exclusiveGateway'
+                ? [defaultEdges[0]]
+                : defaultEdges;
+        }
+        throw new common_1.ConflictException(`Workflow node ${node.id} has no matching outgoing edge`);
+    }
+    async evaluateWorkflowEdge(manager, instance, node, edge) {
+        const expression = edge.data.condition?.trim();
+        if (expression) {
+            return this.conditionService.evaluateBoolean(expression, {
+                ...buildWorkflowExpressionContext(instance),
+                lastDecision: await this.readLastDecisionContext(manager, instance.id, node.id),
+            }, `workflow.edges.${edge.id}.data.condition`);
+        }
+        return (0, workflow_condition_evaluator_1.evaluateWorkflowEdgeCondition)(edge, { formData: instance.formData });
+    }
+    async readLastDecisionContext(manager, instanceId, nodeId) {
+        const tasks = await manager.getRepository(task_entity_1.TaskEntity).find({
+            where: { instanceId, nodeId },
+        });
+        const taskIds = tasks.map((task) => task.id);
+        if (taskIds.length === 0) {
+            return null;
+        }
+        const decision = (await manager.getRepository(task_decision_entity_1.TaskDecisionEntity).find({
+            order: { decidedAt: 'DESC' },
+            where: { taskId: (0, typeorm_2.In)(taskIds) },
+        }))[0];
+        if (!decision) {
+            return null;
+        }
+        return {
+            action: decision.action,
+            comment: decision.comment,
+            decidedAt: decision.decidedAt.toISOString(),
+            decidedByMemberId: decision.decidedByMemberId,
+            returnToNodeId: decision.returnToNodeId,
+            taskId: decision.taskId,
+            transferToMemberId: decision.transferToMemberId,
+        };
+    }
+    async advanceTokenAlongEdge(manager, instance, token, node, edge) {
+        const tokenRepository = manager.getRepository(workflow_token_entity_1.WorkflowTokenEntity);
+        const activityRepository = manager.getRepository(activity_log_entity_1.ActivityLogEntity);
+        const nextToken = await tokenRepository.save({
+            ...token,
+            currentNodeId: edge.target,
+        });
+        await activityRepository.save(activityRepository.create({
+            actorMemberId: null,
+            eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TOKEN_ADVANCED,
+            instanceId: instance.id,
+            nodeId: edge.target,
+            payload: {
+                edgeId: edge.id,
+                fromNodeId: node.id,
+                tokenId: nextToken.id,
+                toNodeId: edge.target,
+            },
+            taskId: null,
+        }));
+    }
+    async forkTokenAlongEdges(manager, instance, token, node, edges) {
+        const forkedAt = new Date();
+        const tokenRepository = manager.getRepository(workflow_token_entity_1.WorkflowTokenEntity);
+        const activityRepository = manager.getRepository(activity_log_entity_1.ActivityLogEntity);
+        await tokenRepository.save({
+            ...token,
+            consumedAt: forkedAt,
+            status: workflow_engine_enums_1.WorkflowTokenStatusEnum.CONSUMED,
+        });
+        const childTokens = await tokenRepository.save(edges.map((edge) => tokenRepository.create({
+            consumedAt: null,
+            currentNodeId: edge.target,
+            instanceId: instance.id,
+            parentTokenId: token.id,
+            status: workflow_engine_enums_1.WorkflowTokenStatusEnum.ACTIVE,
+        })));
+        await activityRepository.save([
+            activityRepository.create({
+                actorMemberId: null,
+                eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TOKEN_ADVANCED,
+                instanceId: instance.id,
+                nodeId: node.id,
+                payload: {
+                    edgeIds: edges.map((edge) => edge.id),
+                    fromNodeId: node.id,
+                    tokenId: token.id,
+                    toNodeIds: edges.map((edge) => edge.target),
+                },
+                taskId: null,
+            }),
+            ...childTokens.map((childToken, index) => activityRepository.create({
+                actorMemberId: null,
+                eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TOKEN_CREATED,
+                instanceId: instance.id,
+                nodeId: childToken.currentNodeId,
+                payload: {
+                    edgeId: edges[index]?.id,
+                    parentTokenId: token.id,
+                    tokenId: childToken.id,
+                },
+                taskId: null,
+            })),
+        ]);
+    }
+    async completeTokenAtEndNode(manager, instance, token, node) {
+        const completedAt = new Date();
+        const tokenRepository = manager.getRepository(workflow_token_entity_1.WorkflowTokenEntity);
+        const instanceRepository = manager.getRepository(approval_instance_entity_1.ApprovalInstanceEntity);
+        const activityRepository = manager.getRepository(activity_log_entity_1.ActivityLogEntity);
+        const endState = node.data.endState ?? 'APPROVED';
+        const instanceState = endState === 'REJECTED'
+            ? workflow_engine_enums_1.ApprovalInstanceStateEnum.REJECTED
+            : workflow_engine_enums_1.ApprovalInstanceStateEnum.APPROVED;
+        await tokenRepository.save({
+            ...token,
+            consumedAt: completedAt,
+            status: workflow_engine_enums_1.WorkflowTokenStatusEnum.CONSUMED,
+        });
+        const hasOpenToken = (await tokenRepository.find({
+            where: { instanceId: instance.id },
+        })).some((candidate) => candidate.id !== token.id &&
+            (candidate.status === workflow_engine_enums_1.WorkflowTokenStatusEnum.ACTIVE ||
+                candidate.status === workflow_engine_enums_1.WorkflowTokenStatusEnum.WAITING));
+        if (!hasOpenToken) {
+            const completedInstance = await instanceRepository.save({
+                ...instance,
+                completedAt,
+                state: instanceState,
+            });
+            if (instanceState === workflow_engine_enums_1.ApprovalInstanceStateEnum.APPROVED) {
+                await this.notificationService.createInstanceCompletedNotification({
+                    instance: completedInstance,
+                    manager,
+                });
+            }
+            await this.dispatchAdhocCompletionNotifications(manager, completedInstance, instanceState);
+            await this.cancelPendingAdhocDirectives(manager, instance.id, null);
+        }
+        await activityRepository.save(activityRepository.create({
+            actorMemberId: null,
+            eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TOKEN_ADVANCED,
+            instanceId: instance.id,
+            nodeId: node.id,
+            payload: {
+                endState,
+                instanceState,
+                tokenId: token.id,
+            },
+            taskId: null,
+        }));
+    }
+    async createUserTaskForToken(manager, instance, token, node) {
+        const taskRepository = manager.getRepository(task_entity_1.TaskEntity);
+        const taskCandidateRepository = manager.getRepository(task_candidate_entity_1.TaskCandidateEntity);
+        const tokenRepository = manager.getRepository(workflow_token_entity_1.WorkflowTokenEntity);
+        const activityRepository = manager.getRepository(activity_log_entity_1.ActivityLogEntity);
+        const existingTask = await taskRepository.findOne({
+            where: {
+                isAdhoc: false,
+                nodeId: node.id,
+                tokenId: token.id,
+            },
+        });
+        if (existingTask) {
+            await tokenRepository.save({
+                ...token,
+                status: workflow_engine_enums_1.WorkflowTokenStatusEnum.WAITING,
+            });
+            return;
+        }
+        const candidates = await this.resolveRuntimeTaskCandidates(manager, instance, node);
+        const primaryCandidate = candidates[0];
+        const now = new Date();
+        const task = await taskRepository.save(taskRepository.create({
+            assigneeMemberId: candidates.length === 1 ? primaryCandidate.memberId : null,
+            assignmentType: candidates.length === 1
+                ? workflow_engine_enums_1.TaskAssignmentTypeEnum.DIRECT_MEMBER
+                : workflow_engine_enums_1.TaskAssignmentTypeEnum.CANDIDATE_GROUP,
+            completedAt: null,
+            createdAt: now,
+            decisionPolicySnapshot: node.data.decisionPolicy,
+            delegationChain: candidates.length === 1 ? primaryCandidate.delegationChain : [],
+            instanceId: instance.id,
+            nodeId: node.id,
+            openedAt: null,
+            originalAssigneeMemberId: candidates.length === 1 ? primaryCandidate.originalMemberId : null,
+            slaDueAt: (0, notification_service_1.calculateTaskSlaDueAt)({ node, now }),
+            status: workflow_engine_enums_1.TaskStatusEnum.PENDING,
+            tokenId: token.id,
+        }));
+        const savedCandidates = await taskCandidateRepository.save(candidates.map((candidate) => taskCandidateRepository.create({
+            claimedAt: null,
+            createdAt: now,
+            decidedAt: null,
+            delegationChain: candidate.delegationChain,
+            memberId: candidate.memberId,
+            originalMemberId: candidate.originalMemberId,
+            sourceType: candidate.sourceType,
+            status: workflow_engine_enums_1.TaskCandidateStatusEnum.PENDING,
+            taskId: task.id,
+        })));
+        task.candidateMemberIds = savedCandidates.map((candidate) => candidate.memberId);
+        const singleCandidate = savedCandidates.length === 1 ? savedCandidates[0] : null;
+        await tokenRepository.save({
+            ...token,
+            status: workflow_engine_enums_1.WorkflowTokenStatusEnum.WAITING,
+        });
+        await activityRepository.save(activityRepository.create({
+            actorMemberId: null,
+            eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TASK_CREATED,
+            instanceId: instance.id,
+            nodeId: node.id,
+            payload: {
+                assignmentType: task.assignmentType,
+                assigneeMemberId: singleCandidate?.memberId ?? null,
+                candidateMemberIds: savedCandidates.map((candidate) => candidate.memberId),
+                originalAssigneeMemberId: singleCandidate?.originalMemberId ?? null,
+                tokenId: token.id,
+            },
+            taskId: task.id,
+        }));
+        await savedCandidates.reduce(async (previous, candidate) => {
+            await previous;
+            await this.notificationService.createTaskAssignedNotification({
+                instance,
+                manager,
+                node,
+                task: Object.assign(new task_entity_1.TaskEntity(), task, {
+                    assigneeMemberId: candidate.memberId,
+                    delegationChain: candidate.delegationChain,
+                    originalAssigneeMemberId: candidate.originalMemberId,
+                }),
+            });
+        }, Promise.resolve());
+        // Pending ad-hoc countersign directives attach to the next user task
+        // created after they were requested — spawn their parallel tasks now.
+        await this.spawnCountersignTasksForNode(manager, instance, token, node, now);
+    }
+    async markTaskCandidateDecision({ action, candidate, candidates, decidedAt, manager, task, }) {
+        const taskCandidateRepository = manager.getRepository(task_candidate_entity_1.TaskCandidateEntity);
+        if (!candidate && candidates.length === 0 && task.assigneeMemberId) {
+            const legacyCandidate = await taskCandidateRepository.save(taskCandidateRepository.create({
+                claimedAt: task.openedAt ?? decidedAt,
+                createdAt: task.createdAt,
+                decidedAt,
+                delegationChain: task.delegationChain,
+                memberId: task.assigneeMemberId,
+                originalMemberId: task.originalAssigneeMemberId ?? task.assigneeMemberId,
+                sourceType: 'DIRECT',
+                status: workflow_engine_enums_1.TaskCandidateStatusEnum.COMPLETED,
+                taskId: task.id,
+            }));
+            return [legacyCandidate];
+        }
+        const completedCandidate = candidate
+            ? Object.assign(new task_candidate_entity_1.TaskCandidateEntity(), candidate, {
+                claimedAt: candidate.claimedAt ?? decidedAt,
+                decidedAt,
+                status: workflow_engine_enums_1.TaskCandidateStatusEnum.COMPLETED,
+            })
+            : null;
+        const decisionPolicy = readDecisionPolicySnapshot(task);
+        const shouldCancelOpenCandidates = action !== workflow_engine_enums_1.TaskDecisionActionEnum.APPROVED ||
+            decisionPolicy.type === 'SINGLE' ||
+            decisionPolicy.type === 'PARALLEL_ANY';
+        const nextCandidates = candidates.map((currentCandidate) => {
+            if (currentCandidate.id === completedCandidate?.id) {
+                return completedCandidate;
+            }
+            if (shouldCancelOpenCandidates &&
+                (currentCandidate.status === workflow_engine_enums_1.TaskCandidateStatusEnum.PENDING ||
+                    currentCandidate.status === workflow_engine_enums_1.TaskCandidateStatusEnum.CLAIMED)) {
+                return Object.assign(new task_candidate_entity_1.TaskCandidateEntity(), currentCandidate, {
+                    decidedAt,
+                    status: workflow_engine_enums_1.TaskCandidateStatusEnum.CANCELLED,
+                });
+            }
+            return currentCandidate;
+        });
+        if (nextCandidates.length > 0) {
+            await taskCandidateRepository.save(nextCandidates);
+        }
+        return nextCandidates;
+    }
+    async transferTask(manager, instance, task, decision, signature, transferToMemberId, decisionComment, decidedAt, actorCandidate) {
+        if (!transferToMemberId) {
+            throw new common_1.BadRequestException('Transfer target member is required');
+        }
+        const taskRepository = manager.getRepository(task_entity_1.TaskEntity);
+        const taskCandidateRepository = manager.getRepository(task_candidate_entity_1.TaskCandidateEntity);
+        const activityRepository = manager.getRepository(activity_log_entity_1.ActivityLogEntity);
+        const transferringMemberId = task.assigneeMemberId;
+        if (!transferringMemberId) {
+            throw new common_1.ConflictException('Task must be claimed before transfer');
+        }
+        const nextDelegationChain = [
+            ...readDelegationSteps(task.delegationChain),
+            {
+                from: transferringMemberId,
+                reason: 'MANUAL_TRANSFER',
+                ruleId: null,
+                to: transferToMemberId,
+            },
+        ];
+        const transferredTask = await taskRepository.save({
+            ...task,
+            completedAt: decidedAt,
+            delegationChain: nextDelegationChain,
+            status: workflow_engine_enums_1.TaskStatusEnum.TRANSFERRED,
+        });
+        const nextTask = await taskRepository.save(taskRepository.create({
+            assigneeMemberId: transferToMemberId,
+            assignmentType: workflow_engine_enums_1.TaskAssignmentTypeEnum.DIRECT_MEMBER,
+            completedAt: null,
+            decisionPolicySnapshot: { type: 'SINGLE' },
+            delegationChain: nextDelegationChain,
+            instanceId: task.instanceId,
+            nodeId: task.nodeId,
+            openedAt: null,
+            originalAssigneeMemberId: task.originalAssigneeMemberId,
+            slaDueAt: task.slaDueAt,
+            status: workflow_engine_enums_1.TaskStatusEnum.PENDING,
+            tokenId: task.tokenId,
+        }));
+        await taskCandidateRepository.save([
+            ...(actorCandidate
+                ? [
+                    taskCandidateRepository.create({
+                        ...actorCandidate,
+                        decidedAt,
+                        status: workflow_engine_enums_1.TaskCandidateStatusEnum.TRANSFERRED,
+                    }),
+                ]
+                : []),
+            taskCandidateRepository.create({
+                claimedAt: null,
+                createdAt: decidedAt,
+                decidedAt: null,
+                delegationChain: nextDelegationChain,
+                memberId: transferToMemberId,
+                originalMemberId: task.originalAssigneeMemberId ?? transferToMemberId,
+                sourceType: 'DIRECT',
+                status: workflow_engine_enums_1.TaskCandidateStatusEnum.PENDING,
+                taskId: nextTask.id,
+            }),
+        ]);
+        await activityRepository.save([
+            activityRepository.create({
+                actorMemberId: task.assigneeMemberId,
+                eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TASK_DECIDED,
+                instanceId: instance.id,
+                nodeId: task.nodeId,
+                payload: {
+                    action: workflow_engine_enums_1.TaskDecisionActionEnum.TRANSFERRED,
+                    comment: decisionComment,
+                    decisionId: decision.id,
+                    signatureId: signature.id,
+                    signedPayloadHash: signature.signedPayloadHash,
+                    transferToMemberId,
+                },
+                taskId: transferredTask.id,
+            }),
+            activityRepository.create({
+                actorMemberId: transferringMemberId,
+                eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TASK_CREATED,
+                instanceId: instance.id,
+                nodeId: task.nodeId,
+                payload: {
+                    assigneeMemberId: transferToMemberId,
+                    delegationChain: nextDelegationChain,
+                    originalAssigneeMemberId: task.originalAssigneeMemberId,
+                    tokenId: task.tokenId,
+                    transferredFromTaskId: task.id,
+                },
+                taskId: nextTask.id,
+            }),
+        ]);
+        const node = readWorkflowNodeOrThrow(instance.workflowSnapshot, task.nodeId);
+        if (node.type === 'userTask') {
+            await this.notificationService.createTaskAssignedNotification({
+                instance,
+                manager,
+                node,
+                task: nextTask,
+                transferred: true,
+            });
+        }
+    }
+    async resolveRuntimeTaskCandidates(manager, instance, node) {
+        const resolvedCandidates = await this.resolveApproverResolver(manager, instance, node.data.approverResolver, `簽核節點「${node.data.label}」`);
+        const uniqueCandidates = await this.applyDelegationToResolvedCandidates(instance, node.id, resolvedCandidates);
+        if (uniqueCandidates.length === 0) {
+            throw new common_1.ConflictException(`簽核節點「${node.data.label}」 did not resolve to any member id`);
+        }
+        return uniqueCandidates;
+    }
+    async applyDelegationToResolvedCandidates(instance, nodeId, resolvedCandidates) {
+        const context = {
+            formData: instance.formData,
+            initiatorMemberId: instance.initiatorMemberId,
+            initiatorMetadataSnapshot: instance.initiatorMetadataSnapshot,
+            instanceId: instance.id,
+            nodeId,
+            state: instance.state,
+            templateId: instance.templateId,
+            templateVersionId: instance.templateVersionId,
+            title: instance.title,
+        };
+        const delegatedCandidates = await Promise.all(resolvedCandidates.map(async (candidate) => {
+            const delegationResolution = await this.delegationService.resolveAssignee(candidate.memberId, context);
+            return {
+                delegationChain: delegationResolution.delegationChain,
+                memberId: delegationResolution.finalAssigneeMemberId,
+                originalMemberId: candidate.memberId,
+                sourceType: candidate.sourceType,
+            };
+        }));
+        return uniqueRuntimeCandidates(delegatedCandidates);
+    }
+    async resolveApproverResolver(manager, instance, resolver, label) {
+        if (resolver.type === 'DIRECT') {
+            return readMemberIdsFromValue(resolver.memberIds, label).map((memberId) => ({ memberId, sourceType: resolver.type }));
+        }
+        if (resolver.type === 'DYNAMIC_FORM') {
+            return readMemberIdsFromValue(readValueAtPath(instance.formData, resolver.formPath), `${label}.formPath`).map((memberId) => ({ memberId, sourceType: resolver.type }));
+        }
+        if (resolver.type === 'EXPRESSION') {
+            return readMemberIdsFromValue(this.conditionService.evaluateValue(resolver.expression, buildWorkflowExpressionContext(instance), `${label}.expression`), `${label}.expression`).map((memberId) => ({ memberId, sourceType: resolver.type }));
+        }
+        if (resolver.type === 'POSITION') {
+            return this.resolvePositionCandidates(manager, resolver.positionId, label).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
+        }
+        if (resolver.type === 'ORG_UNIT_MEMBER') {
+            return this.resolveOrgUnitMemberCandidates(manager, resolver.orgUnitId, Boolean(resolver.includeDescendants), label).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
+        }
+        if (resolver.type === 'ORG_UNIT_POSITION') {
+            return this.resolveOrgUnitPositionCandidates(manager, resolver.orgUnitId, resolver.positionId, Boolean(resolver.includeDescendants), label).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
+        }
+        if (resolver.type === 'ORG_UNIT_MANAGER') {
+            return this.resolveOrgUnitManagerCandidates(manager, instance, resolver.orgUnitId, resolver.fallback, label).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
+        }
+        return this.resolveInitiatorManagerCandidates(manager, instance, resolver.levelsUp, resolver.fallback, label).then((memberIds) => memberIds.map((memberId) => ({ memberId, sourceType: resolver.type })));
+    }
+    async resolvePositionCandidates(manager, positionId, label) {
+        const today = toDateOnlyString(new Date());
+        const memberships = await manager.getRepository(membership_entity_1.MembershipEntity).find({
+            where: { positionId },
+        });
+        const activeMemberships = memberships
+            .filter((membership) => membership.effectiveFrom <= today &&
+            (!membership.effectiveTo || membership.effectiveTo >= today))
+            .sort((first, second) => {
+            if (first.isPrimary !== second.isPrimary) {
+                return first.isPrimary ? -1 : 1;
+            }
+            return second.effectiveFrom.localeCompare(first.effectiveFrom);
+        });
+        if (!activeMemberships.length) {
+            throw new common_1.ConflictException(`${label} position ${positionId} has no active membership`);
+        }
+        return uniqueTexts(activeMemberships.map((membership) => membership.memberId));
+    }
+    async resolveInitiatorManagerCandidates(manager, instance, levelsUp, fallback, label) {
+        const normalizedLevelsUp = Math.max(Math.trunc(levelsUp), 1);
+        const resolvedManagerMemberIds = await this.resolveManagerMemberIdsFromOrganization(manager, instance.initiatorMemberId, normalizedLevelsUp);
+        if (resolvedManagerMemberIds.length) {
+            return resolvedManagerMemberIds;
+        }
+        return [
+            this.resolveFallbackAssignee(instance, fallback, label, `找不到發起人的第 ${normalizedLevelsUp} 層主管`),
+        ];
+    }
+    resolveFallbackAssignee(instance, fallback, label, failureReason) {
+        if (!fallback || fallback.type === 'NONE') {
+            throw new common_1.ConflictException(`${label} 無法建立待簽任務：${failureReason}，且未設定改派固定人。請聯絡流程管理員調整主管規則或模板 fallback。`);
+        }
+        if (!fallback.memberId.trim()) {
+            throw new common_1.ConflictException(`${label} 無法建立待簽任務：改派固定人未設定。`);
+        }
+        if (fallback.memberId === instance.initiatorMemberId &&
+            !fallback.allowInitiatorSelfApproval) {
+            throw new common_1.ConflictException(`${label} 無法建立待簽任務：改派固定人是申請人本人，且此節點未允許申請人自簽。`);
+        }
+        return fallback.memberId;
+    }
+    async resolveManagerMemberIdsFromOrganization(manager, memberId, levelsUp) {
+        return this.resolveManagerMemberIdsAtLevel(manager, memberId, toDateOnlyString(new Date()), levelsUp);
+    }
+    async resolveManagerMemberIdsAtLevel(manager, memberId, date, remainingLevels) {
+        const directManagerMemberIds = await this.resolveDirectManagerMemberIds(manager, memberId, date);
+        if (remainingLevels <= 1 || directManagerMemberIds.length === 0) {
+            return directManagerMemberIds;
+        }
+        const nextLevelGroups = await Promise.all(directManagerMemberIds.map((managerMemberId) => this.resolveManagerMemberIdsAtLevel(manager, managerMemberId, date, remainingLevels - 1)));
+        return uniqueTexts(nextLevelGroups.flat());
+    }
+    async resolveDirectManagerMemberIds(manager, memberId, date) {
+        const memberships = await manager.getRepository(membership_entity_1.MembershipEntity).find({
+            where: { memberId },
+        });
+        const activeMemberships = memberships.filter((membership) => isDateRangeActive(membership, date));
+        const directOrgUnitIds = activeMemberships.map((membership) => membership.orgUnitId);
+        const positionIds = activeMemberships
+            .map((membership) => membership.positionId)
+            .filter((positionId) => Boolean(positionId));
+        const orgUnitIds = await this.readOrgUnitAndAncestorIds(manager, directOrgUnitIds);
+        const candidatePairs = [
+            { scopeId: memberId, scopeType: organization_enums_1.ManagerResolutionScopeTypeEnum.MEMBER },
+            ...orgUnitIds.map((scopeId) => ({
+                scopeId,
+                scopeType: organization_enums_1.ManagerResolutionScopeTypeEnum.ORG_UNIT,
+            })),
+            ...positionIds.map((scopeId) => ({
+                scopeId,
+                scopeType: organization_enums_1.ManagerResolutionScopeTypeEnum.POSITION,
+            })),
+        ];
+        return this.resolveManagerResolutionCandidates(manager, candidatePairs, date);
+    }
+    async resolveOrgUnitManagerCandidates(manager, instance, orgUnitId, fallback, label) {
+        const date = toDateOnlyString(new Date());
+        const orgUnitIds = await this.readOrgUnitAndAncestorIds(manager, [
+            orgUnitId,
+        ]);
+        const managerMemberIds = await this.resolveManagerResolutionCandidates(manager, orgUnitIds.map((scopeId) => ({
+            scopeId,
+            scopeType: organization_enums_1.ManagerResolutionScopeTypeEnum.ORG_UNIT,
+        })), date);
+        if (!managerMemberIds.length) {
+            return [
+                this.resolveFallbackAssignee(instance, fallback, label, `找不到指定組織的主管規則`),
+            ];
+        }
+        return managerMemberIds;
+    }
+    async readOrgUnitAndAncestorIds(manager, orgUnitIds) {
+        if (!orgUnitIds.length) {
+            return [];
+        }
+        const orgUnitRepository = manager.getRepository(org_unit_entity_1.OrgUnitEntity);
+        const directOrgUnits = await orgUnitRepository.find({
+            where: { deletedAt: (0, typeorm_2.IsNull)(), id: (0, typeorm_2.In)([...orgUnitIds]) },
+        });
+        const ancestorGroups = await Promise.all(directOrgUnits.map((orgUnit) => orgUnitRepository
+            .createQueryBuilder('orgUnit')
+            .where('orgUnit.deleted_at IS NULL')
+            .andWhere('orgUnit.path @> :path', { path: orgUnit.path })
+            .getMany()));
+        const byId = new Map([...directOrgUnits, ...ancestorGroups.flat()].map((orgUnit) => [orgUnit.id, orgUnit]));
+        return [...byId.keys()];
+    }
+    async resolveManagerResolutionCandidates(manager, candidatePairs, date) {
+        const scopeIds = candidatePairs.map((pair) => pair.scopeId);
+        if (!scopeIds.length) {
+            return [];
+        }
+        const resolutions = await manager
+            .getRepository(manager_resolution_entity_1.ManagerResolutionEntity)
+            .find({
+            where: {
+                scopeId: (0, typeorm_2.In)([...scopeIds]),
+                scopeType: (0, typeorm_2.In)([
+                    organization_enums_1.ManagerResolutionScopeTypeEnum.MEMBER,
+                    organization_enums_1.ManagerResolutionScopeTypeEnum.ORG_UNIT,
+                    organization_enums_1.ManagerResolutionScopeTypeEnum.POSITION,
+                ]),
+            },
+        });
+        const active = resolutions
+            .filter((resolution) => candidatePairs.some((pair) => pair.scopeId === resolution.scopeId &&
+            pair.scopeType === resolution.scopeType))
+            .filter((resolution) => isDateRangeActive(resolution, date))
+            .sort(compareManagerResolution);
+        return uniqueTexts(active.map((resolution) => resolution.managerMemberId));
+    }
+    async resolveOrgUnitMemberCandidates(manager, orgUnitId, includeDescendants, label) {
+        const orgUnitIds = await this.readOrgUnitScopeIds(manager, orgUnitId, includeDescendants);
+        const today = toDateOnlyString(new Date());
+        const memberships = await manager.getRepository(membership_entity_1.MembershipEntity).find({
+            where: { orgUnitId: (0, typeorm_2.In)([...orgUnitIds]) },
+        });
+        const memberIds = memberships
+            .filter((membership) => isDateRangeActive(membership, today))
+            .sort(compareMembership)
+            .map((membership) => membership.memberId);
+        if (memberIds.length === 0) {
+            throw new common_1.ConflictException(`${label} orgUnit ${orgUnitId} has no active member`);
+        }
+        return uniqueTexts(memberIds);
+    }
+    async resolveOrgUnitPositionCandidates(manager, orgUnitId, positionId, includeDescendants, label) {
+        const orgUnitIds = await this.readOrgUnitScopeIds(manager, orgUnitId, includeDescendants);
+        const today = toDateOnlyString(new Date());
+        const memberships = await manager.getRepository(membership_entity_1.MembershipEntity).find({
+            where: { orgUnitId: (0, typeorm_2.In)([...orgUnitIds]), positionId },
+        });
+        const memberIds = memberships
+            .filter((membership) => isDateRangeActive(membership, today))
+            .sort(compareMembership)
+            .map((membership) => membership.memberId);
+        if (memberIds.length === 0) {
+            throw new common_1.ConflictException(`${label} orgUnit ${orgUnitId} and position ${positionId} has no active membership`);
+        }
+        return uniqueTexts(memberIds);
+    }
+    async readOrgUnitScopeIds(manager, orgUnitId, includeDescendants) {
+        const orgUnitRepository = manager.getRepository(org_unit_entity_1.OrgUnitEntity);
+        const orgUnit = await orgUnitRepository.findOne({
+            where: { deletedAt: (0, typeorm_2.IsNull)(), id: orgUnitId },
+        });
+        if (!orgUnit) {
+            throw new common_1.ConflictException(`Org unit ${orgUnitId} was not found`);
+        }
+        if (!includeDescendants) {
+            return [orgUnit.id];
+        }
+        const descendants = await orgUnitRepository
+            .createQueryBuilder('orgUnit')
+            .where('orgUnit.deleted_at IS NULL')
+            .andWhere('orgUnit.path <@ :path', { path: orgUnit.path })
+            .getMany();
+        return uniqueTexts([orgUnit.id, ...descendants.map((unit) => unit.id)]);
+    }
+    async processExclusiveGateway(manager, instance, token, node) {
+        if (node.data.direction !== 'split') {
+            await this.advanceTokenToOutgoingNodes(manager, instance, token, node);
+            return;
+        }
+        const edge = (await this.readAvailableOutgoingEdges(manager, instance, node))[0];
+        await this.advanceTokenAlongEdge(manager, instance, token, node, edge);
+    }
+    async executeServiceTask(manager, instance, token, node) {
+        const activityRepository = manager.getRepository(activity_log_entity_1.ActivityLogEntity);
+        const action = node.data.action;
+        if (action.type === 'WEBHOOK') {
+            const payload = typeof action.payload === 'string' && action.payload.trim()
+                ? this.conditionService.evaluateValue(action.payload, buildWorkflowExpressionContext(instance), `workflow.nodes.${node.id}.data.action.payload`)
+                : {
+                    instance: buildWorkflowExpressionContext(instance).instance,
+                    triggeredAt: new Date().toISOString(),
+                };
+            const result = await executeWebhookServiceAction(this.serviceTaskDispatcher, action, payload);
+            await activityRepository.save(activityRepository.create({
+                actorMemberId: null,
+                eventType: result.ok
+                    ? workflow_engine_enums_1.ActivityLogEventTypeEnum.SERVICE_TASK_EXECUTED
+                    : workflow_engine_enums_1.ActivityLogEventTypeEnum.SERVICE_TASK_FAILED,
+                instanceId: instance.id,
+                nodeId: node.id,
+                payload: {
+                    action: 'WEBHOOK',
+                    error: result.error,
+                    ok: result.ok,
+                    status: result.status,
+                    tokenId: token.id,
+                    url: action.url,
+                },
+                taskId: null,
+            }));
+            await this.advanceTokenToOutgoingNodes(manager, instance, token, node);
+            return;
+        }
+        if (action.type === 'SET_FORM_FIELD') {
+            const value = this.conditionService.evaluateValue(action.value, buildWorkflowExpressionContext(instance), `workflow.nodes.${node.id}.data.action.value`);
+            const updatedFormData = writeValueAtPath(instance.formData, action.fieldPath, value);
+            const updatedInstance = await manager
+                .getRepository(approval_instance_entity_1.ApprovalInstanceEntity)
+                .save({
+                ...instance,
+                formData: updatedFormData,
+            });
+            Object.assign(instance, updatedInstance);
+            await activityRepository.save(activityRepository.create({
+                actorMemberId: null,
+                eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.SERVICE_TASK_EXECUTED,
+                instanceId: instance.id,
+                nodeId: node.id,
+                payload: {
+                    action: 'SET_FORM_FIELD',
+                    fieldPath: action.fieldPath,
+                    tokenId: token.id,
+                },
+                taskId: null,
+            }));
+            await this.advanceTokenToOutgoingNodes(manager, updatedInstance, token, node);
+            return;
+        }
+        const recipients = await this.resolveApproverResolver(manager, instance, action.recipients, `知會節點「${node.data.label}」`);
+        const recipientMemberIds = uniqueTexts(recipients.map((recipient) => recipient.memberId));
+        await this.notificationService.createServiceTaskNotifications({
+            instance,
+            manager,
+            node,
+            recipientMemberIds,
+        });
+        await manager.getRepository(workflow_token_entity_1.WorkflowTokenEntity).save({
+            ...token,
+            consumedAt: new Date(),
+            status: workflow_engine_enums_1.WorkflowTokenStatusEnum.CONSUMED,
+        });
+        await activityRepository.save(activityRepository.create({
+            actorMemberId: null,
+            eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TOKEN_ADVANCED,
+            instanceId: instance.id,
+            nodeId: node.id,
+            payload: {
+                action: 'NOTIFY',
+                recipientMemberIds,
+                tokenId: token.id,
+            },
+            taskId: null,
+        }));
+    }
+    async rejectInstance(manager, instance, task, rejectedAt) {
+        const instanceRepository = manager.getRepository(approval_instance_entity_1.ApprovalInstanceEntity);
+        // Dispatch pending ad-hoc notifications for the rejecting node before the
+        // remaining directives are cancelled by the terminal cleanup below.
+        await this.dispatchAdhocStageNotifications(manager, instance, task.nodeId, 'REJECTED');
+        // Consume open tokens and cancel any still-open tasks (parallel branches,
+        // ad-hoc countersign / pre-approval tasks) so nothing actionable lingers
+        // on a rejected instance.
+        await this.consumeOpenRuntimeState(manager, instance, rejectedAt, workflow_engine_enums_1.TaskStatusEnum.CANCELLED);
+        await this.notificationService.supersedeInstanceTaskNotifications({
+            instanceId: instance.id,
+            manager,
+        });
+        const rejectedInstance = await instanceRepository.save({
+            ...instance,
+            completedAt: rejectedAt,
+            state: workflow_engine_enums_1.ApprovalInstanceStateEnum.REJECTED,
+        });
+        await this.dispatchAdhocCompletionNotifications(manager, rejectedInstance, workflow_engine_enums_1.ApprovalInstanceStateEnum.REJECTED);
+        await this.cancelPendingAdhocDirectives(manager, instance.id, null);
+        await manager.getRepository(activity_log_entity_1.ActivityLogEntity).save(manager.getRepository(activity_log_entity_1.ActivityLogEntity).create({
+            actorMemberId: task.assigneeMemberId,
+            eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TOKEN_ADVANCED,
+            instanceId: instance.id,
+            nodeId: task.nodeId,
+            payload: {
+                action: 'REJECTED',
+                taskId: task.id,
+            },
+            taskId: task.id,
+        }));
+    }
+    async returnInstanceToNode(manager, instance, task, returnToNodeId, returnedAt) {
+        if (!returnToNodeId) {
+            throw new common_1.ConflictException('Return target node is required');
+        }
+        const targetNode = readWorkflowNodeOrThrow(instance.workflowSnapshot, returnToNodeId);
+        const tokenRepository = manager.getRepository(workflow_token_entity_1.WorkflowTokenEntity);
+        const instanceRepository = manager.getRepository(approval_instance_entity_1.ApprovalInstanceEntity);
+        const activityRepository = manager.getRepository(activity_log_entity_1.ActivityLogEntity);
+        // The returning node's stage has ended (outcome: RETURNED) — dispatch its
+        // pending ad-hoc stage notifications, then drop flow-affecting ad-hoc
+        // directives so they cannot replay after the return/resubmit cycle.
+        await this.dispatchAdhocStageNotifications(manager, instance, task.nodeId, 'RETURNED');
+        await this.cancelPendingAdhocDirectives(manager, instance.id, [
+            adhoc_enums_1.AdhocDirectiveTypeEnum.COUNTERSIGN,
+            adhoc_enums_1.AdhocDirectiveTypeEnum.PRE_APPROVAL,
+        ]);
+        await this.consumeOpenRuntimeState(manager, instance, returnedAt, workflow_engine_enums_1.TaskStatusEnum.CANCELLED);
+        const returnedInstance = await instanceRepository.save({
+            ...instance,
+            completedAt: null,
+            state: targetNode.type === 'startEvent'
+                ? workflow_engine_enums_1.ApprovalInstanceStateEnum.RETURNED
+                : workflow_engine_enums_1.ApprovalInstanceStateEnum.RUNNING,
+        });
+        const resubmitStrategy = readReturnResubmitStrategy(task, instance);
+        const returnToken = await tokenRepository.save(tokenRepository.create({
+            consumedAt: null,
+            currentNodeId: targetNode.id,
+            instanceId: instance.id,
+            parentTokenId: null,
+            status: workflow_engine_enums_1.WorkflowTokenStatusEnum.ACTIVE,
+        }));
+        await activityRepository.save([
+            activityRepository.create({
+                actorMemberId: task.assigneeMemberId,
+                eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.INSTANCE_RETURNED,
+                instanceId: instance.id,
+                nodeId: task.nodeId,
+                payload: {
+                    resubmitStrategy,
+                    returnedFromNodeId: task.nodeId,
+                    returnToNodeId: targetNode.id,
+                    taskId: task.id,
+                },
+                taskId: task.id,
+            }),
+            activityRepository.create({
+                actorMemberId: null,
+                eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TOKEN_CREATED,
+                instanceId: instance.id,
+                nodeId: targetNode.id,
+                payload: {
+                    returnedFromNodeId: task.nodeId,
+                    tokenId: returnToken.id,
+                },
+                taskId: null,
+            }),
+        ]);
+        if (returnedInstance.state === workflow_engine_enums_1.ApprovalInstanceStateEnum.RUNNING) {
+            await this.processRunningInstance(manager, returnedInstance);
+        }
+    }
+    async readLatestReturnedInstanceContext(manager, instanceId) {
+        const activity = await manager.getRepository(activity_log_entity_1.ActivityLogEntity).findOne({
+            order: { createdAt: 'DESC' },
+            where: {
+                eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.INSTANCE_RETURNED,
+                instanceId,
+            },
+        });
+        if (!activity) {
+            return null;
+        }
+        const returnToNodeId = readStringPayloadValue(activity.payload, 'returnToNodeId');
+        const returnedFromNodeId = readStringPayloadValue(activity.payload, 'returnedFromNodeId') ??
+            activity.nodeId;
+        if (!returnToNodeId || !returnedFromNodeId) {
+            return null;
+        }
+        return {
+            resubmitStrategy: readReturnResubmitStrategyFromPayload(activity.payload),
+            returnedFromNodeId,
+            returnToNodeId,
+        };
+    }
+    async resumeReturnedInstanceFromReturnPoint(manager, instance, context, resubmittedAt) {
+        const targetNode = readWorkflowNodeOrThrow(instance.workflowSnapshot, context.returnToNodeId);
+        if (targetNode.type !== 'startEvent') {
+            return instance;
+        }
+        readWorkflowNodeOrThrow(instance.workflowSnapshot, context.returnedFromNodeId);
+        await this.consumeOpenRuntimeState(manager, instance, resubmittedAt, workflow_engine_enums_1.TaskStatusEnum.CANCELLED);
+        const tokenRepository = manager.getRepository(workflow_token_entity_1.WorkflowTokenEntity);
+        const returnPointToken = await tokenRepository.save(tokenRepository.create({
+            consumedAt: null,
+            currentNodeId: context.returnedFromNodeId,
+            instanceId: instance.id,
+            parentTokenId: null,
+            status: workflow_engine_enums_1.WorkflowTokenStatusEnum.ACTIVE,
+        }));
+        await manager.getRepository(activity_log_entity_1.ActivityLogEntity).save(manager.getRepository(activity_log_entity_1.ActivityLogEntity).create({
+            actorMemberId: null,
+            eventType: workflow_engine_enums_1.ActivityLogEventTypeEnum.TOKEN_CREATED,
+            instanceId: instance.id,
+            nodeId: context.returnedFromNodeId,
+            payload: {
+                resubmitStrategy: context.resubmitStrategy,
+                resumedFromNodeId: context.returnToNodeId,
+                tokenId: returnPointToken.id,
+            },
+            taskId: null,
+        }));
+        return instance;
+    }
+    async consumeOpenRuntimeState(manager, instance, consumedAt, taskStatus) {
+        const tokenRepository = manager.getRepository(workflow_token_entity_1.WorkflowTokenEntity);
+        const taskRepository = manager.getRepository(task_entity_1.TaskEntity);
+        const tokens = await tokenRepository.find({
+            where: { instanceId: instance.id },
+        });
+        const openTokens = tokens.filter((token) => token.status === workflow_engine_enums_1.WorkflowTokenStatusEnum.ACTIVE ||
+            token.status === workflow_engine_enums_1.WorkflowTokenStatusEnum.WAITING);
+        const tasks = await taskRepository.find({
+            where: { instanceId: instance.id },
+        });
+        const openTasks = tasks.filter((task) => task.status === workflow_engine_enums_1.TaskStatusEnum.PENDING ||
+            task.status === workflow_engine_enums_1.TaskStatusEnum.IN_PROGRESS);
+        if (openTokens.length > 0) {
+            await tokenRepository.save(openTokens.map((token) => ({
+                ...token,
+                consumedAt,
+                status: workflow_engine_enums_1.WorkflowTokenStatusEnum.CONSUMED,
+            })));
+        }
+        if (openTasks.length > 0) {
+            await taskRepository.save(openTasks.map((openTask) => Object.assign(new task_entity_1.TaskEntity(), openTask, {
+                completedAt: consumedAt,
+                status: taskStatus,
+            })));
+            await this.closeTaskCandidates(manager, openTasks.map((task) => task.id), readCandidateStatusForClosedTask(taskStatus));
+        }
+    }
+    async consumeJoinedTokens(manager, tokens) {
+        if (tokens.length === 0) {
+            return;
+        }
+        const consumedAt = new Date();
+        await manager.getRepository(workflow_token_entity_1.WorkflowTokenEntity).save(tokens.map((token) => ({
+            ...token,
+            consumedAt,
+            status: workflow_engine_enums_1.WorkflowTokenStatusEnum.CONSUMED,
+        })));
+    }
+    async cancelAlternativeTokensForOrTrigger(manager, instance, token, targetNodeId) {
+        const tokenRepository = manager.getRepository(workflow_token_entity_1.WorkflowTokenEntity);
+        const taskRepository = manager.getRepository(task_entity_1.TaskEntity);
+        const consumedAt = new Date();
+        const tokens = await tokenRepository.find({
+            where: { instanceId: instance.id },
+        });
+        const alternativeTokens = tokens.filter((candidate) => candidate.id !== token.id &&
+            (candidate.status === workflow_engine_enums_1.WorkflowTokenStatusEnum.ACTIVE ||
+                candidate.status === workflow_engine_enums_1.WorkflowTokenStatusEnum.WAITING) &&
+            hasPathToNode(instance.workflowSnapshot, candidate.currentNodeId, targetNodeId));
+        if (alternativeTokens.length === 0) {
+            return;
+        }
+        const alternativeTokenIds = alternativeTokens.map((candidate) => candidate.id);
+        const cancellableTasks = (await taskRepository.find({
+            where: { instanceId: instance.id },
+        })).filter((task) => alternativeTokenIds.includes(task.tokenId) &&
+            (task.status === workflow_engine_enums_1.TaskStatusEnum.PENDING ||
+                task.status === workflow_engine_enums_1.TaskStatusEnum.IN_PROGRESS));
+        await tokenRepository.save(alternativeTokens.map((candidate) => ({
+            ...candidate,
+            consumedAt,
+            status: workflow_engine_enums_1.WorkflowTokenStatusEnum.CONSUMED,
+        })));
+        if (cancellableTasks.length) {
+            await taskRepository.save(cancellableTasks.map((task) => Object.assign(new task_entity_1.TaskEntity(), task, {
+                completedAt: consumedAt,
+                status: workflow_engine_enums_1.TaskStatusEnum.CANCELLED,
+            })));
+            await this.closeTaskCandidates(manager, cancellableTasks.map((task) => task.id), workflow_engine_enums_1.TaskCandidateStatusEnum.SUPERSEDED);
+        }
+    }
+    async closeTaskCandidates(manager, taskIds, status) {
+        if (taskIds.length === 0) {
+            return;
+        }
+        const candidateRepository = manager.getRepository(task_candidate_entity_1.TaskCandidateEntity);
+        const candidates = (await candidateRepository.find({ where: { taskId: (0, typeorm_2.In)([...taskIds]) } })).filter((candidate) => candidate.status === workflow_engine_enums_1.TaskCandidateStatusEnum.PENDING ||
+            candidate.status === workflow_engine_enums_1.TaskCandidateStatusEnum.CLAIMED);
+        if (candidates.length === 0) {
+            return;
+        }
+        await candidateRepository.save(candidates.map((candidate) => Object.assign(new task_candidate_entity_1.TaskCandidateEntity(), candidate, { status })));
+    }
+    async getTemplateOrThrow(templateId) {
+        const template = await this.approvalTemplateRepository.findOne({
+            where: { deletedAt: (0, typeorm_2.IsNull)(), id: templateId },
+        });
+        if (!template) {
+            throw new common_1.NotFoundException(`Approval template ${templateId} was not found`);
+        }
+        return template;
+    }
+    async getPublishedTemplateVersionOrThrow(versionId) {
+        const version = await this.approvalTemplateVersionRepository.findOne({
+            where: { id: versionId },
+        });
+        if (!version) {
+            throw new common_1.NotFoundException(`Approval template version ${versionId} was not found`);
+        }
+        if (version.status !== template_enums_1.ApprovalTemplateVersionStatusEnum.PUBLISHED) {
+            throw new common_1.ConflictException('Approval template current version must be published');
+        }
+        return version;
+    }
+    async getPublishedFormVersionOrThrow(versionId) {
+        if (!versionId) {
+            throw new common_1.ConflictException('Approval template version does not bind a form version');
+        }
+        const version = await this.formDefinitionVersionRepository.findOne({
+            where: { id: versionId },
+        });
+        if (!version) {
+            throw new common_1.NotFoundException(`Form definition version ${versionId} was not found`);
+        }
+        if (version.status !== form_enums_1.FormDefinitionVersionStatusEnum.PUBLISHED) {
+            throw new common_1.ConflictException('Approval template must bind a published form version');
+        }
+        return version;
+    }
+};
+exports.WorkflowEngineService = WorkflowEngineService;
+exports.WorkflowEngineService = WorkflowEngineService = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(0, (0, typeorm_1.InjectRepository)(approval_instance_entity_1.ApprovalInstanceEntity)),
+    tslib_1.__param(1, (0, typeorm_1.InjectRepository)(workflow_token_entity_1.WorkflowTokenEntity)),
+    tslib_1.__param(2, (0, typeorm_1.InjectRepository)(task_entity_1.TaskEntity)),
+    tslib_1.__param(3, (0, typeorm_1.InjectRepository)(task_candidate_entity_1.TaskCandidateEntity)),
+    tslib_1.__param(4, (0, typeorm_1.InjectRepository)(task_decision_entity_1.TaskDecisionEntity)),
+    tslib_1.__param(5, (0, typeorm_1.InjectRepository)(notification_entity_1.NotificationEntity)),
+    tslib_1.__param(6, (0, typeorm_1.InjectRepository)(activity_log_entity_1.ActivityLogEntity)),
+    tslib_1.__param(7, (0, typeorm_1.InjectRepository)(adhoc_directive_entity_1.AdhocDirectiveEntity)),
+    tslib_1.__param(8, (0, typeorm_1.InjectRepository)(approval_template_entity_1.ApprovalTemplateEntity)),
+    tslib_1.__param(9, (0, typeorm_1.InjectRepository)(approval_template_version_entity_1.ApprovalTemplateVersionEntity)),
+    tslib_1.__param(10, (0, typeorm_1.InjectRepository)(form_definition_version_entity_1.FormDefinitionVersionEntity)),
+    tslib_1.__param(16, (0, common_1.Optional)()),
+    tslib_1.__param(16, (0, common_1.Inject)(workflow_service_task_dispatcher_token_1.BPM_WORKFLOW_SERVICE_TASK_DISPATCHER)),
+    tslib_1.__metadata("design:paramtypes", [typeorm_2.Repository,
+        typeorm_2.Repository,
+        typeorm_2.Repository,
+        typeorm_2.Repository,
+        typeorm_2.Repository,
+        typeorm_2.Repository,
+        typeorm_2.Repository,
+        typeorm_2.Repository,
+        typeorm_2.Repository,
+        typeorm_2.Repository,
+        typeorm_2.Repository,
+        attachment_service_1.AttachmentService,
+        condition_service_1.ConditionService,
+        delegation_service_1.DelegationService,
+        notification_service_1.NotificationService,
+        signature_service_1.SignatureService, Object])
+], WorkflowEngineService);
+function parseJsonObject(value, label) {
+    try {
+        const parsedValue = JSON.parse(value);
+        if (isRecord(parsedValue)) {
+            return parsedValue;
+        }
+        throw new common_1.BadRequestException(`${label} must be a JSON object`);
+    }
+    catch (error) {
+        if (error instanceof common_1.BadRequestException) {
+            throw error;
+        }
+        throw new common_1.BadRequestException(error instanceof Error ? error.message : `${label} is invalid JSON`);
+    }
+}
+function readDefaultInitiatorMetadataSnapshot(memberId) {
+    return {
+        customFields: {},
+        memberId,
+    };
+}
+function parseWorkflowDefinition(value) {
+    try {
+        const parsedValue = JSON.parse(value);
+        if (isRecord(parsedValue) &&
+            Array.isArray(parsedValue.nodes) &&
+            Array.isArray(parsedValue.edges) &&
+            isRecord(parsedValue.meta)) {
+            return parsedValue;
+        }
+        throw new common_1.BadRequestException('workflowDefinitionJson must be a workflow definition object');
+    }
+    catch (error) {
+        if (error instanceof common_1.BadRequestException) {
+            throw error;
+        }
+        throw new common_1.BadRequestException(error instanceof Error
+            ? error.message
+            : 'workflowDefinitionJson is invalid JSON');
+    }
+}
+function buildInitiatorPolicyContext(initiatorMetadataSnapshot) {
+    return {
+        env: {
+            now: new Date().toISOString(),
+        },
+        initiator: initiatorMetadataSnapshot,
+        subject: initiatorMetadataSnapshot,
+    };
+}
+function buildWorkflowExpressionContext(instance) {
+    return {
+        env: {
+            now: new Date().toISOString(),
+        },
+        form: instance.formData,
+        formData: instance.formData,
+        initiator: {
+            ...instance.initiatorMetadataSnapshot,
+            memberId: instance.initiatorMemberId,
+        },
+        instance: {
+            id: instance.id,
+            state: instance.state,
+            templateId: instance.templateId,
+            templateVersionId: instance.templateVersionId,
+            title: instance.title,
+        },
+    };
+}
+function readDelegationSteps(value) {
+    return value
+        .map((step) => {
+        const from = readStringValue(step.from);
+        const to = readStringValue(step.to);
+        const reason = readStringValue(step.reason);
+        if (!from || !to || !reason) {
+            return null;
+        }
+        return {
+            from,
+            reason,
+            ruleId: readStringValue(step.ruleId),
+            to,
+        };
+    })
+        .filter((step) => step !== null);
+}
+function readStringValue(value) {
+    return typeof value === 'string' && value.trim() ? value : null;
+}
+function buildDryRunExpressionContext(input, lastDecision) {
+    return {
+        env: {
+            now: new Date().toISOString(),
+        },
+        form: input.formData,
+        formData: input.formData,
+        initiator: {
+            ...input.initiatorMetadataSnapshot,
+            memberId: input.initiatorMemberId,
+        },
+        instance: {
+            id: SYSTEM_DRY_RUN_INSTANCE_ID,
+            state: workflow_engine_enums_1.ApprovalInstanceStateEnum.RUNNING,
+            title: 'Dry Run',
+        },
+        lastDecision,
+    };
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function readWorkflowNodeOrThrow(workflow, nodeId) {
+    const node = workflow.nodes.find((candidate) => candidate.id === nodeId);
+    if (!node) {
+        throw new common_1.ConflictException(`Workflow node ${nodeId} was not found`);
+    }
+    return node;
+}
+function readOutgoingEdgesOrThrow(workflow, nodeId) {
+    const edges = workflow.edges.filter((edge) => edge.source === nodeId);
+    if (edges.length === 0) {
+        throw new common_1.ConflictException(`Workflow node ${nodeId} has no outgoing edge`);
+    }
+    return edges;
+}
+function readIncomingEdges(workflow, nodeId) {
+    return workflow.edges.filter((edge) => edge.target === nodeId);
+}
+function hasPathToNode(workflow, sourceNodeId, targetNodeId) {
+    return visitPathToNode(workflow, sourceNodeId, targetNodeId, new Set());
+}
+function visitPathToNode(workflow, sourceNodeId, targetNodeId, visitedNodeIds) {
+    if (sourceNodeId === targetNodeId) {
+        return true;
+    }
+    if (visitedNodeIds.has(sourceNodeId)) {
+        return false;
+    }
+    const nextVisitedNodeIds = new Set([...visitedNodeIds, sourceNodeId]);
+    return workflow.edges
+        .filter((edge) => edge.source === sourceNodeId)
+        .some((edge) => visitPathToNode(workflow, edge.target, targetNodeId, nextVisitedNodeIds));
+}
+function readReturnTargetNodeId(workflow, currentNodeId, requestedNodeId) {
+    const currentNode = readWorkflowNodeOrThrow(workflow, currentNodeId);
+    if (currentNode.type !== 'userTask') {
+        throw new common_1.ConflictException(`Workflow node ${currentNodeId} does not support return decisions`);
+    }
+    if (!currentNode.data.returnBehavior.allowReturn) {
+        throw new common_1.ConflictException(`User task ${currentNodeId} does not allow return decisions`);
+    }
+    const trimmedRequestedNodeId = requestedNodeId?.trim() || null;
+    const defaultTargetNodeId = readDefaultReturnTargetNodeId(workflow, currentNode);
+    if (currentNode.data.returnBehavior.allowedTargets === 'ANY') {
+        if (!trimmedRequestedNodeId) {
+            throw new common_1.BadRequestException('returnToNodeId is required');
+        }
+        readWorkflowNodeOrThrow(workflow, trimmedRequestedNodeId);
+        return trimmedRequestedNodeId;
+    }
+    if (trimmedRequestedNodeId &&
+        trimmedRequestedNodeId !== defaultTargetNodeId) {
+        throw new common_1.ConflictException(`User task ${currentNodeId} can only return to ${defaultTargetNodeId}`);
+    }
+    return defaultTargetNodeId;
+}
+function readDefaultReturnTargetNodeId(workflow, currentNode) {
+    if (currentNode.data.returnBehavior.allowedTargets === 'INITIATOR') {
+        const startNode = workflow.nodes.find((node) => node.type === 'startEvent');
+        if (!startNode) {
+            throw new common_1.ConflictException('Workflow does not include a startEvent');
+        }
+        return startNode.id;
+    }
+    const previousNodeId = readIncomingEdges(workflow, currentNode.id)[0]?.source;
+    if (!previousNodeId) {
+        throw new common_1.ConflictException(`User task ${currentNode.id} does not have a previous node to return to`);
+    }
+    return previousNodeId;
+}
+function readReturnResubmitStrategy(task, instance) {
+    const node = readWorkflowNodeOrThrow(instance.workflowSnapshot, task.nodeId);
+    if (node.type !== 'userTask') {
+        return 'RESTART';
+    }
+    return node.data.returnBehavior.resubmitStrategy ?? 'RESTART';
+}
+function readReturnResubmitStrategyFromPayload(payload) {
+    return payload.resubmitStrategy === 'FROM_RETURN_POINT'
+        ? 'FROM_RETURN_POINT'
+        : 'RESTART';
+}
+function readStringPayloadValue(payload, key) {
+    const value = payload[key];
+    return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+function readNodeEntryCondition(node) {
+    if (node.type === 'userTask' || node.type === 'serviceTask') {
+        return node.data.entryCondition?.trim() || null;
+    }
+    return null;
+}
+function edgeHasCondition(edge) {
+    return Boolean(edge.data.condition?.trim() ||
+        (edge.data.conditionFieldKey && edge.data.conditionOperator));
+}
+function readMemberIdFromValue(value, label) {
+    return readMemberIdsFromValue(value, label)[0] ?? '';
+}
+function readMemberIdsFromValue(value, label) {
+    if (typeof value === 'string' && value.trim()) {
+        return [value.trim()];
+    }
+    if (Array.isArray(value)) {
+        const memberIds = value
+            .filter((candidate) => typeof candidate === 'string' && Boolean(candidate.trim()))
+            .map((candidate) => candidate.trim());
+        if (memberIds.length > 0) {
+            return uniqueTexts(memberIds);
+        }
+    }
+    throw new common_1.ConflictException(`${label} did not resolve to a member id`);
+}
+function uniqueTexts(values) {
+    return [...new Set(values.filter((value) => value.trim()))];
+}
+function uniqueRuntimeCandidates(candidates) {
+    const seen = new Set();
+    return candidates.filter((candidate) => {
+        if (seen.has(candidate.memberId)) {
+            return false;
+        }
+        seen.add(candidate.memberId);
+        return true;
+    });
+}
+function uniqueTasksById(tasks) {
+    const seen = new Set();
+    return tasks.filter((task) => {
+        if (seen.has(task.id)) {
+            return false;
+        }
+        seen.add(task.id);
+        return true;
+    });
+}
+function normalizeText(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+function readPageOffset(page, pageSize) {
+    const normalizedPageSize = normalizePageSize(pageSize);
+    return (normalizePage(page) - 1) * normalizedPageSize;
+}
+function shouldPaginateList(options) {
+    return (typeof options.page !== 'undefined' ||
+        typeof options.pageSize !== 'undefined');
+}
+function normalizePage(value) {
+    return Number.isInteger(value) && Number(value) > 0 ? Number(value) : 1;
+}
+function normalizePageSize(value) {
+    if (!Number.isInteger(value) || Number(value) <= 0) {
+        return 20;
+    }
+    return Math.min(Number(value), 100);
+}
+function applyApprovalInstanceSearchFilter(queryBuilder, searchTextValue) {
+    const searchText = normalizeText(searchTextValue)?.toLocaleLowerCase();
+    if (!searchText) {
+        return;
+    }
+    queryBuilder.andWhere([
+        '(',
+        'LOWER("approvalInstance"."title") LIKE :approvalInstanceSearchText',
+        'OR LOWER("approvalInstance"."initiator_member_id") LIKE :approvalInstanceSearchText',
+        'OR LOWER(CAST("approvalInstance"."id" AS text)) LIKE :approvalInstanceSearchText',
+        ')',
+    ].join(' '), {
+        approvalInstanceSearchText: `%${escapeLikePattern(searchText)}%`,
+    });
+}
+function escapeLikePattern(value) {
+    return value
+        .replace(/\\/gu, '\\\\')
+        .replace(/%/gu, '\\%')
+        .replace(/_/gu, '\\_');
+}
+function isInstanceWithinRange(instance, options) {
+    const fromTime = options.from?.getTime() ?? null;
+    const toTime = options.to?.getTime() ?? null;
+    const candidateTime = (instance.completedAt ??
+        instance.startedAt ??
+        instance.createdAt).getTime();
+    return ((fromTime === null || candidateTime >= fromTime) &&
+        (toTime === null || candidateTime <= toTime));
+}
+function readDecisionPolicySnapshot(task) {
+    const value = task.decisionPolicySnapshot;
+    if (isRecord(value) &&
+        typeof value.type === 'string' &&
+        (value.type === 'SINGLE' ||
+            value.type === 'SEQUENTIAL' ||
+            value.type === 'PARALLEL_ALL' ||
+            value.type === 'PARALLEL_ANY')) {
+        return { type: value.type };
+    }
+    if (isRecord(value) &&
+        value.type === 'QUORUM' &&
+        typeof value.threshold === 'number' &&
+        (value.thresholdType === 'COUNT' || value.thresholdType === 'PERCENTAGE')) {
+        return {
+            threshold: value.threshold,
+            thresholdType: value.thresholdType,
+            type: 'QUORUM',
+        };
+    }
+    return { type: 'SINGLE' };
+}
+function shouldCompleteTaskAfterDecision({ action, candidates, decisionPolicy, }) {
+    if (action !== workflow_engine_enums_1.TaskDecisionActionEnum.APPROVED) {
+        return true;
+    }
+    if (decisionPolicy.type === 'SINGLE' ||
+        decisionPolicy.type === 'PARALLEL_ANY') {
+        return true;
+    }
+    const completedCount = candidates.filter((candidate) => candidate.status === workflow_engine_enums_1.TaskCandidateStatusEnum.COMPLETED).length;
+    const totalCount = Math.max(candidates.length, 1);
+    if (decisionPolicy.type === 'PARALLEL_ALL' ||
+        decisionPolicy.type === 'SEQUENTIAL') {
+        return completedCount >= totalCount;
+    }
+    const threshold = decisionPolicy.thresholdType === 'PERCENTAGE'
+        ? Math.ceil((totalCount * decisionPolicy.threshold) / 100)
+        : decisionPolicy.threshold;
+    return completedCount >= Math.max(threshold, 1);
+}
+function readValueAtPath(value, path) {
+    return path
+        .split('.')
+        .filter((segment) => segment.trim())
+        .reduce((currentValue, segment) => {
+        if (!isRecord(currentValue)) {
+            return undefined;
+        }
+        return currentValue[segment];
+    }, value);
+}
+function writeValueAtPath(value, path, nextValue) {
+    const segments = normalizeFormFieldPath(path);
+    if (segments.length === 0) {
+        return value;
+    }
+    return writeNestedValue(value, segments, nextValue);
+}
+function writeNestedValue(value, segments, nextValue) {
+    const [currentSegment, ...remainingSegments] = segments;
+    if (!currentSegment) {
+        return value;
+    }
+    if (remainingSegments.length === 0) {
+        return { ...value, [currentSegment]: nextValue };
+    }
+    const currentValue = value[currentSegment];
+    const nestedValue = isRecord(currentValue) ? currentValue : {};
+    return {
+        ...value,
+        [currentSegment]: writeNestedValue(nestedValue, remainingSegments, nextValue),
+    };
+}
+function normalizeFormFieldPath(path) {
+    const segments = path
+        .split('.')
+        .map((segment) => segment.trim())
+        .filter(Boolean);
+    if (segments[0] === 'form' || segments[0] === 'formData') {
+        return segments.slice(1);
+    }
+    return segments;
+}
+async function executeWebhookServiceAction(serviceTaskDispatcher, action, payload) {
+    try {
+        return await serviceTaskDispatcher.dispatchWebhook({
+            headers: action.headers,
+            payload,
+            url: action.url,
+        });
+    }
+    catch (error) {
+        return {
+            error: error instanceof Error ? error.message : 'Unknown webhook error',
+            ok: false,
+            status: null,
+        };
+    }
+}
+async function executeAdhocWebhookDispatch(serviceTaskDispatcher, target, payload) {
+    if (!target.webhookUrl) {
+        return { error: 'Webhook URL is missing', ok: false, status: null };
+    }
+    try {
+        return await serviceTaskDispatcher.dispatchWebhook({
+            headers: target.webhookHeaders,
+            payload,
+            url: target.webhookUrl,
+        });
+    }
+    catch (error) {
+        return {
+            error: error instanceof Error ? error.message : 'Unknown webhook error',
+            ok: false,
+            status: null,
+        };
+    }
+}
+function buildAdhocTargetValue(input) {
+    if (input.kind === adhoc_enums_1.AdhocTargetKindEnum.MEMBER) {
+        const memberIds = uniqueTexts([...(input.memberIds ?? [])]);
+        if (memberIds.length === 0) {
+            throw new common_1.BadRequestException('memberIds is required for a MEMBER ad-hoc target');
+        }
+        return { kind: input.kind, memberIds };
+    }
+    if (input.kind === adhoc_enums_1.AdhocTargetKindEnum.POSITION) {
+        const positionId = input.positionId?.trim();
+        if (!positionId) {
+            throw new common_1.BadRequestException('positionId is required for a POSITION ad-hoc target');
+        }
+        return { kind: input.kind, positionId };
+    }
+    if (input.kind === adhoc_enums_1.AdhocTargetKindEnum.ORG_UNIT_MEMBER) {
+        const orgUnitId = input.orgUnitId?.trim();
+        if (!orgUnitId) {
+            throw new common_1.BadRequestException('orgUnitId is required for an ORG_UNIT_MEMBER ad-hoc target');
+        }
+        return {
+            includeDescendants: Boolean(input.includeDescendants),
+            kind: input.kind,
+            orgUnitId,
+        };
+    }
+    const webhookUrl = input.webhookUrl?.trim();
+    if (!webhookUrl) {
+        throw new common_1.BadRequestException('webhookUrl is required for a WEBHOOK ad-hoc target');
+    }
+    return {
+        kind: input.kind,
+        webhookHeaders: input.webhookHeadersJson
+            ? parseAdhocWebhookHeaders(input.webhookHeadersJson)
+            : undefined,
+        webhookUrl,
+    };
+}
+function parseAdhocWebhookHeaders(json) {
+    try {
+        const parsed = JSON.parse(json);
+        if (!isRecord(parsed)) {
+            throw new common_1.BadRequestException('webhookHeadersJson must be a JSON object of string values');
+        }
+        return Object.entries(parsed).reduce((accumulator, [key, value]) => ({
+            ...accumulator,
+            ...(typeof value === 'string' ? { [key]: value } : {}),
+        }), {});
+    }
+    catch (error) {
+        if (error instanceof common_1.BadRequestException) {
+            throw error;
+        }
+        throw new common_1.BadRequestException('webhookHeadersJson is not valid JSON');
+    }
+}
+function readAdhocTargetValue(directive) {
+    const value = directive.targetValue;
+    const kind = directive.targetKind;
+    if (kind === adhoc_enums_1.AdhocTargetKindEnum.MEMBER) {
+        return {
+            kind,
+            memberIds: Array.isArray(value.memberIds)
+                ? value.memberIds.filter((memberId) => typeof memberId === 'string')
+                : [],
+        };
+    }
+    if (kind === adhoc_enums_1.AdhocTargetKindEnum.POSITION) {
+        return {
+            kind,
+            positionId: typeof value.positionId === 'string' ? value.positionId : '',
+        };
+    }
+    if (kind === adhoc_enums_1.AdhocTargetKindEnum.ORG_UNIT_MEMBER) {
+        return {
+            includeDescendants: Boolean(value.includeDescendants),
+            kind,
+            orgUnitId: typeof value.orgUnitId === 'string' ? value.orgUnitId : '',
+        };
+    }
+    return {
+        kind,
+        webhookHeaders: isRecord(value.webhookHeaders)
+            ? Object.entries(value.webhookHeaders).reduce((accumulator, [key, headerValue]) => ({
+                ...accumulator,
+                ...(typeof headerValue === 'string'
+                    ? { [key]: headerValue }
+                    : {}),
+            }), {})
+            : undefined,
+        webhookUrl: typeof value.webhookUrl === 'string' ? value.webhookUrl : '',
+    };
+}
+function buildAdhocApproverResolver(target) {
+    if (target.kind === adhoc_enums_1.AdhocTargetKindEnum.MEMBER) {
+        return { memberIds: target.memberIds ?? [], type: 'DIRECT' };
+    }
+    if (target.kind === adhoc_enums_1.AdhocTargetKindEnum.POSITION) {
+        return { positionId: target.positionId ?? '', type: 'POSITION' };
+    }
+    if (target.kind === adhoc_enums_1.AdhocTargetKindEnum.ORG_UNIT_MEMBER) {
+        return {
+            includeDescendants: target.includeDescendants,
+            orgUnitId: target.orgUnitId ?? '',
+            type: 'ORG_UNIT_MEMBER',
+        };
+    }
+    throw new common_1.BadRequestException('WEBHOOK ad-hoc targets cannot be used as approvers');
+}
+function readAdhocStageOutcomeLabel(outcome) {
+    if (outcome === 'APPROVED') {
+        return '通過';
+    }
+    if (outcome === 'REJECTED') {
+        return '拒絕';
+    }
+    return '退回';
+}
+function readInstanceFinalStateLabel(finalState) {
+    if (finalState === workflow_engine_enums_1.ApprovalInstanceStateEnum.APPROVED) {
+        return '核准';
+    }
+    if (finalState === workflow_engine_enums_1.ApprovalInstanceStateEnum.REJECTED) {
+        return '拒絕';
+    }
+    return '取消';
+}
+function readManagerMemberIdFromInitiatorSnapshot(initiatorMetadataSnapshot, levelsUp) {
+    const managerChain = initiatorMetadataSnapshot.managerChain;
+    if (Array.isArray(managerChain)) {
+        return managerChain[Math.max(levelsUp - 1, 0)];
+    }
+    const managerMemberIds = initiatorMetadataSnapshot.managerMemberIds;
+    if (Array.isArray(managerMemberIds)) {
+        return managerMemberIds[Math.max(levelsUp - 1, 0)];
+    }
+    const customFields = initiatorMetadataSnapshot.customFields;
+    if (isRecord(customFields)) {
+        return customFields.managerMemberId;
+    }
+    return initiatorMetadataSnapshot.managerMemberId;
+}
+function isDateRangeActive(value, date) {
+    return (value.effectiveFrom <= date &&
+        (!value.effectiveTo || value.effectiveTo >= date));
+}
+function compareManagerResolution(left, right) {
+    const priorityDiff = right.priority - left.priority;
+    if (priorityDiff !== 0) {
+        return priorityDiff;
+    }
+    return (readManagerResolutionScopeRank(right.scopeType) -
+        readManagerResolutionScopeRank(left.scopeType) ||
+        right.effectiveFrom.localeCompare(left.effectiveFrom));
+}
+function readManagerResolutionScopeRank(scopeType) {
+    const ranks = {
+        [organization_enums_1.ManagerResolutionScopeTypeEnum.MEMBER]: 3,
+        [organization_enums_1.ManagerResolutionScopeTypeEnum.ORG_UNIT]: 2,
+        [organization_enums_1.ManagerResolutionScopeTypeEnum.POSITION]: 1,
+    };
+    return ranks[scopeType];
+}
+function compareMembership(left, right) {
+    if (left.isPrimary !== right.isPrimary) {
+        return left.isPrimary ? -1 : 1;
+    }
+    return right.effectiveFrom.localeCompare(left.effectiveFrom);
+}
+function toDateOnlyString(value) {
+    return value.toISOString().slice(0, 10);
+}
+function canReadAllWorkflows(scope) {
+    return (scope.roles.includes('BPM_ADMIN') ||
+        scope.permissions.some((permission) => WORKFLOW_READ_ALL_PERMISSIONS.has(permission)));
+}
+function isTaskRelatedToMember(task, memberId) {
+    return (task.assigneeMemberId === memberId ||
+        task.originalAssigneeMemberId === memberId);
+}
+function readCandidateStatusForClosedTask(taskStatus) {
+    if (taskStatus === workflow_engine_enums_1.TaskStatusEnum.TRANSFERRED) {
+        return workflow_engine_enums_1.TaskCandidateStatusEnum.TRANSFERRED;
+    }
+    if (taskStatus === workflow_engine_enums_1.TaskStatusEnum.COMPLETED) {
+        return workflow_engine_enums_1.TaskCandidateStatusEnum.COMPLETED;
+    }
+    return workflow_engine_enums_1.TaskCandidateStatusEnum.CANCELLED;
+}
+function validateSubmittedFormData(schema, formData) {
+    const missingFields = schema.fields.filter((field) => {
+        const fieldValue = formData[field.fieldKey];
+        return (isSubmittedFormFieldVisible(field, schema.fields, formData) &&
+            isSubmittedFormFieldRequired(field, schema.fields, formData) &&
+            !isSubmittedFieldValuePresent(fieldValue));
+    });
+    if (missingFields.length > 0) {
+        throw new common_1.BadRequestException(`Form data is missing required fields: ${missingFields
+            .map((field) => field.label || field.fieldKey)
+            .join(', ')}`);
+    }
+}
+function readFormDefinitionSnapshotSchema(snapshot) {
+    const schema = snapshot.schema;
+    if (isFormDefinitionSchema(schema)) {
+        return schema;
+    }
+    throw new common_1.BadRequestException('Approval instance form schema is invalid');
+}
+function isFormDefinitionSchema(value) {
+    return (isRecord(value) && value.schemaVersion === 1 && Array.isArray(value.fields));
+}
+function isSubmittedFormFieldVisible(field, fields, values) {
+    return field.visibleWhen
+        ? evaluateFormConditionExpression(field.visibleWhen, fields, values, true)
+        : true;
+}
+function isSubmittedFormFieldRequired(field, fields, values) {
+    return (field.required ||
+        Boolean(field.requiredWhen
+            ? evaluateFormConditionExpression(field.requiredWhen, fields, values, false)
+            : false));
+}
+function evaluateFormConditionExpression(expression, fields, values, fallback) {
+    const rule = parseFormConditionRule(expression);
+    if (!rule) {
+        return fallback;
+    }
+    const field = fields.find((candidate) => candidate.fieldKey === rule.fieldKey);
+    if (!field) {
+        return fallback;
+    }
+    return evaluateFormConditionRule(rule, field, values[field.fieldKey]);
+}
+function parseFormConditionRule(expression) {
+    const match = expression
+        .trim()
+        .match(/^form\.([A-Za-z][A-Za-z0-9_]*)\s*(==|!=|>=|<=|>|<)\s*(.+)$/u);
+    if (!match) {
+        return null;
+    }
+    const operator = readFormConditionOperatorFromSymbol(match[2]);
+    if (!operator) {
+        return null;
+    }
+    return {
+        fieldKey: match[1],
+        operator,
+        value: parseFormConditionLiteral(match[3]),
+    };
+}
+function evaluateFormConditionRule(rule, field, value) {
+    if (Array.isArray(value)) {
+        return evaluateArrayFormCondition(value, rule);
+    }
+    if (field.type === 'boolean') {
+        return compareFormConditionValues(value === true ? 'true' : 'false', rule.value, rule.operator);
+    }
+    if (isNumberFormField(field)) {
+        return compareNumericFormCondition(value, rule);
+    }
+    return compareFormConditionValues(typeof value === 'undefined' || value === null ? '' : String(value), rule.value, rule.operator);
+}
+function evaluateArrayFormCondition(value, rule) {
+    const stringValues = value.filter((entry) => typeof entry === 'string');
+    if (rule.operator === 'equals') {
+        return stringValues.includes(rule.value);
+    }
+    if (rule.operator === 'notEquals') {
+        return !stringValues.includes(rule.value);
+    }
+    return false;
+}
+function compareNumericFormCondition(value, rule) {
+    const actualValue = typeof value === 'number' ? value : Number(value);
+    const expectedValue = Number(rule.value);
+    if (!Number.isFinite(actualValue) || !Number.isFinite(expectedValue)) {
+        return false;
+    }
+    return compareFormConditionValues(actualValue, expectedValue, rule.operator);
+}
+function compareFormConditionValues(actualValue, expectedValue, operator) {
+    if (operator === 'equals') {
+        return actualValue === expectedValue;
+    }
+    if (operator === 'notEquals') {
+        return actualValue !== expectedValue;
+    }
+    if (operator === 'greaterThan') {
+        return actualValue > expectedValue;
+    }
+    if (operator === 'greaterThanOrEqual') {
+        return actualValue >= expectedValue;
+    }
+    if (operator === 'lessThan') {
+        return actualValue < expectedValue;
+    }
+    return actualValue <= expectedValue;
+}
+function readFormConditionOperatorFromSymbol(symbol) {
+    const operators = {
+        '!=': 'notEquals',
+        '<': 'lessThan',
+        '<=': 'lessThanOrEqual',
+        '==': 'equals',
+        '>': 'greaterThan',
+        '>=': 'greaterThanOrEqual',
+    };
+    return symbol ? (operators[symbol] ?? null) : null;
+}
+function parseFormConditionLiteral(value) {
+    const trimmedValue = value.trim();
+    if ((trimmedValue.startsWith('"') && trimmedValue.endsWith('"')) ||
+        (trimmedValue.startsWith("'") && trimmedValue.endsWith("'"))) {
+        return trimmedValue.slice(1, -1);
+    }
+    return trimmedValue;
+}
+function isSubmittedFieldValuePresent(value) {
+    if (typeof value === 'undefined' || value === null) {
+        return false;
+    }
+    if (typeof value === 'string') {
+        return value.trim().length > 0;
+    }
+    if (Array.isArray(value)) {
+        return value.length > 0;
+    }
+    return true;
+}
+function isNumberFormField(field) {
+    return field.type === 'number' || field.type === 'money';
+}
+function createDryRunStep(input) {
+    return Object.assign(new workflow_dry_run_object_1.WorkflowDryRunStepObject(), {
+        assigneeMemberId: input.assigneeMemberId,
+        edgeDefault: input.edge ? Boolean(input.edge.data.isDefault) : null,
+        edgeId: input.edge?.id ?? null,
+        edgeLabel: input.edge ? readDryRunEdgeLabel(input.edge) : null,
+        edgeMatched: input.edgeMatched,
+        edgeReason: input.edgeReason,
+        entryCondition: input.entryCondition,
+        entryConditionMatched: input.entryConditionMet,
+        id: `dry-run-step-${input.stepIndex + 1}`,
+        message: input.message,
+        nodeId: input.node.id,
+        nodeLabel: input.node.data.label,
+        nodeType: input.node.type,
+        status: input.status,
+    });
+}
+function readDryRunEdgeLabel(edge) {
+    return edge.data.label?.trim() || edge.id;
+}
+function readDryRunEdgeReason(edge) {
+    if (!edge) {
+        return null;
+    }
+    if (edge.data.isDefault) {
+        return '其他條件不符合時採用預設路徑。';
+    }
+    const expression = edge.data.condition?.trim();
+    if (expression) {
+        return `條件成立：${expression}`;
+    }
+    if (edge.data.conditionFieldKey && edge.data.conditionOperator) {
+        return `條件成立：${edge.data.conditionFieldKey} ${edge.data.conditionOperator}${edge.data.conditionValue ? ` ${edge.data.conditionValue}` : ''}`;
+    }
+    return '無條件路徑。';
+}
+function readDryRunStepStatus(node, entryConditionMet) {
+    if (!entryConditionMet) {
+        return 'SKIPPED';
+    }
+    if (node.type === 'userTask') {
+        return 'WAITING';
+    }
+    if (node.type === 'endEvent') {
+        return 'COMPLETED';
+    }
+    return 'PASSED';
+}
+function readDryRunStepMessage(node, entryConditionMet) {
+    if (!entryConditionMet) {
+        return '進入條件不符合，略過節點。';
+    }
+    if (node.type === 'userTask') {
+        return '將建立待簽任務。';
+    }
+    if (node.type === 'endEvent') {
+        return `流程結束：${node.data.endState ?? 'APPROVED'}`;
+    }
+    return '節點條件通過。';
+}
+function mapDecisionToResolution(action) {
+    switch (action) {
+        case workflow_engine_enums_1.TaskDecisionActionEnum.APPROVED:
+            return notification_enums_1.NotificationResolutionEnum.APPROVED;
+        case workflow_engine_enums_1.TaskDecisionActionEnum.REJECTED:
+            return notification_enums_1.NotificationResolutionEnum.REJECTED;
+        case workflow_engine_enums_1.TaskDecisionActionEnum.RETURNED:
+            return notification_enums_1.NotificationResolutionEnum.RETURNED;
+        case workflow_engine_enums_1.TaskDecisionActionEnum.TRANSFERRED:
+            return notification_enums_1.NotificationResolutionEnum.TRANSFERRED;
+    }
+}
+//# sourceMappingURL=workflow-engine.service.js.map