@stalfh233/omc-cli 0.0.0-stage → 0.4.10

package/dist/lanes/workflow.js

@@ -0,0 +1,1813 @@
+import { z } from "zod";
+import { ENDPOINTS } from "../endpoints.js";
+import { capabilityArg, environmentArg } from "../args.js";
+import { governedRead } from "../read.js";
+import { ToolRefusalError } from "../tool-types.js";
+import { writeTool } from "../write.js";
+import { registerPackageTool } from "../package-tool.js";
+import { writeSummary } from "../human-summary.js";
+import { defineTool, ToolInputError } from "../tool-types.js";
+import { wireCall, wireRows, WireError } from "../wire.js";
+import { resolveBizObjectIdByInstance, searchWorkItems, wireString } from "../workflow-support.js";
+import { WORKFLOW_EVENT_HANDLER_FIELDS, WORKFLOW_LANE_CONTRACT, workflowTemplateArg } from "./workflow-contract.js";
+import { PLATFORM_TRIGGER_RULE_CODES } from "./rule-graph.js";
+import { executeRuleEnableWrite } from "./rule-lifecycle.js";
+const WORKFLOW_LANE = WORKFLOW_LANE_CONTRACT.lane;
+const WORKFLOW_TOOLS = WORKFLOW_LANE_CONTRACT.tools;
+const WORKFLOW_ACTIVITY_TYPES = new Set(["START", "END", "CONNECTION", "PARTICIPANT", "SUB_INSTANCE", "CIRCULATE", "SYSTEM_ACTIVITY", "AGENT_ACTIVITY"]);
+const WORKFLOW_POINT = /^-?\d+(?:\.\d+)?,\s-?\d+(?:\.\d+)?$/;
+/**
+ * Conditional branch lines (round7). `routes[]` maps to the platform `Rule`
+ * DTO (Rule.java:28-59), which carries a structured branch condition
+ * `ruleConditionGroup = List<List<RuleConditionItem>>` (outer OR / inner AND).
+ * ActivityContext.getNextFormulaActivities:82-99 only consults it when
+ * popupType == EXPRESSION; a rule with utilizeElse=true is the else/fallback
+ * line and is never a condition line. These enums mirror ConditionType.java and
+ * MatchType.java (shared 8.6.26); a typo silently no-ops on the platform, so the
+ * write gate refuses it instead.
+ */
+const WORKFLOW_CONDITION_TYPES = new Set(["EQ", "NEQ", "GT", "LT", "GTEQ", "LTEQ", "CT", "NCT", "EP", "NEP", "OF", "NOF", "BETWEEN", "NOTBETWEEN", "CT_ALL", "NCT_ALL", "CT_ANY", "NCT_ANY", "EQ_ANY", "NEQ_ANY"]);
+const WORKFLOW_MATCH_TYPES = new Set(["ALL", "ANY"]);
+/**
+ * `RuleConditionItem` (RuleConditionItem.java, shared 8.6.26) has EXACTLY four
+ * fields: currentDataItem, bizPropertyType, conditionType, value. Any extra key
+ * makes the platform's workflow/update deserialization fail and answer a
+ * **misleading `401001 流程不存在！`** — not a key error (live 2026-09-25: adding
+ * the business-rule condition keys targetDataItem/ruleValueType to a workflow
+ * route condition poisoned the whole update). Fail closed on unknown keys before
+ * the wire so the agent gets the real fix instead of chasing a phantom workflow.
+ */
+const WORKFLOW_RULE_CONDITION_ITEM_KEYS = new Set(["currentDataItem", "bizPropertyType", "conditionType", "value"]);
+/**
+ * RuleConditionItem.bizPropertyType is a BizPropertyType whose fastjson
+ * deserializer (BizPropertyTypeDeserializer.deserialze) reads an INT index
+ * (`BizPropertyType.get(TypeUtils.castToInt(value))`) and whose serializer writes
+ * the same index. Sending the enum NAME ("NUMERICAL") makes castToInt coerce it
+ * to 0 (the wrong type) and the template conversion then fails with a MISLEADING
+ * `流程名称为空！` (live 101.96.203.196 / AI-Platform 1.1.22 — cost the sandbox
+ * agent the whole workflow write). Accept the name for ergonomics but emit the
+ * index on the wire.
+ */
+const WORKFLOW_BIZ_PROPERTY_TYPE_INDEX = Object.freeze({
+    SHORT_TEXT: 0, LONG_TEXT: 1, NUMERICAL: 2, DATE: 3, LOGICAL: 4, SELECTION: 5,
+    ATTACHMENT: 6, COMMENT: 7, CHILD_TABLE: 8, WORK_SHEET: 9, ADDRESS: 10, MULT_WORK_SHEET: 11,
+    RADIO: 12, CHECKBOX: 13, DROPDOWN_BOX: 14, DROPDOWN_MULTI_BOX: 15, RELEVANCE_DATA: 16,
+    HYPER_LINK: 17, ID: 20, TIME: 28, STAFF_SELECTOR: 50, STAFF_MULTI_SELECTOR: 51,
+    DEPARTMENT_SELECTOR: 60, DEPARTMENT_MULTI_SELECTOR: 61, FORMULA: 100, OCR: 250,
+    ELECTRONIC_SIGN: 251, APPROVAL_INFO: 254,
+});
+const WORKFLOW_BIZ_PROPERTY_INDEX_SET = new Set(Object.values(WORKFLOW_BIZ_PROPERTY_TYPE_INDEX));
+/** Resolve a caller-supplied bizPropertyType (index or enum name) to the wire index, or null if invalid. */
+function resolveBizPropertyTypeIndex(value) {
+    if (typeof value === "number" && Number.isInteger(value))
+        return WORKFLOW_BIZ_PROPERTY_INDEX_SET.has(value) ? value : null;
+    if (typeof value === "string")
+        return WORKFLOW_BIZ_PROPERTY_TYPE_INDEX[value.trim().toUpperCase()] ?? null;
+    return null;
+}
+/** Rewrite each RuleConditionItem.bizPropertyType to the numeric index the platform deserializes. */
+function normalizeRuleConditionGroup(groups) {
+    if (!Array.isArray(groups))
+        return groups;
+    return groups.map((group) => Array.isArray(group)
+        ? group.map((item) => {
+            const record = (item ?? {});
+            const index = resolveBizPropertyTypeIndex(record.bizPropertyType);
+            return index === null ? record : { ...record, bizPropertyType: index };
+        })
+        : group);
+}
+/** Route fields that describe the line's condition/behaviour (as opposed to geometry). */
+const WORKFLOW_ROUTE_CONDITION_KEYS = ["text", "formula", "utilizeElse", "fixedPoint", "alternativeFlag", "childMatchType", "ruleConditionGroup"];
+/**
+ * Fail closed on a malformed structured branch condition BEFORE any wire call —
+ * an unknown conditionType or childMatchType deserializes to null on the platform
+ * and the line silently never fires (the same class of silent no-op that bit
+ * checkType=2). Only caller-supplied `routes`/`rules` are checked.
+ */
+function validateWorkflowRouteConditions(template, tool) {
+    const raw = template.routes ?? template.rules ?? template.edges;
+    if (!Array.isArray(raw))
+        return;
+    for (const [index, entry] of raw.entries()) {
+        const route = (entry ?? {});
+        // `null` is the platform's stored form for an absent optional — a caller
+        // legitimately round-tripping get_draft sends `text:null`/`formula:null`. Treat
+        // null like undefined, not as a wrong type.
+        for (const booleanKey of ["utilizeElse", "fixedPoint", "alternativeFlag"])
+            if (route[booleanKey] !== undefined && route[booleanKey] !== null && typeof route[booleanKey] !== "boolean")
+                throw new ToolRefusalError({ status: "refused", blocker: "workflow-route-condition-invalid", message: `${tool}: routes[${index}].${booleanKey} must be boolean` });
+        for (const stringKey of ["text", "formula"])
+            if (route[stringKey] !== undefined && route[stringKey] !== null && typeof route[stringKey] !== "string")
+                throw new ToolRefusalError({ status: "refused", blocker: "workflow-route-condition-invalid", message: `${tool}: routes[${index}].${stringKey} must be a string` });
+        if (route.childMatchType !== undefined && route.childMatchType !== null && !(typeof route.childMatchType === "string" && WORKFLOW_MATCH_TYPES.has(route.childMatchType)))
+            throw new ToolRefusalError({ status: "refused", blocker: "workflow-route-condition-invalid", message: `${tool}: routes[${index}].childMatchType must be ALL or ANY` });
+        if (route.ruleConditionGroup === undefined || route.ruleConditionGroup === null)
+            continue;
+        const groups = route.ruleConditionGroup;
+        if (!Array.isArray(groups) || groups.length === 0)
+            throw new ToolRefusalError({ status: "refused", blocker: "workflow-route-condition-invalid", message: `${tool}: routes[${index}].ruleConditionGroup must be a non-empty array of AND-groups (each an array of conditions)` });
+        for (const [groupIndex, group] of groups.entries()) {
+            if (!Array.isArray(group) || group.length === 0)
+                throw new ToolRefusalError({ status: "refused", blocker: "workflow-route-condition-invalid", message: `${tool}: routes[${index}].ruleConditionGroup[${groupIndex}] must be a non-empty array of RuleConditionItem` });
+            for (const [itemIndex, item] of group.entries()) {
+                const condition = (item ?? {});
+                if (typeof condition.currentDataItem !== "string" || condition.currentDataItem.trim() === "")
+                    throw new ToolRefusalError({ status: "refused", blocker: "workflow-route-condition-invalid", message: `${tool}: routes[${index}].ruleConditionGroup[${groupIndex}][${itemIndex}].currentDataItem must be a non-empty field code (child fields use "childSchemaCode.fieldCode")` });
+                if (!(typeof condition.conditionType === "string" && WORKFLOW_CONDITION_TYPES.has(condition.conditionType)))
+                    throw new ToolRefusalError({ status: "refused", blocker: "workflow-route-condition-invalid", message: `${tool}: routes[${index}].ruleConditionGroup[${groupIndex}][${itemIndex}].conditionType must be a ConditionType (${[...WORKFLOW_CONDITION_TYPES].join("/")})` });
+                if (condition.bizPropertyType !== undefined && condition.bizPropertyType !== null && resolveBizPropertyTypeIndex(condition.bizPropertyType) === null)
+                    throw new ToolRefusalError({ status: "refused", blocker: "workflow-route-condition-invalid", message: `${tool}: routes[${index}].ruleConditionGroup[${groupIndex}][${itemIndex}].bizPropertyType must be a BizPropertyType index (NUMERICAL=2, DATE=3, SHORT_TEXT=0, STAFF_SELECTOR=50, …) or a known enum name` });
+                const unknownKeys = Object.keys(condition).filter((key) => !WORKFLOW_RULE_CONDITION_ITEM_KEYS.has(key));
+                if (unknownKeys.length > 0)
+                    throw new ToolRefusalError({
+                        status: "refused",
+                        blocker: "workflow-route-condition-invalid",
+                        message: `${tool}: routes[${index}].ruleConditionGroup[${groupIndex}][${itemIndex}] 含未知键 ${unknownKeys.join("/")}——RuleConditionItem 只接受 ${[...WORKFLOW_RULE_CONDITION_ITEM_KEYS].join("/")}；未知键会让平台 workflow/update 返回**误导性的 401001 流程不存在！**（真机 2026-09-25）。业务规则条件组的 targetDataItem/ruleValueType 等键不能照抄到流程连线条件里。`,
+                    });
+            }
+        }
+    }
+}
+/**
+ * Fail closed on an unknown bindRule handler BEFORE any wire call. The MCP
+ * transport validates the zod schema, but `omc call` (the first-class live
+ * driver) invokes the handler directly, so the semantic gate lives here.
+ */
+function resolveEventHandlerField(handler) {
+    const key = handler ?? "end";
+    const field = WORKFLOW_EVENT_HANDLER_FIELDS[key];
+    if (!field) {
+        throw new ToolRefusalError({
+            status: "refused",
+            blocker: "workflow-invalid-handler",
+            handler,
+            message: `handler must be one of ${Object.keys(WORKFLOW_EVENT_HANDLER_FIELDS).join("|")} (omit for end)`,
+        });
+    }
+    return { key: key, field };
+}
+/**
+ * Live 8.6.26 fidelity — a REFUSED workflow write still answers HTTP 200 with
+ * `errcode 0`; the refusal rides `data` as a `ValidateMessage[]`
+ * ({errCode, errContent, errorLevel}; S29 live contract, publish refusal errmsg
+ * is 发布流程失败). Trusting `errcode` alone reports a phantom success: live, a
+ * PARTICIPANT node whose originate participant is `"admin"` (not the platform
+ * keyword `"{Originator}"`) answers `401035 填写申请单 ERROR` while errcode stays
+ * 0 — the tool said publish:ok and the flow never went live. Surface every
+ * ERROR-level message as a structured refusal so the caller can fix the
+ * template instead of believing the flow is running. WARN-level messages are
+ * returned as evidence but do not block (live: `{Creator}` answers 401062 WARN).
+ */
+function workflowValidationErrors(data) {
+    if (!Array.isArray(data))
+        return [];
+    return data.filter((message) => message !== null && typeof message === "object" && message.errorLevel === "ERROR");
+}
+function workflowValidationWarnings(data) {
+    if (!Array.isArray(data))
+        return [];
+    return data.filter((message) => message !== null && typeof message === "object" && message.errorLevel !== "ERROR");
+}
+/** Refuse after a workflow write when the platform answered ValidateMessage[] ERRORs (errcode 0 notwithstanding). */
+function assertWorkflowWriteAccepted(performed, tool, workflowCode) {
+    const errors = workflowValidationErrors(performed.data);
+    if (errors.length === 0)
+        return;
+    throw new ToolRefusalError({
+        status: "refused",
+        blocker: "workflow-publish-invalid",
+        workflowCode,
+        validationErrors: errors,
+        message: `${tool}: 平台以 ValidateMessage[] 拒绝（errcode 0 但不落库）：${errors.map((error) => `${error.errCode} ${error.errContent}`).join("；")}。常见根因：审批(PARTICIPANT)节点的 sheetCode 为空（=模型默认表单槽位，通常等于 schemaCode；401026 WORKFLOW_ACTIVITY_NO_SHEET——工具已自动回填，仍报则检查端点是否漏），或新增节点未接入链路（END 无入边）。修正模板后重试，不要反复 publish`,
+    });
+}
+/**
+ * Ticket 77 — a START/END-only template cannot overwrite the platform's
+ * auto-generated full draft (PARTICIPANT 填写申请单/审批 nodes); the platform
+ * answers a stable 401001 流程不存在. Refuse pre-wire and point at the
+ * get_draft-based editing path (or workflow.bindRule for rule binding).
+ */
+/**
+ * Caller activities may arrive as an array OR as an index-keyed object
+ * (`{"0":{…},"1":{…}}` — the shape the published workflow recipe teaches and
+ * the shape get_draft-adjacent callers reach for). Every downstream merge/lint
+ * step keys on an ARRAY; before this coercion an object-shaped `activities`
+ * was destructured away and silently DROPPED, so `workflow.update` answered
+ * `ok` while writing the unchanged draft — bench10/11: an agent's two-level
+ * approval template vanished and it could never land the second approval,
+ * burning 7 get_draft + 7 update round-trips. Coerce object → array in numeric
+ * key order; a non-array/non-object value is left to the element checks.
+ */
+function callerActivities(template) {
+    const activities = template?.activities;
+    if (Array.isArray(activities))
+        return activities;
+    if (activities !== null && typeof activities === "object") {
+        return Object.keys(activities)
+            .sort((a, b) => Number(a) - Number(b))
+            .map((key) => activities[key]);
+    }
+    return undefined;
+}
+function assertTemplateNotMinimal(template, tool) {
+    // An absent template (publish the stored draft as-is) is the platform's own
+    // path and is out of the guard's scope — the bench golden evals drive it.
+    if (template === undefined || template === null)
+        return;
+    const activities = callerActivities(template);
+    const types = activities
+        ? activities
+            .map((activity) => (activity && typeof activity === "object" ? String(activity.type ?? activity.activityType ?? "") : ""))
+            .filter((type) => type.length > 0)
+        : [];
+    if (types.length > 0 && types.every((type) => type === "START" || type === "END")) {
+        throw new ToolRefusalError({
+            status: "refused",
+            blocker: "workflow-template-minimal",
+            message: `${tool} 收到仅含 START/END 的极简模板——平台为流程头自动生成含 PARTICIPANT 节点（填写申请单/审批）的完整草稿，极简模板无法覆盖，平台会稳定返回 401001 流程不存在。以 workflow.get_draft 返回的完整模板为基础修改后再 update/publish；只绑规则用 workflow.bindRule`,
+        });
+    }
+}
+/**
+ * Ticket 112 — dry-lint the caller template against the platform's update
+ * contract (8.6.26 decompiled source), zero wire:
+ * - `templateType:"BusinessProcess"` is NOT a WorkflowTemplateStatus member
+ *   (WorkflowTemplateUtil.java:136 valueOf; the converter swallows the
+ *   exception into a partial model and the save chain then fails with errcode
+ *   50000) — omit it and the draft's value rides along.
+ * - every activities element needs a type (platform keys on activityType;
+ *   ActivityType.valueOf("null") throws the same swallowed way).
+ */
+function lintWorkflowTemplate(template, tool) {
+    if (template === undefined || template === null)
+        return;
+    if (template.templateType === "BusinessProcess")
+        throw new ToolRefusalError({
+            status: "refused",
+            blocker: "workflow-template-type-invalid",
+            message: `${tool}: templateType "BusinessProcess" 不是 WorkflowTemplateStatus 枚举成员（WorkflowTemplateUtil.java:136 valueOf——转换异常被吞成残缺模型后保存链 50000）。省略 templateType，由 get_draft 草稿值回显`,
+        });
+    const activities = callerActivities(template);
+    if (activities) {
+        for (const activity of activities) {
+            const record = activity;
+            const type = record != null && typeof record === "object" ? (record.type ?? record.activityType) : undefined;
+            if (type === undefined || type === null || String(type).trim() === "")
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "workflow-activity-type-missing",
+                    message: `${tool}: activities 元素缺少 type/activityType（平台 ActivityType.valueOf 对 "null" 抛异常被吞成残缺模型 → 50000）；每个活动必须带类型`,
+                });
+        }
+    }
+}
+/** Caller-side Activity aliases (input + workflowSummary spelling) that must never ride the wire. */
+const ACTIVITY_INPUT_ALIAS_KEYS = ["id", "type", "name", "code", "index"];
+/**
+ * Ticket 112 — normalize the caller template onto the platform DTO:
+ * - `routes[]` is NOT a WorkflowTemplateModel field (WorkflowTemplateModel
+ *   .java:51-66 declares List<Rule> rules; Rule.java:40-57
+ *   preActivityCode/postActivityCode). Caller routes are mapped to rules
+ *   elements — with derived string `points` (the workflow designer canvas
+ *   keys on them exactly like the rule graph does) — and the routes key
+ *   never rides the wire.
+ * - caller activities may use the repo shorthand {id,type,name,participant};
+ *   the platform wire keys are activityCode/activityType/activityName
+ *   (WorkflowTemplateController update @ApiImplicitParam example;
+ *   ActivityType.valueOf("null") makes the converter fail → 401001). Each
+ *   caller activity is merged onto the matching DRAFT activity so the
+ *   platform-required subfaces (todoDataItems, permittedAction,
+ *   preCondition, geometry) echo instead of holing the model.
+ */
+function mapCallerActivities(callerActivities, draftActivities) {
+    const draftByCode = new Map(draftActivities.map((activity) => [String(activity.activityCode ?? ""), activity]));
+    const draftByType = (type) => draftActivities.find((activity) => String(activity.activityType ?? "") === type);
+    return callerActivities.map((entry) => {
+        const record = (entry ?? {});
+        const code = activityCodeOf(record);
+        const rawType = String(record.activityType ?? record.type ?? "");
+        const type = rawType === "APPROVAL" ? "PARTICIPANT" : rawType;
+        const base = draftByCode.get(code) ??
+            (type === "START" ? draftByType("START") : type === "END" ? draftByType("END") : type === "PARTICIPANT" ? draftByType("PARTICIPANT") : undefined) ??
+            {};
+        // Drop the input aliases AND the readback-only keys (`code`/`index` come
+        // from workflowSummary). Stray keys on an Activity/Rule make the platform
+        // answer a misleading 401001; only canonical keys may ride the wire. The
+        // participant is normalized as part of the record so the trailing spread
+        // cannot re-introduce a shorthand the platform cannot resolve.
+        const wireRecord = {
+            ...Object.fromEntries(Object.entries(record).filter(([key]) => !ACTIVITY_INPUT_ALIAS_KEYS.includes(key))),
+            ...(record.participant !== undefined ? { participant: normalizeParticipantForWire(record.participant) } : {}),
+        };
+        return {
+            ...base,
+            activityCode: code,
+            ...(type ? { activityType: type } : {}),
+            ...(record.name !== undefined ? { activityName: record.name } : {}),
+            ...wireRecord,
+        };
+    });
+}
+function validateCallerActivities(template, tool) {
+    const activities = callerActivities(template);
+    if (!activities)
+        return;
+    const codes = new Set();
+    for (const [index, raw] of activities.entries()) {
+        const activity = raw;
+        const code = String(activity?.activityCode ?? activity?.id ?? activity?.code ?? "").trim();
+        const rawType = String(activity?.activityType ?? activity?.type ?? "").trim();
+        const type = rawType === "APPROVAL" ? "PARTICIPANT" : rawType;
+        if (!code)
+            throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-activity-code-invalid", message: `${tool}: activities[${index}] requires a non-empty activityCode/id` });
+        if (codes.has(code))
+            throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-activity-code-duplicate", message: `${tool}: duplicate activityCode ${code}` });
+        if (!rawType)
+            throw new ToolRefusalError({ status: "refused", blocker: "workflow-activity-type-missing", message: `${tool}: activities[${index}] requires type/activityType` });
+        if (!WORKFLOW_ACTIVITY_TYPES.has(type))
+            throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-activity-type-invalid", message: `${tool}: activities[${index}] has an illegal ActivityType` });
+        codes.add(code);
+    }
+}
+/**
+ * Workflow canonical node layout — the same lesson as the rule graph
+ * (CFG-26), freshly observed live 2026-09-17: mapCallerActivities merges an
+ * activity onto the draft row by code, else by TYPE. A caller who names TWO
+ * PARTICIPANT nodes has neither code in the draft, so BOTH inherit the single
+ * draft PARTICIPANT's box (x=327, y=116) and overlap — the designer then draws
+ * the fill→approve edge as a horizontal stub and the chain is unreadable. When
+ * the merged activities lack geometry or collide, lay the chain out in the
+ * platform's single column (x=327, 158×40, 80px apart) and re-derive the rule
+ * points. A graph the caller laid out deliberately (no missing box, no
+ * overlap) is preserved verbatim.
+ */
+function linearWorkflowOrder(activities, rules) {
+    const codes = activities.map((activity) => String(activity.activityCode ?? ""));
+    if (codes.some((code) => !code) || new Set(codes).size !== codes.length)
+        return [];
+    const outgoing = new Map();
+    for (const rule of rules) {
+        const pre = String(rule.preActivityCode ?? "");
+        const post = String(rule.postActivityCode ?? "");
+        if (!codes.includes(pre) || !codes.includes(post))
+            continue;
+        outgoing.set(pre, [...(outgoing.get(pre) ?? []), post]);
+    }
+    const starts = activities.filter((activity) => activity.activityType === "START").map((activity) => String(activity.activityCode));
+    if (starts.length !== 1 || [...outgoing.values()].some((targets) => targets.length > 1))
+        return [];
+    const order = [];
+    let cursor = starts[0];
+    while (cursor !== undefined && !order.includes(cursor)) {
+        order.push(cursor);
+        cursor = outgoing.get(cursor)?.[0];
+    }
+    return order.length === codes.length ? order : [];
+}
+function canonicalizeWorkflowLayout(activities, rules) {
+    const numberOr = (value, fallback) => (Number.isFinite(Number(value)) ? Number(value) : fallback);
+    const boxOf = (activity) => ({
+        x: numberOr(activity.x, Number.NaN),
+        y: numberOr(activity.y, Number.NaN),
+        width: numberOr(activity.width, 158),
+        height: numberOr(activity.height, 40),
+    });
+    const boxes = activities.map(boxOf);
+    const missing = boxes.some((box) => Number.isNaN(box.x) || Number.isNaN(box.y));
+    const overlaps = boxes.some((a, ai) => boxes.some((b, bi) => bi > ai && !Number.isNaN(a.x) && !Number.isNaN(b.x) && a.x < b.x + b.width && b.x < a.x + a.width && a.y < b.y + b.height && b.y < a.y + a.height));
+    if (!missing && !overlaps)
+        return { activities, changed: false };
+    const order = linearWorkflowOrder(activities, rules);
+    const position = (code, index) => (order.length > 0 ? order.indexOf(code) : index);
+    return {
+        changed: true,
+        activities: activities.map((activity, index) => ({
+            ...activity,
+            x: 327,
+            y: 36 + 80 * position(String(activity.activityCode ?? ""), index),
+            width: 158,
+            height: 40,
+        })),
+    };
+}
+/** Ticket 112 — workflow rules carry designer-canvas `points` (same lesson as the rule graph): derive from the activity boxes. */
+function deriveRulePoints(pre, post, activities) {
+    const numberOr = (value, fallback) => (Number.isFinite(Number(value)) ? Number(value) : fallback);
+    const boxOf = (code, index) => {
+        const activity = activities.find((candidate) => String(candidate.activityCode ?? "") === code) ?? activities[index];
+        return {
+            x: numberOr(activity?.x, 327),
+            y: numberOr(activity?.y, 36 + 80 * index),
+            width: numberOr(activity?.width, 158),
+            height: numberOr(activity?.height, 40),
+        };
+    };
+    const preIndex = Math.max(0, activities.findIndex((candidate) => String(candidate.activityCode ?? "") === pre));
+    const postIndex = Math.max(0, activities.findIndex((candidate) => String(candidate.activityCode ?? "") === post));
+    const s = boxOf(pre, preIndex);
+    const t = boxOf(post, postIndex);
+    const scx = s.x + s.width / 2;
+    const tcx = t.x + t.width / 2;
+    if (t.y > s.y)
+        return [`${scx}, ${s.y + s.height}`, `${tcx}, ${t.y}`];
+    if (t.y < s.y)
+        return [`${scx}, ${s.y}`, `${tcx}, ${t.y + t.height}`];
+    if (t.x >= s.x)
+        return [`${s.x + s.width}, ${s.y + s.height / 2}`, `${t.x}, ${t.y + t.height / 2}`];
+    return [`${s.x}, ${s.y + s.height / 2}`, `${t.x + t.width}, ${t.y + t.height / 2}`];
+}
+function mapCallerRules(callerRoutes, draftRules, activities) {
+    const baseRule = draftRules[0] ?? {};
+    return callerRoutes.map((entry) => {
+        const record = (entry ?? {});
+        const pre = String(record.preActivityCode ?? record.preNode ?? record.pre ?? record.from ?? "");
+        const post = String(record.postActivityCode ?? record.postNode ?? record.post ?? record.to ?? "");
+        const points = Array.isArray(record.points) && record.points.length > 0 ? record.points : deriveRulePoints(pre, post, activities);
+        const mapped = {
+            ...baseRule,
+            ...Object.fromEntries(Object.entries(record).filter(([key]) => !["preNode", "postNode", "pre", "post", "from", "to"].includes(key))),
+            preActivityCode: pre,
+            postActivityCode: post,
+            points,
+        };
+        // A structured branch line (round7) only fires when popupType is EXPRESSION
+        // and it is NOT the else/fallback line (ActivityContext
+        // .getNextFormulaActivities:82-99). The platform defaults are popupType
+        // FUNCTION (Rule.java:49) and utilizeElse true (Rule.java:37) — either would
+        // silently turn a supplied ruleConditionGroup into a no-op, and both ride in
+        // via the draft baseRule. So force them unless the caller set them itself.
+        if (record.ruleConditionGroup !== undefined) {
+            if (record.popupType === undefined)
+                mapped.popupType = "EXPRESSION";
+            if (record.utilizeElse === undefined)
+                mapped.utilizeElse = false;
+            // The platform deserializes BizPropertyType from an INT index; normalize a
+            // caller's enum name before the wire (see WORKFLOW_BIZ_PROPERTY_TYPE_INDEX).
+            mapped.ruleConditionGroup = normalizeRuleConditionGroup(record.ruleConditionGroup);
+        }
+        return mapped;
+    });
+}
+/**
+ * Participant references must be platform-resolvable. Real published workflows
+ * (2026-09-23 production observation) use exactly three forms:
+ *   (a) a keyword — `{Originator}`;
+ *   (b) a JSON array of participant objects —
+ *       `[{"code","corpId","id","name","type"}]` (type 2 = role, 3 = user),
+ *       joined with `+` for several;
+ *   (c) a function — `FindUserByRole({Originator.OU},"<roleCode>","random")`.
+ * Free text (a bare role name like `部门负责人`) publishes but resolves to
+ * nobody and creates no workitem, so warn — the caller must resolve names via
+ * `org.role.list` / `org.department.list` first. Advisory (never blocks): the
+ * platform accepts the save, so this is a readback lint, not a write gate.
+ */
+function participantReferenceWarnings(template) {
+    const activities = Array.isArray(template.activities) ? template.activities : [];
+    const warnings = [];
+    for (const activity of activities) {
+        if (String(activity.activityType ?? "") !== "PARTICIPANT")
+            continue;
+        const raw = activity.participant;
+        if (raw === undefined || raw === null || String(raw).trim().length === 0)
+            continue; // platform may fill later
+        const participant = String(raw).trim();
+        if (isPlatformParticipantReference(participant))
+            continue;
+        warnings.push({
+            activityCode: String(activity.activityCode ?? ""),
+            participant,
+            warning: `参与者「${participant}」不是平台可解析的引用（自由文本解析不到人，不生成待办）。真实语法：关键字 {Originator}；参与者对象数组 [{"code":"<角色code>","corpId":"<corpId|other>","id":"<roleId>","name":"<角色名>","type":2}]（type 2=角色,3=用户，多个用 + 连接）；或函数 FindUserByRole({Originator.OU},"<roleCode>","random")。先用 org.role.list / org.department.list / org.user.search 解析 code/id。`,
+        });
+    }
+    return warnings;
+}
+function isPlatformParticipantReference(participant) {
+    if (/^\{[^}]+\}$/.test(participant))
+        return true; // {Originator} keyword
+    if (/^[A-Za-z_$][\w$]*\s*\(/.test(participant))
+        return true; // FindUserByRole(...)
+    if (participant.startsWith("[") || participant.startsWith("+")) {
+        // one or more `[...]` segments joined by +
+        const segments = participant.split("+").map((segment) => segment.trim());
+        return segments.every((segment) => {
+            if (segment.length === 0)
+                return true;
+            try {
+                const parsed = JSON.parse(segment);
+                return Array.isArray(parsed) && parsed.every((entry) => entry !== null && typeof entry === "object" && ("id" in entry || "code" in entry));
+            }
+            catch {
+                return false;
+            }
+        });
+    }
+    return false;
+}
+/**
+ * Normalize a participant reference to a platform-resolvable form BEFORE it rides
+ * the wire. Live 2026-09-28: an intent that declares `participant: {type: Originator}`
+ * (or a bare `participant: Originator`) is stored as the JSON string
+ * `"{\"type\":\"Originator\"}"`, and `workflow.publish` refuses with
+ * `401035 填写申请单` — the originate participant never resolves, so the whole
+ * workflow will not publish. The platform understands three forms (see
+ * participantReferenceWarnings); this maps the natural shorthands onto them:
+ *   - a lone originator (bare `Originator`, or `{type/participantType: "Originator"}`
+ *     with only display keys)      → the keyword `"{Originator}"`
+ *   - a role/user object `{code|id: …}` → a one-element JSON array `[obj]`
+ *   - an array → JSON string; a string is left verbatim (already a valid form)
+ * Existing `"{Originator}"`/function/role-array strings pass through unchanged.
+ */
+export function normalizeParticipantForWire(participant) {
+    if (participant === undefined || participant === null)
+        return participant;
+    if (typeof participant === "string") {
+        return /^originator$/i.test(participant.trim()) ? "{Originator}" : participant;
+    }
+    if (Array.isArray(participant))
+        return participant.length === 0 ? "" : JSON.stringify(participant);
+    if (typeof participant === "object") {
+        const record = participant;
+        const keys = Object.keys(record);
+        const typeValue = record.type ?? record.participantType;
+        const displayOnly = keys.every((key) => ["type", "participantType", "name", "i18nMessage", "label", "displayName"].includes(key));
+        if (displayOnly && typeof typeValue === "string" && /^originator$/i.test(typeValue.trim()))
+            return "{Originator}";
+        // A role/user descriptor must be a JSON ARRAY string; a bare object fails
+        // resolution too.
+        if ("code" in record || "id" in record)
+            return JSON.stringify([record]);
+        return JSON.stringify(record);
+    }
+    return participant;
+}
+function workflowRenderCompat(template) {
+    const activities = Array.isArray(template.activities) ? template.activities : [];
+    const rules = Array.isArray(template.rules) ? template.rules : [];
+    const activityCodes = new Set(activities.map((activity) => String(activity.activityCode ?? "")));
+    const danglingViolations = rules.flatMap((rule, index) => {
+        const missing = ["preActivityCode", "postActivityCode"].filter((key) => !activityCodes.has(String(rule[key] ?? "")));
+        return missing.length > 0 ? [{ ruleIndex: index, missing }] : [];
+    });
+    // 2026-09-25 cost pass: geometry + route points are deterministic for the
+    // canonical single column (x=327, 158×40, 80px apart). Echoing all of them on
+    // every activity/edge was ~880 B per workflow write. Only a DEVIATION from the
+    // canonical seat/edge is meaningful (a caller-placed layout, or a collision the
+    // canonicalizer fixed), so only deviations are echoed; their absence proves the
+    // graph is canonical. This keeps the render-compat capability (ticket 109:
+    // catch a broken/off-column layout) at a fraction of the bytes.
+    const numberOr = (value, fallback) => (Number.isFinite(Number(value)) ? Number(value) : fallback);
+    const order = linearWorkflowOrder(activities, rules);
+    const seat = (activity, index) => ({
+        x: 327,
+        y: 36 + 80 * (order.length > 0 ? order.indexOf(String(activity.activityCode ?? "")) : index),
+        width: 158,
+        height: 40,
+    });
+    const canonicalGeometry = (activity, index) => {
+        const expected = seat(activity, index);
+        return numberOr(activity.x, Number.NaN) === expected.x && numberOr(activity.y, Number.NaN) === expected.y && numberOr(activity.width, expected.width) === expected.width && numberOr(activity.height, expected.height) === expected.height;
+    };
+    return {
+        activities: activities.map((activity, index) => {
+            const geometry = { x: activity.x, y: activity.y, width: activity.width, height: activity.height };
+            return { activityCode: String(activity.activityCode), activityType: String(activity.activityType), ...(canonicalGeometry(activity, index) ? {} : { geometry }) };
+        }),
+        rules: rules.map((rule) => {
+            const pre = String(rule.preActivityCode);
+            const post = String(rule.postActivityCode);
+            const stored = Array.isArray(rule.points) ? rule.points : [];
+            const derived = deriveRulePoints(pre, post, activities);
+            const canonicalPoints = stored.length === derived.length && stored.every((point, index) => point === derived[index]);
+            return { preActivityCode: pre, postActivityCode: post, ...(canonicalPoints ? {} : { points: rule.points }), ...workflowRouteConditionView(rule) };
+        }),
+        startEnd: {
+            start: activities.filter((activity) => activity.activityType === "START").map((activity) => String(activity.activityCode)),
+            end: activities.filter((activity) => activity.activityType === "END").map((activity) => String(activity.activityCode)),
+        },
+        danglingViolations,
+    };
+}
+/**
+ * Round7 — the branch-relevant fields of a `Rule`, for readback. Without this
+ * the route condition is invisible: an agent could write a branch and never
+ * confirm which edge carries which condition.
+ *
+ * 2026-09-25 cost pass: the platform stores every optional rule key (`text`,
+ * `formula`, `childMatchType`, `ruleConditionGroup` as null; `utilizeElse`,
+ * `fixedPoint`, `alternativeFlag` as false; `popupType` as "FUNCTION"). Echoing
+ * those defaults repeated ~8 keys on EVERY edge of every workflow read (a 4-edge
+ * workflow carried ~890 B of edges, mostly defaults). Only meaningful values
+ * survive here; a default/absent key stays out. `full:true` still returns the
+ * raw stored row.
+ */
+function workflowRouteConditionView(rule) {
+    const view = {};
+    for (const key of ["text", "formula", "childMatchType", "ruleConditionGroup"]) {
+        const value = rule[key];
+        if (value !== undefined && value !== null)
+            view[key] = value;
+    }
+    for (const key of ["utilizeElse", "fixedPoint", "alternativeFlag"]) {
+        if (rule[key] === true)
+            view[key] = true;
+    }
+    if (rule.popupType !== undefined && rule.popupType !== null && rule.popupType !== "FUNCTION")
+        view.popupType = rule.popupType;
+    return view;
+}
+function validateWorkflowRender(template, tool) {
+    const activities = template.activities;
+    if (!Array.isArray(activities))
+        throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-activities-invalid", message: `${tool}: activities must be an array` });
+    const codes = new Set();
+    for (const [index, raw] of activities.entries()) {
+        const activity = raw;
+        const code = String(activity?.activityCode ?? "").trim();
+        const type = String(activity?.activityType ?? "").trim();
+        if (!code)
+            throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-activity-code-invalid", message: `${tool}: activities[${index}].activityCode must be non-empty` });
+        if (codes.has(code))
+            throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-activity-code-duplicate", message: `${tool}: duplicate activityCode ${code}` });
+        if (!WORKFLOW_ACTIVITY_TYPES.has(type))
+            throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-activity-type-invalid", message: `${tool}: activities[${index}].activityType is not an 8.6.26 ActivityType` });
+        codes.add(code);
+    }
+    const rules = template.rules;
+    if (!Array.isArray(rules))
+        throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-rules-invalid", message: `${tool}: rules must be an array` });
+    for (const [index, raw] of rules.entries()) {
+        const rule = raw;
+        const pre = String(rule?.preActivityCode ?? "").trim();
+        const post = String(rule?.postActivityCode ?? "").trim();
+        if (!pre || !post || !codes.has(pre) || !codes.has(post))
+            throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-dangling-rule", message: `${tool}: rules[${index}] references an unknown activity` });
+        const points = rule?.points;
+        if (!Array.isArray(points) || points.length === 0 || points.some((point) => typeof point !== "string" || !WORKFLOW_POINT.test(point)))
+            throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-rules-invalid", message: `${tool}: rules[${index}].points must be a non-empty string[] of "x, y" coordinates` });
+    }
+}
+/**
+ * The draft rules remapped by index cannot describe an activity the caller
+ * ADDED (an extra approval node): the remapped edges stop at the old chain, an
+ * extra END sits with no inbound edge, and the platform publish validator
+ * answers 401026/401027/401017 on 结束 (bench12, live). When the remapped rules
+ * are not a clean linear chain over the mapped activities, rebuild the chain in
+ * the caller's array order — the recipe contract is "array order = approval
+ * chain order" — reusing any edge whose endpoints survived. A draft whose
+ * (possibly branching) graph is untouched passes the chain check verbatim.
+ */
+function completeWorkflowChain(rules, activities) {
+    const codes = activities.map((activity) => String(activity.activityCode ?? "")).filter((code) => code.length > 0);
+    if (codes.length < 2)
+        return rules;
+    const typeOf = (code) => String(activities.find((activity) => String(activity.activityCode ?? "") === code)?.activityType ?? "");
+    const codeSet = new Set(codes);
+    const inbound = new Map();
+    const outbound = new Map();
+    let valid = true;
+    for (const rule of rules) {
+        const pre = String(rule.preActivityCode ?? "");
+        const post = String(rule.postActivityCode ?? "");
+        if (!codeSet.has(pre) || !codeSet.has(post)) {
+            valid = false;
+            continue;
+        }
+        outbound.set(pre, (outbound.get(pre) ?? 0) + 1);
+        inbound.set(post, (inbound.get(post) ?? 0) + 1);
+    }
+    for (const code of codes) {
+        const type = typeOf(code);
+        if (type !== "START" && (inbound.get(code) ?? 0) !== 1)
+            valid = false;
+        if (type !== "END" && (outbound.get(code) ?? 0) !== 1)
+            valid = false;
+    }
+    if (valid)
+        return rules;
+    const byEdge = new Map(rules.map((rule) => [`${rule.preActivityCode}->${rule.postActivityCode}`, rule]));
+    return codes.slice(0, -1).map((code, index) => byEdge.get(`${code}->${codes[index + 1]}`) ?? { preActivityCode: code, postActivityCode: codes[index + 1] });
+}
+/** Activity type resolution shared by the merge + code reconcile (APPROVAL is a legacy alias). */
+function activityTypeOf(record) {
+    const rawType = String(record.activityType ?? record.type ?? "");
+    return rawType === "APPROVAL" ? "PARTICIPANT" : rawType;
+}
+/** Display name the caller asked for, in any accepted spelling. */
+function activityNameOf(record) {
+    const value = record.activityName ?? record.i18nMessage ?? record.name;
+    if (typeof value === "string" && value.length > 0)
+        return value;
+    // The participant shorthand `{type: Originator, name: 部门负责人}` carries the
+    // intended NODE label inside `participant.name`. The platform only resolves
+    // the participant keyword and defaults the activity name to 填写申请单, so
+    // without this the declared node name is silently lost (bench62: both approval
+    // nodes read back as 填写申请单). Promote it when the participant is the lone
+    // originator shorthand (the role-descriptor form keeps its own semantics).
+    const participant = record.participant;
+    if (participant && typeof participant === "object" && !Array.isArray(participant)) {
+        const descriptor = participant;
+        const typeValue = descriptor.type ?? descriptor.participantType;
+        if (typeof typeValue === "string" && /^originator$/i.test(typeValue.trim()) && typeof descriptor.name === "string" && descriptor.name.trim().length > 0)
+            return descriptor.name;
+    }
+    return undefined;
+}
+/**
+ * Activity code in any accepted spelling. `code` is what `workflowSummary`
+ * (get_draft/get_published compact) emits, so `get_draft → edit → update` — the
+ * documented "read back then send the delta" flow — round-trips: an activity the
+ * readback handed you is directly re-sendable.
+ */
+function activityCodeOf(record) {
+    return String(record.activityCode ?? record.id ?? record.code ?? "");
+}
+/**
+ * Live 2026-09-23: the platform's workflow/update CANNOT RENAME an existing
+ * activityCode — the stored name and type win. A caller list that reuses the
+ * auto-draft's `ActivityN` codes therefore corrupts: the caller's
+ * `Activity3` PARTICIPANT keeps the draft's name ("审批"), and a caller's
+ * `Activity4` PARTICIPANT merges onto the draft's END node (name "结束",
+ * type END) — reproduced on bench12/13/15, where the second approval node
+ * showed as "结束". Only a FRESH code receives the caller's name/type.
+ *
+ * Reconcile the caller list against the draft: keep a code when the caller
+ * re-sends the same type + name (idempotent re-update), otherwise mint a
+ * collision-free code so the change actually lands. Returns the rewritten
+ * activities plus the original→final code map for route remapping.
+ */
+function reconcileCallerActivityCodes(callerActivities, draftActivities) {
+    const draftByCode = new Map(draftActivities.map((activity) => [String(activity.activityCode ?? ""), activity]));
+    const used = new Set(draftActivities.map((activity) => String(activity.activityCode ?? "")));
+    const codeMap = new Map();
+    const activities = callerActivities.map((record) => {
+        const original = activityCodeOf(record);
+        const type = activityTypeOf(record);
+        const name = activityNameOf(record);
+        const draft = draftByCode.get(original);
+        let code = original;
+        if (draft !== undefined) {
+            const draftType = String(draft.activityType ?? "");
+            const draftName = activityNameOf(draft);
+            const changed = draftType !== type || (name !== undefined && draftName !== undefined && name !== draftName);
+            if (changed) {
+                let suffix = 2;
+                while (used.has(`${original}_${suffix}`))
+                    suffix += 1;
+                code = `${original}_${suffix}`;
+            }
+        }
+        used.add(code);
+        codeMap.set(original, code);
+        return { ...record, activityCode: code, ...(name !== undefined ? { activityName: name, i18nMessage: name } : {}) };
+    });
+    return { activities, codeMap };
+}
+/**
+ * Context-cost (round 15): a caller template that declares activities but NOT
+ * both boundaries is necessarily a partial edit — a workflow without START+END
+ * cannot stand alone on the platform (create always mints them). Treating it as
+ * a full replace dropped the draft's boundary nodes and answered a misleading
+ * `50000 服务异常` (bench43: a targeted `propertyPermissions` update on two
+ * PARTICIPANT nodes lost start/end, and the agent's recovery was to read the
+ * whole 43.7 KB body back and post it verbatim — 93 KB, 38% of the task).
+ * Route such a template through the delta merge instead, so the caller can send
+ * only the node(s) it touches. A template that DOES carry both boundaries keeps
+ * replace semantics (an explicit full-graph rewrite).
+ */
+function activitiesLackBoundaries(template) {
+    const activities = callerActivities(template);
+    if (!activities || activities.length === 0)
+        return false;
+    const types = activities.map((raw) => {
+        const record = raw;
+        return record != null && typeof record === "object" ? String(record.activityType ?? record.type ?? "").trim().toUpperCase() : "";
+    });
+    return !(types.includes("START") && types.includes("END"));
+}
+/**
+ * Deep-merge a caller activity row onto its draft row, with `propertyPermissions`
+ * (and each entry's `subPropertyPermissions`) merged BY `propertyCode` rather
+ * than replaced. A targeted field-permission edit sends one or two permission
+ * entries; a raw array replace would silently drop every field the caller did
+ * not re-send. Only arrays deep-merge; an explicit non-array (e.g. null) is
+ * taken as the caller's intent to replace.
+ */
+function mergePermissionsByCode(base, caller) {
+    if (!Array.isArray(base) || !Array.isArray(caller))
+        return caller;
+    const byCode = new Map();
+    for (const entry of base) {
+        if (entry && typeof entry === "object") {
+            const row = entry;
+            byCode.set(String(row.propertyCode ?? ""), row);
+        }
+    }
+    for (const entry of caller) {
+        if (!entry || typeof entry !== "object")
+            continue;
+        const row = entry;
+        const key = String(row.propertyCode ?? "");
+        const prev = byCode.get(key);
+        byCode.set(key, prev
+            ? {
+                ...prev,
+                ...row,
+                ...(row.subPropertyPermissions !== undefined ? { subPropertyPermissions: mergePermissionsByCode(prev.subPropertyPermissions, row.subPropertyPermissions) } : {}),
+            }
+            : row);
+    }
+    return [...byCode.values()];
+}
+function deepMergeActivityRow(base, caller) {
+    const merged = { ...base, ...caller };
+    if (Array.isArray(caller.propertyPermissions))
+        merged.propertyPermissions = mergePermissionsByCode(base.propertyPermissions, caller.propertyPermissions);
+    return merged;
+}
+/**
+ * Incremental (`merge:true`) workflow edit: the caller sends ONLY the activities/
+ * routes it adds or changes; the draft is the base. Draft activities survive
+ * unless overridden by `activityCode`, caller-only codes append (usually before
+ * END via `completeWorkflowChain`), and route edges union (caller wins on the
+ * same edge). This is the "read back, then send the delta" path — without it a
+ * subset silently REPLACED the whole activity list and dropped nodes.
+ */
+function mergeCallerDelta(template, draft) {
+    const { routes: routesRaw, activities: _raw, edges: edgesRaw, ...rest } = template;
+    const routes = routesRaw ?? edgesRaw;
+    const draftActivities = Array.isArray(draft.activities) ? draft.activities : [];
+    const draftRules = Array.isArray(draft.rules) ? draft.rules : [];
+    const caller = (callerActivities(template) ?? []).map((raw) => {
+        const type = activityTypeOf(raw);
+        const name = activityNameOf(raw);
+        return {
+            // Drop the input aliases AND the readback-only keys (`code`/`index` come
+            // from workflowSummary): the merge override is spread onto the draft row,
+            // so an unstripped alias would ride the wire and make the platform answer
+            // a misleading 401001 (same policy as mapCallerActivities).
+            ...Object.fromEntries(Object.entries(raw).filter(([key]) => !ACTIVITY_INPUT_ALIAS_KEYS.includes(key))),
+            activityCode: activityCodeOf(raw),
+            ...(type ? { activityType: type } : {}),
+            ...(name !== undefined ? { activityName: name, i18nMessage: name } : {}),
+            // Normalize a participant shorthand to a platform-resolvable form (the
+            // merge path bypasses mapCallerActivities; see normalizeParticipantForWire).
+            ...(raw.participant !== undefined ? { participant: normalizeParticipantForWire(raw.participant) } : {}),
+        };
+    });
+    // Live 2026-09-23: the platform cannot rename an existing activityCode — the
+    // stored name/type win (same constraint the replace path reconciles). A
+    // caller that re-sends the readback with a changed name/type must get a FRESH
+    // code, and the old node must be DROPPED so it is a rename, not a duplicate.
+    const { activities: reconciledCaller, codeMap } = reconcileCallerActivityCodes(caller, draftActivities);
+    const draftByCode = new Map(draftActivities.map((activity) => [String(activity.activityCode ?? ""), activity]));
+    const originalOf = new Map();
+    for (const [original, final] of codeMap)
+        if (String(original) !== String(final))
+            originalOf.set(String(final), String(original));
+    // Map each caller node back to the DRAFT code it targets, so an override
+    // (including a rename) replaces that draft row IN PLACE instead of moving
+    // the node to the end of the chain. A renamed node inherits the old row's
+    // subfaces (geometry, sheetCode, todoDataItems, …) — only code/name/type change.
+    const callerByOriginal = new Map();
+    for (const activity of reconciledCaller) {
+        const final = String(activity.activityCode);
+        const original = originalOf.get(final) ?? final;
+        const base = draftByCode.get(original);
+        callerByOriginal.set(original, base ? deepMergeActivityRow(base, activity) : activity);
+    }
+    const mergedActivities = draftActivities.map((activity) => {
+        const key = String(activity.activityCode ?? "");
+        const override = callerByOriginal.get(key);
+        if (!override)
+            return activity;
+        callerByOriginal.delete(key);
+        return { ...activity, ...override };
+    });
+    const newActivities = [...callerByOriginal.values()];
+    // Insert added nodes BEFORE the terminal END, so the auto-chain reads
+    // START → …existing… → new → END (appending after END produced a chain that
+    // ended on the new node instead of END).
+    if (newActivities.length > 0) {
+        let endIndex = mergedActivities.length;
+        for (let index = mergedActivities.length - 1; index >= 0; index -= 1) {
+            if (String(mergedActivities[index]?.activityType ?? "") === "END") {
+                endIndex = index;
+                break;
+            }
+        }
+        mergedActivities.splice(endIndex, 0, ...newActivities);
+    }
+    const remapCode = (value) => codeMap.get(String(value ?? "")) ?? value;
+    // Both draft edges and caller edges follow a renamed node; the caller may use
+    // any endpoint spelling, so remap every alias.
+    const remapRuleEndpoints = (rule) => {
+        const mapped = { ...rule };
+        for (const key of ["preActivityCode", "preNode", "pre", "from"])
+            if (rule[key] !== undefined)
+                mapped[key] = remapCode(rule[key]);
+        for (const key of ["postActivityCode", "postNode", "post", "to"])
+            if (rule[key] !== undefined)
+                mapped[key] = remapCode(rule[key]);
+        return mapped;
+    };
+    const edgeKey = (rule) => `${rule.preActivityCode ?? rule.preNode ?? rule.pre ?? rule.from}->${rule.postActivityCode ?? rule.postNode ?? rule.post ?? rule.to}`;
+    const remappedDraftRules = draftRules.map(remapRuleEndpoints);
+    const mappedCallerRoutes = Array.isArray(routes) ? mapCallerRules(routes.map((entry) => remapRuleEndpoints((entry ?? {}))), remappedDraftRules, mergedActivities) : [];
+    const byEdge = new Map();
+    for (const rule of remappedDraftRules)
+        byEdge.set(edgeKey(rule), rule);
+    for (const rule of mappedCallerRoutes)
+        byEdge.set(edgeKey(rule), { ...(byEdge.get(edgeKey(rule)) ?? {}), ...rule });
+    const mergedRules = completeWorkflowChain([...byEdge.values()], mergedActivities);
+    // Same layout + points derivation as the replace path: a chain-completion edge
+    // synthesized above carries no points, and the designer canvas needs them.
+    const laidOut = canonicalizeWorkflowLayout(mergedActivities, mergedRules);
+    const rules = mergedRules.map((rule) => {
+        const absent = rule.points === undefined || rule.points === null;
+        return laidOut.changed || absent
+            ? { ...rule, points: deriveRulePoints(String(rule.preActivityCode ?? ""), String(rule.postActivityCode ?? ""), laidOut.activities) }
+            : rule;
+    });
+    return { ...rest, activities: laidOut.activities, rules };
+}
+function normalizeWorkflowTemplate(template, draft) {
+    if (template === undefined || template === null)
+        return {};
+    const { routes: routesRaw, activities: rawActivities, edges: edgesRaw, ...rest } = template;
+    const routes = routesRaw ?? edgesRaw;
+    void rawActivities;
+    // Array OR index-keyed object; `rest` must not carry the raw form or an
+    // object-shaped activities would ride the wire unmerged.
+    const rawCaller = callerActivities(template);
+    const draftActivities = Array.isArray(draft.activities) ? draft.activities : [];
+    const draftRules = Array.isArray(draft.rules) ? draft.rules : [];
+    // The platform cannot rename an existing activityCode (see the reconcile
+    // comment); give every changed/new node a fresh code, and remap caller routes
+    // so they follow.
+    const reconciled = rawCaller ? reconcileCallerActivityCodes(rawCaller, draftActivities) : undefined;
+    const activities = reconciled?.activities;
+    const codeMap = reconciled?.codeMap ?? new Map();
+    const remapCode = (value) => codeMap.get(String(value ?? "")) ?? value;
+    const remappedRoutes = Array.isArray(routes)
+        ? routes.map((entry) => {
+            const record = (entry ?? {});
+            return {
+                ...record,
+                ...(record.preNode !== undefined ? { preNode: remapCode(record.preNode) } : {}),
+                ...(record.postNode !== undefined ? { postNode: remapCode(record.postNode) } : {}),
+                ...(record.pre !== undefined ? { pre: remapCode(record.pre) } : {}),
+                ...(record.post !== undefined ? { post: remapCode(record.post) } : {}),
+            };
+        })
+        : routes;
+    const normalized = { ...rest };
+    if (activities)
+        normalized.activities = mapCallerActivities(activities, draftActivities);
+    if (Array.isArray(remappedRoutes)) {
+        const mapped = mapCallerRules(remappedRoutes, draftRules, normalized.activities ?? draftActivities);
+        normalized.rules = Array.isArray(rest.rules) ? [...rest.rules, ...mapped] : mapped;
+    }
+    if (Array.isArray(rest.rules) && !Array.isArray(remappedRoutes))
+        normalized.rules = mapCallerRules(rest.rules, draftRules, normalized.activities ?? draftActivities);
+    if (activities && !Array.isArray(remappedRoutes) && !Array.isArray(rest.rules)) {
+        const mappedActivities = normalized.activities;
+        const remapped = draftRules.map((rule) => {
+            const preIndex = draftActivities.findIndex((activity) => String(activity.activityCode ?? "") === String(rule.preActivityCode ?? ""));
+            const postIndex = draftActivities.findIndex((activity) => String(activity.activityCode ?? "") === String(rule.postActivityCode ?? ""));
+            const pre = mappedActivities[preIndex]?.activityCode ?? rule.preActivityCode;
+            const post = mappedActivities[postIndex]?.activityCode ?? rule.postActivityCode;
+            return { ...rule, preActivityCode: pre, postActivityCode: post };
+        });
+        normalized.rules = completeWorkflowChain(remapped, mappedActivities);
+    }
+    // Live 2026-09-17: merged activities may collide (two PARTICIPANT nodes both
+    // inheriting the draft PARTICIPANT's box) — lay the chain out canonically,
+    // then re-derive every rule's points from the final geometry so the designer
+    // lines follow the boxes instead of drawing a horizontal stub.
+    if (Array.isArray(normalized.activities)) {
+        const laidOut = canonicalizeWorkflowLayout(normalized.activities, Array.isArray(normalized.rules) ? normalized.rules : []);
+        normalized.activities = laidOut.activities;
+        // Caller-authored points on an already-renderable layout stay verbatim;
+        // points are re-derived when the geometry was repaired — or when a rule
+        // carries none at all (a chain-completion edge synthesized above). A
+        // provided-but-malformed points value is left for validateWorkflowRender to
+        // refuse (never silently repaired).
+        if (Array.isArray(normalized.rules))
+            normalized.rules = normalized.rules.map((rule) => {
+                const absent = rule.points === undefined || rule.points === null;
+                return laidOut.changed || absent
+                    ? { ...rule, points: deriveRulePoints(String(rule.preActivityCode ?? ""), String(rule.postActivityCode ?? ""), laidOut.activities) }
+                    : rule;
+            });
+    }
+    return normalized;
+}
+/**
+ * Ticket 112 — merge the caller template onto the FULL get_draft row before
+ * the update/publish wire. The platform save is a full-row write; posting a
+ * minimal template leaves converter-swallowed holes and answers errcode
+ * 50000 (live incident). Caller keys override; everything else echoes the
+ * draft verbatim (the same merge pattern workflow.bindRule uses).
+ */
+async function mergedTemplateBody(session, schemaCode, code, template, merge = false) {
+    const draft = await getWorkflowDraftOrNull(session, code);
+    if (draft == null)
+        throw new ToolRefusalError({
+            status: "refused",
+            blocker: "workflow-not-found",
+            workflowCode: code,
+            message: `流程 ${code} 不存在（get_draft 401001 缺席）——先 workflow.create 再 update/publish`,
+        });
+    const normalized = merge ? mergeCallerDelta(template, draft) : normalizeWorkflowTemplate(template, draft);
+    // S29 contract: a PARTICIPANT activity requires sheetCode = the schema's
+    // sheet, else validate/publish answers 401026 WORKFLOW_ACTIVITY_NO_SHEET. The
+    // platform's own draft sets each participant's sheetCode to the model code;
+    // an activity the caller ADDED has no draft row to inherit it from, so
+    // backfill it (the default-form slot is the model code — same rule as
+    // configure_form's omitted sheetCode).
+    if (Array.isArray(normalized.activities))
+        normalized.activities = normalized.activities.map((activity) => String(activity.activityType ?? "") === "PARTICIPANT" && (activity.sheetCode === undefined || activity.sheetCode === null || activity.sheetCode === "")
+            ? { ...activity, sheetCode: schemaCode }
+            : activity);
+    return { ...draft, ...normalized, schemaCode, workflowCode: code };
+}
+/**
+ * Round-2 BUG-05 — live `workflow/get_header` and `workflow/get_draft` answer
+ * `401001 流程不存在！` for an ABSENT workflow rather than a null payload. Both
+ * are ABSENCE signals, not failures: the pre-create probe and the post-create
+ * readback must treat them as "no workflow" so workflow.create can proceed
+ * instead of stopping at the probe's 401001.
+ */
+function isWorkflowAbsent(error) {
+    return error instanceof WireError && error.kind === "business" && error.errcode === 401001;
+}
+/**
+ * Identity seam: a caller may hold only the model's `schemaCode`. Resolve the
+ * workflow it backs via the platform link (workflow/isworkflow →
+ * workflow/getWorkflow); return null when the model has no workflow.
+ */
+async function resolveWorkflowArg(session, args) {
+    if (args.workflowCode)
+        return args.workflowCode;
+    if (!args.schemaCode)
+        throw new ToolInputError({ status: "error", blocker: "tool-input-invalid", tool: "workflow.*", message: "需要 workflowCode，或 schemaCode（工具内部解析该模型的流程）" });
+    const code = (await wireCall(session, { path: ENDPOINTS.workflowIsWorkflow, query: { schemaCode: args.schemaCode } })).data === true
+        ? (await wireCall(session, { path: ENDPOINTS.workflowGetBySchema, query: { schemaCode: args.schemaCode } })).data
+        : null;
+    const workflowCode = code && typeof code.workflowCode === "string" && code.workflowCode ? code.workflowCode : null;
+    return workflowCode;
+}
+async function getWorkflowHeaderOrNull(session, workflowCode) {
+    try {
+        return ((await wireCall(session, { path: ENDPOINTS.workflowGetHeader, query: { workflowCode } })).data ?? null);
+    }
+    catch (error) {
+        if (isWorkflowAbsent(error))
+            return null;
+        throw error;
+    }
+}
+async function getWorkflowDraftOrNull(session, workflowCode) {
+    try {
+        return ((await wireCall(session, { path: ENDPOINTS.workflowGetDraft, query: { workflowCode } })).data ?? null);
+    }
+    catch (error) {
+        if (isWorkflowAbsent(error))
+            return null;
+        throw error;
+    }
+}
+/**
+ * Round 4 (context-cost): keep the node structure in the default workflow
+ * readback. The full template row is 30–75 KB (activities ×4, originateActivity,
+ * notify config); without this projection the agent fetches the whole artifact
+ * just to see the node list. Reproduced benchmark: `artifact get` was 56% of a
+ * complex task's stdout, dominated by workflow.get_draft/get_published (75 KB +
+ * 52 KB). Full body stays reachable via detailArtifactId, `--jq`, or `--full`.
+ */
+/**
+ * Round 16: compact, non-default field-permission summary for one activity.
+ * The full permission row carries ~10 keys per field (`propertyName`,
+ * `encryptVisible`, `decryptAble`, …); the caller only needs to confirm who can
+ * see/edit/require what, so keep `{code, visible, editable, required}` and drop
+ * the all-false rows that dominate the full body. Returns undefined when the
+ * activity declares no permission face or has no non-default row.
+ */
+function activityPermissions(activity) {
+    const rows = activity.propertyPermissions;
+    if (!Array.isArray(rows))
+        return undefined;
+    const permissions = rows
+        .filter((row) => Boolean(row && typeof row === "object" && !Array.isArray(row)))
+        .map((row) => ({ code: row.propertyCode ?? null, visible: row.visible === true, editable: row.editable === true, required: row.required === true }))
+        .filter((row) => row.visible || row.editable || row.required);
+    return permissions.length > 0 ? { permissions } : undefined;
+}
+export function workflowCompactProjection(result) {
+    const data = (result.data ?? null);
+    if (data === null)
+        return {};
+    const activities = (data.activities ?? {});
+    const nodes = Object.entries(activities).map(([index, activity]) => ({
+        index: Number(index),
+        code: activity.activityCode ?? null,
+        type: activity.activityType ?? null,
+        name: activity.activityName ?? activity.i18nMessage ?? null,
+        ...(activity.participant !== undefined ? { participant: activity.participant } : {}),
+        // Round 16 (bench65 feedback): a participant node's field permissions were
+        // only visible in the 30–45 KB full body, so acceptance (and any "did my
+        // permission edit land?") required the artifact. Surface only the
+        // NON-DEFAULT rows (any of visible/editable/required true) so the summary
+        // stays small and names exactly what a readback should confirm.
+        ...(activityPermissions(activity) ?? {}),
+    }));
+    const rules = data.rules;
+    const edges = Array.isArray(rules)
+        ? rules.map((rule) => {
+            const record = rule;
+            return { from: record.preActivityCode ?? null, to: record.postActivityCode ?? null, ...workflowRouteConditionView(record) };
+        })
+        : [];
+    // Round 15 (bench61 feedback): a count ("ruleBindings: 3") cannot be verified —
+    // show WHICH event handler binds WHICH rule codes, so a readback confirms the
+    // binding without pulling the full body. The platform's own originate node
+    // (填写申请单) and any injected participant are named too, so a caller does not
+    // mistake them for their declared nodes.
+    const ruleBindings = [];
+    for (const [handler, field] of Object.entries(WORKFLOW_EVENT_HANDLER_FIELDS)) {
+        const config = data[field];
+        const codes = Array.isArray(config?.bizActions) ? config.bizActions.filter((value) => typeof value === "string") : [];
+        if (codes.length > 0 && config?.bizActionType === "BIZ_RULE")
+            ruleBindings.push({ handler, field, ruleCodes: codes });
+    }
+    const originate = data.originateActivity;
+    return {
+        workflowSummary: {
+            workflowCode: data.workflowCode ?? result.workflowCode ?? null,
+            templateType: data.templateType ?? null,
+            activities: nodes,
+            edges,
+            ruleBindings,
+            ruleBindingCount: ruleBindings.reduce((sum, binding) => sum + binding.ruleCodes.length, 0),
+            ...(originate ? { originateActivity: { code: originate.activityCode ?? null, type: originate.activityType ?? null, name: originate.activityName ?? originate.i18nMessage ?? null, participant: originate.participant ?? null } } : {}),
+        },
+        // Editing needs only `activities` (array or index object) + `routes`: the tool
+        // merges onto the stored draft, connects added nodes through to END, fills
+        // sheetCode and geometry. Reading the 30–75 KB full body is NOT required —
+        // bench17 pulled 61 KB `full:true` just to edit two node names.
+        summaryHint: "改流程只需把要改/新增的 activities（数组）+ routes 传给 workflow.update：缺 START/END 的部分模板会自动按增量 merge 到草稿（草稿为基，自动补 sheetCode/连线/坐标），无需读回整模板或 --full 正文；字段权限也只需在对应 PARTICIPANT 上给 propertyPermissions:[{propertyCode,...}]，工具按 propertyCode 合并、未列的字段权限保留。只有要整图替换时才给全 START..END 的完整模板；要看通知等完整节点正文才用 detailArtifactId 或 --full",
+    };
+}
+/**
+ * A workflow event handler (start/cancel/activate/end) binds a business rule by
+ * CODE. The platform's designer rule picker only offers CUSTOM rules — the
+ * preset trigger rows (Create/Update/Delete/Load/GetList/Available/Cancel, all
+ * `defaultRule:true`) are NOT selectable there, because they already run on the
+ * data event itself. Binding one (2026-09-28: bench59 bound `Create` to `end`)
+ * produces a handler the designer cannot represent. Refuse before any write.
+ */
+async function assertBindableWorkflowRules(session, schemaCode, codes) {
+    const presets = codes.filter((code) => PLATFORM_TRIGGER_RULE_CODES.has(code));
+    if (presets.length > 0)
+        throw new ToolRefusalError({
+            status: "refused",
+            blocker: "workflow-bind-preset-rule",
+            ruleCodes: presets,
+            message: `流程事件只能绑定【自定义】业务规则，不能绑定平台预置触发规则（${presets.join("、")}）——预置规则已在数据事件上运行，设计器的流程事件规则选择器不提供它们。要「审批通过后执行某逻辑」，请新建一条自定义规则（自定义 ruleCode），把动作节点写进它，再 bindRule 到对应 handler；或在预置 Create/Update 规则里直接追加节点。`,
+        });
+    // Cross-check the authoritative `defaultRule` flag (covers preset codes not in
+    // the local set, and a schema that renamed one).
+    let rows;
+    try {
+        const list = await wireCall(session, { path: ENDPOINTS.businessRuleListBySchemaCode, query: { schemaCode } });
+        rows = wireRows(list.data);
+    }
+    catch {
+        return new Map(); // a read failure must not block an otherwise-valid bind
+    }
+    const byCode = new Map(rows.map((row) => [String(row.code ?? ""), row]));
+    const defaults = codes.filter((code) => byCode.get(code)?.defaultRule === true && !PLATFORM_TRIGGER_RULE_CODES.has(code));
+    if (defaults.length > 0)
+        throw new ToolRefusalError({
+            status: "refused",
+            blocker: "workflow-bind-preset-rule",
+            ruleCodes: defaults,
+            message: `流程事件只能绑定自定义业务规则；${defaults.join("、")} 是平台预置默认规则（defaultRule:true），设计器不可选。改用自定义规则。`,
+        });
+    return byCode;
+}
+/**
+ * A rule bound to a workflow event handler is INERT while disabled — the
+ * designer shows it 失效/未启用 and the event handler will not run it. Binding a
+ * workflow rule therefore GUARANTEES the bound custom rule is enabled: a
+ * disabled/never-published rule (the state `rule.save` leaves) is published +
+ * enabled here via the same `rule.enable` chain. Live 2026-10-08 (SCM sandbox):
+ * rules created with `rule.save` (DRAFT/DISABLED) and bound with
+ * `workflow.bindRule` read back 「失效·未启用」 in the workflow designer — a
+ * workflow-bound rule MUST be enabled.
+ */
+async function ensureWorkflowRulesEnabled(session, schemaCode, codes, byCode) {
+    const enabledRuleCodes = [];
+    const alreadyEnabledRuleCodes = [];
+    if (byCode.size === 0)
+        return { enabledRuleCodes, alreadyEnabledRuleCodes }; // list read failed → cannot judge
+    for (const code of codes) {
+        const row = byCode.get(code);
+        if (!row)
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "workflow-bind-rule-absent",
+                schemaCode,
+                ruleCodes: [code],
+                message: `流程事件要绑定的规则 "${code}" 不存在（${schemaCode} 的 list_by_schemacode 无此 code）——流程事件只能绑已存在的【自定义】规则。先用 rule.save 建该规则（CUSTOM_NODE + 动作节点），再 bindRule。`,
+            });
+        if (row.enabled === true) {
+            alreadyEnabledRuleCodes.push(code);
+            continue;
+        }
+        // Disabled/DRAFT: publish + enable so the event handler actually runs it.
+        await executeRuleEnableWrite(session, { schemaCode, ruleCode: code });
+        enabledRuleCodes.push(code);
+    }
+    return { enabledRuleCodes, alreadyEnabledRuleCodes };
+}
+export function registerWorkflowLane(tools) {
+    // Sibling registry for the high-level `configure_workflow` (reuses each atomic
+    // tool's own writeExecute so every gate + readback is identical).
+    const siblings = tools;
+    tools.push(defineTool({
+        name: "workflow.get_draft",
+        layer: "low",
+        kind: "read",
+        lane: WORKFLOW_LANE,
+        scope: WORKFLOW_TOOLS["workflow.get_draft"].scope,
+        description: WORKFLOW_TOOLS["workflow.get_draft"].description,
+        inputSchema: {
+            environment: environmentArg,
+            workflowCode: z.string().optional().describe("流程 code；也可改用 schemaCode（工具内部按 workflow/isworkflow + workflow/getWorkflow 解析）"),
+            schemaCode: z.string().optional().describe("模型 code：省略 workflowCode 时用它解析该模型已发布的流程；模型没有流程则 exists:false"),
+            full: z.boolean().optional().describe("内联完整工作流模板；默认返回摘要与 detailFile"),
+            capability: capabilityArg,
+        },
+        handler: async (ctx, args, self) => governedRead(ctx, self, args, async (session) => {
+            // Identity seam: callers often hold only the model's schemaCode; resolve the
+            // workflow it backs rather than forcing an external mapping.
+            const workflowCode = await resolveWorkflowArg(session, args);
+            if (!workflowCode)
+                return { schemaCode: args.schemaCode, exists: false, note: "该模型没有已发布流程（workflow/isworkflow=false）；先 workflow.create" };
+            // Round-2 BUG-05: a missing workflow answers 401001 — surface absence as
+            // a clean readback (exists:false) instead of a confusing error.
+            const draft = await getWorkflowDraftOrNull(session, workflowCode);
+            return draft == null
+                ? { workflowCode, exists: false, note: "流程不存在（平台 401001 = 缺席信号）；先 workflow.create" }
+                : { workflowCode, exists: true, data: draft };
+        }, { full: args.full === true, compact: workflowCompactProjection, target: `workflow.get_draft:${args.workflowCode ?? args.schemaCode}` }),
+    }));
+    tools.push(defineTool({
+        name: "workflow.get_published",
+        layer: "low",
+        kind: "read",
+        lane: WORKFLOW_LANE,
+        scope: WORKFLOW_TOOLS["workflow.get_published"].scope,
+        description: WORKFLOW_TOOLS["workflow.get_published"].description,
+        inputSchema: {
+            environment: environmentArg,
+            workflowCode: z.string().optional().describe("流程 code；也可改用 schemaCode（工具内部按 workflow/isworkflow + workflow/getWorkflow 解析）"),
+            schemaCode: z.string().optional().describe("模型 code：省略 workflowCode 时用它解析该模型已发布的流程；模型没有流程则 exists:false"),
+            full: z.boolean().optional().describe("内联完整工作流模板；默认返回摘要与 detailFile"),
+            capability: capabilityArg,
+        },
+        handler: async (ctx, args, self) => governedRead(ctx, self, args, async (session) => {
+            const workflowCode = await resolveWorkflowArg(session, args);
+            if (!workflowCode)
+                return { schemaCode: args.schemaCode, exists: false, published: false, note: "该模型没有已发布流程（workflow/isworkflow=false）；先 workflow.create 再 publish" };
+            let pub;
+            try {
+                pub = await wireCall(session, { path: ENDPOINTS.workflowGetPublished, query: { workflowCode } });
+            }
+            catch (error) {
+                // Live `workflow/get_published` also answers 401001 流程不存在！ for an
+                // absent workflow. Mirror workflow.get_draft: surface absence as a
+                // clean exists:false readback so a greenfield probe does not have to
+                // create the workflow first.
+                if (isWorkflowAbsent(error))
+                    return { workflowCode, exists: false, published: false, note: "流程不存在（平台 401001 = 缺席信号）；先 workflow.create 再 publish" };
+                throw error;
+            }
+            // Ticket 77: the platform answers the DRAFT shape for an unpublished
+            // workflow — data presence is NOT publish evidence. The published face
+            // is identified by its markers (templateType PUBLISH / published flag).
+            const data = (pub.data ?? null);
+            const published = data !== null && (data.templateType === "PUBLISH" || data.published === true);
+            return {
+                workflowCode,
+                exists: true,
+                published,
+                ...(data && !published ? { note: "平台对未发布流程仍返回草稿形态——此读回不能当作已发布证据；以 published:true / templateType:PUBLISH 为准（先 workflow.publish）" } : {}),
+                data: pub.data,
+            };
+        }, { full: args.full === true, compact: workflowCompactProjection, target: `workflow.get_published:${args.workflowCode ?? args.schemaCode}` }),
+    }));
+    tools.push(defineTool({
+        name: "workflow.validate",
+        layer: "low",
+        kind: "read",
+        lane: WORKFLOW_LANE,
+        scope: WORKFLOW_TOOLS["workflow.validate"].scope,
+        description: WORKFLOW_TOOLS["workflow.validate"].description,
+        inputSchema: {
+            environment: environmentArg,
+            workflowCode: z.string().optional().describe("要校验的流程；省略则用 schemaCode 解析"),
+            schemaCode: z.string().optional().describe("模型 code：省略 workflowCode 时用它解析该模型的流程"),
+            template: workflowTemplateArg.optional().describe("可选：先按 workflow.update 的 merge 语义合成该模板再校验；省略则校验当前草稿"),
+            capability: capabilityArg,
+        },
+        handler: async (ctx, args, self) => governedRead(ctx, self, args, async (session) => {
+            const workflowCode = await resolveWorkflowArg(session, args);
+            if (!workflowCode)
+                return { schemaCode: args.schemaCode, exists: false, note: "该模型没有流程可校验" };
+            const template = (args.template ?? {});
+            const body = await mergedTemplateBody(session, args.schemaCode ?? "", workflowCode, template, activitiesLackBoundaries(template));
+            const result = await wireCall(session, { path: ENDPOINTS.workflowValidate, method: "POST", body });
+            const messages = Array.isArray(result.data) ? result.data : [];
+            const errors = messages.filter((message) => message.errorLevel === "ERROR");
+            const warnings = messages.filter((message) => message.errorLevel !== "ERROR");
+            return { workflowCode, valid: errors.length === 0, errorCount: errors.length, warningCount: warnings.length, errors, warnings };
+        }, { target: `workflow.validate:${args.workflowCode ?? args.schemaCode}` }),
+    }));
+    writeTool(tools, "workflow.create", WORKFLOW_LANE, WORKFLOW_TOOLS["workflow.create"].scope, WORKFLOW_TOOLS["workflow.create"].description, { schemaCode: z.string().min(1), name: z.string().min(1), code: z.string().min(1) }, async (session, args) => {
+        // Ticket 76 idempotent retry: get_header FIRST — a post-timeout
+        // re-create of the same code short-circuits with the existing header
+        // and ZERO create wires. On the happy path this read REPLACES the
+        // post-create header read (same wire count), because a successful
+        // create implies the header.
+        const existingHeader = await getWorkflowHeaderOrNull(session, args.code);
+        if (existingHeader != null) {
+            return { performed: { skipped: "already-present" }, readback: { alreadyPresent: true, header: existingHeader } };
+        }
+        let performed;
+        try {
+            performed = await wireCall(session, {
+                path: ENDPOINTS.workflowCreate,
+                method: "POST",
+                body: { workflowCode: args.code, workflowName: args.name, schemaCode: args.schemaCode, icon: "h-icon-all-logic" },
+            });
+        }
+        catch (error) {
+            // Ticket 76 live: the platform answers an envelope with NO numeric
+            // errcode when the SCHEMA already has a workflow (a second, differently
+            // coded one is refused). Decode it as a duplicate-create — same-code
+            // presence was already excluded by the pre-check, so this is the
+            // different-code case — instead of surfacing a malformed-envelope
+            // transport-looking failure on a business duplicate.
+            if (error instanceof WireError && error.kind === "malformed-envelope") {
+                const has = await wireCall(session, { path: ENDPOINTS.workflowIsWorkflow, query: { schemaCode: args.schemaCode } });
+                if (has.data === true) {
+                    throw new ToolRefusalError({
+                        status: "refused",
+                        blocker: "workflow-already-exists",
+                        schemaCode: args.schemaCode,
+                        workflowCode: args.code,
+                        message: `模型 ${args.schemaCode} 已有流程（平台对重复创建返回非数字 errcode 的 envelope）——一个模型只能有一个流程。要改现有流程用 workflow.update/workflow.publish（先 workflow.get_draft 取当前模板），不要另建新 code`,
+                    });
+                }
+            }
+            throw error;
+        }
+        const draft = await getWorkflowDraftOrNull(session, args.code);
+        return {
+            performed: { errcode: performed.errcode },
+            readback: { workflowCode: args.code, headerPresent: true, draftPresent: draft != null, templateId: draft?.id ?? null },
+        };
+    });
+    writeTool(tools, "workflow.update", WORKFLOW_LANE, WORKFLOW_TOOLS["workflow.update"].scope, WORKFLOW_TOOLS["workflow.update"].description, { schemaCode: z.string().min(1), code: z.string().min(1), template: workflowTemplateArg, merge: z.boolean().optional().describe("增量：只发改动/新增的活动与路由，工具按 activityCode 合并到草稿（草稿为基；新增节点自动接链），不必先读回整模板再重发。默认自动：模板缺 START 或 END 时按增量 merge（部分模板），给了完整 START..END 才整模板替换；显式 true 强制增量、false 强制替换") }, async (session, args) => {
+        const template = args.template ?? {};
+        validateCallerActivities(template, "workflow.update");
+        validateWorkflowRouteConditions(template, "workflow.update");
+        assertTemplateNotMinimal(template, "workflow.update");
+        lintWorkflowTemplate(template, "workflow.update");
+        // Ticket 112: merge onto the full draft row — a verbatim minimal post
+        // leaves converter holes and answers errcode 50000 on the platform.
+        // Delta semantics: explicit `true` forces merge, explicit `false` forces
+        // replace, and the default auto-detects a partial template (missing
+        // START/END) as a delta — see activitiesLackBoundaries.
+        const merge = args.merge === true || (args.merge !== false && activitiesLackBoundaries(template));
+        const body = await mergedTemplateBody(session, args.schemaCode, args.code, template, merge);
+        validateWorkflowRender(body, "workflow.update");
+        // Live: workflow/update does NOT run the template validator — it stores a
+        // refused participant silently and only /publish answers the
+        // ValidateMessage[]. So the guard belongs on publish/bindRule, not here.
+        const performed = await wireCall(session, { path: ENDPOINTS.workflowUpdate, method: "POST", body });
+        const draft = await wireCall(session, { path: ENDPOINTS.workflowGetDraft, query: { workflowCode: args.code } });
+        const data = (draft.data ?? null);
+        if (!data)
+            throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-readback-invalid", message: "workflow.update returned no draft" });
+        validateWorkflowRender(data, "workflow.update readback");
+        const participantWarnings = participantReferenceWarnings(data);
+        return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, activities: Array.isArray(data.activities) ? data.activities.length : 0, templateType: data.templateType ?? null, ...(participantWarnings.length ? { participantWarnings } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
+    });
+    writeTool(tools, "workflow.publish", WORKFLOW_LANE, WORKFLOW_TOOLS["workflow.publish"].scope, WORKFLOW_TOOLS["workflow.publish"].description, { schemaCode: z.string().min(1), code: z.string().min(1), template: workflowTemplateArg.optional() }, async (session, args) => {
+        // An absent template publishes the stored draft as-is — the platform's own
+        // path. The schema is optional so the contract no longer contradicts it.
+        const template = args.template ?? {};
+        validateCallerActivities(template, "workflow.publish");
+        validateWorkflowRouteConditions(template, "workflow.publish");
+        assertTemplateNotMinimal(template, "workflow.publish");
+        lintWorkflowTemplate(template, "workflow.publish");
+        // Ticket 112: same merge-before-write as update. A template without both
+        // boundaries is a partial edit → delta merge (see activitiesLackBoundaries).
+        const body = await mergedTemplateBody(session, args.schemaCode, args.code, template, activitiesLackBoundaries(template));
+        validateWorkflowRender(body, "workflow.publish");
+        const performed = await wireCall(session, { path: ENDPOINTS.workflowPublish, method: "POST", body });
+        // A refused publish answers errcode 0 — the ValidateMessage[] is the truth.
+        assertWorkflowWriteAccepted(performed, "workflow.publish", args.code);
+        const published = await wireCall(session, { path: ENDPOINTS.workflowGetPublished, query: { workflowCode: args.code } });
+        const data = (published.data ?? null);
+        // Ticket 77: publish evidence is the published-face MARKER, not data
+        // presence (the endpoint answers the draft shape when unpublished).
+        const isPublished = data !== null && (data.templateType === "PUBLISH" || data.published === true);
+        if (!data)
+            throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-readback-invalid", message: "workflow.publish returned no published template" });
+        const warnings = workflowValidationWarnings(performed.data);
+        // The platform accepted the write (no ERROR) yet the published face still
+        // shows the draft marker: surface that honestly instead of implying the
+        // flow went live.
+        if (!isPublished)
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "workflow-publish-not-applied",
+                workflowCode: args.code,
+                message: `workflow.publish: 平台接受写入（errcode 0）但读回仍是草稿形态（templateType=${String(data.templateType ?? "null")}, published=${String(data.published ?? "null")}）——流程未生效。先 workflow.validate 复核模板，修正后重试`,
+            });
+        validateWorkflowRender(data, "workflow.publish readback");
+        const participantWarnings = participantReferenceWarnings(data);
+        return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, published: isPublished, workflowVersion: data.workflowVersion ?? null, ...(warnings.length ? { warnings } : {}), ...(participantWarnings.length ? { participantWarnings } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
+    });
+    writeTool(tools, "workflow.bindRule", WORKFLOW_LANE, WORKFLOW_TOOLS["workflow.bindRule"].scope, WORKFLOW_TOOLS["workflow.bindRule"].description, {
+        schemaCode: z.string().min(1),
+        workflowCode: z.string().min(1),
+        ruleCode: z.string().min(1).optional().describe("single-rule form: the rule to bind (mutually exclusive with ruleCodes)"),
+        ruleCodes: z.array(z.string().min(1)).min(1).optional().describe("batch form: several rules bound in ONE update + publish; MERGE semantics — the handler's existing bizActions are preserved and the listed rules appended (deduplicated)"),
+        handler: z
+            .string()
+            .optional()
+            .describe("event handler to bind: start | cancel | activate | end (default end)"),
+        publish: z.boolean().optional(),
+    }, async (session, args) => {
+        const { key: handlerKey, field: handlerField } = resolveEventHandlerField(args.handler);
+        const codes = (args.ruleCodes ?? [args.ruleCode]).map(String);
+        // Only CUSTOM rules are bindable to workflow events — the designer's picker
+        // does not offer preset trigger rows (bench59 bound `Create` to `end`).
+        const bindableByCode = await assertBindableWorkflowRules(session, args.schemaCode, codes);
+        // A bound workflow rule MUST be enabled (else 失效/未启用). Enable any
+        // disabled bound custom rule before writing the binding.
+        const { enabledRuleCodes, alreadyEnabledRuleCodes } = await ensureWorkflowRulesEnabled(session, args.schemaCode, codes, bindableByCode);
+        const shouldPublish = args.publish !== false;
+        const draft = (await getWorkflowDraftOrNull(session, args.workflowCode)) ?? {};
+        if (Object.keys(draft).length === 0) {
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "workflow-not-found",
+                workflowCode: args.workflowCode,
+                message: `流程 ${args.workflowCode} 不存在（get_draft 401001 缺席）——先 workflow.create，再 bindRule`,
+            });
+        }
+        const existing = (draft[handlerField] ?? {});
+        const priorActions = Array.isArray(existing.bizActions)
+            ? existing.bizActions.filter((value) => typeof value === "string")
+            : [];
+        // MERGE: existing bizActions are preserved; the listed rules are
+        // appended in order, deduplicated (same semantics the single-rule form
+        // has always had — replace is NOT the contract).
+        const nextActions = [...priorActions];
+        for (const code of codes)
+            if (!nextActions.includes(code))
+                nextActions.push(code);
+        const nextTemplate = {
+            ...draft,
+            [handlerField]: {
+                ...(typeof existing === "object" && existing ? existing : {}),
+                bizActions: nextActions,
+                bizActionType: "BIZ_RULE",
+            },
+            workflowCode: args.workflowCode,
+            schemaCode: args.schemaCode,
+        };
+        validateWorkflowRender(nextTemplate, "workflow.bindRule");
+        const performed = await wireCall(session, {
+            path: ENDPOINTS.workflowUpdate,
+            method: "POST",
+            body: nextTemplate,
+        });
+        let publishedReadback = null;
+        let publishMarked = false;
+        if (shouldPublish) {
+            const publishPerformed = await wireCall(session, {
+                path: ENDPOINTS.workflowPublish,
+                method: "POST",
+                body: nextTemplate,
+            });
+            // A refused publish answers errcode 0 with the truth in ValidateMessage[].
+            assertWorkflowWriteAccepted(publishPerformed, "workflow.bindRule", args.workflowCode);
+            const pub = await wireCall(session, { path: ENDPOINTS.workflowGetPublished, query: { workflowCode: args.workflowCode } });
+            publishedReadback = (pub.data ?? null);
+            // Authoritative marker, not the request echo (ticket 77 semantics).
+            publishMarked = publishedReadback !== null && (publishedReadback.templateType === "PUBLISH" || publishedReadback.published === true);
+        }
+        const draftReadback = await wireCall(session, { path: ENDPOINTS.workflowGetDraft, query: { workflowCode: args.workflowCode } });
+        const data = (draftReadback.data ?? null);
+        if (!data)
+            throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-readback-invalid", message: "workflow.bindRule returned no draft" });
+        validateWorkflowRender(data, "workflow.bindRule readback");
+        const handler = data ? data[handlerField] : undefined;
+        const bizActions = Array.isArray(handler?.bizActions) ? handler.bizActions.filter((value) => typeof value === "string") : [];
+        const publishedHandler = publishedReadback ? publishedReadback[handlerField] : undefined;
+        const publishedBizActions = Array.isArray(publishedHandler?.bizActions)
+            ? publishedHandler.bizActions.filter((value) => typeof value === "string")
+            : [];
+        return {
+            performed: { errcode: performed.errcode, handler: handlerKey, addedRuleCodes: codes, bizActions, publishRequested: shouldPublish },
+            readback: {
+                workflowCode: args.workflowCode,
+                handler: handlerKey,
+                handlerField,
+                semantics: "merge",
+                bound: codes.every((code) => bizActions.includes(code)),
+                bizActions,
+                // Workflow-bound rules must be enabled; report the enable delta.
+                enabledRuleCodes,
+                alreadyEnabledRuleCodes,
+                bizActionType: typeof handler?.bizActionType === "string" ? handler.bizActionType : null,
+                templateFieldsPreserved: Object.keys(draft).every((key) => key === handlerField || data[key] !== undefined),
+                // Authoritative published-face marker, NOT the request echo: a
+                // refused publish keeps errcode 0 and the draft marker (live 8.6.26).
+                published: publishMarked,
+                publishedBound: codes.every((code) => publishedBizActions.includes(code)),
+                publishedBizActions,
+                publishedBizActionType: typeof publishedHandler?.bizActionType === "string" ? publishedHandler.bizActionType : null,
+                ...(participantReferenceWarnings(data).length ? { participantWarnings: participantReferenceWarnings(data) } : {}),
+                ...(bizActions.length > 1
+                    ? { advisory: `同一事件处理器绑定了 ${bizActions.length} 条规则，它们会**全部执行**（没有互斥）：审批通过/驳回这类互斥结果不要用两条各自 FIXED 赋值的规则——两次都会写、后者覆盖前者（bench22 病灶：通过→已通过、驳回→已驳回 两条各自 FIXED 赋值都绑 endEventHandler）。正确做法二选一：① **绑定到不同处理器/触发**——通过绑流程结束处理器 \`end\`（endEventHandler）或流程生效规则 \`Available\`，驳回绑流程作废处理器 \`cancel\`（cancelEventHandler）或规则 \`Cancel\`；② **一条规则内部按条件分支**（规则图用 BRANCH/filterCondition/dataCondition 读审批结果，多分支各写各的）。真实生产（2026-09-23，case_info_update）只在 endEventHandler 绑一条多分支图（updateData），由该图内部分支完成回写。` }
+                    : {}),
+                workflowRenderCompat: workflowRenderCompat(data),
+            },
+        };
+    }, (args) => {
+        resolveEventHandlerField(args.handler);
+        const hasSingle = typeof args.ruleCode === "string" && args.ruleCode.length > 0;
+        const hasMany = Array.isArray(args.ruleCodes);
+        if (hasSingle && hasMany)
+            throw new ToolRefusalError({ status: "refused", blocker: "workflow-bindrule-codes-exclusive", message: "ruleCode 与 ruleCodes 互斥：单规则用 ruleCode，多规则用 ruleCodes[]" });
+        if (!hasSingle && !hasMany)
+            throw new ToolRefusalError({ status: "refused", blocker: "workflow-bindrule-codes-invalid", message: "需要 ruleCode（单个）或 ruleCodes（数组）之一" });
+        if (hasMany) {
+            const codes = args.ruleCodes;
+            if (codes.length === 0 || new Set(codes.map(String)).size !== codes.length || codes.some((code) => typeof code !== "string" || code.length === 0))
+                throw new ToolRefusalError({ status: "refused", blocker: "workflow-bindrule-codes-invalid", message: "ruleCodes 必须是非空、去重的规则 code 数组" });
+        }
+    });
+    writeTool(tools, "workflow.delete", WORKFLOW_LANE, WORKFLOW_TOOLS["workflow.delete"].scope, WORKFLOW_TOOLS["workflow.delete"].description, { schemaCode: z.string().min(1), code: z.string().min(1) }, async (session, args) => {
+        const performed = await wireCall(session, {
+            path: ENDPOINTS.workflowDelete,
+            method: "POST",
+            query: { workflowCode: args.code },
+        });
+        const header = await wireCall(session, { path: ENDPOINTS.workflowGetHeader, query: { workflowCode: args.code } }).catch(() => ({ data: null }));
+        return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, absent: header.data === null || header.data === undefined } };
+    });
+    // ---- high-level greenfield orchestration (round 10 ergonomics) --------
+    // The survey's write-face gap: a first workflow took create → update →
+    // publish (+ bindRule for rules), 3–4 separate CLI calls. configure_workflow
+    // runs the SAME atomic steps through each tool's own writeExecute, so the
+    // gates/readbacks are identical, in one governed package.
+    registerPackageTool(tools, {
+        name: "configure_workflow",
+        lane: WORKFLOW_LANE,
+        scope: WORKFLOW_TOOLS["configure_workflow"].scope,
+        description: WORKFLOW_TOOLS["configure_workflow"].description,
+        inputSchema: {
+            schemaCode: z.string().min(1),
+            name: z.string().min(1),
+            code: z.string().min(1).describe("workflowCode"),
+            template: workflowTemplateArg.describe("完整模板（activities + routes）；工具内部合并到草稿，含条件分支写法见 workflow.update"),
+            bindRules: z
+                .array(z.object({ handler: z.string().optional(), ruleCodes: z.array(z.string().min(1)).min(1) }))
+                .optional()
+                .describe("可选：发布后绑定业务规则；每项 {handler?,ruleCodes[]}，handler 取 start|cancel|activate|end（缺省 end）"),
+        },
+        plan: (args) => {
+            const actions = [
+                { tool: "workflow.create", args: { schemaCode: args.schemaCode, name: args.name, code: args.code } },
+                { tool: "workflow.update", args: { schemaCode: args.schemaCode, code: args.code, template: args.template } },
+                { tool: "workflow.publish", args: { schemaCode: args.schemaCode, code: args.code } },
+            ];
+            for (const binding of args.bindRules ?? [])
+                actions.push({ tool: "workflow.bindRule", args: { schemaCode: args.schemaCode, workflowCode: args.code, ruleCodes: binding.ruleCodes, ...(binding.handler ? { handler: binding.handler } : {}) } });
+            return { summary: writeSummary("configure_workflow", args, undefined, "plan"), actions };
+        },
+        execute: async (session, args) => {
+            const steps = [];
+            const run = async (toolName, toolArgs) => {
+                const target = siblings.find((tool) => tool.name === toolName);
+                if (!target?.writeExecute)
+                    throw new ToolRefusalError({ status: "refused", blocker: "configure-workflow-step-unavailable", message: `configure_workflow 需要 ${toolName}，但它未注册写执行` });
+                try {
+                    const outcome = await target.writeExecute(session, toolArgs);
+                    steps.push({ step: toolName, ...outcome });
+                    return outcome.readback;
+                }
+                catch (error) {
+                    const envelope = error instanceof ToolRefusalError ? { ...error.payload } : error instanceof WireError ? { blocker: `wire-${error.kind}`, errcode: error.errcode, message: error.message } : { blocker: "configure-workflow-step-failed", message: String(error) };
+                    return { __failed: true, tool: toolName, index: steps.length, envelope };
+                }
+            };
+            for (const [toolName, toolArgs] of [
+                ["workflow.create", { schemaCode: args.schemaCode, name: args.name, code: args.code }],
+                ["workflow.update", { schemaCode: args.schemaCode, code: args.code, template: args.template }],
+                ["workflow.publish", { schemaCode: args.schemaCode, code: args.code }],
+            ]) {
+                const readback = await run(toolName, toolArgs);
+                if (readback && readback.__failed)
+                    return { status: "refused", steps, failedStep: { index: steps.length, tool: toolName }, envelope: readback.envelope };
+            }
+            for (const binding of args.bindRules ?? []) {
+                const readback = await run("workflow.bindRule", { schemaCode: args.schemaCode, workflowCode: args.code, ruleCodes: binding.ruleCodes, ...(binding.handler ? { handler: binding.handler } : {}) });
+                if (readback && readback.__failed)
+                    return { status: "refused", steps, failedStep: { index: steps.length, tool: "workflow.bindRule" }, envelope: readback.envelope };
+            }
+            return { steps, readback: { workflowCode: args.code, published: true, boundHandlers: (args.bindRules ?? []).map((binding) => binding.handler ?? "end") } };
+        },
+        summarize: (args, _outcome, phase) => writeSummary("configure_workflow", args, undefined, phase),
+    });
+    tools.push(defineTool({
+        name: "workitem.list",
+        layer: "low",
+        kind: "read",
+        lane: WORKFLOW_LANE,
+        scope: WORKFLOW_TOOLS["workitem.list"].scope,
+        description: WORKFLOW_TOOLS["workitem.list"].description,
+        inputSchema: {
+            environment: environmentArg,
+            workflowInstanceId: z
+                .string()
+                .optional()
+                .describe("exact-match client-side filter on the returned items' instanceId (the server filterWorkflowInstanceId field is a NOT-equal exclusion, so it is not used)"),
+            workflowCode: z.string().optional(),
+            schemaCode: z.string().optional(),
+            page: z.number().int().min(0).optional(),
+            size: z
+                .number()
+                .int()
+                .min(1)
+                .max(200)
+                .optional()
+                .describe("page size; defaults to 200 when workflowInstanceId is set (single-page scan) else 20"),
+            capability: capabilityArg,
+        },
+        handler: async (ctx, args, self) => governedRead(ctx, self, args, async (session) => {
+            const page = await searchWorkItems(session, {
+                ...(args.workflowInstanceId ? { instanceId: args.workflowInstanceId } : {}),
+                ...(args.workflowCode ? { workflowCode: args.workflowCode } : {}),
+                ...(args.schemaCode ? { schemaCode: args.schemaCode } : {}),
+                page: args.page ?? 0,
+                size: args.size ?? (args.workflowInstanceId ? 200 : 20),
+            });
+            const selected = page.items;
+            // Resolve the in-flight bizObject id per distinct instance. Authoritative
+            // source: getBizObjectByWfInstanceId -> BizObjectCreatedModel.id/schemaCode.
+            // Best-effort: a failed lookup leaves the identity null, never drops the todo.
+            const objectByInstance = new Map();
+            for (const item of selected) {
+                const instanceId = wireString(item.instanceId);
+                if (!instanceId || objectByInstance.has(instanceId))
+                    continue;
+                objectByInstance.set(instanceId, await resolveBizObjectIdByInstance(session, instanceId));
+            }
+            const items = selected.map((item) => {
+                const instanceId = wireString(item.instanceId);
+                const linked = instanceId ? objectByInstance.get(instanceId) : undefined;
+                return {
+                    workItemId: wireString(item.id),
+                    workflowInstanceId: instanceId,
+                    workflowCode: wireString(item.workflowCode),
+                    activityCode: wireString(item.activityCode),
+                    activityName: wireString(item.activityName),
+                    state: wireString(item.state),
+                    sequenceNo: wireString(item.sequenceNo),
+                    originator: wireString(item.originator),
+                    originatorName: wireString(item.originatorName),
+                    participant: wireString(item.participant),
+                    participantName: wireString(item.participantName),
+                    bizObjectId: linked?.bizObjectId ?? null,
+                    schemaCode: linked?.schemaCode ?? wireString(item.schemaCode),
+                };
+            });
+            return {
+                total: page.total,
+                totalPages: page.totalPages,
+                count: items.length,
+                items,
+            };
+        }),
+    }));
+    tools.push(defineTool({
+        name: "org.role.list",
+        layer: "low",
+        kind: "read",
+        lane: WORKFLOW_LANE,
+        scope: WORKFLOW_TOOLS["org.role.list"].scope,
+        description: WORKFLOW_TOOLS["org.role.list"].description,
+        inputSchema: { environment: environmentArg, capability: capabilityArg },
+        handler: async (ctx, args, self) => governedRead(ctx, self, args, async (session) => {
+            const data = (await wireCall(session, { path: ENDPOINTS.organizationRoleList })).data;
+            const roles = [];
+            for (const group of wireRows(data)) {
+                const children = Array.isArray(group.children) ? group.children : [];
+                if (children.length === 0)
+                    roles.push(roleOf(group, null));
+                else
+                    for (const child of children)
+                        roles.push(roleOf(child, String(group.name ?? "")));
+            }
+            return { count: roles.length, roles };
+        }),
+    }));
+    tools.push(defineTool({
+        name: "org.department.list",
+        layer: "low",
+        kind: "read",
+        lane: WORKFLOW_LANE,
+        scope: WORKFLOW_TOOLS["org.department.list"].scope,
+        description: WORKFLOW_TOOLS["org.department.list"].description,
+        inputSchema: { environment: environmentArg, capability: capabilityArg },
+        handler: async (ctx, args, self) => governedRead(ctx, self, args, async (session) => {
+            const data = (await wireCall(session, { path: ENDPOINTS.organizationDepartmentTree })).data;
+            const list = Array.isArray(data?.departmentList) ? data.departmentList : wireRows(data);
+            const departments = list.map((dept) => ({
+                id: dept.id ?? null,
+                name: dept.name ?? null,
+                code: dept.code ?? null,
+                corpId: dept.corpId ?? null,
+                parentId: dept.parentId ?? null,
+            }));
+            return { count: departments.length, departments };
+        }),
+    }));
+    tools.push(defineTool({
+        name: "org.user.search",
+        layer: "low",
+        kind: "read",
+        lane: WORKFLOW_LANE,
+        scope: WORKFLOW_TOOLS["org.user.search"].scope,
+        description: WORKFLOW_TOOLS["org.user.search"].description,
+        inputSchema: {
+            environment: environmentArg,
+            // `wd` is the platform's own key; `keyword`/`q` are accepted aliases so a
+            // caller that reaches for the natural word is not bounced with
+            // "wd: Required" (round 10: an agent sent `keyword` and burned a retry).
+            wd: z.string().min(1).optional().describe("搜索关键字（用户姓名或账号用户名）；平台 \"关键字不能为空\" 即缺它。可用 keyword/q 作别名"),
+            keyword: z.string().min(1).optional().describe("`wd` 的别名"),
+            q: z.string().min(1).optional().describe("`wd` 的别名"),
+            page: z.number().int().min(0).optional().describe("页号，默认 0"),
+            size: z.number().int().min(1).optional().describe("每页条数，默认 100"),
+            filterType: z.string().optional().describe("admin=只搜当前应用管理员可见范围（可省）"),
+            capability: capabilityArg,
+        },
+        handler: async (ctx, args, self) => {
+            const keyword = args.wd ?? args.keyword ?? args.q;
+            if (!keyword)
+                throw new ToolInputError({ status: "error", blocker: "tool-input-invalid", tool: "org.user.search", message: "需要 wd（关键字）；keyword/q 亦可" });
+            return governedRead(ctx, self, { ...args, wd: keyword }, async (session) => {
+                const body = { wd: keyword, page: args.page ?? 0, size: args.size ?? 100 };
+                if (args.filterType !== undefined)
+                    body.filterType = args.filterType;
+                const data = (await wireCall(session, { path: ENDPOINTS.organizationUserSearch, method: "POST", body })).data;
+                const rows = Array.isArray(data?.content) ? data.content : wireRows(data);
+                const users = rows.map((user) => ({
+                    id: user.id ?? null,
+                    name: user.name ?? null,
+                    username: user.username ?? null,
+                    userId: user.userId ?? null,
+                    code: user.code ?? null,
+                    departmentId: user.departmentId ?? null,
+                    corpId: user.corpId ?? null,
+                    status: user.status ?? null,
+                }));
+                return { keyword, count: users.length, total: data?.totalElements ?? users.length, users };
+            });
+        },
+    }));
+}
+/** Flatten a role-group/role row into the participant-construction fields. */
+function roleOf(row, group) {
+    return {
+        id: row.id ?? null,
+        name: row.name ?? null,
+        code: row.code ?? null,
+        roleType: row.roleType ?? null,
+        corpId: row.corpId ?? null,
+        ...(group !== null ? { group } : {}),
+    };
+}
+//# sourceMappingURL=workflow.js.map