weaver-e9-assistant-cli 1.0.0

package/dist/todoreject.js

@@ -0,0 +1,215 @@
+import { createApiFromProfile } from './client.js';
+import { todayStr, nowTimeStr } from './util.js';
+/**
+ * 退回/驳回流程。HAR 正确链路：
+ *   loadForm(2步拿签名) → judgeRejectWay(判断退回方式) → getForwardDatas(取可退回节点) →
+ *   doBack(selectRow=选定节点行id) → requestOperation(src=reject)
+ *
+ * 修复（P0-3）：旧实现跳过 judgeRejectWay/getForwardDatas/doBack，直接 requestOperation(src=reject)，
+ *   且 RejectNodes/RejectToNodeid/RejectToType 全空 → 报"流程数据已更改"。
+ *
+ * ⚠ getForwardDatas 响应结构未抓到（HAR 只抓请求），selectRow/RejectToNodeid 的取值路径属 best-effort，
+ *   需实跑校准；如失败可用 --reject-node/--reject-to-node/--reject-to-type 手工指定。
+ */
+export async function rejectTodo(cfg, opts) {
+    const { requestId } = opts;
+    const remarkText = opts.remark ?? '退回';
+    const remarkHtml = remarkText.split(/\r?\n/).map((l) => `<p>${l}</p>`).join('');
+    const api = await createApiFromProfile(cfg);
+    // 第一步 loadForm → 拿签名
+    const r0 = await api.post('/api/workflow/reqform/loadForm', { iscreate: '0', requestid: requestId });
+    const j0 = r0.json ?? {};
+    const p0 = j0.params ?? {};
+    const sp0 = j0.submitParams ?? {};
+    const wfId = String(p0.workflowid ?? '');
+    const nodeId = String(p0.nodeid ?? '');
+    let p = p0;
+    let sp = sp0;
+    if (wfId && nodeId) {
+        const r1 = await api.post('/api/workflow/reqform/loadForm', { iscreate: '0', requestid: requestId, workflowid: wfId, nodeid: nodeId });
+        const j1 = r1.json ?? {};
+        p = j1.params ?? p0;
+        sp = j1.submitParams ?? sp0;
+    }
+    const userId = String(p.f_weaver_belongto_userid ?? '1');
+    // ② judgeRejectWay（HAR：requestid/workflowid/nodeid/f_weaver_belongto_userid/...）
+    try {
+        await api.post('/api/workflow/reqform/judgeRejectWay', {
+            requestid: requestId,
+            workflowid: wfId,
+            nodeid: nodeId,
+            'f_weaver_belongto_userid': userId,
+            'f_weaver_belongto_usertype': String(p.f_weaver_belongto_usertype ?? '0'),
+            wfTestStr: '',
+        });
+    }
+    catch { /* 判断失败不阻断，继续走退回 */ }
+    // ③ getForwardDatas（GET，取可退回节点列表；响应未抓，best-effort 解析 selectRow + nodeid）
+    let rejectNodes = [];
+    let selectRow = '';
+    let rejectToNode = opts.rejectToNode ?? '';
+    let rejectToType = opts.rejectToType ?? '';
+    let rejectNodesField = opts.rejectNode ?? '';
+    try {
+        const rFd = await api.get('/api/workflow/reqform/getForwardDatas', {
+            requestid: requestId, workflowid: wfId, nodeid: nodeId,
+            'f_weaver_belongto_userid': userId, 'f_weaver_belongto_usertype': String(p.f_weaver_belongto_usertype ?? '0'),
+        });
+        const fdText = rFd.text ?? '';
+        // best-effort：从响应里提节点行 id（selectRow）与 nodeid/nodename
+        rejectNodes = [...fdText.matchAll(/["']?selectRow["']?\s*[:=]\s*["']?(\d+)["']?[^}]*?["']?nodeid["']?\s*[:=]\s*["']?(\d+)["']?(?:[^}]*?["']?nodename["']?\s*[:=]\s*["']?([^"',}]+)["']?)?/gi)]
+            .map((m) => ({ selectRow: m[1], nodeid: m[2], nodename: m[3] ?? '' }));
+        if (rejectNodes.length === 0) {
+            // 兜底：分别提 selectRow 与 nodeid
+            const srs = [...fdText.matchAll(/selectRow["']?\s*[:=]\s*["']?(\d+)/gi)].map((m) => m[1]);
+            const nids = [...fdText.matchAll(/nodeid["']?\s*[:=]\s*["']?(\d+)/gi)].map((m) => m[1]);
+            rejectNodes = srs.map((sr, i) => ({ selectRow: sr, nodeid: nids[i] ?? '', nodename: '' }));
+        }
+        // 选定目标节点：用户传 --reject-to-node(=nodeid) 优先，否则取第一个
+        const picked = rejectToNode
+            ? rejectNodes.find((n) => n.nodeid === rejectToNode) ?? rejectNodes[0]
+            : rejectNodes[0];
+        if (picked) {
+            selectRow = picked.selectRow;
+            if (!rejectToNode)
+                rejectToNode = picked.nodeid;
+        }
+    }
+    catch { /* getForwardDatas 失败不阻断 */ }
+    // ④ doBack(selectRow)（HAR：selectRow=<节点行id>）
+    if (selectRow) {
+        try {
+            await api.post('/api/workflow/reqform/doBack', {
+                selectRow,
+                requestid: requestId,
+                workflowid: wfId,
+                nodeid: nodeId,
+                'f_weaver_belongto_userid': userId,
+                'f_weaver_belongto_usertype': String(p.f_weaver_belongto_usertype ?? '0'),
+            });
+        }
+        catch { /* doBack 失败不阻断 */ }
+    }
+    const sigDecoded = Buffer.from(String(p.signatureAttributesStr ?? ''), 'base64').toString('utf8');
+    const lastOpDate = (sigDecoded.match(/lastOperateDate=([^|]*)/)?.[1] ?? '').trim();
+    const lastOpTime = (sigDecoded.match(/lastOperateTime=([^|]*)/)?.[1] ?? '').trim();
+    const todayStrVal = todayStr();
+    const timeStr = nowTimeStr();
+    const submitTokenKey = `${userId}_${requestId}_request_submit_token`;
+    const submitToken = String(sp[submitTokenKey] ?? Date.now());
+    // ⑤ requestOperation(src=reject)，带上退回目标（HAR 实测旧实现三字段全空是失败根因）
+    const body = {
+        formid: String(sp.formid ?? p.formid ?? ''),
+        isSubmitDirectNode: '',
+        openByDefaultBrowser: '',
+        iscreate: '0',
+        creatertype: '0',
+        isdialog: '1',
+        lastOperateDate: lastOpDate,
+        createdoc: '',
+        nodeid: nodeId,
+        workflowid: wfId,
+        isbill: String(sp.isbill ?? p.isbill ?? '1'),
+        authStr: String(p.authStr ?? ''),
+        'f_weaver_belongto_userid': userId,
+        currenttime: timeStr,
+        'f_weaver_belongto_usertype': String(p.f_weaver_belongto_usertype ?? '0'),
+        agentorByAgentId: '-1',
+        isMultiDoc: '',
+        inputcheck: '',
+        comemessage: '',
+        lastOperateTime: lastOpTime,
+        temphasUseTempletSucceed: '',
+        workflowRequestLogId: '',
+        edesign_layout: '',
+        [submitTokenKey]: submitToken,
+        requestid: requestId,
+        isremark: '0',
+        creater: String(p.creater ?? userId),
+        htmlfieldids: '',
+        SubmitToNodeid: '',
+        isCptwf: 'false',
+        isovertime: '',
+        agentType: '0',
+        authSignatureStr: String(p.authSignatureStr ?? ''),
+        nodetype: String(p.nodetype ?? sp.nodetype ?? '0'),
+        needoutprint: '',
+        lastOperator: String(sp.lastOperator ?? p.lastOperator ?? userId),
+        topage: '',
+        isFormSignature: '0',
+        remindTypes: '',
+        fromFlowDoc: '',
+        RejectNodes: rejectNodesField,
+        linkageUUID: String(sp.linkageUUID ?? ''),
+        billid: String(sp.billid ?? ''),
+        lastnodeid: '',
+        uploadType: '',
+        isSignMustInput: '',
+        RejectToNodeid: rejectToNode,
+        isWorkflowDoc: 'false',
+        src: 'reject',
+        annexmaxUploadImageSize: '',
+        takisremark: '0',
+        workflowtype: String(sp.workflowtype ?? p.workflowtype ?? ''),
+        remarkLocation: '',
+        needcheck: '',
+        needcheckLock: 'false',
+        selectfieldvalue: '',
+        RejectToType: rejectToType,
+        currentdate: todayStrVal,
+        needwfback: '0',
+        remark: remarkHtml,
+        'field-annexupload': '',
+        signdocids: '',
+        signworkflowids: '',
+        annexdocids: '',
+        annexdocinfos: '',
+        handWrittenSign: '',
+        isOdocRequest: '0',
+        enableIntervenor: '',
+        verifyRequiredRange: 'field-9999,',
+        linkageUnFinishedKey: '',
+        remarkquote: remarkHtml,
+        actiontype: 'requestOperation',
+        isFirstSubmit: '0',
+        existChangeRange: '',
+        requestname: String(p.requestname ?? ''),
+        requestlevel: '0',
+        chatsType: '-1',
+        messageType: '-1',
+        'field-9': '0',
+        'field-10': '4',
+        mainFieldUnEmptyCount: '0',
+        detailFieldUnEmptyCount: '0',
+        signatureAttributesStr: String(p.signatureAttributesStr ?? ''),
+        signatureSecretKey: String(p.signatureSecretKey ?? ''),
+        selectNextFlow: '0',
+        openDataVerify: '0',
+        wfTestStr: '',
+    };
+    return api.post('/api/workflow/reqform/requestOperation', body);
+}
+/**
+ * 获取可退回的节点列表（judgeRejectWay → getForwardDatas）。
+ */
+export async function getRejectNodes(cfg, requestId) {
+    const api = await createApiFromProfile(cfg);
+    const r0 = await api.post('/api/workflow/reqform/loadForm', { iscreate: '0', requestid: requestId });
+    const j0 = r0.json ?? {};
+    const p0 = j0.params ?? {};
+    const wfId = String(p0.workflowid ?? '');
+    const nodeId = String(p0.nodeid ?? '');
+    const userId = String(p0.f_weaver_belongto_userid ?? '1');
+    try {
+        await api.post('/api/workflow/reqform/judgeRejectWay', {
+            requestid: requestId, workflowid: wfId, nodeid: nodeId,
+            'f_weaver_belongto_userid': userId, 'f_weaver_belongto_usertype': String(p0.f_weaver_belongto_usertype ?? '0'),
+            wfTestStr: '',
+        });
+    }
+    catch { /* 忽略 */ }
+    return api.get('/api/workflow/reqform/getForwardDatas', {
+        requestid: requestId, workflowid: wfId, nodeid: nodeId,
+        'f_weaver_belongto_userid': userId, 'f_weaver_belongto_usertype': String(p0.f_weaver_belongto_usertype ?? '0'),
+    });
+}

package/dist/todosubmit.js

@@ -0,0 +1,277 @@
+import { createApiFromProfile } from './client.js';
+import { getWfList } from './workflow.js';
+import { todayStr, nowTimeStr } from './util.js';
+/**
+ * 提交待办到下一节点。POST requestOperation（iscreate=0）。
+ * 两步 loadForm 拿签名（先取 wf+node，再带 wf+node 取 per-request 签名）。
+ *
+ * 修复（P0-5）：submit_token key 旧硬编码 `1_<rid>_...`（前缀=1=sysadmin），非 sysadmin 取不到 token；
+ *   改用 `p.f_weaver_belongto_userid` 动态拼 key，并兜底 `1_` 旧前缀，与 wfstart.js create 路径一致。
+ */
+export async function submitTodo(cfg, opts) {
+    const { requestId } = opts;
+    const remarkText = opts.remark ?? 'OK';
+    const remarkHtml = remarkText.split(/\r?\n/).map((l) => `<p>${l}</p>`).join('');
+    const api = await createApiFromProfile(cfg);
+    // 第一步 loadForm（不带 wf+node）→ 拿 workflowid/nodeid
+    const r0 = await api.post('/api/workflow/reqform/loadForm', { iscreate: '0', requestid: requestId });
+    const j0 = r0.json ?? {};
+    const p0 = j0.params ?? {};
+    const sp0 = j0.submitParams ?? {};
+    const wfId = String(p0.workflowid ?? '');
+    const nodeId = String(p0.nodeid ?? '');
+    // 第二步 loadForm（带 wf+node）→ 拿 per-request 签名
+    let p = p0;
+    let sp = sp0;
+    if (wfId && nodeId) {
+        const r1 = await api.post('/api/workflow/reqform/loadForm', { iscreate: '0', requestid: requestId, workflowid: wfId, nodeid: nodeId });
+        const j1 = r1.json ?? {};
+        p = j1.params ?? p0;
+        sp = j1.submitParams ?? sp0;
+    }
+    const userId = String(p.f_weaver_belongto_userid ?? '1');
+    // submit_token：loadForm 的 submitParams 对部分待办不返回 token（实跑发现 node 5967 待办没有），
+    //   E9 校验的是"客户端现生成的较新时间戳"防重复提交；故用 Date.now() 现生成，兜底 loadForm 值。
+    const submitTokenKey = `${userId}_${requestId}_request_submit_token`;
+    const submitToken = String(sp[submitTokenKey] ?? sp[`1_${requestId}_request_submit_token`] ?? Date.now());
+    // 构造提交体
+    // 从 signatureAttributesStr 解码提取 lastOperateDate 等运行时字段
+    const sigDecoded = Buffer.from(String(p.signatureAttributesStr ?? ''), 'base64').toString('utf8');
+    const lastOpDate = (sigDecoded.match(/lastOperateDate=([^|]*)/)?.[1] ?? '').trim();
+    const lastOpTime = (sigDecoded.match(/lastOperateTime=([^|]*)/)?.[1] ?? '').trim();
+    const todayStrVal = todayStr();
+    const timeStr = nowTimeStr();
+    const body = {
+        formid: String(sp.formid ?? p.formid ?? ''),
+        isSubmitDirectNode: '',
+        openByDefaultBrowser: '',
+        iscreate: '0',
+        creatertype: '0',
+        isdialog: '1',
+        lastOperateDate: lastOpDate,
+        createdoc: '',
+        nodeid: nodeId,
+        workflowid: wfId,
+        isbill: String(sp.isbill ?? p.isbill ?? '1'),
+        authStr: String(p.authStr ?? ''),
+        'f_weaver_belongto_userid': userId,
+        currenttime: timeStr,
+        'f_weaver_belongto_usertype': String(p.f_weaver_belongto_usertype ?? '0'),
+        agentorByAgentId: '-1',
+        isMultiDoc: '',
+        inputcheck: '',
+        comemessage: '',
+        lastOperateTime: lastOpTime,
+        temphasUseTempletSucceed: '',
+        workflowRequestLogId: '',
+        edesign_layout: '',
+        [submitTokenKey]: submitToken,
+        requestid: requestId,
+        isremark: '0',
+        creater: String(p.creater ?? userId),
+        htmlfieldids: '',
+        SubmitToNodeid: '',
+        isCptwf: 'false',
+        isovertime: '',
+        agentType: '0',
+        authSignatureStr: String(p.authSignatureStr ?? ''),
+        nodetype: String(p.nodetype ?? sp.nodetype ?? '0'),
+        needoutprint: '',
+        lastOperator: String(sp.lastOperator ?? p.lastOperator ?? userId),
+        topage: '',
+        isFormSignature: '0',
+        remindTypes: '',
+        fromFlowDoc: '',
+        RejectNodes: '',
+        linkageUUID: String(sp.linkageUUID ?? ''),
+        billid: String(sp.billid ?? ''),
+        lastnodeid: '',
+        uploadType: '',
+        isSignMustInput: '',
+        RejectToNodeid: '',
+        isWorkflowDoc: 'false',
+        src: 'submit',
+        annexmaxUploadImageSize: '',
+        takisremark: '0',
+        workflowtype: String(sp.workflowtype ?? p.workflowtype ?? ''),
+        remarkLocation: '',
+        needcheck: String(sp.needcheck ?? ''),
+        needcheckLock: String(sp.needcheckLock ?? 'false'),
+        selectfieldvalue: String(sp.selectfieldvalue ?? ''),
+        RejectToType: '',
+        currentdate: todayStrVal,
+        // ★ 0.5.1 修复：submit 必须带 needwfback。E9 bundle 实证：
+        //   doSubmitBack()→needwfback:"1"（提交后流程退回当前节点）、doSubmitNoBack()→needwfback:"0"（正常流转）。
+        //   旧 body 缺此字段时服务端把"提交"当不流转处理（停在原节点）。
+        //   取 loadForm 回传值兜底 '0'（默认不回退=正常流转到下一节点）。
+        needwfback: String(sp.needwfback === undefined || sp.needwfback === null ? '0' : sp.needwfback),
+        remark: remarkHtml,
+        'field-annexupload': '',
+        signdocids: '',
+        signworkflowids: '',
+        annexdocids: '',
+        annexdocinfos: '',
+        handWrittenSign: '',
+        isOdocRequest: '0',
+        enableIntervenor: '',
+        verifyRequiredRange: 'field-9999,',
+        linkageUnFinishedKey: '',
+        remarkquote: remarkHtml,
+        actiontype: 'requestOperation',
+        isFirstSubmit: '0',
+        existChangeRange: '',
+        requestname: String(p.requestname ?? ''),
+        requestlevel: '0',
+        chatsType: '-1',
+        messageType: '-1',
+        'field-9': '0',
+        'field-10': '4',
+        mainFieldUnEmptyCount: '0',
+        detailFieldUnEmptyCount: '0',
+        signatureAttributesStr: String(p.signatureAttributesStr ?? ''),
+        signatureSecretKey: String(p.signatureSecretKey ?? ''),
+        selectNextFlow: '',
+        openDataVerify: '0',
+        wfTestStr: '',
+    };
+    // 修改字段值（可选）
+    if (opts.fieldValues) {
+        let count = 0;
+        for (const [k, v] of Object.entries(opts.fieldValues)) {
+            const id = k.startsWith('field') ? k.replace(/^field/, '') : k;
+            body[`field${id}`] = v;
+            count++;
+        }
+        body.mainFieldUnEmptyCount = String(count);
+    }
+    return api.post('/api/workflow/reqform/requestOperation', body);
+}
+async function readMineListEvidence(cfg, requestId, before = {}) {
+    const query = {
+        category: 'mine', page: 1,
+        workflow: String(before.workflowid ?? ''),
+        keyword: String(before.requestname ?? ''),
+    };
+    const first = await getWfList(cfg, query);
+    let found = first.items.find((item) => String(item.requestId) === String(requestId));
+    const pageSize = Number(first.pageSize) || first.items.length || 50;
+    const pages = Math.ceil((Number(first.total) || 0) / pageSize);
+    if (pages > 50)
+        return { complete: false, found: Boolean(found), pagesChecked: 1, reason: `我的请求筛选结果仍有 ${pages} 页，超过 50 页核验上限` };
+    for (let page = 2; !found && page <= pages; page++) {
+        const next = await getWfList(cfg, { ...query, page });
+        found = next.items.find((item) => String(item.requestId) === String(requestId));
+    }
+    return { complete: true, found: Boolean(found), item: found, pagesChecked: Math.max(1, pages) };
+}
+/**
+ * 撤回流程（0.5.1）。实证（2026-09-08 .27）：
+ *   E9 前端 OPER_WITHDRAW 走 POST /api/workflow/reqform/requestWithdraw（actionType=getSettings→submit），
+ *   返回 {"result":"success","msg":"撤回成功"}，流程撤回到 recallNodeId 节点。
+ *   - 审批人"撤回批准"：3469387 批准后 getSettings 得 recallNodeId=5968(审批2)、allowWithdrawalType=1，
+ *     submit 后流程回到 5968、重进待办、流转日志记"撤回1"。
+ *   - 创建节点单据同样可用（3469383 getSettings 也返回 allowWithdrawalType=1）。
+ *   ⚠ 旧实现（delRequestVerify+src=delete / functionLink flag=cancel）与前端不符已弃用——
+ *     已批准单据 currentnodeid 可能回到发起节点值，旧逻辑会误走删除路径。
+ *   ⚠ flag=cancel（doCancel=撤销当前流程）与 flag=rb（doRetract=强制收回）实测都不是"撤回批准"。
+ */
+export async function retractRequest(cfg, requestId, opts = {}) {
+    const remark = opts.remark ?? '撤回';
+    const api = await createApiFromProfile(cfg);
+    let p = {};
+    let sp = {};
+    let userId = '';
+    try {
+        const r0 = await api.post('/api/workflow/reqform/loadForm', { iscreate: '0', requestid: requestId });
+        p = r0.json?.params ?? {};
+        sp = r0.json?.submitParams ?? {};
+        userId = String(p.f_weaver_belongto_userid ?? '');
+    }
+    catch (error) {
+        return { ok: false, verified: false, mode: 'unknown', message: `无法读取流程当前状态：${error.message}` };
+    }
+    if (!userId)
+        return { ok: false, verified: false, mode: 'unknown', message: '流程表单未返回当前用户 ID，已拒绝使用硬编码账号执行撤回。' };
+    const sigDecoded = Buffer.from(String(p.signatureAttributesStr ?? ''), 'base64').toString('utf8');
+    const lastOpDate = (sigDecoded.match(/lastOperateDate=([^|]*)/)?.[1] ?? '').trim();
+    const lastOpTime = (sigDecoded.match(/lastOperateTime=([^|]*)/)?.[1] ?? '').trim();
+    const submitTokenKey = `${userId}_${requestId}_request_submit_token`;
+    // requestWithdraw 的 baseParam（对齐前端 baseParamRange + 签名 + submit_token）
+    const base = {
+        requestid: String(requestId),
+        workflowid: String(p.workflowid ?? ''),
+        nodeid: String(p.nodeid ?? ''),
+        formid: String(sp.formid ?? p.formid ?? ''),
+        isbill: String(sp.isbill ?? p.isbill ?? '1'),
+        'f_weaver_belongto_userid': userId,
+        'f_weaver_belongto_usertype': String(p.f_weaver_belongto_usertype ?? '0'),
+        languageid: '7',
+        authStr: String(p.authStr ?? ''),
+        authSignatureStr: String(p.authSignatureStr ?? ''),
+        signatureSecretKey: String(p.signatureSecretKey ?? ''),
+        signatureAttributesStr: String(p.signatureAttributesStr ?? ''),
+        [submitTokenKey]: String(sp[submitTokenKey] ?? Date.now()),
+    };
+    // ① getSettings：取撤回目标节点与权限
+    let settings = {};
+    let getResp;
+    try {
+        getResp = await api.post('/api/workflow/reqform/requestWithdraw', { ...base, actionType: 'getSettings' });
+        settings = getResp.json ?? {};
+    }
+    catch (error) {
+        return { ok: false, verified: false, mode: 'withdraw', message: `撤回前检查失败（requestWithdraw/getSettings）：${error.message}` };
+    }
+    if (String(settings.allowWithdrawalType ?? '') !== '1') {
+        return { ok: false, verified: false, mode: 'withdraw', response: getResp, settings,
+            message: `OA 不允许撤回当前流程（allowWithdrawalType=${settings.allowWithdrawalType}）。${settings.msg ?? ''}` };
+    }
+    // ② submit：执行撤回（remark 必填；recallNodeId/doPreOperate 来自 getSettings）
+    const body = {
+        ...base,
+        actionType: 'submit',
+        isRemind: '1',
+        remark,
+        recallNodeId: String(settings.recallNodeId ?? ''),
+        doPreOperate: String(settings.doPreOperate ?? ''),
+        lastOperateDate: String(sp.lastOperateDate ?? lastOpDate ?? ''),
+        lastOperateTime: String(sp.lastOperateTime ?? lastOpTime ?? ''),
+        currentdate: todayStr(),
+        currenttime: nowTimeStr(),
+    };
+    let response;
+    try {
+        response = await api.post('/api/workflow/reqform/requestWithdraw', body);
+    }
+    catch (error) {
+        return { ok: false, verified: false, mode: 'withdraw', settings, message: `撤回请求失败：${error.message}` };
+    }
+    const wj = response.json ?? {};
+    const bizSuccess = wj.result === 'success' || wj.result === '1' || wj.result === true || wj.success === true;
+    const recallNodeId = String(settings.recallNodeId ?? '');
+    // ③ 回读核验：流程应回到 recallNodeId（loadForm currentnodeid），且"我的请求"回读可见
+    try {
+        const afterResponse = await api.post('/api/workflow/reqform/loadForm', { iscreate: '0', requestid: requestId });
+        const afterParams = afterResponse.json?.params ?? {};
+        const afterNodeId = String(afterParams.currentnodeid ?? afterParams.nodeid ?? '');
+        let mineList;
+        try { mineList = await readMineListEvidence(cfg, requestId, p); }
+        catch (error) { mineList = { complete: false, found: null, reason: error.message }; }
+        const returnedToRecall = !!recallNodeId && (afterNodeId === recallNodeId || afterNodeId === String(p.nodeid ?? ''));
+        const listVerified = mineList.complete && (bizSuccess ? mineList.found === true : mineList.found === false);
+        const verified = bizSuccess && (returnedToRecall || listVerified);
+        return {
+            ok: verified, verified, mode: 'withdraw', response, settings,
+            recallNodeId, afterNodeId,
+            mineList,
+            message: verified
+                ? `撤回已核验：流程已撤回到 ${settings.recallNodeName ?? recallNodeId} 节点。`
+                : bizSuccess
+                    ? 'OA 已返回撤回成功，但回读未确认流程回到撤回节点，结果待人工核对。'
+                    : `OA 未确认撤回成功：${wj.msg ?? response.text?.slice(0, 160) ?? ''}`,
+        };
+    }
+    catch (error) {
+        return { ok: false, verified: false, mode: 'withdraw', response, settings, message: `OA 已受理撤回，但回读核验失败：${error.message}` };
+    }
+}

package/dist/todotransfer.js

@@ -0,0 +1,54 @@
+import { createApiFromProfile } from './client.js';
+import { resolveReceivers } from './wfreceiver.js';
+/**
+ * 转办（处理权转移）。
+ *
+ * 链路（前端 bundle 实证）：doReview3 → A({showForward:!0, forwardflag:"3"})，与转发/传阅/意见征询
+ *   打开同一个 ForwardDialog，提交统一走 signInput → remarkOperate：
+ *     loadForm(取 workflowid/nodeid/操作人 userid) → signInput(forwardflag=3 预载) →
+ *     remarkOperate(operate=save, forwardflag=3, field5=接收人) → {"success":true,"message":"流程转办成功"}。
+ *
+ * 修复（0.5.1）：旧实现走 requestOperation(src=submit, needwfback=1, forwardOperators=接收人)
+ *   且不带 forwardflag，被服务端当成"批准"。前端 doReview3 是 forwardflag="3"（非 requestOperation），
+ *   成功提示即"流程转办成功"。转办不需要改表单经办人字段——field5 即新办理人，由服务端处理。
+ *   参考 ForwardDialog 实现：doReview3 无 needwfback（转办并退回 doReviewback3 才带 needwfback=1）。
+ */
+export async function transferTodo(cfg, opts) {
+    const { requestId } = opts;
+    const remarkText = opts.remark ?? '';
+    const remarkHtml = remarkText.split(/\r?\n/).map((l) => `<p>${l}</p>`).join('');
+    const api = await createApiFromProfile(cfg);
+    const r0 = await api.post('/api/workflow/reqform/loadForm', { iscreate: '0', requestid: String(requestId) });
+    const p = (r0.json ?? {}).params ?? {};
+    const userId = String(p.f_weaver_belongto_userid ?? '1');
+    const userType = String(p.f_weaver_belongto_usertype ?? '0');
+    const workflowid = String(p.workflowid ?? '');
+    const nodeid = String(p.nodeid ?? '');
+    const field5 = await resolveReceivers(cfg, opts);
+    if (!field5)
+        throw new Error('转办需要目标人：传 --receiver <userId> 或 --receiver-name <姓名>');
+    const tokenKey = `forward_token_${requestId}_${userId}`;
+    const token = String(Date.now());
+    const common = {
+        isShowReplyNotice: '0', takOverMins: '30', remark: remarkHtml,
+        workflowRequestLogId: '', forwardflag: '3', requestid: String(requestId),
+        nodeid, workflowid, 'f_weaver_belongto_userid': userId, 'f_weaver_belongto_usertype': userType,
+        agentType: '0', agentorByAgentId: '-1', secLevelInfo: '[object Object]',
+        [tokenKey]: token,
+    };
+    // ① signInput 预载（forwardflag=3，field5 空）
+    await api.post('/api/workflow/reqform/signInput', {
+        ...common, field5: '', IsSubmitedOpinion: '1', IsBeForwardTodo: '1',
+    });
+    // ② remarkOperate 提交（operate=save，field5=接收人）
+    return api.post('/api/workflow/reqform/remarkOperate', {
+        ...common, field5,
+        operate: 'save',
+        openByDefaultBrowser: '', IsBeForwardSubmitAlready: '', IsBeForwardAlready: '',
+        IsSubmitedOpinion: '', IsBeForwardTodo: '',
+        isSubmitSign: '0', isChuanyue: '0', isRemind: '0',
+        signworkflowids: '', signdocids: '', remarkLocation: '',
+        'field-annexupload': '', 'field-annexupload-request': String(requestId),
+        handWrittenSign: '0', remindTypes: '',
+    });
+}

package/dist/util.js

@@ -0,0 +1,25 @@
+/**
+ * 通用工具：日期字符串、sleep、字符串化。
+ * 统一各模块里重复的 today()/todayStr()/stringify()/sleep()。
+ */
+/** 今天 YYYY-MM-DD（本地时区，避免 UTC 偏移）。 */
+export function todayStr() {
+    const d = new Date();
+    const tz = d.getTimezoneOffset() * 60000;
+    return new Date(d.getTime() - tz).toISOString().slice(0, 10);
+}
+/** 当前本地时间 HH:MM:SS（提交体里的 currenttime 字段用）。 */
+export function nowTimeStr() {
+    const d = new Date();
+    const tz = d.getTimezoneOffset() * 60000;
+    return new Date(d.getTime() - tz).toISOString().slice(11, 19);
+}
+export function sleep(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
+/** 非空字符串化：null/undefined/'' → undefined，否则 String(v)。 */
+export function stringify(v) {
+    if (v === undefined || v === null || v === '')
+        return undefined;
+    return String(v);
+}