@rytass/bpm-core-client 0.1.3 → 0.1.5

package/CHANGELOG.md

@@ -8,6 +8,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 Releases are managed by [`nx release`](https://nx.dev/recipes/nx-release) with
 Conventional Commits — see `nx.json` for the release config.
 
+## 0.1.5 — 2026-05-28
+
+### Documentation
+
+- **README "Organization mirror pattern" section.** Condensed pointer to
+  the full pattern in `@rytass/bpm-core-nestjs-module`'s README plus a
+  client-side worked example using `createOrgUnit`, `updateOrgUnit`,
+  `deleteOrgUnit`, `commitOrgUnitTreeDraft`, `createPosition`,
+  `createMembership`, `createManagerResolution`. Clarifies that BPM owns
+  the org graph and host applications mirror their existing org data in
+  rather than expose a resolver (in contrast to the member-resolver
+  pattern).
+
+### Why a patch
+
+No type or runtime change. README only.
+
+## 0.1.4 — 2026-05-27
+
+No source changes. Bumped in lockstep with
+`@rytass/bpm-core-nestjs-module@0.1.4` (re-publish after the 0.1.3
+backend tarball shipped only `.ts` source — see that package's CHANGELOG).
+
+## 0.1.3 — 2026-05-27 (deprecated on npm)
+
+Lockstep bump alongside the broken 0.1.3 backend release. Avoid;
+upgrade directly to 0.1.4 or newer.
+
 ## 0.1.2 — 2026-05-27
 
 No source changes. Bumped in lockstep with

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Rytass
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -151,9 +151,9 @@ default endpoint, no cookie jar. Treat them the same as Server Components.
 
 ## Endpoint Resolution
 
-By default the client targets the same origin (no `/api` prefix) — see
-[`docs/10-bpm-embedding-auth.md`](../../docs/10-bpm-embedding-auth.md) for the
-host contract. Endpoint resolution rules:
+By default the client targets the same origin (no `/api` prefix) — see the
+"Embedding & auth" section of `@rytass/bpm-core-nestjs-module`'s README for
+the host-side contract. Endpoint resolution rules:
 
 | Source                                          | Behavior                                                                   |
 | ----------------------------------------------- | -------------------------------------------------------------------------- |
@@ -206,6 +206,72 @@ Every subpath uses the same `requestGraphQl` transport from the root. Hosts
 can mix and match — for example a read-only dashboard might only import
 `workflow` queries, never reaching for `/organization` mutations.
 
+## Organization Mirror Pattern (Important)
+
+> **TL;DR:** BPM owns the org graph (`org_units`, `positions`,
+> `memberships`, `manager_resolutions`). Hosts with their own org model
+> mirror data **into** BPM via the `/organization` mutations rather than
+> exposing a host-side resolver. See the
+> "Organization Data Ownership" section of
+> `@rytass/bpm-core-nestjs-module`'s README for the rationale.
+
+The integration shape is **asymmetric** with `BPMMemberResolver`:
+member identity stays in the host's user table and BPM reaches in via
+the resolver token; the org structure lives in BPM and the host pushes
+data in. Three rules keep the mirror idempotent:
+
+1. **Use `code` as the natural key.** Both `OrgUnit` and `Position`
+   carry a unique `code` you control. On every sync, look up by `code`
+   before deciding INSERT vs UPDATE.
+2. **Stash the host-FK in `metadata`.** Both entities carry an opaque
+   `metadata` JSON BPM never introspects — store your host's primary
+   key there to chase pointers back during reconciliation.
+3. **Soft-delete via the `delete*` mutations.** They set `deletedAt`;
+   live queries (`orgUnits`, `orgUnitCount`, etc.) filter soft-deleted
+   rows automatically.
+
+Quick wire-up using only this package's exports:
+
+```ts
+import {
+  createOrgUnit,
+  updateOrgUnit,
+  orgUnits,
+} from '@rytass/bpm-core-client/organization';
+
+async function upsertOrgUnit(hostUnit: {
+  code: string;
+  name: string;
+  type: 'COMPANY' | 'DIVISION' | 'DEPARTMENT' | 'TEAM';
+  parentCode: string | null;
+  hostId: string;
+}): Promise<string> {
+  const existing = (await orgUnits({ searchText: hostUnit.code })).find(
+    (u) => u.code === hostUnit.code,
+  );
+  const parentId = hostUnit.parentCode
+    ? (await orgUnits({ searchText: hostUnit.parentCode })).find(
+        (u) => u.code === hostUnit.parentCode,
+      )?.id ?? null
+    : null;
+  const metadataJson = JSON.stringify({ hostId: hostUnit.hostId });
+
+  if (existing) {
+    return (
+      await updateOrgUnit({
+        id: existing.id,
+        input: { ...hostUnit, parentId, metadataJson },
+      })
+    ).id;
+  }
+  return (await createOrgUnit({ ...hostUnit, parentId, metadataJson })).id;
+}
+```
+
+`createPosition`, `createMembership`, `updateMembership`, and
+`createManagerResolution` follow the same pattern. For bulk tree moves
+in one transaction, see `commitOrgUnitTreeDraft`.
+
 ## Auth REST Endpoints
 
 The BPM wrapper-host exposes the following endpoints under the host root (no

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rytass/bpm-core-client",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Framework-agnostic TypeScript client for the Rytass BPM approval workflow GraphQL surface: fetch-based GraphQL transport, REST auth client, pre-baked typed operations for organization, member, form, template, and workflow.",
   "keywords": [
     "bpm",
@@ -73,9 +73,10 @@
     }
   },
   "peerDependencies": {
-    "@rytass/bpm-core-shared": "^0.1.3"
+    "@rytass/bpm-core-shared": "^0.1.5"
   },
   "dependencies": {
     "tslib": "^2.3.0"
-  }
-}
+  },
+  "type": "commonjs"
+}

package/src/index.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./lib/api-auth-client"), exports);
+tslib_1.__exportStar(require("./lib/graphql-client"), exports);
+tslib_1.__exportStar(require("./lib/member-api"), exports);
+//# sourceMappingURL=index.js.map

package/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../libs/bpm-core-client/src/index.ts"],"names":[],"mappings":";;;AAAA,gEAAsC;AACtC,+DAAqC;AACrC,2DAAiC"}

package/src/lib/api-auth-client.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Authenticated BPM member returned by {@link loginApi} and
+ * {@link readApiCurrentMember}.
+ *
+ * Mirrors the shape that BPM-compatible wrapper hosts emit from their
+ * `POST /auth/login` and `GET /auth/me` endpoints. Roles and permissions
+ * are used by BPM's `BPMAdminGuard` / `BPMDesignerGuard`.
+ */
+export interface ApiMember {
+    readonly email: string;
+    readonly expiresAt: string;
+    readonly memberId: string;
+    readonly name: string;
+    readonly permissions: readonly string[];
+    readonly roles: readonly string[];
+}
+/**
+ * Reduced member shape returned by {@link listApiTestMembers}. Excludes
+ * `permissions` and `expiresAt` because the test-members endpoint is meant
+ * for picker UIs in dev / demo, not for session establishment.
+ */
+export interface ApiPublicMember {
+    readonly email: string;
+    readonly memberId: string;
+    readonly name: string;
+    readonly roles: readonly string[];
+}
+/**
+ * Lists seeded test members exposed by the host's `/auth/test-members`
+ * endpoint. Hosts targeting production typically disable this endpoint or
+ * gate it behind a feature flag.
+ */
+export declare function listApiTestMembers(): Promise<readonly ApiPublicMember[]>;
+/**
+ * Performs a login against the host's `POST /auth/login` endpoint. On
+ * success the host issues an HTTP-only session cookie that subsequent
+ * {@link requestGraphQl} calls automatically carry, because
+ * {@link requestApi} uses `credentials: 'include'`.
+ *
+ * Throws on HTTP errors with a message extracted from the response body
+ * when available.
+ *
+ * @param input.identifier - Member id, email, or any other identifier the
+ *                           host understands.
+ * @param input.password   - Cleartext credential — TLS is the consumer's
+ *                           responsibility.
+ */
+export declare function loginApi(input: {
+    readonly identifier: string;
+    readonly password: string;
+}): Promise<ApiMember>;
+/**
+ * Calls `POST /auth/logout` on the host. The host clears the session
+ * cookie. Safe to call when not logged in (host should return 200).
+ */
+export declare function logoutApi(): Promise<void>;
+/**
+ * Reads the currently authenticated member from `GET /auth/me`.
+ *
+ * Returns `null` when the host replies `401`, which is the conventional
+ * way to signal "no active session". Any other HTTP failure throws.
+ */
+export declare function readApiCurrentMember(): Promise<ApiMember | null>;
+/**
+ * Resolves the base URL used by the REST `/auth/*` calls.
+ *
+ * Resolution order:
+ * 1. `process.env.NEXT_PUBLIC_API_AUTH_URL` if non-empty.
+ * 2. Derived from {@link readGraphQlEndpoint}'s origin — the host is
+ *    assumed to expose both `/graphql` and `/auth/*` at the same origin.
+ */
+export declare function readApiBaseUrl(): string;
+export declare function resolveApiBaseUrlFromGraphQlEndpoint(graphQlEndpoint: string): string;

package/src/lib/api-auth-client.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listApiTestMembers = listApiTestMembers;
+exports.loginApi = loginApi;
+exports.logoutApi = logoutApi;
+exports.readApiCurrentMember = readApiCurrentMember;
+exports.readApiBaseUrl = readApiBaseUrl;
+exports.resolveApiBaseUrlFromGraphQlEndpoint = resolveApiBaseUrlFromGraphQlEndpoint;
+const graphql_client_1 = require("./graphql-client");
+/**
+ * Lists seeded test members exposed by the host's `/auth/test-members`
+ * endpoint. Hosts targeting production typically disable this endpoint or
+ * gate it behind a feature flag.
+ */
+async function listApiTestMembers() {
+    return requestApi('/auth/test-members');
+}
+/**
+ * Performs a login against the host's `POST /auth/login` endpoint. On
+ * success the host issues an HTTP-only session cookie that subsequent
+ * {@link requestGraphQl} calls automatically carry, because
+ * {@link requestApi} uses `credentials: 'include'`.
+ *
+ * Throws on HTTP errors with a message extracted from the response body
+ * when available.
+ *
+ * @param input.identifier - Member id, email, or any other identifier the
+ *                           host understands.
+ * @param input.password   - Cleartext credential — TLS is the consumer's
+ *                           responsibility.
+ */
+async function loginApi(input) {
+    return requestApi('/auth/login', {
+        body: JSON.stringify(input),
+        headers: { 'Content-Type': 'application/json' },
+        method: 'POST',
+    });
+}
+/**
+ * Calls `POST /auth/logout` on the host. The host clears the session
+ * cookie. Safe to call when not logged in (host should return 200).
+ */
+async function logoutApi() {
+    await requestApi('/auth/logout', {
+        method: 'POST',
+    });
+}
+/**
+ * Reads the currently authenticated member from `GET /auth/me`.
+ *
+ * Returns `null` when the host replies `401`, which is the conventional
+ * way to signal "no active session". Any other HTTP failure throws.
+ */
+async function readApiCurrentMember() {
+    try {
+        return await requestApi('/auth/me');
+    }
+    catch (error) {
+        if (error instanceof ApiRequestError && error.status === 401) {
+            return null;
+        }
+        throw error;
+    }
+}
+/**
+ * Resolves the base URL used by the REST `/auth/*` calls.
+ *
+ * Resolution order:
+ * 1. `process.env.NEXT_PUBLIC_API_AUTH_URL` if non-empty.
+ * 2. Derived from {@link readGraphQlEndpoint}'s origin — the host is
+ *    assumed to expose both `/graphql` and `/auth/*` at the same origin.
+ */
+function readApiBaseUrl() {
+    const explicitApiBaseUrl = process.env.NEXT_PUBLIC_API_AUTH_URL?.trim();
+    if (explicitApiBaseUrl) {
+        return explicitApiBaseUrl.replace(/\/$/, '');
+    }
+    const graphQlEndpoint = (0, graphql_client_1.readGraphQlEndpoint)();
+    return resolveApiBaseUrlFromGraphQlEndpoint(graphQlEndpoint);
+}
+function resolveApiBaseUrlFromGraphQlEndpoint(graphQlEndpoint) {
+    if (!isAbsoluteUrl(graphQlEndpoint)) {
+        return '';
+    }
+    const endpoint = new URL(graphQlEndpoint);
+    endpoint.pathname = '/';
+    endpoint.search = '';
+    endpoint.hash = '';
+    return endpoint.toString().replace(/\/$/, '');
+}
+async function requestApi(path, init) {
+    const response = await fetch(`${readApiBaseUrl()}${path}`, {
+        credentials: 'include',
+        ...init,
+    });
+    if (!response.ok) {
+        throw new ApiRequestError(response.status, await readError(response));
+    }
+    return (await response.json());
+}
+async function readError(response) {
+    try {
+        const payload = (await response.json());
+        return typeof payload.message === 'string'
+            ? payload.message
+            : `BPM API request failed with HTTP ${response.status}`;
+    }
+    catch {
+        return `BPM API request failed with HTTP ${response.status}`;
+    }
+}
+class ApiRequestError extends Error {
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+function isAbsoluteUrl(value) {
+    return value.startsWith('http://') || value.startsWith('https://');
+}
+//# sourceMappingURL=api-auth-client.js.map

package/src/lib/api-auth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-auth-client.js","sourceRoot":"","sources":["../../../../../libs/bpm-core-client/src/lib/api-auth-client.ts"],"names":[],"mappings":";;AAoCA,gDAIC;AAgBD,4BASC;AAMD,8BAIC;AAQD,oDAUC;AAUD,wCAUC;AAED,oFAYC;AA/HD,qDAAuD;AA+BvD;;;;GAIG;AACI,KAAK,UAAU,kBAAkB;IAGtC,OAAO,UAAU,CAA6B,oBAAoB,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,QAAQ,CAAC,KAG9B;IACC,OAAO,UAAU,CAAY,aAAa,EAAE;QAC1C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAC3B,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,MAAM,EAAE,MAAM;KACf,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,SAAS;IAC7B,MAAM,UAAU,CAAwB,cAAc,EAAE;QACtD,MAAM,EAAE,MAAM;KACf,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,oBAAoB;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,UAAU,CAAY,UAAU,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,cAAc;IAC5B,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;IAExE,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,eAAe,GAAG,IAAA,oCAAmB,GAAE,CAAC;IAE9C,OAAO,oCAAoC,CAAC,eAAe,CAAC,CAAC;AAC/D,CAAC;AAED,SAAgB,oCAAoC,CAClD,eAAuB;IAEvB,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,GAAG,GAAG,CAAC;IACxB,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC;IACrB,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC;IACnB,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,IAAY,EACZ,IAAkB;IAElB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,EAAE,GAAG,IAAI,EAAE,EAAE;QACzD,WAAW,EAAE,SAAS;QACtB,GAAG,IAAI;KACR,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAU,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,QAAkB;IACzC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmC,CAAC;QAE1E,OAAO,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;YACxC,CAAC,CAAC,OAAO,CAAC,OAAO;YACjB,CAAC,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,MAAM,eAAgB,SAAQ,KAAK;IACjC,YACW,MAAc,EACvB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;IAIzB,CAAC;CACF;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACrE,CAAC"}

package/src/lib/form/form-api.d.ts

@@ -0,0 +1,48 @@
+import { FormDefinitionSchema, FormFieldDefinition, FormUiSchema } from '@rytass/bpm-core-shared/form';
+export interface FormDefinitionRecord {
+    readonly currentVersionId: string | null;
+    readonly currentVersionCreatedAt: string | null;
+    readonly currentVersionNumber: number | null;
+    readonly currentVersionPublishedAt: string | null;
+    readonly description: string | null;
+    readonly id: string;
+    readonly name: string;
+    readonly updatedAt: string;
+}
+export type FormDefinitionListStatus = 'DRAFT' | 'PUBLISHED';
+export interface FormDefinitionVersionRecord {
+    readonly id: string;
+    readonly publishedAt: string | null;
+    readonly schema: FormDefinitionSchema;
+    readonly schemaJson: string;
+    readonly status: 'ARCHIVED' | 'DRAFT' | 'PUBLISHED';
+    readonly uiSchema: FormUiSchema;
+    readonly uiSchemaJson: string;
+    readonly updatedAt: string;
+    readonly version: number;
+}
+export interface FormBuilderRecord {
+    readonly definition: FormDefinitionRecord;
+    readonly versions: readonly FormDefinitionVersionRecord[];
+}
+export interface FormSchemaLintResult {
+    readonly errors: readonly string[];
+    readonly valid: boolean;
+}
+export declare function listFormDefinitions(): Promise<readonly FormDefinitionRecord[]>;
+export declare function listFormDefinitionsPage({ page, pageSize, status, }: {
+    readonly page: number;
+    readonly pageSize: number;
+    readonly status?: FormDefinitionListStatus | null;
+}): Promise<{
+    readonly forms: readonly FormDefinitionRecord[];
+    readonly totalCount: number;
+}>;
+export declare function createFormDefinition(name: string): Promise<string>;
+export declare function updateFormDefinition(id: string, name: string): Promise<FormDefinitionRecord>;
+export declare function readFormBuilder(formDefinitionId: string): Promise<FormBuilderRecord>;
+export declare function updateFormDefinitionDraft(versionId: string, schema: FormDefinitionSchema, uiSchema: FormUiSchema): Promise<FormDefinitionVersionRecord>;
+export declare function publishFormDefinitionVersion(versionId: string): Promise<FormDefinitionVersionRecord>;
+export declare function forkFormDefinition(formDefinitionId: string): Promise<FormDefinitionVersionRecord>;
+export declare function lintFormSchema(schema: FormDefinitionSchema, uiSchema: FormUiSchema): Promise<FormSchemaLintResult>;
+export declare function createFieldDefinition(type: FormFieldDefinition['type'], index: number): FormFieldDefinition;

package/src/lib/form/form-api.js

@@ -0,0 +1,228 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listFormDefinitions = listFormDefinitions;
+exports.listFormDefinitionsPage = listFormDefinitionsPage;
+exports.createFormDefinition = createFormDefinition;
+exports.updateFormDefinition = updateFormDefinition;
+exports.readFormBuilder = readFormBuilder;
+exports.updateFormDefinitionDraft = updateFormDefinitionDraft;
+exports.publishFormDefinitionVersion = publishFormDefinitionVersion;
+exports.forkFormDefinition = forkFormDefinition;
+exports.lintFormSchema = lintFormSchema;
+exports.createFieldDefinition = createFieldDefinition;
+const graphql_client_1 = require("../graphql-client");
+async function listFormDefinitions() {
+    const data = await (0, graphql_client_1.requestGraphQl)(`query FormDefinitions {
+      formDefinitions {
+        currentVersionCreatedAt
+        currentVersionId
+        currentVersionNumber
+        currentVersionPublishedAt
+        description
+        id
+        name
+        updatedAt
+      }
+    }`);
+    return data.formDefinitions;
+}
+async function listFormDefinitionsPage({ page, pageSize, status, }) {
+    const data = await (0, graphql_client_1.requestGraphQl)(`query FormDefinitionsPage(
+      $page: Int!
+      $pageSize: Int!
+      $status: FormDefinitionListStatus
+    ) {
+      formDefinitions(page: $page, pageSize: $pageSize, status: $status) {
+        currentVersionCreatedAt
+        currentVersionId
+        currentVersionNumber
+        currentVersionPublishedAt
+        description
+        id
+        name
+        updatedAt
+      }
+      formDefinitionCount(status: $status)
+    }`, { page, pageSize, status: status ?? null });
+    return {
+        forms: data.formDefinitions,
+        totalCount: data.formDefinitionCount,
+    };
+}
+async function createFormDefinition(name) {
+    const data = await (0, graphql_client_1.requestGraphQl)(`mutation CreateFormDefinition($input: CreateFormDefinitionInput!) {
+      createFormDefinition(input: $input) {
+        id
+      }
+    }`, {
+        input: {
+            createdByMemberId: null,
+            description: null,
+            name,
+            schemaJson: null,
+            uiSchemaJson: null,
+        },
+    });
+    return data.createFormDefinition.id;
+}
+async function updateFormDefinition(id, name) {
+    const data = await (0, graphql_client_1.requestGraphQl)(`mutation UpdateFormDefinition($input: UpdateFormDefinitionInput!) {
+      updateFormDefinition(input: $input) {
+        currentVersionCreatedAt
+        currentVersionId
+        currentVersionNumber
+        currentVersionPublishedAt
+        description
+        id
+        name
+        updatedAt
+      }
+    }`, {
+        input: {
+            description: null,
+            id,
+            name,
+        },
+    });
+    return data.updateFormDefinition;
+}
+async function readFormBuilder(formDefinitionId) {
+    const data = await (0, graphql_client_1.requestGraphQl)(`query FormBuilder($id: String!) {
+      formDefinition(id: $id) {
+        currentVersionCreatedAt
+        currentVersionId
+        currentVersionNumber
+        currentVersionPublishedAt
+        description
+        id
+        name
+        updatedAt
+      }
+      formDefinitionVersions(formDefinitionId: $id) {
+        id
+        publishedAt
+        schemaJson
+        status
+        uiSchemaJson
+        updatedAt
+        version
+      }
+    }`, { id: formDefinitionId });
+    return {
+        definition: data.formDefinition,
+        versions: data.formDefinitionVersions.map(parseVersionJson),
+    };
+}
+async function updateFormDefinitionDraft(versionId, schema, uiSchema) {
+    const data = await (0, graphql_client_1.requestGraphQl)(`mutation UpdateFormDefinitionDraft($input: UpdateFormDefinitionDraftInput!) {
+      updateFormDefinitionDraft(input: $input) {
+        id
+        publishedAt
+        schemaJson
+        status
+        uiSchemaJson
+        updatedAt
+        version
+      }
+    }`, {
+        input: {
+            schemaJson: JSON.stringify(schema),
+            uiSchemaJson: JSON.stringify(uiSchema),
+            versionId,
+        },
+    });
+    return parseVersionJson(data.updateFormDefinitionDraft);
+}
+async function publishFormDefinitionVersion(versionId) {
+    const data = await (0, graphql_client_1.requestGraphQl)(`mutation PublishFormDefinitionVersion($versionId: String!) {
+      publishFormDefinitionVersion(versionId: $versionId) {
+        id
+        publishedAt
+        schemaJson
+        status
+        uiSchemaJson
+        updatedAt
+        version
+      }
+    }`, { versionId });
+    return parseVersionJson(data.publishFormDefinitionVersion);
+}
+async function forkFormDefinition(formDefinitionId) {
+    const data = await (0, graphql_client_1.requestGraphQl)(`mutation ForkFormDefinition($formDefinitionId: String!) {
+      forkFormDefinition(formDefinitionId: $formDefinitionId) {
+        id
+        publishedAt
+        schemaJson
+        status
+        uiSchemaJson
+        updatedAt
+        version
+      }
+    }`, { formDefinitionId });
+    return parseVersionJson(data.forkFormDefinition);
+}
+async function lintFormSchema(schema, uiSchema) {
+    const data = await (0, graphql_client_1.requestGraphQl)(`query LintFormSchema($input: LintFormSchemaInput!) {
+      lintFormSchema(input: $input) {
+        errors
+        valid
+      }
+    }`, {
+        input: {
+            schemaJson: JSON.stringify(schema),
+            uiSchemaJson: JSON.stringify(uiSchema),
+        },
+    });
+    return data.lintFormSchema;
+}
+function createFieldDefinition(type, index) {
+    const fieldKey = `${type}_${index}`;
+    const base = {
+        fieldKey,
+        label: readDefaultFieldLabel(type, index),
+        required: false,
+        type,
+    };
+    if (type === 'select' || type === 'radio' || type === 'checkbox') {
+        return {
+            ...base,
+            options: [
+                { label: '選項 A', value: 'option_a' },
+                { label: '選項 B', value: 'option_b' },
+            ],
+            type,
+        };
+    }
+    if (type === 'file_upload') {
+        return {
+            ...base,
+            maxFiles: 1,
+            type,
+        };
+    }
+    return base;
+}
+function parseVersionJson(version) {
+    return {
+        ...version,
+        schema: JSON.parse(version.schemaJson),
+        uiSchema: JSON.parse(version.uiSchemaJson),
+    };
+}
+function readDefaultFieldLabel(type, index) {
+    const labels = {
+        boolean: '開關',
+        checkbox: '複選',
+        date: '日期',
+        datetime: '日期時間',
+        file_upload: '附件',
+        money: '金額',
+        number: '數字',
+        radio: '單選',
+        select: '下拉選單',
+        text: '文字',
+        textarea: '長文字',
+    };
+    return `${labels[type]} ${index}`;
+}
+//# sourceMappingURL=form-api.js.map

package/src/lib/form/form-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"form-api.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core-client/src/lib/form/form-api.ts"],"names":[],"mappings":";;AAuFA,kDAmBC;AAED,0DAqCC;AAED,oDAmBC;AAED,oDA2BC;AAED,0CAgCC;AAED,8DA2BC;AAED,oEAmBC;AAED,gDAmBC;AAED,wCAoBC;AAED,sDAgCC;AA/VD,sDAAmD;AAkF5C,KAAK,UAAU,mBAAmB;IAGvC,MAAM,IAAI,GAAG,MAAM,IAAA,+BAAc,EAC/B;;;;;;;;;;;MAWE,CACH,CAAC;IAEF,OAAO,IAAI,CAAC,eAAe,CAAC;AAC9B,CAAC;AAEM,KAAK,UAAU,uBAAuB,CAAC,EAC5C,IAAI,EACJ,QAAQ,EACR,MAAM,GAKP;IAIC,MAAM,IAAI,GAAG,MAAM,IAAA,+BAAc,EAC/B;;;;;;;;;;;;;;;;MAgBE,EACF,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,CAC3C,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,eAAe;QAC3B,UAAU,EAAE,IAAI,CAAC,mBAAmB;KACrC,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,oBAAoB,CAAC,IAAY;IACrD,MAAM,IAAI,GAAG,MAAM,IAAA,+BAAc,EAC/B;;;;MAIE,EACF;QACE,KAAK,EAAE;YACL,iBAAiB,EAAE,IAAI;YACvB,WAAW,EAAE,IAAI;YACjB,IAAI;YACJ,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;SACnB;KACF,CACF,CAAC;IAEF,OAAO,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;AACtC,CAAC;AAEM,KAAK,UAAU,oBAAoB,CACxC,EAAU,EACV,IAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,IAAA,+BAAc,EAC/B;;;;;;;;;;;MAWE,EACF;QACE,KAAK,EAAE;YACL,WAAW,EAAE,IAAI;YACjB,EAAE;YACF,IAAI;SACL;KACF,CACF,CAAC;IAEF,OAAO,IAAI,CAAC,oBAAoB,CAAC;AACnC,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,gBAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,IAAA,+BAAc,EAC/B;;;;;;;;;;;;;;;;;;;;MAoBE,EACF,EAAE,EAAE,EAAE,gBAAgB,EAAE,CACzB,CAAC;IAEF,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,cAAc;QAC/B,QAAQ,EAAE,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,gBAAgB,CAAC;KAC5D,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAC7C,SAAiB,EACjB,MAA4B,EAC5B,QAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,IAAA,+BAAc,EAC/B;;;;;;;;;;MAUE,EACF;QACE,KAAK,EAAE;YACL,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAClC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YACtC,SAAS;SACV;KACF,CACF,CAAC;IAEF,OAAO,gBAAgB,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAC1D,CAAC;AAEM,KAAK,UAAU,4BAA4B,CAChD,SAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,IAAA,+BAAc,EAC/B;;;;;;;;;;MAUE,EACF,EAAE,SAAS,EAAE,CACd,CAAC;IAEF,OAAO,gBAAgB,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;AAC7D,CAAC;AAEM,KAAK,UAAU,kBAAkB,CACtC,gBAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,IAAA,+BAAc,EAC/B;;;;;;;;;;MAUE,EACF,EAAE,gBAAgB,EAAE,CACrB,CAAC;IAEF,OAAO,gBAAgB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AACnD,CAAC;AAEM,KAAK,UAAU,cAAc,CAClC,MAA4B,EAC5B,QAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,IAAA,+BAAc,EAC/B;;;;;MAKE,EACF;QACE,KAAK,EAAE;YACL,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAClC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;SACvC;KACF,CACF,CAAC;IAEF,OAAO,IAAI,CAAC,cAAc,CAAC;AAC7B,CAAC;AAED,SAAgB,qBAAqB,CACnC,IAAiC,EACjC,KAAa;IAEb,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG;QACX,QAAQ;QACR,KAAK,EAAE,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC;QACzC,QAAQ,EAAE,KAAK;QACf,IAAI;KACL,CAAC;IAEF,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACjE,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE;gBACpC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE;aACrC;YACD,IAAI;SACL,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,OAAO;YACL,GAAG,IAAI;YACP,QAAQ,EAAE,CAAC;YACX,IAAI;SACL,CAAC;IACJ,CAAC;IAED,OAAO,IAA2B,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CACvB,OAA0B;IAE1B,OAAO;QACL,GAAG,OAAO;QACV,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAyB;QAC9D,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAiB;KAC3D,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAiC,EACjC,KAAa;IAEb,MAAM,MAAM,GAA0D;QACpE,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,IAAI;QACjB,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,KAAK;KAChB,CAAC;IAEF,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;AACpC,CAAC"}