@rytass/bpm-core-nestjs-module 0.1.0

package/package.json

@@ -0,0 +1,168 @@
+{
+  "name": "@rytass/bpm-core-nestjs-module",
+  "version": "0.1.0",
+  "description": "Embeddable NestJS BPM approval workflow module: workflow engine, approval templates, forms, organization/member contracts, attachments, signatures, notifications, delegation, and TypeORM migrations.",
+  "keywords": [
+    "bpm",
+    "approval",
+    "workflow",
+    "nestjs",
+    "graphql",
+    "typeorm",
+    "postgres",
+    "form-builder",
+    "rytass"
+  ],
+  "homepage": "https://github.com/Rytass/BPMCore#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Rytass/BPMCore.git",
+    "directory": "libs/bpm-core"
+  },
+  "bugs": {
+    "url": "https://github.com/Rytass/BPMCore/issues"
+  },
+  "author": "Rytass <hello@rytass.com>",
+  "license": "MIT",
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "type": "commonjs",
+  "main": "./src/index.js",
+  "types": "./src/index.d.ts",
+  "typesVersions": {
+    "*": {
+      "attachment": [
+        "./src/lib/attachment/index.d.ts"
+      ],
+      "bpm-auth": [
+        "./src/lib/bpm-auth/index.d.ts"
+      ],
+      "condition": [
+        "./src/lib/condition/index.d.ts"
+      ],
+      "database": [
+        "./src/lib/database/index.d.ts"
+      ],
+      "delegation": [
+        "./src/lib/delegation/index.d.ts"
+      ],
+      "form": [
+        "./src/lib/form/index.d.ts"
+      ],
+      "identity": [
+        "./src/lib/identity/index.d.ts"
+      ],
+      "migrations": [
+        "./src/lib/migrations/index.d.ts"
+      ],
+      "notification": [
+        "./src/lib/notification/index.d.ts"
+      ],
+      "organization": [
+        "./src/lib/organization/index.d.ts"
+      ],
+      "signature": [
+        "./src/lib/signature/index.d.ts"
+      ],
+      "template": [
+        "./src/lib/template/index.d.ts"
+      ],
+      "workflow-engine": [
+        "./src/lib/workflow-engine/index.d.ts"
+      ]
+    }
+  },
+  "exports": {
+    ".": {
+      "types": "./src/index.d.ts",
+      "default": "./src/index.js"
+    },
+    "./package.json": "./package.json",
+    "./attachment": {
+      "types": "./src/lib/attachment/index.d.ts",
+      "default": "./src/lib/attachment/index.js"
+    },
+    "./bpm-auth": {
+      "types": "./src/lib/bpm-auth/index.d.ts",
+      "default": "./src/lib/bpm-auth/index.js"
+    },
+    "./database": {
+      "types": "./src/lib/database/index.d.ts",
+      "default": "./src/lib/database/index.js"
+    },
+    "./condition": {
+      "types": "./src/lib/condition/index.d.ts",
+      "default": "./src/lib/condition/index.js"
+    },
+    "./delegation": {
+      "types": "./src/lib/delegation/index.d.ts",
+      "default": "./src/lib/delegation/index.js"
+    },
+    "./form": {
+      "types": "./src/lib/form/index.d.ts",
+      "default": "./src/lib/form/index.js"
+    },
+    "./identity": {
+      "types": "./src/lib/identity/index.d.ts",
+      "default": "./src/lib/identity/index.js"
+    },
+    "./migrations": {
+      "types": "./src/lib/migrations/index.d.ts",
+      "default": "./src/lib/migrations/index.js"
+    },
+    "./notification": {
+      "types": "./src/lib/notification/index.d.ts",
+      "default": "./src/lib/notification/index.js"
+    },
+    "./organization": {
+      "types": "./src/lib/organization/index.d.ts",
+      "default": "./src/lib/organization/index.js"
+    },
+    "./signature": {
+      "types": "./src/lib/signature/index.d.ts",
+      "default": "./src/lib/signature/index.js"
+    },
+    "./template": {
+      "types": "./src/lib/template/index.d.ts",
+      "default": "./src/lib/template/index.js"
+    },
+    "./workflow-engine": {
+      "types": "./src/lib/workflow-engine/index.d.ts",
+      "default": "./src/lib/workflow-engine/index.js"
+    }
+  },
+  "peerDependencies": {
+    "@nestjs/common": "^11.0.0",
+    "@nestjs/core": "^11.0.0",
+    "@nestjs/graphql": "^13.4.0",
+    "@nestjs/typeorm": "^11.0.1",
+    "@rytass/bpm-core-shared": "^0.1.0",
+    "@rytass/secret-adapter-vault-nestjs": "^0.4.5 || ^0.5.0",
+    "express": "^4.0.0 || ^5.0.0",
+    "graphql": "^16.0.0",
+    "reflect-metadata": "^0.1.13 || ^0.2.0",
+    "typeorm": "^0.3.0"
+  },
+  "peerDependenciesMeta": {
+    "@rytass/secret-adapter-vault-nestjs": {
+      "optional": true
+    },
+    "express": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "@rytass/storages": "^0.2.6",
+    "@rytass/storages-adapter-local": "^0.2.9",
+    "cel-js": "^0.8.2",
+    "class-validator": "^0.15.1",
+    "handlebars": "^4.7.9",
+    "nodemailer": "^8.0.7",
+    "tslib": "^2.3.0"
+  }
+}

package/src/index.d.ts

@@ -0,0 +1,14 @@
+export * from './lib/attachment';
+export * from './lib/bpm';
+export * from './lib/bpm-auth';
+export * from './lib/common';
+export * from './lib/condition';
+export * from './lib/database';
+export * from './lib/delegation';
+export * from './lib/form';
+export * from './lib/identity';
+export * from './lib/notification';
+export * from './lib/organization';
+export * from './lib/signature';
+export * from './lib/template';
+export * from './lib/workflow-engine';

package/src/index.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./lib/attachment"), exports);
+tslib_1.__exportStar(require("./lib/bpm"), exports);
+tslib_1.__exportStar(require("./lib/bpm-auth"), exports);
+tslib_1.__exportStar(require("./lib/common"), exports);
+tslib_1.__exportStar(require("./lib/condition"), exports);
+tslib_1.__exportStar(require("./lib/database"), exports);
+tslib_1.__exportStar(require("./lib/delegation"), exports);
+tslib_1.__exportStar(require("./lib/form"), exports);
+tslib_1.__exportStar(require("./lib/identity"), exports);
+tslib_1.__exportStar(require("./lib/notification"), exports);
+tslib_1.__exportStar(require("./lib/organization"), exports);
+tslib_1.__exportStar(require("./lib/signature"), exports);
+tslib_1.__exportStar(require("./lib/template"), exports);
+tslib_1.__exportStar(require("./lib/workflow-engine"), exports);
+//# sourceMappingURL=index.js.map

package/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../libs/bpm-core/src/index.ts"],"names":[],"mappings":";;;AAAA,2DAAiC;AACjC,oDAA0B;AAC1B,yDAA+B;AAC/B,uDAA6B;AAC7B,0DAAgC;AAChC,yDAA+B;AAC/B,2DAAiC;AACjC,qDAA2B;AAC3B,yDAA+B;AAC/B,6DAAmC;AACnC,6DAAmC;AACnC,0DAAgC;AAChC,yDAA+B;AAC/B,gEAAsC"}

package/src/lib/attachment/attachment-options.d.ts

@@ -0,0 +1,44 @@
+import { InjectionToken } from '@nestjs/common';
+export interface BPMRootAttachmentOptions {
+    /**
+     * Public HTTP base URL used to build signed attachment download and preview
+     * URLs.
+     */
+    readonly attachmentPublicBaseUrl?: string | null;
+    /**
+     * Route prefix used by the host application for BPM attachment endpoints.
+     *
+     * Drives both the Nest controller mount path and the path embedded in BPM
+     * signed attachment URLs. Defaults to `/attachments`.
+     */
+    readonly attachmentRoutePrefix?: string | null;
+    /**
+     * HMAC secret used to sign attachment download and preview tokens.
+     */
+    readonly attachmentSignedUrlSecret?: string | null;
+    /**
+     * Signed attachment URL lifetime in seconds.
+     */
+    readonly attachmentSignedUrlTtlSeconds?: number;
+    /**
+     * Storage provider id recorded on attachment metadata.
+     */
+    readonly attachmentStorageProviderId?: string | null;
+}
+export interface BPMResolvedAttachmentOptions {
+    readonly publicBaseUrl: string;
+    readonly routePrefix: string;
+    readonly signedUrlSecret: string;
+    readonly signedUrlTtlSeconds: number;
+    readonly storageProviderId: string;
+}
+export declare const BPM_ATTACHMENT_OPTIONS: InjectionToken<BPMResolvedAttachmentOptions>;
+export declare const DEFAULT_BPM_ATTACHMENT_OPTIONS: BPMResolvedAttachmentOptions;
+export declare function resolveBPMAttachmentOptions(options?: BPMRootAttachmentOptions): BPMResolvedAttachmentOptions;
+/**
+ * Normalizes an attachment route prefix into the form Nest expects on a
+ * controller decorator (no leading slash, no trailing slash).
+ *
+ * Returns the BPM default `attachments` path when no value is provided.
+ */
+export declare function resolveAttachmentControllerPath(value: string | null | undefined): string;

package/src/lib/attachment/attachment-options.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_BPM_ATTACHMENT_OPTIONS = exports.BPM_ATTACHMENT_OPTIONS = void 0;
+exports.resolveBPMAttachmentOptions = resolveBPMAttachmentOptions;
+exports.resolveAttachmentControllerPath = resolveAttachmentControllerPath;
+exports.BPM_ATTACHMENT_OPTIONS = Symbol('BPM_ATTACHMENT_OPTIONS');
+exports.DEFAULT_BPM_ATTACHMENT_OPTIONS = {
+    publicBaseUrl: 'http://localhost:17603',
+    routePrefix: '/attachments',
+    signedUrlSecret: 'bpm-core-local-attachment-url-key-v1',
+    signedUrlTtlSeconds: 300,
+    storageProviderId: 'local',
+};
+function resolveBPMAttachmentOptions(options = {}) {
+    const resolvedSignedUrlSecret = normalizeText(options.attachmentSignedUrlSecret) ??
+        exports.DEFAULT_BPM_ATTACHMENT_OPTIONS.signedUrlSecret;
+    if (resolvedSignedUrlSecret === exports.DEFAULT_BPM_ATTACHMENT_OPTIONS.signedUrlSecret &&
+        process.env.NODE_ENV === 'production') {
+        // eslint-disable-next-line no-console
+        console.warn('[@rytass/bpm-core-nestjs-module] attachmentSignedUrlSecret is using the built-in local development value. Set BPMRootModuleOptions.attachmentSignedUrlSecret to a strong secret before serving production traffic — signed attachment URLs would otherwise be forgeable.');
+    }
+    return {
+        publicBaseUrl: normalizePublicBaseUrl(options.attachmentPublicBaseUrl),
+        routePrefix: normalizeRoutePrefix(options.attachmentRoutePrefix),
+        signedUrlSecret: resolvedSignedUrlSecret,
+        signedUrlTtlSeconds: normalizePositiveInteger(options.attachmentSignedUrlTtlSeconds, exports.DEFAULT_BPM_ATTACHMENT_OPTIONS.signedUrlTtlSeconds),
+        storageProviderId: normalizeText(options.attachmentStorageProviderId) ??
+            exports.DEFAULT_BPM_ATTACHMENT_OPTIONS.storageProviderId,
+    };
+}
+/**
+ * Normalizes an attachment route prefix into the form Nest expects on a
+ * controller decorator (no leading slash, no trailing slash).
+ *
+ * Returns the BPM default `attachments` path when no value is provided.
+ */
+function resolveAttachmentControllerPath(value) {
+    const normalizedPrefix = normalizeRoutePrefix(value);
+    return normalizedPrefix.replace(/^\//, '');
+}
+function normalizePublicBaseUrl(value) {
+    const normalizedValue = normalizeText(value) ?? exports.DEFAULT_BPM_ATTACHMENT_OPTIONS.publicBaseUrl;
+    return normalizedValue.replace(/\/+$/, '');
+}
+function normalizeRoutePrefix(value) {
+    const normalizedValue = normalizeText(value) ?? exports.DEFAULT_BPM_ATTACHMENT_OPTIONS.routePrefix;
+    const withLeadingSlash = normalizedValue.startsWith('/')
+        ? normalizedValue
+        : `/${normalizedValue}`;
+    return withLeadingSlash.replace(/\/+$/, '');
+}
+function normalizeText(value) {
+    const trimmedValue = value?.trim() ?? '';
+    return trimmedValue || null;
+}
+function normalizePositiveInteger(value, fallback) {
+    if (typeof value !== 'number' || !Number.isInteger(value) || value <= 0) {
+        return fallback;
+    }
+    return value;
+}
+//# sourceMappingURL=attachment-options.js.map

package/src/lib/attachment/attachment-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-options.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/attachment/attachment-options.ts"],"names":[],"mappings":";;;AAoDA,kEA6BC;AAQD,0EAMC;AAtDY,QAAA,sBAAsB,GACjC,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAEtB,QAAA,8BAA8B,GAAiC;IAC1E,aAAa,EAAE,wBAAwB;IACvC,WAAW,EAAE,cAAc;IAC3B,eAAe,EAAE,sCAAsC;IACvD,mBAAmB,EAAE,GAAG;IACxB,iBAAiB,EAAE,OAAO;CAC3B,CAAC;AAEF,SAAgB,2BAA2B,CACzC,UAAoC,EAAE;IAEtC,MAAM,uBAAuB,GAC3B,aAAa,CAAC,OAAO,CAAC,yBAAyB,CAAC;QAChD,sCAA8B,CAAC,eAAe,CAAC;IAEjD,IACE,uBAAuB,KAAK,sCAA8B,CAAC,eAAe;QAC1E,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EACrC,CAAC;QACD,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACV,0QAA0Q,CAC3Q,CAAC;IACJ,CAAC;IAED,OAAO;QACL,aAAa,EAAE,sBAAsB,CAAC,OAAO,CAAC,uBAAuB,CAAC;QACtE,WAAW,EAAE,oBAAoB,CAAC,OAAO,CAAC,qBAAqB,CAAC;QAChE,eAAe,EAAE,uBAAuB;QACxC,mBAAmB,EAAE,wBAAwB,CAC3C,OAAO,CAAC,6BAA6B,EACrC,sCAA8B,CAAC,mBAAmB,CACnD;QACD,iBAAiB,EACf,aAAa,CAAC,OAAO,CAAC,2BAA2B,CAAC;YAClD,sCAA8B,CAAC,iBAAiB;KACnD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,+BAA+B,CAC7C,KAAgC;IAEhC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAErD,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAgC;IAC9D,MAAM,eAAe,GACnB,aAAa,CAAC,KAAK,CAAC,IAAI,sCAA8B,CAAC,aAAa,CAAC;IAEvE,OAAO,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAgC;IAC5D,MAAM,eAAe,GACnB,aAAa,CAAC,KAAK,CAAC,IAAI,sCAA8B,CAAC,WAAW,CAAC;IACrE,MAAM,gBAAgB,GAAG,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC;QACtD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;IAE1B,OAAO,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,aAAa,CAAC,KAAgC;IACrD,MAAM,YAAY,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAEzC,OAAO,YAAY,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAyB,EACzB,QAAgB;IAEhB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACxE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/src/lib/attachment/attachment-storage.provider.d.ts

@@ -0,0 +1,4 @@
+import { Provider } from '@nestjs/common';
+import { AttachmentStorage } from './attachment-storage.token';
+export declare const attachmentStorageProvider: Provider<AttachmentStorage>;
+export declare function createLocalAttachmentStorage(directory: string): AttachmentStorage;

package/src/lib/attachment/attachment-storage.provider.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.attachmentStorageProvider = void 0;
+exports.createLocalAttachmentStorage = createLocalAttachmentStorage;
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
+const attachment_storage_token_1 = require("./attachment-storage.token");
+exports.attachmentStorageProvider = {
+    provide: attachment_storage_token_1.ATTACHMENT_STORAGE,
+    useFactory: () => createLocalAttachmentStorage((0, path_1.resolve)(process.cwd(), '.storage', 'attachments')),
+};
+function createLocalAttachmentStorage(directory) {
+    const storageDirectory = (0, path_1.resolve)(directory);
+    const LocalStorage = readLocalStorageConstructor();
+    const localStorage = new LocalStorage({
+        autoMkdir: true,
+        directory: storageDirectory,
+    });
+    const write = async (file, options) => {
+        if (options?.filename) {
+            await (0, promises_1.mkdir)((0, path_1.dirname)((0, path_1.resolve)(storageDirectory, options.filename)), {
+                recursive: true,
+            });
+        }
+        return localStorage.write(file, options);
+    };
+    return new Proxy(localStorage, {
+        get: (target, property, receiver) => property === 'write' ? write : Reflect.get(target, property, receiver),
+    });
+}
+function readLocalStorageConstructor() {
+    const adapter = require('@rytass/storages-adapter-local');
+    return adapter.LocalStorage;
+}
+//# sourceMappingURL=attachment-storage.provider.js.map

package/src/lib/attachment/attachment-storage.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-storage.provider.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/attachment/attachment-storage.provider.ts"],"names":[],"mappings":";;;AA2BA,oEA0BC;AApDD,0CAAoC;AACpC,+BAAwC;AACxC,yEAGoC;AAavB,QAAA,yBAAyB,GAAgC;IACpE,OAAO,EAAE,6CAAkB;IAC3B,UAAU,EAAE,GAAsB,EAAE,CAClC,4BAA4B,CAC1B,IAAA,cAAO,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,aAAa,CAAC,CAClD;CACJ,CAAC;AAEF,SAAgB,4BAA4B,CAC1C,SAAiB;IAEjB,MAAM,gBAAgB,GAAG,IAAA,cAAO,EAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,2BAA2B,EAAE,CAAC;IACnD,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC;QACpC,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,gBAAgB;KAC5B,CAAC,CAAC;IACH,MAAM,KAAK,GAA+B,KAAK,EAC7C,IAAI,EACJ,OAAO,EACiC,EAAE;QAC1C,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAA,gBAAK,EAAC,IAAA,cAAO,EAAC,IAAA,cAAO,EAAC,gBAAgB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE;gBAChE,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC,CAAC;IAEF,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE;QAC7B,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAW,EAAE,CAC3C,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;KACzE,CAAsB,CAAC;AAC1B,CAAC;AAED,SAAS,2BAA2B;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,gCAAgC,CAAuB,CAAC;IAEhF,OAAO,OAAO,CAAC,YAAY,CAAC;AAC9B,CAAC"}

package/src/lib/attachment/attachment-storage.token.d.ts

@@ -0,0 +1,3 @@
+import type { Storage } from '@rytass/storages';
+export declare const ATTACHMENT_STORAGE: unique symbol;
+export type AttachmentStorage = Storage<Readonly<Record<string, unknown>>>;

package/src/lib/attachment/attachment-storage.token.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ATTACHMENT_STORAGE = void 0;
+exports.ATTACHMENT_STORAGE = Symbol('ATTACHMENT_STORAGE');
+//# sourceMappingURL=attachment-storage.token.js.map

package/src/lib/attachment/attachment-storage.token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-storage.token.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/attachment/attachment-storage.token.ts"],"names":[],"mappings":";;;AAEa,QAAA,kBAAkB,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC"}

package/src/lib/attachment/attachment.controller.d.ts

@@ -0,0 +1,8 @@
+import { StreamableFile } from '@nestjs/common';
+import type { Response } from 'express';
+import { AttachmentService } from './attachment.service';
+export declare class AttachmentController {
+    private readonly attachmentService;
+    constructor(attachmentService: AttachmentService);
+    downloadAttachment(id: string, token: string, disposition: "attachment" | "inline" | undefined, response: Response): Promise<StreamableFile>;
+}

package/src/lib/attachment/attachment.controller.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AttachmentController = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const attachment_service_1 = require("./attachment.service");
+let AttachmentController = class AttachmentController {
+    constructor(attachmentService) {
+        this.attachmentService = attachmentService;
+    }
+    async downloadAttachment(id, token, disposition = 'attachment', response) {
+        const { attachment, buffer } = await this.attachmentService.readSignedAttachment({
+            disposition,
+            id,
+            token,
+        });
+        response.setHeader('Content-Type', attachment.mimeType);
+        response.setHeader('Content-Disposition', `${disposition}; filename="${encodeURIComponent(attachment.filename)}"`);
+        response.setHeader('Content-Length', String(buffer.length));
+        return new common_1.StreamableFile(buffer);
+    }
+};
+exports.AttachmentController = AttachmentController;
+tslib_1.__decorate([
+    (0, common_1.Get)(':id/download'),
+    tslib_1.__param(0, (0, common_1.Param)('id')),
+    tslib_1.__param(1, (0, common_1.Query)('token')),
+    tslib_1.__param(2, (0, common_1.Query)('disposition')),
+    tslib_1.__param(3, (0, common_1.Res)({ passthrough: true })),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, String, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], AttachmentController.prototype, "downloadAttachment", null);
+exports.AttachmentController = AttachmentController = tslib_1.__decorate([
+    (0, common_1.Controller)('attachments'),
+    tslib_1.__metadata("design:paramtypes", [attachment_service_1.AttachmentService])
+], AttachmentController);
+//# sourceMappingURL=attachment.controller.js.map

package/src/lib/attachment/attachment.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment.controller.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/attachment/attachment.controller.ts"],"names":[],"mappings":";;;;AAAA,2CAOwB;AAExB,6DAAyD;AAGlD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YAA6B,iBAAoC;QAApC,sBAAiB,GAAjB,iBAAiB,CAAmB;IAAG,CAAC;IAG/D,AAAN,KAAK,CAAC,kBAAkB,CACT,EAAU,EACP,KAAa,EACP,cAAuC,YAAY,EAC7C,QAAkB;QAE9C,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAC1B,MAAM,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAAC;YAChD,WAAW;YACX,EAAE;YACF,KAAK;SACN,CAAC,CAAC;QAEL,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QACxD,QAAQ,CAAC,SAAS,CAChB,qBAAqB,EACrB,GAAG,WAAW,eAAe,kBAAkB,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CACxE,CAAC;QACF,QAAQ,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAE5D,OAAO,IAAI,uBAAc,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;CACF,CAAA;AA1BY,oDAAoB;AAIzB;IADL,IAAA,YAAG,EAAC,cAAc,CAAC;IAEjB,mBAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;IACX,mBAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,mBAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IACpB,mBAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;;;8DAiB5B;+BAzBU,oBAAoB;IADhC,IAAA,mBAAU,EAAC,aAAa,CAAC;6CAEwB,sCAAiB;GADtD,oBAAoB,CA0BhC"}

package/src/lib/attachment/attachment.entity.d.ts

@@ -0,0 +1,14 @@
+export declare class AttachmentEntity {
+    id: string;
+    instanceId: string | null;
+    taskId: string | null;
+    formFieldPath: string | null;
+    uploaderMemberId: string;
+    filename: string;
+    mimeType: string;
+    sizeBytes: string;
+    storageProvider: string;
+    storageKey: string;
+    checksumSha256: string;
+    createdAt: Date;
+}

package/src/lib/attachment/attachment.entity.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AttachmentEntity = void 0;
+const tslib_1 = require("tslib");
+const graphql_1 = require("@nestjs/graphql");
+const typeorm_1 = require("typeorm");
+let AttachmentEntity = class AttachmentEntity {
+};
+exports.AttachmentEntity = AttachmentEntity;
+tslib_1.__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    (0, graphql_1.Field)(() => graphql_1.ID),
+    tslib_1.__metadata("design:type", String)
+], AttachmentEntity.prototype, "id", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('uuid', { name: 'instance_id', nullable: true }),
+    (0, graphql_1.Field)(() => graphql_1.ID, { nullable: true }),
+    tslib_1.__metadata("design:type", Object)
+], AttachmentEntity.prototype, "instanceId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('uuid', { name: 'task_id', nullable: true }),
+    (0, graphql_1.Field)(() => graphql_1.ID, { nullable: true }),
+    tslib_1.__metadata("design:type", Object)
+], AttachmentEntity.prototype, "taskId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text', { name: 'form_field_path', nullable: true }),
+    (0, graphql_1.Field)(() => String, { nullable: true }),
+    tslib_1.__metadata("design:type", Object)
+], AttachmentEntity.prototype, "formFieldPath", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text', { name: 'uploader_member_id' }),
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", String)
+], AttachmentEntity.prototype, "uploaderMemberId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text'),
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", String)
+], AttachmentEntity.prototype, "filename", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text', { name: 'mime_type' }),
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", String)
+], AttachmentEntity.prototype, "mimeType", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('bigint', { name: 'size_bytes' }),
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", String)
+], AttachmentEntity.prototype, "sizeBytes", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text', { name: 'storage_provider' }),
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", String)
+], AttachmentEntity.prototype, "storageProvider", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text', { name: 'storage_key' }),
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", String)
+], AttachmentEntity.prototype, "storageKey", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text', { name: 'checksum_sha256' }),
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", String)
+], AttachmentEntity.prototype, "checksumSha256", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.CreateDateColumn)({ name: 'created_at', type: 'timestamptz' }),
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", Date)
+], AttachmentEntity.prototype, "createdAt", void 0);
+exports.AttachmentEntity = AttachmentEntity = tslib_1.__decorate([
+    (0, typeorm_1.Entity)('attachments'),
+    (0, graphql_1.ObjectType)('Attachment')
+], AttachmentEntity);
+//# sourceMappingURL=attachment.entity.js.map

package/src/lib/attachment/attachment.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment.entity.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/attachment/attachment.entity.ts"],"names":[],"mappings":";;;;AAAA,6CAAwD;AACxD,qCAKiB;AAIV,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAgD5B,CAAA;AAhDY,4CAAgB;AAG3B;IAFC,IAAA,gCAAsB,EAAC,MAAM,CAAC;IAC9B,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,YAAE,CAAC;;4CACJ;AAIZ;IAFC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACvD,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,YAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;oDACT;AAI3B;IAFC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACnD,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,YAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;gDACb;AAIvB;IAFC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3D,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uDACV;AAI9B;IAFC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;IAC9C,IAAA,eAAK,GAAE;;0DACkB;AAI1B;IAFC,IAAA,gBAAM,EAAC,MAAM,CAAC;IACd,IAAA,eAAK,GAAE;;kDACU;AAIlB;IAFC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACrC,IAAA,eAAK,GAAE;;kDACU;AAIlB;IAFC,IAAA,gBAAM,EAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACxC,IAAA,eAAK,GAAE;;mDACW;AAInB;IAFC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAC5C,IAAA,eAAK,GAAE;;yDACiB;AAIzB;IAFC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACvC,IAAA,eAAK,GAAE;;oDACY;AAIpB;IAFC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAC3C,IAAA,eAAK,GAAE;;wDACgB;AAIxB;IAFC,IAAA,0BAAgB,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAC7D,IAAA,eAAK,GAAE;sCACI,IAAI;mDAAC;2BA/CN,gBAAgB;IAF5B,IAAA,gBAAM,EAAC,aAAa,CAAC;IACrB,IAAA,oBAAU,EAAC,YAAY,CAAC;GACZ,gBAAgB,CAgD5B"}

package/src/lib/attachment/attachment.module.d.ts

@@ -0,0 +1,27 @@
+import { DynamicModule, InjectionToken, Provider } from '@nestjs/common';
+import { ModuleMetadata } from '@nestjs/common/interfaces';
+import { AttachmentStorage } from './attachment-storage.token';
+import { BPMRootAttachmentOptions } from './attachment-options';
+export interface AttachmentModuleOptions extends BPMRootAttachmentOptions {
+    readonly imports?: ModuleMetadata['imports'];
+    readonly storageProvider?: Provider<AttachmentStorage>;
+}
+export interface AttachmentModuleAsyncOptions extends Pick<ModuleMetadata, 'imports'> {
+    /**
+     * Controller mount path used by the BPM attachment endpoints.
+     *
+     * Set at module wiring time because Nest reads the controller path metadata
+     * synchronously when the application starts. Async secrets cannot drive this
+     * value; only static URL routing decisions should set it.
+     *
+     * Defaults to `/attachments`.
+     */
+    readonly attachmentRoutePrefix?: string | null;
+    readonly inject?: readonly InjectionToken[];
+    readonly storageProvider?: Provider<AttachmentStorage>;
+    readonly useFactory: (...args: readonly unknown[]) => BPMRootAttachmentOptions | Promise<BPMRootAttachmentOptions>;
+}
+export declare class AttachmentModule {
+    static forRoot(options?: AttachmentModuleOptions): DynamicModule;
+    static forRootAsync(options: AttachmentModuleAsyncOptions): DynamicModule;
+}