@rytass/bpm-core-nestjs-module 0.12.0 → 0.13.1

package/src/lib/bpm-auth/bpm-resolver-metadata.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Extension point that lets a host stamp its own route metadata onto every BPM
+ * GraphQL handler.
+ *
+ * BPM guards its own resolvers with `@BPMAuthenticated()`, `@BPMAdminOnly()`
+ * and `@BPMDesignerOnly()`. A host that also installs a *global* guard of its
+ * own — `@rytass/member-base-nestjs-module` registers a `CasbinGuard` that
+ * rejects any route carrying no `@CheckPermission` metadata — rejects all of
+ * them before BPM's guards ever run, and the two packages cannot be mounted
+ * together at all.
+ *
+ * BPM cannot import the host's decorator, and a decorator cannot read module
+ * options because it runs when the class is defined. So the resolver classes
+ * register themselves here as they are decorated, and the host supplies a
+ * factory that BPM replays over them at module wiring time — before Nest reads
+ * any of this metadata, which it only does per request.
+ */
+/**
+ * How much authority BPM itself demands of a caller for one handler. A host
+ * maps this onto its own permission vocabulary.
+ */
+export type BPMResolverAccessLevel = 'admin' | 'authenticated' | 'designer';
+export interface BPMResolverHandlerDescriptor {
+    /** Authority BPM's own guards require for this handler. */
+    readonly access: BPMResolverAccessLevel;
+    /**
+     * Method name on the resolver class. Across BPM this is also the GraphQL
+     * field name — `orgUnits`, `createOrgUnit`, `member`.
+     */
+    readonly methodName: string;
+    /** Resolver class name, for example `OrganizationQueries`. */
+    readonly resolverName: string;
+}
+/**
+ * Returns the metadata to attach to one BPM handler, keyed exactly as the
+ * host's guard reads it. Return `null` or `undefined` to leave a handler
+ * alone.
+ *
+ * @example
+ * ```ts
+ * const resolverMetadataFactory: BPMResolverMetadataFactory = ({ access }) => ({
+ *   // the key `@CheckPermission` writes, and the value its guard expects
+ *   PERMISSION_METADATA_KEY: access === 'authenticated' ? ['bpm:use'] : ['bpm:admin'],
+ * });
+ * ```
+ */
+export type BPMResolverMetadataFactory = (handler: BPMResolverHandlerDescriptor) => Readonly<Record<string | symbol, unknown>> | null | undefined;
+/**
+ * Records that a whole resolver class sits behind `access`. Called by BPM's
+ * own authorization decorators; hosts do not call this.
+ */
+export declare function registerBPMResolverClassAccess(resolverClass: object, access: BPMResolverAccessLevel): void;
+/**
+ * Records that a single handler sits behind `access`, overriding whatever the
+ * class-level decorator asked for. Called by BPM's own authorization
+ * decorators; hosts do not call this.
+ */
+export declare function registerBPMResolverMethodAccess(resolverClass: object, methodName: string, access: BPMResolverAccessLevel): void;
+/**
+ * Replays `factory` over every registered BPM handler and writes the metadata
+ * it returns onto the prototype method, which is what Nest hands a guard as
+ * `context.getHandler()`.
+ *
+ * `BPMRootModule` calls this for `resolverMetadataFactory`. Calling it twice
+ * with the same factory simply writes the same values again.
+ */
+export declare function applyBPMResolverMetadata(factory: BPMResolverMetadataFactory): void;
+/**
+ * Every BPM handler the metadata factory would be offered, in registration
+ * order. Exposed so a host can print the list while mapping BPM operations
+ * onto its own permissions.
+ */
+export declare function listBPMResolverHandlers(): readonly BPMResolverHandlerDescriptor[];

package/src/lib/bpm-auth/bpm-resolver-metadata.js

@@ -0,0 +1,158 @@
+"use strict";
+/**
+ * Extension point that lets a host stamp its own route metadata onto every BPM
+ * GraphQL handler.
+ *
+ * BPM guards its own resolvers with `@BPMAuthenticated()`, `@BPMAdminOnly()`
+ * and `@BPMDesignerOnly()`. A host that also installs a *global* guard of its
+ * own — `@rytass/member-base-nestjs-module` registers a `CasbinGuard` that
+ * rejects any route carrying no `@CheckPermission` metadata — rejects all of
+ * them before BPM's guards ever run, and the two packages cannot be mounted
+ * together at all.
+ *
+ * BPM cannot import the host's decorator, and a decorator cannot read module
+ * options because it runs when the class is defined. So the resolver classes
+ * register themselves here as they are decorated, and the host supplies a
+ * factory that BPM replays over them at module wiring time — before Nest reads
+ * any of this metadata, which it only does per request.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerBPMResolverClassAccess = registerBPMResolverClassAccess;
+exports.registerBPMResolverMethodAccess = registerBPMResolverMethodAccess;
+exports.applyBPMResolverMetadata = applyBPMResolverMetadata;
+exports.listBPMResolverHandlers = listBPMResolverHandlers;
+const graphql_1 = require("@nestjs/graphql");
+const ACCESS_BY_RESOLVER = new Map();
+/**
+ * Records that a whole resolver class sits behind `access`. Called by BPM's
+ * own authorization decorators; hosts do not call this.
+ */
+function registerBPMResolverClassAccess(resolverClass, access) {
+    readRegistration(resolverClass).classAccess = access;
+}
+/**
+ * Records that a single handler sits behind `access`, overriding whatever the
+ * class-level decorator asked for. Called by BPM's own authorization
+ * decorators; hosts do not call this.
+ */
+function registerBPMResolverMethodAccess(resolverClass, methodName, access) {
+    readRegistration(resolverClass).accessByMethod.set(methodName, access);
+}
+/**
+ * Replays `factory` over every registered BPM handler and writes the metadata
+ * it returns onto the prototype method, which is what Nest hands a guard as
+ * `context.getHandler()`.
+ *
+ * `BPMRootModule` calls this for `resolverMetadataFactory`. Calling it twice
+ * with the same factory simply writes the same values again.
+ */
+function applyBPMResolverMetadata(factory) {
+    for (const [resolverClass, registration] of ACCESS_BY_RESOLVER) {
+        const prototype = readPrototype(resolverClass);
+        if (!prototype) {
+            continue;
+        }
+        for (const methodName of listHandlerMethodNames(prototype)) {
+            const access = registration.accessByMethod.get(methodName) ??
+                registration.classAccess;
+            if (access === null || access === undefined) {
+                continue;
+            }
+            const metadata = factory({
+                access,
+                methodName,
+                resolverName: readResolverName(resolverClass),
+            });
+            if (!metadata) {
+                continue;
+            }
+            const handler = prototype[methodName];
+            // `Reflect.ownKeys`, not `Object.entries`: several Nest ecosystem guards
+            // key their metadata by symbol, and dropping those silently would look
+            // to a host exactly like the factory never ran.
+            for (const key of Reflect.ownKeys(metadata)) {
+                Reflect.defineMetadata(key, metadata[key], handler);
+            }
+        }
+    }
+}
+/**
+ * Every BPM handler the metadata factory would be offered, in registration
+ * order. Exposed so a host can print the list while mapping BPM operations
+ * onto its own permissions.
+ */
+function listBPMResolverHandlers() {
+    const handlers = [];
+    for (const [resolverClass, registration] of ACCESS_BY_RESOLVER) {
+        const prototype = readPrototype(resolverClass);
+        if (!prototype) {
+            continue;
+        }
+        for (const methodName of listHandlerMethodNames(prototype)) {
+            const access = registration.accessByMethod.get(methodName) ??
+                registration.classAccess;
+            if (access === null || access === undefined) {
+                continue;
+            }
+            handlers.push({
+                access,
+                methodName,
+                resolverName: readResolverName(resolverClass),
+            });
+        }
+    }
+    return handlers;
+}
+function readRegistration(resolverClass) {
+    const existing = ACCESS_BY_RESOLVER.get(resolverClass);
+    if (existing) {
+        return existing;
+    }
+    const registration = {
+        accessByMethod: new Map(),
+        classAccess: null,
+    };
+    ACCESS_BY_RESOLVER.set(resolverClass, registration);
+    return registration;
+}
+function readPrototype(resolverClass) {
+    const prototype = resolverClass
+        .prototype;
+    return typeof prototype === 'object' && prototype !== null
+        ? prototype
+        : null;
+}
+function readResolverName(resolverClass) {
+    const name = resolverClass.name;
+    return typeof name === 'string' ? name : '';
+}
+/**
+ * The GraphQL handlers on a resolver prototype and everything it inherits.
+ *
+ * Two things this must not do. It must not list a plain helper method: a host
+ * builds its permission map from `listBPMResolverHandlers()`, and a private
+ * helper would show up there as a GraphQL field that does not exist. And it
+ * must not stop at the class's own prototype: a handler inherited from a base
+ * resolver would then get no metadata at all, which a host sees only as an
+ * unexplained 403.
+ *
+ * `@Query` / `@Mutation` / `@ResolveField` each stamp
+ * `RESOLVER_TYPE_METADATA` on the method, so that is the test.
+ */
+function listHandlerMethodNames(prototype) {
+    const methodNames = new Set();
+    for (let current = prototype; current !== null && current !== Object.prototype; current = Object.getPrototypeOf(current)) {
+        for (const methodName of Object.getOwnPropertyNames(current)) {
+            if (methodName === 'constructor') {
+                continue;
+            }
+            const member = current[methodName];
+            if (typeof member === 'function' &&
+                Reflect.getMetadata(graphql_1.RESOLVER_TYPE_METADATA, member) !== undefined) {
+                methodNames.add(methodName);
+            }
+        }
+    }
+    return [...methodNames];
+}
+//# sourceMappingURL=bpm-resolver-metadata.js.map

package/src/lib/bpm-auth/bpm-resolver-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bpm-resolver-metadata.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/bpm-auth/bpm-resolver-metadata.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;AAoDH,wEAKC;AAOD,0EAMC;AAUD,4DA2CC;AAOD,0DA4BC;AA5JD,6CAAyD;AAEzD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAyC,CAAC;AA4C5E;;;GAGG;AACH,SAAgB,8BAA8B,CAC5C,aAAqB,EACrB,MAA8B;IAE9B,gBAAgB,CAAC,aAAa,CAAC,CAAC,WAAW,GAAG,MAAM,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAgB,+BAA+B,CAC7C,aAAqB,EACrB,UAAkB,EAClB,MAA8B;IAE9B,gBAAgB,CAAC,aAAa,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,wBAAwB,CACtC,OAAmC;IAEnC,KAAK,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,IAAI,kBAAkB,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;QAE/C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,sBAAsB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,MAAM,MAAM,GACV,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC;gBAC3C,YAAY,CAAC,WAAW,CAAC;YAE3B,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,OAAO,CAAC;gBACvB,MAAM;gBACN,UAAU;gBACV,YAAY,EAAE,gBAAgB,CAAC,aAAa,CAAC;aAC9C,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;YAEtC,yEAAyE;YACzE,uEAAuE;YACvE,gDAAgD;YAChD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5C,OAAO,CAAC,cAAc,CACpB,GAAG,EACF,QAA6C,CAAC,GAAG,CAAC,EACnD,OAAiB,CAClB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,uBAAuB;IACrC,MAAM,QAAQ,GAAmC,EAAE,CAAC;IAEpD,KAAK,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,IAAI,kBAAkB,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;QAE/C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,sBAAsB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,MAAM,MAAM,GACV,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC;gBAC3C,YAAY,CAAC,WAAW,CAAC;YAE3B,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM;gBACN,UAAU;gBACV,YAAY,EAAE,gBAAgB,CAAC,aAAa,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CACvB,aAAqB;IAErB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAEvD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,YAAY,GAAkC;QAClD,cAAc,EAAE,IAAI,GAAG,EAAE;QACzB,WAAW,EAAE,IAAI;KAClB,CAAC;IAEF,kBAAkB,CAAC,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAEpD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CACpB,aAAqB;IAErB,MAAM,SAAS,GAAI,aAAkD;SAClE,SAAS,CAAC;IAEb,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;QACxD,CAAC,CAAE,SAAqC;QACxC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,gBAAgB,CAAC,aAAqB;IAC7C,MAAM,IAAI,GAAI,aAA6C,CAAC,IAAI,CAAC;IAEjE,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,sBAAsB,CAC7B,SAAkC;IAElC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,KACE,IAAI,OAAO,GAAkB,SAAS,EACtC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,CAAC,SAAS,EAChD,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAkB,EACzD,CAAC;QACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;gBACjC,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAI,OAAmC,CAAC,UAAU,CAAC,CAAC;YAEhE,IACE,OAAO,MAAM,KAAK,UAAU;gBAC5B,OAAO,CAAC,WAAW,CAAC,gCAAsB,EAAE,MAAM,CAAC,KAAK,SAAS,EACjE,CAAC;gBACD,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,WAAW,CAAC,CAAC;AAC1B,CAAC"}

package/src/lib/bpm-auth/index.d.ts

@@ -4,3 +4,5 @@ export * from './bpm-auth.decorators';
 export * from './bpm-auth.guard';
 export * from './bpm-auth.module';
 export * from './bpm-auth.options';
+export * from './bpm-resolver-access.decorator';
+export * from './bpm-resolver-metadata';

package/src/lib/bpm-auth/index.js

@@ -7,4 +7,6 @@ tslib_1.__exportStar(require("./bpm-auth.decorators"), exports);
 tslib_1.__exportStar(require("./bpm-auth.guard"), exports);
 tslib_1.__exportStar(require("./bpm-auth.module"), exports);
 tslib_1.__exportStar(require("./bpm-auth.options"), exports);
+tslib_1.__exportStar(require("./bpm-resolver-access.decorator"), exports);
+tslib_1.__exportStar(require("./bpm-resolver-metadata"), exports);
 //# sourceMappingURL=index.js.map

package/src/lib/bpm-auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/bpm-auth/index.ts"],"names":[],"mappings":";;;AAAA,6DAAmC;AACnC,mEAAyC;AACzC,gEAAsC;AACtC,2DAAiC;AACjC,4DAAkC;AAClC,6DAAmC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/bpm-auth/index.ts"],"names":[],"mappings":";;;AAAA,6DAAmC;AACnC,mEAAyC;AACzC,gEAAsC;AACtC,2DAAiC;AACjC,4DAAkC;AAClC,6DAAmC;AACnC,0EAAgD;AAChD,kEAAwC"}

package/src/lib/condition/condition.service.js

@@ -3,7 +3,47 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ConditionService = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
-const cel_js_1 = require("cel-js");
+let celEngine = null;
+/**
+ * Loads `cel-js` on first use rather than when this module is imported.
+ *
+ * `cel-js` is ESM-only and its `chevrotain` dependency ships an exports map
+ * that `jest-resolve` cannot follow. While the import sat at the top of this
+ * file, the package root pulled it in through
+ * `index → bpm-root → delegation → condition`, so *any* consumer test that
+ * imported anything from `@rytass/bpm-core-nestjs-module` failed to load with
+ * `Cannot find module 'chevrotain'` — pointing deep into `node_modules`, far
+ * from the code under test. Hosts had to stub `cel-js` before they could write
+ * a single test.
+ *
+ * Deferring the load means a host that never evaluates a CEL expression never
+ * resolves the package at all. `require` (not `await import`) keeps every
+ * caller in this file synchronous.
+ */
+function loadCelEngine() {
+    if (celEngine === null) {
+        try {
+            celEngine = require('cel-js');
+        }
+        catch (error) {
+            // Deferring the load also defers this failure: it used to surface at
+            // boot as a bare ERR_REQUIRE_ESM, and would now surface as a 500 on
+            // whichever request first evaluated a condition. Name the cause where it
+            // is thrown.
+            if (isRequireEsmError(error)) {
+                throw new Error(`[@rytass/bpm-core-nestjs-module] This Node version cannot require the ESM-only 'cel-js'. BPM needs Node >=20.19 or >=22.12 to evaluate CEL conditions. Original error: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            throw error;
+        }
+    }
+    return celEngine;
+}
+function isRequireEsmError(error) {
+    return (typeof error === 'object' &&
+        error !== null &&
+        'code' in error &&
+        error.code === 'ERR_REQUIRE_ESM');
+}
 const DEFAULT_MAX_EXPRESSION_LENGTH = 2000;
 // `has` and `size` are CEL macros, not context identifiers; the root-identifier
 // lint must not report them as unknown. `size` is required by the table field
@@ -25,7 +65,7 @@ let ConditionService = class ConditionService {
         if (trimmedExpression.length > maxExpressionLength) {
             return [`${label} must be ${maxExpressionLength} characters or fewer`];
         }
-        const parseResult = (0, cel_js_1.parse)(trimmedExpression);
+        const parseResult = loadCelEngine().parse(trimmedExpression);
         if (isParseFailure(parseResult)) {
             return parseResult.errors.map((error) => `${label}: ${error}`);
         }
@@ -47,12 +87,13 @@ let ConditionService = class ConditionService {
         if (lengthErrors.length) {
             throw new common_1.BadRequestException(lengthErrors.join('; '));
         }
-        const parseResult = (0, cel_js_1.parse)(trimmedExpression);
+        const engine = loadCelEngine();
+        const parseResult = engine.parse(trimmedExpression);
         if (isParseFailure(parseResult)) {
             throw new common_1.BadRequestException(parseResult.errors.map((error) => `${label}: ${error}`).join('; '));
         }
         try {
-            return (0, cel_js_1.evaluate)(parseResult.cst, { ...context });
+            return engine.evaluate(parseResult.cst, { ...context });
         }
         catch (error) {
             throw new common_1.BadRequestException(error instanceof Error ? `${label}: ${error.message}` : label);

package/src/lib/condition/condition.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"condition.service.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/condition/condition.service.ts"],"names":[],"mappings":";;;;AAAA,2CAAiE;AACjE,mCAAyE;AAczE,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAC3C,gFAAgF;AAChF,8EAA8E;AAC9E,kDAAkD;AAClD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAGtE,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,eAAe,CACb,WAA2C,EAC3C,UAAgC,EAAE;QAElC,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,CACnD,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAChD,CAAC;IACJ,CAAC;IAED,cAAc,CACZ,UAAqC,EACrC,KAAa,EACb,UAAgC,EAAE;QAElC,IAAI,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YAC7D,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,iBAAiB,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,mBAAmB,GACvB,OAAO,CAAC,mBAAmB,IAAI,6BAA6B,CAAC;QAE/D,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,iBAAiB,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YACnD,OAAO,CAAC,GAAG,KAAK,YAAY,mBAAmB,sBAAsB,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,WAAW,GAAG,IAAA,cAAK,EAAC,iBAAiB,CAAC,CAAC;QAE7C,IAAI,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,OAAO,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAED,eAAe,CACb,UAAqC,EACrC,OAA6B,EAC7B,KAAa;QAEb,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAE7D,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,IAAI,4BAAmB,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACvE,CAAC;IAED,aAAa,CACX,UAAkB,EAClB,OAA6B,EAC7B,KAAa;QAEb,MAAM,iBAAiB,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAEnE,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;YACxB,MAAM,IAAI,4BAAmB,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,WAAW,GAAG,IAAA,cAAK,EAAC,iBAAiB,CAAC,CAAC;QAE7C,IAAI,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,4BAAmB,CAC3B,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACnE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAA,iBAAQ,EAAC,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,IAAI,4BAAmB,CAC3B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AAtFY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;GACA,gBAAgB,CAsF5B;AAED,SAAS,cAAc,CAAC,WAAwB;IAC9C,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC;AAChC,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAAkB,EAClB,KAAa,EACb,OAA6B;IAE7B,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAE9D,IAAI,CAAC,sBAAsB,EAAE,MAAM,EAAE,CAAC;QACpC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,sBAAsB,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;IACtE,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAC5B,mBAAmB,CAAC,QAAQ,CAC1B,8CAA8C,CAC/C,CACF,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,kBAAkB,GAAG;QACzB,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;KACzE,CAAC;IAEF,OAAO,kBAAkB,CAAC,GAAG,CAC3B,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,KAAK,sCAAsC,UAAU,EAAE,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,OAAO,UAAU,CAAC,OAAO,CAAC,mCAAmC,EAAE,IAAI,CAAC,CAAC;AACvE,CAAC"}
+{"version":3,"file":"condition.service.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/condition/condition.service.ts"],"names":[],"mappings":";;;;AAAA,2CAAiE;AAcjE,IAAI,SAAS,GAAqB,IAAI,CAAC;AAEvC;;;;;;;;;;;;;;;GAeG;AACH,SAAS,aAAa;IACpB,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAc,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,qEAAqE;YACrE,oEAAoE;YACpE,yEAAyE;YACzE,aAAa;YACb,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,0KACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,MAAM,IAAI,KAAK;QACd,KAAqC,CAAC,IAAI,KAAK,iBAAiB,CAClE,CAAC;AACJ,CAAC;AAcD,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAC3C,gFAAgF;AAChF,8EAA8E;AAC9E,kDAAkD;AAClD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAGtE,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,eAAe,CACb,WAA2C,EAC3C,UAAgC,EAAE;QAElC,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,CACnD,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAChD,CAAC;IACJ,CAAC;IAED,cAAc,CACZ,UAAqC,EACrC,KAAa,EACb,UAAgC,EAAE;QAElC,IAAI,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YAC7D,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,iBAAiB,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,mBAAmB,GACvB,OAAO,CAAC,mBAAmB,IAAI,6BAA6B,CAAC;QAE/D,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,iBAAiB,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YACnD,OAAO,CAAC,GAAG,KAAK,YAAY,mBAAmB,sBAAsB,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,WAAW,GAAG,aAAa,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAE7D,IAAI,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,OAAO,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAED,eAAe,CACb,UAAqC,EACrC,OAA6B,EAC7B,KAAa;QAEb,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAE7D,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,IAAI,4BAAmB,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACvE,CAAC;IAED,aAAa,CACX,UAAkB,EAClB,OAA6B,EAC7B,KAAa;QAEb,MAAM,iBAAiB,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAEnE,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;YACxB,MAAM,IAAI,4BAAmB,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAEpD,IAAI,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,4BAAmB,CAC3B,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACnE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,IAAI,4BAAmB,CAC3B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AAvFY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;GACA,gBAAgB,CAuF5B;AAED,SAAS,cAAc,CAAC,WAAwB;IAC9C,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC;AAChC,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAAkB,EAClB,KAAa,EACb,OAA6B;IAE7B,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAE9D,IAAI,CAAC,sBAAsB,EAAE,MAAM,EAAE,CAAC;QACpC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,sBAAsB,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;IACtE,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAC5B,mBAAmB,CAAC,QAAQ,CAC1B,8CAA8C,CAC/C,CACF,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,kBAAkB,GAAG;QACzB,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;KACzE,CAAC;IAEF,OAAO,kBAAkB,CAAC,GAAG,CAC3B,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,KAAK,sCAAsC,UAAU,EAAE,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,OAAO,UAAU,CAAC,OAAO,CAAC,mCAAmC,EAAE,IAAI,CAAC,CAAC;AACvE,CAAC"}

package/src/lib/identity/identity-options.d.ts

@@ -4,6 +4,22 @@ export interface BPMRootIdentityOptions {
      * Member metadata cache lifetime in milliseconds.
      */
     readonly identityMemberMetadataCacheTtlMs?: number;
+    /**
+     * Whether BPM registers `IdentityQueries` — the `member`, `members`,
+     * `memberCount`, `searchMembers`, and `cachedMembers` GraphQL queries.
+     * Defaults to `true`.
+     *
+     * Those are common names. A host that already publishes its own member API
+     * gets `MultipleFieldsWithSameNameError` from `@nestjs/graphql` the moment
+     * `BPMRootModule` is mounted, and the application never starts. Set this to
+     * `false` to keep `IdentityService` (and everything in BPM that depends on
+     * it) while leaving the GraphQL surface entirely to the host.
+     *
+     * Read at module wiring time, not from a `forRootAsync` factory: Nest
+     * collects resolver providers while building the schema, before any async
+     * factory has run.
+     */
+    readonly identityRegisterResolvers?: boolean;
 }
 export interface BPMResolvedIdentityOptions {
     readonly memberMetadataCacheTtlMs: number;

package/src/lib/identity/identity-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity-options.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/identity/identity-options.ts"],"names":[],"mappings":";;;AAoBA,8DASC;AAhBY,QAAA,oBAAoB,GAC/B,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAEpB,QAAA,4BAA4B,GAA+B;IACtE,wBAAwB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;CACxC,CAAC;AAEF,SAAgB,yBAAyB,CACvC,UAAkC,EAAE;IAEpC,OAAO;QACL,wBAAwB,EAAE,wBAAwB,CAChD,OAAO,CAAC,gCAAgC,EACxC,oCAA4B,CAAC,wBAAwB,CACtD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAyB,EACzB,QAAgB;IAEhB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACxE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"identity-options.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/identity/identity-options.ts"],"names":[],"mappings":";;;AAqCA,8DASC;AAhBY,QAAA,oBAAoB,GAC/B,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAEpB,QAAA,4BAA4B,GAA+B;IACtE,wBAAwB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;CACxC,CAAC;AAEF,SAAgB,yBAAyB,CACvC,UAAkC,EAAE;IAEpC,OAAO;QACL,wBAAwB,EAAE,wBAAwB,CAChD,OAAO,CAAC,gCAAgC,EACxC,oCAA4B,CAAC,wBAAwB,CACtD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAyB,EACzB,QAAgB;IAEhB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACxE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/src/lib/identity/identity.module.d.ts

@@ -7,6 +7,12 @@ export interface IdentityModuleOptions extends BPMRootIdentityOptions {
     readonly memberResolverProvider: Provider<BPMMemberResolver>;
 }
 export interface IdentityModuleAsyncOptions extends Pick<ModuleMetadata, 'imports'> {
+    /**
+     * See `BPMRootIdentityOptions.identityRegisterResolvers`. Read here rather
+     * than from `useFactory` because Nest collects resolver providers before any
+     * async factory runs.
+     */
+    readonly identityRegisterResolvers?: boolean;
     readonly inject?: readonly InjectionToken[];
     readonly memberResolverProvider: Provider<BPMMemberResolver>;
     readonly useFactory: (...args: readonly unknown[]) => BPMRootIdentityOptions | Promise<BPMRootIdentityOptions>;

package/src/lib/identity/identity.module.js

@@ -20,7 +20,7 @@ let IdentityModule = IdentityModule_1 = class IdentityModule {
             ],
             module: IdentityModule_1,
             providers: [
-                identity_queries_1.IdentityQueries,
+                ...createIdentityGraphQLProviders(options.identityRegisterResolvers),
                 identity_service_1.IdentityService,
                 ...resolverProviders,
                 createIdentityOptionsProvider(options),
@@ -37,7 +37,7 @@ let IdentityModule = IdentityModule_1 = class IdentityModule {
             ],
             module: IdentityModule_1,
             providers: [
-                identity_queries_1.IdentityQueries,
+                ...createIdentityGraphQLProviders(options.identityRegisterResolvers),
                 identity_service_1.IdentityService,
                 ...resolverProviders,
                 {
@@ -53,6 +53,13 @@ exports.IdentityModule = IdentityModule;
 exports.IdentityModule = IdentityModule = IdentityModule_1 = tslib_1.__decorate([
     (0, common_1.Module)({})
 ], IdentityModule);
+/**
+ * `IdentityQueries` is a provider like any other, so leaving it out of the
+ * providers list is what keeps its fields out of the generated schema.
+ */
+function createIdentityGraphQLProviders(registerResolvers) {
+    return registerResolvers === false ? [] : [identity_queries_1.IdentityQueries];
+}
 function createMemberResolverProviders(options) {
     return [options.memberResolverProvider];
 }

package/src/lib/identity/identity.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.module.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/identity/identity.module.ts"],"names":[],"mappings":";;;;;AAAA,2CAKwB;AAExB,6CAAgD;AAChD,yDAAqD;AACrD,yDAAqD;AACrD,iFAA2E;AAE3E,yDAI4B;AAmBrB,IAAM,cAAc,sBAApB,MAAM,cAAc;IACzB,MAAM,CAAC,OAAO,CAAC,OAA8B;QAC3C,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;QAEjE,OAAO;YACL,OAAO,EAAE,CAAC,kCAAe,CAAC;YAC1B,OAAO,EAAE;gBACP,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC1B,uBAAa,CAAC,UAAU,CAAC,CAAC,wDAAyB,CAAC,CAAC;aACtD;YACD,MAAM,EAAE,gBAAc;YACtB,SAAS,EAAE;gBACT,kCAAe;gBACf,kCAAe;gBACf,GAAG,iBAAiB;gBACpB,6BAA6B,CAAC,OAAO,CAAC;aACvC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAmC;QACrD,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;QAEjE,OAAO;YACL,OAAO,EAAE,CAAC,kCAAe,CAAC;YAC1B,OAAO,EAAE;gBACP,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC1B,uBAAa,CAAC,UAAU,CAAC,CAAC,wDAAyB,CAAC,CAAC;aACtD;YACD,MAAM,EAAE,gBAAc;YACtB,SAAS,EAAE;gBACT,kCAAe;gBACf,kCAAe;gBACf,GAAG,iBAAiB;gBACpB;oBACE,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;oBACnC,OAAO,EAAE,uCAAoB;oBAC7B,UAAU,EAAE,KAAK,EACf,GAAG,IAAwB,EAC4B,EAAE,CACzD,IAAA,4CAAyB,EAAC,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;iBAC/D;aACF;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AA7CY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,cAAc,CA6C1B;AAED,SAAS,6BAA6B,CACpC,OAA8B;IAE9B,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,6BAA6B,CACpC,UAAkC,EAAE;IAEpC,OAAO;QACL,OAAO,EAAE,uCAAoB;QAC7B,QAAQ,EAAE,IAAA,4CAAyB,EAAC,OAAO,CAAC;KAC7C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"identity.module.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/identity/identity.module.ts"],"names":[],"mappings":";;;;;AAAA,2CAKwB;AAExB,6CAAgD;AAChD,yDAAqD;AACrD,yDAAqD;AACrD,iFAA2E;AAE3E,yDAI4B;AAyBrB,IAAM,cAAc,sBAApB,MAAM,cAAc;IACzB,MAAM,CAAC,OAAO,CAAC,OAA8B;QAC3C,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;QAEjE,OAAO;YACL,OAAO,EAAE,CAAC,kCAAe,CAAC;YAC1B,OAAO,EAAE;gBACP,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC1B,uBAAa,CAAC,UAAU,CAAC,CAAC,wDAAyB,CAAC,CAAC;aACtD;YACD,MAAM,EAAE,gBAAc;YACtB,SAAS,EAAE;gBACT,GAAG,8BAA8B,CAAC,OAAO,CAAC,yBAAyB,CAAC;gBACpE,kCAAe;gBACf,GAAG,iBAAiB;gBACpB,6BAA6B,CAAC,OAAO,CAAC;aACvC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAmC;QACrD,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;QAEjE,OAAO;YACL,OAAO,EAAE,CAAC,kCAAe,CAAC;YAC1B,OAAO,EAAE;gBACP,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC1B,uBAAa,CAAC,UAAU,CAAC,CAAC,wDAAyB,CAAC,CAAC;aACtD;YACD,MAAM,EAAE,gBAAc;YACtB,SAAS,EAAE;gBACT,GAAG,8BAA8B,CAAC,OAAO,CAAC,yBAAyB,CAAC;gBACpE,kCAAe;gBACf,GAAG,iBAAiB;gBACpB;oBACE,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;oBACnC,OAAO,EAAE,uCAAoB;oBAC7B,UAAU,EAAE,KAAK,EACf,GAAG,IAAwB,EAC4B,EAAE,CACzD,IAAA,4CAAyB,EAAC,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;iBAC/D;aACF;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AA7CY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,cAAc,CA6C1B;AAED;;;GAGG;AACH,SAAS,8BAA8B,CACrC,iBAAsC;IAEtC,OAAO,iBAAiB,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,kCAAe,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,6BAA6B,CACpC,OAA8B;IAE9B,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,6BAA6B,CACpC,UAAkC,EAAE;IAEpC,OAAO;QACL,OAAO,EAAE,uCAAoB;QAC7B,QAAQ,EAAE,IAAA,4CAAyB,EAAC,OAAO,CAAC;KAC7C,CAAC;AACJ,CAAC"}

package/src/lib/migrations/0000000000001-enable-postgres-extensions.d.ts

@@ -2,5 +2,13 @@ import { MigrationInterface, QueryRunner } from 'typeorm';
 export declare class EnablePostgresExtensions0000000000001 implements MigrationInterface {
     readonly name = "EnablePostgresExtensions0000000000001";
     up(queryRunner: QueryRunner): Promise<void>;
-    down(queryRunner: QueryRunner): Promise<void>;
+    /**
+     * Intentionally a no-op.
+     *
+     * Extensions are a one-time, database-wide prerequisite that a privileged
+     * role may well have installed before BPM ever ran — and other schemas in
+     * the same database may depend on them. Dropping `ltree` on the way down
+     * would take something this migration did not necessarily create.
+     */
+    down(): Promise<void>;
 }

package/src/lib/migrations/0000000000001-enable-postgres-extensions.js

@@ -1,17 +1,68 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EnablePostgresExtensions0000000000001 = void 0;
+const INSUFFICIENT_PRIVILEGE = '42501';
+/**
+ * PostgreSQL extensions every later BPM migration depends on: `uuid-ossp` for
+ * `uuid_generate_v4()` defaults, `ltree` for the org unit `path` column and its
+ * ancestor/descendant operators.
+ */
+const REQUIRED_EXTENSIONS = ['uuid-ossp', 'ltree'];
 class EnablePostgresExtensions0000000000001 {
     constructor() {
         this.name = 'EnablePostgresExtensions0000000000001';
     }
     async up(queryRunner) {
-        await queryRunner.query('CREATE EXTENSION IF NOT EXISTS "uuid-ossp"');
-        await queryRunner.query('CREATE EXTENSION IF NOT EXISTS "ltree"');
+        for (const extension of REQUIRED_EXTENSIONS) {
+            // PostgreSQL already returns early from `CREATE EXTENSION IF NOT
+            // EXISTS` when the extension is present, before it checks privileges, so
+            // this probe is not what makes a least-privilege role work — it makes
+            // the intent explicit and keeps the branch below reachable only in the
+            // case that actually needs explaining.
+            if (await isExtensionInstalled(queryRunner, extension)) {
+                continue;
+            }
+            try {
+                await queryRunner.query(`CREATE EXTENSION IF NOT EXISTS "${extension}"`);
+            }
+            catch (error) {
+                if (!isInsufficientPrivilegeError(error)) {
+                    throw error;
+                }
+                throw new Error([
+                    `[@rytass/bpm-core-nestjs-module] Cannot create the required PostgreSQL extension "${extension}": the migration role has no CREATE privilege on this database.`,
+                    'This is a one-time prerequisite, not something the application role can fix at runtime. Ask a role with sufficient privilege (a superuser, the database owner, or rds_superuser) to run:',
+                    ...REQUIRED_EXTENSIONS.map((name) => `    CREATE EXTENSION IF NOT EXISTS "${name}";`),
+                    'against the BPM database, then run the migrations again. See the package README, "Database prerequisites".',
+                    `Original error: ${readErrorMessage(error)}`,
+                ].join('\n'));
+            }
+        }
     }
-    async down(queryRunner) {
-        await queryRunner.query('DROP EXTENSION IF EXISTS "ltree"');
+    /**
+     * Intentionally a no-op.
+     *
+     * Extensions are a one-time, database-wide prerequisite that a privileged
+     * role may well have installed before BPM ever ran — and other schemas in
+     * the same database may depend on them. Dropping `ltree` on the way down
+     * would take something this migration did not necessarily create.
+     */
+    async down() {
+        return;
     }
 }
 exports.EnablePostgresExtensions0000000000001 = EnablePostgresExtensions0000000000001;
+async function isExtensionInstalled(queryRunner, extension) {
+    const rows = await queryRunner.query('SELECT 1 FROM pg_extension WHERE extname = $1', [extension]);
+    return rows.length > 0;
+}
+function readErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function isInsufficientPrivilegeError(error) {
+    return (typeof error === 'object' &&
+        error !== null &&
+        'code' in error &&
+        error.code === INSUFFICIENT_PRIVILEGE);
+}
 //# sourceMappingURL=0000000000001-enable-postgres-extensions.js.map

package/src/lib/migrations/0000000000001-enable-postgres-extensions.js.map

@@ -1 +1 @@
-{"version":3,"file":"0000000000001-enable-postgres-extensions.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/migrations/0000000000001-enable-postgres-extensions.ts"],"names":[],"mappings":";;;AAEA,MAAa,qCAAqC;IAAlD;QACW,SAAI,GAAG,uCAAuC,CAAC;IAU1D,CAAC;IARC,KAAK,CAAC,EAAE,CAAC,WAAwB;QAC/B,MAAM,WAAW,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACtE,MAAM,WAAW,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,WAAwB;QACjC,MAAM,WAAW,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC9D,CAAC;CACF;AAXD,sFAWC"}
+{"version":3,"file":"0000000000001-enable-postgres-extensions.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/migrations/0000000000001-enable-postgres-extensions.ts"],"names":[],"mappings":";;;AAEA,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAEvC;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,CAAC,WAAW,EAAE,OAAO,CAAU,CAAC;AAE5D,MAAa,qCAAqC;IAAlD;QACW,SAAI,GAAG,uCAAuC,CAAC;IAgD1D,CAAC;IA9CC,KAAK,CAAC,EAAE,CAAC,WAAwB;QAC/B,KAAK,MAAM,SAAS,IAAI,mBAAmB,EAAE,CAAC;YAC5C,iEAAiE;YACjE,yEAAyE;YACzE,sEAAsE;YACtE,uEAAuE;YACvE,uCAAuC;YACvC,IAAI,MAAM,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;gBACvD,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,KAAK,CACrB,mCAAmC,SAAS,GAAG,CAChD,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzC,MAAM,KAAK,CAAC;gBACd,CAAC;gBAED,MAAM,IAAI,KAAK,CACb;oBACE,qFAAqF,SAAS,iEAAiE;oBAC/J,0LAA0L;oBAC1L,GAAG,mBAAmB,CAAC,GAAG,CACxB,CAAC,IAAI,EAAU,EAAE,CAAC,uCAAuC,IAAI,IAAI,CAClE;oBACD,4GAA4G;oBAC5G,mBAAmB,gBAAgB,CAAC,KAAK,CAAC,EAAE;iBAC7C,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI;QACR,OAAO;IACT,CAAC;CACF;AAjDD,sFAiDC;AAED,KAAK,UAAU,oBAAoB,CACjC,WAAwB,EACxB,SAAiB;IAEjB,MAAM,IAAI,GAAuB,MAAM,WAAW,CAAC,KAAK,CACtD,+CAA+C,EAC/C,CAAC,SAAS,CAAC,CACZ,CAAC;IAEF,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAc;IAClD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,MAAM,IAAI,KAAK;QACd,KAAqC,CAAC,IAAI,KAAK,sBAAsB,CACvE,CAAC;AACJ,CAAC"}

package/src/lib/notification/index.d.ts

@@ -1,3 +1,4 @@
+export * from './dto/notification-preference.input';
 export * from './notification-delivery.service';
 export * from './notification-dispatcher.token';
 export * from './notification-observer.token';

package/src/lib/notification/index.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./dto/notification-preference.input"), exports);
 tslib_1.__exportStar(require("./notification-delivery.service"), exports);
 tslib_1.__exportStar(require("./notification-dispatcher.token"), exports);
 tslib_1.__exportStar(require("./notification-observer.token"), exports);

package/src/lib/notification/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/notification/index.ts"],"names":[],"mappings":";;;AAAA,0EAAgD;AAChD,0EAAgD;AAChD,wEAA8C;AAC9C,2EAAiD;AACjD,kEAAwC;AACxC,gEAAsC;AACtC,+DAAqC;AACrC,iEAAuC;AACvC,wEAA8C;AAC9C,gEAAsC;AACtC,iEAAuC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/notification/index.ts"],"names":[],"mappings":";;;AAAA,8EAAoD;AACpD,0EAAgD;AAChD,0EAAgD;AAChD,wEAA8C;AAC9C,2EAAiD;AACjD,kEAAwC;AACxC,gEAAsC;AACtC,+DAAqC;AACrC,iEAAuC;AACvC,wEAA8C;AAC9C,gEAAsC;AACtC,iEAAuC"}

package/src/lib/organization/dto/manager-resolution.input.d.ts

@@ -5,14 +5,14 @@ export declare class CreateManagerResolutionInput {
     managerMemberId: string;
     priority: number;
     effectiveFrom: string;
-    effectiveTo: string | null;
+    effectiveTo?: string | null;
 }
 export declare class UpdateManagerResolutionInput {
     id: string;
-    scopeType: ManagerResolutionScopeTypeEnum | null;
-    scopeId: string | null;
-    managerMemberId: string | null;
-    priority: number | null;
-    effectiveFrom: string | null;
-    effectiveTo: string | null;
+    scopeType?: ManagerResolutionScopeTypeEnum | null;
+    scopeId?: string | null;
+    managerMemberId?: string | null;
+    priority?: number | null;
+    effectiveFrom?: string | null;
+    effectiveTo?: string | null;
 }

package/src/lib/organization/dto/membership.input.d.ts

@@ -1,16 +1,16 @@
 export declare class CreateMembershipInput {
     memberId: string;
     orgUnitId: string;
-    positionId: string | null;
+    positionId?: string | null;
     isPrimary: boolean;
     effectiveFrom: string;
-    effectiveTo: string | null;
+    effectiveTo?: string | null;
 }
 export declare class UpdateMembershipInput {
     id: string;
-    orgUnitId: string | null;
-    positionId: string | null;
-    isPrimary: boolean | null;
-    effectiveFrom: string | null;
-    effectiveTo: string | null;
+    orgUnitId?: string | null;
+    positionId?: string | null;
+    isPrimary?: boolean | null;
+    effectiveFrom?: string | null;
+    effectiveTo?: string | null;
 }