@rytass/bpm-core-nestjs-module 0.13.3 → 0.13.5

package/src/lib/workflow-webhook/workflow-webhook-endpoint.entity.js

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkflowWebhookEndpointAuditEntity = exports.WorkflowWebhookEndpointAuditActionEnum = exports.WorkflowWebhookEndpointEntity = void 0;
+const tslib_1 = require("tslib");
+const typeorm_1 = require("typeorm");
+/**
+ * A NOTIFY webhook endpoint maintained by a BPM administrator (ADR 18
+ * §3.13). Not a GraphQL type: the admin view masks every header value and
+ * the signing secret, and only says whether they are set.
+ */
+let WorkflowWebhookEndpointEntity = class WorkflowWebhookEndpointEntity {
+};
+exports.WorkflowWebhookEndpointEntity = WorkflowWebhookEndpointEntity;
+tslib_1.__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    tslib_1.__metadata("design:type", String)
+], WorkflowWebhookEndpointEntity.prototype, "id", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text'),
+    tslib_1.__metadata("design:type", String)
+], WorkflowWebhookEndpointEntity.prototype, "key", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('integer'),
+    tslib_1.__metadata("design:type", Number)
+], WorkflowWebhookEndpointEntity.prototype, "version", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text'),
+    tslib_1.__metadata("design:type", String)
+], WorkflowWebhookEndpointEntity.prototype, "label", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text', { nullable: true }),
+    tslib_1.__metadata("design:type", Object)
+], WorkflowWebhookEndpointEntity.prototype, "description", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('jsonb', { default: () => "'[]'::jsonb" }),
+    tslib_1.__metadata("design:type", Array)
+], WorkflowWebhookEndpointEntity.prototype, "parameters", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text'),
+    tslib_1.__metadata("design:type", String)
+], WorkflowWebhookEndpointEntity.prototype, "url", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text', { default: 'POST' }),
+    tslib_1.__metadata("design:type", String)
+], WorkflowWebhookEndpointEntity.prototype, "method", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text', { name: 'encrypted_headers', nullable: true }),
+    tslib_1.__metadata("design:type", Object)
+], WorkflowWebhookEndpointEntity.prototype, "encryptedHeaders", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text', { name: 'encrypted_signing_secret', nullable: true }),
+    tslib_1.__metadata("design:type", Object)
+], WorkflowWebhookEndpointEntity.prototype, "encryptedSigningSecret", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('integer', { name: 'timeout_ms', nullable: true }),
+    tslib_1.__metadata("design:type", Object)
+], WorkflowWebhookEndpointEntity.prototype, "timeoutMs", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('boolean', { default: true, name: 'is_active' }),
+    tslib_1.__metadata("design:type", Boolean)
+], WorkflowWebhookEndpointEntity.prototype, "isActive", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('boolean', { default: false }),
+    tslib_1.__metadata("design:type", Boolean)
+], WorkflowWebhookEndpointEntity.prototype, "deprecated", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('timestamptz', { name: 'secret_rotated_at', nullable: true }),
+    tslib_1.__metadata("design:type", Object)
+], WorkflowWebhookEndpointEntity.prototype, "secretRotatedAt", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text', { name: 'created_by_member_id', nullable: true }),
+    tslib_1.__metadata("design:type", Object)
+], WorkflowWebhookEndpointEntity.prototype, "createdByMemberId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text', { name: 'updated_by_member_id', nullable: true }),
+    tslib_1.__metadata("design:type", Object)
+], WorkflowWebhookEndpointEntity.prototype, "updatedByMemberId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.CreateDateColumn)({ name: 'created_at', type: 'timestamptz' }),
+    tslib_1.__metadata("design:type", Date)
+], WorkflowWebhookEndpointEntity.prototype, "createdAt", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.UpdateDateColumn)({ name: 'updated_at', type: 'timestamptz' }),
+    tslib_1.__metadata("design:type", Date)
+], WorkflowWebhookEndpointEntity.prototype, "updatedAt", void 0);
+exports.WorkflowWebhookEndpointEntity = WorkflowWebhookEndpointEntity = tslib_1.__decorate([
+    (0, typeorm_1.Entity)('workflow_webhook_endpoints'),
+    (0, typeorm_1.Index)('IDX_workflow_webhook_endpoints_active', ['isActive']),
+    (0, typeorm_1.Unique)('UQ_workflow_webhook_endpoints_key_version', ['key', 'version'])
+], WorkflowWebhookEndpointEntity);
+var WorkflowWebhookEndpointAuditActionEnum;
+(function (WorkflowWebhookEndpointAuditActionEnum) {
+    WorkflowWebhookEndpointAuditActionEnum["CREATED"] = "CREATED";
+    WorkflowWebhookEndpointAuditActionEnum["DISABLED"] = "DISABLED";
+    WorkflowWebhookEndpointAuditActionEnum["ENABLED"] = "ENABLED";
+    WorkflowWebhookEndpointAuditActionEnum["SECRET_ROTATED"] = "SECRET_ROTATED";
+    WorkflowWebhookEndpointAuditActionEnum["TEST_SENT"] = "TEST_SENT";
+    WorkflowWebhookEndpointAuditActionEnum["UPDATED"] = "UPDATED";
+})(WorkflowWebhookEndpointAuditActionEnum || (exports.WorkflowWebhookEndpointAuditActionEnum = WorkflowWebhookEndpointAuditActionEnum = {}));
+/** Who changed which fields of an endpoint, and when. Never a value. */
+let WorkflowWebhookEndpointAuditEntity = class WorkflowWebhookEndpointAuditEntity {
+};
+exports.WorkflowWebhookEndpointAuditEntity = WorkflowWebhookEndpointAuditEntity;
+tslib_1.__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    tslib_1.__metadata("design:type", String)
+], WorkflowWebhookEndpointAuditEntity.prototype, "id", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('uuid', { name: 'endpoint_id' }),
+    tslib_1.__metadata("design:type", String)
+], WorkflowWebhookEndpointAuditEntity.prototype, "endpointId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text'),
+    tslib_1.__metadata("design:type", String)
+], WorkflowWebhookEndpointAuditEntity.prototype, "action", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('jsonb', { default: () => "'[]'::jsonb", name: 'changed_fields' }),
+    tslib_1.__metadata("design:type", Array)
+], WorkflowWebhookEndpointAuditEntity.prototype, "changedFields", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text', { name: 'actor_member_id', nullable: true }),
+    tslib_1.__metadata("design:type", Object)
+], WorkflowWebhookEndpointAuditEntity.prototype, "actorMemberId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.CreateDateColumn)({ name: 'created_at', type: 'timestamptz' }),
+    tslib_1.__metadata("design:type", Date)
+], WorkflowWebhookEndpointAuditEntity.prototype, "createdAt", void 0);
+exports.WorkflowWebhookEndpointAuditEntity = WorkflowWebhookEndpointAuditEntity = tslib_1.__decorate([
+    (0, typeorm_1.Entity)('workflow_webhook_endpoint_audits'),
+    (0, typeorm_1.Index)('IDX_workflow_webhook_endpoint_audits_endpoint', [
+        'endpointId',
+        'createdAt',
+    ])
+], WorkflowWebhookEndpointAuditEntity);
+//# sourceMappingURL=workflow-webhook-endpoint.entity.js.map

package/src/lib/workflow-webhook/workflow-webhook-endpoint.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-webhook-endpoint.entity.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/workflow-webhook/workflow-webhook-endpoint.entity.ts"],"names":[],"mappings":";;;;AACA,qCAQiB;AAWjB;;;;GAIG;AAII,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;CAuDzC,CAAA;AAvDY,sEAA6B;AAExC;IADC,IAAA,gCAAsB,EAAC,MAAM,CAAC;;yDACnB;AAGZ;IADC,IAAA,gBAAM,EAAC,MAAM,CAAC;;0DACF;AAGb;IADC,IAAA,gBAAM,EAAC,SAAS,CAAC;;8DACD;AAGjB;IADC,IAAA,gBAAM,EAAC,MAAM,CAAC;;4DACA;AAGf;IADC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kEACP;AAG5B;IADC,IAAA,gBAAM,EAAC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC;;iEACK;AAGvD;IADC,IAAA,gBAAM,EAAC,MAAM,CAAC;;0DACF;AAGb;IADC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;;6DACpB;AAIhB;IADC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uEAC7B;AAGjC;IADC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;6EAC9B;AAGvC;IADC,IAAA,gBAAM,EAAC,SAAS,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;gEAChC;AAG1B;IADC,IAAA,gBAAM,EAAC,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;;+DACrC;AAGnB;IADC,IAAA,gBAAM,EAAC,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;;iEACjB;AAGrB;IADC,IAAA,gBAAM,EAAC,aAAa,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sEACvC;AAG9B;IADC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;wEAC/B;AAGlC;IADC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;wEAC/B;AAGlC;IADC,IAAA,0BAAgB,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;sCAClD,IAAI;gEAAC;AAGjB;IADC,IAAA,0BAAgB,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;sCAClD,IAAI;gEAAC;wCAtDN,6BAA6B;IAHzC,IAAA,gBAAM,EAAC,4BAA4B,CAAC;IACpC,IAAA,eAAK,EAAC,uCAAuC,EAAE,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAA,gBAAM,EAAC,2CAA2C,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;GAC3D,6BAA6B,CAuDzC;AAED,IAAY,sCAOX;AAPD,WAAY,sCAAsC;IAChD,6DAAmB,CAAA;IACnB,+DAAqB,CAAA;IACrB,6DAAmB,CAAA;IACnB,2EAAiC,CAAA;IACjC,iEAAuB,CAAA;IACvB,6DAAmB,CAAA;AACrB,CAAC,EAPW,sCAAsC,sDAAtC,sCAAsC,QAOjD;AAED,wEAAwE;AAMjE,IAAM,kCAAkC,GAAxC,MAAM,kCAAkC;CAkB9C,CAAA;AAlBY,gFAAkC;AAE7C;IADC,IAAA,gCAAsB,EAAC,MAAM,CAAC;;8DACnB;AAGZ;IADC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;;sEACpB;AAGpB;IADC,IAAA,gBAAM,EAAC,MAAM,CAAC;;kEACiC;AAGhD;IADC,IAAA,gBAAM,EAAC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;;yEACxC;AAGlC;IADC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;yEAC9B;AAG9B;IADC,IAAA,0BAAgB,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;sCAClD,IAAI;qEAAC;6CAjBN,kCAAkC;IAL9C,IAAA,gBAAM,EAAC,kCAAkC,CAAC;IAC1C,IAAA,eAAK,EAAC,+CAA+C,EAAE;QACtD,YAAY;QACZ,WAAW;KACZ,CAAC;GACW,kCAAkC,CAkB9C"}

package/src/lib/workflow-webhook/workflow-webhook-enqueue.d.ts

@@ -0,0 +1,46 @@
+import { WorkflowWebhookDeliveryStatusEnum } from './workflow-webhook-delivery.enums';
+import { WorkflowWebhookFrozenEvent } from './workflow-webhook-delivery.entity';
+import { BPMWorkflowWebhookEndpointEntry } from './workflow-webhook.types';
+export interface WorkflowWebhookEnqueueContext {
+    readonly instance: {
+        readonly formData: Readonly<Record<string, unknown>>;
+        readonly id: string;
+        readonly initiatorMemberId: string;
+        readonly templateId: string;
+        readonly templateVersionId: string;
+        readonly title: string;
+    };
+    readonly node: {
+        readonly id: string;
+        readonly label: string;
+    };
+    readonly occurredAt: Date;
+    readonly tokenId: string;
+}
+/** The columns a queued delivery is created with. */
+export interface WorkflowWebhookDeliveryDraft {
+    readonly endpointKey: string;
+    readonly endpointVersion: number;
+    readonly event: WorkflowWebhookFrozenEvent;
+    readonly instanceId: string;
+    readonly lastErrorCode: string | null;
+    readonly lastErrorDetail: string | null;
+    readonly nodeId: string;
+    readonly status: WorkflowWebhookDeliveryStatusEnum;
+    readonly targetId: string;
+    readonly tokenId: string;
+}
+/**
+ * Turns a NOTIFY node's webhook targets into delivery rows (ADR 18 §3.5).
+ *
+ * Runs inside the engine transaction, so it must never throw for anything a
+ * template or the submitted form can cause: a problem becomes a row that is
+ * already `FAILED`, recorded and visible to an administrator, and the approval
+ * that reached the node carries on. Parameters are resolved here, once, so
+ * every retry sends exactly what the node saw.
+ */
+export declare function buildWorkflowWebhookDeliveryDrafts({ context, resolveEndpoint, targets, }: {
+    readonly context: WorkflowWebhookEnqueueContext;
+    readonly resolveEndpoint: (key: string, version: number) => Promise<BPMWorkflowWebhookEndpointEntry | null>;
+    readonly targets: unknown;
+}): Promise<readonly WorkflowWebhookDeliveryDraft[]>;

package/src/lib/workflow-webhook/workflow-webhook-enqueue.js

@@ -0,0 +1,134 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildWorkflowWebhookDeliveryDrafts = buildWorkflowWebhookDeliveryDrafts;
+const workflow_graph_1 = require("@rytass/bpm-core-shared/workflow-graph");
+const workflow_webhook_delivery_enums_1 = require("./workflow-webhook-delivery.enums");
+/**
+ * Turns a NOTIFY node's webhook targets into delivery rows (ADR 18 §3.5).
+ *
+ * Runs inside the engine transaction, so it must never throw for anything a
+ * template or the submitted form can cause: a problem becomes a row that is
+ * already `FAILED`, recorded and visible to an administrator, and the approval
+ * that reached the node carries on. Parameters are resolved here, once, so
+ * every retry sends exactly what the node saw.
+ */
+async function buildWorkflowWebhookDeliveryDrafts({ context, resolveEndpoint, targets, }) {
+    const issues = (0, workflow_graph_1.readNotifyWebhookStructureIssues)(targets);
+    // The snapshot passed publish, so this only guards against a definition
+    // written around the lint. A malformed list has nothing safe to deliver.
+    if (!Array.isArray(targets) ||
+        issues.some((issue) => issue.targetIndex === null)) {
+        return [];
+    }
+    const malformed = new Set(issues.map((issue) => issue.targetIndex));
+    const wellFormed = targets.filter((_target, index) => !malformed.has(index));
+    return Promise.all(wellFormed.map(async (target) => {
+        // A host registry that throws must not roll back the approval that
+        // reached this node; the row records the failure instead.
+        const lookup = await resolveEndpoint(target.endpoint.key, target.endpoint.version).then((value) => ({ entry: value, lookupFailed: false }), () => ({ entry: null, lookupFailed: true }));
+        const entry = lookup.entry;
+        const parameters = entry
+            ? resolveParameters(target.bindings, entry.endpoint.descriptor.parameters, context)
+            : { issue: null, values: {} };
+        const failure = lookup.lookupFailed
+            ? {
+                code: workflow_webhook_delivery_enums_1.WORKFLOW_WEBHOOK_DELIVERY_ERROR_CODES.ENDPOINT_LOOKUP_FAILED,
+                detail: `${target.endpoint.key}@${target.endpoint.version} could not be looked up`,
+            }
+            : !entry
+                ? {
+                    code: workflow_webhook_delivery_enums_1.WORKFLOW_WEBHOOK_DELIVERY_ERROR_CODES.ENDPOINT_MISSING,
+                    detail: `${target.endpoint.key}@${target.endpoint.version} is not registered`,
+                }
+                : entry.endpoint.descriptor.disabled
+                    ? {
+                        code: workflow_webhook_delivery_enums_1.WORKFLOW_WEBHOOK_DELIVERY_ERROR_CODES.ENDPOINT_DISABLED,
+                        detail: `${target.endpoint.key}@${target.endpoint.version} is disabled`,
+                    }
+                    : parameters.issue
+                        ? {
+                            code: workflow_webhook_delivery_enums_1.WORKFLOW_WEBHOOK_DELIVERY_ERROR_CODES.PARAMETER_INVALID,
+                            detail: parameters.issue,
+                        }
+                        : null;
+        return {
+            endpointKey: target.endpoint.key,
+            endpointVersion: target.endpoint.version,
+            event: {
+                endpoint: {
+                    key: target.endpoint.key,
+                    version: target.endpoint.version,
+                },
+                initiator: { memberId: context.instance.initiatorMemberId },
+                instance: {
+                    id: context.instance.id,
+                    templateId: context.instance.templateId,
+                    templateVersionId: context.instance.templateVersionId,
+                    title: context.instance.title,
+                },
+                node: { id: context.node.id, label: context.node.label },
+                occurredAt: context.occurredAt.toISOString(),
+                parameters: parameters.values,
+            },
+            instanceId: context.instance.id,
+            lastErrorCode: failure?.code ?? null,
+            lastErrorDetail: failure?.detail ?? null,
+            nodeId: context.node.id,
+            status: failure
+                ? workflow_webhook_delivery_enums_1.WorkflowWebhookDeliveryStatusEnum.FAILED
+                : workflow_webhook_delivery_enums_1.WorkflowWebhookDeliveryStatusEnum.PENDING,
+            targetId: target.id,
+            tokenId: context.tokenId,
+        };
+    }));
+}
+function resolveParameters(bindings, declared, context) {
+    const resolved = declared.flatMap((parameter) => {
+        const binding = bindings.find((candidate) => candidate.parameter === parameter.key);
+        return binding
+            ? [{ parameter, value: readBindingValue(binding, context) }]
+            : [];
+    });
+    const issue = declared
+        .map((parameter) => {
+        const match = resolved.find((candidate) => candidate.parameter.key === parameter.key);
+        const value = match?.value ?? null;
+        if (parameter.required && value === null) {
+            return `parameter "${parameter.key}" is required but resolved to no value`;
+        }
+        return match &&
+            !(0, workflow_graph_1.isNotifyWebhookValueCompatibleWithParameter)(value, parameter.type)
+            ? `parameter "${parameter.key}" expects ${parameter.type}`
+            : null;
+    })
+        .find((candidate) => candidate !== null) ?? null;
+    return {
+        issue,
+        values: Object.fromEntries(resolved.map(({ parameter, value }) => [parameter.key, value])),
+    };
+}
+function readBindingValue(binding, context) {
+    const from = binding.from;
+    if (from.kind === 'CONSTANT') {
+        return from.value;
+    }
+    if (from.kind === 'FIELD') {
+        return Object.prototype.hasOwnProperty.call(context.instance.formData, from.fieldKey)
+            ? (context.instance.formData[from.fieldKey] ?? null)
+            : null;
+    }
+    return readContextValue(from.path, context);
+}
+function readContextValue(path, context) {
+    const values = {
+        'initiator.memberId': context.instance.initiatorMemberId,
+        'instance.id': context.instance.id,
+        'instance.templateId': context.instance.templateId,
+        'instance.templateVersionId': context.instance.templateVersionId,
+        'instance.title': context.instance.title,
+        'node.id': context.node.id,
+        'node.label': context.node.label,
+    };
+    return values[path];
+}
+//# sourceMappingURL=workflow-webhook-enqueue.js.map

package/src/lib/workflow-webhook/workflow-webhook-enqueue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-webhook-enqueue.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/workflow-webhook/workflow-webhook-enqueue.ts"],"names":[],"mappings":";;AA2DA,gFAoGC;AA1JD,2EAGgD;AAChD,uFAG2C;AAsC3C;;;;;;;;GAQG;AACI,KAAK,UAAU,kCAAkC,CAAC,EACvD,OAAO,EACP,eAAe,EACf,OAAO,GAQR;IACC,MAAM,MAAM,GAAG,IAAA,iDAAgC,EAAC,OAAO,CAAC,CAAC;IAEzD,wEAAwE;IACxE,yEAAyE;IACzE,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,EAClD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACpE,MAAM,UAAU,GAAI,OAA0C,CAAC,MAAM,CACnE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAC1C,CAAC;IAEF,OAAO,OAAO,CAAC,GAAG,CAChB,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC9B,mEAAmE;QACnE,0DAA0D;QAC1D,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,MAAM,CAAC,QAAQ,CAAC,GAAG,EACnB,MAAM,CAAC,QAAQ,CAAC,OAAO,CACxB,CAAC,IAAI,CACJ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAClD,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAC5C,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,MAAM,UAAU,GAAG,KAAK;YACtB,CAAC,CAAC,iBAAiB,CACf,MAAM,CAAC,QAAQ,EACf,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,EACpC,OAAO,CACR;YACH,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY;YACjC,CAAC,CAAC;gBACE,IAAI,EAAE,uEAAqC,CAAC,sBAAsB;gBAClE,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,yBAAyB;aACnF;YACH,CAAC,CAAC,CAAC,KAAK;gBACN,CAAC,CAAC;oBACE,IAAI,EAAE,uEAAqC,CAAC,gBAAgB;oBAC5D,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,oBAAoB;iBAC9E;gBACH,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ;oBAClC,CAAC,CAAC;wBACE,IAAI,EAAE,uEAAqC,CAAC,iBAAiB;wBAC7D,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,cAAc;qBACxE;oBACH,CAAC,CAAC,UAAU,CAAC,KAAK;wBAChB,CAAC,CAAC;4BACE,IAAI,EAAE,uEAAqC,CAAC,iBAAiB;4BAC7D,MAAM,EAAE,UAAU,CAAC,KAAK;yBACzB;wBACH,CAAC,CAAC,IAAI,CAAC;QAEf,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;YAChC,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;YACxC,KAAK,EAAE;gBACL,QAAQ,EAAE;oBACR,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;oBACxB,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;iBACjC;gBACD,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE;gBAC3D,QAAQ,EAAE;oBACR,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE;oBACvB,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU;oBACvC,iBAAiB,EAAE,OAAO,CAAC,QAAQ,CAAC,iBAAiB;oBACrD,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK;iBAC9B;gBACD,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE;gBACxD,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE;gBAC5C,UAAU,EAAE,UAAU,CAAC,MAAM;aAC9B;YACD,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC/B,aAAa,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI;YACpC,eAAe,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI;YACxC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;YACvB,MAAM,EAAE,OAAO;gBACb,CAAC,CAAC,mEAAiC,CAAC,MAAM;gBAC1C,CAAC,CAAC,mEAAiC,CAAC,OAAO;YAC7C,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAyC,EACzC,QAAgD,EAChD,OAAsC;IAKtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;QAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAC3B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,GAAG,CACrD,CAAC;QAEF,OAAO,OAAO;YACZ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YAC5D,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GACT,QAAQ;SACL,GAAG,CAAC,CAAC,SAAS,EAAiB,EAAE;QAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CACzB,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,CACzD,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC;QAEnC,IAAI,SAAS,CAAC,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACzC,OAAO,cAAc,SAAS,CAAC,GAAG,wCAAwC,CAAC;QAC7E,CAAC;QAED,OAAO,KAAK;YACV,CAAC,IAAA,4DAA2C,EAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC;YACnE,CAAC,CAAC,cAAc,SAAS,CAAC,GAAG,aAAa,SAAS,CAAC,IAAI,EAAE;YAC1D,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,SAAS,EAAuB,EAAE,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;IAE1E,OAAO;QACL,KAAK;QACL,MAAM,EAAE,MAAM,CAAC,WAAW,CACxB,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAC/D;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,OAA6B,EAC7B,OAAsC;IAEtC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAE1B,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CACzC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EACzB,IAAI,CAAC,QAAQ,CACd;YACC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,gBAAgB,CACvB,IAA8B,EAC9B,OAAsC;IAEtC,MAAM,MAAM,GAAuD;QACjE,oBAAoB,EAAE,OAAO,CAAC,QAAQ,CAAC,iBAAiB;QACxD,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE;QAClC,qBAAqB,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU;QAClD,4BAA4B,EAAE,OAAO,CAAC,QAAQ,CAAC,iBAAiB;QAChE,gBAAgB,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK;QACxC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;QAC1B,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;KACjC,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC"}

package/src/lib/workflow-webhook/workflow-webhook-options.d.ts

@@ -0,0 +1,86 @@
+import { InjectionToken } from '@nestjs/common';
+import { ParsedWorkflowWebhookUrlPattern } from './workflow-webhook-allowlist';
+import { BPMWorkflowWebhookEndpointSourceKind } from './workflow-webhook.types';
+/**
+ * Flattened webhook settings on `BPMRootModule`, alongside the notification
+ * ones (ADR 18 §3.13).
+ */
+export interface BPMRootWorkflowWebhookOptions {
+    /**
+     * Where NOTIFY webhook endpoints may come from. Defaults to `['REGISTRY']`,
+     * so an existing host keeps exactly the endpoints its code registers.
+     *
+     * `DATABASE` additionally needs a non-empty
+     * {@link BPMRootWorkflowWebhookOptions.workflowWebhookAllowedUrlPatterns}
+     * and a {@link BPMRootWorkflowWebhookOptions.workflowWebhookSecretEncryptionKey};
+     * without them the source stays off rather than running unguarded.
+     */
+    readonly workflowWebhookTargetSources?: readonly BPMWorkflowWebhookEndpointSourceKind[];
+    /**
+     * URLs webhook endpoints may call, as patterns (`https://*.example.com/hooks/*`).
+     *
+     * An invalid pattern fails the application at boot. An empty list is not
+     * "allow everything": it means the `DATABASE` source cannot be enabled.
+     */
+    readonly workflowWebhookAllowedUrlPatterns?: readonly string[];
+    /**
+     * Also check `REGISTRY` endpoints against the allowlist. Off by default,
+     * because those URLs come from host code rather than from a form.
+     */
+    readonly workflowWebhookEnforceAllowlistForRegistry?: boolean;
+    /**
+     * Key used to encrypt header values and signing secrets of
+     * database-managed endpoints (P6). Expected to come from the host's secret
+     * store; 32 bytes, hex or base64.
+     */
+    readonly workflowWebhookSecretEncryptionKey?: string;
+    /**
+     * Runs the background scan that retries and releases queued deliveries.
+     * Omitted: on whenever at least one endpoint is registered, because without
+     * it a failed delivery would never be retried. Always off under
+     * `NODE_ENV=test`.
+     */
+    readonly workflowWebhookDeliverySchedulerEnabled?: boolean;
+    /** How often the scheduler scans for due deliveries. Default 15 000 ms. */
+    readonly workflowWebhookDeliveryScanIntervalMs?: number;
+    /** Deliveries claimed per scan. Default 25. */
+    readonly workflowWebhookDeliveryBatchSize?: number;
+    /** Attempts before a retryable failure becomes `FAILED`. Default 6. */
+    readonly workflowWebhookDeliveryMaxAttempts?: number;
+    /**
+     * First retry delay; each further attempt doubles it, with ±20 % jitter.
+     * Default 30 000 ms.
+     */
+    readonly workflowWebhookDeliveryRetryBaseDelayMs?: number;
+    /** Ceiling for a single retry delay. Default 3 600 000 ms (1 hour). */
+    readonly workflowWebhookDeliveryMaxRetryDelayMs?: number;
+    /**
+     * Request timeout when the endpoint does not set one. Default 10 000 ms.
+     * An endpoint's own `timeoutMs` is capped at
+     * {@link WORKFLOW_WEBHOOK_MAX_TIMEOUT_MS}.
+     */
+    readonly workflowWebhookDeliveryDefaultTimeoutMs?: number;
+}
+/** No single request may hold a delivery longer than this (ADR 18 §3.6). */
+export declare const WORKFLOW_WEBHOOK_MAX_TIMEOUT_MS = 30000;
+export interface BPMResolvedWorkflowWebhookDeliveryOptions {
+    readonly batchSize: number;
+    readonly defaultTimeoutMs: number;
+    readonly maxAttempts: number;
+    readonly maxRetryDelayMs: number;
+    readonly retryBaseDelayMs: number;
+    readonly scanIntervalMs: number;
+    /** `null` means "decide from the catalog at boot". */
+    readonly schedulerEnabled: boolean | null;
+}
+export interface BPMResolvedWorkflowWebhookOptions {
+    readonly allowedUrlPatterns: readonly ParsedWorkflowWebhookUrlPattern[];
+    readonly delivery: BPMResolvedWorkflowWebhookDeliveryOptions;
+    readonly enforceAllowlistForRegistry: boolean;
+    readonly secretEncryptionKey: string | null;
+    readonly targetSources: readonly BPMWorkflowWebhookEndpointSourceKind[];
+}
+export declare const BPM_WORKFLOW_WEBHOOK_OPTIONS: InjectionToken<BPMResolvedWorkflowWebhookOptions>;
+export declare const DEFAULT_BPM_WORKFLOW_WEBHOOK_OPTIONS: BPMResolvedWorkflowWebhookOptions;
+export declare function resolveBPMWorkflowWebhookOptions(options?: BPMRootWorkflowWebhookOptions): BPMResolvedWorkflowWebhookOptions;
+export declare function readDisabledWorkflowWebhookSourceReason(options: BPMRootWorkflowWebhookOptions, resolved: BPMResolvedWorkflowWebhookOptions): string | null;

package/src/lib/workflow-webhook/workflow-webhook-options.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_BPM_WORKFLOW_WEBHOOK_OPTIONS = exports.BPM_WORKFLOW_WEBHOOK_OPTIONS = exports.WORKFLOW_WEBHOOK_MAX_TIMEOUT_MS = void 0;
+exports.resolveBPMWorkflowWebhookOptions = resolveBPMWorkflowWebhookOptions;
+exports.readDisabledWorkflowWebhookSourceReason = readDisabledWorkflowWebhookSourceReason;
+const workflow_webhook_allowlist_1 = require("./workflow-webhook-allowlist");
+const workflow_webhook_secret_cipher_1 = require("./workflow-webhook-secret-cipher");
+/** No single request may hold a delivery longer than this (ADR 18 §3.6). */
+exports.WORKFLOW_WEBHOOK_MAX_TIMEOUT_MS = 30_000;
+exports.BPM_WORKFLOW_WEBHOOK_OPTIONS = Symbol('BPM_WORKFLOW_WEBHOOK_OPTIONS');
+exports.DEFAULT_BPM_WORKFLOW_WEBHOOK_OPTIONS = {
+    allowedUrlPatterns: [],
+    delivery: {
+        batchSize: 25,
+        defaultTimeoutMs: 10_000,
+        maxAttempts: 6,
+        maxRetryDelayMs: 3_600_000,
+        retryBaseDelayMs: 30_000,
+        scanIntervalMs: 15_000,
+        schedulerEnabled: null,
+    },
+    enforceAllowlistForRegistry: false,
+    secretEncryptionKey: null,
+    targetSources: ['REGISTRY'],
+};
+function resolveBPMWorkflowWebhookOptions(options = {}) {
+    const { errors, patterns } = (0, workflow_webhook_allowlist_1.parseWorkflowWebhookUrlPatterns)(options.workflowWebhookAllowedUrlPatterns ?? []);
+    if (errors.length) {
+        throw new Error(errors.join('; '));
+    }
+    const requestedSources = options.workflowWebhookTargetSources ??
+        exports.DEFAULT_BPM_WORKFLOW_WEBHOOK_OPTIONS.targetSources;
+    const secretEncryptionKey = options.workflowWebhookSecretEncryptionKey?.trim() || null;
+    // A key that is set but unusable fails the boot, like an invalid pattern:
+    // encrypting with it would lock the values away for good.
+    if (secretEncryptionKey) {
+        (0, workflow_webhook_secret_cipher_1.parseWorkflowWebhookSecretKey)(secretEncryptionKey);
+    }
+    const defaults = exports.DEFAULT_BPM_WORKFLOW_WEBHOOK_OPTIONS.delivery;
+    return {
+        allowedUrlPatterns: patterns,
+        delivery: {
+            batchSize: readPositiveInteger(options.workflowWebhookDeliveryBatchSize, defaults.batchSize),
+            defaultTimeoutMs: Math.min(readPositiveInteger(options.workflowWebhookDeliveryDefaultTimeoutMs, defaults.defaultTimeoutMs), exports.WORKFLOW_WEBHOOK_MAX_TIMEOUT_MS),
+            maxAttempts: readPositiveInteger(options.workflowWebhookDeliveryMaxAttempts, defaults.maxAttempts),
+            maxRetryDelayMs: readPositiveInteger(options.workflowWebhookDeliveryMaxRetryDelayMs, defaults.maxRetryDelayMs),
+            retryBaseDelayMs: readPositiveInteger(options.workflowWebhookDeliveryRetryBaseDelayMs, defaults.retryBaseDelayMs),
+            scanIntervalMs: readPositiveInteger(options.workflowWebhookDeliveryScanIntervalMs, defaults.scanIntervalMs),
+            schedulerEnabled: typeof options.workflowWebhookDeliverySchedulerEnabled === 'boolean'
+                ? options.workflowWebhookDeliverySchedulerEnabled
+                : null,
+        },
+        enforceAllowlistForRegistry: Boolean(options.workflowWebhookEnforceAllowlistForRegistry),
+        secretEncryptionKey,
+        targetSources: resolveTargetSources(requestedSources, patterns.length > 0, Boolean(secretEncryptionKey)),
+    };
+}
+/**
+ * The database source is refused rather than silently downgraded when its
+ * guards are missing, but refusing to boot would strand a host that turned it
+ * on before wiring Vault. It is dropped from the resolved list instead, and
+ * `readDisabledWorkflowWebhookSourceReason` explains why for the log.
+ */
+function resolveTargetSources(requested, hasAllowlist, hasEncryptionKey) {
+    const unique = [...new Set(requested)];
+    return unique.filter((source) => source !== 'DATABASE' || (hasAllowlist && hasEncryptionKey));
+}
+function readDisabledWorkflowWebhookSourceReason(options, resolved) {
+    const requestedDatabase = (options.workflowWebhookTargetSources ?? []).includes('DATABASE');
+    if (!requestedDatabase || resolved.targetSources.includes('DATABASE')) {
+        return null;
+    }
+    const missing = [
+        ...(resolved.allowedUrlPatterns.length
+            ? []
+            : ['workflowWebhookAllowedUrlPatterns']),
+        ...(resolved.secretEncryptionKey
+            ? []
+            : ['workflowWebhookSecretEncryptionKey']),
+    ];
+    return `DATABASE webhook endpoints are disabled: ${missing.join(' and ')} must be set`;
+}
+function readPositiveInteger(value, fallback) {
+    return typeof value === 'number' && Number.isInteger(value) && value > 0
+        ? value
+        : fallback;
+}
+//# sourceMappingURL=workflow-webhook-options.js.map

package/src/lib/workflow-webhook/workflow-webhook-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-webhook-options.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/workflow-webhook/workflow-webhook-options.ts"],"names":[],"mappings":";;;AAyHA,4EAsEC;AAoBD,0FAsBC;AAxOD,6EAGsC;AACtC,qFAAiF;AA0EjF,4EAA4E;AAC/D,QAAA,+BAA+B,GAAG,MAAM,CAAC;AAqBzC,QAAA,4BAA4B,GACvC,MAAM,CAAC,8BAA8B,CAAC,CAAC;AAE5B,QAAA,oCAAoC,GAC/C;IACE,kBAAkB,EAAE,EAAE;IACtB,QAAQ,EAAE;QACR,SAAS,EAAE,EAAE;QACb,gBAAgB,EAAE,MAAM;QACxB,WAAW,EAAE,CAAC;QACd,eAAe,EAAE,SAAS;QAC1B,gBAAgB,EAAE,MAAM;QACxB,cAAc,EAAE,MAAM;QACtB,gBAAgB,EAAE,IAAI;KACvB;IACD,2BAA2B,EAAE,KAAK;IAClC,mBAAmB,EAAE,IAAI;IACzB,aAAa,EAAE,CAAC,UAAU,CAAC;CAC5B,CAAC;AAEJ,SAAgB,gCAAgC,CAC9C,UAAyC,EAAE;IAE3C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAA,4DAA+B,EAC1D,OAAO,CAAC,iCAAiC,IAAI,EAAE,CAChD,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,gBAAgB,GACpB,OAAO,CAAC,4BAA4B;QACpC,4CAAoC,CAAC,aAAa,CAAC;IACrD,MAAM,mBAAmB,GACvB,OAAO,CAAC,kCAAkC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAE7D,0EAA0E;IAC1E,0DAA0D;IAC1D,IAAI,mBAAmB,EAAE,CAAC;QACxB,IAAA,8DAA6B,EAAC,mBAAmB,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,QAAQ,GAAG,4CAAoC,CAAC,QAAQ,CAAC;IAE/D,OAAO;QACL,kBAAkB,EAAE,QAAQ;QAC5B,QAAQ,EAAE;YACR,SAAS,EAAE,mBAAmB,CAC5B,OAAO,CAAC,gCAAgC,EACxC,QAAQ,CAAC,SAAS,CACnB;YACD,gBAAgB,EAAE,IAAI,CAAC,GAAG,CACxB,mBAAmB,CACjB,OAAO,CAAC,uCAAuC,EAC/C,QAAQ,CAAC,gBAAgB,CAC1B,EACD,uCAA+B,CAChC;YACD,WAAW,EAAE,mBAAmB,CAC9B,OAAO,CAAC,kCAAkC,EAC1C,QAAQ,CAAC,WAAW,CACrB;YACD,eAAe,EAAE,mBAAmB,CAClC,OAAO,CAAC,sCAAsC,EAC9C,QAAQ,CAAC,eAAe,CACzB;YACD,gBAAgB,EAAE,mBAAmB,CACnC,OAAO,CAAC,uCAAuC,EAC/C,QAAQ,CAAC,gBAAgB,CAC1B;YACD,cAAc,EAAE,mBAAmB,CACjC,OAAO,CAAC,qCAAqC,EAC7C,QAAQ,CAAC,cAAc,CACxB;YACD,gBAAgB,EACd,OAAO,OAAO,CAAC,uCAAuC,KAAK,SAAS;gBAClE,CAAC,CAAC,OAAO,CAAC,uCAAuC;gBACjD,CAAC,CAAC,IAAI;SACX;QACD,2BAA2B,EAAE,OAAO,CAClC,OAAO,CAAC,0CAA0C,CACnD;QACD,mBAAmB;QACnB,aAAa,EAAE,oBAAoB,CACjC,gBAAgB,EAChB,QAAQ,CAAC,MAAM,GAAG,CAAC,EACnB,OAAO,CAAC,mBAAmB,CAAC,CAC7B;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,SAA0D,EAC1D,YAAqB,EACrB,gBAAyB;IAEzB,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAEvC,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,YAAY,IAAI,gBAAgB,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,SAAgB,uCAAuC,CACrD,OAAsC,EACtC,QAA2C;IAE3C,MAAM,iBAAiB,GAAG,CACxB,OAAO,CAAC,4BAA4B,IAAI,EAAE,CAC3C,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAEvB,IAAI,CAAC,iBAAiB,IAAI,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,MAAM;YACpC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC;QAC1C,GAAG,CAAC,QAAQ,CAAC,mBAAmB;YAC9B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC;KAC5C,CAAC;IAEF,OAAO,4CAA4C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;AACzF,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAyB,EACzB,QAAgB;IAEhB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QACtE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC"}

package/src/lib/workflow-webhook/workflow-webhook-options.module.d.ts

@@ -0,0 +1,18 @@
+import { DynamicModule, InjectionToken } from '@nestjs/common';
+import { ModuleMetadata } from '@nestjs/common/interfaces';
+import { BPMResolvedWorkflowWebhookOptions, BPMRootWorkflowWebhookOptions } from './workflow-webhook-options';
+/**
+ * Resolves the options and says why a requested `DATABASE` source was
+ * dropped. The reason needs the raw input as well as the resolved result, so
+ * this is the one place both exist; without it the source would vanish
+ * silently and publish would only report that no source is configured.
+ */
+export declare function resolveAndReportWorkflowWebhookOptions(options: BPMRootWorkflowWebhookOptions): BPMResolvedWorkflowWebhookOptions;
+export interface WorkflowWebhookOptionsModuleAsyncOptions extends Pick<ModuleMetadata, 'imports'> {
+    readonly inject?: readonly InjectionToken[];
+    readonly useFactory: (...args: readonly unknown[]) => BPMRootWorkflowWebhookOptions | Promise<BPMRootWorkflowWebhookOptions>;
+}
+export declare class WorkflowWebhookOptionsModule {
+    static forRoot(options?: BPMRootWorkflowWebhookOptions): DynamicModule;
+    static forRootAsync(options: WorkflowWebhookOptionsModuleAsyncOptions): DynamicModule;
+}

package/src/lib/workflow-webhook/workflow-webhook-options.module.js

@@ -0,0 +1,57 @@
+"use strict";
+var WorkflowWebhookOptionsModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkflowWebhookOptionsModule = void 0;
+exports.resolveAndReportWorkflowWebhookOptions = resolveAndReportWorkflowWebhookOptions;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const workflow_webhook_options_1 = require("./workflow-webhook-options");
+const logger = new common_1.Logger('WorkflowWebhookOptions');
+/**
+ * Resolves the options and says why a requested `DATABASE` source was
+ * dropped. The reason needs the raw input as well as the resolved result, so
+ * this is the one place both exist; without it the source would vanish
+ * silently and publish would only report that no source is configured.
+ */
+function resolveAndReportWorkflowWebhookOptions(options) {
+    const resolved = (0, workflow_webhook_options_1.resolveBPMWorkflowWebhookOptions)(options);
+    const reason = (0, workflow_webhook_options_1.readDisabledWorkflowWebhookSourceReason)(options, resolved);
+    if (reason) {
+        logger.warn(reason);
+    }
+    return resolved;
+}
+let WorkflowWebhookOptionsModule = WorkflowWebhookOptionsModule_1 = class WorkflowWebhookOptionsModule {
+    static forRoot(options = {}) {
+        return {
+            exports: [workflow_webhook_options_1.BPM_WORKFLOW_WEBHOOK_OPTIONS],
+            module: WorkflowWebhookOptionsModule_1,
+            providers: [
+                {
+                    provide: workflow_webhook_options_1.BPM_WORKFLOW_WEBHOOK_OPTIONS,
+                    useValue: resolveAndReportWorkflowWebhookOptions(options),
+                },
+            ],
+        };
+    }
+    static forRootAsync(options) {
+        return {
+            exports: [workflow_webhook_options_1.BPM_WORKFLOW_WEBHOOK_OPTIONS],
+            imports: options.imports,
+            module: WorkflowWebhookOptionsModule_1,
+            providers: [
+                {
+                    inject: [...(options.inject ?? [])],
+                    provide: workflow_webhook_options_1.BPM_WORKFLOW_WEBHOOK_OPTIONS,
+                    useFactory: async (...args) => resolveAndReportWorkflowWebhookOptions(await options.useFactory(...args)),
+                },
+            ],
+        };
+    }
+};
+exports.WorkflowWebhookOptionsModule = WorkflowWebhookOptionsModule;
+exports.WorkflowWebhookOptionsModule = WorkflowWebhookOptionsModule = WorkflowWebhookOptionsModule_1 = tslib_1.__decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({})
+], WorkflowWebhookOptionsModule);
+//# sourceMappingURL=workflow-webhook-options.module.js.map

package/src/lib/workflow-webhook/workflow-webhook-options.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-webhook-options.module.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/workflow-webhook/workflow-webhook-options.module.ts"],"names":[],"mappings":";;;;AAwBA,wFAWC;;AAnCD,2CAMwB;AAExB,yEAMoC;AAEpC,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,wBAAwB,CAAC,CAAC;AAEpD;;;;;GAKG;AACH,SAAgB,sCAAsC,CACpD,OAAsC;IAEtC,MAAM,QAAQ,GAAG,IAAA,2DAAgC,EAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAA,kEAAuC,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE1E,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAcM,IAAM,4BAA4B,oCAAlC,MAAM,4BAA4B;IACvC,MAAM,CAAC,OAAO,CAAC,UAAyC,EAAE;QACxD,OAAO;YACL,OAAO,EAAE,CAAC,uDAA4B,CAAC;YACvC,MAAM,EAAE,8BAA4B;YACpC,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,uDAA4B;oBACrC,QAAQ,EAAE,sCAAsC,CAAC,OAAO,CAAC;iBAC1D;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CACjB,OAAiD;QAEjD,OAAO;YACL,OAAO,EAAE,CAAC,uDAA4B,CAAC;YACvC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,8BAA4B;YACpC,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;oBACnC,OAAO,EAAE,uDAA4B;oBACrC,UAAU,EAAE,KAAK,EACf,GAAG,IAAwB,EACiB,EAAE,CAC9C,sCAAsC,CACpC,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAClC;iBACJ;aACF;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAnCY,oEAA4B;uCAA5B,4BAA4B;IAFxC,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,4BAA4B,CAmCxC"}

package/src/lib/workflow-webhook/workflow-webhook-secret-cipher.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Reads `workflowWebhookSecretEncryptionKey`: 32 bytes as 64 hex characters or
+ * base64. Anything else throws at boot, because a key that silently decodes
+ * to the wrong length would encrypt everything with a key nobody can
+ * reproduce. The message never echoes the key.
+ */
+export declare function parseWorkflowWebhookSecretKey(value: string): Buffer;
+/**
+ * AES-256-GCM for the header values and signing secrets of database-managed
+ * webhook endpoints (ADR 18 §3.13). The envelope is
+ * `v1:<base64(iv | tag | ciphertext)>`, so a future key or algorithm change
+ * can tell old values apart. Decryption fails loudly on a wrong key or a
+ * tampered value instead of returning garbage.
+ */
+export declare class WorkflowWebhookSecretCipher {
+    private readonly key;
+    constructor(key: string);
+    encrypt(plaintext: string): string;
+    decrypt(envelope: string): string;
+}