@rytass/bpm-core-nestjs-module 0.6.0 → 0.9.0

package/CHANGELOG.md

@@ -1,3 +1,66 @@
+## 0.9.0 (2026-08-17)
+
+### 🚀 Features
+
+- **notification:** lift routing fields onto the created event ([e02270b](https://github.com/Rytass/BPMCore/commit/e02270b))
+- **notification:** let a host observe notifications as they are created ([#21](https://github.com/Rytass/BPMCore/pull/21))
+- **shared:** detect a quorum no approver set can ever satisfy ([5671497](https://github.com/Rytass/BPMCore/commit/5671497))
+- **shared:** expose the decision policy to the workflow toolset ([f6152b0](https://github.com/Rytass/BPMCore/commit/f6152b0))
+
+### 🩹 Fixes
+
+- ⚠️  **template:** reject deleting a referenced category ([#16](https://github.com/Rytass/BPMCore/pull/16))
+- **template:** let a template actually change category ([#17](https://github.com/Rytass/BPMCore/pull/17))
+- **shared:** keep an approver change from discarding a workable policy ([ea6afbe](https://github.com/Rytass/BPMCore/commit/ea6afbe))
+- **template:** block publishing a deadlocked quorum node ([89ab6a2](https://github.com/Rytass/BPMCore/commit/89ab6a2))
+- **e2e:** poll on the expected value in the quorum threshold sanitiser spec ([099529f](https://github.com/Rytass/BPMCore/commit/099529f))
+- **bpm-core-react:** correct decision-policy panel review findings ([ebf0337](https://github.com/Rytass/BPMCore/commit/ebf0337))
+
+### ⚠️  Breaking Changes
+
+- **template:** reject deleting a referenced category  ([#16](https://github.com/Rytass/BPMCore/pull/16))
+  `deleteApprovalTemplateCategory` now throws
+  `BadRequestException` when templates still reference the category, instead
+  of deactivating it and reporting success.
+  The old behaviour substituted a different operation for the one requested
+  and returned the same entity type either way, so a caller could not tell
+  that the delete had not happened — nor that `isActive` had been flipped as
+  a side effect it never asked for. Downstream, the category vanished from
+  groupings because it was now inactive, with nothing to explain why.
+  Deactivation is not lost: `deactivateApprovalTemplateCategory(id)` has
+  always existed and is unchanged, so the fallback was never the only way to
+  reach that state.
+  The designer's category screen already wraps the call in try/catch and
+  surfaces the message, and it only closes the confirmation dialog on
+  success, so the new error reaches the author without a UI change.
+  Reported by a consumer on 0.7.0, who had to re-implement the reference
+  check ahead of the call to avoid telling users something had been deleted
+  when it had not.
+  Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
+
+### ❤️ Thank You
+
+- Chia Yu Pai @fantasywind
+- Claude Opus 5
+- Kai-Chieh Yang
+
+## 0.7.0 (2026-08-10)
+
+### 🚀 Features
+
+- **bpm-core:** lint the new SLA and return-behaviour node fields ([f10c0bb](https://github.com/Rytass/BPMCore/commit/f10c0bb))
+- **bpm-core:** enforce required return comments ([6cb288f](https://github.com/Rytass/BPMCore/commit/6cb288f))
+- **bpm-core:** resolve task SLA due dates through a host business calendar ([3cb9d4d](https://github.com/Rytass/BPMCore/commit/3cb9d4d))
+
+### 🩹 Fixes
+
+- **bpm-core:** stop SLA escalation from walking the whole management chain ([f7e4669](https://github.com/Rytass/BPMCore/commit/f7e4669))
+
+### ❤️ Thank You
+
+- Chia Yu Pai @fantasywind
+- Claude Opus 5 (1M context)
+
 # Changelog
 
 All notable changes to `@rytass/bpm-core-nestjs-module` are documented in this
@@ -6,6 +69,27 @@ file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## Unreleased
+
+### Added
+
+- Form schema parsing now supports additive versioned option-source references
+  and structural lint for bindings, dependency cycles, and dynamic defaults.
+- Added `FORM_DATA_SOURCE_VALUE_NOT_RESOLVED` so a submitted value that is no
+  longer selectable is reported separately from a provider contract breach.
+- Added the host-provided versioned DataSource registry contract, guarded
+  GraphQL catalog/preview/runtime queries, provider limits, and stable error
+  codes for dynamic form options.
+- Added server-side dynamic option resolution for submit/resubmit, persisted
+  option-label snapshots, optimistic revision protection around resubmit, and
+  the reversible `form_data_option_snapshot` migration.
+- Resubmit mutations now return the refreshed persisted instance after dynamic
+  option resolution and workflow processing, keeping GraphQL JSON accessors in
+  sync with the committed form data and option snapshot.
+- GraphQL DataSource input DTOs now carry explicit validation metadata so hosts
+  using `ValidationPipe({ forbidUnknownValues: true })` can call preview/runtime
+  option queries without bypassing input validation.
+
 Releases are managed by [`nx release`](https://nx.dev/recipes/nx-release) with
 Conventional Commits — see `nx.json` for the release config.
 
@@ -24,6 +108,55 @@ Conventional Commits — see `nx.json` for the release config.
 
 ### Fixed
 
+- **Rolling back to an archived version now honours the registry gate.**
+  `rollbackFormDefinitionVersion` republished an archived form without checking
+  the host registry, so a version referencing a source the host had dropped
+  could become current again.
+- **An illegal empty value no longer counts as "cleared".** `''` clears a
+  single-select and `[]` clears a multiple one; the mismatched shapes are
+  rejected instead of persisting a value the primitive contract forbids.
+- **A corrupt instance form snapshot returns a controlled error.** Snapshot
+  readers dereferenced field entries, so `fields: [null]` raised a `TypeError`
+  out of submit/resubmit; such a snapshot is now rejected as invalid.
+- **A `SET_FORM_FIELD` service task no longer leaves a wrong option label.**
+  Writing into a DataSource-backed field kept the previous option snapshot, so
+  instance history rendered the old label next to the new value. The snapshot
+  for that field is now dropped (the raw value is shown instead) and the
+  activity log records which field was cleared. The service task runs inside the
+  write transaction, so re-resolving through the host provider there would
+  breach the ADR's transaction boundary.
+- **Clearing a dynamic option now removes its snapshot on resubmit.** A host
+  without a registry kept the old label for a field the user had emptied. An
+  empty array only clears a `multiple` field; on a single-select it stays an
+  illegal value instead of silently dropping the snapshot.
+- **A binding-only preview failure now reports `FORM_DATA_SOURCE_INVALID_BINDING`.**
+  Binding lint lines stay prose because they quote a host-chosen parameter name,
+  so they carried no code and the preview fell back to `INVALID_DESCRIPTOR` —
+  telling the designer to contact an administrator about a binding they could
+  fix themselves. The code is now derived from the line shape.
+- **The preview error code now follows the first lint error.** It was picked by
+  scanning the error-code list for a substring match, so the reported code
+  depended on enum declaration order and would misfire once one code became a
+  substring of another. It is now read only from the code-bearing lint shape
+  `<path>.dataSource <CODE>`, so prose such as an unbound parameter whose name
+  looks like a code is no longer reported as that code.
+- **Publish lint no longer mislabels an unregistered DataSource key.** A key the
+  host never registered reported `FORM_DATA_SOURCE_VERSION_MISSING`, telling
+  designers to pick another version of a source that no longer exists. It now
+  reports `FORM_DATA_SOURCE_MISSING`, matching the runtime query path, and an
+  unsupported bounded control is reported once instead of twice.
+- **A host without a DataSource registry can no longer publish or submit
+  dynamic option fields — but drafts stay editable.** The registry check runs
+  only where a published version is produced, so a draft that references an
+  unavailable source is still saved verbatim, as the ADR requires. Both the publish lint and the submit/resubmit
+  resolution degraded to no-ops when no registry was provided, so a
+  DataSource-backed value could reach the database with nothing able to
+  validate it. Both paths now fail with `FORM_DATA_SOURCE_MISSING`; static
+  forms are unaffected.
+- **`initiatorMemberId` is no longer a required GraphQL input.** Submit and
+  resubmit inputs demanded a value the resolver always replaced with the
+  authenticated member id. The field is now optional and deprecated; the engine
+  still requires the server-derived id.
 - **Manager resolution priority now respected.**
   `resolveManagerResolutionCandidates` previously returned every active
   resolution regardless of priority. Now it keeps only the top-priority

package/README.md

@@ -12,6 +12,13 @@ application owns runtime infrastructure such as GraphQL setup, TypeORM
 connection setup, auth/session handling, Vault or secret loading, member
 directory integration, storage adapters, and deployment.
 
+Form Definition parsing accepts the additive static/DataSource option-source
+shape and performs structural publish lint for source XOR, selection mode,
+direct bindings, duplicate parameters, field references, dependency cycles,
+and dynamic default-value prohibition. Hosts can register versioned DataSources
+through `BPMRootModule`; the runtime validates bindings, bounds provider calls,
+and keeps transport details and credentials out of form JSON.
+
 ## Package Status
 
 Current version: `0.1.10`
@@ -121,7 +128,7 @@ import { HostSessionService } from './host-session.service';
         sortSchema: true,
       }),
     }),
-    BPMRootModule.forRoot({
+  BPMRootModule.forRoot({
       imports: [HostAuthModule],
       authContextFactory: buildBPMAuthContextFromExecutionContext,
       memberResolverProvider: {
@@ -375,6 +382,54 @@ configureBPMClient({
 });
 ```
 
+### Dynamic form option DataSources
+
+The host owns the actual ERP, database, or integration-bus implementation. It
+registers one versioned catalog provider; a form stores only the source key,
+version, and field/constant bindings:
+
+```ts
+import {
+  BPM_FORM_DATA_SOURCE_REGISTRY,
+  BPM_MEMBER_RESOLVER,
+  BPMRootModule,
+} from '@rytass/bpm-core-nestjs-module';
+import { HostFormDataSourceRegistry } from './host-form-data-source.registry';
+
+BPMRootModule.forRoot({
+  formDataSourceRegistryProvider: {
+    provide: BPM_FORM_DATA_SOURCE_REGISTRY,
+    useClass: HostFormDataSourceRegistry,
+  },
+  memberResolverProvider: {
+    provide: BPM_MEMBER_RESOLVER,
+    useClass: HostBPMMemberResolver,
+  },
+});
+```
+
+`formDataSources` and `previewFormFieldOptions` are designer-only GraphQL
+queries. `formFieldOptions` is an authenticated runtime query whose source
+reference comes from the server's published form version or returned-instance
+snapshot. Missing registry versions, unsupported controls, incomplete
+bindings, provider failures, and over-limit results return stable DataSource
+error codes.
+
+On submit, the engine resolves every selected DataSource-backed value on the
+server and stores the returned labels, source version, binding hash, and
+validation timestamp in `approval_instances.form_data_option_snapshot`. A
+resubmit resolves outside the database transaction, then rechecks the
+instance revision under the transaction lock before writing form data and its
+snapshot atomically. This keeps historical labels readable even when a host
+later removes a registry version, while changed bindings or an `ALWAYS`
+revalidation policy still require a live provider call.
+
+The repository wrapper host demonstrates the contract with
+`ApiFormDataSourceRegistry` and the seeded `demo.cost-centers@1` family. Its
+database table and reset ownership remain in `apps/api`; an external host should
+replace that provider through `BPMRootModule.forRoot()` and keep its own source
+data and authorization rules outside the BPM package.
+
 This requires the wrapper host's auth middleware to honor `Authorization`
 headers (member-base hosts can be configured to do so via
 `authStrategy: 'jwt'` in addition to `cookieMode: true`).
@@ -811,6 +866,8 @@ BPMRootModule.forRootAsync({
 | `memberResolverProvider`                         | required                       | Provider for `BPM_MEMBER_RESOLVER`.                            |
 | `attachmentStorageProvider`                      | local `.storage/attachments`   | Host-provided `@rytass/storages` adapter.                      |
 | `workflowServiceTaskDispatcherProvider`          | built-in `fetch` dispatcher    | Host provider for executable workflow `WEBHOOK` service tasks. |
+| `businessCalendarProvider`                       | Monday–Friday calendar         | Host provider for `BPM_BUSINESS_CALENDAR`, used by `BUSINESS_DAY` SLAs. BPMCore ships no holiday data. |
+| `formDataSourceRegistryProvider`                 | Empty catalog                  | Single host provider for versioned Select / AutoComplete / Radio / Checkbox DataSources. |
 | `attachmentRoutePrefix`                          | `/attachments`                 | Drives both the BPM signed URL path and the Nest controller mount path for `AttachmentController`. Must be set at module wiring time (see "Attachment Storage" below). |
 | `attachmentStorageProviderId`                    | `local`                        | Value stored on attachment metadata for the active adapter.    |
 | `attachmentPublicBaseUrl`                        | `http://localhost:17603`       | Public base URL for signed attachment URLs.                    |
@@ -835,6 +892,7 @@ BPMRootModule.forRootAsync({
 | `notificationDeliveryRetryBaseDelayMs`           | `60000`                        | Base retry delay multiplied by attempt count.                  |
 | `notificationSlaSchedulerEnabled`                | `false`                        | Runs automatic SLA scan loop in this process.                  |
 | `notificationSlaScanIntervalMs`                  | `60000`                        | SLA scheduler interval.                                        |
+| `notificationSlaBusinessCalendarTimeZone`        | `UTC`                          | IANA zone for the built-in weekday calendar. Ignored when `businessCalendarProvider` is set. |
 | `notificationSlaTimeoutRemindEnabled`            | `true`                         | Enables SLA timeout `REMIND`.                                  |
 | `notificationSlaTimeoutAutoApproveEnabled`       | `false`                        | Enables SLA timeout `AUTO_APPROVE`.                            |
 | `notificationSlaTimeoutEscalateEnabled`          | `false`                        | Enables SLA timeout `ESCALATE`.                                |
@@ -1279,6 +1337,7 @@ Importing `BPMRootModule` registers GraphQL resolvers for:
 - Organization units, positions, memberships, manager resolution, and summary.
 - Member profile lookup and member metadata cache inspection.
 - Form definitions and form definition versions.
+- Form option DataSource catalog, designer preview, and authenticated runtime option queries.
 - Approval templates, template versions, categories, validation, and dry run.
 - Workflow instances, tokens, tasks, task candidates, decisions, activity logs,
   submit/process/approve/return/cancel/resubmit operations.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rytass/bpm-core-nestjs-module",
-  "version": "0.6.0",
+  "version": "0.9.0",
   "description": "Embeddable NestJS BPM approval workflow module: workflow engine, approval templates, forms, organization/member contracts, attachments, signatures, notifications, delegation, and TypeORM migrations.",
   "keywords": [
     "bpm",
@@ -42,6 +42,9 @@
       "bpm-auth": [
         "./src/lib/bpm-auth/index.d.ts"
       ],
+      "calendar": [
+        "./src/lib/calendar/index.d.ts"
+      ],
       "condition": [
         "./src/lib/condition/index.d.ts"
       ],
@@ -54,6 +57,9 @@
       "form": [
         "./src/lib/form/index.d.ts"
       ],
+      "form-data-source": [
+        "./src/lib/form-data-source/index.d.ts"
+      ],
       "identity": [
         "./src/lib/identity/index.d.ts"
       ],
@@ -91,6 +97,10 @@
       "types": "./src/lib/bpm-auth/index.d.ts",
       "default": "./src/lib/bpm-auth/index.js"
     },
+    "./calendar": {
+      "types": "./src/lib/calendar/index.d.ts",
+      "default": "./src/lib/calendar/index.js"
+    },
     "./database": {
       "types": "./src/lib/database/index.d.ts",
       "default": "./src/lib/database/index.js"
@@ -107,6 +117,10 @@
       "types": "./src/lib/form/index.d.ts",
       "default": "./src/lib/form/index.js"
     },
+    "./form-data-source": {
+      "types": "./src/lib/form-data-source/index.d.ts",
+      "default": "./src/lib/form-data-source/index.js"
+    },
     "./identity": {
       "types": "./src/lib/identity/index.d.ts",
       "default": "./src/lib/identity/index.js"
@@ -141,8 +155,8 @@
     "@nestjs/core": "^11.0.0",
     "@nestjs/graphql": "^13.4.0",
     "@nestjs/typeorm": "^11.0.1",
-    "@rytass/bpm-core-shared": "^0.6.0",
-    "@rytass/secret-adapter-vault-nestjs": "^0.4.5 || ^0.5.0",
+    "@rytass/bpm-core-shared": "^0.9.0",
+    "@rytass/secret-adapter-vault-nestjs": "^0.4.5 || ^0.5.0 || ^0.6.0",
     "express": "^4.0.0 || ^5.0.0",
     "graphql": "^16.0.0",
     "reflect-metadata": "^0.1.13 || ^0.2.0",

package/src/index.d.ts

@@ -1,11 +1,13 @@
 export * from './lib/attachment';
 export * from './lib/bpm';
 export * from './lib/bpm-auth';
+export * from './lib/calendar';
 export * from './lib/common';
 export * from './lib/condition';
 export * from './lib/database';
 export * from './lib/delegation';
 export * from './lib/form';
+export * from './lib/form-data-source';
 export * from './lib/identity';
 export * from './lib/notification';
 export * from './lib/organization';

package/src/index.js

@@ -4,11 +4,13 @@ const tslib_1 = require("tslib");
 tslib_1.__exportStar(require("./lib/attachment"), exports);
 tslib_1.__exportStar(require("./lib/bpm"), exports);
 tslib_1.__exportStar(require("./lib/bpm-auth"), exports);
+tslib_1.__exportStar(require("./lib/calendar"), exports);
 tslib_1.__exportStar(require("./lib/common"), exports);
 tslib_1.__exportStar(require("./lib/condition"), exports);
 tslib_1.__exportStar(require("./lib/database"), exports);
 tslib_1.__exportStar(require("./lib/delegation"), exports);
 tslib_1.__exportStar(require("./lib/form"), exports);
+tslib_1.__exportStar(require("./lib/form-data-source"), exports);
 tslib_1.__exportStar(require("./lib/identity"), exports);
 tslib_1.__exportStar(require("./lib/notification"), exports);
 tslib_1.__exportStar(require("./lib/organization"), exports);

package/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../libs/bpm-core/src/index.ts"],"names":[],"mappings":";;;AAAA,2DAAiC;AACjC,oDAA0B;AAC1B,yDAA+B;AAC/B,uDAA6B;AAC7B,0DAAgC;AAChC,yDAA+B;AAC/B,2DAAiC;AACjC,qDAA2B;AAC3B,yDAA+B;AAC/B,6DAAmC;AACnC,6DAAmC;AACnC,0DAAgC;AAChC,yDAA+B;AAC/B,gEAAsC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../libs/bpm-core/src/index.ts"],"names":[],"mappings":";;;AAAA,2DAAiC;AACjC,oDAA0B;AAC1B,yDAA+B;AAC/B,yDAA+B;AAC/B,uDAA6B;AAC7B,0DAAgC;AAChC,yDAA+B;AAC/B,2DAAiC;AACjC,qDAA2B;AAC3B,iEAAuC;AACvC,yDAA+B;AAC/B,6DAAmC;AACnC,6DAAmC;AACnC,0DAAgC;AAChC,yDAA+B;AAC/B,gEAAsC"}

package/src/lib/bpm/bpm-root.module.d.ts

@@ -3,6 +3,8 @@ import { ModuleMetadata } from '@nestjs/common/interfaces';
 import { BPMRootAttachmentOptions } from '../attachment/attachment-options';
 import { AttachmentStorage } from '../attachment/attachment-storage.token';
 import { BPMAuthModuleOptions } from '../bpm-auth/bpm-auth.options';
+import { BPMBusinessCalendar } from '../calendar/business-calendar.token';
+import { BPMFormDataSourceRegistry } from '../form-data-source';
 import { BPMRootIdentityOptions } from '../identity/identity-options';
 import { BPMMemberResolver } from '../identity/member-resolver.interface';
 import { BPMRootNotificationOptions } from '../notification/notification-options';
@@ -27,6 +29,24 @@ export interface BPMRootModuleOptions extends Pick<ModuleMetadata, 'imports'>, B
      * operations that require authentication will not receive a host session.
      */
     readonly authContextFactory?: BPMAuthModuleOptions['contextFactory'];
+    /**
+     * Host-provided business calendar used by workflow nodes whose SLA opts into
+     * `BUSINESS_DAY`.
+     *
+     * BPMCore ships no national holiday data. When omitted, BPM falls back to a
+     * Monday–Friday calendar (see `notificationSlaBusinessCalendarTimeZone`);
+     * hosts that need national holidays or make-up working days register their
+     * own `BPM_BUSINESS_CALENDAR` provider here.
+     */
+    readonly businessCalendarProvider?: Provider<BPMBusinessCalendar>;
+    /**
+     * Host-provided registry containing versioned form option DataSources.
+     *
+     * The registry is a single provider so a published form reference always
+     * resolves against one coherent catalog. When omitted, BPM exposes an
+     * empty catalog and keeps existing hosts bootstrap-compatible.
+     */
+    readonly formDataSourceRegistryProvider?: Provider<BPMFormDataSourceRegistry>;
     /**
      * Host-provided member resolver provider.
      *
@@ -72,6 +92,19 @@ export interface BPMRootModuleAsyncOptions extends Pick<ModuleMetadata, 'imports
      * use a Nest provider with `useFactory` / `inject` here.
      */
     readonly attachmentStorageProvider?: Provider<AttachmentStorage>;
+    /**
+     * Host-provided business calendar for `BUSINESS_DAY` SLAs.
+     *
+     * This provider is static at module wiring time. If secrets or a repository
+     * are required, use a Nest provider with `useFactory` / `inject` here.
+     */
+    readonly businessCalendarProvider?: Provider<BPMBusinessCalendar>;
+    /**
+     * Host-provided versioned form option DataSource registry. This provider is
+     * static at module wiring time; secrets and repositories can be injected
+     * through its Nest `useFactory`, `useClass`, or `useExisting` definition.
+     */
+    readonly formDataSourceRegistryProvider?: Provider<BPMFormDataSourceRegistry>;
     /**
      * Providers injected into `useFactory`.
      *

package/src/lib/bpm/bpm-root.module.js

@@ -6,8 +6,10 @@ const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
 const attachment_module_1 = require("../attachment/attachment.module");
 const bpm_auth_module_1 = require("../bpm-auth/bpm-auth.module");
+const calendar_module_1 = require("../calendar/calendar.module");
 const delegation_module_1 = require("../delegation/delegation.module");
 const form_module_1 = require("../form/form.module");
+const form_data_source_1 = require("../form-data-source");
 const identity_module_1 = require("../identity/identity.module");
 const notification_module_1 = require("../notification/notification.module");
 const notification_options_module_1 = require("../notification/notification-options.module");
@@ -82,11 +84,13 @@ let BPMRootModule = BPMRootModule_1 = class BPMRootModule {
         return {
             exports: [
                 notification_options_module_1.NotificationOptionsModule,
+                calendar_module_1.CalendarModule,
                 bpm_auth_module_1.BPMAuthModule,
                 identity_module_1.IdentityModule,
                 organization_module_1.OrganizationModule,
                 attachment_module_1.AttachmentModule,
                 form_module_1.FormModule,
+                form_data_source_1.FormDataSourceModule,
                 template_module_1.TemplateModule,
                 delegation_module_1.DelegationModule,
                 notification_module_1.NotificationModule,
@@ -99,6 +103,10 @@ let BPMRootModule = BPMRootModule_1 = class BPMRootModule {
                     inject: options.inject,
                     useFactory: options.useFactory,
                 }),
+                calendar_module_1.CalendarModule.forRoot({
+                    businessCalendarProvider: options.businessCalendarProvider,
+                    imports: options.imports,
+                }),
                 bpm_auth_module_1.BPMAuthModule.forRootAsync(authOptions),
                 identity_module_1.IdentityModule.forRootAsync({
                     imports: options.imports,
@@ -115,6 +123,10 @@ let BPMRootModule = BPMRootModule_1 = class BPMRootModule {
                     useFactory: options.useFactory,
                 }),
                 form_module_1.FormModule,
+                form_data_source_1.FormDataSourceModule.forRoot({
+                    imports: options.imports,
+                    registryProvider: options.formDataSourceRegistryProvider,
+                }),
                 template_module_1.TemplateModule,
                 delegation_module_1.DelegationModule,
                 notification_module_1.NotificationModule,
@@ -139,6 +151,10 @@ exports.BPMRootModule = BPMRootModule = BPMRootModule_1 = tslib_1.__decorate([
 function createBPMFeatureModules(options) {
     return [
         notification_options_module_1.NotificationOptionsModule.forRoot(options),
+        calendar_module_1.CalendarModule.forRoot({
+            businessCalendarProvider: options.businessCalendarProvider,
+            imports: options.imports,
+        }),
         bpm_auth_module_1.BPMAuthModule.forRoot(createBPMAuthModuleOptions(options)),
         identity_module_1.IdentityModule.forRoot({
             ...options,
@@ -152,6 +168,10 @@ function createBPMFeatureModules(options) {
             storageProvider: options.attachmentStorageProvider,
         }),
         form_module_1.FormModule,
+        form_data_source_1.FormDataSourceModule.forRoot({
+            imports: options.imports,
+            registryProvider: options.formDataSourceRegistryProvider,
+        }),
         template_module_1.TemplateModule,
         delegation_module_1.DelegationModule,
         notification_module_1.NotificationModule,

package/src/lib/bpm/bpm-root.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"bpm-root.module.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/bpm/bpm-root.module.ts"],"names":[],"mappings":";;;;;AAAA,2CAMwB;AAGxB,uEAAmE;AAEnE,iEAA4D;AAK5D,uEAAmE;AACnE,qDAAiD;AAEjD,iEAA6D;AAE7D,6EAAyE;AACzE,6FAAwF;AAExF,6EAAyE;AAEzE,oEAAgE;AAChE,iEAA6D;AAC7D,sFAAiF;AAiIjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEI,IAAM,aAAa,qBAAnB,MAAM,aAAa;IACxB;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,OAA6B;QAC1C,MAAM,cAAc,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAExD,OAAO;YACL,OAAO,EAAE,CAAC,GAAG,cAAc,CAAC;YAC5B,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,cAAc,CAAC;YACxD,MAAM,EAAE,eAAa;SACtB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,YAAY,CAAC,OAAkC;QACpD,MAAM,WAAW,GAA8B;YAC7C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,KAAK,EACf,GAAG,IAAwB,EACI,EAAE;gBACjC,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;gBAEtD,OAAO,0BAA0B,CAAC,WAAW,CAAC,CAAC;YACjD,CAAC;SACF,CAAC;QAEF,OAAO;YACL,OAAO,EAAE;gBACP,uDAAyB;gBACzB,+BAAa;gBACb,gCAAc;gBACd,wCAAkB;gBAClB,oCAAgB;gBAChB,wBAAU;gBACV,gCAAc;gBACd,oCAAgB;gBAChB,wCAAkB;gBAClB,kCAAe;gBACf,6CAAoB;aACrB;YACD,OAAO,EAAE;gBACP,uDAAyB,CAAC,YAAY,CAAC;oBACrC,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;gBACF,+BAAa,CAAC,YAAY,CAAC,WAAW,CAAC;gBACvC,gCAAc,CAAC,YAAY,CAAC;oBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;oBACtD,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;gBACF,wCAAkB;gBAClB,oCAAgB,CAAC,YAAY,CAAC;oBAC5B,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;oBACpD,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,eAAe,EAAE,OAAO,CAAC,yBAAyB;oBAClD,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;gBACF,wBAAU;gBACV,gCAAc;gBACd,oCAAgB;gBAChB,wCAAkB;gBAClB,kCAAe,CAAC,YAAY,CAAC;oBAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;gBACF,6CAAoB,CAAC,OAAO,CAAC;oBAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,6BAA6B,EAC3B,OAAO,CAAC,qCAAqC;iBAChD,CAAC;aACH;YACD,MAAM,EAAE,eAAa;SACtB,CAAC;IACJ,CAAC;CACF,CAAA;AA7FY,sCAAa;wBAAb,aAAa;IADzB,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,aAAa,CA6FzB;AAED,SAAS,uBAAuB,CAC9B,OAA6B;IAE7B,OAAO;QACL,uDAAyB,CAAC,OAAO,CAAC,OAAO,CAAC;QAC1C,+BAAa,CAAC,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;QAC1D,gCAAc,CAAC,OAAO,CAAC;YACrB,GAAG,OAAO;YACV,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;SACvD,CAAC;QACF,wCAAkB;QAClB,oCAAgB,CAAC,OAAO,CAAC;YACvB,GAAG,OAAO;YACV,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,eAAe,EAAE,OAAO,CAAC,yBAAyB;SACnD,CAAC;QACF,wBAAU;QACV,gCAAc;QACd,oCAAgB;QAChB,wCAAkB;QAClB,kCAAe,CAAC,OAAO,CAAC,OAAO,CAAC;QAChC,6CAAoB,CAAC,OAAO,CAAC;YAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,6BAA6B,EAC3B,OAAO,CAAC,qCAAqC;SAChD,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,OAAgE;IAEhE,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,kBAAkB;KAC3C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"bpm-root.module.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/bpm/bpm-root.module.ts"],"names":[],"mappings":";;;;;AAAA,2CAMwB;AAGxB,uEAAmE;AAEnE,iEAA4D;AAM5D,iEAA6D;AAC7D,uEAAmE;AACnE,qDAAiD;AACjD,0DAI6B;AAE7B,iEAA6D;AAE7D,6EAAyE;AACzE,6FAAwF;AAExF,6EAAyE;AAEzE,oEAAgE;AAChE,iEAA6D;AAC7D,sFAAiF;AAoKjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEI,IAAM,aAAa,qBAAnB,MAAM,aAAa;IACxB;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,OAA6B;QAC1C,MAAM,cAAc,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAExD,OAAO;YACL,OAAO,EAAE,CAAC,GAAG,cAAc,CAAC;YAC5B,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,cAAc,CAAC;YACxD,MAAM,EAAE,eAAa;SACtB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,YAAY,CAAC,OAAkC;QACpD,MAAM,WAAW,GAA8B;YAC7C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,KAAK,EACf,GAAG,IAAwB,EACI,EAAE;gBACjC,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;gBAEtD,OAAO,0BAA0B,CAAC,WAAW,CAAC,CAAC;YACjD,CAAC;SACF,CAAC;QAEF,OAAO;YACL,OAAO,EAAE;gBACP,uDAAyB;gBACzB,gCAAc;gBACd,+BAAa;gBACb,gCAAc;gBACd,wCAAkB;gBAClB,oCAAgB;gBAChB,wBAAU;gBACV,uCAAoB;gBACpB,gCAAc;gBACd,oCAAgB;gBAChB,wCAAkB;gBAClB,kCAAe;gBACf,6CAAoB;aACrB;YACD,OAAO,EAAE;gBACP,uDAAyB,CAAC,YAAY,CAAC;oBACrC,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;gBACF,gCAAc,CAAC,OAAO,CAAC;oBACrB,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;oBAC1D,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC;gBACF,+BAAa,CAAC,YAAY,CAAC,WAAW,CAAC;gBACvC,gCAAc,CAAC,YAAY,CAAC;oBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;oBACtD,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;gBACF,wCAAkB;gBAClB,oCAAgB,CAAC,YAAY,CAAC;oBAC5B,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;oBACpD,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,eAAe,EAAE,OAAO,CAAC,yBAAyB;oBAClD,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;gBACF,wBAAU;gBACV,uCAAoB,CAAC,OAAO,CAAC;oBAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,gBAAgB,EAAE,OAAO,CAAC,8BAA8B;iBACnB,CAAC;gBACxC,gCAAc;gBACd,oCAAgB;gBAChB,wCAAkB;gBAClB,kCAAe,CAAC,YAAY,CAAC;oBAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;gBACF,6CAAoB,CAAC,OAAO,CAAC;oBAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,6BAA6B,EAC3B,OAAO,CAAC,qCAAqC;iBAChD,CAAC;aACH;YACD,MAAM,EAAE,eAAa;SACtB,CAAC;IACJ,CAAC;CACF,CAAA;AAvGY,sCAAa;wBAAb,aAAa;IADzB,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,aAAa,CAuGzB;AAED,SAAS,uBAAuB,CAC9B,OAA6B;IAE7B,OAAO;QACL,uDAAyB,CAAC,OAAO,CAAC,OAAO,CAAC;QAC1C,gCAAc,CAAC,OAAO,CAAC;YACrB,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;YAC1D,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;QACF,+BAAa,CAAC,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;QAC1D,gCAAc,CAAC,OAAO,CAAC;YACrB,GAAG,OAAO;YACV,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;SACvD,CAAC;QACF,wCAAkB;QAClB,oCAAgB,CAAC,OAAO,CAAC;YACvB,GAAG,OAAO;YACV,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,eAAe,EAAE,OAAO,CAAC,yBAAyB;SACnD,CAAC;QACF,wBAAU;QACV,uCAAoB,CAAC,OAAO,CAAC;YAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,gBAAgB,EAAE,OAAO,CAAC,8BAA8B;SACnB,CAAC;QACxC,gCAAc;QACd,oCAAgB;QAChB,wCAAkB;QAClB,kCAAe,CAAC,OAAO,CAAC,OAAO,CAAC;QAChC,6CAAoB,CAAC,OAAO,CAAC;YAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,6BAA6B,EAC3B,OAAO,CAAC,qCAAqC;SAChD,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,OAAgE;IAEhE,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,kBAAkB;KAC3C,CAAC;AACJ,CAAC"}

package/src/lib/calendar/business-calendar.provider.d.ts

@@ -0,0 +1,11 @@
+import { Provider } from '@nestjs/common';
+import { BPMBusinessCalendar } from './business-calendar.token';
+/**
+ * Default {@link BPMBusinessCalendar} used when the host registers none.
+ *
+ * Treats Monday–Friday as working days in the time zone configured through
+ * `notificationSlaBusinessCalendarTimeZone`, and knows about no holidays. Hosts
+ * that need national holidays or make-up working days replace this provider via
+ * `BPMRootModule`'s `businessCalendarProvider`.
+ */
+export declare const defaultBusinessCalendarProvider: Provider<BPMBusinessCalendar>;

package/src/lib/calendar/business-calendar.provider.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultBusinessCalendarProvider = void 0;
+const notification_options_1 = require("../notification/notification-options");
+const business_calendar_token_1 = require("./business-calendar.token");
+const weekday_business_calendar_1 = require("./weekday-business-calendar");
+/**
+ * Default {@link BPMBusinessCalendar} used when the host registers none.
+ *
+ * Treats Monday–Friday as working days in the time zone configured through
+ * `notificationSlaBusinessCalendarTimeZone`, and knows about no holidays. Hosts
+ * that need national holidays or make-up working days replace this provider via
+ * `BPMRootModule`'s `businessCalendarProvider`.
+ */
+exports.defaultBusinessCalendarProvider = {
+    inject: [notification_options_1.BPM_NOTIFICATION_OPTIONS],
+    provide: business_calendar_token_1.BPM_BUSINESS_CALENDAR,
+    useFactory: (options) => new weekday_business_calendar_1.BPMWeekdayBusinessCalendar(options.slaBusinessCalendarTimeZone),
+};
+//# sourceMappingURL=business-calendar.provider.js.map

package/src/lib/calendar/business-calendar.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-calendar.provider.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/calendar/business-calendar.provider.ts"],"names":[],"mappings":";;;AACA,+EAG8C;AAC9C,uEAGmC;AACnC,2EAAyE;AAEzE;;;;;;;GAOG;AACU,QAAA,+BAA+B,GAAkC;IAC5E,MAAM,EAAE,CAAC,+CAAwB,CAAC;IAClC,OAAO,EAAE,+CAAqB;IAC9B,UAAU,EAAE,CACV,OAAuC,EAClB,EAAE,CACvB,IAAI,sDAA0B,CAAC,OAAO,CAAC,2BAA2B,CAAC;CACtE,CAAC"}

package/src/lib/calendar/business-calendar.token.d.ts

@@ -0,0 +1,38 @@
+import { InjectionToken } from '@nestjs/common';
+/**
+ * Host-provided business calendar used to resolve `BUSINESS_DAY` SLA due
+ * dates.
+ *
+ * BPMCore deliberately ships **no** national holiday data. A host that needs
+ * real working-day semantics (national holidays, make-up working Saturdays,
+ * company shutdown days) implements this contract against its own calendar
+ * source and registers it through `BPMRootModule`'s `businessCalendarProvider`.
+ *
+ * @example
+ * ```ts
+ * BPMRootModule.forRoot({
+ *   businessCalendarProvider: {
+ *     provide: BPM_BUSINESS_CALENDAR,
+ *     useClass: TaiwanBusinessCalendar,
+ *   },
+ *   // ...
+ * });
+ * ```
+ */
+export interface BPMBusinessCalendar {
+    /**
+     * IANA time zone the calendar's dates are expressed in, for example
+     * `Asia/Taipei`. BPM converts each instant to a local date in this zone
+     * before asking {@link BPMBusinessCalendar.isBusinessDay}, so day boundaries
+     * follow the host's calendar rather than the server's locale or UTC.
+     */
+    readonly timeZone: string;
+    /**
+     * Answers whether `localDate` is a working day.
+     *
+     * @param localDate Calendar date in `YYYY-MM-DD` form, already expressed in
+     * {@link BPMBusinessCalendar.timeZone}.
+     */
+    isBusinessDay(localDate: string): boolean | Promise<boolean>;
+}
+export declare const BPM_BUSINESS_CALENDAR: InjectionToken<BPMBusinessCalendar>;

package/src/lib/calendar/business-calendar.token.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BPM_BUSINESS_CALENDAR = void 0;
+exports.BPM_BUSINESS_CALENDAR = Symbol('BPM_BUSINESS_CALENDAR');
+//# sourceMappingURL=business-calendar.token.js.map

package/src/lib/calendar/business-calendar.token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-calendar.token.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/calendar/business-calendar.token.ts"],"names":[],"mappings":";;;AAwCa,QAAA,qBAAqB,GAChC,MAAM,CAAC,uBAAuB,CAAC,CAAC"}

package/src/lib/calendar/calendar.module.d.ts

@@ -0,0 +1,22 @@
+import { DynamicModule, Provider } from '@nestjs/common';
+import { ModuleMetadata } from '@nestjs/common/interfaces';
+import { BPMBusinessCalendar } from './business-calendar.token';
+export interface CalendarModuleOptions extends Pick<ModuleMetadata, 'imports'> {
+    /**
+     * Host-provided business calendar. When omitted, BPM falls back to a
+     * Monday–Friday calendar with no holiday knowledge.
+     *
+     * A `useClass` or `useFactory` provider may depend on host services, so the
+     * modules exporting them have to be listed in `imports`.
+     */
+    readonly businessCalendarProvider?: Provider<BPMBusinessCalendar>;
+}
+/**
+ * Supplies SLA scheduling to every BPM module.
+ *
+ * Global because the workflow engine computes due dates while creating tasks
+ * and hosts should not have to thread the calendar through each feature module.
+ */
+export declare class CalendarModule {
+    static forRoot(options?: CalendarModuleOptions): DynamicModule;
+}

package/src/lib/calendar/calendar.module.js

@@ -0,0 +1,33 @@
+"use strict";
+var CalendarModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CalendarModule = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const business_calendar_provider_1 = require("./business-calendar.provider");
+const sla_schedule_service_1 = require("./sla-schedule.service");
+/**
+ * Supplies SLA scheduling to every BPM module.
+ *
+ * Global because the workflow engine computes due dates while creating tasks
+ * and hosts should not have to thread the calendar through each feature module.
+ */
+let CalendarModule = CalendarModule_1 = class CalendarModule {
+    static forRoot(options = {}) {
+        return {
+            exports: [sla_schedule_service_1.BPMSlaScheduleService],
+            imports: options.imports ? [...options.imports] : [],
+            module: CalendarModule_1,
+            providers: [
+                options.businessCalendarProvider ?? business_calendar_provider_1.defaultBusinessCalendarProvider,
+                sla_schedule_service_1.BPMSlaScheduleService,
+            ],
+        };
+    }
+};
+exports.CalendarModule = CalendarModule;
+exports.CalendarModule = CalendarModule = CalendarModule_1 = tslib_1.__decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({})
+], CalendarModule);
+//# sourceMappingURL=calendar.module.js.map

package/src/lib/calendar/calendar.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"calendar.module.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/calendar/calendar.module.ts"],"names":[],"mappings":";;;;;AAAA,2CAAyE;AAGzE,6EAA+E;AAC/E,iEAA+D;AAa/D;;;;;GAKG;AAGI,IAAM,cAAc,sBAApB,MAAM,cAAc;IACzB,MAAM,CAAC,OAAO,CAAC,UAAiC,EAAE;QAChD,OAAO;YACL,OAAO,EAAE,CAAC,4CAAqB,CAAC;YAChC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;YACpD,MAAM,EAAE,gBAAc;YACtB,SAAS,EAAE;gBACT,OAAO,CAAC,wBAAwB,IAAI,4DAA+B;gBACnE,4CAAqB;aACtB;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAZY,wCAAc;yBAAd,cAAc;IAF1B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,cAAc,CAY1B"}

package/src/lib/calendar/index.d.ts

@@ -0,0 +1,5 @@
+export * from './business-calendar.provider';
+export * from './business-calendar.token';
+export * from './calendar.module';
+export * from './sla-schedule.service';
+export * from './weekday-business-calendar';