@burdenoff/be-sdk 2026.1002.1 → 2026.1004.1

package/dist/rbac/index.d.ts

@@ -1,5 +1,5 @@
-import { B as BurdenoffGraphQLClient } from '../graphql-Dxxpbzr3.js';
-import { S as SDKContext } from '../index-B8viwwDM.js';
+import { B as BurdenoffGraphQLClient } from '../graphql-AaLJfGzz.js';
+import { a as SDKContext } from '../index-CfRZtB99.js';
 import { Plugin } from '@envelop/core';
 import { S as ServiceLayer } from '../layer-GNAVXBMf.js';
 import 'graphql-request';

package/dist/resource-caps/index.d.ts

@@ -1,7 +1,7 @@
 import { GraphQLError } from 'graphql';
-import { B as BurdenoffGraphQLClient } from '../graphql-Dxxpbzr3.js';
+import { B as BurdenoffGraphQLClient } from '../graphql-AaLJfGzz.js';
 import 'graphql-request';
-import '../index-B8viwwDM.js';
+import '../index-CfRZtB99.js';
 import '../layer-GNAVXBMf.js';
 
 type ResourceName = 'workspace' | 'workspaceMember' | 'sandbox' | 'vibe' | 'agent' | 'conversation' | 'message' | 'tag' | 'file' | 'group' | 'calendar' | 'scheduledTask' | 'form' | 'apiKey' | 'webhook';

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
-import { W as WorkspaceSecret, I as IActor, J as JWTPayload, S as ServerDefinition, a as ServerInstance, b as ITenant, G as GraphQLContext, Y as YogaPlugin } from '../types-BAHkj1GE.js';
-export { C as ConsentContext, E as ElysiaApp, c as IContextFilterInput, d as IOperationContext, e as IOrganization, f as IProduct, g as IProject, h as ITracking, i as IWorkspace, M as ModuleGraphConfig, P as PrismaClientConstructor, R as RESTEndpoint, j as ServerConfig, k as ServerI18nConfig, l as ServerInfo, m as WspaceGraphQLContext } from '../types-BAHkj1GE.js';
+import { W as WorkspaceSecret, I as IActor, J as JWTPayload, S as ServerDefinition, a as ServerInstance, b as ITenant, G as GraphQLContext, Y as YogaPlugin } from '../types-Biv0uaJk.js';
+export { A as ActorProvenance, C as ConsentContext, E as ElysiaApp, c as IContextFilterInput, d as IOperationContext, e as IOrganization, f as IProduct, g as IProject, h as ITracking, i as IWorkspace, M as ModuleGraphConfig, P as PrismaClientConstructor, R as RESTEndpoint, j as ServerConfig, k as ServerI18nConfig, l as ServerInfo, V as VerifiedDelegationContext, m as WspaceGraphQLContext } from '../types-Biv0uaJk.js';
 import * as jose from 'jose';
 import { VerifyOptions } from 'jsonwebtoken';
 import { I as I18n } from '../i18n-DrdPTann.js';

package/dist/server/index.js

@@ -123,7 +123,7 @@ __name(verifyJWT, "verifyJWT");
 async function decodeJWT(token) {
   try {
     const joseLib = await getJose();
-    return await joseLib.decodeJwt(token);
+    return joseLib.decodeJwt(token);
   } catch {
     return null;
   }
@@ -184,6 +184,70 @@ function tenantCheck(context) {
   return context.tenant.id;
 }
 __name(tenantCheck, "tenantCheck");
+
+// src/server/verified-delegation.ts
+function object(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+__name(object, "object");
+function identifier(value) {
+  return typeof value === "string" && value["length"] > 0 && value["length"] <= 200 && value["trim"]() === value && Array.from(value).every((character) => character.charCodeAt(0) >= 32 && character.charCodeAt(0) !== 127);
+}
+__name(identifier, "identifier");
+function list(value) {
+  return Array.isArray(value) && value["length"] <= 1e3 && value["every"](identifier);
+}
+__name(list, "list");
+function instant(value) {
+  if (typeof value !== "string") return null;
+  const time = Date.parse(value);
+  return Number.isFinite(time) && new Date(time).toISOString() === value ? new Date(time) : null;
+}
+__name(instant, "instant");
+function decodeVerifiedDelegation(header, actor, workspaceId, trustedGateway, now = Date.now()) {
+  if (!trustedGateway || !actor || actor.provenance !== "delegated" || ![
+    "user",
+    "super_admin"
+  ].includes(actor.type) || header === void 0) return void 0;
+  const invalid = /* @__PURE__ */ __name(() => new Error("Invalid verified delegation context"), "invalid");
+  let raw;
+  try {
+    raw = JSON.parse(header);
+  } catch {
+    throw invalid();
+  }
+  const value = object(raw);
+  const tokenExpiresAt = instant(value?.["tokenExpiresAt"]);
+  if (!value || !identifier(value["representedUserId"]) || value["representedUserId"] !== actor.id || !identifier(value["originatingAppId"]) || !identifier(value["delegationId"]) || !list(value["scopes"]) || !list(value["allowedWorkspaceIds"]) || !tokenExpiresAt || tokenExpiresAt.getTime() <= now || workspaceId && value["allowedWorkspaceIds"].length > 0 && !value["allowedWorkspaceIds"].includes(workspaceId)) throw invalid();
+  let consent = null;
+  if (value["consent"] !== null) {
+    const facts = object(value["consent"]);
+    const grantedAt = instant(facts?.["grantedAt"]);
+    const expiresAt = facts?.["expiresAt"] === null ? null : instant(facts?.["expiresAt"]);
+    if (!facts || !identifier(facts["grantedBy"]) || !grantedAt || grantedAt.getTime() > now || facts["expiresAt"] !== null && (!expiresAt || expiresAt.getTime() <= grantedAt.getTime() || tokenExpiresAt.getTime() > expiresAt.getTime())) throw invalid();
+    consent = {
+      grantedBy: facts["grantedBy"],
+      grantedAt,
+      expiresAt
+    };
+  }
+  return {
+    representedUserId: value["representedUserId"],
+    originatingAppId: value["originatingAppId"],
+    delegationId: value["delegationId"],
+    scopes: [
+      ...value["scopes"]
+    ],
+    allowedWorkspaceIds: [
+      ...value["allowedWorkspaceIds"]
+    ],
+    tokenExpiresAt,
+    consent
+  };
+}
+__name(decodeVerifiedDelegation, "decodeVerifiedDelegation");
+
+// src/server/context.ts
 var contextOptions = null;
 function configureContext(options) {
   contextOptions = options;
@@ -227,6 +291,11 @@ function extractTracking(request) {
   };
 }
 __name(extractTracking, "extractTracking");
+function actorProvenance(request) {
+  const value = getHeader(request, "x-verified-actor-provenance");
+  return value === "direct_human" || value === "delegated" || value === "non_human" ? value : "unknown";
+}
+__name(actorProvenance, "actorProvenance");
 async function extractActor(request) {
   const actorId = getHeader(request, "x-actor-id");
   if (actorId && shouldTrustActorHeaders(request)) {
@@ -236,6 +305,7 @@ async function extractActor(request) {
     return {
       id: actorId,
       type: actorType,
+      provenance: actorProvenance(request),
       workspace_id: getHeader(request, "x-workspace-id"),
       tenant_id: getHeader(request, "x-tenant-id"),
       org_id: getHeader(request, "x-org-id") || getHeader(request, "x-organization-id"),
@@ -259,6 +329,7 @@ async function extractActor(request) {
     return {
       id: payload.id,
       type: "user",
+      provenance: "unknown",
       workspace_id: payload.workspace_id
     };
   } catch (error) {
@@ -363,6 +434,7 @@ async function buildContext(request) {
   const product = extractProduct(request);
   const tracking = extractTracking(request);
   const consentContext = extractConsentContext(request);
+  const verifiedDelegation = decodeVerifiedDelegation(getHeader(request, "x-verified-delegation"), actor, workspace?.id, shouldTrustActorHeaders(request));
   let i18n;
   if (contextOptions.i18n) {
     i18n = contextOptions.i18n.createContextFromRequest(request);
@@ -416,6 +488,7 @@ async function buildContext(request) {
     product,
     tracking,
     consentContext: consentContext || void 0,
+    verifiedDelegation,
     onBehalfOf: onBehalfOf || actor?.id || "",
     db: contextOptions.getDb(),
     i18n,