@burdenoff/be-sdk 2026.1005.1 → 2026.1008.1

package/README.md

@@ -204,3 +204,67 @@ PROPRIETARY - Copyright Burdenoff Consultancy Services Pvt. Ltd.
 ## Support
 
 For support, email contact@burdenoff.com or visit [https://burdenoff.com/support](https://burdenoff.com/support).
+
+## Shared DuckLake dataset contract (BOFF-8254)
+
+The DuckLake catalog PostgreSQL database owns `shared_lake_datasets` and
+`shared_lake_dataset_consumers` (migration in `prisma/lake-registry/`).
+`dataset_id` is the existing BigConsole sink UUID, `metadata_schema` is
+`dl_<UUID with underscores>`, and the S3 prefix stays
+`datasinks/<dataset_id>/`. BigConsole's service database continues to own the
+ingest watermark and dashboard payload behavior; it mirrors legacy metadata
+to this registry. Run its idempotent `scripts/backfill-shared-lake-registry.ts`
+after the catalog migration, then let normal writes keep it current.
+
+Legacy `payload_versions` and `payload_elements` are JSON dashboard data, not
+an operational TimeCampus contract. A product owner adds a typed table in the
+same catalog schema (or a new dataset), with non-null `workspace_id` and
+nullable `product_id`. A null `product_id` explicitly marks a row shared with
+all **approved** dataset consumers. Product-specific rows carry their product
+slug. Readers use both `workspace_id` and `(product_id = consumer OR
+product_id IS NULL)` in every query. Column names and types are versioned by
+`schema_version`; an incompatible change requires a new version/table and a
+staged consumer migration. A single designated owner writes each typed table;
+readers never write. Owners serialize commits and update
+`last_committed_version` only after the lake transaction succeeds. Add DuckLake
+product/date partitions only after file-size and query-profile evidence shows
+that pruning is useful; partitions are a performance choice, not an access
+control mechanism.
+
+The first TimeCampus GraphQL operation exposes only typed `time_entries`
+tables classified L1 or L2. Other approved datasets remain service-only until
+their fields and end-user RBAC are reviewed explicitly.
+
+Rollout for a TimeCampus grant:
+
+1. Apply `bun run lake:registry:migrate` against the catalog with
+   `DUCKLAKE_REGISTRY_MIGRATION_URL`. Backfill existing BigConsole sinks.
+2. Create the typed table and a representative fixture in alpha, validate
+   workspace/product columns and version, then call `registerTyped` with the
+   original sink ID/routing and `lifecycle: 'ready'`. BigConsole continues using
+   its legacy payload tables in the same schema.
+3. Add the dataset UUID to `timecampus_ducklake_dataset_ids.alpha` in
+   `tf-aws-cloud/roots/secrets`, review/apply the S3 policy through IaC, and
+   provision a separate static access key in the TimeCampus Secrets Manager
+   bundle. The TimeCampus catalog login must be a member of the
+   `boff_timecampus_lake_reader` role; put its read-only URL in
+   `DUCKLAKE_CATALOG_URL`. Add `DUCKLAKE_S3_BUCKET`,
+   `DUCKLAKE_S3_ACCESS_KEY_ID`, and `DUCKLAKE_S3_SECRET_ACCESS_KEY` to the same
+   bundle. The workload already imports its bundle through GitOps.
+4. Run `bun run lake:grant:timecampus` with the approved `LAKE_DATASET_ID` and
+   `LAKE_GRANT_ACTOR`. This grants catalog schema SELECT and activates the
+   product grant. The approved view prevents TimeCampus's catalog login from
+   reading the unfiltered registry tables. The IAM key can read only the
+   reviewed S3 prefix. Validate discovery, direct read, denied guessed ID, and
+   mixed-product rows with
+   `timecampus-doctor/wspace/modules/timecampus/scripts/test-timecampus.sh --test lake`
+   in alpha; then
+   repeat the reviewed grant and validation in prod.
+
+To adopt a second product, add its own catalog view and NOLOGIN reader role,
+per-dataset PostgreSQL schema grants, IAM principal/prefix policy, Secrets
+Manager bundle values, and service using `LakeDatasetRegistry` plus
+`AuthorizedLakeReader`. Grant revocation must use
+`LAKE_GRANT_ACTION=revoke bun run lake:grant:timecampus`, remove the dataset
+UUID from the Terraform S3 policy, and rotate credentials if a removed product
+previously held them. Do not share BigConsole's broad lake credentials.

package/dist/auth/index.d.ts

@@ -1,6 +1,6 @@
 import { B as BurdenoffGraphQLClient } from '../graphql-AaLJfGzz.js';
 import { a as SDKContext } from '../index-CfRZtB99.js';
-import { G as GraphQLContext } from '../types-Biv0uaJk.js';
+import { G as GraphQLContext } from '../types-C-6m9NoG.js';
 import 'graphql-request';
 import '../layer-GNAVXBMf.js';
 import 'graphql';
@@ -8,7 +8,7 @@ import 'graphql-yoga';
 import '../client-CCXpAZ2r.js';
 import '@prisma/adapter-pg';
 import 'pg';
-import '../workspace-extension-DlxYz3P4.js';
+import '../workspace-extension-DiNiTLa3.js';
 import '../types-C8TbSdEj.js';
 
 interface CookieOptions {