@burdenoff/be-sdk 2026.510.79

package/README.md

@@ -0,0 +1,173 @@
+# @burdenoff/be-sdk
+
+Backend SDK for Burdenoff products providing unified access to notifications, RBAC, activity tracking, usage monitoring, and more.
+
+> Published automatically using npm trusted publishers (OIDC) - no long-lived tokens needed!
+
+## Installation
+
+```bash
+npm install @burdenoff/be-sdk
+```
+
+## Quick Start
+
+```typescript
+import { BurdenoffSDK } from '@burdenoff/be-sdk';
+
+// Initialize SDK
+const sdk = new BurdenoffSDK({
+  workspacesApiUrl: 'https://api.burdenoff.com/graphql',
+  tenantApiUrl: 'https://tenant.burdenoff.com/graphql',
+  context: {
+    userId: 'user-123',
+    workspaceId: 'workspace-456',
+    token: 'your-jwt-token',
+  },
+});
+
+// Send notification
+await sdk.notifications.send({
+  title: 'Welcome',
+  message: 'Hello from Burdenoff!',
+  userIds: ['user-123'],
+  type: 'info',
+});
+
+// Track operation with RBAC + Activity + Usage
+await sdk.tracker.trackOperation({
+  operationName: 'createProject',
+  userId: 'user-123',
+  rbacCheck: { workspaceId: 'workspace-456' },
+  activityOptions: {
+    description: 'Created new project',
+    metadata: { projectName: 'My Project' },
+  },
+  usageOptions: {
+    billingAccountId: 'billing-123',
+  },
+});
+
+// Check permissions
+await sdk.rbac.requirePermission({
+  userId: 'user-123',
+  action: 'create:project',
+  resourceType: 'project',
+  workspaceId: 'workspace-456',
+});
+
+// Record activity
+await sdk.activity.record({
+  userId: 'user-123',
+  action: 'PROJECT_CREATED',
+  description: 'Created new project',
+  productId: 'WORKSPACE',
+  workspaceId: 'workspace-456',
+});
+
+// Add usage
+await sdk.usage.add({
+  billingAccountId: 'billing-123',
+  quotaName: 'api_calls',
+  value: 1,
+  description: 'API call for project creation',
+});
+
+// Export product translations from i18n service
+const hiDictionary = await sdk.translation.exportProductTranslations({
+  productName: 'vibecontrols',
+  languageCode: 'hi',
+  format: 'JSON',
+  decodeJson: true,
+});
+
+// Upsert product translations (creates missing keys/translations, publishes)
+await sdk.translation.upsertProductTranslations({
+  productName: 'vibecontrols',
+  languageCode: 'ta',
+  translations: {
+    'overviewPage.title': 'VibeControls மேலோட்டம்',
+  },
+});
+```
+
+## Features
+
+- **Unified Tracking**: Single function for RBAC + Activity + Usage + Quota checking
+- **Notifications**: Send in-app, email, SMS, and push notifications
+- **RBAC**: Role-based access control and permission management
+- **Activity Logging**: Comprehensive audit trail for all operations
+- **Usage Tracking**: Track resource consumption for billing
+- **Graph Integration**: Global search across all products
+- **Context Management**: Automatic context propagation
+- **Event Queue**: NATS integration for event-driven architecture
+- **Database Helpers**: Prisma utilities and transaction management
+- **Authentication**: JWT verification and token management
+- **Payments**: Payment processing and webhook handling
+- **Translation**: Backend i18n support
+- **Search**: Advanced search utilities
+- **Logger**: Structured logging compatible with console
+
+## Modules
+
+### Core Modules
+
+- **tracker**: Unified operation tracking (RBAC + Activity + Usage + Notifications)
+- **logger**: Structured logging system
+- **context**: Request context management
+- **client**: GraphQL client with retry logic
+
+### Integration Modules
+
+- **notifications**: Notification management
+- **rbac**: Permission and access control
+- **activity**: Activity logging
+- **usage**: Usage and quota tracking
+- **graph**: Knowledge graph integration
+- **events**: Event queue (NATS) integration
+- **auth**: Authentication and JWT handling
+
+### Utility Modules
+
+- **database**: Prisma helpers
+- **search**: Search utilities
+- **translation**: i18n support
+- **payments**: Payment processing
+- **bootstrap**: Server initialization
+
+## Documentation
+
+For detailed documentation, see:
+
+- [API Reference](./docs/api.md)
+- [Integration Guide](./docs/integration.md)
+- [Examples](./docs/examples.md)
+- [Migration Guide](./docs/migration.md)
+- [Internal Client Architecture](./src/client/README.md) - Service-to-service communication and header transformation
+
+## Development
+
+```bash
+# Install dependencies
+npm install
+
+# Run tests
+npm test
+
+# Build
+npm run build
+
+# Lint
+npm run lint
+
+# Format
+npm run format
+```
+
+## License
+
+PROPRIETARY - Copyright Burdenoff Consultancy Services Pvt. Ltd.
+
+## Support
+
+For support, email contact@burdenoff.com or visit [https://burdenoff.com/support](https://burdenoff.com/support).

package/configs/eslint/index.js

@@ -0,0 +1,492 @@
+import pluginJs from '@eslint/js';
+import eslintComments from 'eslint-plugin-eslint-comments';
+import importPlugin from 'eslint-plugin-import';
+import security from 'eslint-plugin-security';
+import sonarjs from 'eslint-plugin-sonarjs';
+import globals from 'globals';
+import tseslint from 'typescript-eslint';
+
+/**
+ * Burdenoff TypeScript Backend ESLint Configuration v1.2.0
+ *
+ * Factory function that creates a complete ESLint configuration with TypeScript
+ * type-aware rules, eliminating the need for consuming projects to provide
+ * parserOptions manually.
+ *
+ * CHANGELOG v1.2.0:
+ * - **BREAKING CHANGE**: Now exports a factory function instead of array
+ * - Automatically configures TypeScript parser options with provided dirname
+ * - Eliminates need for manual languageOptions configuration in consuming projects
+ * - Backwards compatible: see migration guide below
+ *
+ * MIGRATION FROM v1.1.0 to v1.2.0:
+ * Before:
+ *   import burdenoffConfig from '@burdenoff/be-ts-lint';
+ *   export default [...burdenoffConfig, { languageOptions: { ... } }];
+ *
+ * After:
+ *   import createConfig from '@burdenoff/be-ts-lint';
+ *   export default createConfig(import.meta.dirname);
+ *
+ * @param {string} dirname - The directory of the consuming project (use import.meta.dirname)
+ * @param {object} options - Optional configuration
+ * @param {string} options.project - Path to tsconfig file (default: './tsconfig.eslint.json')
+ * @returns {import('eslint').Linter.FlatConfig[]}
+ */
+export default function createBurdenoffConfig(dirname, options = {}) {
+  const { project = './tsconfig.eslint.json' } = options;
+
+  if (!dirname) {
+    throw new Error(
+      '@burdenoff/be-ts-lint: dirname is required. Use createConfig(import.meta.dirname)',
+    );
+  }
+
+  return [
+    {
+      files: ['**/*.{js,mjs,cjs,ts}'],
+    },
+    {
+      ignores: [
+        '**/generated/**',
+        '**/generated/*.ts',
+        '**/temp/**',
+        '**/dist/**',
+        '**/coverage/**',
+        '**/node_modules/**',
+        '*.d.ts',
+        '*.config.js',
+        '*.config.mjs',
+      ],
+    },
+    {
+      languageOptions: {
+        globals: {
+          ...globals.node,
+          ...globals.es2022,
+        },
+        parserOptions: {
+          // Automatically configured from factory function parameters
+          project,
+          tsconfigRootDir: dirname,
+          ecmaVersion: 'latest',
+          sourceType: 'module',
+        },
+      },
+    },
+    // ============================================================================
+    // Base Recommended Configurations
+    // ============================================================================
+    pluginJs.configs.recommended,
+    ...tseslint.configs.recommended,
+    security.configs.recommended,
+    sonarjs.configs.recommended,
+    {
+      plugins: {
+        import: importPlugin,
+        'eslint-comments': eslintComments,
+      },
+      rules: {
+        // ============================================================================
+        // ESLint Comments - Control inline ESLint directives
+        // ============================================================================
+        'eslint-comments/no-use': 'error', // Require description for eslint-disable comments
+        'eslint-comments/no-unlimited-disable': 'error', // Disallow unlimited eslint-disable
+        'eslint-comments/no-restricted-disable': 'error', // Disallow disabling specific rules without justification
+        'eslint-comments/no-duplicate-disable': 'error', // Disallow duplicate eslint-disable comments
+        'eslint-comments/no-unused-disable': 'error', // Disallow unused eslint-disable comments
+        'eslint-comments/no-unused-enable': 'error', // Disallow unused eslint-enable comments
+
+        // ============================================================================
+        // TypeScript Core Rules
+        // ============================================================================
+        '@typescript-eslint/ban-ts-ignore': 'off', // Allow @ts-ignore when needed
+        '@typescript-eslint/ban-ts-comment': 'off', // Allow @ts-expect-error with description
+
+        // Type Safety - Gradual adoption approach
+        '@typescript-eslint/no-explicit-any': 'warn', // Warn on 'any' usage (gradual improvement)
+        // Unused vars/imports - ERROR level since TypeScript's noUnusedLocals is disabled
+        // (TypeScript doesn't support per-file overrides, so ESLint handles this)
+        // Generated files are excluded via the ignores pattern and override section
+        '@typescript-eslint/no-unused-vars': [
+          'error',
+          {
+            argsIgnorePattern: '^_',
+            varsIgnorePattern: '^_',
+            destructuredArrayIgnorePattern: '^_',
+            caughtErrorsIgnorePattern: '^_',
+            ignoreRestSiblings: true,
+          },
+        ],
+        '@typescript-eslint/explicit-function-return-type': [
+          'warn',
+          {
+            allowExpressions: true,
+            allowTypedFunctionExpressions: true,
+            allowHigherOrderFunctions: true,
+          },
+        ],
+
+        // ============================================================================
+        // Async/Promise Handling - CRITICAL for backend reliability
+        // ============================================================================
+        '@typescript-eslint/no-floating-promises': 'error', // Prevent unhandled promises
+        '@typescript-eslint/no-misused-promises': 'error', // Prevent promises used in wrong contexts
+        '@typescript-eslint/await-thenable': 'error', // Ensure await is only used with promises
+        // Disable require-await - async functions without await are allowed for interface consistency,
+        // promise return types, and future async operations
+        '@typescript-eslint/require-await': 'off',
+        // Disable promise-function-async - produces numerous false positives on arrow functions
+        // in array methods that don't return promises (e.g., .map((x) => x.id), .filter((a) => a.tag))
+        // The rule incorrectly flags simple property access and synchronous operations as promise-returning
+        '@typescript-eslint/promise-function-async': 'off',
+        'no-return-await': 'off', // Turned off in favor of @typescript-eslint version
+        '@typescript-eslint/return-await': 'error', // Enforce proper return await for try/catch
+
+        // ============================================================================
+        // Type Imports/Exports - Tree-shaking and performance
+        // ============================================================================
+        '@typescript-eslint/consistent-type-imports': [
+          'error',
+          {
+            prefer: 'type-imports',
+            disallowTypeAnnotations: false, // Allow type imports in annotations
+            fixStyle: 'separate-type-imports',
+          },
+        ],
+        '@typescript-eslint/consistent-type-exports': 'error',
+        '@typescript-eslint/no-unnecessary-type-assertion': 'error',
+
+        // Type safety rules with too many false positives - disabled for now
+        '@typescript-eslint/no-unsafe-assignment': 'off',
+        '@typescript-eslint/no-unsafe-call': 'off',
+        '@typescript-eslint/no-unsafe-member-access': 'off',
+        '@typescript-eslint/no-unsafe-return': 'off',
+        '@typescript-eslint/no-namespace': 'warn', // Warn on namespaces (occasionally needed for type augmentation)
+
+        // ============================================================================
+        // Import Organization - Code organization and circular dependency prevention
+        // ============================================================================
+        'import/order': 'off', // Disabled in favor of Prettier plugin (@trivago/prettier-plugin-sort-imports)
+        'import/no-duplicates': 'error', // Prevent duplicate imports
+        'import/no-cycle': ['error', { maxDepth: 3 }], // Prevent circular dependencies
+        'import/no-self-import': 'error', // Prevent self imports
+        'import/first': 'error', // Imports should be at top of file
+        'import/newline-after-import': 'error', // Blank line after imports
+
+        // ============================================================================
+        // Code Quality - General best practices
+        // ============================================================================
+        'no-console': ['warn', { allow: ['warn', 'error', 'info'] }], // Warn on console.log
+        'no-debugger': 'error', // Disallow debugger statements
+        'prefer-const': 'error', // Prefer const over let
+        'no-var': 'error', // Disallow var
+        eqeqeq: ['error', 'always', { null: 'ignore' }], // Require === and !==
+        'no-throw-literal': 'error', // Disallow throwing literals
+        'prefer-promise-reject-errors': 'error', // Reject with Error objects
+
+        // ============================================================================
+        // Error Handling - Production reliability (NEW in v1.1.0)
+        // ============================================================================
+        'no-ex-assign': 'error', // Disallow reassigning exceptions
+        'no-unsafe-finally': 'error', // Disallow unsafe returns in finally blocks
+        'no-unreachable': 'error', // Disallow unreachable code
+        'no-loss-of-precision': 'error', // Disallow number precision loss
+
+        // ============================================================================
+        // Performance - Backend optimization (NEW in v1.1.0)
+        // ============================================================================
+        // Disable no-await-in-loop globally - many sequential operations (transactions, batch processing)
+        // are intentionally using await in loops for data integrity and ordering
+        'no-await-in-loop': 'off',
+        'no-constant-condition': 'error', // Disallow constant conditions
+        'no-dupe-else-if': 'error', // Disallow duplicate else-if conditions
+        'no-duplicate-case': 'error', // Disallow duplicate case labels
+        'no-empty': ['error', { allowEmptyCatch: false }], // Disallow empty blocks
+        'no-extra-boolean-cast': 'error', // Disallow unnecessary boolean casts
+
+        // ============================================================================
+        // SonarJS Rules - Code complexity and quality
+        // ============================================================================
+        'sonarjs/cognitive-complexity': ['warn', 25], // Warn on high complexity (25 is pragmatic)
+        'sonarjs/no-dead-store': 'error', // Error on unused assignments (TypeScript noUnusedLocals disabled)
+        'sonarjs/no-unused-vars': 'error', // Error on unused variables (TypeScript noUnusedLocals disabled)
+        'sonarjs/unused-import': 'error', // Error on unused imports (TypeScript noUnusedLocals disabled)
+        'sonarjs/no-duplicate-string': 'off', // Off for GraphQL/config strings
+        'sonarjs/todo-tag': 'warn', // Warn on TODO comments
+        'sonarjs/fixme-tag': 'off', // Allow FIXME for documented blockers
+        'sonarjs/slow-regex': 'warn', // Warn on slow regex
+        'sonarjs/pseudo-random': 'warn', // Warn on Math.random() for security
+        'sonarjs/no-commented-code': 'warn', // Warn on commented code
+        'sonarjs/redundant-type-aliases': 'off', // Too many false positives with generated types
+        'sonarjs/no-invariant-returns': 'warn', // Warn on invariant returns
+        // Disable function-return-type - union return types and conditional returns are intentional
+        // design patterns (e.g., returning different types based on runtime conditions)
+        'sonarjs/function-return-type': 'off',
+        'sonarjs/different-types-comparison': 'warn', // Warn on comparing different types
+        'sonarjs/deprecation': 'warn', // Warn on deprecated APIs
+        'sonarjs/no-nested-conditional': 'warn', // Warn on nested conditionals
+        'sonarjs/no-ignored-exceptions': 'warn', // Warn on ignored exceptions
+        'sonarjs/no-small-switch': 'warn', // Warn on small switch statements
+        'sonarjs/no-async-constructor': 'warn', // Warn on async constructors
+        'sonarjs/no-control-regex': 'off', // Allow control characters in regex
+        'no-control-regex': 'off', // Allow control characters in regex
+        'sonarjs/class-name': 'off', // Allow underscores in generated types
+        // Disable sonarjs/encryption-secure-mode - false positive on cipher algorithm selection
+        'sonarjs/encryption-secure-mode': 'off',
+        'sonarjs/no-hardcoded-ip': 'off', // Allow hardcoded IPs for config
+        'sonarjs/updated-loop-counter': 'warn', // Warn on loop counter updates
+        'sonarjs/anchor-precedence': 'warn', // Warn on anchor precedence
+        'sonarjs/void-use': 'off', // Allow void for ignoring promises
+
+        // ============================================================================
+        // Security Rules - Production security
+        // ============================================================================
+        'security/detect-object-injection': 'off', // Too many false positives
+        // Other security rules are enabled via security.configs.recommended
+      },
+    },
+
+    // ============================================================================
+    // Override Rules for Test Files
+    // ============================================================================
+    {
+      files: [
+        '**/__tests__/**/*.ts',
+        '**/*.test.ts',
+        '**/*.spec.ts',
+        '**/*.integration.test.ts',
+      ],
+      rules: {
+        'sonarjs/no-hardcoded-ip': 'off', // Test files can have hardcoded IPs
+        'sonarjs/no-hardcoded-passwords': 'off', // Test files can have test passwords
+        'no-control-regex': 'off', // Test files can have control chars in regex
+        'sonarjs/no-control-regex': 'off', // Test files can have control chars
+        '@typescript-eslint/no-explicit-any': 'off', // Test files can use any
+        '@typescript-eslint/require-await': 'off', // Test setup functions often don't need await
+        '@typescript-eslint/no-misused-promises': 'off', // Test mocks properly handle async
+        'sonarjs/no-nested-functions': 'off', // Test mocks often require nested functions
+        'sonarjs/pseudo-random': 'off', // Test data generation can use Math.random()
+        'eslint-comments/no-use': 'off', // Allow eslint-disable in test files
+        'no-await-in-loop': 'off', // Tests often need sequential async operations
+      },
+    },
+
+    // ============================================================================
+    // Override Rules for Cache/Storage Services
+    // ============================================================================
+    {
+      files: [
+        '**/cache/**/*.ts',
+        '**/storage/**/*.ts',
+        '**/services/cache/**/*.ts',
+        '**/services/storage/**/*.ts',
+      ],
+      rules: {
+        'sonarjs/hashing': 'off', // MD5 for checksums/ETags is acceptable
+        'sonarjs/publicly-writable-directories': 'off', // Temp directories are acceptable
+        'security/detect-non-literal-fs-filename': 'off', // Storage services use dynamic paths
+        'sonarjs/no-invariant-returns': 'off', // Interface implementations may require specific returns
+        'sonarjs/cognitive-complexity': ['warn', 40], // Storage operations naturally complex
+      },
+    },
+
+    // ============================================================================
+    // Override Rules for Generated Type Files
+    // Generated files (codegen, prisma) have unused imports we cannot control
+    // ============================================================================
+    {
+      files: [
+        '**/types/**/*.ts',
+        '**/*.types.ts',
+        '**/generated/**/*.ts',
+        '**/*.generated.ts',
+        '**/mapper-models.ts', // Imports from generated Prisma types
+        '**/scalar-types.ts', // Scalar type definitions for codegen
+      ],
+      rules: {
+        'sonarjs/class-name': 'off', // Generated types can have _ prefix
+        '@typescript-eslint/no-explicit-any': 'off', // Generated types can use any
+        '@typescript-eslint/explicit-function-return-type': 'off', // Generated types don't need explicit returns
+        // Disable unused vars/imports checks for generated files
+        '@typescript-eslint/no-unused-vars': 'off',
+        'sonarjs/no-unused-vars': 'off',
+        'sonarjs/unused-import': 'off',
+        'sonarjs/no-dead-store': 'off',
+      },
+    },
+
+    // ============================================================================
+    // Override Rules for Adapter Files
+    // ============================================================================
+    {
+      files: ['**/adapters/**/*.ts', '**/*Adapter.ts'],
+      rules: {
+        'sonarjs/function-return-type': 'off', // Adapters implement external API contracts
+      },
+    },
+
+    // ============================================================================
+    // Override Rules for Resolver Files (GraphQL)
+    // ============================================================================
+    {
+      files: ['**/resolvers/**/*.ts', '**/*.resolvers.ts'],
+      rules: {
+        'sonarjs/function-return-type': 'off', // Resolvers implement GraphQL schema contracts
+      },
+    },
+
+    // ============================================================================
+    // Override Rules for Logger Transports (NEW in v1.1.0)
+    // Validated file paths from config, not user input
+    // ============================================================================
+    {
+      files: ['**/logger/**/transports.ts', '**/utils/logger/transports.ts'],
+      rules: {
+        'security/detect-non-literal-fs-filename': 'off', // File paths validated in constructor
+        'eslint-comments/no-use': 'off', // Allow eslint-disable for documented safe fs operations
+      },
+    },
+
+    // ============================================================================
+    // Override Rules for Export Services (NEW in v1.1.0)
+    // Validated export paths with security checks
+    // ============================================================================
+    {
+      files: [
+        '**/export/**/ExportFormatService.ts',
+        '**/modules/export/services/ExportFormatService.ts',
+      ],
+      rules: {
+        'security/detect-non-literal-fs-filename': 'off', // Export paths validated before fs operations
+        'eslint-comments/no-use': 'off', // Allow eslint-disable for documented safe export operations
+      },
+    },
+
+    // ============================================================================
+    // Override Rules for Services with Validated Dynamic RegExp (NEW in v1.1.0)
+    // RegExp patterns from validated application config, not user input
+    // ============================================================================
+    {
+      files: [
+        '**/TemplateService.ts',
+        '**/numberGenerator.ts',
+        '**/tags/services/validation.ts',
+      ],
+      rules: {
+        'security/detect-non-literal-regexp': 'off', // RegExp from validated config with error handling
+        'eslint-comments/no-use': 'off', // Allow eslint-disable for documented safe regex usage
+      },
+    },
+
+    // ============================================================================
+    // Override Rules for Report Generators (NEW in v1.1.0)
+    // Naturally high complexity due to Excel/PDF formatting
+    // ============================================================================
+    {
+      files: ['**/ExcelReportGenerator.ts', '**/PDFReportGenerator.ts', '**/ReportService.ts'],
+      rules: {
+        'sonarjs/cognitive-complexity': ['warn', 35], // Allow higher complexity for report generation
+      },
+    },
+
+    // ============================================================================
+    // Override Rules for GraphQL Modules Namespace Augmentation (NEW in v1.1.0)
+    // Required by @graphql-modules for context type augmentation
+    // ============================================================================
+    {
+      files: ['**/modules/*/index.ts', '**/modules/*/declarations.ts'],
+      rules: {
+        '@typescript-eslint/no-namespace': 'off', // Namespace augmentation required for GraphQL Modules
+        'eslint-comments/no-use': 'off', // Allow eslint-disable for documented namespace usage
+      },
+    },
+
+    // ============================================================================
+    // Override Rules for Prisma JSON Type Handling (NEW in v1.1.0)
+    // Prisma.JsonValue is a union type by design
+    // ============================================================================
+    {
+      files: ['**/inputValidators.ts', '**/*Validator.ts'],
+      rules: {
+        'sonarjs/function-return-type': 'off', // Prisma.JsonValue is a union type by design
+        'eslint-comments/no-use': 'off', // Allow eslint-disable for documented Prisma type usage
+      },
+    },
+
+    // ============================================================================
+    // Override Rules for SDK Core Implementation Files
+    // Allow eslint-disable for documented design decisions
+    // ============================================================================
+    {
+      files: [
+        '**/database/index.ts',
+        '**/middleware/security.ts',
+        '**/event-queue/implementations/**/*.ts',
+        '**/instrumentation/metrics-collector.ts',
+      ],
+      rules: {
+        'eslint-comments/no-use': 'off', // Allow eslint-disable for documented design patterns
+      },
+    },
+
+    // ============================================================================
+    // Override Rules for I18n Translation Loader
+    // Validated file paths from config, not user input
+    // ============================================================================
+    {
+      files: ['**/i18n/loader.ts', '**/i18n/**/loader.ts'],
+      rules: {
+        'security/detect-non-literal-fs-filename': 'off', // File paths validated before fs operations
+        'eslint-comments/no-use': 'off', // Allow eslint-disable for documented safe fs operations
+      },
+    },
+
+    // ============================================================================
+    // Override Rules for Prisma Generator
+    // Validated output paths with security checks
+    // ============================================================================
+    {
+      files: ['**/prisma/generator/**/*.ts', '**/generator/index.ts'],
+      rules: {
+        'security/detect-non-literal-fs-filename': 'off', // Output paths validated before fs operations
+        'eslint-comments/no-use': 'off', // Allow eslint-disable for documented safe fs operations
+      },
+    },
+
+    // ============================================================================
+    // Override Rules for Translation Service with Dynamic RegExp
+    // RegExp patterns from validated translation config, not user input
+    // ============================================================================
+    {
+      files: ['**/translation/index.ts', '**/translation/**/index.ts'],
+      rules: {
+        'security/detect-non-literal-regexp': 'off', // RegExp from validated translation patterns
+        'eslint-comments/no-use': 'off', // Allow eslint-disable for documented safe regex usage
+      },
+    },
+
+    // ============================================================================
+    // Override Rules for Validation Utilities with Dynamic RegExp
+    // RegExp patterns from validated validation rules, not user input
+    // ============================================================================
+    {
+      files: ['**/utils/validation.ts', '**/utils/**/validation.ts'],
+      rules: {
+        'security/detect-non-literal-regexp': 'off', // RegExp from validated validation rules
+        'eslint-comments/no-use': 'off', // Allow eslint-disable for documented safe regex usage
+      },
+    },
+
+    // ============================================================================
+    // Override Rules for Server Backwards Compatibility
+    // IUser is deprecated in favor of IActor, but SDK maintains backwards compat
+    // ============================================================================
+    {
+      files: ['**/server/context.ts', '**/server/types.ts'],
+      rules: {
+        'sonarjs/deprecation': 'off', // Intentional use of deprecated IUser for backwards compatibility
+      },
+    },
+  ];
+}