@burdenoff/be-sdk 2026.510.79

package/dist/chunk-SAG6ZYWQ.js

@@ -0,0 +1,89 @@
+import { __name } from './chunk-XE4OXN2W.js';
+
+// src/types/index.ts
+var SDKError = class _SDKError extends Error {
+  static {
+    __name(this, "SDKError");
+  }
+  code;
+  details;
+  constructor(message, code, details) {
+    super(message), this.code = code, this.details = details;
+    this.name = "SDKError";
+    Object.setPrototypeOf(this, _SDKError.prototype);
+  }
+};
+var PermissionDeniedError = class _PermissionDeniedError extends SDKError {
+  static {
+    __name(this, "PermissionDeniedError");
+  }
+  constructor(message, details) {
+    super(message, "PERMISSION_DENIED", details);
+    this.name = "PermissionDeniedError";
+    Object.setPrototypeOf(this, _PermissionDeniedError.prototype);
+  }
+};
+var AuthenticationError = class _AuthenticationError extends SDKError {
+  static {
+    __name(this, "AuthenticationError");
+  }
+  constructor(message, details) {
+    super(message, "AUTHENTICATION_ERROR", details);
+    this.name = "AuthenticationError";
+    Object.setPrototypeOf(this, _AuthenticationError.prototype);
+  }
+};
+var APIError = class _APIError extends SDKError {
+  static {
+    __name(this, "APIError");
+  }
+  constructor(message, details) {
+    super(message, "API_ERROR", details);
+    this.name = "APIError";
+    Object.setPrototypeOf(this, _APIError.prototype);
+  }
+};
+var ValidationError = class _ValidationError extends SDKError {
+  static {
+    __name(this, "ValidationError");
+  }
+  constructor(message, details) {
+    super(message, "VALIDATION_ERROR", details);
+    this.name = "ValidationError";
+    Object.setPrototypeOf(this, _ValidationError.prototype);
+  }
+};
+var QuotaExceededError = class _QuotaExceededError extends SDKError {
+  static {
+    __name(this, "QuotaExceededError");
+  }
+  constructor(message, details) {
+    super(message, "QUOTA_EXCEEDED", details);
+    this.name = "QuotaExceededError";
+    Object.setPrototypeOf(this, _QuotaExceededError.prototype);
+  }
+};
+var NetworkError = class _NetworkError extends SDKError {
+  static {
+    __name(this, "NetworkError");
+  }
+  constructor(message, details) {
+    super(message, "NETWORK_ERROR", details);
+    this.name = "NetworkError";
+    Object.setPrototypeOf(this, _NetworkError.prototype);
+  }
+};
+var TimeoutError = class _TimeoutError extends SDKError {
+  static {
+    __name(this, "TimeoutError");
+  }
+  constructor(message, details) {
+    super(message, "TIMEOUT_ERROR", details);
+    this.name = "TimeoutError";
+    Object.setPrototypeOf(this, _TimeoutError.prototype);
+  }
+};
+
+export { APIError, AuthenticationError, NetworkError, PermissionDeniedError, QuotaExceededError, TimeoutError, ValidationError };
+//# sourceMappingURL=chunk-SAG6ZYWQ.js.map
+//# sourceMappingURL=chunk-SAG6ZYWQ.js.map

package/dist/chunk-SAG6ZYWQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types/index.ts"],"names":["SDKError","Error","message","code","details","name","Object","setPrototypeOf","prototype","PermissionDeniedError","AuthenticationError","APIError","ValidationError","QuotaExceededError","NetworkError","TimeoutError"],"mappings":";;;AAqGO,IAAMA,QAAAA,GAAN,MAAMA,SAAAA,SAAiBC,KAAAA,CAAAA;EArG9B;;;;;EAsGE,WAAA,CACEC,OAAAA,EACOC,MACAC,OAAAA,EACP;AACA,IAAA,KAAA,CAAMF,OAAAA,CAAAA,EAAAA,IAAAA,CAHCC,IAAAA,GAAAA,IAAAA,EAAAA,KACAC,OAAAA,GAAAA,OAAAA;AAGP,IAAA,IAAA,CAAKC,IAAAA,GAAO,UAAA;AACZC,IAAAA,MAAAA,CAAOC,cAAAA,CAAe,IAAA,EAAMP,SAAAA,CAASQ,SAAS,CAAA;AAChD,EAAA;AACF,CAAA;AAKO,IAAMC,qBAAAA,GAAN,MAAMA,sBAAAA,SAA8BT,QAAAA,CAAAA;EApH3C;;;AAqHE,EAAA,WAAA,CAAYE,SAAiBE,OAAAA,EAAmC;AAC9D,IAAA,KAAA,CAAMF,OAAAA,EAAS,qBAAqBE,OAAAA,CAAAA;AACpC,IAAA,IAAA,CAAKC,IAAAA,GAAO,uBAAA;AACZC,IAAAA,MAAAA,CAAOC,cAAAA,CAAe,IAAA,EAAME,sBAAAA,CAAsBD,SAAS,CAAA;AAC7D,EAAA;AACF;AAKO,IAAME,mBAAAA,GAAN,MAAMA,oBAAAA,SAA4BV,QAAAA,CAAAA;EA/HzC;;;AAgIE,EAAA,WAAA,CAAYE,SAAiBE,OAAAA,EAAmC;AAC9D,IAAA,KAAA,CAAMF,OAAAA,EAAS,wBAAwBE,OAAAA,CAAAA;AACvC,IAAA,IAAA,CAAKC,IAAAA,GAAO,qBAAA;AACZC,IAAAA,MAAAA,CAAOC,cAAAA,CAAe,IAAA,EAAMG,oBAAAA,CAAoBF,SAAS,CAAA;AAC3D,EAAA;AACF;AAKO,IAAMG,QAAAA,GAAN,MAAMA,SAAAA,SAAiBX,QAAAA,CAAAA;EA1I9B;;;AA2IE,EAAA,WAAA,CAAYE,SAAiBE,OAAAA,EAAmC;AAC9D,IAAA,KAAA,CAAMF,OAAAA,EAAS,aAAaE,OAAAA,CAAAA;AAC5B,IAAA,IAAA,CAAKC,IAAAA,GAAO,UAAA;AACZC,IAAAA,MAAAA,CAAOC,cAAAA,CAAe,IAAA,EAAMI,SAAAA,CAASH,SAAS,CAAA;AAChD,EAAA;AACF;AAKO,IAAMI,eAAAA,GAAN,MAAMA,gBAAAA,SAAwBZ,QAAAA,CAAAA;EArJrC;;;AAsJE,EAAA,WAAA,CAAYE,SAAiBE,OAAAA,EAAmC;AAC9D,IAAA,KAAA,CAAMF,OAAAA,EAAS,oBAAoBE,OAAAA,CAAAA;AACnC,IAAA,IAAA,CAAKC,IAAAA,GAAO,iBAAA;AACZC,IAAAA,MAAAA,CAAOC,cAAAA,CAAe,IAAA,EAAMK,gBAAAA,CAAgBJ,SAAS,CAAA;AACvD,EAAA;AACF;AAKO,IAAMK,kBAAAA,GAAN,MAAMA,mBAAAA,SAA2Bb,QAAAA,CAAAA;EAhKxC;;;AAiKE,EAAA,WAAA,CAAYE,SAAiBE,OAAAA,EAAmC;AAC9D,IAAA,KAAA,CAAMF,OAAAA,EAAS,kBAAkBE,OAAAA,CAAAA;AACjC,IAAA,IAAA,CAAKC,IAAAA,GAAO,oBAAA;AACZC,IAAAA,MAAAA,CAAOC,cAAAA,CAAe,IAAA,EAAMM,mBAAAA,CAAmBL,SAAS,CAAA;AAC1D,EAAA;AACF;AAKO,IAAMM,YAAAA,GAAN,MAAMA,aAAAA,SAAqBd,QAAAA,CAAAA;EA3KlC;;;AA4KE,EAAA,WAAA,CAAYE,SAAiBE,OAAAA,EAAmC;AAC9D,IAAA,KAAA,CAAMF,OAAAA,EAAS,iBAAiBE,OAAAA,CAAAA;AAChC,IAAA,IAAA,CAAKC,IAAAA,GAAO,cAAA;AACZC,IAAAA,MAAAA,CAAOC,cAAAA,CAAe,IAAA,EAAMO,aAAAA,CAAaN,SAAS,CAAA;AACpD,EAAA;AACF;AAKO,IAAMO,YAAAA,GAAN,MAAMA,aAAAA,SAAqBf,QAAAA,CAAAA;EAtLlC;;;AAuLE,EAAA,WAAA,CAAYE,SAAiBE,OAAAA,EAAmC;AAC9D,IAAA,KAAA,CAAMF,OAAAA,EAAS,iBAAiBE,OAAAA,CAAAA;AAChC,IAAA,IAAA,CAAKC,IAAAA,GAAO,cAAA;AACZC,IAAAA,MAAAA,CAAOC,cAAAA,CAAe,IAAA,EAAMQ,aAAAA,CAAaP,SAAS,CAAA;AACpD,EAAA;AACF","file":"chunk-SAG6ZYWQ.js","sourcesContent":["/**\n * Core type definitions for Burdenoff Backend SDK\n */\n\n/**\n * SDK Configuration\n */\nexport interface SDKConfig {\n  /** Workspaces API GraphQL endpoint (should point to wspace-int-gateway for M2M calls) */\n  workspacesApiUrl: string;\n  /** Tenant API GraphQL endpoint (should point to global-int-gateway for M2M calls) */\n  tenantApiUrl?: string;\n  /** Default timeout for API requests in milliseconds */\n  timeout?: number;\n  /** Retry configuration */\n  retry?: RetryConfig;\n  /** Logger configuration */\n  logger?: LoggerConfig;\n  /** NATS configuration */\n  nats?: NATSSDKConfig;\n  /** Temporal module type (workspace or tenant) */\n  temporalModuleType?: 'workspace' | 'tenant';\n  /** Temporal server address */\n  temporalAddress?: string;\n  /** Temporal namespace */\n  temporalNamespace?: string;\n  /** Temporal task queue */\n  temporalTaskQueue?: string;\n  /** Auto-connect to Temporal (default: true) */\n  temporalAutoConnect?: boolean;\n}\n\n/**\n * Retry configuration for API requests\n */\nexport interface RetryConfig {\n  /** Maximum number of retry attempts */\n  maxAttempts: number;\n  /** Initial retry delay in milliseconds */\n  initialDelay: number;\n  /** Maximum retry delay in milliseconds */\n  maxDelay: number;\n  /** Backoff multiplier */\n  backoffMultiplier: number;\n}\n\n/**\n * Logger configuration\n */\nexport interface LoggerConfig {\n  /** Log level */\n  level: 'debug' | 'info' | 'warn' | 'error';\n  /** Enable console output */\n  console: boolean;\n  /** Custom logger transport */\n  transport?: LoggerTransport;\n}\n\n/**\n * Custom logger transport interface\n */\nexport interface LoggerTransport {\n  log(level: string, message: string, meta?: Record<string, unknown>): void;\n}\n\n/**\n * Actor type for RBAC authorization\n * - user: Direct user request (via frontend)\n * - app: OAuth app acting on behalf of user\n * - service: M2M service-to-service communication\n * - super_admin: Platform administration (bypasses all checks)\n */\nexport type ActorType = 'user' | 'app' | 'service' | 'super_admin';\n\n/**\n * Request context passed with every SDK operation\n */\nexport interface SDKContext {\n  /** Actor ID - identifies the entity making the request */\n  actorId?: string;\n  /** Actor type - determines authorization behavior */\n  actorType?: ActorType;\n  /** Workspace ID */\n  workspaceId?: string;\n  /** Tenant ID */\n  tenantId?: string;\n  /** Project ID */\n  projectId?: string;\n  /** App ID */\n  appId?: string;\n  /** JWT token for authentication */\n  token?: string;\n  /** Product ID */\n  productId?: string;\n  /** Additional custom context */\n  [key: string]: unknown;\n}\n\n/**\n * SDK Error base class\n */\nexport class SDKError extends Error {\n  constructor(\n    message: string,\n    public code: string,\n    public details?: Record<string, unknown>\n  ) {\n    super(message);\n    this.name = 'SDKError';\n    Object.setPrototypeOf(this, SDKError.prototype);\n  }\n}\n\n/**\n * Permission denied error\n */\nexport class PermissionDeniedError extends SDKError {\n  constructor(message: string, details?: Record<string, unknown>) {\n    super(message, 'PERMISSION_DENIED', details);\n    this.name = 'PermissionDeniedError';\n    Object.setPrototypeOf(this, PermissionDeniedError.prototype);\n  }\n}\n\n/**\n * Authentication error\n */\nexport class AuthenticationError extends SDKError {\n  constructor(message: string, details?: Record<string, unknown>) {\n    super(message, 'AUTHENTICATION_ERROR', details);\n    this.name = 'AuthenticationError';\n    Object.setPrototypeOf(this, AuthenticationError.prototype);\n  }\n}\n\n/**\n * API error from backend\n */\nexport class APIError extends SDKError {\n  constructor(message: string, details?: Record<string, unknown>) {\n    super(message, 'API_ERROR', details);\n    this.name = 'APIError';\n    Object.setPrototypeOf(this, APIError.prototype);\n  }\n}\n\n/**\n * Validation error\n */\nexport class ValidationError extends SDKError {\n  constructor(message: string, details?: Record<string, unknown>) {\n    super(message, 'VALIDATION_ERROR', details);\n    this.name = 'ValidationError';\n    Object.setPrototypeOf(this, ValidationError.prototype);\n  }\n}\n\n/**\n * Quota exceeded error\n */\nexport class QuotaExceededError extends SDKError {\n  constructor(message: string, details?: Record<string, unknown>) {\n    super(message, 'QUOTA_EXCEEDED', details);\n    this.name = 'QuotaExceededError';\n    Object.setPrototypeOf(this, QuotaExceededError.prototype);\n  }\n}\n\n/**\n * Network error\n */\nexport class NetworkError extends SDKError {\n  constructor(message: string, details?: Record<string, unknown>) {\n    super(message, 'NETWORK_ERROR', details);\n    this.name = 'NetworkError';\n    Object.setPrototypeOf(this, NetworkError.prototype);\n  }\n}\n\n/**\n * Timeout error\n */\nexport class TimeoutError extends SDKError {\n  constructor(message: string, details?: Record<string, unknown>) {\n    super(message, 'TIMEOUT_ERROR', details);\n    this.name = 'TimeoutError';\n    Object.setPrototypeOf(this, TimeoutError.prototype);\n  }\n}\n\n/**\n * NATS SDK Configuration\n */\nexport interface NATSSDKConfig {\n  /** NATS server URL (single URL, preferred) */\n  url?: string;\n  /** NATS server URLs (array, alternative to url) */\n  servers?: string[];\n  /** Username for authentication */\n  user?: string;\n  /** Password for authentication */\n  password?: string;\n  /** Token for authentication */\n  token?: string;\n  /** Maximum reconnect attempts (default: -1 = infinite) */\n  maxReconnectAttempts?: number;\n  /** Reconnect time wait in milliseconds (default: 2000) */\n  reconnectTimeWait?: number;\n  /** Client name for logging (default: service name) */\n  name?: string;\n  /** Auto-connect on SDK initialization (default: true) */\n  autoConnect?: boolean;\n}\n\n/**\n * NATS health status\n */\nexport interface NatsHealthStatus {\n  status: 'healthy' | 'unhealthy' | 'not_configured';\n  connected: boolean;\n  url?: string;\n  details?: Record<string, unknown>;\n}\n\n/**\n * Temporal health status\n */\nexport interface TemporalHealthStatus {\n  status: 'healthy' | 'unhealthy' | 'not_configured';\n  connected: boolean;\n  address?: string;\n  namespace?: string;\n  details?: Record<string, unknown>;\n}\n\n/**\n * Overall SDK health status\n */\nexport interface SDKHealthStatus {\n  nats: NatsHealthStatus;\n  temporal: TemporalHealthStatus;\n}\n\n/**\n * SDK shutdown options\n */\nexport interface SDKShutdownOptions {\n  /** Shutdown timeout in milliseconds (default: 5000) */\n  timeout?: number;\n  /** Force shutdown even if timeout is exceeded (default: true) */\n  force?: boolean;\n}\n\n// ============================================================================\n// Layer Types Export\n// ============================================================================\n\n/**\n * Re-export all layer-related types for convenience\n */\nexport type {\n  ServiceLayer,\n  LayerConfig,\n  LayerGatewayConfig,\n  LayerResourceUrls,\n  LayerFullConfig,\n  GatewayRoutingConfig,\n  CircuitBreakerConfig,\n  GatewayRetryConfig,\n  GatewayRequestHeaders,\n} from './layer.js';\n\nexport {\n  DEFAULT_GATEWAY_ROUTING,\n  DEFAULT_LAYER_RESOURCES,\n  DEFAULT_LAYER_STREAMS,\n  DEFAULT_CIRCUIT_BREAKER_CONFIG,\n  DEFAULT_GATEWAY_RETRY_CONFIG,\n} from './layer.js';\n"]}

package/dist/chunk-SAK2JCA7.js

@@ -0,0 +1,198 @@
+import { isTokenExpired, parseJWT } from './chunk-MOCUBSTW.js';
+import { AuthenticationError } from './chunk-SAG6ZYWQ.js';
+import { logger } from './chunk-CBZNP6RF.js';
+import { __name } from './chunk-XE4OXN2W.js';
+
+// src/auth/index.ts
+var ACCESS_TOKEN_COOKIE = "bf_access_token";
+var REFRESH_TOKEN_COOKIE = "bf_refresh_token";
+var ACCESS_TOKEN_MAX_AGE = 15 * 60;
+var REFRESH_TOKEN_MAX_AGE = 30 * 24 * 60 * 60;
+var REFRESH_TOKEN_REMEMBER_MAX_AGE = 30 * 24 * 60 * 60;
+function buildCookieString(name, value, maxAge) {
+  return `${name}=${value}; Max-Age=${maxAge}; Path=/; HttpOnly; SameSite=Strict`;
+}
+__name(buildCookieString, "buildCookieString");
+function buildClearCookieString(name) {
+  return `${name}=; Max-Age=0; Path=/; HttpOnly; SameSite=Strict`;
+}
+__name(buildClearCookieString, "buildClearCookieString");
+var AuthCookieHelper = {
+  setAuthCookies(context, tokens, options) {
+    const headers = context.responseHeaders;
+    if (!headers) return;
+    const rememberMe = options?.rememberMe ?? false;
+    const refreshMaxAge = rememberMe ? REFRESH_TOKEN_REMEMBER_MAX_AGE : REFRESH_TOKEN_MAX_AGE;
+    headers.append("Set-Cookie", buildCookieString(ACCESS_TOKEN_COOKIE, tokens.accessToken, ACCESS_TOKEN_MAX_AGE));
+    headers.append("Set-Cookie", buildCookieString(REFRESH_TOKEN_COOKIE, tokens.refreshToken, refreshMaxAge));
+  },
+  clearAuthCookies(context) {
+    const headers = context.responseHeaders;
+    if (!headers) return;
+    headers.append("Set-Cookie", buildClearCookieString(ACCESS_TOKEN_COOKIE));
+    headers.append("Set-Cookie", buildClearCookieString(REFRESH_TOKEN_COOKIE));
+  }
+};
+var AuthModule = class {
+  static {
+    __name(this, "AuthModule");
+  }
+  client;
+  context;
+  constructor(client, context) {
+    this.client = client;
+    this.context = context;
+  }
+  /**
+  * Verify JWT token
+  */
+  async verifyToken(token) {
+    logger.debug("[Auth] Verifying token");
+    if (isTokenExpired(token)) {
+      return {
+        valid: false,
+        error: "Token expired"
+      };
+    }
+    const query = `
+      query VerifyToken($token: String!) {
+        verifyToken(token: $token) {
+          valid
+          payload
+          error
+        }
+      }
+    `;
+    try {
+      const response = await this.client.query(query, {
+        token
+      }, this.context);
+      logger.debug("[Auth] Token verification result", {
+        valid: response.verifyToken.valid
+      });
+      return response.verifyToken;
+    } catch (error) {
+      logger.error("[Auth] Token verification failed", {
+        error
+      });
+      return {
+        valid: false,
+        error: error instanceof Error ? error.message : "Unknown error"
+      };
+    }
+  }
+  /**
+  * Decode token without verification
+  */
+  decodeToken(token) {
+    const payload = parseJWT(token);
+    if (!payload) {
+      return null;
+    }
+    return payload;
+  }
+  /**
+  * Refresh access token using refresh token
+  */
+  async refreshToken(refreshToken) {
+    logger.debug("[Auth] Refreshing token");
+    const mutation = `
+      mutation RefreshToken($refreshToken: String!) {
+        refreshToken(refreshToken: $refreshToken) {
+          accessToken
+          refreshToken
+          expiresIn
+        }
+      }
+    `;
+    try {
+      const response = await this.client.query(mutation, {
+        refreshToken
+      }, this.context);
+      logger.info("[Auth] Token refreshed successfully");
+      return response.refreshToken;
+    } catch (error) {
+      logger.error("[Auth] Token refresh failed", {
+        error
+      });
+      throw new AuthenticationError("Failed to refresh token", {
+        error: error instanceof Error ? error.message : "Unknown error"
+      });
+    }
+  }
+  /**
+  * Validate user has specific permission
+  */
+  async validatePermission(userId, permission, resourceId) {
+    logger.debug("[Auth] Validating permission", {
+      userId,
+      permission,
+      resourceId
+    });
+    const query = `
+      query ValidatePermission($userId: ID!, $permission: String!, $resourceId: ID) {
+        validatePermission(userId: $userId, permission: $permission, resourceId: $resourceId) {
+          allowed
+        }
+      }
+    `;
+    try {
+      const response = await this.client.query(query, {
+        userId,
+        permission,
+        resourceId
+      }, this.context);
+      logger.debug("[Auth] Permission validation result", {
+        allowed: response.validatePermission.allowed
+      });
+      return response.validatePermission.allowed;
+    } catch (error) {
+      logger.error("[Auth] Permission validation failed", {
+        error
+      });
+      return false;
+    }
+  }
+  /**
+  * Check if token is valid and not expired
+  */
+  isTokenValid(token) {
+    return !isTokenExpired(token);
+  }
+  /**
+  * Get user ID from token
+  */
+  getUserIdFromToken(token) {
+    const payload = this.decodeToken(token);
+    return payload?.user_id || null;
+  }
+  /**
+  * Get workspace ID from token
+  */
+  getWorkspaceIdFromToken(token) {
+    const payload = this.decodeToken(token);
+    return payload?.workspace_id || null;
+  }
+  /**
+  * Extract all claims from token
+  */
+  getTokenClaims(token) {
+    const payload = parseJWT(token);
+    return payload;
+  }
+  /**
+  * Check if token will expire soon (within given seconds)
+  */
+  willExpireSoon(token, withinSeconds = 300) {
+    const payload = this.decodeToken(token);
+    if (!payload || typeof payload.exp !== "number") {
+      return true;
+    }
+    const now = Math.floor(Date.now() / 1e3);
+    return payload.exp - now < withinSeconds;
+  }
+};
+
+export { AuthCookieHelper, AuthModule };
+//# sourceMappingURL=chunk-SAK2JCA7.js.map
+//# sourceMappingURL=chunk-SAK2JCA7.js.map

package/dist/chunk-SAK2JCA7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth/index.ts"],"names":["ACCESS_TOKEN_COOKIE","REFRESH_TOKEN_COOKIE","ACCESS_TOKEN_MAX_AGE","REFRESH_TOKEN_MAX_AGE","REFRESH_TOKEN_REMEMBER_MAX_AGE","buildCookieString","name","value","maxAge","buildClearCookieString","AuthCookieHelper","setAuthCookies","context","tokens","options","headers","responseHeaders","rememberMe","refreshMaxAge","append","accessToken","refreshToken","clearAuthCookies","AuthModule","client","verifyToken","token","logger","debug","isTokenExpired","valid","error","query","response","Error","message","decodeToken","payload","parseJWT","mutation","info","AuthenticationError","validatePermission","userId","permission","resourceId","allowed","isTokenValid","getUserIdFromToken","user_id","getWorkspaceIdFromToken","workspace_id","getTokenClaims","willExpireSoon","withinSeconds","exp","now","Math","floor","Date"],"mappings":";;;;;;AAgBA,IAAMA,mBAAAA,GAAsB,iBAAA;AAC5B,IAAMC,oBAAAA,GAAuB,kBAAA;AAC7B,IAAMC,uBAAuB,EAAA,GAAK,EAAA;AAClC,IAAMC,qBAAAA,GAAwB,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAC7C,IAAMC,8BAAAA,GAAiC,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAEtD,SAASC,iBAAAA,CAAkBC,IAAAA,EAAcC,KAAAA,EAAeC,MAAAA,EAAc;AACpE,EAAA,OAAO,CAAA,EAAGF,IAAAA,CAAAA,CAAAA,EAAQC,KAAAA,aAAkBC,MAAAA,CAAAA,mCAAAA,CAAAA;AACtC;AAFSH,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAIT,SAASI,uBAAuBH,IAAAA,EAAY;AAC1C,EAAA,OAAO,GAAGA,IAAAA,CAAAA,+CAAAA,CAAAA;AACZ;AAFSG,MAAAA,CAAAA,sBAAAA,EAAAA,wBAAAA,CAAAA;AAIF,IAAMC,gBAAAA,GAAmB;EAC9BC,cAAAA,CACEC,OAAAA,EACAC,QACAC,OAAAA,EAAkC;AAElC,IAAA,MAAMC,UAAUH,OAAAA,CAAQI,eAAAA;AACxB,IAAA,IAAI,CAACD,OAAAA,EAAS;AAEd,IAAA,MAAME,UAAAA,GAAaH,SAASG,UAAAA,IAAc,KAAA;AAC1C,IAAA,MAAMC,aAAAA,GAAgBD,aAAab,8BAAAA,GAAiCD,qBAAAA;AAEpEY,IAAAA,OAAAA,CAAQI,OAAO,YAAA,EAAcd,iBAAAA,CAAkBL,qBAAqBa,MAAAA,CAAOO,WAAAA,EAAalB,oBAAAA,CAAAA,CAAAA;AACxFa,IAAAA,OAAAA,CAAQI,OAAO,YAAA,EAAcd,iBAAAA,CAAkBJ,sBAAsBY,MAAAA,CAAOQ,YAAAA,EAAcH,aAAAA,CAAAA,CAAAA;AAC5F,EAAA,CAAA;AAEAI,EAAAA,gBAAAA,CAAiBV,OAAAA,EAAsB;AACrC,IAAA,MAAMG,UAAUH,OAAAA,CAAQI,eAAAA;AACxB,IAAA,IAAI,CAACD,OAAAA,EAAS;AAEdA,IAAAA,OAAAA,CAAQI,MAAAA,CAAO,YAAA,EAAcV,sBAAAA,CAAuBT,mBAAAA,CAAAA,CAAAA;AACpDe,IAAAA,OAAAA,CAAQI,MAAAA,CAAO,YAAA,EAAcV,sBAAAA,CAAuBR,oBAAAA,CAAAA,CAAAA;AACtD,EAAA;AACF;AA+BO,IAAMsB,aAAN,MAAMA;EApFb;;;;;AAqFE,EAAA,WAAA,CACUC,QACAZ,OAAAA,EACR;SAFQY,MAAAA,GAAAA,MAAAA;SACAZ,OAAAA,GAAAA,OAAAA;AACP,EAAA;;;;AAKH,EAAA,MAAaa,YAAYC,KAAAA,EAA2C;AAClEC,IAAAA,MAAAA,CAAOC,MAAM,wBAAA,CAAA;AAGb,IAAA,IAAIC,cAAAA,CAAeH,KAAAA,CAAAA,EAAQ;AACzB,MAAA,OAAO;QACLI,KAAAA,EAAO,KAAA;QACPC,KAAAA,EAAO;AACT,OAAA;AACF,IAAA;AAEA,IAAA,MAAMC,KAAAA,GAAQ;;;;;;;;;AAUd,IAAA,IAAI;AACF,MAAA,MAAMC,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MAA0CA,KAAAA,EAAO;AAAEN,QAAAA;AAAM,OAAA,EAAG,KAAKd,OAAO,CAAA;AAE3Ge,MAAAA,MAAAA,CAAOC,MAAM,kCAAA,EAAoC;AAAEE,QAAAA,KAAAA,EAAOG,SAASR,WAAAA,CAAYK;OAAM,CAAA;AAErF,MAAA,OAAOG,QAAAA,CAASR,WAAAA;AAClB,IAAA,CAAA,CAAA,OAASM,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,kCAAA,EAAoC;AAAEA,QAAAA;OAAM,CAAA;AACzD,MAAA,OAAO;QACLD,KAAAA,EAAO,KAAA;QACPC,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMI,OAAAA,GAAU;AAClD,OAAA;AACF,IAAA;AACF,EAAA;;;;AAKOC,EAAAA,WAAAA,CAAYV,KAAAA,EAAoC;AACrD,IAAA,MAAMW,OAAAA,GAAUC,SAASZ,KAAAA,CAAAA;AACzB,IAAA,IAAI,CAACW,OAAAA,EAAS;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AACA,IAAA,OAAOA,OAAAA;AACT,EAAA;;;;AAKA,EAAA,MAAahB,aAAaA,YAAAA,EAAmD;AAC3EM,IAAAA,MAAAA,CAAOC,MAAM,yBAAA,CAAA;AAEb,IAAA,MAAMW,QAAAA,GAAW;;;;;;;;;AAUjB,IAAA,IAAI;AACF,MAAA,MAAMN,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MACjCO,QAAAA,EACA;AAAElB,QAAAA;AAAa,OAAA,EACf,KAAKT,OAAO,CAAA;AAGde,MAAAA,MAAAA,CAAOa,KAAK,qCAAA,CAAA;AAEZ,MAAA,OAAOP,QAAAA,CAASZ,YAAAA;AAClB,IAAA,CAAA,CAAA,OAASU,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,6BAAA,EAA+B;AAAEA,QAAAA;OAAM,CAAA;AACpD,MAAA,MAAM,IAAIU,oBAAoB,yBAAA,EAA2B;QACvDV,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMI,OAAAA,GAAU;OAClD,CAAA;AACF,IAAA;AACF,EAAA;;;;EAKA,MAAaO,kBAAAA,CAAmBC,MAAAA,EAAgBC,UAAAA,EAAoBC,UAAAA,EAAuC;AACzGlB,IAAAA,MAAAA,CAAOC,MAAM,8BAAA,EAAgC;AAAEe,MAAAA,MAAAA;AAAQC,MAAAA,UAAAA;AAAYC,MAAAA;KAAW,CAAA;AAE9E,IAAA,MAAMb,KAAAA,GAAQ;;;;;;;AAQd,IAAA,IAAI;AACF,MAAA,MAAMC,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MAEhCA,KAAAA,EAAO;AAAEW,QAAAA,MAAAA;AAAQC,QAAAA,UAAAA;AAAYC,QAAAA;AAAW,OAAA,EAAG,KAAKjC,OAAO,CAAA;AAE1De,MAAAA,MAAAA,CAAOC,MAAM,qCAAA,EAAuC;AAClDkB,QAAAA,OAAAA,EAASb,SAASS,kBAAAA,CAAmBI;OACvC,CAAA;AAEA,MAAA,OAAOb,SAASS,kBAAAA,CAAmBI,OAAAA;AACrC,IAAA,CAAA,CAAA,OAASf,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,qCAAA,EAAuC;AAAEA,QAAAA;OAAM,CAAA;AAC5D,MAAA,OAAO,KAAA;AACT,IAAA;AACF,EAAA;;;;AAKOgB,EAAAA,YAAAA,CAAarB,KAAAA,EAAwB;AAC1C,IAAA,OAAO,CAACG,eAAeH,KAAAA,CAAAA;AACzB,EAAA;;;;AAKOsB,EAAAA,kBAAAA,CAAmBtB,KAAAA,EAA8B;AACtD,IAAA,MAAMW,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,OAAOW,SAASY,OAAAA,IAAW,IAAA;AAC7B,EAAA;;;;AAKOC,EAAAA,uBAAAA,CAAwBxB,KAAAA,EAA8B;AAC3D,IAAA,MAAMW,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,OAAOW,SAASc,YAAAA,IAAgB,IAAA;AAClC,EAAA;;;;AAKOC,EAAAA,cAAAA,CAAe1B,KAAAA,EAA+C;AACnE,IAAA,MAAMW,OAAAA,GAAUC,SAASZ,KAAAA,CAAAA;AACzB,IAAA,OAAOW,OAAAA;AACT,EAAA;;;;EAKOgB,cAAAA,CAAe3B,KAAAA,EAAe4B,gBAAwB,GAAA,EAAc;AACzE,IAAA,MAAMjB,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,IAAI,CAACW,OAAAA,IAAW,OAAOA,OAAAA,CAAQkB,QAAQ,QAAA,EAAU;AAC/C,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMC,MAAMC,IAAAA,CAAKC,KAAAA,CAAMC,IAAAA,CAAKH,GAAAA,KAAQ,GAAA,CAAA;AACpC,IAAA,OAAOnB,OAAAA,CAAQkB,MAAMC,GAAAA,GAAMF,aAAAA;AAC7B,EAAA;AACF","file":"chunk-SAK2JCA7.js","sourcesContent":["/**\n * Authentication Module\n * JWT verification, token management, and user authentication\n */\n\nimport type { BurdenoffGraphQLClient } from '../client/graphql.js';\nimport type { SDKContext } from '../types/index.js';\nimport { AuthenticationError } from '../types/index.js';\nimport { logger } from '../logger/index.js';\nimport { parseJWT, isTokenExpired } from '../utils/index.js';\n\ninterface CookieContext {\n  responseHeaders?: Headers;\n  [key: string]: unknown;\n}\n\nconst ACCESS_TOKEN_COOKIE = 'bf_access_token';\nconst REFRESH_TOKEN_COOKIE = 'bf_refresh_token';\nconst ACCESS_TOKEN_MAX_AGE = 15 * 60; // 15 minutes\nconst REFRESH_TOKEN_MAX_AGE = 30 * 24 * 60 * 60; // 30 days\nconst REFRESH_TOKEN_REMEMBER_MAX_AGE = 30 * 24 * 60 * 60; // 30 days (same, controlled by backend)\n\nfunction buildCookieString(name: string, value: string, maxAge: number): string {\n  return `${name}=${value}; Max-Age=${maxAge}; Path=/; HttpOnly; SameSite=Strict`;\n}\n\nfunction buildClearCookieString(name: string): string {\n  return `${name}=; Max-Age=0; Path=/; HttpOnly; SameSite=Strict`;\n}\n\nexport const AuthCookieHelper = {\n  setAuthCookies(\n    context: CookieContext,\n    tokens: { accessToken: string; refreshToken: string },\n    options?: { rememberMe?: boolean }\n  ): void {\n    const headers = context.responseHeaders;\n    if (!headers) return;\n\n    const rememberMe = options?.rememberMe ?? false;\n    const refreshMaxAge = rememberMe ? REFRESH_TOKEN_REMEMBER_MAX_AGE : REFRESH_TOKEN_MAX_AGE;\n\n    headers.append('Set-Cookie', buildCookieString(ACCESS_TOKEN_COOKIE, tokens.accessToken, ACCESS_TOKEN_MAX_AGE));\n    headers.append('Set-Cookie', buildCookieString(REFRESH_TOKEN_COOKIE, tokens.refreshToken, refreshMaxAge));\n  },\n\n  clearAuthCookies(context: CookieContext): void {\n    const headers = context.responseHeaders;\n    if (!headers) return;\n\n    headers.append('Set-Cookie', buildClearCookieString(ACCESS_TOKEN_COOKIE));\n    headers.append('Set-Cookie', buildClearCookieString(REFRESH_TOKEN_COOKIE));\n  },\n};\n\nexport interface TokenPayload {\n  jti: string;\n  sub: string;\n  user_id: string;\n  workspace_id?: string;\n  org_id?: string;\n  tenant_endpoint?: string;\n  iat: number;\n  exp: number;\n  scope?: string;\n}\n\nexport interface VerifyTokenResult {\n  valid: boolean;\n  payload?: TokenPayload;\n  error?: string;\n}\n\nexport interface RefreshTokenResult {\n  accessToken: string;\n  refreshToken: string;\n  expiresIn: number;\n}\n\nexport * from './cookie-helper.js';\n\n/**\n * Authentication Module\n */\nexport class AuthModule {\n  constructor(\n    private client: BurdenoffGraphQLClient,\n    private context: SDKContext\n  ) {}\n\n  /**\n   * Verify JWT token\n   */\n  public async verifyToken(token: string): Promise<VerifyTokenResult> {\n    logger.debug('[Auth] Verifying token');\n\n    // First check if token is expired locally\n    if (isTokenExpired(token)) {\n      return {\n        valid: false,\n        error: 'Token expired',\n      };\n    }\n\n    const query = `\n      query VerifyToken($token: String!) {\n        verifyToken(token: $token) {\n          valid\n          payload\n          error\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{ verifyToken: VerifyTokenResult }>(query, { token }, this.context);\n\n      logger.debug('[Auth] Token verification result', { valid: response.verifyToken.valid });\n\n      return response.verifyToken;\n    } catch (error) {\n      logger.error('[Auth] Token verification failed', { error });\n      return {\n        valid: false,\n        error: error instanceof Error ? error.message : 'Unknown error',\n      };\n    }\n  }\n\n  /**\n   * Decode token without verification\n   */\n  public decodeToken(token: string): TokenPayload | null {\n    const payload = parseJWT(token);\n    if (!payload) {\n      return null;\n    }\n    return payload as unknown as TokenPayload;\n  }\n\n  /**\n   * Refresh access token using refresh token\n   */\n  public async refreshToken(refreshToken: string): Promise<RefreshTokenResult> {\n    logger.debug('[Auth] Refreshing token');\n\n    const mutation = `\n      mutation RefreshToken($refreshToken: String!) {\n        refreshToken(refreshToken: $refreshToken) {\n          accessToken\n          refreshToken\n          expiresIn\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{ refreshToken: RefreshTokenResult }>(\n        mutation,\n        { refreshToken },\n        this.context\n      );\n\n      logger.info('[Auth] Token refreshed successfully');\n\n      return response.refreshToken;\n    } catch (error) {\n      logger.error('[Auth] Token refresh failed', { error });\n      throw new AuthenticationError('Failed to refresh token', {\n        error: error instanceof Error ? error.message : 'Unknown error',\n      });\n    }\n  }\n\n  /**\n   * Validate user has specific permission\n   */\n  public async validatePermission(userId: string, permission: string, resourceId?: string): Promise<boolean> {\n    logger.debug('[Auth] Validating permission', { userId, permission, resourceId });\n\n    const query = `\n      query ValidatePermission($userId: ID!, $permission: String!, $resourceId: ID) {\n        validatePermission(userId: $userId, permission: $permission, resourceId: $resourceId) {\n          allowed\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{\n        validatePermission: { allowed: boolean };\n      }>(query, { userId, permission, resourceId }, this.context);\n\n      logger.debug('[Auth] Permission validation result', {\n        allowed: response.validatePermission.allowed,\n      });\n\n      return response.validatePermission.allowed;\n    } catch (error) {\n      logger.error('[Auth] Permission validation failed', { error });\n      return false;\n    }\n  }\n\n  /**\n   * Check if token is valid and not expired\n   */\n  public isTokenValid(token: string): boolean {\n    return !isTokenExpired(token);\n  }\n\n  /**\n   * Get user ID from token\n   */\n  public getUserIdFromToken(token: string): string | null {\n    const payload = this.decodeToken(token);\n    return payload?.user_id || null;\n  }\n\n  /**\n   * Get workspace ID from token\n   */\n  public getWorkspaceIdFromToken(token: string): string | null {\n    const payload = this.decodeToken(token);\n    return payload?.workspace_id || null;\n  }\n\n  /**\n   * Extract all claims from token\n   */\n  public getTokenClaims(token: string): Record<string, unknown> | null {\n    const payload = parseJWT(token);\n    return payload;\n  }\n\n  /**\n   * Check if token will expire soon (within given seconds)\n   */\n  public willExpireSoon(token: string, withinSeconds: number = 300): boolean {\n    const payload = this.decodeToken(token);\n    if (!payload || typeof payload.exp !== 'number') {\n      return true;\n    }\n\n    const now = Math.floor(Date.now() / 1000);\n    return payload.exp - now < withinSeconds;\n  }\n}\n"]}

package/dist/chunk-SBS4S2PJ.js

@@ -0,0 +1,100 @@
+import { __export, __name } from './chunk-XE4OXN2W.js';
+import crypto from 'crypto';
+
+// src/crypto/index.ts
+var crypto_exports = {};
+__export(crypto_exports, {
+  decrypt: () => decrypt,
+  decryptIfNeeded: () => decryptIfNeeded,
+  encrypt: () => encrypt,
+  encryptIfNeeded: () => encryptIfNeeded,
+  generateEncryptionKey: () => generateEncryptionKey,
+  isEncrypted: () => isEncrypted
+});
+var ALGORITHM = "aes-256-gcm";
+var IV_LENGTH = 16;
+var AUTH_TAG_LENGTH = 16;
+function encrypt(text, key) {
+  if (!text) {
+    throw new Error("Text to encrypt cannot be empty");
+  }
+  if (!key || key.length !== 64) {
+    throw new Error("Encryption key must be a 64-character hex string (32 bytes)");
+  }
+  const iv = crypto.randomBytes(IV_LENGTH);
+  const cipher = crypto.createCipheriv(ALGORITHM, Buffer.from(key, "hex"), iv);
+  let encrypted = cipher.update(text, "utf8", "hex");
+  encrypted += cipher.final("hex");
+  const authTag = cipher.getAuthTag();
+  return `${iv.toString("hex")}:${authTag.toString("hex")}:${encrypted}`;
+}
+__name(encrypt, "encrypt");
+function decrypt(encryptedText, key) {
+  if (!encryptedText) {
+    throw new Error("Encrypted text cannot be empty");
+  }
+  if (!key || key.length !== 64) {
+    throw new Error("Encryption key must be a 64-character hex string (32 bytes)");
+  }
+  const parts = encryptedText.split(":");
+  if (parts.length !== 3) {
+    throw new Error("Invalid encrypted text format. Expected: iv:authTag:ciphertext");
+  }
+  const [ivHex, authTagHex, encrypted] = parts;
+  if (!ivHex || !authTagHex || !encrypted) {
+    throw new Error("Invalid encrypted text format. Missing components.");
+  }
+  const iv = Buffer.from(ivHex, "hex");
+  const authTag = Buffer.from(authTagHex, "hex");
+  if (iv.length !== IV_LENGTH) {
+    throw new Error(`Invalid IV length. Expected ${IV_LENGTH} bytes.`);
+  }
+  if (authTag.length !== AUTH_TAG_LENGTH) {
+    throw new Error(`Invalid auth tag length. Expected ${AUTH_TAG_LENGTH} bytes.`);
+  }
+  const decipher = crypto.createDecipheriv(ALGORITHM, Buffer.from(key, "hex"), iv);
+  decipher.setAuthTag(authTag);
+  let decrypted = decipher.update(encrypted, "hex", "utf8");
+  decrypted += decipher.final("utf8");
+  return decrypted;
+}
+__name(decrypt, "decrypt");
+function generateEncryptionKey() {
+  return crypto.randomBytes(32).toString("hex");
+}
+__name(generateEncryptionKey, "generateEncryptionKey");
+function isEncrypted(text) {
+  if (!text) return false;
+  const parts = text.split(":");
+  if (parts.length !== 3) return false;
+  const [ivHex, authTagHex, ciphertext] = parts;
+  if (!ivHex || ivHex.length !== 32 || !/^[0-9a-f]+$/i.test(ivHex)) {
+    return false;
+  }
+  if (!authTagHex || authTagHex.length !== 32 || !/^[0-9a-f]+$/i.test(authTagHex)) {
+    return false;
+  }
+  if (!ciphertext || !/^[0-9a-f]+$/i.test(ciphertext)) {
+    return false;
+  }
+  return true;
+}
+__name(isEncrypted, "isEncrypted");
+function encryptIfNeeded(text, key) {
+  if (isEncrypted(text)) {
+    return text;
+  }
+  return encrypt(text, key);
+}
+__name(encryptIfNeeded, "encryptIfNeeded");
+function decryptIfNeeded(text, key) {
+  if (!isEncrypted(text)) {
+    return text;
+  }
+  return decrypt(text, key);
+}
+__name(decryptIfNeeded, "decryptIfNeeded");
+
+export { crypto_exports, decrypt, decryptIfNeeded, encrypt, encryptIfNeeded, generateEncryptionKey, isEncrypted };
+//# sourceMappingURL=chunk-SBS4S2PJ.js.map
+//# sourceMappingURL=chunk-SBS4S2PJ.js.map

package/dist/chunk-SBS4S2PJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/crypto/index.ts","../src/crypto/encryption.ts"],"names":["ALGORITHM","IV_LENGTH","AUTH_TAG_LENGTH","encrypt","text","key","Error","length","iv","crypto","randomBytes","cipher","createCipheriv","Buffer","from","encrypted","update","final","authTag","getAuthTag","toString","decrypt","encryptedText","parts","split","ivHex","authTagHex","decipher","createDecipheriv","setAuthTag","decrypted","generateEncryptionKey","isEncrypted","ciphertext","test","encryptIfNeeded","decryptIfNeeded"],"mappings":";;;;AAAA,IAAA,cAAA,GAAA;;;;;;;;;ACQA,IAAMA,SAAAA,GAAY,aAAA;AAClB,IAAMC,SAAAA,GAAY,EAAA;AAClB,IAAMC,eAAAA,GAAkB,EAAA;AAiBjB,SAASC,OAAAA,CAAQC,MAAcC,GAAAA,EAAW;AAC/C,EAAA,IAAI,CAACD,IAAAA,EAAM;AACT,IAAA,MAAM,IAAIE,MAAM,iCAAA,CAAA;AAClB,EAAA;AACA,EAAA,IAAI,CAACD,GAAAA,IAAOA,GAAAA,CAAIE,MAAAA,KAAW,EAAA,EAAI;AAC7B,IAAA,MAAM,IAAID,MAAM,6DAAA,CAAA;AAClB,EAAA;AAEA,EAAA,MAAME,EAAAA,GAAKC,MAAAA,CAAOC,WAAAA,CAAYT,SAAAA,CAAAA;AAC9B,EAAA,MAAMU,MAAAA,GAASF,OAAOG,cAAAA,CAAeZ,SAAAA,EAAWa,OAAOC,IAAAA,CAAKT,GAAAA,EAAK,KAAA,CAAA,EAAQG,EAAAA,CAAAA;AAEzE,EAAA,IAAIO,SAAAA,GAAYJ,MAAAA,CAAOK,MAAAA,CAAOZ,IAAAA,EAAM,QAAQ,KAAA,CAAA;AAC5CW,EAAAA,SAAAA,IAAaJ,MAAAA,CAAOM,MAAM,KAAA,CAAA;AAE1B,EAAA,MAAMC,OAAAA,GAAUP,OAAOQ,UAAAA,EAAU;AAEjC,EAAA,OAAO,CAAA,EAAGX,EAAAA,CAAGY,QAAAA,CAAS,KAAA,CAAA,CAAA,CAAA,EAAUF,OAAAA,CAAQE,QAAAA,CAAS,KAAA,CAAA,CAAA,CAAA,EAAUL,SAAAA,CAAAA,CAAAA;AAC7D;AAjBgBZ,MAAAA,CAAAA,OAAAA,EAAAA,SAAAA,CAAAA;AAiCT,SAASkB,OAAAA,CAAQC,eAAuBjB,GAAAA,EAAW;AACxD,EAAA,IAAI,CAACiB,aAAAA,EAAe;AAClB,IAAA,MAAM,IAAIhB,MAAM,gCAAA,CAAA;AAClB,EAAA;AACA,EAAA,IAAI,CAACD,GAAAA,IAAOA,GAAAA,CAAIE,MAAAA,KAAW,EAAA,EAAI;AAC7B,IAAA,MAAM,IAAID,MAAM,6DAAA,CAAA;AAClB,EAAA;AAEA,EAAA,MAAMiB,KAAAA,GAAQD,aAAAA,CAAcE,KAAAA,CAAM,GAAA,CAAA;AAClC,EAAA,IAAID,KAAAA,CAAMhB,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,IAAID,MAAM,gEAAA,CAAA;AAClB,EAAA;AAEA,EAAA,MAAM,CAACmB,KAAAA,EAAOC,UAAAA,EAAYX,SAAAA,CAAAA,GAAaQ,KAAAA;AAEvC,EAAA,IAAI,CAACE,KAAAA,IAAS,CAACC,UAAAA,IAAc,CAACX,SAAAA,EAAW;AACvC,IAAA,MAAM,IAAIT,MAAM,oDAAA,CAAA;AAClB,EAAA;AAEA,EAAA,MAAME,EAAAA,GAAKK,MAAAA,CAAOC,IAAAA,CAAKW,KAAAA,EAAO,KAAA,CAAA;AAC9B,EAAA,MAAMP,OAAAA,GAAUL,MAAAA,CAAOC,IAAAA,CAAKY,UAAAA,EAAY,KAAA,CAAA;AAExC,EAAA,IAAIlB,EAAAA,CAAGD,WAAWN,SAAAA,EAAW;AAC3B,IAAA,MAAM,IAAIK,KAAAA,CAAM,CAAA,4BAAA,EAA+BL,SAAAA,CAAAA,OAAAA,CAAkB,CAAA;AACnE,EAAA;AACA,EAAA,IAAIiB,OAAAA,CAAQX,WAAWL,eAAAA,EAAiB;AACtC,IAAA,MAAM,IAAII,KAAAA,CAAM,CAAA,kCAAA,EAAqCJ,eAAAA,CAAAA,OAAAA,CAAwB,CAAA;AAC/E,EAAA;AAEA,EAAA,MAAMyB,QAAAA,GAAWlB,OAAOmB,gBAAAA,CAAiB5B,SAAAA,EAAWa,OAAOC,IAAAA,CAAKT,GAAAA,EAAK,KAAA,CAAA,EAAQG,EAAAA,CAAAA;AAC7EmB,EAAAA,QAAAA,CAASE,WAAWX,OAAAA,CAAAA;AAEpB,EAAA,IAAIY,SAAAA,GAAYH,QAAAA,CAASX,MAAAA,CAAOD,SAAAA,EAAW,OAAO,MAAA,CAAA;AAClDe,EAAAA,SAAAA,IAAaH,QAAAA,CAASV,MAAM,MAAA,CAAA;AAE5B,EAAA,OAAOa,SAAAA;AACT;AApCgBT,MAAAA,CAAAA,OAAAA,EAAAA,SAAAA,CAAAA;AAoDT,SAASU,qBAAAA,GAAAA;AACd,EAAA,OAAOtB,MAAAA,CAAOC,WAAAA,CAAY,EAAA,CAAA,CAAIU,SAAS,KAAA,CAAA;AACzC;AAFgBW,MAAAA,CAAAA,qBAAAA,EAAAA,uBAAAA,CAAAA;AAmBT,SAASC,YAAY5B,IAAAA,EAAY;AACtC,EAAA,IAAI,CAACA,MAAM,OAAO,KAAA;AAElB,EAAA,MAAMmB,KAAAA,GAAQnB,IAAAA,CAAKoB,KAAAA,CAAM,GAAA,CAAA;AACzB,EAAA,IAAID,KAAAA,CAAMhB,MAAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAE/B,EAAA,MAAM,CAACkB,KAAAA,EAAOC,UAAAA,EAAYO,UAAAA,CAAAA,GAAcV,KAAAA;AAGxC,EAAA,IAAI,CAACE,SAASA,KAAAA,CAAMlB,MAAAA,KAAW,MAAM,CAAC,cAAA,CAAe2B,IAAAA,CAAKT,KAAAA,CAAAA,EAAQ;AAChE,IAAA,OAAO,KAAA;AACT,EAAA;AAGA,EAAA,IAAI,CAACC,cAAcA,UAAAA,CAAWnB,MAAAA,KAAW,MAAM,CAAC,cAAA,CAAe2B,IAAAA,CAAKR,UAAAA,CAAAA,EAAa;AAC/E,IAAA,OAAO,KAAA;AACT,EAAA;AAGA,EAAA,IAAI,CAACO,UAAAA,IAAc,CAAC,cAAA,CAAeC,IAAAA,CAAKD,UAAAA,CAAAA,EAAa;AACnD,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AAxBgBD,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;AAiCT,SAASG,eAAAA,CAAgB/B,MAAcC,GAAAA,EAAW;AACvD,EAAA,IAAI2B,WAAAA,CAAY5B,IAAAA,CAAAA,EAAO;AACrB,IAAA,OAAOA,IAAAA;AACT,EAAA;AACA,EAAA,OAAOD,OAAAA,CAAQC,MAAMC,GAAAA,CAAAA;AACvB;AALgB8B,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAcT,SAASC,eAAAA,CAAgBhC,MAAcC,GAAAA,EAAW;AACvD,EAAA,IAAI,CAAC2B,WAAAA,CAAY5B,IAAAA,CAAAA,EAAO;AACtB,IAAA,OAAOA,IAAAA;AACT,EAAA;AACA,EAAA,OAAOiB,OAAAA,CAAQjB,MAAMC,GAAAA,CAAAA;AACvB;AALgB+B,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA","file":"chunk-SBS4S2PJ.js","sourcesContent":["/**\n * Crypto module - Encryption utilities for sensitive data\n *\n * @module crypto\n *\n * @example\n * ```typescript\n * import { Crypto } from '@burdenoff/be-sdk';\n *\n * // Generate a key (do this once and store securely)\n * const key = Crypto.generateEncryptionKey();\n *\n * // Encrypt sensitive data\n * const encrypted = Crypto.encrypt('my-secret', key);\n *\n * // Decrypt when needed\n * const decrypted = Crypto.decrypt(encrypted, key);\n * ```\n */\n\nexport {\n  encrypt,\n  decrypt,\n  generateEncryptionKey,\n  isEncrypted,\n  encryptIfNeeded,\n  decryptIfNeeded,\n} from './encryption.js';\n","/**\n * AES-256-GCM Encryption utilities for sensitive data\n *\n * @module crypto/encryption\n */\n\nimport crypto from 'crypto';\n\nconst ALGORITHM = 'aes-256-gcm';\nconst IV_LENGTH = 16;\nconst AUTH_TAG_LENGTH = 16;\n\n/**\n * Encrypt a string using AES-256-GCM\n *\n * @param text - The plaintext to encrypt\n * @param key - 32-byte hex-encoded encryption key (64 hex characters)\n * @returns Encrypted string in format: iv:authTag:ciphertext (all hex-encoded)\n *\n * @example\n * ```typescript\n * import { encrypt, generateEncryptionKey } from '@burdenoff/be-sdk/crypto';\n *\n * const key = generateEncryptionKey();\n * const encrypted = encrypt('my-secret-data', key);\n * ```\n */\nexport function encrypt(text: string, key: string): string {\n  if (!text) {\n    throw new Error('Text to encrypt cannot be empty');\n  }\n  if (!key || key.length !== 64) {\n    throw new Error('Encryption key must be a 64-character hex string (32 bytes)');\n  }\n\n  const iv = crypto.randomBytes(IV_LENGTH);\n  const cipher = crypto.createCipheriv(ALGORITHM, Buffer.from(key, 'hex'), iv);\n\n  let encrypted = cipher.update(text, 'utf8', 'hex');\n  encrypted += cipher.final('hex');\n\n  const authTag = cipher.getAuthTag();\n\n  return `${iv.toString('hex')}:${authTag.toString('hex')}:${encrypted}`;\n}\n\n/**\n * Decrypt a string encrypted with AES-256-GCM\n *\n * @param encryptedText - Encrypted string in format: iv:authTag:ciphertext\n * @param key - 32-byte hex-encoded encryption key (64 hex characters)\n * @returns Decrypted plaintext\n *\n * @example\n * ```typescript\n * import { decrypt } from '@burdenoff/be-sdk/crypto';\n *\n * const decrypted = decrypt(encryptedData, key);\n * ```\n */\nexport function decrypt(encryptedText: string, key: string): string {\n  if (!encryptedText) {\n    throw new Error('Encrypted text cannot be empty');\n  }\n  if (!key || key.length !== 64) {\n    throw new Error('Encryption key must be a 64-character hex string (32 bytes)');\n  }\n\n  const parts = encryptedText.split(':');\n  if (parts.length !== 3) {\n    throw new Error('Invalid encrypted text format. Expected: iv:authTag:ciphertext');\n  }\n\n  const [ivHex, authTagHex, encrypted] = parts;\n\n  if (!ivHex || !authTagHex || !encrypted) {\n    throw new Error('Invalid encrypted text format. Missing components.');\n  }\n\n  const iv = Buffer.from(ivHex, 'hex');\n  const authTag = Buffer.from(authTagHex, 'hex');\n\n  if (iv.length !== IV_LENGTH) {\n    throw new Error(`Invalid IV length. Expected ${IV_LENGTH} bytes.`);\n  }\n  if (authTag.length !== AUTH_TAG_LENGTH) {\n    throw new Error(`Invalid auth tag length. Expected ${AUTH_TAG_LENGTH} bytes.`);\n  }\n\n  const decipher = crypto.createDecipheriv(ALGORITHM, Buffer.from(key, 'hex'), iv);\n  decipher.setAuthTag(authTag);\n\n  let decrypted = decipher.update(encrypted, 'hex', 'utf8');\n  decrypted += decipher.final('utf8');\n\n  return decrypted;\n}\n\n/**\n * Generate a cryptographically secure encryption key\n *\n * @returns 64-character hex string (32 bytes) suitable for AES-256\n *\n * @example\n * ```typescript\n * import { generateEncryptionKey } from '@burdenoff/be-sdk/crypto';\n *\n * const key = generateEncryptionKey();\n * // Store this key securely (e.g., in environment variables)\n * console.log(key); // \"a1b2c3d4e5f6...\"\n * ```\n */\nexport function generateEncryptionKey(): string {\n  return crypto.randomBytes(32).toString('hex');\n}\n\n/**\n * Check if a string appears to be encrypted (has the expected format)\n *\n * @param text - The string to check\n * @returns true if the string matches the encrypted format\n *\n * @example\n * ```typescript\n * import { isEncrypted } from '@burdenoff/be-sdk/crypto';\n *\n * if (!isEncrypted(data)) {\n *   data = encrypt(data, key);\n * }\n * ```\n */\nexport function isEncrypted(text: string): boolean {\n  if (!text) return false;\n\n  const parts = text.split(':');\n  if (parts.length !== 3) return false;\n\n  const [ivHex, authTagHex, ciphertext] = parts;\n\n  // Check IV is 32 hex chars (16 bytes)\n  if (!ivHex || ivHex.length !== 32 || !/^[0-9a-f]+$/i.test(ivHex)) {\n    return false;\n  }\n\n  // Check auth tag is 32 hex chars (16 bytes)\n  if (!authTagHex || authTagHex.length !== 32 || !/^[0-9a-f]+$/i.test(authTagHex)) {\n    return false;\n  }\n\n  // Check ciphertext exists and is hex\n  if (!ciphertext || !/^[0-9a-f]+$/i.test(ciphertext)) {\n    return false;\n  }\n\n  return true;\n}\n\n/**\n * Encrypt a value only if it's not already encrypted\n *\n * @param text - The text to potentially encrypt\n * @param key - The encryption key\n * @returns Encrypted text (either newly encrypted or unchanged if already encrypted)\n */\nexport function encryptIfNeeded(text: string, key: string): string {\n  if (isEncrypted(text)) {\n    return text;\n  }\n  return encrypt(text, key);\n}\n\n/**\n * Decrypt a value only if it appears to be encrypted\n *\n * @param text - The text to potentially decrypt\n * @param key - The encryption key\n * @returns Decrypted text (either newly decrypted or unchanged if not encrypted)\n */\nexport function decryptIfNeeded(text: string, key: string): string {\n  if (!isEncrypted(text)) {\n    return text;\n  }\n  return decrypt(text, key);\n}\n"]}

package/dist/chunk-SNEOLWXT.js

@@ -0,0 +1,148 @@
+import { Logger } from './chunk-CBZNP6RF.js';
+import { __name } from './chunk-XE4OXN2W.js';
+
+// src/telemetry/pino-redaction.ts
+var DEFAULT_REDACT_PATHS = Object.freeze([
+  "password",
+  "*.password",
+  "*.*.password",
+  "token",
+  "authToken",
+  "workspaceToken",
+  "accessToken",
+  "refreshToken",
+  "clientSecret",
+  "apiKey",
+  "*.apiKey",
+  "authorization",
+  "req.headers.authorization",
+  'req.headers["x-workspace-authorization"]',
+  "req.headers.cookie",
+  'res.headers["set-cookie"]',
+  "params.*.password",
+  "params.*.token",
+  "params.*.secret"
+]);
+
+// src/telemetry/pino-logger.ts
+async function tryLoadPino() {
+  try {
+    const mod = await import('pino');
+    const candidate = mod.default ?? mod;
+    if (typeof candidate === "function") {
+      return candidate;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+__name(tryLoadPino, "tryLoadPino");
+var PinoAdapter = class PinoAdapter2 extends Logger {
+  static {
+    __name(this, "PinoAdapter");
+  }
+  pino;
+  constructor(pino) {
+    super({
+      level: pino.level ?? "info",
+      console: false
+    }), this.pino = pino;
+  }
+  debug(message, ...args) {
+    this.pino.debug(this.mergeArgs(args), message);
+  }
+  info(message, ...args) {
+    this.pino.info(this.mergeArgs(args), message);
+  }
+  warn(message, ...args) {
+    this.pino.warn(this.mergeArgs(args), message);
+  }
+  error(message, ...args) {
+    this.pino.error(this.mergeArgs(args), message);
+  }
+  log(message, ...args) {
+    this.pino.info(this.mergeArgs(args), message);
+  }
+  trace(message, ...args) {
+    this.pino.trace(this.mergeArgs(args), message);
+  }
+  mergeArgs(args) {
+    const out = {};
+    for (const arg of args) {
+      if (arg instanceof Error) {
+        out["err"] = {
+          message: arg.message,
+          stack: arg.stack,
+          name: arg.name
+        };
+      } else if (arg && typeof arg === "object") {
+        Object.assign(out, arg);
+      } else if (arg !== void 0 && arg !== null) {
+        out["data"] = arg;
+      }
+    }
+    return out;
+  }
+};
+async function createPinoLogger(cfg) {
+  const pinoFactory = await tryLoadPino();
+  if (!pinoFactory) {
+    const fallback = new Logger({
+      level: cfg.env === "prod" ? "warn" : "info",
+      console: true
+    });
+    fallback.setContext({
+      service: cfg.serviceName,
+      env: cfg.env,
+      version: cfg.version
+    });
+    return fallback;
+  }
+  const redactPaths = [
+    ...DEFAULT_REDACT_PATHS,
+    ...cfg.redactPaths ?? []
+  ];
+  const pino = pinoFactory({
+    name: cfg.serviceName,
+    level: cfg.level ?? (cfg.env === "prod" ? "warn" : "info"),
+    base: {
+      service: {
+        name: cfg.serviceName,
+        version: cfg.version
+      },
+      env: cfg.env
+    },
+    redact: {
+      paths: redactPaths,
+      censor: "[REDACTED]",
+      remove: false
+    },
+    timestamp: /* @__PURE__ */ __name(() => `,"time":"${(/* @__PURE__ */ new Date()).toISOString()}"`, "timestamp"),
+    mixin: /* @__PURE__ */ __name(() => pickTraceFields(), "mixin")
+  });
+  return new PinoAdapter(pino);
+}
+__name(createPinoLogger, "createPinoLogger");
+function pickTraceFields() {
+  try {
+    const api = globalThis.__otelApi;
+    if (!api) return {};
+    const anyApi = api;
+    const span = anyApi.trace.getActiveSpan();
+    if (!span) return {};
+    const ctx = span.spanContext();
+    return {
+      trace_id: ctx.traceId,
+      span_id: ctx.spanId,
+      trace_flags: ctx.traceFlags.toString(16).padStart(2, "0")
+    };
+  } catch {
+    return {};
+  }
+}
+__name(pickTraceFields, "pickTraceFields");
+
+export { DEFAULT_REDACT_PATHS, createPinoLogger };
+//# sourceMappingURL=chunk-SNEOLWXT.js.map
+//# sourceMappingURL=chunk-SNEOLWXT.js.map

package/dist/chunk-SNEOLWXT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/telemetry/pino-redaction.ts","../src/telemetry/pino-logger.ts"],"names":["DEFAULT_REDACT_PATHS","Object","freeze","tryLoadPino","mod","candidate","default","PinoAdapter","BaseLogger","pino","level","console","debug","message","args","mergeArgs","info","warn","error","log","trace","out","arg","Error","stack","name","assign","undefined","createPinoLogger","cfg","pinoFactory","fallback","env","setContext","service","serviceName","version","redactPaths","base","redact","paths","censor","remove","timestamp","Date","toISOString","mixin","pickTraceFields","api","globalThis","__otelApi","anyApi","span","getActiveSpan","ctx","spanContext","trace_id","traceId","span_id","spanId","trace_flags","traceFlags","toString","padStart"],"mappings":";;;;AAMO,IAAMA,oBAAAA,GAA0CC,OAAOC,MAAAA,CAAO;AACnE,EAAA,UAAA;AACA,EAAA,YAAA;AACA,EAAA,cAAA;AACA,EAAA,OAAA;AACA,EAAA,WAAA;AACA,EAAA,gBAAA;AACA,EAAA,aAAA;AACA,EAAA,cAAA;AACA,EAAA,cAAA;AACA,EAAA,QAAA;AACA,EAAA,UAAA;AACA,EAAA,eAAA;AACA,EAAA,2BAAA;AACA,EAAA,0CAAA;AACA,EAAA,oBAAA;AACA,EAAA,2BAAA;AACA,EAAA,mBAAA;AACA,EAAA,gBAAA;AACA,EAAA;AACD,CAAA;;;ACGD,eAAeC,WAAAA,GAAAA;AACb,EAAA,IAAI;AACF,IAAA,MAAMC,GAAAA,GAAO,MAAM,OAAO,MAAA,CAAA;AAC1B,IAAA,MAAMC,SAAAA,GAAaD,IAAIE,OAAAA,IAAWF,GAAAA;AAClC,IAAA,IAAI,OAAOC,cAAc,UAAA,EAAY;AACnC,MAAA,OAAOA,SAAAA;AACT,IAAA;AACA,IAAA,OAAO,IAAA;EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAXeF,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;AAaf,IAAMI,WAAAA,GAAN,MAAMA,YAAAA,SAAoBC,MAAAA,CAAAA;EA1C1B;;;;AA2CE,EAAA,WAAA,CAA6BC,IAAAA,EAAgB;AAC3C,IAAA,KAAA,CAAM;AACJC,MAAAA,KAAAA,EAAQD,KAAKC,KAAAA,IAAsE,MAAA;MACnFC,OAAAA,EAAS;KACX,CAAA,EAAA,KAJ2BF,IAAAA,GAAAA,IAAAA;AAK7B,EAAA;AAEgBG,EAAAA,KAAAA,CAAMC,YAAoBC,IAAAA,EAAuB;AAC/D,IAAA,IAAA,CAAKL,KAAKG,KAAAA,CAAM,IAAA,CAAKG,SAAAA,CAAUD,IAAAA,GAAOD,OAAAA,CAAAA;AACxC,EAAA;AACgBG,EAAAA,IAAAA,CAAKH,YAAoBC,IAAAA,EAAuB;AAC9D,IAAA,IAAA,CAAKL,KAAKO,IAAAA,CAAK,IAAA,CAAKD,SAAAA,CAAUD,IAAAA,GAAOD,OAAAA,CAAAA;AACvC,EAAA;AACgBI,EAAAA,IAAAA,CAAKJ,YAAoBC,IAAAA,EAAuB;AAC9D,IAAA,IAAA,CAAKL,KAAKQ,IAAAA,CAAK,IAAA,CAAKF,SAAAA,CAAUD,IAAAA,GAAOD,OAAAA,CAAAA;AACvC,EAAA;AACgBK,EAAAA,KAAAA,CAAML,YAAoBC,IAAAA,EAAuB;AAC/D,IAAA,IAAA,CAAKL,KAAKS,KAAAA,CAAM,IAAA,CAAKH,SAAAA,CAAUD,IAAAA,GAAOD,OAAAA,CAAAA;AACxC,EAAA;AACgBM,EAAAA,GAAAA,CAAIN,YAAoBC,IAAAA,EAAuB;AAC7D,IAAA,IAAA,CAAKL,KAAKO,IAAAA,CAAK,IAAA,CAAKD,SAAAA,CAAUD,IAAAA,GAAOD,OAAAA,CAAAA;AACvC,EAAA;AACgBO,EAAAA,KAAAA,CAAMP,YAAoBC,IAAAA,EAAuB;AAC/D,IAAA,IAAA,CAAKL,KAAKW,KAAAA,CAAM,IAAA,CAAKL,SAAAA,CAAUD,IAAAA,GAAOD,OAAAA,CAAAA;AACxC,EAAA;AAEQE,EAAAA,SAAAA,CAAUD,IAAAA,EAA0C;AAC1D,IAAA,MAAMO,MAA+B,EAAC;AACtC,IAAA,KAAA,MAAWC,OAAOR,IAAAA,EAAM;AACtB,MAAA,IAAIQ,eAAeC,KAAAA,EAAO;AACxBF,QAAAA,GAAAA,CAAI,KAAA,CAAA,GAAS;AAAER,UAAAA,OAAAA,EAASS,GAAAA,CAAIT,OAAAA;AAASW,UAAAA,KAAAA,EAAOF,GAAAA,CAAIE,KAAAA;AAAOC,UAAAA,IAAAA,EAAMH,GAAAA,CAAIG;AAAK,SAAA;MACxE,CAAA,MAAA,IAAWH,GAAAA,IAAO,OAAOA,GAAAA,KAAQ,QAAA,EAAU;AACzCrB,QAAAA,MAAAA,CAAOyB,MAAAA,CAAOL,KAAKC,GAAAA,CAAAA;MACrB,CAAA,MAAA,IAAWA,GAAAA,KAAQK,MAAAA,IAAaL,GAAAA,KAAQ,IAAA,EAAM;AAC5CD,QAAAA,GAAAA,CAAI,MAAA,CAAA,GAAUC,GAAAA;AAChB,MAAA;AACF,IAAA;AACA,IAAA,OAAOD,GAAAA;AACT,EAAA;AACF,CAAA;AAQA,eAAsBO,iBAAiBC,GAAAA,EAAqB;AAC1D,EAAA,MAAMC,WAAAA,GAAc,MAAM3B,WAAAA,EAAAA;AAC1B,EAAA,IAAI,CAAC2B,WAAAA,EAAa;AAEhB,IAAA,MAAMC,QAAAA,GAAW,IAAIvB,MAAAA,CAAW;MAAEE,KAAAA,EAAOmB,GAAAA,CAAIG,GAAAA,KAAQ,MAAA,GAAS,MAAA,GAAS,MAAA;MAAQrB,OAAAA,EAAS;KAAK,CAAA;AAC7FoB,IAAAA,QAAAA,CAASE,UAAAA,CAAW;AAClBC,MAAAA,OAAAA,EAASL,GAAAA,CAAIM,WAAAA;AACbH,MAAAA,GAAAA,EAAKH,GAAAA,CAAIG,GAAAA;AACTI,MAAAA,OAAAA,EAASP,GAAAA,CAAIO;KACf,CAAA;AACA,IAAA,OAAOL,QAAAA;AACT,EAAA;AAEA,EAAA,MAAMM,WAAAA,GAAc;AAAIrC,IAAAA,GAAAA,oBAAAA;AAA0B6B,IAAAA,GAAAA,GAAAA,CAAIQ,eAAe;;AACrE,EAAA,MAAM5B,OAAOqB,WAAAA,CAAY;AACvBL,IAAAA,IAAAA,EAAMI,GAAAA,CAAIM,WAAAA;AACVzB,IAAAA,KAAAA,EAAOmB,GAAAA,CAAInB,KAAAA,KAAUmB,GAAAA,CAAIG,GAAAA,KAAQ,SAAS,MAAA,GAAS,MAAA,CAAA;IACnDM,IAAAA,EAAM;MACJJ,OAAAA,EAAS;AAAET,QAAAA,IAAAA,EAAMI,GAAAA,CAAIM,WAAAA;AAAaC,QAAAA,OAAAA,EAASP,GAAAA,CAAIO;AAAQ,OAAA;AACvDJ,MAAAA,GAAAA,EAAKH,GAAAA,CAAIG;AACX,KAAA;IACAO,MAAAA,EAAQ;MACNC,KAAAA,EAAOH,WAAAA;MACPI,MAAAA,EAAQ,YAAA;MACRC,MAAAA,EAAQ;AACV,KAAA;AACAC,IAAAA,SAAAA,+BAAiB,CAAA,SAAA,EAAA,iBAAY,IAAIC,MAAAA,EAAOC,WAAAA,EAAW,CAAA,CAAA,CAAA,EAAxC,WAAA,CAAA;IACXC,KAAAA,kBAAO,MAAA,CAAA,MAAMC,iBAAAA,EAAN,OAAA;GACT,CAAA;AACA,EAAA,OAAO,IAAIxC,YAAYE,IAAAA,CAAAA;AACzB;AA9BsBmB,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAgCtB,SAASmB,eAAAA,GAAAA;AACP,EAAA,IAAI;AAGF,IAAA,MAAMC,MAAOC,UAAAA,CAAkDC,SAAAA;AAC/D,IAAA,IAAI,CAACF,GAAAA,EAAK,OAAO,EAAC;AAClB,IAAA,MAAMG,MAAAA,GAASH,GAAAA;AAKf,IAAA,MAAMI,IAAAA,GAAOD,MAAAA,CAAO/B,KAAAA,CAAMiC,aAAAA,EAAa;AACvC,IAAA,IAAI,CAACD,IAAAA,EAAM,OAAO,EAAC;AACnB,IAAA,MAAME,GAAAA,GAAMF,KAAKG,WAAAA,EAAW;AAC5B,IAAA,OAAO;AACLC,MAAAA,QAAAA,EAAUF,GAAAA,CAAIG,OAAAA;AACdC,MAAAA,OAAAA,EAASJ,GAAAA,CAAIK,MAAAA;AACbC,MAAAA,WAAAA,EAAaN,IAAIO,UAAAA,CAAWC,QAAAA,CAAS,EAAA,CAAA,CAAIC,QAAAA,CAAS,GAAG,GAAA;AACvD,KAAA;EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AACV,EAAA;AACF;AAtBShB,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA","file":"chunk-SNEOLWXT.js","sourcesContent":["/**\n * Default Pino redact paths — covers the Burdenoff authorization +\n * gateway header + NATS/GraphQL payload surface area.\n *\n * Services can extend this list via their own Pino options.\n */\nexport const DEFAULT_REDACT_PATHS: readonly string[] = Object.freeze([\n  'password',\n  '*.password',\n  '*.*.password',\n  'token',\n  'authToken',\n  'workspaceToken',\n  'accessToken',\n  'refreshToken',\n  'clientSecret',\n  'apiKey',\n  '*.apiKey',\n  'authorization',\n  'req.headers.authorization',\n  'req.headers[\"x-workspace-authorization\"]',\n  'req.headers.cookie',\n  'res.headers[\"set-cookie\"]',\n  'params.*.password',\n  'params.*.token',\n  'params.*.secret',\n]);\n","/**\n * Pino logger wrapper that emits structured JSON with trace/span correlation\n * fields. Falls back to the SDK's built-in Logger when `pino` isn't installed\n * so services without the peer dep still compile and run.\n */\nimport { Logger as BaseLogger } from '../logger/index.js';\nimport { DEFAULT_REDACT_PATHS } from './pino-redaction.js';\n\nexport interface PinoLoggerConfig {\n  serviceName: string;\n  env: 'alpha' | 'prod' | 'dev';\n  version: string;\n  /** Override Pino log level. Default: warn (prod), info (alpha/dev). */\n  level?: 'fatal' | 'error' | 'warn' | 'info' | 'debug' | 'trace';\n  /** Extra redact paths appended to DEFAULT_REDACT_PATHS. */\n  redactPaths?: string[];\n}\n\ninterface PinoLike {\n  level: string;\n  fatal: (...args: unknown[]) => void;\n  error: (...args: unknown[]) => void;\n  warn: (...args: unknown[]) => void;\n  info: (...args: unknown[]) => void;\n  debug: (...args: unknown[]) => void;\n  trace: (...args: unknown[]) => void;\n  child: (bindings: Record<string, unknown>) => PinoLike;\n}\n\nasync function tryLoadPino(): Promise<((opts: unknown) => PinoLike) | null> {\n  try {\n    const mod = (await import('pino')) as unknown as { default?: unknown };\n    const candidate = (mod.default ?? mod) as unknown;\n    if (typeof candidate === 'function') {\n      return candidate as (opts: unknown) => PinoLike;\n    }\n    return null;\n  } catch {\n    return null;\n  }\n}\n\nclass PinoAdapter extends BaseLogger {\n  constructor(private readonly pino: PinoLike) {\n    super({\n      level: (pino.level as BaseLogger['getLevel'] extends () => infer L ? L : never) ?? 'info',\n      console: false,\n    });\n  }\n\n  public override debug(message: string, ...args: unknown[]): void {\n    this.pino.debug(this.mergeArgs(args), message);\n  }\n  public override info(message: string, ...args: unknown[]): void {\n    this.pino.info(this.mergeArgs(args), message);\n  }\n  public override warn(message: string, ...args: unknown[]): void {\n    this.pino.warn(this.mergeArgs(args), message);\n  }\n  public override error(message: string, ...args: unknown[]): void {\n    this.pino.error(this.mergeArgs(args), message);\n  }\n  public override log(message: string, ...args: unknown[]): void {\n    this.pino.info(this.mergeArgs(args), message);\n  }\n  public override trace(message: string, ...args: unknown[]): void {\n    this.pino.trace(this.mergeArgs(args), message);\n  }\n\n  private mergeArgs(args: unknown[]): Record<string, unknown> {\n    const out: Record<string, unknown> = {};\n    for (const arg of args) {\n      if (arg instanceof Error) {\n        out['err'] = { message: arg.message, stack: arg.stack, name: arg.name };\n      } else if (arg && typeof arg === 'object') {\n        Object.assign(out, arg as Record<string, unknown>);\n      } else if (arg !== undefined && arg !== null) {\n        out['data'] = arg;\n      }\n    }\n    return out;\n  }\n}\n\n/**\n * Build a logger instance. Returns a Pino-backed adapter when `pino` is\n * installed; otherwise falls back to the SDK's built-in JSON Logger.\n *\n * Services call this through `bootstrapTelemetry`, not directly.\n */\nexport async function createPinoLogger(cfg: PinoLoggerConfig): Promise<BaseLogger> {\n  const pinoFactory = await tryLoadPino();\n  if (!pinoFactory) {\n    // No pino — fall back to the built-in Logger with console output.\n    const fallback = new BaseLogger({ level: cfg.env === 'prod' ? 'warn' : 'info', console: true });\n    fallback.setContext({\n      service: cfg.serviceName,\n      env: cfg.env,\n      version: cfg.version,\n    } as unknown as import('../types/index.js').SDKContext);\n    return fallback;\n  }\n\n  const redactPaths = [...DEFAULT_REDACT_PATHS, ...(cfg.redactPaths ?? [])];\n  const pino = pinoFactory({\n    name: cfg.serviceName,\n    level: cfg.level ?? (cfg.env === 'prod' ? 'warn' : 'info'),\n    base: {\n      service: { name: cfg.serviceName, version: cfg.version },\n      env: cfg.env,\n    },\n    redact: {\n      paths: redactPaths,\n      censor: '[REDACTED]',\n      remove: false,\n    },\n    timestamp: () => `,\"time\":\"${new Date().toISOString()}\"`,\n    mixin: () => pickTraceFields(),\n  });\n  return new PinoAdapter(pino);\n}\n\nfunction pickTraceFields(): Record<string, string> {\n  try {\n    // Pull active span context via @opentelemetry/api if installed.\n    // Use require-style dynamic access to keep this file dep-free.\n    const api = (globalThis as unknown as { __otelApi?: unknown }).__otelApi;\n    if (!api) return {};\n    const anyApi = api as {\n      trace: {\n        getActiveSpan: () => { spanContext: () => { traceId: string; spanId: string; traceFlags: number } } | undefined;\n      };\n    };\n    const span = anyApi.trace.getActiveSpan();\n    if (!span) return {};\n    const ctx = span.spanContext();\n    return {\n      trace_id: ctx.traceId,\n      span_id: ctx.spanId,\n      trace_flags: ctx.traceFlags.toString(16).padStart(2, '0'),\n    };\n  } catch {\n    return {};\n  }\n}\n"]}