@burdenoff/be-sdk 2026.510.79

package/dist/chunk-UBXFIIAW.js

@@ -0,0 +1,127 @@
+import { logger } from './chunk-CBZNP6RF.js';
+import { __name } from './chunk-XE4OXN2W.js';
+
+// src/server/workspace-guard.ts
+var WorkspaceRequiredError = class WorkspaceRequiredError2 extends Error {
+  static {
+    __name(this, "WorkspaceRequiredError");
+  }
+  extensions;
+  constructor(message) {
+    super(message);
+    this.name = "WorkspaceRequiredError";
+    this.extensions = {
+      code: "WORKSPACE_REQUIRED",
+      http: {
+        status: 403
+      }
+    };
+  }
+};
+function isFieldPublic(field) {
+  const directives = field?.astNode?.directives;
+  if (!directives || directives.length === 0) return false;
+  for (const dir of directives) {
+    const name = dir.name?.value;
+    if (name === "public") return true;
+    if (name === "rbac") {
+      const args = dir.arguments ?? [];
+      for (const arg of args) {
+        if (arg.name?.value === "public" && arg.value?.kind === "BooleanValue" && arg.value.value === true) {
+          return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+__name(isFieldPublic, "isFieldPublic");
+function resolveOperationType(document, operationName) {
+  const defs = document?.definitions ?? [];
+  for (const def of defs) {
+    if (def.kind !== "OperationDefinition") ;
+    if (def.operation && (!operationName || def.name?.value === operationName)) {
+      return def.operation;
+    }
+  }
+  return "query";
+}
+__name(resolveOperationType, "resolveOperationType");
+function allRootFieldsPublic(schema, document, operationName) {
+  if (!schema || !document) return false;
+  const opType = resolveOperationType(document, operationName);
+  let rootType;
+  if (opType === "mutation") {
+    rootType = schema.getMutationType?.();
+  } else if (opType === "subscription") {
+    rootType = schema.getSubscriptionType?.();
+  } else {
+    rootType = schema.getQueryType?.();
+  }
+  if (!rootType) return false;
+  const fields = rootType.getFields();
+  const defs = document.definitions ?? [];
+  const opDef = defs.find((d) => d.operation && (!operationName || d.name?.value === operationName));
+  const selections = opDef?.selectionSet?.selections ?? [];
+  if (selections.length === 0) return false;
+  for (const sel of selections) {
+    if (sel.kind && sel.kind !== "Field") return false;
+    const fieldName = sel.name?.value;
+    if (!fieldName) return false;
+    if (fieldName.startsWith("__")) continue;
+    const fieldDef = fields[fieldName];
+    if (!isFieldPublic(fieldDef)) return false;
+  }
+  return true;
+}
+__name(allRootFieldsPublic, "allRootFieldsPublic");
+function createWorkspaceGuardPlugin(config) {
+  const enabled = config?.enabled ?? true;
+  const whitelistedOperations = new Set(config?.whitelistedOperations ?? []);
+  const allowPublicDirective = config?.allowPublicDirective ?? true;
+  const errorMessage = config?.errorMessage ?? "Workspace context required. Ensure the request includes a valid workspace context (x-workspace-id header).";
+  if (!enabled) {
+    logger.info("[WorkspaceGuard] Workspace guard disabled");
+    return {};
+  }
+  logger.info("[WorkspaceGuard] Workspace guard enabled", {
+    whitelistedOperations: [
+      ...whitelistedOperations
+    ],
+    allowPublicDirective
+  });
+  return {
+    onExecute({ args }) {
+      let operationName = args.operationName;
+      if (!operationName && args.document?.definitions) {
+        for (const def of args.document.definitions) {
+          if (def.operation && def.name?.value) {
+            operationName = def.name.value;
+            break;
+          }
+        }
+      }
+      if (operationName && whitelistedOperations.has(operationName)) {
+        return void 0;
+      }
+      if (allowPublicDirective && allRootFieldsPublic(args.schema, args.document, operationName)) {
+        return void 0;
+      }
+      const context = args.contextValue;
+      const workspaceId = context?.workspace?.id;
+      const headerWorkspaceId = context?.request?.headers?.get?.("x-workspace-id");
+      if (!workspaceId && !headerWorkspaceId) {
+        logger.warn("[WorkspaceGuard] Blocked operation without workspace context", {
+          operationName: operationName ?? "<anonymous>"
+        });
+        throw new WorkspaceRequiredError(errorMessage);
+      }
+      return void 0;
+    }
+  };
+}
+__name(createWorkspaceGuardPlugin, "createWorkspaceGuardPlugin");
+
+export { createWorkspaceGuardPlugin };
+//# sourceMappingURL=chunk-UBXFIIAW.js.map
+//# sourceMappingURL=chunk-UBXFIIAW.js.map

package/dist/chunk-UBXFIIAW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/workspace-guard.ts"],"names":["WorkspaceRequiredError","Error","extensions","message","name","code","http","status","isFieldPublic","field","directives","astNode","length","dir","value","args","arguments","arg","kind","resolveOperationType","document","operationName","defs","definitions","def","operation","allRootFieldsPublic","schema","opType","rootType","getMutationType","getSubscriptionType","getQueryType","fields","getFields","opDef","find","d","selections","selectionSet","sel","fieldName","startsWith","fieldDef","createWorkspaceGuardPlugin","config","enabled","whitelistedOperations","Set","allowPublicDirective","errorMessage","logger","info","onExecute","has","undefined","context","contextValue","workspaceId","workspace","id","headerWorkspaceId","request","headers","get","warn"],"mappings":";;;;AA4EA,IAAMA,sBAAAA,GAAN,MAAMA,uBAAAA,SAA+BC,KAAAA,CAAAA;EA5ErC;;;AA6EkBC,EAAAA,UAAAA;AAEhB,EAAA,WAAA,CAAYC,OAAAA,EAAiB;AAC3B,IAAA,KAAA,CAAMA,OAAAA,CAAAA;AACN,IAAA,IAAA,CAAKC,IAAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAKF,UAAAA,GAAa;MAChBG,IAAAA,EAAM,oBAAA;MACNC,IAAAA,EAAM;QAAEC,MAAAA,EAAQ;AAAI;AACtB,KAAA;AACF,EAAA;AACF,CAAA;AAkCA,SAASC,cAAcC,KAAAA,EAA+B;AACpD,EAAA,MAAMC,UAAAA,GAAaD,OAAOE,OAAAA,EAASD,UAAAA;AACnC,EAAA,IAAI,CAACA,UAAAA,IAAcA,UAAAA,CAAWE,MAAAA,KAAW,GAAG,OAAO,KAAA;AAEnD,EAAA,KAAA,MAAWC,OAAOH,UAAAA,EAAY;AAC5B,IAAA,MAAMN,IAAAA,GAAOS,IAAIT,IAAAA,EAAMU,KAAAA;AACvB,IAAA,IAAIV,IAAAA,KAAS,UAAU,OAAO,IAAA;AAC9B,IAAA,IAAIA,SAAS,MAAA,EAAQ;AACnB,MAAA,MAAMW,IAAAA,GAAOF,GAAAA,CAAIG,SAAAA,IAAa,EAAA;AAC9B,MAAA,KAAA,MAAWC,OAAOF,IAAAA,EAAM;AACtB,QAAA,IAAIE,GAAAA,CAAIb,IAAAA,EAAMU,KAAAA,KAAU,QAAA,IAAYG,GAAAA,CAAIH,KAAAA,EAAOI,IAAAA,KAAS,cAAA,IAAkBD,GAAAA,CAAIH,KAAAA,CAAMA,KAAAA,KAAU,IAAA,EAAM;AAClG,UAAA,OAAO,IAAA;AACT,QAAA;AACF,MAAA;AACF,IAAA;AACF,EAAA;AACA,EAAA,OAAO,KAAA;AACT;AAjBSN,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAqCT,SAASW,oBAAAA,CACPC,UACAC,aAAAA,EAAwC;AAExC,EAAA,MAAMC,IAAAA,GAAOF,QAAAA,EAAUG,WAAAA,IAAe,EAAA;AACtC,EAAA,KAAA,MAAWC,OAAOF,IAAAA,EAAM;AACtB,IAAA,IAAIE,GAAAA,CAAIN,SAAS,qBAAA,EAAuB;AAGxC,IAAA,IAAIM,IAAIC,SAAAA,KAAc,CAACJ,iBAAiBG,GAAAA,CAAIpB,IAAAA,EAAMU,UAAUO,aAAAA,CAAAA,EAAgB;AAC1E,MAAA,OAAOG,GAAAA,CAAIC,SAAAA;AACb,IAAA;AACF,EAAA;AACA,EAAA,OAAO,OAAA;AACT;AAdSN,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAoBT,SAASO,mBAAAA,CACPC,MAAAA,EACAP,QAAAA,EACAC,aAAAA,EAAwC;AAExC,EAAA,IAAI,CAACM,MAAAA,IAAU,CAACP,QAAAA,EAAU,OAAO,KAAA;AAEjC,EAAA,MAAMQ,MAAAA,GAAST,oBAAAA,CAAqBC,QAAAA,EAAUC,aAAAA,CAAAA;AAC9C,EAAA,IAAIQ,QAAAA;AACJ,EAAA,IAAID,WAAW,UAAA,EAAY;AACzBC,IAAAA,QAAAA,GAAWF,OAAOG,eAAAA,IAAe;AACnC,EAAA,CAAA,MAAA,IAAWF,WAAW,cAAA,EAAgB;AACpCC,IAAAA,QAAAA,GAAWF,OAAOI,mBAAAA,IAAmB;EACvC,CAAA,MAAO;AACLF,IAAAA,QAAAA,GAAWF,OAAOK,YAAAA,IAAY;AAChC,EAAA;AAEA,EAAA,IAAI,CAACH,UAAU,OAAO,KAAA;AAEtB,EAAA,MAAMI,MAAAA,GAASJ,SAASK,SAAAA,EAAS;AACjC,EAAA,MAAMZ,IAAAA,GAAOF,QAAAA,CAASG,WAAAA,IAAe,EAAA;AAGrC,EAAA,MAAMY,KAAAA,GAAQb,IAAAA,CAAKc,IAAAA,CAAK,CAACC,CAAAA,KAAMA,CAAAA,CAAEZ,SAAAA,KAAc,CAACJ,aAAAA,IAAiBgB,CAAAA,CAAEjC,IAAAA,EAAMU,KAAAA,KAAUO,aAAAA,CAAY,CAAA;AAC/F,EAAA,MAAMiB,UAAAA,GAAaH,KAAAA,EAAOI,YAAAA,EAAcD,UAAAA,IAAc,EAAA;AACtD,EAAA,IAAIA,UAAAA,CAAW1B,MAAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAEpC,EAAA,KAAA,MAAW4B,OAAOF,UAAAA,EAAY;AAG5B,IAAA,IAAIE,GAAAA,CAAItB,IAAAA,IAAQsB,GAAAA,CAAItB,IAAAA,KAAS,SAAS,OAAO,KAAA;AAC7C,IAAA,MAAMuB,SAAAA,GAAYD,IAAIpC,IAAAA,EAAMU,KAAAA;AAC5B,IAAA,IAAI,CAAC2B,WAAW,OAAO,KAAA;AAGvB,IAAA,IAAIA,SAAAA,CAAUC,UAAAA,CAAW,IAAA,CAAA,EAAO;AAChC,IAAA,MAAMC,QAAAA,GAAWV,OAAOQ,SAAAA,CAAAA;AACxB,IAAA,IAAI,CAACjC,aAAAA,CAAcmC,QAAAA,CAAAA,EAAW,OAAO,KAAA;AACvC,EAAA;AACA,EAAA,OAAO,IAAA;AACT;AAxCSjB,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAkEF,SAASkB,2BAA2BC,MAAAA,EAA6B;AACtE,EAAA,MAAMC,OAAAA,GAAUD,QAAQC,OAAAA,IAAW,IAAA;AACnC,EAAA,MAAMC,wBAAwB,IAAIC,GAAAA,CAAIH,MAAAA,EAAQE,qBAAAA,IAAyB,EAAE,CAAA;AACzE,EAAA,MAAME,oBAAAA,GAAuBJ,QAAQI,oBAAAA,IAAwB,IAAA;AAC7D,EAAA,MAAMC,YAAAA,GACJL,QAAQK,YAAAA,IACR,4GAAA;AAEF,EAAA,IAAI,CAACJ,OAAAA,EAAS;AACZK,IAAAA,MAAAA,CAAOC,KAAK,2CAAA,CAAA;AACZ,IAAA,OAAO,EAAC;AACV,EAAA;AAEAD,EAAAA,MAAAA,CAAOC,KAAK,0CAAA,EAA4C;IACtDL,qBAAAA,EAAuB;AAAIA,MAAAA,GAAAA;;AAC3BE,IAAAA;GACF,CAAA;AAEA,EAAA,OAAO;IACLI,SAAAA,CAAU,EACRtC,MAAI,EAQL;AAEC,MAAA,IAAIM,gBAAgBN,IAAAA,CAAKM,aAAAA;AAEzB,MAAA,IAAI,CAACA,aAAAA,IAAiBN,IAAAA,CAAKK,QAAAA,EAAUG,WAAAA,EAAa;AAChD,QAAA,KAAA,MAAWC,GAAAA,IAAOT,IAAAA,CAAKK,QAAAA,CAASG,WAAAA,EAAa;AAC3C,UAAA,IAAIC,GAAAA,CAAIC,SAAAA,IAAaD,GAAAA,CAAIpB,IAAAA,EAAMU,KAAAA,EAAO;AACpCO,YAAAA,aAAAA,GAAgBG,IAAIpB,IAAAA,CAAKU,KAAAA;AACzB,YAAA;AACF,UAAA;AACF,QAAA;AACF,MAAA;AAGA,MAAA,IAAIO,aAAAA,IAAiB0B,qBAAAA,CAAsBO,GAAAA,CAAIjC,aAAAA,CAAAA,EAAgB;AAC7D,QAAA,OAAOkC,MAAAA;AACT,MAAA;AAGA,MAAA,IAAIN,wBAAwBvB,mBAAAA,CAAoBX,IAAAA,CAAKY,QAAQZ,IAAAA,CAAKK,QAAAA,EAAUC,aAAAA,CAAAA,EAAgB;AAC1F,QAAA,OAAOkC,MAAAA;AACT,MAAA;AAGA,MAAA,MAAMC,UAAUzC,IAAAA,CAAK0C,YAAAA;AACrB,MAAA,MAAMC,WAAAA,GAAcF,SAASG,SAAAA,EAAWC,EAAAA;AAGxC,MAAA,MAAMC,iBAAAA,GAAoBL,OAAAA,EAASM,OAAAA,EAASC,OAAAA,EAASC,MAAM,gBAAA,CAAA;AAE3D,MAAA,IAAI,CAACN,WAAAA,IAAe,CAACG,iBAAAA,EAAmB;AACtCV,QAAAA,MAAAA,CAAOc,KAAK,8DAAA,EAAgE;AAC1E5C,UAAAA,aAAAA,EAAeA,aAAAA,IAAiB;SAClC,CAAA;AACA,QAAA,MAAM,IAAIrB,uBAAuBkD,YAAAA,CAAAA;AACnC,MAAA;AAEA,MAAA,OAAOK,MAAAA;AACT,IAAA;AACF,GAAA;AACF;AApEgBX,MAAAA,CAAAA,0BAAAA,EAAAA,4BAAAA,CAAAA","file":"chunk-UBXFIIAW.js","sourcesContent":["/**\n * Workspace Guard Plugin for GraphQL Yoga\n *\n * Blocks GraphQL operations that lack a valid workspace context (x-workspace-id header).\n * This provides defense-in-depth at the GraphQL layer — even if the gateway allows a request\n * through, the service itself will reject it if workspace context is missing.\n *\n * **Whitelisted operations** (e.g., workspace creation) can bypass the guard.\n *\n * **Public schema fields** marked with `@public` or `@rbac(public: true)` are auto-bypassed\n * when `allowPublicDirective` is enabled (default true). This lets anonymous public-link\n * resolvers (e.g. `accessShare`) be reached through the federation gateway without an\n * `x-workspace-id` header.\n *\n * @module server/workspace-guard\n * @category Security\n */\n\nimport { logger } from '../logger/index.js';\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/**\n * Configuration for the workspace guard plugin\n */\nexport interface WorkspaceGuardConfig {\n  /**\n   * Enable the workspace guard.\n   * @default true\n   */\n  enabled?: boolean;\n\n  /**\n   * GraphQL operation names that can run without workspace context.\n   * These are typically operations like `createWorkspace` that execute\n   * before a workspace exists.\n   *\n   * Matching is case-sensitive against the operation name in the GraphQL document.\n   *\n   * @default []\n   *\n   * @example\n   * ```typescript\n   * whitelistedOperations: ['createWorkspace', 'validateTokens']\n   * ```\n   */\n  whitelistedOperations?: string[];\n\n  /**\n   * Custom error message when workspace context is missing.\n   * @default 'Workspace context required. Provide a valid X-Workspace-Authorization header.'\n   */\n  errorMessage?: string;\n\n  /**\n   * If true, fields whose schema definition carries the `@public` directive or\n   * `@rbac(public: true)` are bypassed by the guard automatically — no need to\n   * list them in `whitelistedOperations`. The check uses the GraphQL schema\n   * passed to the executor at request time.\n   *\n   * Set to false to fall back to the legacy operation-name allowlist only.\n   *\n   * @default true\n   */\n  allowPublicDirective?: boolean;\n}\n\n// ============================================================================\n// GraphQL Error\n// ============================================================================\n\n/**\n * Workspace required error with proper GraphQL error extensions\n */\nclass WorkspaceRequiredError extends Error {\n  public readonly extensions: { code: string; http: { status: number } };\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'WorkspaceRequiredError';\n    this.extensions = {\n      code: 'WORKSPACE_REQUIRED',\n      http: { status: 403 },\n    };\n  }\n}\n\n// ============================================================================\n// Schema directive helpers\n// ============================================================================\n\n/**\n * Minimal structural typings for the bits of the GraphQL schema we look at.\n * We avoid importing the GraphQL types directly so the SDK keeps `graphql`\n * as a peer dep without a runtime hard dependency.\n */\ninterface FieldLikeDef {\n  astNode?: {\n    directives?: ReadonlyArray<{\n      name: { value: string };\n      arguments?: ReadonlyArray<{\n        name: { value: string };\n        value: { kind: string; value?: unknown };\n      }>;\n    }>;\n  };\n}\n\ninterface SchemaLike {\n  getQueryType?: () => { getFields: () => Record<string, FieldLikeDef> } | null | undefined;\n  getMutationType?: () => { getFields: () => Record<string, FieldLikeDef> } | null | undefined;\n  getSubscriptionType?: () => { getFields: () => Record<string, FieldLikeDef> } | null | undefined;\n}\n\n/**\n * Returns true iff the field carries either:\n *   - `@public` directive, OR\n *   - `@rbac(public: true)` directive (any arg-order)\n */\nfunction isFieldPublic(field: FieldLikeDef | undefined): boolean {\n  const directives = field?.astNode?.directives;\n  if (!directives || directives.length === 0) return false;\n\n  for (const dir of directives) {\n    const name = dir.name?.value;\n    if (name === 'public') return true;\n    if (name === 'rbac') {\n      const args = dir.arguments ?? [];\n      for (const arg of args) {\n        if (arg.name?.value === 'public' && arg.value?.kind === 'BooleanValue' && arg.value.value === true) {\n          return true;\n        }\n      }\n    }\n  }\n  return false;\n}\n\ninterface DocumentLike {\n  definitions?: ReadonlyArray<{\n    kind?: string;\n    operation?: string;\n    name?: { value?: string };\n    selectionSet?: {\n      selections?: ReadonlyArray<{\n        kind?: string;\n        name?: { value?: string };\n      }>;\n    };\n  }>;\n}\n\n/**\n * Resolve the operation type ('query' | 'mutation' | 'subscription') for the\n * primary operation in the document. Falls back to 'query'.\n */\nfunction resolveOperationType(\n  document: DocumentLike | undefined,\n  operationName: string | null | undefined\n): 'query' | 'mutation' | 'subscription' {\n  const defs = document?.definitions ?? [];\n  for (const def of defs) {\n    if (def.kind !== 'OperationDefinition') {\n      // Older parsers may not set kind; fall through to the operation property check below.\n    }\n    if (def.operation && (!operationName || def.name?.value === operationName)) {\n      return def.operation as 'query' | 'mutation' | 'subscription';\n    }\n  }\n  return 'query';\n}\n\n/**\n * Returns true iff every root field in the document selection set is marked\n * public on the schema. Empty selection sets return false (fail-closed).\n */\nfunction allRootFieldsPublic(\n  schema: SchemaLike | undefined,\n  document: DocumentLike | undefined,\n  operationName: string | null | undefined\n): boolean {\n  if (!schema || !document) return false;\n\n  const opType = resolveOperationType(document, operationName);\n  let rootType: ReturnType<NonNullable<SchemaLike['getQueryType']>> | undefined;\n  if (opType === 'mutation') {\n    rootType = schema.getMutationType?.();\n  } else if (opType === 'subscription') {\n    rootType = schema.getSubscriptionType?.();\n  } else {\n    rootType = schema.getQueryType?.();\n  }\n\n  if (!rootType) return false;\n\n  const fields = rootType.getFields();\n  const defs = document.definitions ?? [];\n\n  // Find the operation definition matching operationName (or first one).\n  const opDef = defs.find((d) => d.operation && (!operationName || d.name?.value === operationName));\n  const selections = opDef?.selectionSet?.selections ?? [];\n  if (selections.length === 0) return false;\n\n  for (const sel of selections) {\n    // Only consider plain Field selections (skip fragments — fragments at the root\n    // shouldn't drive a public bypass; fail-closed there).\n    if (sel.kind && sel.kind !== 'Field') return false;\n    const fieldName = sel.name?.value;\n    if (!fieldName) return false;\n    // __schema / __type introspection is always allowed without workspace context;\n    // treat them as public.\n    if (fieldName.startsWith('__')) continue;\n    const fieldDef = fields[fieldName];\n    if (!isFieldPublic(fieldDef)) return false;\n  }\n  return true;\n}\n\n// ============================================================================\n// Plugin\n// ============================================================================\n\n/**\n * Create a GraphQL Yoga plugin that guards operations requiring workspace context.\n *\n * The plugin inspects the GraphQL context for workspace information (set by the SDK's\n * buildContext from the x-workspace-id header). If missing and the operation is not\n * whitelisted (and not all-public per directive), it throws a WORKSPACE_REQUIRED error.\n *\n * @param config - Guard configuration\n * @returns A Yoga-compatible plugin\n *\n * @example\n * ```typescript\n * import { createWorkspaceGuardPlugin } from '@burdenoff/be-sdk/server';\n *\n * const guardPlugin = createWorkspaceGuardPlugin({\n *   whitelistedOperations: ['createWorkspace'],\n *   allowPublicDirective: true, // default\n * });\n * ```\n */\nexport function createWorkspaceGuardPlugin(config?: WorkspaceGuardConfig) {\n  const enabled = config?.enabled ?? true;\n  const whitelistedOperations = new Set(config?.whitelistedOperations ?? []);\n  const allowPublicDirective = config?.allowPublicDirective ?? true;\n  const errorMessage =\n    config?.errorMessage ??\n    'Workspace context required. Ensure the request includes a valid workspace context (x-workspace-id header).';\n\n  if (!enabled) {\n    logger.info('[WorkspaceGuard] Workspace guard disabled');\n    return {};\n  }\n\n  logger.info('[WorkspaceGuard] Workspace guard enabled', {\n    whitelistedOperations: [...whitelistedOperations],\n    allowPublicDirective,\n  });\n\n  return {\n    onExecute({\n      args,\n    }: {\n      args: {\n        schema?: SchemaLike;\n        document?: DocumentLike;\n        operationName?: string | null;\n        contextValue?: { workspace?: { id?: string }; request?: Request };\n      };\n    }) {\n      // Extract operation name from args or document\n      let operationName = args.operationName;\n\n      if (!operationName && args.document?.definitions) {\n        for (const def of args.document.definitions) {\n          if (def.operation && def.name?.value) {\n            operationName = def.name.value;\n            break;\n          }\n        }\n      }\n\n      // Check if operation is whitelisted by name\n      if (operationName && whitelistedOperations.has(operationName)) {\n        return undefined;\n      }\n\n      // Check schema-directive-based public bypass (Option C)\n      if (allowPublicDirective && allRootFieldsPublic(args.schema, args.document, operationName)) {\n        return undefined;\n      }\n\n      // Check for workspace context\n      const context = args.contextValue as { workspace?: { id?: string }; request?: Request } | undefined;\n      const workspaceId = context?.workspace?.id;\n\n      // Also check the raw header as a fallback\n      const headerWorkspaceId = context?.request?.headers?.get?.('x-workspace-id');\n\n      if (!workspaceId && !headerWorkspaceId) {\n        logger.warn('[WorkspaceGuard] Blocked operation without workspace context', {\n          operationName: operationName ?? '<anonymous>',\n        });\n        throw new WorkspaceRequiredError(errorMessage);\n      }\n\n      return undefined;\n    },\n  };\n}\n"]}

package/dist/chunk-VI4VSNTI.js

@@ -0,0 +1,57 @@
+import { logger } from './chunk-CBZNP6RF.js';
+import { __name } from './chunk-XE4OXN2W.js';
+import { GraphQLClient } from 'graphql-request';
+
+function createInternalClient(serviceUrl, serviceIdentity, additionalHeaders) {
+  const INTERNAL_TOKEN = process.env["INTERNAL_SERVICE_TOKEN"];
+  if (!INTERNAL_TOKEN) {
+    const error = new Error("INTERNAL_SERVICE_TOKEN environment variable is not configured. This is required for internal service-to-service communication with RBAC bypass.");
+    logger.error("[Internal Client] Missing INTERNAL_SERVICE_TOKEN", {
+      serviceIdentity,
+      serviceUrl
+    });
+    throw error;
+  }
+  if (!serviceIdentity || serviceIdentity.trim().length === 0) {
+    throw new Error("serviceIdentity is required and cannot be empty");
+  }
+  if (!serviceUrl || serviceUrl.trim().length === 0) {
+    throw new Error("serviceUrl is required and cannot be empty");
+  }
+  logger.debug("[Internal Client] Creating internal client", {
+    serviceUrl,
+    serviceIdentity
+  });
+  const headers = {
+    "x-bypass-permission": INTERNAL_TOKEN,
+    "x-service-identity": serviceIdentity,
+    "x-call-type": "internal",
+    ...additionalHeaders
+  };
+  return new GraphQLClient(serviceUrl, {
+    headers
+  });
+}
+__name(createInternalClient, "createInternalClient");
+function createInternalClientForWorkspaces(serviceIdentity, additionalHeaders) {
+  const WORKSPACES_GATEWAY_URL = process.env["WORKSPACES_GATEWAY_URL"] || "http://localhost:4001/workspaces/graphql";
+  logger.debug("[Internal Client] Creating Workspaces client", {
+    serviceIdentity,
+    gatewayUrl: WORKSPACES_GATEWAY_URL
+  });
+  return createInternalClient(WORKSPACES_GATEWAY_URL, serviceIdentity, additionalHeaders);
+}
+__name(createInternalClientForWorkspaces, "createInternalClientForWorkspaces");
+function createInternalClientForTenant(serviceIdentity, additionalHeaders) {
+  const TENANT_GATEWAY_URL = process.env["TENANT_GATEWAY_URL"] || "http://localhost:4002/tenant/graphql";
+  logger.debug("[Internal Client] Creating Tenant client", {
+    serviceIdentity,
+    gatewayUrl: TENANT_GATEWAY_URL
+  });
+  return createInternalClient(TENANT_GATEWAY_URL, serviceIdentity, additionalHeaders);
+}
+__name(createInternalClientForTenant, "createInternalClientForTenant");
+
+export { createInternalClient, createInternalClientForTenant, createInternalClientForWorkspaces };
+//# sourceMappingURL=chunk-VI4VSNTI.js.map
+//# sourceMappingURL=chunk-VI4VSNTI.js.map

package/dist/chunk-VI4VSNTI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client/internal-client.ts"],"names":["createInternalClient","serviceUrl","serviceIdentity","additionalHeaders","INTERNAL_TOKEN","process","env","error","Error","logger","trim","length","debug","headers","GraphQLClient","createInternalClientForWorkspaces","WORKSPACES_GATEWAY_URL","gatewayUrl","createInternalClientForTenant","TENANT_GATEWAY_URL"],"mappings":";;;;AAiFO,SAASA,oBAAAA,CACdC,UAAAA,EACAC,eAAAA,EACAC,iBAAAA,EAA0C;AAE1C,EAAA,MAAMC,cAAAA,GAAiBC,OAAAA,CAAQC,GAAAA,CAAI,wBAAA,CAAA;AAEnC,EAAA,IAAI,CAACF,cAAAA,EAAgB;AACnB,IAAA,MAAMG,KAAAA,GAAQ,IAAIC,KAAAA,CAChB,iJACE,CAAA;AAEJC,IAAAA,MAAAA,CAAOF,MAAM,kDAAA,EAAoD;AAC/DL,MAAAA,eAAAA;AACAD,MAAAA;KACF,CAAA;AACA,IAAA,MAAMM,KAAAA;AACR,EAAA;AAEA,EAAA,IAAI,CAACL,eAAAA,IAAmBA,eAAAA,CAAgBQ,IAAAA,EAAI,CAAGC,WAAW,CAAA,EAAG;AAC3D,IAAA,MAAM,IAAIH,MAAM,iDAAA,CAAA;AAClB,EAAA;AAEA,EAAA,IAAI,CAACP,UAAAA,IAAcA,UAAAA,CAAWS,IAAAA,EAAI,CAAGC,WAAW,CAAA,EAAG;AACjD,IAAA,MAAM,IAAIH,MAAM,4CAAA,CAAA;AAClB,EAAA;AAEAC,EAAAA,MAAAA,CAAOG,MAAM,4CAAA,EAA8C;AACzDX,IAAAA,UAAAA;AACAC,IAAAA;GACF,CAAA;AAiBA,EAAA,MAAMW,OAAAA,GAAkC;IACtC,qBAAA,EAAuBT,cAAAA;IACvB,oBAAA,EAAsBF,eAAAA;IACtB,aAAA,EAAe,UAAA;IACf,GAAGC;AACL,GAAA;AAEA,EAAA,OAAO,IAAIW,cAAcb,UAAAA,EAAY;AAAEY,IAAAA;GAAQ,CAAA;AACjD;AAvDgBb,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAiFT,SAASe,iCAAAA,CACdb,iBACAC,iBAAAA,EAA0C;AAE1C,EAAA,MAAMa,sBAAAA,GAAyBX,OAAAA,CAAQC,GAAAA,CAAI,wBAAA,CAAA,IAA6B,0CAAA;AAExEG,EAAAA,MAAAA,CAAOG,MAAM,8CAAA,EAAgD;AAC3DV,IAAAA,eAAAA;IACAe,UAAAA,EAAYD;GACd,CAAA;AAEA,EAAA,OAAOhB,oBAAAA,CAAqBgB,sBAAAA,EAAwBd,eAAAA,EAAiBC,iBAAAA,CAAAA;AACvE;AAZgBY,MAAAA,CAAAA,iCAAAA,EAAAA,mCAAAA,CAAAA;AAuCT,SAASG,6BAAAA,CACdhB,iBACAC,iBAAAA,EAA0C;AAE1C,EAAA,MAAMgB,kBAAAA,GAAqBd,OAAAA,CAAQC,GAAAA,CAAI,oBAAA,CAAA,IAAyB,sCAAA;AAEhEG,EAAAA,MAAAA,CAAOG,MAAM,0CAAA,EAA4C;AACvDV,IAAAA,eAAAA;IACAe,UAAAA,EAAYE;GACd,CAAA;AAEA,EAAA,OAAOnB,oBAAAA,CAAqBmB,kBAAAA,EAAoBjB,eAAAA,EAAiBC,iBAAAA,CAAAA;AACnE;AAZgBe,MAAAA,CAAAA,6BAAAA,EAAAA,+BAAAA,CAAAA","file":"chunk-VI4VSNTI.js","sourcesContent":["/**\n * Internal Client for Service-to-Service Communication\n *\n * This module provides helper functions to create GraphQL clients for internal\n * service-to-service calls with automatic RBAC bypass.\n *\n * Features:\n * - Automatic injection of bypass headers (x-bypass-permission, x-service-identity)\n * - Pre-configured for workspaces and tenant gateways\n * - Environment variable validation\n *\n * ⚠️ IMPORTANT: Header Transformation Architecture\n * ================================================\n * This client sends headers to the INTERNAL API GATEWAY, which transforms them\n * before forwarding to downstream services with RBAC directives.\n *\n * Header Flow:\n * 1. This client → Gateway: x-bypass-permission, x-service-identity, x-call-type\n * 2. Gateway → Service: x-rbac-bypass, x-bypass-source, x-bypass-timestamp\n *\n * The headers sent by this client DO NOT match the headers expected by the RBAC\n * directive (src/rbac/directive.ts). This is INTENTIONAL - the gateway handles\n * the transformation as part of the security architecture.\n *\n * @module client/internal-client\n * @example\n * ```typescript\n * import { createInternalClient } from '@burdenoff/be-sdk/client/internal';\n *\n * const client = createInternalClient(\n *   'http://localhost:4001/workspaces/graphql',\n *   'scheduler-service'\n * );\n *\n * const result = await client.request(`\n *   mutation {\n *     createProject(input: { name: \"Test\" }) {\n *       id\n *     }\n *   }\n * `);\n * ```\n */\n\nimport { GraphQLClient } from 'graphql-request';\nimport { logger } from '../logger/index.js';\n\n/**\n * Create GraphQL client for internal service-to-service calls\n *\n * This client automatically injects bypass headers for RBAC bypass:\n * - x-bypass-permission: Internal service token (from env)\n * - x-service-identity: Service identifier\n * - x-call-type: \"internal\"\n *\n * IMPORTANT: This should ONLY be used for internal service-to-service calls,\n * never for user-initiated requests.\n *\n * @param serviceUrl - GraphQL endpoint URL (e.g., 'http://localhost:4001/workspaces/graphql')\n * @param serviceIdentity - Service identifier (e.g., 'scheduler-service')\n * @param additionalHeaders - Optional additional headers to include\n * @returns Configured GraphQL client with bypass headers\n * @throws Error if INTERNAL_SERVICE_TOKEN is not configured\n *\n * @example\n * ```typescript\n * const client = createInternalClient(\n *   process.env.WORKSPACES_GATEWAY_URL,\n *   'scheduler-service'\n * );\n *\n * const result = await client.request(`\n *   query {\n *     workspace(id: \"ws123\") {\n *       id\n *       name\n *     }\n *   }\n * `);\n * ```\n */\nexport function createInternalClient(\n  serviceUrl: string,\n  serviceIdentity: string,\n  additionalHeaders?: Record<string, string>\n): GraphQLClient {\n  const INTERNAL_TOKEN = process.env['INTERNAL_SERVICE_TOKEN'];\n\n  if (!INTERNAL_TOKEN) {\n    const error = new Error(\n      'INTERNAL_SERVICE_TOKEN environment variable is not configured. ' +\n        'This is required for internal service-to-service communication with RBAC bypass.'\n    );\n    logger.error('[Internal Client] Missing INTERNAL_SERVICE_TOKEN', {\n      serviceIdentity,\n      serviceUrl,\n    });\n    throw error;\n  }\n\n  if (!serviceIdentity || serviceIdentity.trim().length === 0) {\n    throw new Error('serviceIdentity is required and cannot be empty');\n  }\n\n  if (!serviceUrl || serviceUrl.trim().length === 0) {\n    throw new Error('serviceUrl is required and cannot be empty');\n  }\n\n  logger.debug('[Internal Client] Creating internal client', {\n    serviceUrl,\n    serviceIdentity,\n  });\n\n  // ⚠️ ARCHITECTURE NOTE: Header Transformation Flow\n  // ================================================\n  // These headers are sent to the INTERNAL API GATEWAY, NOT directly to downstream services.\n  //\n  // Flow:\n  // 1. Service A (this client) → Internal API Gateway\n  //    Headers: x-bypass-permission, x-service-identity, x-call-type\n  //\n  // 2. Internal API Gateway → Service B (with RBAC directive)\n  //    Headers transformed to: x-rbac-bypass, x-bypass-source, x-bypass-timestamp\n  //\n  // The RBAC directive (src/rbac/directive.ts:472-474) expects the TRANSFORMED headers,\n  // not these original headers. This is intentional and part of the security architecture.\n  //\n  // DO NOT \"fix\" this to match RBAC directive headers - the gateway handles the transformation.\n  const headers: Record<string, string> = {\n    'x-bypass-permission': INTERNAL_TOKEN,\n    'x-service-identity': serviceIdentity,\n    'x-call-type': 'internal',\n    ...additionalHeaders,\n  };\n\n  return new GraphQLClient(serviceUrl, { headers });\n}\n\n/**\n * Create GraphQL client for Workspaces Gateway (internal)\n *\n * Convenience wrapper for createInternalClient that uses WORKSPACES_GATEWAY_URL\n * from environment variables.\n *\n * @param serviceIdentity - Service identifier (e.g., 'scheduler-service')\n * @param additionalHeaders - Optional additional headers\n * @returns Configured GraphQL client\n * @throws Error if WORKSPACES_GATEWAY_URL or INTERNAL_SERVICE_TOKEN not configured\n *\n * @example\n * ```typescript\n * const client = createInternalClientForWorkspaces('scheduler-service');\n *\n * const result = await client.request(`\n *   mutation {\n *     generateReport(workspaceId: \"ws123\") {\n *       id\n *     }\n *   }\n * `);\n * ```\n */\nexport function createInternalClientForWorkspaces(\n  serviceIdentity: string,\n  additionalHeaders?: Record<string, string>\n): GraphQLClient {\n  const WORKSPACES_GATEWAY_URL = process.env['WORKSPACES_GATEWAY_URL'] || 'http://localhost:4001/workspaces/graphql';\n\n  logger.debug('[Internal Client] Creating Workspaces client', {\n    serviceIdentity,\n    gatewayUrl: WORKSPACES_GATEWAY_URL,\n  });\n\n  return createInternalClient(WORKSPACES_GATEWAY_URL, serviceIdentity, additionalHeaders);\n}\n\n/**\n * Create GraphQL client for Tenant Gateway (internal)\n *\n * Convenience wrapper for createInternalClient that uses TENANT_GATEWAY_URL\n * from environment variables.\n *\n * @param serviceIdentity - Service identifier (e.g., 'notification-dispatcher')\n * @param additionalHeaders - Optional additional headers\n * @returns Configured GraphQL client\n * @throws Error if TENANT_GATEWAY_URL or INTERNAL_SERVICE_TOKEN not configured\n *\n * @example\n * ```typescript\n * const client = createInternalClientForTenant('notification-dispatcher');\n *\n * const result = await client.request(`\n *   query {\n *     notifications(workspaceId: \"ws123\") {\n *       id\n *       type\n *     }\n *   }\n * `);\n * ```\n */\nexport function createInternalClientForTenant(\n  serviceIdentity: string,\n  additionalHeaders?: Record<string, string>\n): GraphQLClient {\n  const TENANT_GATEWAY_URL = process.env['TENANT_GATEWAY_URL'] || 'http://localhost:4002/tenant/graphql';\n\n  logger.debug('[Internal Client] Creating Tenant client', {\n    serviceIdentity,\n    gatewayUrl: TENANT_GATEWAY_URL,\n  });\n\n  return createInternalClient(TENANT_GATEWAY_URL, serviceIdentity, additionalHeaders);\n}\n"]}

package/dist/chunk-VWCN5PMD.js

@@ -0,0 +1,268 @@
+import { __export, __name } from './chunk-XE4OXN2W.js';
+
+// src/feature-flags/index.ts
+var feature_flags_exports = {};
+__export(feature_flags_exports, {
+  FeatureFlagProvider: () => FeatureFlagProvider
+});
+
+// src/feature-flags/provider.ts
+var EVALUATE_QUERY = `
+  query EvaluateFeatureFlags($input: EvaluateFeatureFlagsInput!) {
+    evaluateFeatureFlags(input: $input) {
+      evaluations {
+        key
+        value
+        variant
+        reason
+        flagType
+        errorCode
+      }
+    }
+  }
+`;
+var FeatureFlagProvider = class {
+  static {
+    __name(this, "FeatureFlagProvider");
+  }
+  gatewayUrl;
+  cacheTtlMs;
+  serviceToken;
+  defaultActorType;
+  /** In-memory cache keyed by `${workspaceId}:${actorId}` */
+  cache = /* @__PURE__ */ new Map();
+  constructor(config) {
+    this.gatewayUrl = config.gatewayUrl;
+    this.cacheTtlMs = (config.cacheTtlSeconds ?? 60) * 1e3;
+    this.serviceToken = config.serviceToken;
+    this.defaultActorType = config.defaultActorType ?? "service";
+  }
+  // =========================================================================
+  // Public Resolution Methods (OpenFeature-compatible interface)
+  // =========================================================================
+  /**
+  * Resolve a boolean feature flag
+  *
+  * @param flagKey - The flag key (e.g. "calendar.recurring-events")
+  * @param defaultValue - Default value if resolution fails
+  * @param context - Evaluation context with actor and workspace info
+  * @returns Resolution details with the resolved boolean value
+  */
+  async resolveBoolean(flagKey, defaultValue, context) {
+    const evaluation = await this.getEvaluation(flagKey, context);
+    if (!evaluation) {
+      return {
+        value: defaultValue,
+        reason: "DEFAULT",
+        flagType: "BOOLEAN"
+      };
+    }
+    return {
+      value: Boolean(evaluation.value),
+      variant: evaluation.variant ?? void 0,
+      reason: evaluation.reason,
+      flagType: evaluation.flagType,
+      errorCode: evaluation.errorCode ?? void 0
+    };
+  }
+  /**
+  * Resolve a string feature flag
+  */
+  async resolveString(flagKey, defaultValue, context) {
+    const evaluation = await this.getEvaluation(flagKey, context);
+    if (!evaluation) {
+      return {
+        value: defaultValue,
+        reason: "DEFAULT",
+        flagType: "STRING"
+      };
+    }
+    return {
+      value: String(evaluation.value),
+      variant: evaluation.variant ?? void 0,
+      reason: evaluation.reason,
+      flagType: evaluation.flagType,
+      errorCode: evaluation.errorCode ?? void 0
+    };
+  }
+  /**
+  * Resolve a number feature flag
+  */
+  async resolveNumber(flagKey, defaultValue, context) {
+    const evaluation = await this.getEvaluation(flagKey, context);
+    if (!evaluation) {
+      return {
+        value: defaultValue,
+        reason: "DEFAULT",
+        flagType: "NUMBER"
+      };
+    }
+    return {
+      value: Number(evaluation.value),
+      variant: evaluation.variant ?? void 0,
+      reason: evaluation.reason,
+      flagType: evaluation.flagType,
+      errorCode: evaluation.errorCode ?? void 0
+    };
+  }
+  /**
+  * Resolve an object (JSON) feature flag
+  */
+  async resolveObject(flagKey, defaultValue, context) {
+    const evaluation = await this.getEvaluation(flagKey, context);
+    if (!evaluation) {
+      return {
+        value: defaultValue,
+        reason: "DEFAULT",
+        flagType: "JSON"
+      };
+    }
+    return {
+      value: evaluation.value,
+      variant: evaluation.variant ?? void 0,
+      reason: evaluation.reason,
+      flagType: evaluation.flagType,
+      errorCode: evaluation.errorCode ?? void 0
+    };
+  }
+  // =========================================================================
+  // Convenience Methods
+  // =========================================================================
+  /**
+  * Quick boolean check — returns just the value.
+  * Defaults to `true` (default-allow philosophy) if the flag is not found.
+  *
+  * @example
+  * ```typescript
+  * if (await provider.isEnabled('calendar.recurring-events', ctx)) {
+  *   // Feature is enabled
+  * }
+  * ```
+  */
+  async isEnabled(flagKey, context) {
+    const result = await this.resolveBoolean(flagKey, true, context ?? {
+      workspaceId: "system",
+      actorType: "service",
+      actorId: "boot"
+    });
+    return result.value;
+  }
+  /**
+  * Bulk evaluate multiple flags at once.
+  * Returns a map of key -> ResolutionDetails.
+  */
+  async evaluateAll(context, keys) {
+    const evaluations = await this.fetchEvaluations(context, keys);
+    const result = /* @__PURE__ */ new Map();
+    for (const [key, evaluation] of evaluations) {
+      result.set(key, {
+        value: evaluation.value,
+        variant: evaluation.variant ?? void 0,
+        reason: evaluation.reason,
+        flagType: evaluation.flagType,
+        errorCode: evaluation.errorCode ?? void 0
+      });
+    }
+    return result;
+  }
+  /**
+  * Invalidate the cache for a specific workspace+actor combination,
+  * or all cache entries if no context is provided.
+  */
+  invalidateCache(context) {
+    if (context) {
+      const cacheKey = this.buildCacheKey(context);
+      this.cache.delete(cacheKey);
+    } else {
+      this.cache.clear();
+    }
+  }
+  // =========================================================================
+  // Private Methods
+  // =========================================================================
+  /**
+  * Get a single flag evaluation, fetching from cache or API
+  */
+  async getEvaluation(flagKey, context) {
+    try {
+      const evaluations = await this.fetchEvaluations(context);
+      return evaluations.get(flagKey) ?? null;
+    } catch {
+      return null;
+    }
+  }
+  /**
+  * Fetch flag evaluations — uses cache if available, otherwise calls the API
+  */
+  async fetchEvaluations(context, keys) {
+    const cacheKey = this.buildCacheKey(context);
+    const cached = this.cache.get(cacheKey);
+    if (cached && cached.expiresAt > Date.now()) {
+      return cached.evaluations;
+    }
+    if (!context?.workspaceId) {
+      return /* @__PURE__ */ new Map();
+    }
+    try {
+      const response = await fetch(this.gatewayUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          ...context.actorId && {
+            "x-actor-id": context.actorId
+          },
+          "x-actor-type": context.actorType ?? this.defaultActorType,
+          "x-workspace-id": context.workspaceId,
+          ...this.serviceToken && {
+            Authorization: `Bearer ${this.serviceToken}`
+          }
+        },
+        body: JSON.stringify({
+          query: EVALUATE_QUERY,
+          variables: {
+            input: {
+              workspaceId: context.workspaceId,
+              keys: keys ?? null
+            }
+          }
+        })
+      });
+      if (!response.ok) {
+        return /* @__PURE__ */ new Map();
+      }
+      const json = await response.json();
+      if (json.errors || !json.data?.evaluateFeatureFlags?.evaluations) {
+        return /* @__PURE__ */ new Map();
+      }
+      const evaluations = /* @__PURE__ */ new Map();
+      for (const evaluation of json.data.evaluateFeatureFlags.evaluations) {
+        evaluations.set(evaluation.key, evaluation);
+      }
+      this.cache.set(cacheKey, {
+        evaluations,
+        expiresAt: Date.now() + this.cacheTtlMs
+      });
+      return evaluations;
+    } catch {
+      return /* @__PURE__ */ new Map();
+    }
+  }
+  /**
+  * Build a cache key from the evaluation context.
+  *
+  * Safe against undefined/null context — callers like isEnabled() may
+  * pass no context during service boot (e.g. checking a default-allow
+  * feature flag at startup before the first request builds a real
+  * actor context). Without the guard, isEnabled(flag) used to throw
+  * "undefined is not an object (evaluating 'context.workspaceId')"
+  * and crash the svc at startServer().
+  */
+  buildCacheKey(context) {
+    const ctx = context ?? {};
+    return `${ctx.workspaceId ?? "system"}:${ctx.actorId ?? "anonymous"}:${ctx.actorType ?? "user"}`;
+  }
+};
+
+export { FeatureFlagProvider, feature_flags_exports };
+//# sourceMappingURL=chunk-VWCN5PMD.js.map
+//# sourceMappingURL=chunk-VWCN5PMD.js.map

package/dist/chunk-VWCN5PMD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/feature-flags/index.ts","../src/feature-flags/provider.ts"],"names":["EVALUATE_QUERY","FeatureFlagProvider","gatewayUrl","cacheTtlMs","serviceToken","defaultActorType","cache","Map","config","cacheTtlSeconds","resolveBoolean","flagKey","defaultValue","context","evaluation","getEvaluation","value","reason","flagType","Boolean","variant","undefined","errorCode","resolveString","String","resolveNumber","Number","resolveObject","isEnabled","result","workspaceId","actorType","actorId","evaluateAll","keys","evaluations","fetchEvaluations","key","set","invalidateCache","cacheKey","buildCacheKey","delete","clear","get","cached","expiresAt","Date","now","response","fetch","method","headers","Authorization","body","JSON","stringify","query","variables","input","ok","json","errors","data","evaluateFeatureFlags","ctx"],"mappings":";;;AAAA,IAAA,qBAAA,GAAA;;;;;;ACqCA,IAAMA,cAAAA,GAAiB;;;;;;;;;;;;;;AAsBhB,IAAMC,sBAAN,MAAMA;EA3Db;;;AA4DmBC,EAAAA,UAAAA;AACAC,EAAAA,UAAAA;AACAC,EAAAA,YAAAA;AACAC,EAAAA,gBAAAA;;AAGAC,EAAAA,KAAAA,uBAAYC,GAAAA,EAAAA;AAE7B,EAAA,WAAA,CAAYC,MAAAA,EAAmC;AAC7C,IAAA,IAAA,CAAKN,aAAaM,MAAAA,CAAON,UAAAA;AACzB,IAAA,IAAA,CAAKC,UAAAA,GAAAA,CAAcK,MAAAA,CAAOC,eAAAA,IAAmB,EAAA,IAAM,GAAA;AACnD,IAAA,IAAA,CAAKL,eAAeI,MAAAA,CAAOJ,YAAAA;AAC3B,IAAA,IAAA,CAAKC,gBAAAA,GAAmBG,OAAOH,gBAAAA,IAAoB,SAAA;AACrD,EAAA;;;;;;;;;;;;EAcA,MAAMK,cAAAA,CACJC,OAAAA,EACAC,YAAAA,EACAC,OAAAA,EACqC;AACrC,IAAA,MAAMC,UAAAA,GAAa,MAAM,IAAA,CAAKC,aAAAA,CAAcJ,SAASE,OAAAA,CAAAA;AACrD,IAAA,IAAI,CAACC,UAAAA,EAAY;AACf,MAAA,OAAO;QACLE,KAAAA,EAAOJ,YAAAA;QACPK,MAAAA,EAAQ,SAAA;QACRC,QAAAA,EAAU;AACZ,OAAA;AACF,IAAA;AAEA,IAAA,OAAO;MACLF,KAAAA,EAAOG,OAAAA,CAAQL,WAAWE,KAAK,CAAA;AAC/BI,MAAAA,OAAAA,EAASN,WAAWM,OAAAA,IAAWC,MAAAA;AAC/BJ,MAAAA,MAAAA,EAAQH,UAAAA,CAAWG,MAAAA;AACnBC,MAAAA,QAAAA,EAAUJ,UAAAA,CAAWI,QAAAA;AACrBI,MAAAA,SAAAA,EAAWR,WAAWQ,SAAAA,IAAaD;AACrC,KAAA;AACF,EAAA;;;;EAKA,MAAME,aAAAA,CACJZ,OAAAA,EACAC,YAAAA,EACAC,OAAAA,EACoC;AACpC,IAAA,MAAMC,UAAAA,GAAa,MAAM,IAAA,CAAKC,aAAAA,CAAcJ,SAASE,OAAAA,CAAAA;AACrD,IAAA,IAAI,CAACC,UAAAA,EAAY;AACf,MAAA,OAAO;QACLE,KAAAA,EAAOJ,YAAAA;QACPK,MAAAA,EAAQ,SAAA;QACRC,QAAAA,EAAU;AACZ,OAAA;AACF,IAAA;AAEA,IAAA,OAAO;MACLF,KAAAA,EAAOQ,MAAAA,CAAOV,WAAWE,KAAK,CAAA;AAC9BI,MAAAA,OAAAA,EAASN,WAAWM,OAAAA,IAAWC,MAAAA;AAC/BJ,MAAAA,MAAAA,EAAQH,UAAAA,CAAWG,MAAAA;AACnBC,MAAAA,QAAAA,EAAUJ,UAAAA,CAAWI,QAAAA;AACrBI,MAAAA,SAAAA,EAAWR,WAAWQ,SAAAA,IAAaD;AACrC,KAAA;AACF,EAAA;;;;EAKA,MAAMI,aAAAA,CACJd,OAAAA,EACAC,YAAAA,EACAC,OAAAA,EACoC;AACpC,IAAA,MAAMC,UAAAA,GAAa,MAAM,IAAA,CAAKC,aAAAA,CAAcJ,SAASE,OAAAA,CAAAA;AACrD,IAAA,IAAI,CAACC,UAAAA,EAAY;AACf,MAAA,OAAO;QACLE,KAAAA,EAAOJ,YAAAA;QACPK,MAAAA,EAAQ,SAAA;QACRC,QAAAA,EAAU;AACZ,OAAA;AACF,IAAA;AAEA,IAAA,OAAO;MACLF,KAAAA,EAAOU,MAAAA,CAAOZ,WAAWE,KAAK,CAAA;AAC9BI,MAAAA,OAAAA,EAASN,WAAWM,OAAAA,IAAWC,MAAAA;AAC/BJ,MAAAA,MAAAA,EAAQH,UAAAA,CAAWG,MAAAA;AACnBC,MAAAA,QAAAA,EAAUJ,UAAAA,CAAWI,QAAAA;AACrBI,MAAAA,SAAAA,EAAWR,WAAWQ,SAAAA,IAAaD;AACrC,KAAA;AACF,EAAA;;;;EAKA,MAAMM,aAAAA,CACJhB,OAAAA,EACAC,YAAAA,EACAC,OAAAA,EAC+B;AAC/B,IAAA,MAAMC,UAAAA,GAAa,MAAM,IAAA,CAAKC,aAAAA,CAAcJ,SAASE,OAAAA,CAAAA;AACrD,IAAA,IAAI,CAACC,UAAAA,EAAY;AACf,MAAA,OAAO;QACLE,KAAAA,EAAOJ,YAAAA;QACPK,MAAAA,EAAQ,SAAA;QACRC,QAAAA,EAAU;AACZ,OAAA;AACF,IAAA;AAEA,IAAA,OAAO;AACLF,MAAAA,KAAAA,EAAOF,UAAAA,CAAWE,KAAAA;AAClBI,MAAAA,OAAAA,EAASN,WAAWM,OAAAA,IAAWC,MAAAA;AAC/BJ,MAAAA,MAAAA,EAAQH,UAAAA,CAAWG,MAAAA;AACnBC,MAAAA,QAAAA,EAAUJ,UAAAA,CAAWI,QAAAA;AACrBI,MAAAA,SAAAA,EAAWR,WAAWQ,SAAAA,IAAaD;AACrC,KAAA;AACF,EAAA;;;;;;;;;;;;;;;EAiBA,MAAMO,SAAAA,CAAUjB,SAAiBE,OAAAA,EAA+C;AAC9E,IAAA,MAAMgB,SAAS,MAAM,IAAA,CAAKnB,cAAAA,CACxBC,OAAAA,EACA,MACAE,OAAAA,IAAW;MAAEiB,WAAAA,EAAa,QAAA;MAAUC,SAAAA,EAAW,SAAA;MAAWC,OAAAA,EAAS;KAAO,CAAA;AAE5E,IAAA,OAAOH,MAAAA,CAAOb,KAAAA;AAChB,EAAA;;;;;EAMA,MAAMiB,WAAAA,CAAYpB,SAA4BqB,IAAAA,EAAmE;AAC/G,IAAA,MAAMC,WAAAA,GAAc,MAAM,IAAA,CAAKC,gBAAAA,CAAiBvB,SAASqB,IAAAA,CAAAA;AACzD,IAAA,MAAML,MAAAA,uBAAatB,GAAAA,EAAAA;AAEnB,IAAA,KAAA,MAAW,CAAC8B,GAAAA,EAAKvB,UAAAA,CAAAA,IAAeqB,WAAAA,EAAa;AAC3CN,MAAAA,MAAAA,CAAOS,IAAID,GAAAA,EAAK;AACdrB,QAAAA,KAAAA,EAAOF,UAAAA,CAAWE,KAAAA;AAClBI,QAAAA,OAAAA,EAASN,WAAWM,OAAAA,IAAWC,MAAAA;AAC/BJ,QAAAA,MAAAA,EAAQH,UAAAA,CAAWG,MAAAA;AACnBC,QAAAA,QAAAA,EAAUJ,UAAAA,CAAWI,QAAAA;AACrBI,QAAAA,SAAAA,EAAWR,WAAWQ,SAAAA,IAAaD;OACrC,CAAA;AACF,IAAA;AAEA,IAAA,OAAOQ,MAAAA;AACT,EAAA;;;;;AAMAU,EAAAA,eAAAA,CAAgB1B,OAAAA,EAAmC;AACjD,IAAA,IAAIA,OAAAA,EAAS;AACX,MAAA,MAAM2B,QAAAA,GAAW,IAAA,CAAKC,aAAAA,CAAc5B,OAAAA,CAAAA;AACpC,MAAA,IAAA,CAAKP,KAAAA,CAAMoC,OAAOF,QAAAA,CAAAA;IACpB,CAAA,MAAO;AACL,MAAA,IAAA,CAAKlC,MAAMqC,KAAAA,EAAK;AAClB,IAAA;AACF,EAAA;;;;;;;EASA,MAAc5B,aAAAA,CAAcJ,SAAiBE,OAAAA,EAAwE;AACnH,IAAA,IAAI;AACF,MAAA,MAAMsB,WAAAA,GAAc,MAAM,IAAA,CAAKC,gBAAAA,CAAiBvB,OAAAA,CAAAA;AAChD,MAAA,OAAOsB,WAAAA,CAAYS,GAAAA,CAAIjC,OAAAA,CAAAA,IAAY,IAAA;IACrC,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AACT,IAAA;AACF,EAAA;;;;EAKA,MAAcyB,gBAAAA,CACZvB,SACAqB,IAAAA,EACsC;AACtC,IAAA,MAAMM,QAAAA,GAAW,IAAA,CAAKC,aAAAA,CAAc5B,OAAAA,CAAAA;AACpC,IAAA,MAAMgC,MAAAA,GAAS,IAAA,CAAKvC,KAAAA,CAAMsC,GAAAA,CAAIJ,QAAAA,CAAAA;AAE9B,IAAA,IAAIK,MAAAA,IAAUA,MAAAA,CAAOC,SAAAA,GAAYC,IAAAA,CAAKC,KAAG,EAAI;AAC3C,MAAA,OAAOH,MAAAA,CAAOV,WAAAA;AAChB,IAAA;AAIA,IAAA,IAAI,CAACtB,SAASiB,WAAAA,EAAa;AACzB,MAAA,2BAAWvB,GAAAA,EAAAA;AACb,IAAA;AAGA,IAAA,IAAI;AACF,MAAA,MAAM0C,QAAAA,GAAW,MAAMC,KAAAA,CAAM,IAAA,CAAKhD,UAAAA,EAAY;QAC5CiD,MAAAA,EAAQ,MAAA;QACRC,OAAAA,EAAS;UACP,cAAA,EAAgB,kBAAA;AAChB,UAAA,GAAIvC,QAAQmB,OAAAA,IAAW;AAAE,YAAA,YAAA,EAAcnB,OAAAA,CAAQmB;AAAQ,WAAA;UACvD,cAAA,EAAgBnB,OAAAA,CAAQkB,aAAa,IAAA,CAAK1B,gBAAAA;AAC1C,UAAA,gBAAA,EAAkBQ,OAAAA,CAAQiB,WAAAA;AAC1B,UAAA,GAAI,KAAK1B,YAAAA,IAAgB;YAAEiD,aAAAA,EAAe,CAAA,OAAA,EAAU,KAAKjD,YAAY,CAAA;AAAG;AAC1E,SAAA;AACAkD,QAAAA,IAAAA,EAAMC,KAAKC,SAAAA,CAAU;UACnBC,KAAAA,EAAOzD,cAAAA;UACP0D,SAAAA,EAAW;YACTC,KAAAA,EAAO;AACL7B,cAAAA,WAAAA,EAAajB,OAAAA,CAAQiB,WAAAA;AACrBI,cAAAA,IAAAA,EAAMA,IAAAA,IAAQ;AAChB;AACF;SACF;OACF,CAAA;AAEA,MAAA,IAAI,CAACe,SAASW,EAAAA,EAAI;AAEhB,QAAA,2BAAWrD,GAAAA,EAAAA;AACb,MAAA;AAEA,MAAA,MAAMsD,IAAAA,GAAQ,MAAMZ,QAAAA,CAASY,IAAAA,EAAI;AASjC,MAAA,IAAIA,KAAKC,MAAAA,IAAU,CAACD,IAAAA,CAAKE,IAAAA,EAAMC,sBAAsB7B,WAAAA,EAAa;AAChE,QAAA,2BAAW5B,GAAAA,EAAAA;AACb,MAAA;AAEA,MAAA,MAAM4B,WAAAA,uBAAkB5B,GAAAA,EAAAA;AACxB,MAAA,KAAA,MAAWO,UAAAA,IAAc+C,IAAAA,CAAKE,IAAAA,CAAKC,oBAAAA,CAAqB7B,WAAAA,EAAa;AACnEA,QAAAA,WAAAA,CAAYG,GAAAA,CAAIxB,UAAAA,CAAWuB,GAAAA,EAAKvB,UAAAA,CAAAA;AAClC,MAAA;AAGA,MAAA,IAAA,CAAKR,KAAAA,CAAMgC,IAAIE,QAAAA,EAAU;AACvBL,QAAAA,WAAAA;QACAW,SAAAA,EAAWC,IAAAA,CAAKC,GAAAA,EAAG,GAAK,IAAA,CAAK7C;OAC/B,CAAA;AAEA,MAAA,OAAOgC,WAAAA;IACT,CAAA,CAAA,MAAQ;AAEN,MAAA,2BAAW5B,GAAAA,EAAAA;AACb,IAAA;AACF,EAAA;;;;;;;;;;;AAYQkC,EAAAA,aAAAA,CAAc5B,OAAAA,EAAgD;AACpE,IAAA,MAAMoD,GAAAA,GAAMpD,WAAY,EAAC;AACzB,IAAA,OAAO,CAAA,EAAGoD,GAAAA,CAAInC,WAAAA,IAAe,QAAA,CAAA,CAAA,EAAYmC,GAAAA,CAAIjC,OAAAA,IAAW,WAAA,CAAA,CAAA,EAAeiC,GAAAA,CAAIlC,SAAAA,IAAa,MAAA,CAAA,CAAA;AAC1F,EAAA;AACF","file":"chunk-VWCN5PMD.js","sourcesContent":["/**\n * Feature Flags Module\n *\n * In-house feature flag evaluation for Burdenoff backend services.\n * Compatible with OpenFeature specification concepts.\n *\n * @module feature-flags\n * @category FeatureFlags\n *\n * @example\n * ```typescript\n * import { FeatureFlagProvider } from '@burdenoff/be-sdk/feature-flags';\n *\n * // Create provider (typically done once at service startup)\n * const provider = new FeatureFlagProvider({\n *   gatewayUrl: process.env.GLOBAL_INT_GATEWAY_URL || 'http://global-int-gateway:4000/global/graphql',\n *   cacheTtlSeconds: 60,\n * });\n *\n * // Check a boolean flag\n * const ctx = { actorId: 'user-123', actorType: 'user' as const, workspaceId: 'ws-456' };\n * const isEnabled = await provider.isEnabled('calendar.recurring-events', ctx);\n *\n * // Resolve with full details\n * const details = await provider.resolveBoolean('calendar.recurring-events', true, ctx);\n * console.log(details.value);   // true\n * console.log(details.reason);  // 'TARGETING_MATCH'\n * console.log(details.variant); // 'user-opted-in'\n * ```\n */\n\nexport { FeatureFlagProvider } from './provider.js';\nexport type {\n  EvaluationContext,\n  FeatureFlagProviderConfig,\n  FlagEvaluation,\n  FlagType,\n  ResolutionDetails,\n} from './types.js';\n","/**\n * Burdenoff Feature Flags Server Provider\n *\n * Server-side feature flag provider for backend services.\n * Evaluates flags via the global-tenant-svc GraphQL API through the internal gateway.\n * Supports in-memory caching with configurable TTL.\n *\n * @module feature-flags/provider\n * @category FeatureFlags\n *\n * @example\n * ```typescript\n * import { FeatureFlagProvider } from '@burdenoff/be-sdk/feature-flags';\n *\n * const provider = new FeatureFlagProvider({\n *   gatewayUrl: 'http://global-int-gateway:4000/global/graphql',\n *   cacheTtlSeconds: 60,\n * });\n *\n * const isEnabled = await provider.resolveBoolean('calendar.recurring-events', false, {\n *   actorId: 'user-123',\n *   actorType: 'user',\n *   workspaceId: 'ws-456',\n * });\n *\n * console.log(isEnabled.value); // true or false\n * console.log(isEnabled.reason); // 'TARGETING_MATCH', 'DEFAULT', etc.\n * ```\n */\n\nimport type { EvaluationContext, FeatureFlagProviderConfig, FlagEvaluation, ResolutionDetails } from './types.js';\n\ninterface CacheEntry {\n  evaluations: Map<string, FlagEvaluation>;\n  expiresAt: number;\n}\n\nconst EVALUATE_QUERY = `\n  query EvaluateFeatureFlags($input: EvaluateFeatureFlagsInput!) {\n    evaluateFeatureFlags(input: $input) {\n      evaluations {\n        key\n        value\n        variant\n        reason\n        flagType\n        errorCode\n      }\n    }\n  }\n`;\n\n/**\n * Burdenoff Feature Flag Server Provider\n *\n * Evaluates feature flags by querying the global-tenant-svc through\n * the internal gateway. Results are cached in-memory per workspace+actor\n * combination with a configurable TTL.\n */\nexport class FeatureFlagProvider {\n  private readonly gatewayUrl: string;\n  private readonly cacheTtlMs: number;\n  private readonly serviceToken?: string;\n  private readonly defaultActorType: string;\n\n  /** In-memory cache keyed by `${workspaceId}:${actorId}` */\n  private readonly cache = new Map<string, CacheEntry>();\n\n  constructor(config: FeatureFlagProviderConfig) {\n    this.gatewayUrl = config.gatewayUrl;\n    this.cacheTtlMs = (config.cacheTtlSeconds ?? 60) * 1000;\n    this.serviceToken = config.serviceToken;\n    this.defaultActorType = config.defaultActorType ?? 'service';\n  }\n\n  // =========================================================================\n  // Public Resolution Methods (OpenFeature-compatible interface)\n  // =========================================================================\n\n  /**\n   * Resolve a boolean feature flag\n   *\n   * @param flagKey - The flag key (e.g. \"calendar.recurring-events\")\n   * @param defaultValue - Default value if resolution fails\n   * @param context - Evaluation context with actor and workspace info\n   * @returns Resolution details with the resolved boolean value\n   */\n  async resolveBoolean(\n    flagKey: string,\n    defaultValue: boolean,\n    context: EvaluationContext\n  ): Promise<ResolutionDetails<boolean>> {\n    const evaluation = await this.getEvaluation(flagKey, context);\n    if (!evaluation) {\n      return {\n        value: defaultValue,\n        reason: 'DEFAULT',\n        flagType: 'BOOLEAN',\n      };\n    }\n\n    return {\n      value: Boolean(evaluation.value),\n      variant: evaluation.variant ?? undefined,\n      reason: evaluation.reason,\n      flagType: evaluation.flagType,\n      errorCode: evaluation.errorCode ?? undefined,\n    };\n  }\n\n  /**\n   * Resolve a string feature flag\n   */\n  async resolveString(\n    flagKey: string,\n    defaultValue: string,\n    context: EvaluationContext\n  ): Promise<ResolutionDetails<string>> {\n    const evaluation = await this.getEvaluation(flagKey, context);\n    if (!evaluation) {\n      return {\n        value: defaultValue,\n        reason: 'DEFAULT',\n        flagType: 'STRING',\n      };\n    }\n\n    return {\n      value: String(evaluation.value),\n      variant: evaluation.variant ?? undefined,\n      reason: evaluation.reason,\n      flagType: evaluation.flagType,\n      errorCode: evaluation.errorCode ?? undefined,\n    };\n  }\n\n  /**\n   * Resolve a number feature flag\n   */\n  async resolveNumber(\n    flagKey: string,\n    defaultValue: number,\n    context: EvaluationContext\n  ): Promise<ResolutionDetails<number>> {\n    const evaluation = await this.getEvaluation(flagKey, context);\n    if (!evaluation) {\n      return {\n        value: defaultValue,\n        reason: 'DEFAULT',\n        flagType: 'NUMBER',\n      };\n    }\n\n    return {\n      value: Number(evaluation.value),\n      variant: evaluation.variant ?? undefined,\n      reason: evaluation.reason,\n      flagType: evaluation.flagType,\n      errorCode: evaluation.errorCode ?? undefined,\n    };\n  }\n\n  /**\n   * Resolve an object (JSON) feature flag\n   */\n  async resolveObject<T extends Record<string, unknown>>(\n    flagKey: string,\n    defaultValue: T,\n    context: EvaluationContext\n  ): Promise<ResolutionDetails<T>> {\n    const evaluation = await this.getEvaluation(flagKey, context);\n    if (!evaluation) {\n      return {\n        value: defaultValue,\n        reason: 'DEFAULT',\n        flagType: 'JSON',\n      };\n    }\n\n    return {\n      value: evaluation.value as T,\n      variant: evaluation.variant ?? undefined,\n      reason: evaluation.reason,\n      flagType: evaluation.flagType,\n      errorCode: evaluation.errorCode ?? undefined,\n    };\n  }\n\n  // =========================================================================\n  // Convenience Methods\n  // =========================================================================\n\n  /**\n   * Quick boolean check — returns just the value.\n   * Defaults to `true` (default-allow philosophy) if the flag is not found.\n   *\n   * @example\n   * ```typescript\n   * if (await provider.isEnabled('calendar.recurring-events', ctx)) {\n   *   // Feature is enabled\n   * }\n   * ```\n   */\n  async isEnabled(flagKey: string, context?: EvaluationContext): Promise<boolean> {\n    const result = await this.resolveBoolean(\n      flagKey,\n      true,\n      context ?? { workspaceId: 'system', actorType: 'service', actorId: 'boot' }\n    );\n    return result.value;\n  }\n\n  /**\n   * Bulk evaluate multiple flags at once.\n   * Returns a map of key -> ResolutionDetails.\n   */\n  async evaluateAll(context: EvaluationContext, keys?: string[]): Promise<Map<string, ResolutionDetails<unknown>>> {\n    const evaluations = await this.fetchEvaluations(context, keys);\n    const result = new Map<string, ResolutionDetails<unknown>>();\n\n    for (const [key, evaluation] of evaluations) {\n      result.set(key, {\n        value: evaluation.value,\n        variant: evaluation.variant ?? undefined,\n        reason: evaluation.reason,\n        flagType: evaluation.flagType,\n        errorCode: evaluation.errorCode ?? undefined,\n      });\n    }\n\n    return result;\n  }\n\n  /**\n   * Invalidate the cache for a specific workspace+actor combination,\n   * or all cache entries if no context is provided.\n   */\n  invalidateCache(context?: EvaluationContext): void {\n    if (context) {\n      const cacheKey = this.buildCacheKey(context);\n      this.cache.delete(cacheKey);\n    } else {\n      this.cache.clear();\n    }\n  }\n\n  // =========================================================================\n  // Private Methods\n  // =========================================================================\n\n  /**\n   * Get a single flag evaluation, fetching from cache or API\n   */\n  private async getEvaluation(flagKey: string, context: EvaluationContext | undefined): Promise<FlagEvaluation | null> {\n    try {\n      const evaluations = await this.fetchEvaluations(context);\n      return evaluations.get(flagKey) ?? null;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Fetch flag evaluations — uses cache if available, otherwise calls the API\n   */\n  private async fetchEvaluations(\n    context: EvaluationContext | undefined,\n    keys?: string[]\n  ): Promise<Map<string, FlagEvaluation>> {\n    const cacheKey = this.buildCacheKey(context);\n    const cached = this.cache.get(cacheKey);\n\n    if (cached && cached.expiresAt > Date.now()) {\n      return cached.evaluations;\n    }\n\n    // Without a workspace context there's nothing the backend can evaluate\n    // against — fall through to caller defaults instead of hitting the API.\n    if (!context?.workspaceId) {\n      return new Map();\n    }\n\n    // Fetch from API\n    try {\n      const response = await fetch(this.gatewayUrl, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          ...(context.actorId && { 'x-actor-id': context.actorId }),\n          'x-actor-type': context.actorType ?? this.defaultActorType,\n          'x-workspace-id': context.workspaceId,\n          ...(this.serviceToken && { Authorization: `Bearer ${this.serviceToken}` }),\n        },\n        body: JSON.stringify({\n          query: EVALUATE_QUERY,\n          variables: {\n            input: {\n              workspaceId: context.workspaceId,\n              keys: keys ?? null,\n            },\n          },\n        }),\n      });\n\n      if (!response.ok) {\n        // Return empty map on error — default-allow handled by callers\n        return new Map();\n      }\n\n      const json = (await response.json()) as {\n        data?: {\n          evaluateFeatureFlags?: {\n            evaluations?: FlagEvaluation[];\n          };\n        };\n        errors?: Array<{ message: string }>;\n      };\n\n      if (json.errors || !json.data?.evaluateFeatureFlags?.evaluations) {\n        return new Map();\n      }\n\n      const evaluations = new Map<string, FlagEvaluation>();\n      for (const evaluation of json.data.evaluateFeatureFlags.evaluations) {\n        evaluations.set(evaluation.key, evaluation);\n      }\n\n      // Cache the results\n      this.cache.set(cacheKey, {\n        evaluations,\n        expiresAt: Date.now() + this.cacheTtlMs,\n      });\n\n      return evaluations;\n    } catch {\n      // On network error, return empty map (default-allow handled by callers)\n      return new Map();\n    }\n  }\n\n  /**\n   * Build a cache key from the evaluation context.\n   *\n   * Safe against undefined/null context — callers like isEnabled() may\n   * pass no context during service boot (e.g. checking a default-allow\n   * feature flag at startup before the first request builds a real\n   * actor context). Without the guard, isEnabled(flag) used to throw\n   * \"undefined is not an object (evaluating 'context.workspaceId')\"\n   * and crash the svc at startServer().\n   */\n  private buildCacheKey(context: EvaluationContext | undefined): string {\n    const ctx = context ?? ({} as EvaluationContext);\n    return `${ctx.workspaceId ?? 'system'}:${ctx.actorId ?? 'anonymous'}:${ctx.actorType ?? 'user'}`;\n  }\n}\n"]}