@burdenoff/be-sdk 2026.510.79

package/dist/server/index.js

@@ -0,0 +1,884 @@
+export { createWorkspaceGuardPlugin } from '../chunk-UBXFIIAW.js';
+import { setWorkspaceContext } from '../chunk-GTEMQXCA.js';
+import { I18n } from '../chunk-IYE2NTRX.js';
+import { logger } from '../chunk-CBZNP6RF.js';
+import { __name } from '../chunk-XE4OXN2W.js';
+import crypto from 'crypto';
+
+// src/server/auth.ts
+var getDbFn = null;
+async function getDb() {
+  if (!getDbFn) {
+    const prismaModule = await import('../prisma/index.js');
+    getDbFn = prismaModule.getDb;
+  }
+  return getDbFn();
+}
+__name(getDb, "getDb");
+var joseModule = null;
+var jwtModule = null;
+async function getJose() {
+  if (!joseModule) {
+    joseModule = await import('jose');
+  }
+  return joseModule;
+}
+__name(getJose, "getJose");
+async function getJwt() {
+  if (!jwtModule) {
+    const jwt = await import('jsonwebtoken');
+    jwtModule = jwt.default ?? jwt;
+  }
+  return jwtModule;
+}
+__name(getJwt, "getJwt");
+var authConfig = null;
+function configureAuth(config) {
+  authConfig = config;
+  logger.debug("[ServerAuth] Auth configured");
+}
+__name(configureAuth, "configureAuth");
+async function fetchWorkspaceSecret(workspaceId) {
+  try {
+    const db = await getDb();
+    const workspace = await db.client.workspace.findUnique({
+      where: {
+        id: workspaceId
+      }
+    });
+    if (!workspace?.jwtSecret) {
+      logger.debug("[ServerAuth] No JWT secret found for workspace", {
+        workspaceId
+      });
+      return null;
+    }
+    return JSON.parse(JSON.stringify(workspace.jwtSecret));
+  } catch (error) {
+    logger.warn("[ServerAuth] Error fetching workspace secret", {
+      workspaceId,
+      error
+    });
+    return null;
+  }
+}
+__name(fetchWorkspaceSecret, "fetchWorkspaceSecret");
+function configureDefaultAuth() {
+  if (!authConfig) {
+    configureAuth({
+      fetchWorkspaceSecret
+    });
+    logger.debug("[ServerAuth] Default auth configured with built-in workspace secret fetcher");
+  }
+}
+__name(configureDefaultAuth, "configureDefaultAuth");
+async function generateSymmetricSecret() {
+  const joseLib = await getJose();
+  const secret = await joseLib.generateSecret("HS256");
+  const jwk = await joseLib.exportJWK(secret);
+  return jwk;
+}
+__name(generateSymmetricSecret, "generateSymmetricSecret");
+async function verifyJWT(token, secret, options = {}) {
+  try {
+    const jwt = await getJwt();
+    const joseLib = await getJose();
+    const decoded = jwt.decode(token, {
+      complete: true
+    });
+    if (!decoded || typeof decoded === "string" || !decoded.payload || typeof decoded.payload !== "object") {
+      logger.warn("[ServerAuth] Invalid token format");
+      return null;
+    }
+    if (secret) {
+      const verifiedJwt2 = jwt.verify(token, secret, options);
+      return mapPayloadToActor(verifiedJwt2);
+    }
+    const decodedJwt = joseLib.decodeJwt(token);
+    if (!decodedJwt.workspace_id) {
+      logger.warn("[ServerAuth] No workspace_id found in token");
+      return null;
+    }
+    if (!authConfig?.fetchWorkspaceSecret) {
+      logger.error("[ServerAuth] Auth not configured - call configureAuth() first");
+      return null;
+    }
+    const workspaceSecret = await authConfig.fetchWorkspaceSecret(decodedJwt.workspace_id);
+    if (!workspaceSecret) {
+      logger.warn("[ServerAuth] Workspace secret not found");
+      return null;
+    }
+    const keyLikeSecret = await joseLib.importJWK(workspaceSecret, "HS256");
+    const verifiedJwt = await joseLib.jwtVerify(token, keyLikeSecret, options);
+    return mapPayloadToActor(verifiedJwt.payload);
+  } catch (err) {
+    logger.warn("[ServerAuth] Error verifying JWT:", err);
+    return null;
+  }
+}
+__name(verifyJWT, "verifyJWT");
+async function decodeJWT(token) {
+  try {
+    const joseLib = await getJose();
+    return joseLib.decodeJwt(token);
+  } catch {
+    return null;
+  }
+}
+__name(decodeJWT, "decodeJWT");
+function mapPayloadToActor(payload) {
+  return {
+    id: payload.sub,
+    type: payload.actor_type ?? "user",
+    workspace_id: payload.workspace_id,
+    tenant_id: payload.tenant_id,
+    org_id: payload.org_id,
+    isAdmin: payload["isAdmin"]
+  };
+}
+__name(mapPayloadToActor, "mapPayloadToActor");
+function authCheck(actor) {
+  if (!actor) {
+    throw new Error("Please sign in");
+  }
+  return actor;
+}
+__name(authCheck, "authCheck");
+function workspaceCheck(context) {
+  const actor = authCheck(context.actor);
+  if (!context.workspace?.id) {
+    throw new Error("Please switch to a workspace");
+  }
+  return {
+    actorId: actor.id,
+    workspaceId: context.workspace.id
+  };
+}
+__name(workspaceCheck, "workspaceCheck");
+function requireWorkspace(context) {
+  authCheck(context.actor);
+  if (!context.workspace?.id) {
+    throw new Error("Please switch to a workspace");
+  }
+  return context;
+}
+__name(requireWorkspace, "requireWorkspace");
+function orgCheck(context) {
+  const actor = authCheck(context.actor);
+  if (!context.organization?.id) {
+    throw new Error("Please switch to an organization");
+  }
+  return {
+    actorId: actor.id,
+    orgId: context.organization.id
+  };
+}
+__name(orgCheck, "orgCheck");
+function tenantCheck(context) {
+  if (!context.tenant?.id) {
+    throw new Error("Tenant context is required");
+  }
+  return context.tenant.id;
+}
+__name(tenantCheck, "tenantCheck");
+var contextOptions = null;
+function configureContext(options) {
+  contextOptions = options;
+  logger.debug("[ServerContext] Context builder configured");
+}
+__name(configureContext, "configureContext");
+function getHeader(request, key) {
+  return request.headers.get(key.toLowerCase()) ?? void 0;
+}
+__name(getHeader, "getHeader");
+function compareSecret(provided, expected) {
+  const providedBuffer = Buffer.from(provided);
+  const expectedBuffer = Buffer.from(expected);
+  if (providedBuffer.length !== expectedBuffer.length) {
+    return false;
+  }
+  return crypto.timingSafeEqual(providedBuffer, expectedBuffer);
+}
+__name(compareSecret, "compareSecret");
+function shouldTrustActorHeaders(request, nodeEnv = process.env["NODE_ENV"], expectedGatewayToken = process.env["TRUSTED_GATEWAY_TOKEN"] ?? process.env["INTERNAL_SERVICE_TOKEN"]) {
+  if (!getHeader(request, "x-actor-id")) {
+    return false;
+  }
+  if (nodeEnv === "production") {
+    return true;
+  }
+  const providedGatewayToken = getHeader(request, "x-internal-service-token") || getHeader(request, "x-gateway-auth-token");
+  if (!expectedGatewayToken || !providedGatewayToken) {
+    return false;
+  }
+  return compareSecret(providedGatewayToken, expectedGatewayToken);
+}
+__name(shouldTrustActorHeaders, "shouldTrustActorHeaders");
+function extractTracking(request) {
+  const forwardedFor = getHeader(request, "x-forwarded-for");
+  const realIp = getHeader(request, "x-real-ip");
+  const ip = forwardedFor?.split(",")[0]?.trim() || realIp || void 0;
+  return {
+    ip,
+    userAgent: getHeader(request, "user-agent")
+  };
+}
+__name(extractTracking, "extractTracking");
+async function extractActor(request) {
+  const actorId = getHeader(request, "x-actor-id");
+  if (actorId && shouldTrustActorHeaders(request)) {
+    logger.debug("[ServerContext] Using gateway-authenticated actor from headers");
+    const actorType = getHeader(request, "x-actor-type") || "user";
+    const userRole = getHeader(request, "x-user-role");
+    return {
+      id: actorId,
+      type: actorType,
+      workspace_id: getHeader(request, "x-workspace-id"),
+      tenant_id: getHeader(request, "x-tenant-id"),
+      org_id: getHeader(request, "x-org-id") || getHeader(request, "x-organization-id"),
+      isAdmin: actorType === "super_admin" || userRole === "TENANT_ADMIN" || userRole === "SUPER_ADMIN" || userRole === "PLATFORM_ADMIN"
+    };
+  }
+  if (actorId) {
+    logger.warn("[ServerContext] Ignoring untrusted actor headers and falling back to JWT verification");
+  }
+  const authHeader = getHeader(request, "authorization");
+  if (!authHeader?.startsWith("Bearer ")) {
+    return null;
+  }
+  const token = authHeader.substring(7);
+  try {
+    logger.debug("[ServerContext] No gateway headers, verifying JWT directly for actor (dev mode)");
+    const payload = await verifyJWT(token);
+    if (!payload) {
+      return null;
+    }
+    return {
+      id: payload.id,
+      type: "user",
+      workspace_id: payload.workspace_id
+    };
+  } catch (error) {
+    logger.warn("[ServerContext] Invalid JWT token:", error);
+    return null;
+  }
+}
+__name(extractActor, "extractActor");
+function extractTenant(request) {
+  const tenantId = getHeader(request, "x-tenant-id");
+  const tenantEndpoint = getHeader(request, "x-tenant-endpoint");
+  if (tenantId) {
+    return {
+      id: tenantId,
+      endpoint: tenantEndpoint || ""
+    };
+  }
+  return contextOptions?.defaultTenant || null;
+}
+__name(extractTenant, "extractTenant");
+function extractOrganization(request) {
+  const orgId = getHeader(request, "x-org-id") || getHeader(request, "x-organization-id");
+  if (orgId) {
+    return {
+      id: orgId
+    };
+  }
+  return null;
+}
+__name(extractOrganization, "extractOrganization");
+function extractWorkspace(request, actor) {
+  const workspaceId = getHeader(request, "x-workspace-id");
+  if (workspaceId) {
+    return {
+      id: workspaceId
+    };
+  }
+  if (actor?.workspace_id) {
+    return {
+      id: actor.workspace_id
+    };
+  }
+  return null;
+}
+__name(extractWorkspace, "extractWorkspace");
+function extractProject(request) {
+  const projectId = getHeader(request, "x-project-id");
+  if (projectId) {
+    return {
+      id: projectId
+    };
+  }
+  return null;
+}
+__name(extractProject, "extractProject");
+function extractProduct(request) {
+  const productId = getHeader(request, "x-product-id");
+  if (productId) {
+    return {
+      id: productId
+    };
+  }
+  return null;
+}
+__name(extractProduct, "extractProduct");
+function extractGeography(request) {
+  const country = getHeader(request, "x-geo-country");
+  const currency = getHeader(request, "x-geo-currency");
+  const timezone = getHeader(request, "x-geo-timezone");
+  return {
+    country: country?.toUpperCase() || void 0,
+    currency: currency?.toUpperCase() || void 0,
+    timezone: timezone || void 0
+  };
+}
+__name(extractGeography, "extractGeography");
+function extractConsentContext(request) {
+  const grantedBy = getHeader(request, "x-consent-granted-by");
+  if (!grantedBy) {
+    return null;
+  }
+  const scopesHeader = getHeader(request, "x-consent-scope");
+  const grantedAtHeader = getHeader(request, "x-consent-granted-at");
+  const expiresAtHeader = getHeader(request, "x-consent-expires-at");
+  return {
+    grantedBy,
+    scopes: scopesHeader ? scopesHeader.split(",").map((s) => s.trim()) : void 0,
+    grantedAt: grantedAtHeader ? new Date(grantedAtHeader) : void 0,
+    expiresAt: expiresAtHeader ? new Date(expiresAtHeader) : void 0
+  };
+}
+__name(extractConsentContext, "extractConsentContext");
+async function buildContext(request) {
+  if (!contextOptions) {
+    throw new Error("[ServerContext] Context not configured - call configureContext() first");
+  }
+  const actor = await extractActor(request);
+  const tenant = extractTenant(request);
+  const organization = extractOrganization(request);
+  const workspace = extractWorkspace(request, actor);
+  const project = extractProject(request);
+  const product = extractProduct(request);
+  const tracking = extractTracking(request);
+  const consentContext = extractConsentContext(request);
+  let i18n;
+  if (contextOptions.i18n) {
+    i18n = contextOptions.i18n.createContextFromRequest(request);
+  }
+  const geo = extractGeography(request);
+  if (geo.country || geo.currency || geo.timezone) {
+    if (i18n) {
+      if (geo.country) i18n.country = geo.country;
+      if (geo.currency) i18n.currency = geo.currency;
+      if (geo.timezone) i18n.timezone = geo.timezone;
+    } else {
+      i18n = {
+        locale: "en-US",
+        language: "en",
+        country: geo.country,
+        currency: geo.currency,
+        timezone: geo.timezone,
+        t: /* @__PURE__ */ __name((key) => key, "t"),
+        tp: /* @__PURE__ */ __name((key) => key, "tp"),
+        formatNumber: /* @__PURE__ */ __name((value) => String(value), "formatNumber"),
+        formatCurrency: /* @__PURE__ */ __name((value, currency) => `${currency} ${value}`, "formatCurrency"),
+        formatDate: /* @__PURE__ */ __name((date) => String(date), "formatDate"),
+        formatRelativeTime: /* @__PURE__ */ __name((value, unit) => `${value} ${unit}`, "formatRelativeTime")
+      };
+    }
+  }
+  const onBehalfOf = (actor?.type === "app" || actor?.type === "service" || actor?.type === "service_account") && consentContext?.grantedBy ? consentContext.grantedBy : actor?.id;
+  const wsCtxPayload = {
+    workspaceId: workspace?.id,
+    tenantId: tenant?.id,
+    actorId: actor?.id,
+    actorType: actor?.type,
+    organizationId: organization?.id,
+    projectId: project?.id,
+    onBehalfOf
+  };
+  logger.debug("[ServerContext] Setting workspace context", {
+    workspaceId: wsCtxPayload.workspaceId ?? "NONE",
+    actorId: wsCtxPayload.actorId ?? "NONE",
+    rawHeader: getHeader(request, "x-workspace-id") ?? "MISSING"
+  });
+  setWorkspaceContext(wsCtxPayload);
+  return {
+    request,
+    actor,
+    tenant,
+    organization,
+    workspace,
+    project,
+    product,
+    tracking,
+    consentContext: consentContext || void 0,
+    onBehalfOf: onBehalfOf || actor?.id || "",
+    db: contextOptions.getDb(),
+    i18n,
+    responseHeaders: new Headers()
+  };
+}
+__name(buildContext, "buildContext");
+function getContextOptions() {
+  return contextOptions;
+}
+__name(getContextOptions, "getContextOptions");
+
+// src/server/security.ts
+var LOCALHOST_ORIGINS = [
+  "http://localhost:3000",
+  "http://localhost:4000",
+  "http://localhost:5173",
+  "http://127.0.0.1:3000",
+  "http://127.0.0.1:4000",
+  "http://127.0.0.1:5173"
+];
+function normalizeCorsOrigins(origins, environment) {
+  const normalized = (Array.isArray(origins) ? origins : origins?.split(",") || []).map((origin) => origin.trim()).filter(Boolean);
+  if (normalized.length === 0) {
+    return environment === "production" ? [] : LOCALHOST_ORIGINS;
+  }
+  if (normalized.includes("*")) {
+    return environment === "production" ? [] : LOCALHOST_ORIGINS;
+  }
+  return normalized;
+}
+__name(normalizeCorsOrigins, "normalizeCorsOrigins");
+function resolveAllowedCorsOrigin(requestOrigin, allowedOrigins) {
+  if (!requestOrigin) {
+    return allowedOrigins[0] ?? null;
+  }
+  return allowedOrigins.includes(requestOrigin) ? requestOrigin : null;
+}
+__name(resolveAllowedCorsOrigin, "resolveAllowedCorsOrigin");
+function canAccessGraphExport(actor) {
+  if (!actor) {
+    return false;
+  }
+  return actor.isAdmin === true || [
+    "service",
+    "super_admin"
+  ].includes(actor.type);
+}
+__name(canAccessGraphExport, "canAccessGraphExport");
+
+// src/server/server.ts
+var serverStartTime = null;
+async function createServer(definition) {
+  const { config, prismaClient, schema, moduleGraph, restEndpoints, yogaPlugins, buildContext: customBuildContext, workspaceExtensionConfig, disableWorkspaceExtension, onShutdown } = definition;
+  const { Elysia } = await import('elysia');
+  const { BunAdapter } = await import('elysia/adapter/bun');
+  const { cors } = await import('@elysiajs/cors');
+  const { createYoga } = await import('graphql-yoga');
+  const { initializeDatabase, getDb: getDb2, getDatabaseManager } = await import('../prisma/index.js');
+  const { createSecurityPlugin } = await import('../middleware/index.js');
+  const { createMetricsPlugin } = await import('../observability/index.js');
+  const { createWorkspaceGuardPlugin: createWorkspaceGuardPlugin2 } = await import('../workspace-guard-LHBNK4TG.js');
+  logger.info(`[Server] Initializing ${config.serviceName}...`);
+  const boundary = config.boundary ?? (config.serviceName.startsWith("wspace-") ? "wspace" : config.serviceName.startsWith("global-") ? "global" : "wspace");
+  const shouldEnableWorkspaceExtension = disableWorkspaceExtension === true ? false : disableWorkspaceExtension === false ? true : boundary === "wspace";
+  logger.info("[Server] Initializing database...", {
+    boundary,
+    workspaceExtension: shouldEnableWorkspaceExtension
+  });
+  const { connect } = initializeDatabase(prismaClient, config.serviceName, {
+    registerShutdownHandlers: false,
+    enableWorkspaceExtension: shouldEnableWorkspaceExtension,
+    ...workspaceExtensionConfig ? {
+      workspaceExtensionConfig
+    } : {}
+  });
+  await connect();
+  let i18nInstance;
+  if (config.i18n?.enabled && config.i18n.localesPath) {
+    logger.info("[Server] Initializing i18n...");
+    i18nInstance = new I18n({
+      defaultLocale: config.i18n.defaultLocale || "en-US",
+      fallbackLocale: config.i18n.fallbackLocale || "en-US",
+      localesPath: config.i18n.localesPath,
+      supportedLocales: config.i18n.supportedLocales,
+      namespace: config.i18n.namespace || config.serviceName,
+      lazyLoad: config.i18n.lazyLoad,
+      logMissing: config.i18n.logMissing ?? true,
+      enableCache: true,
+      returnKeyOnMissing: true
+    });
+    await i18nInstance.initialize();
+    logger.info(`[Server] i18n initialized with locales: ${i18nInstance.getSupportedLocales().join(", ")}`);
+  }
+  configureContext({
+    getDb: /* @__PURE__ */ __name(() => getDb2(), "getDb"),
+    i18n: i18nInstance
+  });
+  configureDefaultAuth();
+  if (moduleGraph) {
+    logger.info("[Server] Initializing module graph...");
+    await moduleGraph.initialize();
+  }
+  const isDev = config.environment !== "production";
+  const enablePlayground = config.enablePlayground ?? isDev;
+  const workspaceGuardEnabled = config.workspaceGuard?.enabled ?? boundary === "wspace";
+  logger.info(`[Server] Boundary: ${boundary}, workspace guard: ${workspaceGuardEnabled ? "enabled" : "disabled"}`);
+  const workspaceGuardPlugins = workspaceGuardEnabled ? [
+    createWorkspaceGuardPlugin2({
+      enabled: true,
+      whitelistedOperations: config.workspaceGuard?.whitelistedOperations
+    })
+  ] : [];
+  const graphqlEndpoint = config.graphqlEndpoint || "/graphql";
+  logger.info("[Server] Setting up GraphQL Yoga with provided schema...");
+  const responseHeadersPlugin = {
+    onResponse: /* @__PURE__ */ __name(({ response, serverContext }) => {
+      const yogaContext = serverContext;
+      if (yogaContext?.responseHeaders) {
+        yogaContext.responseHeaders.forEach((value, key) => {
+          response.headers.append(key, value);
+        });
+      }
+    }, "onResponse")
+  };
+  const yoga = createYoga({
+    graphqlEndpoint,
+    schema,
+    graphiql: enablePlayground,
+    logging: {
+      debug: /* @__PURE__ */ __name((...args) => logger.debug("[GraphQL]", ...args), "debug"),
+      info: /* @__PURE__ */ __name((...args) => logger.info("[GraphQL]", ...args), "info"),
+      warn: /* @__PURE__ */ __name((...args) => logger.warn("[GraphQL]", ...args), "warn"),
+      error: /* @__PURE__ */ __name((...args) => logger.error("[GraphQL]", ...args), "error")
+    },
+    plugins: [
+      ...workspaceGuardPlugins,
+      responseHeadersPlugin,
+      ...yogaPlugins || []
+    ],
+    context: /* @__PURE__ */ __name(async ({ request }) => {
+      const defaultContext = await buildContext(request);
+      if (customBuildContext) {
+        return customBuildContext(defaultContext);
+      }
+      return defaultContext;
+    }, "context")
+  });
+  const app = new Elysia({
+    adapter: BunAdapter
+  });
+  const corsOrigins = normalizeCorsOrigins(config.corsOrigins, config.environment);
+  app.use(cors({
+    origin: corsOrigins,
+    credentials: corsOrigins.length > 0,
+    allowedHeaders: [
+      "Content-Type",
+      "Authorization",
+      "X-Tenant-ID",
+      "X-Workspace-ID",
+      "X-Org-ID",
+      "X-Project-ID",
+      "X-Product-ID",
+      "X-CSRF-Token",
+      "X-Service-Name",
+      "Accept-Language",
+      "X-Locale",
+      "X-Language",
+      "X-Geo-Country",
+      "X-Geo-Currency",
+      "X-Geo-Timezone",
+      // Actor headers (gateway-injected or dev mode)
+      "X-Actor-ID",
+      "X-Actor-Type",
+      "X-Internal-Service-Token",
+      "X-Gateway-Auth-Token"
+    ],
+    methods: [
+      "GET",
+      "POST",
+      "PUT",
+      "PATCH",
+      "DELETE",
+      "OPTIONS"
+    ]
+  }));
+  const rawBodyEndpoints = (restEndpoints || []).filter((ep) => ep.rawBody);
+  const rawBodyPaths = new Map(rawBodyEndpoints.map((ep) => [
+    ep.path,
+    ep
+  ]));
+  const rawBodyMatchers = rawBodyEndpoints.map((endpoint) => {
+    const regexPattern = endpoint.path.replace(/:[^/]+/g, "[^/]+");
+    return {
+      endpoint,
+      regexPattern,
+      regex: new RegExp(`^${regexPattern}$`)
+    };
+  });
+  const matchRawBodyEndpoint = /* @__PURE__ */ __name((pathname) => {
+    const exactMatch = rawBodyPaths.get(pathname);
+    if (exactMatch) return exactMatch;
+    for (const { endpoint, regex, regexPattern } of rawBodyMatchers) {
+      const isMatch = regex.test(pathname);
+      logger.debug(`[Server] Checking ${pathname} against pattern ${endpoint.path} (regex: ${regexPattern}), match: ${isMatch}`);
+      if (isMatch) {
+        logger.debug(`[Server] Matched ${pathname} to pattern ${endpoint.path}`);
+        return endpoint;
+      }
+    }
+    logger.debug(`[Server] No raw body endpoint match for ${pathname}, rawBodyEndpoints: ${rawBodyEndpoints.length}`);
+    return void 0;
+  }, "matchRawBodyEndpoint");
+  app.onRequest(async ({ request }) => {
+    const url = new URL(request.url);
+    const pathname = url.pathname;
+    logger.debug(`[Server] onRequest: ${request.method} ${pathname}`);
+    const isHealthRoute = pathname === "/health" || pathname.startsWith("/health/");
+    const buildCorsHeaders = /* @__PURE__ */ __name(() => {
+      const origin = request.headers.get("origin") || "*";
+      const allowedOrigin = resolveAllowedCorsOrigin(origin === "*" ? null : origin, corsOrigins);
+      const headers = {
+        "Access-Control-Allow-Methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS",
+        "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Tenant-ID, X-Workspace-ID, X-Org-ID, X-Project-ID, X-Product-ID, X-CSRF-Token, X-Service-Name, Accept-Language, X-Locale, X-Language, X-Geo-Country, X-Geo-Currency, X-Geo-Timezone, X-Actor-ID, X-Actor-Type, X-Internal-Service-Token, X-Gateway-Auth-Token"
+      };
+      if (allowedOrigin) {
+        headers["Access-Control-Allow-Origin"] = allowedOrigin;
+        headers["Access-Control-Allow-Credentials"] = "true";
+      }
+      return headers;
+    }, "buildCorsHeaders");
+    const rawBodyEndpoint = isHealthRoute ? void 0 : matchRawBodyEndpoint(pathname);
+    if (rawBodyEndpoint) {
+      logger.debug(`[Server] Matched raw body endpoint: ${pathname} -> ${rawBodyEndpoint.path}`);
+      const corsHeaders = buildCorsHeaders();
+      if (request.method === "OPTIONS") {
+        return new Response(null, {
+          status: 204,
+          headers: corsHeaders
+        });
+      }
+      if (request.method !== rawBodyEndpoint.method) {
+        return void 0;
+      }
+      try {
+        const rawBody = await request.text();
+        const context = await buildContext(request);
+        const result = await rawBodyEndpoint.handler(request, context, rawBody);
+        if (result instanceof Response) {
+          const headers2 = new Headers(result.headers);
+          for (const [key, value] of Object.entries(corsHeaders)) {
+            headers2.set(key, value);
+          }
+          return new Response(result.body, {
+            status: result.status,
+            statusText: result.statusText,
+            headers: headers2
+          });
+        }
+        const headers = new Headers({
+          "Content-Type": "application/json",
+          ...corsHeaders
+        });
+        return new Response(JSON.stringify(result), {
+          status: 200,
+          headers
+        });
+      } catch (error) {
+        logger.error(`[Server] Raw body endpoint error (${pathname}):`, error);
+        const corsHeaders2 = buildCorsHeaders();
+        return new Response(JSON.stringify({
+          error: error instanceof Error ? error.message : "Internal server error"
+        }), {
+          status: 500,
+          headers: {
+            "Content-Type": "application/json",
+            ...corsHeaders2
+          }
+        });
+      }
+    }
+    const yogaRoutes = [
+      graphqlEndpoint,
+      `${graphqlEndpoint}/`,
+      "/metrics"
+    ];
+    const shouldHandleByYoga = yogaRoutes.includes(pathname);
+    if (shouldHandleByYoga) {
+      const corsHeaders = buildCorsHeaders();
+      if (request.method === "OPTIONS") {
+        return new Response(null, {
+          status: 204,
+          headers: corsHeaders
+        });
+      }
+      const yogaResponse = await yoga.fetch(request);
+      const headers = new Headers(yogaResponse.headers);
+      for (const [key, value] of Object.entries(corsHeaders)) {
+        headers.set(key, value);
+      }
+      return new Response(yogaResponse.body, {
+        status: yogaResponse.status,
+        statusText: yogaResponse.statusText,
+        headers
+      });
+    }
+    return void 0;
+  });
+  app.use(createMetricsPlugin());
+  app.use(createSecurityPlugin({
+    csrfSkipRoutes: config.csrfSkipRoutes || [
+      "/graphql",
+      "/health",
+      "/api/graph/"
+    ],
+    loginEndpoints: config.loginEndpoints || [],
+    enableCSRF: config.enableCSRF ?? false,
+    enableSessionSecurity: config.enableSessionSecurity ?? false
+  }));
+  const healthResponse = /* @__PURE__ */ __name(() => ({
+    status: "healthy",
+    service: config.serviceName,
+    version: config.serviceVersion || "1.0.0",
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  }), "healthResponse");
+  app.get("/health", healthResponse);
+  app.get("/health/live", healthResponse);
+  app.get("/health/ready", healthResponse);
+  app.get("/health/startup", healthResponse);
+  if (moduleGraph) {
+    app.get("/api/graph/schema", async ({ request, set }) => {
+      const context = await buildContext(request);
+      if (!canAccessGraphExport(context.actor)) {
+        set.status = 403;
+        return {
+          error: "Forbidden"
+        };
+      }
+      return moduleGraph.getSchema();
+    });
+    app.get("/api/graph/export", async ({ query, request, set }) => {
+      const context = await buildContext(request);
+      if (!canAccessGraphExport(context.actor)) {
+        set.status = 403;
+        return {
+          error: "Forbidden"
+        };
+      }
+      const { organizationId, workspaceId } = query;
+      return moduleGraph.exportAll(organizationId, workspaceId);
+    });
+    app.get("/api/graph/entities", async ({ query, request, set }) => {
+      const context = await buildContext(request);
+      if (!canAccessGraphExport(context.actor)) {
+        set.status = 403;
+        return {
+          error: "Forbidden"
+        };
+      }
+      const { organizationId, workspaceId, types } = query;
+      const entityTypes = types?.split(",").map((t) => t.trim());
+      return moduleGraph.exportEntities(organizationId, workspaceId, entityTypes);
+    });
+    app.get("/api/graph/relationships", async ({ query, request, set }) => {
+      const context = await buildContext(request);
+      if (!canAccessGraphExport(context.actor)) {
+        set.status = 403;
+        return {
+          error: "Forbidden"
+        };
+      }
+      const { organizationId, workspaceId } = query;
+      return moduleGraph.exportRelationships(organizationId, workspaceId);
+    });
+  }
+  if (restEndpoints && restEndpoints.length > 0) {
+    for (const endpoint of restEndpoints) {
+      if (endpoint.rawBody) {
+        logger.info(`[Server] Raw body endpoint registered: ${endpoint.method} ${endpoint.path}`);
+        continue;
+      }
+      const handler = /* @__PURE__ */ __name(async ({ request }) => {
+        const context = await buildContext(request);
+        return endpoint.handler(request, context);
+      }, "handler");
+      switch (endpoint.method) {
+        case "GET":
+          app.get(endpoint.path, handler);
+          break;
+        case "POST":
+          app.post(endpoint.path, handler);
+          break;
+        case "PUT":
+          app.put(endpoint.path, handler);
+          break;
+        case "PATCH":
+          app.patch(endpoint.path, handler);
+          break;
+        case "DELETE":
+          app.delete(endpoint.path, handler);
+          break;
+      }
+    }
+  }
+  const host = config.host || "0.0.0.0";
+  const port = config.port;
+  const serverInstance = {
+    app,
+    server: null,
+    start: /* @__PURE__ */ __name(async () => {
+      serverStartTime = /* @__PURE__ */ new Date();
+      app.listen({
+        port,
+        hostname: host
+      });
+      const elysiaApp = app;
+      serverInstance.server = elysiaApp.server;
+      logger.info(`\u{1F680} ${config.serviceName} is running at http://${host}:${port}${graphqlEndpoint}`);
+    }, "start"),
+    stop: /* @__PURE__ */ __name(async () => {
+      logger.info(`[Server] Stopping ${config.serviceName}...`);
+      if (onShutdown) {
+        await onShutdown();
+      }
+      if (moduleGraph) {
+        await moduleGraph.shutdown();
+      }
+      await getDatabaseManager().disconnect();
+      if (serverInstance.server) {
+        serverInstance.server.stop();
+      }
+      logger.info(`[Server] ${config.serviceName} stopped`);
+    }, "stop"),
+    getInfo: /* @__PURE__ */ __name(() => {
+      const uptime = serverStartTime ? Math.floor((Date.now() - serverStartTime.getTime()) / 1e3) : 0;
+      return {
+        serviceName: config.serviceName,
+        serviceVersion: config.serviceVersion || "1.0.0",
+        environment: config.environment || "development",
+        port,
+        host,
+        graphqlEndpoint,
+        startedAt: serverStartTime?.toISOString() || "",
+        uptime
+      };
+    }, "getInfo")
+  };
+  const gracefulShutdown = /* @__PURE__ */ __name(async (signal) => {
+    logger.info(`[Server] ${signal} received, shutting down gracefully...`);
+    await serverInstance.stop();
+    process.exit(0);
+  }, "gracefulShutdown");
+  process.on("SIGTERM", () => {
+    void gracefulShutdown("SIGTERM");
+  });
+  process.on("SIGINT", () => {
+    void gracefulShutdown("SIGINT");
+  });
+  return serverInstance;
+}
+__name(createServer, "createServer");
+function configureServerAuth(fetchWorkspaceSecret2) {
+  configureAuth({
+    fetchWorkspaceSecret: fetchWorkspaceSecret2
+  });
+}
+__name(configureServerAuth, "configureServerAuth");
+
+export { authCheck, buildContext, configureAuth, configureContext, configureDefaultAuth, configureServerAuth, createServer, decodeJWT, fetchWorkspaceSecret, generateSymmetricSecret, getContextOptions, orgCheck, requireWorkspace, tenantCheck, verifyJWT, workspaceCheck };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map