@burdenoff/be-sdk 2026.510.79

package/dist/chunk-4B43DZIS.js

@@ -0,0 +1,560 @@
+import { security_exports } from './chunk-MLW2HPS5.js';
+import { LayerManager } from './chunk-HIWTWIGQ.js';
+import { DEFAULT_CIRCUIT_BREAKER_CONFIG, DEFAULT_GATEWAY_RETRY_CONFIG } from './chunk-NGMEI42S.js';
+import { logger } from './chunk-CBZNP6RF.js';
+import { __export, __name } from './chunk-XE4OXN2W.js';
+
+// src/gateway/index.ts
+var gateway_exports = {};
+__export(gateway_exports, {
+  CircuitState: () => CircuitState,
+  GatewayClient: () => GatewayClient,
+  GatewayError: () => GatewayError,
+  GatewayErrorType: () => GatewayErrorType,
+  Security: () => security_exports,
+  createGatewayClient: () => createGatewayClient,
+  createGatewayClientFromEnv: () => createGatewayClientFromEnv
+});
+
+// src/gateway/service-jwt.ts
+var SIGNING_ENV_VAR = "SERVICE_JWT_SECRET";
+var KEY_ID = "service-v1";
+var DEFAULT_TTL_SECONDS = 60;
+var REFRESH_BEFORE_EXP_MS = 1e4;
+var joseModule = null;
+async function getJose() {
+  if (!joseModule) {
+    joseModule = await import('jose');
+  }
+  return joseModule;
+}
+__name(getJose, "getJose");
+var cache = /* @__PURE__ */ new Map();
+function cacheKey(actorId, ttlSeconds) {
+  return `${actorId}:${ttlSeconds}`;
+}
+__name(cacheKey, "cacheKey");
+async function signServiceJwt(actorId, ttlSeconds = DEFAULT_TTL_SECONDS) {
+  const secret = process.env[SIGNING_ENV_VAR];
+  if (!secret) {
+    return null;
+  }
+  const key = cacheKey(actorId, ttlSeconds);
+  const cached = cache.get(key);
+  if (cached && cached.expiresAtMs - REFRESH_BEFORE_EXP_MS > Date.now()) {
+    return cached.token;
+  }
+  const joseLib = await getJose();
+  const encoder = new TextEncoder();
+  const keyBytes = encoder.encode(secret);
+  const nowSec = Math.floor(Date.now() / 1e3);
+  const expSec = nowSec + ttlSeconds;
+  const token = await new joseLib.SignJWT({
+    actor_type: "service"
+  }).setProtectedHeader({
+    alg: "HS256",
+    typ: "JWT",
+    kid: KEY_ID
+  }).setSubject(actorId).setIssuer(actorId).setIssuedAt(nowSec).setExpirationTime(expSec).sign(keyBytes);
+  cache.set(key, {
+    token,
+    expiresAtMs: expSec * 1e3
+  });
+  return token;
+}
+__name(signServiceJwt, "signServiceJwt");
+
+// src/gateway/types.ts
+var CircuitState = /* @__PURE__ */ (function(CircuitState2) {
+  CircuitState2["CLOSED"] = "CLOSED";
+  CircuitState2["OPEN"] = "OPEN";
+  CircuitState2["HALF_OPEN"] = "HALF_OPEN";
+  return CircuitState2;
+})({});
+var GatewayErrorType = /* @__PURE__ */ (function(GatewayErrorType2) {
+  GatewayErrorType2["NETWORK_ERROR"] = "NETWORK_ERROR";
+  GatewayErrorType2["TIMEOUT_ERROR"] = "TIMEOUT_ERROR";
+  GatewayErrorType2["CIRCUIT_OPEN"] = "CIRCUIT_OPEN";
+  GatewayErrorType2["GRAPHQL_ERROR"] = "GRAPHQL_ERROR";
+  GatewayErrorType2["UNKNOWN_ERROR"] = "UNKNOWN_ERROR";
+  return GatewayErrorType2;
+})({});
+var GatewayError = class _GatewayError extends Error {
+  static {
+    __name(this, "GatewayError");
+  }
+  type;
+  gatewayUrl;
+  statusCode;
+  graphqlErrors;
+  cause;
+  constructor(message, type, gatewayUrl, options) {
+    super(message);
+    this.name = "GatewayError";
+    this.type = type;
+    this.gatewayUrl = gatewayUrl;
+    this.statusCode = options?.statusCode;
+    this.graphqlErrors = options?.graphqlErrors;
+    this.cause = options?.cause;
+    Object.setPrototypeOf(this, _GatewayError.prototype);
+  }
+};
+
+// src/gateway/client.ts
+var uuidv4 = /* @__PURE__ */ __name(() => crypto.randomUUID(), "uuidv4");
+function hasAuthorizationHeader(headers) {
+  for (const key of Object.keys(headers)) {
+    if (key.toLowerCase() === "authorization") return true;
+  }
+  return false;
+}
+__name(hasAuthorizationHeader, "hasAuthorizationHeader");
+function resolveBypassPermissionValue(token = process.env["INTERNAL_SERVICE_TOKEN"]) {
+  const normalizedToken = token?.trim();
+  if (!normalizedToken) {
+    throw new Error("INTERNAL_SERVICE_TOKEN must be configured for bypass-enabled gateway calls");
+  }
+  return normalizedToken;
+}
+__name(resolveBypassPermissionValue, "resolveBypassPermissionValue");
+var CircuitBreaker = class CircuitBreaker2 {
+  static {
+    __name(this, "CircuitBreaker");
+  }
+  state = CircuitState.CLOSED;
+  failures = 0;
+  successes = 0;
+  consecutiveFailures = 0;
+  lastFailureTime = null;
+  lastSuccessTime = null;
+  openedAt = null;
+  failureTimestamps = [];
+  config;
+  constructor(config) {
+    this.config = config;
+  }
+  getState() {
+    this.checkStateTransition();
+    return this.state;
+  }
+  recordSuccess() {
+    this.successes++;
+    this.consecutiveFailures = 0;
+    this.lastSuccessTime = Date.now();
+    if (this.state === CircuitState.HALF_OPEN) {
+      this.state = CircuitState.CLOSED;
+      this.failures = 0;
+      this.failureTimestamps = [];
+      this.openedAt = null;
+      logger.info("[CircuitBreaker] Circuit closed after successful test");
+    }
+  }
+  recordFailure() {
+    this.failures++;
+    this.consecutiveFailures++;
+    this.lastFailureTime = Date.now();
+    this.failureTimestamps.push(Date.now());
+    const windowStart = Date.now() - this.config.failureWindow;
+    this.failureTimestamps = this.failureTimestamps.filter((t) => t > windowStart);
+    if (this.state === CircuitState.CLOSED && this.failureTimestamps.length >= this.config.failureThreshold) {
+      this.state = CircuitState.OPEN;
+      this.openedAt = Date.now();
+      logger.warn("[CircuitBreaker] Circuit opened due to failures", {
+        failures: this.failureTimestamps.length,
+        threshold: this.config.failureThreshold
+      });
+    }
+    if (this.state === CircuitState.HALF_OPEN) {
+      this.state = CircuitState.OPEN;
+      this.openedAt = Date.now();
+      logger.warn("[CircuitBreaker] Circuit re-opened after failed test");
+    }
+  }
+  allowRequest() {
+    this.checkStateTransition();
+    switch (this.state) {
+      case CircuitState.CLOSED:
+        return true;
+      case CircuitState.OPEN:
+        return false;
+      case CircuitState.HALF_OPEN:
+        return true;
+      default:
+        return true;
+    }
+  }
+  forceOpen() {
+    this.state = CircuitState.OPEN;
+    this.openedAt = Date.now();
+    logger.info("[CircuitBreaker] Circuit force-opened");
+  }
+  forceClose() {
+    this.state = CircuitState.CLOSED;
+    this.failures = 0;
+    this.consecutiveFailures = 0;
+    this.failureTimestamps = [];
+    this.openedAt = null;
+    logger.info("[CircuitBreaker] Circuit force-closed");
+  }
+  getStats() {
+    return {
+      state: this.state,
+      failures: this.failures,
+      successes: this.successes,
+      consecutiveFailures: this.consecutiveFailures,
+      lastFailureTime: this.lastFailureTime,
+      lastSuccessTime: this.lastSuccessTime,
+      openedAt: this.openedAt
+    };
+  }
+  checkStateTransition() {
+    if (this.state === CircuitState.OPEN && this.openedAt) {
+      const elapsed = Date.now() - this.openedAt;
+      if (elapsed >= this.config.resetTimeout) {
+        this.state = CircuitState.HALF_OPEN;
+        logger.info("[CircuitBreaker] Circuit transitioning to half-open");
+      }
+    }
+  }
+};
+var GatewayClient = class {
+  static {
+    __name(this, "GatewayClient");
+  }
+  config;
+  layerManager;
+  internalCircuitBreaker;
+  crossLayerCircuitBreaker;
+  retryConfig;
+  defaultHeaders;
+  constructor(config) {
+    this.config = {
+      timeout: 3e4,
+      enableLogging: true,
+      ...config
+    };
+    this.layerManager = new LayerManager({
+      layer: config.layer,
+      serviceName: config.serviceName,
+      serviceIdentity: config.serviceIdentity
+    });
+    if (config.internalGatewayUrl) ;
+    if (config.crossLayerGatewayUrl) ;
+    const cbConfig = {
+      ...DEFAULT_CIRCUIT_BREAKER_CONFIG,
+      ...config.circuitBreaker
+    };
+    this.internalCircuitBreaker = new CircuitBreaker(cbConfig);
+    this.crossLayerCircuitBreaker = new CircuitBreaker(cbConfig);
+    this.retryConfig = {
+      ...DEFAULT_GATEWAY_RETRY_CONFIG,
+      ...config.retry
+    };
+    this.defaultHeaders = {
+      "x-service-identity": this.layerManager.getServiceIdentity(),
+      "x-actor-type": "service",
+      ...config.defaultHeaders
+    };
+    logger.debug("[GatewayClient] Initialized", {
+      layer: config.layer,
+      serviceName: config.serviceName,
+      internalUrl: this.getInternalUrl(),
+      crossLayerUrl: this.getCrossLayerUrl()
+    });
+  }
+  getInternalUrl() {
+    return this.config.internalGatewayUrl || this.layerManager.getInternalGatewayUrl();
+  }
+  getCrossLayerUrl() {
+    return this.config.crossLayerGatewayUrl || this.layerManager.getCrossLayerGatewayUrl();
+  }
+  /**
+  * Execute internal (same layer) GraphQL query/mutation
+  */
+  async internalQuery(options) {
+    const context = this.createRequestContext("internal", options);
+    return this.executeWithRetry(this.getInternalUrl(), options, this.internalCircuitBreaker, context, {
+      bypassPermission: true
+    });
+  }
+  /**
+  * Execute cross-layer GraphQL query/mutation
+  */
+  async crossLayerQuery(options) {
+    const context = this.createRequestContext("cross-layer", options);
+    return this.executeWithRetry(
+      this.getCrossLayerUrl(),
+      options,
+      this.crossLayerCircuitBreaker,
+      context,
+      {
+        bypassPermission: false
+      }
+      // Cross-layer calls go through public gateway
+    );
+  }
+  /**
+  * Execute GraphQL query/mutation with explicit gateway URL
+  */
+  async query(gatewayUrl, options) {
+    const context = this.createRequestContext("direct", options);
+    return this.executeWithRetry(gatewayUrl, options, this.internalCircuitBreaker, context, {
+      bypassPermission: false
+    });
+  }
+  getInternalCircuitBreaker() {
+    return this.internalCircuitBreaker;
+  }
+  getCrossLayerCircuitBreaker() {
+    return this.crossLayerCircuitBreaker;
+  }
+  getHealthStatus() {
+    return {
+      internal: {
+        url: this.getInternalUrl(),
+        circuitState: this.internalCircuitBreaker.getState(),
+        stats: this.internalCircuitBreaker.getStats()
+      },
+      crossLayer: {
+        url: this.getCrossLayerUrl(),
+        circuitState: this.crossLayerCircuitBreaker.getState(),
+        stats: this.crossLayerCircuitBreaker.getStats()
+      }
+    };
+  }
+  updateDefaultHeaders(headers) {
+    this.defaultHeaders = {
+      ...this.defaultHeaders,
+      ...headers
+    };
+  }
+  createRequestContext(callType, options) {
+    return {
+      requestId: uuidv4(),
+      actorId: options.headers?.["x-actor-id"] || this.defaultHeaders["x-actor-id"],
+      workspaceId: options.headers?.["x-workspace-id"] || this.defaultHeaders["x-workspace-id"],
+      startTime: Date.now(),
+      callType
+    };
+  }
+  /**
+  * Check if an error should be retried
+  */
+  shouldRetryError(error) {
+    if (!(error instanceof GatewayError)) {
+      return true;
+    }
+    return error.type !== GatewayErrorType.GRAPHQL_ERROR && error.type !== GatewayErrorType.CIRCUIT_OPEN;
+  }
+  /**
+  * Calculate retry delay with exponential backoff
+  */
+  calculateRetryDelay(attempt) {
+    return Math.min(this.retryConfig.initialDelay * Math.pow(this.retryConfig.backoffMultiplier, attempt - 1), this.retryConfig.maxDelay);
+  }
+  /**
+  * Log retry attempt if logging is enabled
+  */
+  logRetryAttempt(context, attempt, maxAttempts, delay, error) {
+    if (this.config.enableLogging) {
+      logger.warn("[GatewayClient] Request failed, retrying", {
+        requestId: context.requestId,
+        attempt,
+        maxAttempts,
+        delay,
+        error: error.message
+      });
+    }
+  }
+  async executeWithRetry(gatewayUrl, options, circuitBreaker, context, settings) {
+    if (!options.skipCircuitBreaker && !circuitBreaker.allowRequest()) {
+      throw new GatewayError(`Circuit breaker is open for ${gatewayUrl}`, GatewayErrorType.CIRCUIT_OPEN, gatewayUrl);
+    }
+    const maxAttempts = options.skipRetry ? 1 : this.retryConfig.maxAttempts;
+    let lastError = null;
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+      try {
+        const result = await this.executeRequest(gatewayUrl, options, context, settings.bypassPermission);
+        if (!options.skipCircuitBreaker) {
+          circuitBreaker.recordSuccess();
+        }
+        return result;
+      } catch (error) {
+        lastError = error instanceof Error ? error : new Error(String(error));
+        if (!options.skipCircuitBreaker) {
+          circuitBreaker.recordFailure();
+        }
+        if (!this.shouldRetryError(error)) {
+          throw error;
+        }
+        if (attempt < maxAttempts) {
+          const delay = this.calculateRetryDelay(attempt);
+          this.logRetryAttempt(context, attempt, maxAttempts, delay, lastError);
+          await this.sleep(delay);
+        }
+      }
+    }
+    throw lastError || new GatewayError("Request failed after retries", GatewayErrorType.UNKNOWN_ERROR, gatewayUrl);
+  }
+  /**
+  * Build headers for a request
+  */
+  buildRequestHeaders(context, options, bypassPermission) {
+    const headers = {
+      "Content-Type": "application/json",
+      "x-request-id": context.requestId,
+      "x-call-type": context.callType
+    };
+    for (const [key, value] of Object.entries(this.defaultHeaders)) {
+      if (value !== void 0) {
+        headers[key] = String(value);
+      }
+    }
+    if (options.headers) {
+      for (const [key, value] of Object.entries(options.headers)) {
+        if (value !== void 0) {
+          headers[key] = String(value);
+        }
+      }
+    }
+    if (bypassPermission) {
+      headers["x-bypass-permission"] = resolveBypassPermissionValue();
+      headers["x-bypass-source"] = this.layerManager.getServiceIdentity();
+      headers["x-bypass-timestamp"] = Date.now().toString();
+    }
+    return headers;
+  }
+  /**
+  * Handle GraphQL errors in response
+  */
+  handleGraphQLErrors(result, context, gatewayUrl, duration) {
+    if (!result.errors || result.errors.length === 0) {
+      return;
+    }
+    const errorMessages = result.errors.map((e) => e.message).join(", ");
+    if (this.config.enableLogging) {
+      logger.warn("[GatewayClient] GraphQL errors", {
+        requestId: context.requestId,
+        errors: result.errors,
+        duration
+      });
+    }
+    throw new GatewayError(`GraphQL error: ${errorMessages}`, GatewayErrorType.GRAPHQL_ERROR, gatewayUrl, {
+      graphqlErrors: result.errors
+    });
+  }
+  /**
+  * Handle fetch errors
+  */
+  handleFetchError(error, context, gatewayUrl, timeout, duration) {
+    if (error instanceof GatewayError) {
+      throw error;
+    }
+    if (error instanceof Error) {
+      if (error.name === "AbortError") {
+        throw new GatewayError(`Request timed out after ${timeout}ms`, GatewayErrorType.TIMEOUT_ERROR, gatewayUrl, {
+          cause: error
+        });
+      }
+      if (this.config.enableLogging) {
+        logger.error("[GatewayClient] Request failed", {
+          requestId: context.requestId,
+          error: error.message,
+          duration
+        });
+      }
+      throw new GatewayError(error.message, GatewayErrorType.NETWORK_ERROR, gatewayUrl, {
+        cause: error
+      });
+    }
+    throw new GatewayError(String(error), GatewayErrorType.UNKNOWN_ERROR, gatewayUrl);
+  }
+  async executeRequest(gatewayUrl, options, context, bypassPermission) {
+    const timeout = options.timeout || this.config.timeout || 3e4;
+    const headers = this.buildRequestHeaders(context, options, bypassPermission);
+    if (context.callType === "cross-layer" && !hasAuthorizationHeader(headers)) {
+      const serviceActorId = this.layerManager.getServiceIdentity();
+      const serviceJwt = await signServiceJwt(serviceActorId);
+      if (serviceJwt) {
+        headers["Authorization"] = `Bearer ${serviceJwt}`;
+      } else if (this.config.enableLogging) {
+        logger.debug("[GatewayClient] SERVICE_JWT_SECRET not configured \u2014 cross-layer call will proceed without service JWT", {
+          requestId: context.requestId,
+          gatewayUrl
+        });
+      }
+    }
+    const body = JSON.stringify({
+      query: options.query,
+      variables: options.variables || {},
+      operationName: options.operationName
+    });
+    if (this.config.enableLogging) {
+      logger.debug("[GatewayClient] Executing request", {
+        requestId: context.requestId,
+        gatewayUrl,
+        operationName: options.operationName,
+        callType: context.callType,
+        bypassPermission
+      });
+    }
+    try {
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), timeout);
+      const response = await fetch(gatewayUrl, {
+        method: "POST",
+        headers,
+        body,
+        signal: controller.signal
+      });
+      clearTimeout(timeoutId);
+      const duration = Date.now() - context.startTime;
+      if (!response.ok) {
+        throw new GatewayError(`HTTP ${response.status}: ${response.statusText}`, GatewayErrorType.NETWORK_ERROR, gatewayUrl, {
+          statusCode: response.status
+        });
+      }
+      const result = await response.json();
+      this.handleGraphQLErrors(result, context, gatewayUrl, duration);
+      if (this.config.enableLogging) {
+        logger.debug("[GatewayClient] Request completed", {
+          requestId: context.requestId,
+          duration,
+          hasData: !!result.data
+        });
+      }
+      return result;
+    } catch (error) {
+      const duration = Date.now() - context.startTime;
+      this.handleFetchError(error, context, gatewayUrl, timeout, duration);
+    }
+  }
+  sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+  }
+};
+function createGatewayClient(config) {
+  return new GatewayClient(config);
+}
+__name(createGatewayClient, "createGatewayClient");
+function createGatewayClientFromEnv() {
+  const layer = process.env["SERVICE_LAYER"];
+  if (!layer || layer !== "wspace" && layer !== "global") {
+    throw new Error(`[GatewayClient] Invalid or missing SERVICE_LAYER. Expected 'wspace' or 'global', got '${layer}'`);
+  }
+  const serviceName = process.env["SERVICE_NAME"];
+  if (!serviceName) {
+    throw new Error("[GatewayClient] SERVICE_NAME environment variable is required");
+  }
+  const serviceIdentity = process.env["SERVICE_IDENTITY"] || serviceName;
+  return new GatewayClient({
+    layer,
+    serviceName,
+    serviceIdentity
+  });
+}
+__name(createGatewayClientFromEnv, "createGatewayClientFromEnv");
+
+export { CircuitState, GatewayClient, GatewayError, GatewayErrorType, createGatewayClient, createGatewayClientFromEnv, gateway_exports };
+//# sourceMappingURL=chunk-4B43DZIS.js.map
+//# sourceMappingURL=chunk-4B43DZIS.js.map