@burdenoff/be-sdk 2026.516.2 → 2026.516.3

package/dist/{chunk-U455UF4O.js.map → chunk-TXW7ZKA2.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/gateway/index.ts","../src/gateway/service-jwt.ts","../src/gateway/types.ts","../src/gateway/client.ts"],"names":["SIGNING_ENV_VAR","KEY_ID","DEFAULT_TTL_SECONDS","REFRESH_BEFORE_EXP_MS","joseModule","getJose","cache","Map","cacheKey","actorId","ttlSeconds","signServiceJwt","secret","process","env","key","cached","get","expiresAtMs","Date","now","token","joseLib","encoder","TextEncoder","keyBytes","encode","nowSec","Math","floor","expSec","SignJWT","actor_type","setProtectedHeader","alg","typ","kid","setSubject","setIssuer","setIssuedAt","setExpirationTime","sign","set","CircuitState","GatewayErrorType","GatewayError","Error","type","gatewayUrl","statusCode","graphqlErrors","cause","message","options","name","Object","setPrototypeOf","prototype","uuidv4","crypto","randomUUID","hasAuthorizationHeader","headers","keys","toLowerCase","resolveBypassPermissionValue","normalizedToken","trim","CircuitBreaker","state","CLOSED","failures","successes","consecutiveFailures","lastFailureTime","lastSuccessTime","openedAt","failureTimestamps","config","getState","checkStateTransition","recordSuccess","HALF_OPEN","logger","info","recordFailure","push","windowStart","failureWindow","filter","t","length","failureThreshold","OPEN","warn","threshold","allowRequest","forceOpen","forceClose","getStats","elapsed","resetTimeout","GatewayClient","layerManager","internalCircuitBreaker","crossLayerCircuitBreaker","retryConfig","defaultHeaders","timeout","enableLogging","LayerManager","layer","serviceName","serviceIdentity","internalGatewayUrl","crossLayerGatewayUrl","cbConfig","DEFAULT_CIRCUIT_BREAKER_CONFIG","circuitBreaker","DEFAULT_GATEWAY_RETRY_CONFIG","retry","getServiceIdentity","debug","internalUrl","getInternalUrl","crossLayerUrl","getCrossLayerUrl","getInternalGatewayUrl","getCrossLayerGatewayUrl","internalQuery","context","createRequestContext","executeWithRetry","bypassPermission","crossLayerQuery","query","getInternalCircuitBreaker","getCrossLayerCircuitBreaker","getHealthStatus","internal","url","circuitState","stats","crossLayer","updateDefaultHeaders","callType","requestId","workspaceId","startTime","shouldRetryError","error","GRAPHQL_ERROR","CIRCUIT_OPEN","calculateRetryDelay","attempt","min","initialDelay","pow","backoffMultiplier","maxDelay","logRetryAttempt","maxAttempts","delay","settings","skipCircuitBreaker","skipRetry","lastError","result","executeRequest","String","sleep","UNKNOWN_ERROR","buildRequestHeaders","value","entries","undefined","toString","handleGraphQLErrors","duration","errors","errorMessages","map","e","join","handleFetchError","TIMEOUT_ERROR","NETWORK_ERROR","serviceActorId","serviceJwt","body","JSON","stringify","variables","operationName","controller","AbortController","timeoutId","setTimeout","abort","response","fetch","method","signal","clearTimeout","ok","status","statusText","json","hasData","data","ms","Promise","resolve","createGatewayClient","createGatewayClientFromEnv"],"mappings":";;;;;;;AAAA,IAAA,eAAA,GAAA;;;;;;;;;;;;AC6BA,IAAMA,eAAAA,GAAkB,oBAAA;AACxB,IAAMC,MAAAA,GAAS,YAAA;AACf,IAAMC,mBAAAA,GAAsB,EAAA;AAC5B,IAAMC,qBAAAA,GAAwB,GAAA;AAE9B,IAAIC,UAAAA,GAAiC,IAAA;AAErC,eAAeC,OAAAA,GAAAA;AACb,EAAA,IAAI,CAACD,UAAAA,EAAY;AACfA,IAAAA,UAAAA,GAAa,MAAM,OAAO,MAAA,CAAA;AAC5B,EAAA;AACA,EAAA,OAAOA,UAAAA;AACT;AALeC,MAAAA,CAAAA,OAAAA,EAAAA,SAAAA,CAAAA;AAYf,IAAMC,KAAAA,uBAAYC,GAAAA,EAAAA;AAElB,SAASC,QAAAA,CAASC,SAAiBC,UAAAA,EAAkB;AACnD,EAAA,OAAO,CAAA,EAAGD,OAAAA,CAAAA,CAAAA,EAAWC,UAAAA,CAAAA,CAAAA;AACvB;AAFSF,MAAAA,CAAAA,QAAAA,EAAAA,UAAAA,CAAAA;AAQT,eAAsBG,cAAAA,CACpBF,OAAAA,EACAC,UAAAA,GAAqBR,mBAAAA,EAAmB;AAExC,EAAA,MAAMU,MAAAA,GAASC,OAAAA,CAAQC,GAAAA,CAAId,eAAAA,CAAAA;AAC3B,EAAA,IAAI,CAACY,MAAAA,EAAQ;AACX,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMG,GAAAA,GAAMP,QAAAA,CAASC,OAAAA,EAASC,UAAAA,CAAAA;AAC9B,EAAA,MAAMM,MAAAA,GAASV,KAAAA,CAAMW,GAAAA,CAAIF,GAAAA,CAAAA;AACzB,EAAA,IAAIC,UAAUA,MAAAA,CAAOE,WAAAA,GAAcf,qBAAAA,GAAwBgB,IAAAA,CAAKC,KAAG,EAAI;AACrE,IAAA,OAAOJ,MAAAA,CAAOK,KAAAA;AAChB,EAAA;AAEA,EAAA,MAAMC,OAAAA,GAAU,MAAMjB,OAAAA,EAAAA;AACtB,EAAA,MAAMkB,OAAAA,GAAU,IAAIC,WAAAA,EAAAA;AACpB,EAAA,MAAMC,QAAAA,GAAWF,OAAAA,CAAQG,MAAAA,CAAOd,MAAAA,CAAAA;AAEhC,EAAA,MAAMe,SAASC,IAAAA,CAAKC,KAAAA,CAAMV,IAAAA,CAAKC,GAAAA,KAAQ,GAAA,CAAA;AACvC,EAAA,MAAMU,SAASH,MAAAA,GAASjB,UAAAA;AAExB,EAAA,MAAMW,KAAAA,GAAQ,MAAM,IAAIC,OAAAA,CAAQS,OAAAA,CAAQ;IACtCC,UAAAA,EAAY;AACd,GAAA,EACGC,kBAAAA,CAAmB;IAAEC,GAAAA,EAAK,OAAA;IAASC,GAAAA,EAAK,KAAA;IAAOC,GAAAA,EAAKnC;AAAO,GAAA,CAAA,CAC3DoC,UAAAA,CAAW5B,OAAAA,CAAAA,CAKX6B,UAAU7B,OAAAA,CAAAA,CACV8B,WAAAA,CAAYZ,MAAAA,CAAAA,CACZa,iBAAAA,CAAkBV,MAAAA,CAAAA,CAClBW,KAAKhB,QAAAA,CAAAA;AAERnB,EAAAA,KAAAA,CAAMoC,IAAI3B,GAAAA,EAAK;AAAEM,IAAAA,KAAAA;AAAOH,IAAAA,WAAAA,EAAaY,MAAAA,GAAS;GAAK,CAAA;AACnD,EAAA,OAAOT,KAAAA;AACT;AAtCsBV,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;;;ACiBf,IAAKgC,YAAAA,6BAAAA,aAAAA,EAAAA;;;;AAAAA,EAAAA,OAAAA,aAAAA;;AA8ML,IAAKC,gBAAAA,6BAAAA,iBAAAA,EAAAA;;;;;;AAAAA,EAAAA,OAAAA,iBAAAA;;AAWL,IAAMC,YAAAA,GAAN,MAAMA,aAAAA,SAAqBC,KAAAA,CAAAA;EApSlC;;;AAqSEC,EAAAA,IAAAA;AACAC,EAAAA,UAAAA;AACAC,EAAAA,UAAAA;AACAC,EAAAA,aAAAA;AACSC,EAAAA,KAAAA;EAET,WAAA,CACEC,OAAAA,EACAL,IAAAA,EACAC,UAAAA,EACAK,OAAAA,EAKA;AACA,IAAA,KAAA,CAAMD,OAAAA,CAAAA;AACN,IAAA,IAAA,CAAKE,IAAAA,GAAO,cAAA;AACZ,IAAA,IAAA,CAAKP,IAAAA,GAAOA,IAAAA;AACZ,IAAA,IAAA,CAAKC,UAAAA,GAAaA,UAAAA;AAClB,IAAA,IAAA,CAAKC,aAAaI,OAAAA,EAASJ,UAAAA;AAC3B,IAAA,IAAA,CAAKC,gBAAgBG,OAAAA,EAASH,aAAAA;AAC9B,IAAA,IAAA,CAAKC,QAAQE,OAAAA,EAASF,KAAAA;AACtBI,IAAAA,MAAAA,CAAOC,cAAAA,CAAe,IAAA,EAAMX,aAAAA,CAAaY,SAAS,CAAA;AACpD,EAAA;AACF;;;ACtQA,IAAMC,MAAAA,mBAAS,MAAA,CAAA,MAAcC,MAAAA,CAAOC,UAAAA,EAAU,EAA/B,QAAA,CAAA;AASf,SAASC,uBAAuBC,OAAAA,EAA+B;AAC7D,EAAA,KAAA,MAAW/C,GAAAA,IAAOwC,MAAAA,CAAOQ,IAAAA,CAAKD,OAAAA,CAAAA,EAAU;AACtC,IAAA,IAAI/C,GAAAA,CAAIiD,WAAAA,EAAW,KAAO,eAAA,EAAiB,OAAO,IAAA;AACpD,EAAA;AACA,EAAA,OAAO,KAAA;AACT;AALSH,MAAAA,CAAAA,sBAAAA,EAAAA,wBAAAA,CAAAA;AAOF,SAASI,4BAAAA,CACd5C,KAAAA,GAA4BR,OAAAA,CAAQC,GAAAA,CAAI,wBAAA,CAAA,EAAyB;AAEjE,EAAA,MAAMoD,eAAAA,GAAkB7C,OAAO8C,IAAAA,EAAAA;AAE/B,EAAA,IAAI,CAACD,eAAAA,EAAiB;AACpB,IAAA,MAAM,IAAIpB,MAAM,4EAAA,CAAA;AAClB,EAAA;AAEA,EAAA,OAAOoB,eAAAA;AACT;AAVgBD,MAAAA,CAAAA,4BAAAA,EAAAA,8BAAAA,CAAAA;AAehB,IAAMG,cAAAA,GAAN,MAAMA,eAAAA,CAAAA;EAvFN;;;AAwFUC,EAAAA,KAAAA,GAAsB1B,YAAAA,CAAa2B,MAAAA;EACnCC,QAAAA,GAAW,CAAA;EACXC,SAAAA,GAAY,CAAA;EACZC,mBAAAA,GAAsB,CAAA;EACtBC,eAAAA,GAAiC,IAAA;EACjCC,eAAAA,GAAiC,IAAA;EACjCC,QAAAA,GAA0B,IAAA;AAC1BC,EAAAA,iBAAAA,GAA8B,EAAA;AAC9BC,EAAAA,MAAAA;AAER,EAAA,WAAA,CAAYA,MAAAA,EAA8B;AACxC,IAAA,IAAA,CAAKA,MAAAA,GAASA,MAAAA;AAChB,EAAA;EAEAC,QAAAA,GAAyB;AACvB,IAAA,IAAA,CAAKC,oBAAAA,EAAoB;AACzB,IAAA,OAAO,IAAA,CAAKX,KAAAA;AACd,EAAA;EAEAY,aAAAA,GAAsB;AACpB,IAAA,IAAA,CAAKT,SAAAA,EAAAA;AACL,IAAA,IAAA,CAAKC,mBAAAA,GAAsB,CAAA;AAC3B,IAAA,IAAA,CAAKE,eAAAA,GAAkBxD,KAAKC,GAAAA,EAAG;AAE/B,IAAA,IAAI,IAAA,CAAKiD,KAAAA,KAAU1B,YAAAA,CAAauC,SAAAA,EAAW;AACzC,MAAA,IAAA,CAAKb,QAAQ1B,YAAAA,CAAa2B,MAAAA;AAC1B,MAAA,IAAA,CAAKC,QAAAA,GAAW,CAAA;AAChB,MAAA,IAAA,CAAKM,oBAAoB,EAAA;AACzB,MAAA,IAAA,CAAKD,QAAAA,GAAW,IAAA;AAChBO,MAAAA,MAAAA,CAAOC,KAAK,uDAAA,CAAA;AACd,IAAA;AACF,EAAA;EAEAC,aAAAA,GAAsB;AACpB,IAAA,IAAA,CAAKd,QAAAA,EAAAA;AACL,IAAA,IAAA,CAAKE,mBAAAA,EAAAA;AACL,IAAA,IAAA,CAAKC,eAAAA,GAAkBvD,KAAKC,GAAAA,EAAG;AAC/B,IAAA,IAAA,CAAKyD,iBAAAA,CAAkBS,IAAAA,CAAKnE,IAAAA,CAAKC,GAAAA,EAAG,CAAA;AAGpC,IAAA,MAAMmE,WAAAA,GAAcpE,IAAAA,CAAKC,GAAAA,EAAG,GAAK,KAAK0D,MAAAA,CAAOU,aAAAA;AAC7C,IAAA,IAAA,CAAKX,oBAAoB,IAAA,CAAKA,iBAAAA,CAAkBY,OAAO,CAACC,CAAAA,KAAMA,IAAIH,WAAAA,CAAAA;AAGlE,IAAA,IAAI,IAAA,CAAKlB,UAAU1B,YAAAA,CAAa2B,MAAAA,IAAU,KAAKO,iBAAAA,CAAkBc,MAAAA,IAAU,IAAA,CAAKb,MAAAA,CAAOc,gBAAAA,EAAkB;AACvG,MAAA,IAAA,CAAKvB,QAAQ1B,YAAAA,CAAakD,IAAAA;AAC1B,MAAA,IAAA,CAAKjB,QAAAA,GAAWzD,KAAKC,GAAAA,EAAG;AACxB+D,MAAAA,MAAAA,CAAOW,KAAK,iDAAA,EAAmD;AAC7DvB,QAAAA,QAAAA,EAAU,KAAKM,iBAAAA,CAAkBc,MAAAA;AACjCI,QAAAA,SAAAA,EAAW,KAAKjB,MAAAA,CAAOc;OACzB,CAAA;AACF,IAAA;AAGA,IAAA,IAAI,IAAA,CAAKvB,KAAAA,KAAU1B,YAAAA,CAAauC,SAAAA,EAAW;AACzC,MAAA,IAAA,CAAKb,QAAQ1B,YAAAA,CAAakD,IAAAA;AAC1B,MAAA,IAAA,CAAKjB,QAAAA,GAAWzD,KAAKC,GAAAA,EAAG;AACxB+D,MAAAA,MAAAA,CAAOW,KAAK,sDAAA,CAAA;AACd,IAAA;AACF,EAAA;EAEAE,YAAAA,GAAwB;AACtB,IAAA,IAAA,CAAKhB,oBAAAA,EAAoB;AAEzB,IAAA,QAAQ,KAAKX,KAAAA;AACX,MAAA,KAAK1B,YAAAA,CAAa2B,MAAAA;AAChB,QAAA,OAAO,IAAA;AACT,MAAA,KAAK3B,YAAAA,CAAakD,IAAAA;AAChB,QAAA,OAAO,KAAA;AACT,MAAA,KAAKlD,YAAAA,CAAauC,SAAAA;AAEhB,QAAA,OAAO,IAAA;AACT,MAAA;AACE,QAAA,OAAO,IAAA;AACX;AACF,EAAA;EAEAe,SAAAA,GAAkB;AAChB,IAAA,IAAA,CAAK5B,QAAQ1B,YAAAA,CAAakD,IAAAA;AAC1B,IAAA,IAAA,CAAKjB,QAAAA,GAAWzD,KAAKC,GAAAA,EAAG;AACxB+D,IAAAA,MAAAA,CAAOC,KAAK,uCAAA,CAAA;AACd,EAAA;EAEAc,UAAAA,GAAmB;AACjB,IAAA,IAAA,CAAK7B,QAAQ1B,YAAAA,CAAa2B,MAAAA;AAC1B,IAAA,IAAA,CAAKC,QAAAA,GAAW,CAAA;AAChB,IAAA,IAAA,CAAKE,mBAAAA,GAAsB,CAAA;AAC3B,IAAA,IAAA,CAAKI,oBAAoB,EAAA;AACzB,IAAA,IAAA,CAAKD,QAAAA,GAAW,IAAA;AAChBO,IAAAA,MAAAA,CAAOC,KAAK,uCAAA,CAAA;AACd,EAAA;EAEAe,QAAAA,GAAgC;AAC9B,IAAA,OAAO;AACL9B,MAAAA,KAAAA,EAAO,IAAA,CAAKA,KAAAA;AACZE,MAAAA,QAAAA,EAAU,IAAA,CAAKA,QAAAA;AACfC,MAAAA,SAAAA,EAAW,IAAA,CAAKA,SAAAA;AAChBC,MAAAA,mBAAAA,EAAqB,IAAA,CAAKA,mBAAAA;AAC1BC,MAAAA,eAAAA,EAAiB,IAAA,CAAKA,eAAAA;AACtBC,MAAAA,eAAAA,EAAiB,IAAA,CAAKA,eAAAA;AACtBC,MAAAA,QAAAA,EAAU,IAAA,CAAKA;AACjB,KAAA;AACF,EAAA;EAEQI,oBAAAA,GAA6B;AACnC,IAAA,IAAI,IAAA,CAAKX,KAAAA,KAAU1B,YAAAA,CAAakD,IAAAA,IAAQ,KAAKjB,QAAAA,EAAU;AACrD,MAAA,MAAMwB,OAAAA,GAAUjF,IAAAA,CAAKC,GAAAA,EAAG,GAAK,IAAA,CAAKwD,QAAAA;AAClC,MAAA,IAAIwB,OAAAA,IAAW,IAAA,CAAKtB,MAAAA,CAAOuB,YAAAA,EAAc;AACvC,QAAA,IAAA,CAAKhC,QAAQ1B,YAAAA,CAAauC,SAAAA;AAC1BC,QAAAA,MAAAA,CAAOC,KAAK,qDAAA,CAAA;AACd,MAAA;AACF,IAAA;AACF,EAAA;AACF,CAAA;AAKO,IAAMkB,gBAAN,MAAMA;EA9Mb;;;AA+MUxB,EAAAA,MAAAA;AACAyB,EAAAA,YAAAA;AACAC,EAAAA,sBAAAA;AACAC,EAAAA,wBAAAA;AACAC,EAAAA,WAAAA;AACAC,EAAAA,cAAAA;AAER,EAAA,WAAA,CAAY7B,MAAAA,EAA6B;AACvC,IAAA,IAAA,CAAKA,MAAAA,GAAS;MACZ8B,OAAAA,EAAS,GAAA;MACTC,aAAAA,EAAe,IAAA;MACf,GAAG/B;AACL,KAAA;AAGA,IAAA,IAAA,CAAKyB,YAAAA,GAAe,IAAIO,YAAAA,CAAa;AACnCC,MAAAA,KAAAA,EAAOjC,MAAAA,CAAOiC,KAAAA;AACdC,MAAAA,WAAAA,EAAalC,MAAAA,CAAOkC,WAAAA;AACpBC,MAAAA,eAAAA,EAAiBnC,MAAAA,CAAOmC;KAC1B,CAAA;AAGA,IAAA,IAAInC,OAAOoC,kBAAAA,EAAoB;AAG/B,IAAA,IAAIpC,OAAOqC,oBAAAA,EAAsB;AAKjC,IAAA,MAAMC,QAAAA,GAAiC;MACrC,GAAGC,8BAAAA;AACH,MAAA,GAAGvC,MAAAA,CAAOwC;AACZ,KAAA;AACA,IAAA,IAAA,CAAKd,sBAAAA,GAAyB,IAAIpC,cAAAA,CAAegD,QAAAA,CAAAA;AACjD,IAAA,IAAA,CAAKX,wBAAAA,GAA2B,IAAIrC,cAAAA,CAAegD,QAAAA,CAAAA;AAGnD,IAAA,IAAA,CAAKV,WAAAA,GAAc;MACjB,GAAGa,4BAAAA;AACH,MAAA,GAAGzC,MAAAA,CAAO0C;AACZ,KAAA;AAGA,IAAA,IAAA,CAAKb,cAAAA,GAAiB;MACpB,oBAAA,EAAsB,IAAA,CAAKJ,aAAakB,kBAAAA,EAAkB;MAC1D,cAAA,EAAgB,SAAA;AAChB,MAAA,GAAG3C,MAAAA,CAAO6B;AACZ,KAAA;AAEAxB,IAAAA,MAAAA,CAAOuC,MAAM,6BAAA,EAA+B;AAC1CX,MAAAA,KAAAA,EAAOjC,MAAAA,CAAOiC,KAAAA;AACdC,MAAAA,WAAAA,EAAalC,MAAAA,CAAOkC,WAAAA;AACpBW,MAAAA,WAAAA,EAAa,KAAKC,cAAAA,EAAc;AAChCC,MAAAA,aAAAA,EAAe,KAAKC,gBAAAA;KACtB,CAAA;AACF,EAAA;EAEQF,cAAAA,GAAyB;AAC/B,IAAA,OAAO,IAAA,CAAK9C,MAAAA,CAAOoC,kBAAAA,IAAsB,IAAA,CAAKX,aAAawB,qBAAAA,EAAqB;AAClF,EAAA;EAEQD,gBAAAA,GAA2B;AACjC,IAAA,OAAO,IAAA,CAAKhD,MAAAA,CAAOqC,oBAAAA,IAAwB,IAAA,CAAKZ,aAAayB,uBAAAA,EAAuB;AACtF,EAAA;;;;AAKA,EAAA,MAAMC,cAA2B5E,OAAAA,EAA6D;AAC5F,IAAA,MAAM6E,OAAAA,GAAU,IAAA,CAAKC,oBAAAA,CAAqB,UAAA,EAAY9E,OAAAA,CAAAA;AAEtD,IAAA,OAAO,IAAA,CAAK+E,iBAAiB,IAAA,CAAKR,cAAAA,IAAkBvE,OAAAA,EAAS,IAAA,CAAKmD,wBAAwB0B,OAAAA,EAAS;MACjGG,gBAAAA,EAAkB;KACpB,CAAA;AACF,EAAA;;;;AAKA,EAAA,MAAMC,gBAA6BjF,OAAAA,EAA6D;AAC9F,IAAA,MAAM6E,OAAAA,GAAU,IAAA,CAAKC,oBAAAA,CAAqB,aAAA,EAAe9E,OAAAA,CAAAA;AAEzD,IAAA,OAAO,IAAA,CAAK+E,gBAAAA;AACV,MAAA,IAAA,CAAKN,gBAAAA,EAAgB;AACrBzE,MAAAA,OAAAA;MACA,IAAA,CAAKoD,wBAAAA;AACLyB,MAAAA,OAAAA;AACA,MAAA;QAAEG,gBAAAA,EAAkB;AAAM;;;AAE9B,EAAA;;;;EAKA,MAAME,KAAAA,CAAmBvF,YAAoBK,OAAAA,EAA6D;AACxG,IAAA,MAAM6E,OAAAA,GAAU,IAAA,CAAKC,oBAAAA,CAAqB,QAAA,EAAU9E,OAAAA,CAAAA;AAGpD,IAAA,OAAO,KAAK+E,gBAAAA,CAAiBpF,UAAAA,EAAYK,OAAAA,EAAS,IAAA,CAAKmD,wBAAwB0B,OAAAA,EAAS;MACtFG,gBAAAA,EAAkB;KACpB,CAAA;AACF,EAAA;EAEAG,yBAAAA,GAA6C;AAC3C,IAAA,OAAO,IAAA,CAAKhC,sBAAAA;AACd,EAAA;EAEAiC,2BAAAA,GAA+C;AAC7C,IAAA,OAAO,IAAA,CAAKhC,wBAAAA;AACd,EAAA;EAEAiC,eAAAA,GAAuC;AACrC,IAAA,OAAO;MACLC,QAAAA,EAAU;AACRC,QAAAA,GAAAA,EAAK,KAAKhB,cAAAA,EAAc;QACxBiB,YAAAA,EAAc,IAAA,CAAKrC,uBAAuBzB,QAAAA,EAAQ;QAClD+D,KAAAA,EAAO,IAAA,CAAKtC,uBAAuBL,QAAAA;AACrC,OAAA;MACA4C,UAAAA,EAAY;AACVH,QAAAA,GAAAA,EAAK,KAAKd,gBAAAA,EAAgB;QAC1Be,YAAAA,EAAc,IAAA,CAAKpC,yBAAyB1B,QAAAA,EAAQ;QACpD+D,KAAAA,EAAO,IAAA,CAAKrC,yBAAyBN,QAAAA;AACvC;AACF,KAAA;AACF,EAAA;AAEA6C,EAAAA,oBAAAA,CAAqBlF,OAAAA,EAA+C;AAClE,IAAA,IAAA,CAAK6C,cAAAA,GAAiB;AAAE,MAAA,GAAG,IAAA,CAAKA,cAAAA;MAAgB,GAAG7C;AAAQ,KAAA;AAC7D,EAAA;AAEQqE,EAAAA,oBAAAA,CACNc,UACA5F,OAAAA,EACgB;AAChB,IAAA,OAAO;AACL6F,MAAAA,SAAAA,EAAWxF,MAAAA,EAAAA;AACXjD,MAAAA,OAAAA,EAAS4C,QAAQS,OAAAA,GAAU,YAAA,CAAA,IAAiB,IAAA,CAAK6C,eAAe,YAAA,CAAA;AAChEwC,MAAAA,WAAAA,EAAa9F,QAAQS,OAAAA,GAAU,gBAAA,CAAA,IAAqB,IAAA,CAAK6C,eAAe,gBAAA,CAAA;AACxEyC,MAAAA,SAAAA,EAAWjI,KAAKC,GAAAA,EAAG;AACnB6H,MAAAA;AACF,KAAA;AACF,EAAA;;;;AAKQI,EAAAA,gBAAAA,CAAiBC,KAAAA,EAAyB;AAChD,IAAA,IAAI,EAAEA,iBAAiBzG,YAAAA,CAAAA,EAAe;AACpC,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OAAOyG,MAAMvG,IAAAA,KAASH,gBAAAA,CAAiB2G,aAAAA,IAAiBD,KAAAA,CAAMvG,SAASH,gBAAAA,CAAiB4G,YAAAA;AAC1F,EAAA;;;;AAKQC,EAAAA,mBAAAA,CAAoBC,OAAAA,EAAyB;AACnD,IAAA,OAAO9H,IAAAA,CAAK+H,GAAAA,CACV,IAAA,CAAKjD,WAAAA,CAAYkD,eAAehI,IAAAA,CAAKiI,GAAAA,CAAI,IAAA,CAAKnD,WAAAA,CAAYoD,mBAAmBJ,OAAAA,GAAU,CAAA,CAAA,EACvF,IAAA,CAAKhD,YAAYqD,QAAQ,CAAA;AAE7B,EAAA;;;;AAKQC,EAAAA,eAAAA,CACN9B,OAAAA,EACAwB,OAAAA,EACAO,WAAAA,EACAC,KAAAA,EACAZ,KAAAA,EACM;AACN,IAAA,IAAI,IAAA,CAAKxE,OAAO+B,aAAAA,EAAe;AAC7B1B,MAAAA,MAAAA,CAAOW,KAAK,0CAAA,EAA4C;AACtDoD,QAAAA,SAAAA,EAAWhB,OAAAA,CAAQgB,SAAAA;AACnBQ,QAAAA,OAAAA;AACAO,QAAAA,WAAAA;AACAC,QAAAA,KAAAA;AACAZ,QAAAA,KAAAA,EAAOA,KAAAA,CAAMlG;OACf,CAAA;AACF,IAAA;AACF,EAAA;AAEA,EAAA,MAAcgF,gBAAAA,CACZpF,UAAAA,EACAK,OAAAA,EACAiE,cAAAA,EACAY,SACAiC,QAAAA,EAC6B;AAE7B,IAAA,IAAI,CAAC9G,OAAAA,CAAQ+G,kBAAAA,IAAsB,CAAC9C,cAAAA,CAAetB,cAAY,EAAI;AACjE,MAAA,MAAM,IAAInD,YAAAA,CAAa,CAAA,4BAAA,EAA+BG,UAAAA,CAAAA,CAAAA,EAAcJ,gBAAAA,CAAiB4G,cAAcxG,UAAAA,CAAAA;AACrG,IAAA;AAEA,IAAA,MAAMiH,WAAAA,GAAc5G,OAAAA,CAAQgH,SAAAA,GAAY,CAAA,GAAI,KAAK3D,WAAAA,CAAYuD,WAAAA;AAC7D,IAAA,IAAIK,SAAAA,GAA0B,IAAA;AAE9B,IAAA,KAAA,IAASZ,OAAAA,GAAU,CAAA,EAAGA,OAAAA,IAAWO,WAAAA,EAAaP,OAAAA,EAAAA,EAAW;AACvD,MAAA,IAAI;AACF,QAAA,MAAMa,MAAAA,GAAS,MAAM,IAAA,CAAKC,cAAAA,CAAkBxH,YAAYK,OAAAA,EAAS6E,OAAAA,EAASiC,SAAS9B,gBAAgB,CAAA;AACnG,QAAA,IAAI,CAAChF,QAAQ+G,kBAAAA,EAAoB;AAC/B9C,UAAAA,cAAAA,CAAerC,aAAAA,EAAa;AAC9B,QAAA;AACA,QAAA,OAAOsF,MAAAA;AACT,MAAA,CAAA,CAAA,OAASjB,KAAAA,EAAO;AACdgB,QAAAA,SAAAA,GAAYhB,iBAAiBxG,KAAAA,GAAQwG,KAAAA,GAAQ,IAAIxG,KAAAA,CAAM2H,MAAAA,CAAOnB,KAAAA,CAAAA,CAAAA;AAC9D,QAAA,IAAI,CAACjG,QAAQ+G,kBAAAA,EAAoB;AAC/B9C,UAAAA,cAAAA,CAAejC,aAAAA,EAAa;AAC9B,QAAA;AAEA,QAAA,IAAI,CAAC,IAAA,CAAKgE,gBAAAA,CAAiBC,KAAAA,CAAAA,EAAQ;AACjC,UAAA,MAAMA,KAAAA;AACR,QAAA;AAEA,QAAA,IAAII,UAAUO,WAAAA,EAAa;AACzB,UAAA,MAAMC,KAAAA,GAAQ,IAAA,CAAKT,mBAAAA,CAAoBC,OAAAA,CAAAA;AACvC,UAAA,IAAA,CAAKM,eAAAA,CAAgB9B,OAAAA,EAASwB,OAAAA,EAASO,WAAAA,EAAaC,OAAOI,SAAAA,CAAAA;AAC3D,UAAA,MAAM,IAAA,CAAKI,MAAMR,KAAAA,CAAAA;AACnB,QAAA;AACF,MAAA;AACF,IAAA;AAEA,IAAA,MAAMI,aAAa,IAAIzH,YAAAA,CAAa,8BAAA,EAAgCD,gBAAAA,CAAiB+H,eAAe3H,UAAAA,CAAAA;AACtG,EAAA;;;;EAKQ4H,mBAAAA,CACN1C,OAAAA,EACA7E,SACAgF,gBAAAA,EACwB;AACxB,IAAA,MAAMvE,OAAAA,GAAkC;MACtC,cAAA,EAAgB,kBAAA;AAChB,MAAA,cAAA,EAAgBoE,OAAAA,CAAQgB,SAAAA;AACxB,MAAA,aAAA,EAAehB,OAAAA,CAAQe;AACzB,KAAA;AAGA,IAAA,KAAA,MAAW,CAAClI,KAAK8J,KAAAA,CAAAA,IAAUtH,OAAOuH,OAAAA,CAAQ,IAAA,CAAKnE,cAAc,CAAA,EAAG;AAC9D,MAAA,IAAIkE,UAAUE,MAAAA,EAAW;AACvBjH,QAAAA,OAAAA,CAAQ/C,GAAAA,CAAAA,GAAO0J,MAAAA,CAAOI,KAAAA,CAAAA;AACxB,MAAA;AACF,IAAA;AAGA,IAAA,IAAIxH,QAAQS,OAAAA,EAAS;AACnB,MAAA,KAAA,MAAW,CAAC/C,KAAK8J,KAAAA,CAAAA,IAAUtH,OAAOuH,OAAAA,CAAQzH,OAAAA,CAAQS,OAAO,CAAA,EAAG;AAC1D,QAAA,IAAI+G,UAAUE,MAAAA,EAAW;AACvBjH,UAAAA,OAAAA,CAAQ/C,GAAAA,CAAAA,GAAO0J,MAAAA,CAAOI,KAAAA,CAAAA;AACxB,QAAA;AACF,MAAA;AACF,IAAA;AAGA,IAAA,IAAIxC,gBAAAA,EAAkB;AACpBvE,MAAAA,OAAAA,CAAQ,qBAAA,IAAyBG,4BAAAA,EAAAA;AACjCH,MAAAA,OAAAA,CAAQ,iBAAA,CAAA,GAAqB,IAAA,CAAKyC,YAAAA,CAAakB,kBAAAA,EAAkB;AACjE3D,MAAAA,OAAAA,CAAQ,oBAAA,CAAA,GAAwB3C,IAAAA,CAAKC,GAAAA,GAAM4J,QAAAA,EAAQ;AACrD,IAAA;AAEA,IAAA,OAAOlH,OAAAA;AACT,EAAA;;;;EAKQmH,mBAAAA,CACNV,MAAAA,EACArC,OAAAA,EACAlF,UAAAA,EACAkI,QAAAA,EACM;AACN,IAAA,IAAI,CAACX,MAAAA,CAAOY,MAAAA,IAAUZ,MAAAA,CAAOY,MAAAA,CAAOxF,WAAW,CAAA,EAAG;AAChD,MAAA;AACF,IAAA;AAEA,IAAA,MAAMyF,aAAAA,GAAgBb,MAAAA,CAAOY,MAAAA,CAAOE,GAAAA,CAAI,CAACC,MAAoBA,CAAAA,CAAElI,OAAO,CAAA,CAAEmI,IAAAA,CAAK,IAAA,CAAA;AAE7E,IAAA,IAAI,IAAA,CAAKzG,OAAO+B,aAAAA,EAAe;AAC7B1B,MAAAA,MAAAA,CAAOW,KAAK,gCAAA,EAAkC;AAC5CoD,QAAAA,SAAAA,EAAWhB,OAAAA,CAAQgB,SAAAA;AACnBiC,QAAAA,MAAAA,EAAQZ,MAAAA,CAAOY,MAAAA;AACfD,QAAAA;OACF,CAAA;AACF,IAAA;AAEA,IAAA,MAAM,IAAIrI,YAAAA,CAAa,CAAA,eAAA,EAAkBuI,aAAAA,CAAAA,CAAAA,EAAiBxI,gBAAAA,CAAiB2G,eAAevG,UAAAA,EAAY;AACpGE,MAAAA,aAAAA,EAAeqH,MAAAA,CAAOY;KACxB,CAAA;AACF,EAAA;;;;AAKQK,EAAAA,gBAAAA,CACNlC,KAAAA,EACApB,OAAAA,EACAlF,UAAAA,EACA4D,OAAAA,EACAsE,QAAAA,EACO;AACP,IAAA,IAAI5B,iBAAiBzG,YAAAA,EAAc;AACjC,MAAA,MAAMyG,KAAAA;AACR,IAAA;AAEA,IAAA,IAAIA,iBAAiBxG,KAAAA,EAAO;AAC1B,MAAA,IAAIwG,KAAAA,CAAMhG,SAAS,YAAA,EAAc;AAC/B,QAAA,MAAM,IAAIT,YAAAA,CAAa,CAAA,wBAAA,EAA2B+D,OAAAA,CAAAA,EAAAA,CAAAA,EAAahE,gBAAAA,CAAiB6I,eAAezI,UAAAA,EAAY;UACzGG,KAAAA,EAAOmG;SACT,CAAA;AACF,MAAA;AAEA,MAAA,IAAI,IAAA,CAAKxE,OAAO+B,aAAAA,EAAe;AAC7B1B,QAAAA,MAAAA,CAAOmE,MAAM,gCAAA,EAAkC;AAC7CJ,UAAAA,SAAAA,EAAWhB,OAAAA,CAAQgB,SAAAA;AACnBI,UAAAA,KAAAA,EAAOA,KAAAA,CAAMlG,OAAAA;AACb8H,UAAAA;SACF,CAAA;AACF,MAAA;AAEA,MAAA,MAAM,IAAIrI,YAAAA,CAAayG,KAAAA,CAAMlG,OAAAA,EAASR,gBAAAA,CAAiB8I,eAAe1I,UAAAA,EAAY;QAChFG,KAAAA,EAAOmG;OACT,CAAA;AACF,IAAA;AAEA,IAAA,MAAM,IAAIzG,YAAAA,CAAa4H,MAAAA,CAAOnB,KAAAA,CAAAA,EAAQ1G,gBAAAA,CAAiB+H,eAAe3H,UAAAA,CAAAA;AACxE,EAAA;AAEA,EAAA,MAAcwH,cAAAA,CACZxH,UAAAA,EACAK,OAAAA,EACA6E,OAAAA,EACAG,gBAAAA,EAC6B;AAC7B,IAAA,MAAMzB,OAAAA,GAAUvD,OAAAA,CAAQuD,OAAAA,IAAW,IAAA,CAAK9B,OAAO8B,OAAAA,IAAW,GAAA;AAC1D,IAAA,MAAM9C,OAAAA,GAAU,IAAA,CAAK8G,mBAAAA,CAAoB1C,OAAAA,EAAS7E,SAASgF,gBAAAA,CAAAA;AAQ3D,IAAA,IAAIH,QAAQe,QAAAA,KAAa,aAAA,IAAiB,CAACpF,sBAAAA,CAAuBC,OAAAA,CAAAA,EAAU;AAC1E,MAAA,MAAM6H,cAAAA,GAAiB,IAAA,CAAKpF,YAAAA,CAAakB,kBAAAA,EAAkB;AAC3D,MAAA,MAAMmE,UAAAA,GAAa,MAAMjL,cAAAA,CAAegL,cAAAA,CAAAA;AACxC,MAAA,IAAIC,UAAAA,EAAY;AACd9H,QAAAA,OAAAA,CAAQ,eAAA,CAAA,GAAmB,CAAA,OAAA,EAAU8H,UAAAA,CAAAA,CAAAA;MACvC,CAAA,MAAA,IAAW,IAAA,CAAK9G,OAAO+B,aAAAA,EAAe;AAKpC1B,QAAAA,MAAAA,CAAOuC,MACL,4GAAA,EACA;AAAEwB,UAAAA,SAAAA,EAAWhB,OAAAA,CAAQgB,SAAAA;AAAWlG,UAAAA;SAAW,CAAA;AAE/C,MAAA;AACF,IAAA;AAEA,IAAA,MAAM6I,IAAAA,GAAOC,KAAKC,SAAAA,CAAU;AAC1BxD,MAAAA,KAAAA,EAAOlF,OAAAA,CAAQkF,KAAAA;MACfyD,SAAAA,EAAW3I,OAAAA,CAAQ2I,aAAa,EAAC;AACjCC,MAAAA,aAAAA,EAAe5I,OAAAA,CAAQ4I;KACzB,CAAA;AAEA,IAAA,IAAI,IAAA,CAAKnH,OAAO+B,aAAAA,EAAe;AAC7B1B,MAAAA,MAAAA,CAAOuC,MAAM,mCAAA,EAAqC;AAChDwB,QAAAA,SAAAA,EAAWhB,OAAAA,CAAQgB,SAAAA;AACnBlG,QAAAA,UAAAA;AACAiJ,QAAAA,aAAAA,EAAe5I,OAAAA,CAAQ4I,aAAAA;AACvBhD,QAAAA,QAAAA,EAAUf,OAAAA,CAAQe,QAAAA;AAClBZ,QAAAA;OACF,CAAA;AACF,IAAA;AAEA,IAAA,IAAI;AACF,MAAA,MAAM6D,UAAAA,GAAa,IAAIC,eAAAA,EAAAA;AACvB,MAAA,MAAMC,YAAYC,UAAAA,CAAW,MAAMH,UAAAA,CAAWI,KAAAA,IAAS1F,OAAAA,CAAAA;AAEvD,MAAA,MAAM2F,QAAAA,GAAW,MAAMC,KAAAA,CAAMxJ,UAAAA,EAAY;QACvCyJ,MAAAA,EAAQ,MAAA;AACR3I,QAAAA,OAAAA;AACA+H,QAAAA,IAAAA;AACAa,QAAAA,MAAAA,EAAQR,UAAAA,CAAWQ;OACrB,CAAA;AAEAC,MAAAA,YAAAA,CAAaP,SAAAA,CAAAA;AACb,MAAA,MAAMlB,QAAAA,GAAW/J,IAAAA,CAAKC,GAAAA,EAAG,GAAK8G,OAAAA,CAAQkB,SAAAA;AAEtC,MAAA,IAAI,CAACmD,SAASK,EAAAA,EAAI;AAChB,QAAA,MAAM,IAAI/J,YAAAA,CACR,CAAA,KAAA,EAAQ0J,QAAAA,CAASM,MAAM,CAAA,EAAA,EAAKN,QAAAA,CAASO,UAAU,CAAA,CAAA,EAC/ClK,gBAAAA,CAAiB8I,aAAAA,EACjB1I,UAAAA,EACA;AAAEC,UAAAA,UAAAA,EAAYsJ,QAAAA,CAASM;SAAO,CAAA;AAElC,MAAA;AAEA,MAAA,MAAMtC,MAAAA,GAAU,MAAMgC,QAAAA,CAASQ,IAAAA,EAAI;AACnC,MAAA,IAAA,CAAK9B,mBAAAA,CAAoBV,MAAAA,EAAQrC,OAAAA,EAASlF,UAAAA,EAAYkI,QAAAA,CAAAA;AAEtD,MAAA,IAAI,IAAA,CAAKpG,OAAO+B,aAAAA,EAAe;AAC7B1B,QAAAA,MAAAA,CAAOuC,MAAM,mCAAA,EAAqC;AAChDwB,UAAAA,SAAAA,EAAWhB,OAAAA,CAAQgB,SAAAA;AACnBgC,UAAAA,QAAAA;UACA8B,OAAAA,EAAS,CAAC,CAACzC,MAAAA,CAAO0C;SACpB,CAAA;AACF,MAAA;AAEA,MAAA,OAAO1C,MAAAA;AACT,IAAA,CAAA,CAAA,OAASjB,KAAAA,EAAO;AACd,MAAA,MAAM4B,QAAAA,GAAW/J,IAAAA,CAAKC,GAAAA,EAAG,GAAK8G,OAAAA,CAAQkB,SAAAA;AACtC,MAAA,IAAA,CAAKoC,gBAAAA,CAAiBlC,KAAAA,EAAOpB,OAAAA,EAASlF,UAAAA,EAAY4D,SAASsE,QAAAA,CAAAA;AAC7D,IAAA;AACF,EAAA;AAEQR,EAAAA,KAAAA,CAAMwC,EAAAA,EAA2B;AACvC,IAAA,OAAO,IAAIC,OAAAA,CAAQ,CAACC,YAAYf,UAAAA,CAAWe,OAAAA,EAASF,EAAAA,CAAAA,CAAAA;AACtD,EAAA;AACF;AAKO,SAASG,oBAAoBvI,MAAAA,EAA2B;AAC7D,EAAA,OAAO,IAAIwB,cAAcxB,MAAAA,CAAAA;AAC3B;AAFgBuI,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAgBT,SAASC,0BAAAA,GAAAA;AACd,EAAA,MAAMvG,KAAAA,GAAQlG,OAAAA,CAAQC,GAAAA,CAAI,eAAA,CAAA;AAE1B,EAAA,IAAI,CAACiG,KAAAA,IAAUA,KAAAA,KAAU,QAAA,IAAYA,UAAU,QAAA,EAAW;AACxD,IAAA,MAAM,IAAIjE,KAAAA,CAAM,CAAA,sFAAA,EAAyFiE,KAAAA,CAAAA,CAAAA,CAAQ,CAAA;AACnH,EAAA;AAEA,EAAA,MAAMC,WAAAA,GAAcnG,OAAAA,CAAQC,GAAAA,CAAI,cAAA,CAAA;AAChC,EAAA,IAAI,CAACkG,WAAAA,EAAa;AAChB,IAAA,MAAM,IAAIlE,MAAM,+DAAA,CAAA;AAClB,EAAA;AAEA,EAAA,MAAMmE,eAAAA,GAAkBpG,OAAAA,CAAQC,GAAAA,CAAI,kBAAA,CAAA,IAAuBkG,WAAAA;AAE3D,EAAA,OAAO,IAAIV,aAAAA,CAAc;AACvBS,IAAAA,KAAAA;AACAC,IAAAA,WAAAA;AACAC,IAAAA;GACF,CAAA;AACF;AAnBgBqG,MAAAA,CAAAA,0BAAAA,EAAAA,4BAAAA,CAAAA","file":"chunk-U455UF4O.js","sourcesContent":["/**\n * Gateway Module\n *\n * Provides unified gateway client for layer-aware M2M communication\n * with circuit breaker and retry logic.\n *\n * @module gateway\n * @category Gateway\n *\n * @example\n * ```typescript\n * import { GatewayClient, createGatewayClientFromEnv } from '@burdenoff/be-sdk/gateway';\n *\n * // Create from environment variables\n * const client = createGatewayClientFromEnv();\n *\n * // Or create manually\n * const client = new GatewayClient({\n *   layer: 'wspace',\n *   serviceName: 'wspace-tags-svc',\n * });\n *\n * // Internal call (same layer, uses int-gateway with bypass)\n * const internalResult = await client.internalQuery({\n *   query: `query { getTag(id: \"123\") { id name } }`,\n * });\n *\n * // Cross-layer call (via public gateway)\n * const crossLayerResult = await client.crossLayerQuery({\n *   query: `query { getCurrentUser { id email } }`,\n * });\n * ```\n */\n\n// Client exports\nexport { GatewayClient, createGatewayClient, createGatewayClientFromEnv } from './client.js';\n\n// Type exports\nexport {\n  CircuitState,\n  GatewayErrorType,\n  GatewayError,\n  type GatewayClientConfig,\n  type GraphQLRequestOptions,\n  type GraphQLResponse,\n  type GraphQLError,\n  type IGatewayClient,\n  type ICircuitBreaker,\n  type CircuitBreakerStats,\n  type GatewayClientHealth,\n  type RequestContext,\n} from './types.js';\n\n// Gateway-side security plugin stack (for public gateways).\n// Imported by consumers as `@burdenoff/be-sdk/gateway/security` — this\n// re-export lets `@burdenoff/be-sdk/gateway` also resolve the namespace.\nexport * as Security from './security/index.js';\n","/**\n * Service JWT minting + caching for M2M cross-layer calls.\n *\n * The public gateways (global-public-gateway, wspace-public-gateway) validate\n * every incoming request's Authorization header and only propagate `x-actor-*`\n * context headers to subgraphs when the JWT is valid. Without a JWT, raw\n * actor headers are stripped as potential client spoofing. For service-to-\n * service cross-layer calls there is no user JWT to forward — we mint a short-\n * lived service JWT with `actor_type: 'service'` so the gateway admits the\n * call and the subgraph sees a trusted service context.\n *\n * Signing key: SERVICE_JWT_SECRET — a dedicated, separate secret from\n * GLOBAL_AUTH_SECRET (which signs user tokens). Keeping them distinct means a\n * service minter that leaks its env cannot forge user logins. The gateways\n * hold both secrets and pick between them by the JWT's `kid` header\n * (this minter stamps `kid: service-v1`).\n */\nimport type * as jose from 'jose';\n\n/**\n * Dedicated secret for service-minted JWTs.\n *\n * Deliberately separate from `GLOBAL_AUTH_SECRET` (which signs user tokens)\n * so that services that mint service JWTs do not also hold the ability to\n * forge user logins. Blast radius of a leaked secret stays scoped to 60s\n * service tokens with no PII.\n *\n * Gateways hold both secrets and select by the JWT's `kid` header.\n */\nconst SIGNING_ENV_VAR = 'SERVICE_JWT_SECRET';\nconst KEY_ID = 'service-v1';\nconst DEFAULT_TTL_SECONDS = 60;\nconst REFRESH_BEFORE_EXP_MS = 10_000;\n\nlet joseModule: typeof jose | null = null;\n\nasync function getJose(): Promise<typeof jose> {\n  if (!joseModule) {\n    joseModule = await import('jose');\n  }\n  return joseModule;\n}\n\ninterface CachedToken {\n  token: string;\n  expiresAtMs: number;\n}\n\nconst cache = new Map<string, CachedToken>();\n\nfunction cacheKey(actorId: string, ttlSeconds: number): string {\n  return `${actorId}:${ttlSeconds}`;\n}\n\n/**\n * Sign a service-actor JWT.\n * Returns null when no signing secret is configured (opt-in).\n */\nexport async function signServiceJwt(\n  actorId: string,\n  ttlSeconds: number = DEFAULT_TTL_SECONDS\n): Promise<string | null> {\n  const secret = process.env[SIGNING_ENV_VAR];\n  if (!secret) {\n    return null;\n  }\n\n  const key = cacheKey(actorId, ttlSeconds);\n  const cached = cache.get(key);\n  if (cached && cached.expiresAtMs - REFRESH_BEFORE_EXP_MS > Date.now()) {\n    return cached.token;\n  }\n\n  const joseLib = await getJose();\n  const encoder = new TextEncoder();\n  const keyBytes = encoder.encode(secret);\n\n  const nowSec = Math.floor(Date.now() / 1000);\n  const expSec = nowSec + ttlSeconds;\n\n  const token = await new joseLib.SignJWT({\n    actor_type: 'service',\n  })\n    .setProtectedHeader({ alg: 'HS256', typ: 'JWT', kid: KEY_ID })\n    .setSubject(actorId)\n    // `iss` = the service identity that minted the token. Matches `sub`\n    // because these are self-minted tokens (caller is asserting itself).\n    // Gives the gateway room to enforce a minter allowlist later without\n    // a token-format change.\n    .setIssuer(actorId)\n    .setIssuedAt(nowSec)\n    .setExpirationTime(expSec)\n    .sign(keyBytes);\n\n  cache.set(key, { token, expiresAtMs: expSec * 1000 });\n  return token;\n}\n\n/** Test hook to clear the cache between tests. */\nexport function __clearServiceJwtCache(): void {\n  cache.clear();\n}\n","/**\n * Gateway Client Types\n *\n * Type definitions for the unified gateway client with\n * circuit breaker and retry logic.\n *\n * @module gateway/types\n * @category Gateway\n */\n\nimport type { ServiceLayer, CircuitBreakerConfig, GatewayRetryConfig, GatewayRequestHeaders } from '../types/layer.js';\n\n/**\n * Gateway client configuration\n */\nexport interface GatewayClientConfig {\n  /**\n   * Layer this client belongs to\n   */\n  layer: ServiceLayer;\n\n  /**\n   * Service name (for logging and headers)\n   */\n  serviceName: string;\n\n  /**\n   * Service identity for bypass headers\n   * @default serviceName\n   */\n  serviceIdentity?: string;\n\n  /**\n   * Internal gateway URL (same layer M2M)\n   * @default Resolved from layer defaults or environment\n   */\n  internalGatewayUrl?: string;\n\n  /**\n   * Cross-layer gateway URL (cross layer via public gateway)\n   * @default Resolved from layer defaults or environment\n   */\n  crossLayerGatewayUrl?: string;\n\n  /**\n   * Request timeout in milliseconds\n   * @default 30000 (30 seconds)\n   */\n  timeout?: number;\n\n  /**\n   * Circuit breaker configuration\n   */\n  circuitBreaker?: Partial<CircuitBreakerConfig>;\n\n  /**\n   * Retry configuration\n   */\n  retry?: Partial<GatewayRetryConfig>;\n\n  /**\n   * Enable request logging\n   * @default true\n   */\n  enableLogging?: boolean;\n\n  /**\n   * Default headers to include in all requests\n   */\n  defaultHeaders?: GatewayRequestHeaders;\n}\n\n/**\n * Circuit breaker states\n */\nexport enum CircuitState {\n  CLOSED = 'CLOSED',\n  OPEN = 'OPEN',\n  HALF_OPEN = 'HALF_OPEN',\n}\n\n/**\n * Circuit breaker instance interface\n */\nexport interface ICircuitBreaker {\n  /**\n   * Get current circuit state\n   */\n  getState(): CircuitState;\n\n  /**\n   * Record a successful call\n   */\n  recordSuccess(): void;\n\n  /**\n   * Record a failed call\n   */\n  recordFailure(): void;\n\n  /**\n   * Check if circuit allows calls\n   */\n  allowRequest(): boolean;\n\n  /**\n   * Force open the circuit\n   */\n  forceOpen(): void;\n\n  /**\n   * Force close the circuit\n   */\n  forceClose(): void;\n\n  /**\n   * Get circuit statistics\n   */\n  getStats(): CircuitBreakerStats;\n}\n\n/**\n * Circuit breaker statistics\n */\nexport interface CircuitBreakerStats {\n  state: CircuitState;\n  failures: number;\n  successes: number;\n  consecutiveFailures: number;\n  lastFailureTime: number | null;\n  lastSuccessTime: number | null;\n  openedAt: number | null;\n}\n\n/**\n * GraphQL request options\n */\nexport interface GraphQLRequestOptions {\n  /**\n   * GraphQL query or mutation string\n   */\n  query: string;\n\n  /**\n   * GraphQL variables\n   */\n  variables?: Record<string, unknown>;\n\n  /**\n   * Operation name (for multi-operation documents)\n   */\n  operationName?: string;\n\n  /**\n   * Additional headers for this request\n   */\n  headers?: GatewayRequestHeaders;\n\n  /**\n   * Override timeout for this request\n   */\n  timeout?: number;\n\n  /**\n   * Skip circuit breaker for this request\n   * @default false\n   */\n  skipCircuitBreaker?: boolean;\n\n  /**\n   * Skip retry logic for this request\n   * @default false\n   */\n  skipRetry?: boolean;\n}\n\n/**\n * GraphQL response\n */\nexport interface GraphQLResponse<T = unknown> {\n  /**\n   * Response data\n   */\n  data?: T;\n\n  /**\n   * GraphQL errors\n   */\n  errors?: GraphQLError[];\n}\n\n/**\n * GraphQL error structure\n */\nexport interface GraphQLError {\n  message: string;\n  locations?: Array<{ line: number; column: number }>;\n  path?: Array<string | number>;\n  extensions?: Record<string, unknown>;\n}\n\n/**\n * Gateway client interface\n */\nexport interface IGatewayClient {\n  /**\n   * Execute internal (same layer) GraphQL query/mutation\n   *\n   * Uses internal gateway with bypass headers for M2M communication.\n   *\n   * @param options - Request options\n   * @returns GraphQL response\n   */\n  internalQuery<T = unknown>(options: GraphQLRequestOptions): Promise<GraphQLResponse<T>>;\n\n  /**\n   * Execute cross-layer GraphQL query/mutation\n   *\n   * Uses public gateway for cross-layer communication.\n   *\n   * @param options - Request options\n   * @returns GraphQL response\n   */\n  crossLayerQuery<T = unknown>(options: GraphQLRequestOptions): Promise<GraphQLResponse<T>>;\n\n  /**\n   * Execute GraphQL query/mutation with explicit gateway URL\n   *\n   * @param gatewayUrl - Gateway URL to use\n   * @param options - Request options\n   * @returns GraphQL response\n   */\n  query<T = unknown>(gatewayUrl: string, options: GraphQLRequestOptions): Promise<GraphQLResponse<T>>;\n\n  /**\n   * Get internal gateway circuit breaker\n   */\n  getInternalCircuitBreaker(): ICircuitBreaker;\n\n  /**\n   * Get cross-layer gateway circuit breaker\n   */\n  getCrossLayerCircuitBreaker(): ICircuitBreaker;\n\n  /**\n   * Get client health status\n   */\n  getHealthStatus(): GatewayClientHealth;\n\n  /**\n   * Update default headers\n   */\n  updateDefaultHeaders(headers: Partial<GatewayRequestHeaders>): void;\n}\n\n/**\n * Gateway client health status\n */\nexport interface GatewayClientHealth {\n  /**\n   * Internal gateway status\n   */\n  internal: {\n    url: string;\n    circuitState: CircuitState;\n    stats: CircuitBreakerStats;\n  };\n\n  /**\n   * Cross-layer gateway status\n   */\n  crossLayer: {\n    url: string;\n    circuitState: CircuitState;\n    stats: CircuitBreakerStats;\n  };\n}\n\n/**\n * Gateway error types\n */\nexport enum GatewayErrorType {\n  NETWORK_ERROR = 'NETWORK_ERROR',\n  TIMEOUT_ERROR = 'TIMEOUT_ERROR',\n  CIRCUIT_OPEN = 'CIRCUIT_OPEN',\n  GRAPHQL_ERROR = 'GRAPHQL_ERROR',\n  UNKNOWN_ERROR = 'UNKNOWN_ERROR',\n}\n\n/**\n * Gateway error class\n */\nexport class GatewayError extends Error {\n  type: GatewayErrorType;\n  gatewayUrl: string;\n  statusCode?: number;\n  graphqlErrors?: GraphQLError[];\n  override cause?: Error;\n\n  constructor(\n    message: string,\n    type: GatewayErrorType,\n    gatewayUrl: string,\n    options?: {\n      statusCode?: number;\n      graphqlErrors?: GraphQLError[];\n      cause?: Error;\n    }\n  ) {\n    super(message);\n    this.name = 'GatewayError';\n    this.type = type;\n    this.gatewayUrl = gatewayUrl;\n    this.statusCode = options?.statusCode;\n    this.graphqlErrors = options?.graphqlErrors;\n    this.cause = options?.cause;\n    Object.setPrototypeOf(this, GatewayError.prototype);\n  }\n}\n\n/**\n * Request context for logging and tracing\n */\nexport interface RequestContext {\n  /**\n   * Request ID for tracing\n   */\n  requestId: string;\n\n  /**\n   * Actor ID making the request\n   */\n  actorId?: string;\n\n  /**\n   * Workspace ID context\n   */\n  workspaceId?: string;\n\n  /**\n   * Timestamp when request started\n   */\n  startTime: number;\n\n  /**\n   * Call type\n   */\n  callType: 'internal' | 'cross-layer' | 'direct';\n}\n","/**\n * Unified Gateway Client\n *\n * Provides a layer-aware GraphQL client with circuit breaker,\n * retry logic, and automatic header management for M2M communication.\n *\n * @module gateway/client\n * @category Gateway\n *\n * @example\n * ```typescript\n * import { GatewayClient } from '@burdenoff/be-sdk/gateway';\n *\n * const client = new GatewayClient({\n *   layer: 'wspace',\n *   serviceName: 'wspace-tags-svc',\n * });\n *\n * // Internal call (same layer)\n * const result = await client.internalQuery({\n *   query: `query { getTag(id: \"123\") { id name } }`,\n * });\n *\n * // Cross-layer call\n * const authResult = await client.crossLayerQuery({\n *   query: `query { getCurrentUser { id email } }`,\n * });\n * ```\n */\n\nimport { LayerManager } from '../layer/index.js';\nimport { logger } from '../logger/index.js';\nimport { signServiceJwt } from './service-jwt.js';\nimport {\n  DEFAULT_CIRCUIT_BREAKER_CONFIG,\n  DEFAULT_GATEWAY_RETRY_CONFIG,\n  type CircuitBreakerConfig,\n  type GatewayRequestHeaders,\n  type GatewayRetryConfig,\n  type ServiceLayer,\n} from '../types/layer.js';\nimport {\n  CircuitState,\n  GatewayError,\n  GatewayErrorType,\n  type CircuitBreakerStats,\n  type GatewayClientConfig,\n  type GatewayClientHealth,\n  type GraphQLError,\n  type GraphQLRequestOptions,\n  type GraphQLResponse,\n  type ICircuitBreaker,\n  type IGatewayClient,\n  type RequestContext,\n} from './types.js';\n\nconst uuidv4 = (): string => crypto.randomUUID();\n\n/**\n * Case-insensitive presence check for the `Authorization` header. HTTP header\n * names are case-insensitive (RFC 7230), and while the outbound `fetch` will\n * preserve whatever casing the caller supplies, callers may legitimately set\n * `authorization` / `Authorization` / even `AUTHORIZATION` via defaultHeaders\n * or options.headers. We must not overwrite an already-supplied token.\n */\nfunction hasAuthorizationHeader(headers: Record<string, string>): boolean {\n  for (const key of Object.keys(headers)) {\n    if (key.toLowerCase() === 'authorization') return true;\n  }\n  return false;\n}\n\nexport function resolveBypassPermissionValue(\n  token: string | undefined = process.env['INTERNAL_SERVICE_TOKEN']\n): string {\n  const normalizedToken = token?.trim();\n\n  if (!normalizedToken) {\n    throw new Error('INTERNAL_SERVICE_TOKEN must be configured for bypass-enabled gateway calls');\n  }\n\n  return normalizedToken;\n}\n\n/**\n * Circuit Breaker Implementation\n */\nclass CircuitBreaker implements ICircuitBreaker {\n  private state: CircuitState = CircuitState.CLOSED;\n  private failures = 0;\n  private successes = 0;\n  private consecutiveFailures = 0;\n  private lastFailureTime: number | null = null;\n  private lastSuccessTime: number | null = null;\n  private openedAt: number | null = null;\n  private failureTimestamps: number[] = [];\n  private config: CircuitBreakerConfig;\n\n  constructor(config: CircuitBreakerConfig) {\n    this.config = config;\n  }\n\n  getState(): CircuitState {\n    this.checkStateTransition();\n    return this.state;\n  }\n\n  recordSuccess(): void {\n    this.successes++;\n    this.consecutiveFailures = 0;\n    this.lastSuccessTime = Date.now();\n\n    if (this.state === CircuitState.HALF_OPEN) {\n      this.state = CircuitState.CLOSED;\n      this.failures = 0;\n      this.failureTimestamps = [];\n      this.openedAt = null;\n      logger.info('[CircuitBreaker] Circuit closed after successful test');\n    }\n  }\n\n  recordFailure(): void {\n    this.failures++;\n    this.consecutiveFailures++;\n    this.lastFailureTime = Date.now();\n    this.failureTimestamps.push(Date.now());\n\n    // Clean up old timestamps\n    const windowStart = Date.now() - this.config.failureWindow;\n    this.failureTimestamps = this.failureTimestamps.filter((t) => t > windowStart);\n\n    // Check if we should open the circuit\n    if (this.state === CircuitState.CLOSED && this.failureTimestamps.length >= this.config.failureThreshold) {\n      this.state = CircuitState.OPEN;\n      this.openedAt = Date.now();\n      logger.warn('[CircuitBreaker] Circuit opened due to failures', {\n        failures: this.failureTimestamps.length,\n        threshold: this.config.failureThreshold,\n      });\n    }\n\n    // If we're half-open and fail, go back to open\n    if (this.state === CircuitState.HALF_OPEN) {\n      this.state = CircuitState.OPEN;\n      this.openedAt = Date.now();\n      logger.warn('[CircuitBreaker] Circuit re-opened after failed test');\n    }\n  }\n\n  allowRequest(): boolean {\n    this.checkStateTransition();\n\n    switch (this.state) {\n      case CircuitState.CLOSED:\n        return true;\n      case CircuitState.OPEN:\n        return false;\n      case CircuitState.HALF_OPEN:\n        // Allow one test request\n        return true;\n      default:\n        return true;\n    }\n  }\n\n  forceOpen(): void {\n    this.state = CircuitState.OPEN;\n    this.openedAt = Date.now();\n    logger.info('[CircuitBreaker] Circuit force-opened');\n  }\n\n  forceClose(): void {\n    this.state = CircuitState.CLOSED;\n    this.failures = 0;\n    this.consecutiveFailures = 0;\n    this.failureTimestamps = [];\n    this.openedAt = null;\n    logger.info('[CircuitBreaker] Circuit force-closed');\n  }\n\n  getStats(): CircuitBreakerStats {\n    return {\n      state: this.state,\n      failures: this.failures,\n      successes: this.successes,\n      consecutiveFailures: this.consecutiveFailures,\n      lastFailureTime: this.lastFailureTime,\n      lastSuccessTime: this.lastSuccessTime,\n      openedAt: this.openedAt,\n    };\n  }\n\n  private checkStateTransition(): void {\n    if (this.state === CircuitState.OPEN && this.openedAt) {\n      const elapsed = Date.now() - this.openedAt;\n      if (elapsed >= this.config.resetTimeout) {\n        this.state = CircuitState.HALF_OPEN;\n        logger.info('[CircuitBreaker] Circuit transitioning to half-open');\n      }\n    }\n  }\n}\n\n/**\n * Unified Gateway Client\n */\nexport class GatewayClient implements IGatewayClient {\n  private config: GatewayClientConfig;\n  private layerManager: LayerManager;\n  private internalCircuitBreaker: CircuitBreaker;\n  private crossLayerCircuitBreaker: CircuitBreaker;\n  private retryConfig: GatewayRetryConfig;\n  private defaultHeaders: GatewayRequestHeaders;\n\n  constructor(config: GatewayClientConfig) {\n    this.config = {\n      timeout: 30000,\n      enableLogging: true,\n      ...config,\n    };\n\n    // Initialize layer manager\n    this.layerManager = new LayerManager({\n      layer: config.layer,\n      serviceName: config.serviceName,\n      serviceIdentity: config.serviceIdentity,\n    });\n\n    // Override URLs if provided\n    if (config.internalGatewayUrl) {\n      // Use getter internally, but we'll store the override\n    }\n    if (config.crossLayerGatewayUrl) {\n      // Use getter internally, but we'll store the override\n    }\n\n    // Initialize circuit breakers\n    const cbConfig: CircuitBreakerConfig = {\n      ...DEFAULT_CIRCUIT_BREAKER_CONFIG,\n      ...config.circuitBreaker,\n    };\n    this.internalCircuitBreaker = new CircuitBreaker(cbConfig);\n    this.crossLayerCircuitBreaker = new CircuitBreaker(cbConfig);\n\n    // Initialize retry config\n    this.retryConfig = {\n      ...DEFAULT_GATEWAY_RETRY_CONFIG,\n      ...config.retry,\n    };\n\n    // Initialize default headers\n    this.defaultHeaders = {\n      'x-service-identity': this.layerManager.getServiceIdentity(),\n      'x-actor-type': 'service',\n      ...config.defaultHeaders,\n    };\n\n    logger.debug('[GatewayClient] Initialized', {\n      layer: config.layer,\n      serviceName: config.serviceName,\n      internalUrl: this.getInternalUrl(),\n      crossLayerUrl: this.getCrossLayerUrl(),\n    });\n  }\n\n  private getInternalUrl(): string {\n    return this.config.internalGatewayUrl || this.layerManager.getInternalGatewayUrl();\n  }\n\n  private getCrossLayerUrl(): string {\n    return this.config.crossLayerGatewayUrl || this.layerManager.getCrossLayerGatewayUrl();\n  }\n\n  /**\n   * Execute internal (same layer) GraphQL query/mutation\n   */\n  async internalQuery<T = unknown>(options: GraphQLRequestOptions): Promise<GraphQLResponse<T>> {\n    const context = this.createRequestContext('internal', options);\n\n    return this.executeWithRetry(this.getInternalUrl(), options, this.internalCircuitBreaker, context, {\n      bypassPermission: true,\n    });\n  }\n\n  /**\n   * Execute cross-layer GraphQL query/mutation\n   */\n  async crossLayerQuery<T = unknown>(options: GraphQLRequestOptions): Promise<GraphQLResponse<T>> {\n    const context = this.createRequestContext('cross-layer', options);\n\n    return this.executeWithRetry(\n      this.getCrossLayerUrl(),\n      options,\n      this.crossLayerCircuitBreaker,\n      context,\n      { bypassPermission: false } // Cross-layer calls go through public gateway\n    );\n  }\n\n  /**\n   * Execute GraphQL query/mutation with explicit gateway URL\n   */\n  async query<T = unknown>(gatewayUrl: string, options: GraphQLRequestOptions): Promise<GraphQLResponse<T>> {\n    const context = this.createRequestContext('direct', options);\n\n    // Use internal circuit breaker for direct calls\n    return this.executeWithRetry(gatewayUrl, options, this.internalCircuitBreaker, context, {\n      bypassPermission: false,\n    });\n  }\n\n  getInternalCircuitBreaker(): ICircuitBreaker {\n    return this.internalCircuitBreaker;\n  }\n\n  getCrossLayerCircuitBreaker(): ICircuitBreaker {\n    return this.crossLayerCircuitBreaker;\n  }\n\n  getHealthStatus(): GatewayClientHealth {\n    return {\n      internal: {\n        url: this.getInternalUrl(),\n        circuitState: this.internalCircuitBreaker.getState(),\n        stats: this.internalCircuitBreaker.getStats(),\n      },\n      crossLayer: {\n        url: this.getCrossLayerUrl(),\n        circuitState: this.crossLayerCircuitBreaker.getState(),\n        stats: this.crossLayerCircuitBreaker.getStats(),\n      },\n    };\n  }\n\n  updateDefaultHeaders(headers: Partial<GatewayRequestHeaders>): void {\n    this.defaultHeaders = { ...this.defaultHeaders, ...headers };\n  }\n\n  private createRequestContext(\n    callType: 'internal' | 'cross-layer' | 'direct',\n    options: GraphQLRequestOptions\n  ): RequestContext {\n    return {\n      requestId: uuidv4(),\n      actorId: options.headers?.['x-actor-id'] || this.defaultHeaders['x-actor-id'],\n      workspaceId: options.headers?.['x-workspace-id'] || this.defaultHeaders['x-workspace-id'],\n      startTime: Date.now(),\n      callType,\n    };\n  }\n\n  /**\n   * Check if an error should be retried\n   */\n  private shouldRetryError(error: unknown): boolean {\n    if (!(error instanceof GatewayError)) {\n      return true;\n    }\n    // Don't retry GraphQL errors or circuit open errors\n    return error.type !== GatewayErrorType.GRAPHQL_ERROR && error.type !== GatewayErrorType.CIRCUIT_OPEN;\n  }\n\n  /**\n   * Calculate retry delay with exponential backoff\n   */\n  private calculateRetryDelay(attempt: number): number {\n    return Math.min(\n      this.retryConfig.initialDelay * Math.pow(this.retryConfig.backoffMultiplier, attempt - 1),\n      this.retryConfig.maxDelay\n    );\n  }\n\n  /**\n   * Log retry attempt if logging is enabled\n   */\n  private logRetryAttempt(\n    context: RequestContext,\n    attempt: number,\n    maxAttempts: number,\n    delay: number,\n    error: Error\n  ): void {\n    if (this.config.enableLogging) {\n      logger.warn('[GatewayClient] Request failed, retrying', {\n        requestId: context.requestId,\n        attempt,\n        maxAttempts,\n        delay,\n        error: error.message,\n      });\n    }\n  }\n\n  private async executeWithRetry<T>(\n    gatewayUrl: string,\n    options: GraphQLRequestOptions,\n    circuitBreaker: CircuitBreaker,\n    context: RequestContext,\n    settings: { bypassPermission: boolean }\n  ): Promise<GraphQLResponse<T>> {\n    // Check circuit breaker\n    if (!options.skipCircuitBreaker && !circuitBreaker.allowRequest()) {\n      throw new GatewayError(`Circuit breaker is open for ${gatewayUrl}`, GatewayErrorType.CIRCUIT_OPEN, gatewayUrl);\n    }\n\n    const maxAttempts = options.skipRetry ? 1 : this.retryConfig.maxAttempts;\n    let lastError: Error | null = null;\n\n    for (let attempt = 1; attempt <= maxAttempts; attempt++) {\n      try {\n        const result = await this.executeRequest<T>(gatewayUrl, options, context, settings.bypassPermission);\n        if (!options.skipCircuitBreaker) {\n          circuitBreaker.recordSuccess();\n        }\n        return result;\n      } catch (error) {\n        lastError = error instanceof Error ? error : new Error(String(error));\n        if (!options.skipCircuitBreaker) {\n          circuitBreaker.recordFailure();\n        }\n\n        if (!this.shouldRetryError(error)) {\n          throw error;\n        }\n\n        if (attempt < maxAttempts) {\n          const delay = this.calculateRetryDelay(attempt);\n          this.logRetryAttempt(context, attempt, maxAttempts, delay, lastError);\n          await this.sleep(delay);\n        }\n      }\n    }\n\n    throw lastError || new GatewayError('Request failed after retries', GatewayErrorType.UNKNOWN_ERROR, gatewayUrl);\n  }\n\n  /**\n   * Build headers for a request\n   */\n  private buildRequestHeaders(\n    context: RequestContext,\n    options: GraphQLRequestOptions,\n    bypassPermission: boolean\n  ): Record<string, string> {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      'x-request-id': context.requestId,\n      'x-call-type': context.callType,\n    };\n\n    // Add default headers\n    for (const [key, value] of Object.entries(this.defaultHeaders)) {\n      if (value !== undefined) {\n        headers[key] = String(value);\n      }\n    }\n\n    // Add request-specific headers\n    if (options.headers) {\n      for (const [key, value] of Object.entries(options.headers)) {\n        if (value !== undefined) {\n          headers[key] = String(value);\n        }\n      }\n    }\n\n    // Add bypass headers for internal calls\n    if (bypassPermission) {\n      headers['x-bypass-permission'] = resolveBypassPermissionValue();\n      headers['x-bypass-source'] = this.layerManager.getServiceIdentity();\n      headers['x-bypass-timestamp'] = Date.now().toString();\n    }\n\n    return headers;\n  }\n\n  /**\n   * Handle GraphQL errors in response\n   */\n  private handleGraphQLErrors<T>(\n    result: GraphQLResponse<T>,\n    context: RequestContext,\n    gatewayUrl: string,\n    duration: number\n  ): void {\n    if (!result.errors || result.errors.length === 0) {\n      return;\n    }\n\n    const errorMessages = result.errors.map((e: GraphQLError) => e.message).join(', ');\n\n    if (this.config.enableLogging) {\n      logger.warn('[GatewayClient] GraphQL errors', {\n        requestId: context.requestId,\n        errors: result.errors,\n        duration,\n      });\n    }\n\n    throw new GatewayError(`GraphQL error: ${errorMessages}`, GatewayErrorType.GRAPHQL_ERROR, gatewayUrl, {\n      graphqlErrors: result.errors,\n    });\n  }\n\n  /**\n   * Handle fetch errors\n   */\n  private handleFetchError(\n    error: unknown,\n    context: RequestContext,\n    gatewayUrl: string,\n    timeout: number,\n    duration: number\n  ): never {\n    if (error instanceof GatewayError) {\n      throw error;\n    }\n\n    if (error instanceof Error) {\n      if (error.name === 'AbortError') {\n        throw new GatewayError(`Request timed out after ${timeout}ms`, GatewayErrorType.TIMEOUT_ERROR, gatewayUrl, {\n          cause: error,\n        });\n      }\n\n      if (this.config.enableLogging) {\n        logger.error('[GatewayClient] Request failed', {\n          requestId: context.requestId,\n          error: error.message,\n          duration,\n        });\n      }\n\n      throw new GatewayError(error.message, GatewayErrorType.NETWORK_ERROR, gatewayUrl, {\n        cause: error,\n      });\n    }\n\n    throw new GatewayError(String(error), GatewayErrorType.UNKNOWN_ERROR, gatewayUrl);\n  }\n\n  private async executeRequest<T>(\n    gatewayUrl: string,\n    options: GraphQLRequestOptions,\n    context: RequestContext,\n    bypassPermission: boolean\n  ): Promise<GraphQLResponse<T>> {\n    const timeout = options.timeout || this.config.timeout || 30000;\n    const headers = this.buildRequestHeaders(context, options, bypassPermission);\n\n    // Cross-layer calls transit the peer layer's PUBLIC gateway, which\n    // requires JWT auth to propagate actor context. Mint a short-lived\n    // service-actor JWT so the gateway admits the call and preserves\n    // `x-actor-type: service` downstream. Skipped when the caller has\n    // already supplied an Authorization header (e.g., user-originated\n    // cross-layer flows) or when SERVICE_JWT_SECRET is unset.\n    if (context.callType === 'cross-layer' && !hasAuthorizationHeader(headers)) {\n      const serviceActorId = this.layerManager.getServiceIdentity();\n      const serviceJwt = await signServiceJwt(serviceActorId);\n      if (serviceJwt) {\n        headers['Authorization'] = `Bearer ${serviceJwt}`;\n      } else if (this.config.enableLogging) {\n        // Subtle failure mode: without the JWT the public gateway strips\n        // actor headers and the subgraph rejects with `authenticationRequired`.\n        // Surface the root cause so operators rolling out a new caller don't\n        // spend time debugging the downstream error.\n        logger.debug(\n          '[GatewayClient] SERVICE_JWT_SECRET not configured — cross-layer call will proceed without service JWT',\n          { requestId: context.requestId, gatewayUrl }\n        );\n      }\n    }\n\n    const body = JSON.stringify({\n      query: options.query,\n      variables: options.variables || {},\n      operationName: options.operationName,\n    });\n\n    if (this.config.enableLogging) {\n      logger.debug('[GatewayClient] Executing request', {\n        requestId: context.requestId,\n        gatewayUrl,\n        operationName: options.operationName,\n        callType: context.callType,\n        bypassPermission,\n      });\n    }\n\n    try {\n      const controller = new AbortController();\n      const timeoutId = setTimeout(() => controller.abort(), timeout);\n\n      const response = await fetch(gatewayUrl, {\n        method: 'POST',\n        headers,\n        body,\n        signal: controller.signal,\n      });\n\n      clearTimeout(timeoutId);\n      const duration = Date.now() - context.startTime;\n\n      if (!response.ok) {\n        throw new GatewayError(\n          `HTTP ${response.status}: ${response.statusText}`,\n          GatewayErrorType.NETWORK_ERROR,\n          gatewayUrl,\n          { statusCode: response.status }\n        );\n      }\n\n      const result = (await response.json()) as GraphQLResponse<T>;\n      this.handleGraphQLErrors(result, context, gatewayUrl, duration);\n\n      if (this.config.enableLogging) {\n        logger.debug('[GatewayClient] Request completed', {\n          requestId: context.requestId,\n          duration,\n          hasData: !!result.data,\n        });\n      }\n\n      return result;\n    } catch (error) {\n      const duration = Date.now() - context.startTime;\n      this.handleFetchError(error, context, gatewayUrl, timeout, duration);\n    }\n  }\n\n  private sleep(ms: number): Promise<void> {\n    return new Promise((resolve) => setTimeout(resolve, ms));\n  }\n}\n\n/**\n * Create a gateway client for a specific layer\n */\nexport function createGatewayClient(config: GatewayClientConfig): GatewayClient {\n  return new GatewayClient(config);\n}\n\n/**\n * Create a gateway client from environment variables\n *\n * Required environment variables:\n * - SERVICE_LAYER: 'wspace' | 'global'\n * - SERVICE_NAME: Service name\n *\n * Optional:\n * - SERVICE_IDENTITY: Service identity (defaults to SERVICE_NAME)\n * - {LAYER}_INT_GATEWAY_URL: Internal gateway URL\n * - {OPPOSITE_LAYER}_PUBLIC_GATEWAY_URL: Cross-layer gateway URL\n */\nexport function createGatewayClientFromEnv(): GatewayClient {\n  const layer = process.env['SERVICE_LAYER'] as ServiceLayer;\n\n  if (!layer || (layer !== 'wspace' && layer !== 'global')) {\n    throw new Error(`[GatewayClient] Invalid or missing SERVICE_LAYER. Expected 'wspace' or 'global', got '${layer}'`);\n  }\n\n  const serviceName = process.env['SERVICE_NAME'];\n  if (!serviceName) {\n    throw new Error('[GatewayClient] SERVICE_NAME environment variable is required');\n  }\n\n  const serviceIdentity = process.env['SERVICE_IDENTITY'] || serviceName;\n\n  return new GatewayClient({\n    layer,\n    serviceName,\n    serviceIdentity,\n  });\n}\n"]}
+{"version":3,"sources":["../src/gateway/index.ts","../src/gateway/service-jwt.ts","../src/gateway/types.ts","../src/gateway/client.ts"],"names":["SIGNING_ENV_VAR","KEY_ID","DEFAULT_TTL_SECONDS","REFRESH_BEFORE_EXP_MS","joseModule","getJose","cache","Map","cacheKey","actorId","ttlSeconds","signServiceJwt","secret","process","env","key","cached","get","expiresAtMs","Date","now","token","joseLib","encoder","TextEncoder","keyBytes","encode","nowSec","Math","floor","expSec","SignJWT","actor_type","setProtectedHeader","alg","typ","kid","setSubject","setIssuer","setIssuedAt","setExpirationTime","sign","set","CircuitState","GatewayErrorType","GatewayError","Error","type","gatewayUrl","statusCode","graphqlErrors","cause","message","options","name","Object","setPrototypeOf","prototype","uuidv4","crypto","randomUUID","hasAuthorizationHeader","headers","keys","toLowerCase","resolveBypassPermissionValue","normalizedToken","trim","CircuitBreaker","state","CLOSED","failures","successes","consecutiveFailures","lastFailureTime","lastSuccessTime","openedAt","failureTimestamps","config","getState","checkStateTransition","recordSuccess","HALF_OPEN","logger","info","recordFailure","push","windowStart","failureWindow","filter","t","length","failureThreshold","OPEN","warn","threshold","allowRequest","forceOpen","forceClose","getStats","elapsed","resetTimeout","GatewayClient","layerManager","internalCircuitBreaker","crossLayerCircuitBreaker","retryConfig","defaultHeaders","timeout","enableLogging","LayerManager","layer","serviceName","serviceIdentity","internalGatewayUrl","crossLayerGatewayUrl","cbConfig","DEFAULT_CIRCUIT_BREAKER_CONFIG","circuitBreaker","DEFAULT_GATEWAY_RETRY_CONFIG","retry","getServiceIdentity","debug","internalUrl","getInternalUrl","crossLayerUrl","getCrossLayerUrl","getInternalGatewayUrl","getCrossLayerGatewayUrl","internalQuery","context","createRequestContext","executeWithRetry","bypassPermission","crossLayerQuery","query","getInternalCircuitBreaker","getCrossLayerCircuitBreaker","getHealthStatus","internal","url","circuitState","stats","crossLayer","updateDefaultHeaders","callType","requestId","workspaceId","startTime","shouldRetryError","error","GRAPHQL_ERROR","CIRCUIT_OPEN","calculateRetryDelay","attempt","min","initialDelay","pow","backoffMultiplier","maxDelay","logRetryAttempt","maxAttempts","delay","settings","skipCircuitBreaker","skipRetry","lastError","result","executeRequest","String","sleep","UNKNOWN_ERROR","buildRequestHeaders","value","entries","undefined","toString","handleGraphQLErrors","duration","errors","errorMessages","map","e","join","handleFetchError","TIMEOUT_ERROR","NETWORK_ERROR","serviceActorId","serviceJwt","body","JSON","stringify","variables","operationName","controller","AbortController","timeoutId","setTimeout","abort","response","fetch","method","signal","clearTimeout","ok","status","statusText","json","hasData","data","ms","Promise","resolve","createGatewayClient","createGatewayClientFromEnv"],"mappings":";;;;;;;AAAA,IAAA,eAAA,GAAA;;;;;;;;;;;;AC6BA,IAAMA,eAAAA,GAAkB,oBAAA;AACxB,IAAMC,MAAAA,GAAS,YAAA;AACf,IAAMC,mBAAAA,GAAsB,EAAA;AAC5B,IAAMC,qBAAAA,GAAwB,GAAA;AAE9B,IAAIC,UAAAA,GAAiC,IAAA;AAErC,eAAeC,OAAAA,GAAAA;AACb,EAAA,IAAI,CAACD,UAAAA,EAAY;AACfA,IAAAA,UAAAA,GAAa,MAAM,OAAO,MAAA,CAAA;AAC5B,EAAA;AACA,EAAA,OAAOA,UAAAA;AACT;AALeC,MAAAA,CAAAA,OAAAA,EAAAA,SAAAA,CAAAA;AAYf,IAAMC,KAAAA,uBAAYC,GAAAA,EAAAA;AAElB,SAASC,QAAAA,CAASC,SAAiBC,UAAAA,EAAkB;AACnD,EAAA,OAAO,CAAA,EAAGD,OAAAA,CAAAA,CAAAA,EAAWC,UAAAA,CAAAA,CAAAA;AACvB;AAFSF,MAAAA,CAAAA,QAAAA,EAAAA,UAAAA,CAAAA;AAQT,eAAsBG,cAAAA,CACpBF,OAAAA,EACAC,UAAAA,GAAqBR,mBAAAA,EAAmB;AAExC,EAAA,MAAMU,MAAAA,GAASC,OAAAA,CAAQC,GAAAA,CAAId,eAAAA,CAAAA;AAC3B,EAAA,IAAI,CAACY,MAAAA,EAAQ;AACX,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMG,GAAAA,GAAMP,QAAAA,CAASC,OAAAA,EAASC,UAAAA,CAAAA;AAC9B,EAAA,MAAMM,MAAAA,GAASV,KAAAA,CAAMW,GAAAA,CAAIF,GAAAA,CAAAA;AACzB,EAAA,IAAIC,UAAUA,MAAAA,CAAOE,WAAAA,GAAcf,qBAAAA,GAAwBgB,IAAAA,CAAKC,KAAG,EAAI;AACrE,IAAA,OAAOJ,MAAAA,CAAOK,KAAAA;AAChB,EAAA;AAEA,EAAA,MAAMC,OAAAA,GAAU,MAAMjB,OAAAA,EAAAA;AACtB,EAAA,MAAMkB,OAAAA,GAAU,IAAIC,WAAAA,EAAAA;AACpB,EAAA,MAAMC,QAAAA,GAAWF,OAAAA,CAAQG,MAAAA,CAAOd,MAAAA,CAAAA;AAEhC,EAAA,MAAMe,SAASC,IAAAA,CAAKC,KAAAA,CAAMV,IAAAA,CAAKC,GAAAA,KAAQ,GAAA,CAAA;AACvC,EAAA,MAAMU,SAASH,MAAAA,GAASjB,UAAAA;AAExB,EAAA,MAAMW,KAAAA,GAAQ,MAAM,IAAIC,OAAAA,CAAQS,OAAAA,CAAQ;IACtCC,UAAAA,EAAY;AACd,GAAA,EACGC,kBAAAA,CAAmB;IAAEC,GAAAA,EAAK,OAAA;IAASC,GAAAA,EAAK,KAAA;IAAOC,GAAAA,EAAKnC;AAAO,GAAA,CAAA,CAC3DoC,UAAAA,CAAW5B,OAAAA,CAAAA,CAKX6B,UAAU7B,OAAAA,CAAAA,CACV8B,WAAAA,CAAYZ,MAAAA,CAAAA,CACZa,iBAAAA,CAAkBV,MAAAA,CAAAA,CAClBW,KAAKhB,QAAAA,CAAAA;AAERnB,EAAAA,KAAAA,CAAMoC,IAAI3B,GAAAA,EAAK;AAAEM,IAAAA,KAAAA;AAAOH,IAAAA,WAAAA,EAAaY,MAAAA,GAAS;GAAK,CAAA;AACnD,EAAA,OAAOT,KAAAA;AACT;AAtCsBV,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;;;ACiBf,IAAKgC,YAAAA,6BAAAA,aAAAA,EAAAA;;;;AAAAA,EAAAA,OAAAA,aAAAA;;AA8ML,IAAKC,gBAAAA,6BAAAA,iBAAAA,EAAAA;;;;;;AAAAA,EAAAA,OAAAA,iBAAAA;;AAWL,IAAMC,YAAAA,GAAN,MAAMA,aAAAA,SAAqBC,KAAAA,CAAAA;EApSlC;;;AAqSEC,EAAAA,IAAAA;AACAC,EAAAA,UAAAA;AACAC,EAAAA,UAAAA;AACAC,EAAAA,aAAAA;AACSC,EAAAA,KAAAA;EAET,WAAA,CACEC,OAAAA,EACAL,IAAAA,EACAC,UAAAA,EACAK,OAAAA,EAKA;AACA,IAAA,KAAA,CAAMD,OAAAA,CAAAA;AACN,IAAA,IAAA,CAAKE,IAAAA,GAAO,cAAA;AACZ,IAAA,IAAA,CAAKP,IAAAA,GAAOA,IAAAA;AACZ,IAAA,IAAA,CAAKC,UAAAA,GAAaA,UAAAA;AAClB,IAAA,IAAA,CAAKC,aAAaI,OAAAA,EAASJ,UAAAA;AAC3B,IAAA,IAAA,CAAKC,gBAAgBG,OAAAA,EAASH,aAAAA;AAC9B,IAAA,IAAA,CAAKC,QAAQE,OAAAA,EAASF,KAAAA;AACtBI,IAAAA,MAAAA,CAAOC,cAAAA,CAAe,IAAA,EAAMX,aAAAA,CAAaY,SAAS,CAAA;AACpD,EAAA;AACF;;;ACtQA,IAAMC,MAAAA,mBAAS,MAAA,CAAA,MAAcC,MAAAA,CAAOC,UAAAA,EAAU,EAA/B,QAAA,CAAA;AASf,SAASC,uBAAuBC,OAAAA,EAA+B;AAC7D,EAAA,KAAA,MAAW/C,GAAAA,IAAOwC,MAAAA,CAAOQ,IAAAA,CAAKD,OAAAA,CAAAA,EAAU;AACtC,IAAA,IAAI/C,GAAAA,CAAIiD,WAAAA,EAAW,KAAO,eAAA,EAAiB,OAAO,IAAA;AACpD,EAAA;AACA,EAAA,OAAO,KAAA;AACT;AALSH,MAAAA,CAAAA,sBAAAA,EAAAA,wBAAAA,CAAAA;AAOF,SAASI,4BAAAA,CACd5C,KAAAA,GAA4BR,OAAAA,CAAQC,GAAAA,CAAI,wBAAA,CAAA,EAAyB;AAEjE,EAAA,MAAMoD,eAAAA,GAAkB7C,OAAO8C,IAAAA,EAAAA;AAE/B,EAAA,IAAI,CAACD,eAAAA,EAAiB;AACpB,IAAA,MAAM,IAAIpB,MAAM,4EAAA,CAAA;AAClB,EAAA;AAEA,EAAA,OAAOoB,eAAAA;AACT;AAVgBD,MAAAA,CAAAA,4BAAAA,EAAAA,8BAAAA,CAAAA;AAehB,IAAMG,cAAAA,GAAN,MAAMA,eAAAA,CAAAA;EAvFN;;;AAwFUC,EAAAA,KAAAA,GAAsB1B,YAAAA,CAAa2B,MAAAA;EACnCC,QAAAA,GAAW,CAAA;EACXC,SAAAA,GAAY,CAAA;EACZC,mBAAAA,GAAsB,CAAA;EACtBC,eAAAA,GAAiC,IAAA;EACjCC,eAAAA,GAAiC,IAAA;EACjCC,QAAAA,GAA0B,IAAA;AAC1BC,EAAAA,iBAAAA,GAA8B,EAAA;AAC9BC,EAAAA,MAAAA;AAER,EAAA,WAAA,CAAYA,MAAAA,EAA8B;AACxC,IAAA,IAAA,CAAKA,MAAAA,GAASA,MAAAA;AAChB,EAAA;EAEAC,QAAAA,GAAyB;AACvB,IAAA,IAAA,CAAKC,oBAAAA,EAAoB;AACzB,IAAA,OAAO,IAAA,CAAKX,KAAAA;AACd,EAAA;EAEAY,aAAAA,GAAsB;AACpB,IAAA,IAAA,CAAKT,SAAAA,EAAAA;AACL,IAAA,IAAA,CAAKC,mBAAAA,GAAsB,CAAA;AAC3B,IAAA,IAAA,CAAKE,eAAAA,GAAkBxD,KAAKC,GAAAA,EAAG;AAE/B,IAAA,IAAI,IAAA,CAAKiD,KAAAA,KAAU1B,YAAAA,CAAauC,SAAAA,EAAW;AACzC,MAAA,IAAA,CAAKb,QAAQ1B,YAAAA,CAAa2B,MAAAA;AAC1B,MAAA,IAAA,CAAKC,QAAAA,GAAW,CAAA;AAChB,MAAA,IAAA,CAAKM,oBAAoB,EAAA;AACzB,MAAA,IAAA,CAAKD,QAAAA,GAAW,IAAA;AAChBO,MAAAA,MAAAA,CAAOC,KAAK,uDAAA,CAAA;AACd,IAAA;AACF,EAAA;EAEAC,aAAAA,GAAsB;AACpB,IAAA,IAAA,CAAKd,QAAAA,EAAAA;AACL,IAAA,IAAA,CAAKE,mBAAAA,EAAAA;AACL,IAAA,IAAA,CAAKC,eAAAA,GAAkBvD,KAAKC,GAAAA,EAAG;AAC/B,IAAA,IAAA,CAAKyD,iBAAAA,CAAkBS,IAAAA,CAAKnE,IAAAA,CAAKC,GAAAA,EAAG,CAAA;AAGpC,IAAA,MAAMmE,WAAAA,GAAcpE,IAAAA,CAAKC,GAAAA,EAAG,GAAK,KAAK0D,MAAAA,CAAOU,aAAAA;AAC7C,IAAA,IAAA,CAAKX,oBAAoB,IAAA,CAAKA,iBAAAA,CAAkBY,OAAO,CAACC,CAAAA,KAAMA,IAAIH,WAAAA,CAAAA;AAGlE,IAAA,IAAI,IAAA,CAAKlB,UAAU1B,YAAAA,CAAa2B,MAAAA,IAAU,KAAKO,iBAAAA,CAAkBc,MAAAA,IAAU,IAAA,CAAKb,MAAAA,CAAOc,gBAAAA,EAAkB;AACvG,MAAA,IAAA,CAAKvB,QAAQ1B,YAAAA,CAAakD,IAAAA;AAC1B,MAAA,IAAA,CAAKjB,QAAAA,GAAWzD,KAAKC,GAAAA,EAAG;AACxB+D,MAAAA,MAAAA,CAAOW,KAAK,iDAAA,EAAmD;AAC7DvB,QAAAA,QAAAA,EAAU,KAAKM,iBAAAA,CAAkBc,MAAAA;AACjCI,QAAAA,SAAAA,EAAW,KAAKjB,MAAAA,CAAOc;OACzB,CAAA;AACF,IAAA;AAGA,IAAA,IAAI,IAAA,CAAKvB,KAAAA,KAAU1B,YAAAA,CAAauC,SAAAA,EAAW;AACzC,MAAA,IAAA,CAAKb,QAAQ1B,YAAAA,CAAakD,IAAAA;AAC1B,MAAA,IAAA,CAAKjB,QAAAA,GAAWzD,KAAKC,GAAAA,EAAG;AACxB+D,MAAAA,MAAAA,CAAOW,KAAK,sDAAA,CAAA;AACd,IAAA;AACF,EAAA;EAEAE,YAAAA,GAAwB;AACtB,IAAA,IAAA,CAAKhB,oBAAAA,EAAoB;AAEzB,IAAA,QAAQ,KAAKX,KAAAA;AACX,MAAA,KAAK1B,YAAAA,CAAa2B,MAAAA;AAChB,QAAA,OAAO,IAAA;AACT,MAAA,KAAK3B,YAAAA,CAAakD,IAAAA;AAChB,QAAA,OAAO,KAAA;AACT,MAAA,KAAKlD,YAAAA,CAAauC,SAAAA;AAEhB,QAAA,OAAO,IAAA;AACT,MAAA;AACE,QAAA,OAAO,IAAA;AACX;AACF,EAAA;EAEAe,SAAAA,GAAkB;AAChB,IAAA,IAAA,CAAK5B,QAAQ1B,YAAAA,CAAakD,IAAAA;AAC1B,IAAA,IAAA,CAAKjB,QAAAA,GAAWzD,KAAKC,GAAAA,EAAG;AACxB+D,IAAAA,MAAAA,CAAOC,KAAK,uCAAA,CAAA;AACd,EAAA;EAEAc,UAAAA,GAAmB;AACjB,IAAA,IAAA,CAAK7B,QAAQ1B,YAAAA,CAAa2B,MAAAA;AAC1B,IAAA,IAAA,CAAKC,QAAAA,GAAW,CAAA;AAChB,IAAA,IAAA,CAAKE,mBAAAA,GAAsB,CAAA;AAC3B,IAAA,IAAA,CAAKI,oBAAoB,EAAA;AACzB,IAAA,IAAA,CAAKD,QAAAA,GAAW,IAAA;AAChBO,IAAAA,MAAAA,CAAOC,KAAK,uCAAA,CAAA;AACd,EAAA;EAEAe,QAAAA,GAAgC;AAC9B,IAAA,OAAO;AACL9B,MAAAA,KAAAA,EAAO,IAAA,CAAKA,KAAAA;AACZE,MAAAA,QAAAA,EAAU,IAAA,CAAKA,QAAAA;AACfC,MAAAA,SAAAA,EAAW,IAAA,CAAKA,SAAAA;AAChBC,MAAAA,mBAAAA,EAAqB,IAAA,CAAKA,mBAAAA;AAC1BC,MAAAA,eAAAA,EAAiB,IAAA,CAAKA,eAAAA;AACtBC,MAAAA,eAAAA,EAAiB,IAAA,CAAKA,eAAAA;AACtBC,MAAAA,QAAAA,EAAU,IAAA,CAAKA;AACjB,KAAA;AACF,EAAA;EAEQI,oBAAAA,GAA6B;AACnC,IAAA,IAAI,IAAA,CAAKX,KAAAA,KAAU1B,YAAAA,CAAakD,IAAAA,IAAQ,KAAKjB,QAAAA,EAAU;AACrD,MAAA,MAAMwB,OAAAA,GAAUjF,IAAAA,CAAKC,GAAAA,EAAG,GAAK,IAAA,CAAKwD,QAAAA;AAClC,MAAA,IAAIwB,OAAAA,IAAW,IAAA,CAAKtB,MAAAA,CAAOuB,YAAAA,EAAc;AACvC,QAAA,IAAA,CAAKhC,QAAQ1B,YAAAA,CAAauC,SAAAA;AAC1BC,QAAAA,MAAAA,CAAOC,KAAK,qDAAA,CAAA;AACd,MAAA;AACF,IAAA;AACF,EAAA;AACF,CAAA;AAKO,IAAMkB,gBAAN,MAAMA;EA9Mb;;;AA+MUxB,EAAAA,MAAAA;AACAyB,EAAAA,YAAAA;AACAC,EAAAA,sBAAAA;AACAC,EAAAA,wBAAAA;AACAC,EAAAA,WAAAA;AACAC,EAAAA,cAAAA;AAER,EAAA,WAAA,CAAY7B,MAAAA,EAA6B;AACvC,IAAA,IAAA,CAAKA,MAAAA,GAAS;MACZ8B,OAAAA,EAAS,GAAA;MACTC,aAAAA,EAAe,IAAA;MACf,GAAG/B;AACL,KAAA;AAGA,IAAA,IAAA,CAAKyB,YAAAA,GAAe,IAAIO,YAAAA,CAAa;AACnCC,MAAAA,KAAAA,EAAOjC,MAAAA,CAAOiC,KAAAA;AACdC,MAAAA,WAAAA,EAAalC,MAAAA,CAAOkC,WAAAA;AACpBC,MAAAA,eAAAA,EAAiBnC,MAAAA,CAAOmC;KAC1B,CAAA;AAGA,IAAA,IAAInC,OAAOoC,kBAAAA,EAAoB;AAG/B,IAAA,IAAIpC,OAAOqC,oBAAAA,EAAsB;AAKjC,IAAA,MAAMC,QAAAA,GAAiC;MACrC,GAAGC,8BAAAA;AACH,MAAA,GAAGvC,MAAAA,CAAOwC;AACZ,KAAA;AACA,IAAA,IAAA,CAAKd,sBAAAA,GAAyB,IAAIpC,cAAAA,CAAegD,QAAAA,CAAAA;AACjD,IAAA,IAAA,CAAKX,wBAAAA,GAA2B,IAAIrC,cAAAA,CAAegD,QAAAA,CAAAA;AAGnD,IAAA,IAAA,CAAKV,WAAAA,GAAc;MACjB,GAAGa,4BAAAA;AACH,MAAA,GAAGzC,MAAAA,CAAO0C;AACZ,KAAA;AAGA,IAAA,IAAA,CAAKb,cAAAA,GAAiB;MACpB,oBAAA,EAAsB,IAAA,CAAKJ,aAAakB,kBAAAA,EAAkB;MAC1D,cAAA,EAAgB,SAAA;AAChB,MAAA,GAAG3C,MAAAA,CAAO6B;AACZ,KAAA;AAEAxB,IAAAA,MAAAA,CAAOuC,MAAM,6BAAA,EAA+B;AAC1CX,MAAAA,KAAAA,EAAOjC,MAAAA,CAAOiC,KAAAA;AACdC,MAAAA,WAAAA,EAAalC,MAAAA,CAAOkC,WAAAA;AACpBW,MAAAA,WAAAA,EAAa,KAAKC,cAAAA,EAAc;AAChCC,MAAAA,aAAAA,EAAe,KAAKC,gBAAAA;KACtB,CAAA;AACF,EAAA;EAEQF,cAAAA,GAAyB;AAC/B,IAAA,OAAO,IAAA,CAAK9C,MAAAA,CAAOoC,kBAAAA,IAAsB,IAAA,CAAKX,aAAawB,qBAAAA,EAAqB;AAClF,EAAA;EAEQD,gBAAAA,GAA2B;AACjC,IAAA,OAAO,IAAA,CAAKhD,MAAAA,CAAOqC,oBAAAA,IAAwB,IAAA,CAAKZ,aAAayB,uBAAAA,EAAuB;AACtF,EAAA;;;;AAKA,EAAA,MAAMC,cAA2B5E,OAAAA,EAA6D;AAC5F,IAAA,MAAM6E,OAAAA,GAAU,IAAA,CAAKC,oBAAAA,CAAqB,UAAA,EAAY9E,OAAAA,CAAAA;AAEtD,IAAA,OAAO,IAAA,CAAK+E,iBAAiB,IAAA,CAAKR,cAAAA,IAAkBvE,OAAAA,EAAS,IAAA,CAAKmD,wBAAwB0B,OAAAA,EAAS;MACjGG,gBAAAA,EAAkB;KACpB,CAAA;AACF,EAAA;;;;AAKA,EAAA,MAAMC,gBAA6BjF,OAAAA,EAA6D;AAC9F,IAAA,MAAM6E,OAAAA,GAAU,IAAA,CAAKC,oBAAAA,CAAqB,aAAA,EAAe9E,OAAAA,CAAAA;AAEzD,IAAA,OAAO,IAAA,CAAK+E,gBAAAA;AACV,MAAA,IAAA,CAAKN,gBAAAA,EAAgB;AACrBzE,MAAAA,OAAAA;MACA,IAAA,CAAKoD,wBAAAA;AACLyB,MAAAA,OAAAA;AACA,MAAA;QAAEG,gBAAAA,EAAkB;AAAM;;;AAE9B,EAAA;;;;EAKA,MAAME,KAAAA,CAAmBvF,YAAoBK,OAAAA,EAA6D;AACxG,IAAA,MAAM6E,OAAAA,GAAU,IAAA,CAAKC,oBAAAA,CAAqB,QAAA,EAAU9E,OAAAA,CAAAA;AAGpD,IAAA,OAAO,KAAK+E,gBAAAA,CAAiBpF,UAAAA,EAAYK,OAAAA,EAAS,IAAA,CAAKmD,wBAAwB0B,OAAAA,EAAS;MACtFG,gBAAAA,EAAkB;KACpB,CAAA;AACF,EAAA;EAEAG,yBAAAA,GAA6C;AAC3C,IAAA,OAAO,IAAA,CAAKhC,sBAAAA;AACd,EAAA;EAEAiC,2BAAAA,GAA+C;AAC7C,IAAA,OAAO,IAAA,CAAKhC,wBAAAA;AACd,EAAA;EAEAiC,eAAAA,GAAuC;AACrC,IAAA,OAAO;MACLC,QAAAA,EAAU;AACRC,QAAAA,GAAAA,EAAK,KAAKhB,cAAAA,EAAc;QACxBiB,YAAAA,EAAc,IAAA,CAAKrC,uBAAuBzB,QAAAA,EAAQ;QAClD+D,KAAAA,EAAO,IAAA,CAAKtC,uBAAuBL,QAAAA;AACrC,OAAA;MACA4C,UAAAA,EAAY;AACVH,QAAAA,GAAAA,EAAK,KAAKd,gBAAAA,EAAgB;QAC1Be,YAAAA,EAAc,IAAA,CAAKpC,yBAAyB1B,QAAAA,EAAQ;QACpD+D,KAAAA,EAAO,IAAA,CAAKrC,yBAAyBN,QAAAA;AACvC;AACF,KAAA;AACF,EAAA;AAEA6C,EAAAA,oBAAAA,CAAqBlF,OAAAA,EAA+C;AAClE,IAAA,IAAA,CAAK6C,cAAAA,GAAiB;AAAE,MAAA,GAAG,IAAA,CAAKA,cAAAA;MAAgB,GAAG7C;AAAQ,KAAA;AAC7D,EAAA;AAEQqE,EAAAA,oBAAAA,CACNc,UACA5F,OAAAA,EACgB;AAChB,IAAA,OAAO;AACL6F,MAAAA,SAAAA,EAAWxF,MAAAA,EAAAA;AACXjD,MAAAA,OAAAA,EAAS4C,QAAQS,OAAAA,GAAU,YAAA,CAAA,IAAiB,IAAA,CAAK6C,eAAe,YAAA,CAAA;AAChEwC,MAAAA,WAAAA,EAAa9F,QAAQS,OAAAA,GAAU,gBAAA,CAAA,IAAqB,IAAA,CAAK6C,eAAe,gBAAA,CAAA;AACxEyC,MAAAA,SAAAA,EAAWjI,KAAKC,GAAAA,EAAG;AACnB6H,MAAAA;AACF,KAAA;AACF,EAAA;;;;AAKQI,EAAAA,gBAAAA,CAAiBC,KAAAA,EAAyB;AAChD,IAAA,IAAI,EAAEA,iBAAiBzG,YAAAA,CAAAA,EAAe;AACpC,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OAAOyG,MAAMvG,IAAAA,KAASH,gBAAAA,CAAiB2G,aAAAA,IAAiBD,KAAAA,CAAMvG,SAASH,gBAAAA,CAAiB4G,YAAAA;AAC1F,EAAA;;;;AAKQC,EAAAA,mBAAAA,CAAoBC,OAAAA,EAAyB;AACnD,IAAA,OAAO9H,IAAAA,CAAK+H,GAAAA,CACV,IAAA,CAAKjD,WAAAA,CAAYkD,eAAehI,IAAAA,CAAKiI,GAAAA,CAAI,IAAA,CAAKnD,WAAAA,CAAYoD,mBAAmBJ,OAAAA,GAAU,CAAA,CAAA,EACvF,IAAA,CAAKhD,YAAYqD,QAAQ,CAAA;AAE7B,EAAA;;;;AAKQC,EAAAA,eAAAA,CACN9B,OAAAA,EACAwB,OAAAA,EACAO,WAAAA,EACAC,KAAAA,EACAZ,KAAAA,EACM;AACN,IAAA,IAAI,IAAA,CAAKxE,OAAO+B,aAAAA,EAAe;AAC7B1B,MAAAA,MAAAA,CAAOW,KAAK,0CAAA,EAA4C;AACtDoD,QAAAA,SAAAA,EAAWhB,OAAAA,CAAQgB,SAAAA;AACnBQ,QAAAA,OAAAA;AACAO,QAAAA,WAAAA;AACAC,QAAAA,KAAAA;AACAZ,QAAAA,KAAAA,EAAOA,KAAAA,CAAMlG;OACf,CAAA;AACF,IAAA;AACF,EAAA;AAEA,EAAA,MAAcgF,gBAAAA,CACZpF,UAAAA,EACAK,OAAAA,EACAiE,cAAAA,EACAY,SACAiC,QAAAA,EAC6B;AAE7B,IAAA,IAAI,CAAC9G,OAAAA,CAAQ+G,kBAAAA,IAAsB,CAAC9C,cAAAA,CAAetB,cAAY,EAAI;AACjE,MAAA,MAAM,IAAInD,YAAAA,CAAa,CAAA,4BAAA,EAA+BG,UAAAA,CAAAA,CAAAA,EAAcJ,gBAAAA,CAAiB4G,cAAcxG,UAAAA,CAAAA;AACrG,IAAA;AAEA,IAAA,MAAMiH,WAAAA,GAAc5G,OAAAA,CAAQgH,SAAAA,GAAY,CAAA,GAAI,KAAK3D,WAAAA,CAAYuD,WAAAA;AAC7D,IAAA,IAAIK,SAAAA,GAA0B,IAAA;AAE9B,IAAA,KAAA,IAASZ,OAAAA,GAAU,CAAA,EAAGA,OAAAA,IAAWO,WAAAA,EAAaP,OAAAA,EAAAA,EAAW;AACvD,MAAA,IAAI;AACF,QAAA,MAAMa,MAAAA,GAAS,MAAM,IAAA,CAAKC,cAAAA,CAAkBxH,YAAYK,OAAAA,EAAS6E,OAAAA,EAASiC,SAAS9B,gBAAgB,CAAA;AACnG,QAAA,IAAI,CAAChF,QAAQ+G,kBAAAA,EAAoB;AAC/B9C,UAAAA,cAAAA,CAAerC,aAAAA,EAAa;AAC9B,QAAA;AACA,QAAA,OAAOsF,MAAAA;AACT,MAAA,CAAA,CAAA,OAASjB,KAAAA,EAAO;AACdgB,QAAAA,SAAAA,GAAYhB,iBAAiBxG,KAAAA,GAAQwG,KAAAA,GAAQ,IAAIxG,KAAAA,CAAM2H,MAAAA,CAAOnB,KAAAA,CAAAA,CAAAA;AAC9D,QAAA,IAAI,CAACjG,QAAQ+G,kBAAAA,EAAoB;AAC/B9C,UAAAA,cAAAA,CAAejC,aAAAA,EAAa;AAC9B,QAAA;AAEA,QAAA,IAAI,CAAC,IAAA,CAAKgE,gBAAAA,CAAiBC,KAAAA,CAAAA,EAAQ;AACjC,UAAA,MAAMA,KAAAA;AACR,QAAA;AAEA,QAAA,IAAII,UAAUO,WAAAA,EAAa;AACzB,UAAA,MAAMC,KAAAA,GAAQ,IAAA,CAAKT,mBAAAA,CAAoBC,OAAAA,CAAAA;AACvC,UAAA,IAAA,CAAKM,eAAAA,CAAgB9B,OAAAA,EAASwB,OAAAA,EAASO,WAAAA,EAAaC,OAAOI,SAAAA,CAAAA;AAC3D,UAAA,MAAM,IAAA,CAAKI,MAAMR,KAAAA,CAAAA;AACnB,QAAA;AACF,MAAA;AACF,IAAA;AAEA,IAAA,MAAMI,aAAa,IAAIzH,YAAAA,CAAa,8BAAA,EAAgCD,gBAAAA,CAAiB+H,eAAe3H,UAAAA,CAAAA;AACtG,EAAA;;;;EAKQ4H,mBAAAA,CACN1C,OAAAA,EACA7E,SACAgF,gBAAAA,EACwB;AACxB,IAAA,MAAMvE,OAAAA,GAAkC;MACtC,cAAA,EAAgB,kBAAA;AAChB,MAAA,cAAA,EAAgBoE,OAAAA,CAAQgB,SAAAA;AACxB,MAAA,aAAA,EAAehB,OAAAA,CAAQe;AACzB,KAAA;AAGA,IAAA,KAAA,MAAW,CAAClI,KAAK8J,KAAAA,CAAAA,IAAUtH,OAAOuH,OAAAA,CAAQ,IAAA,CAAKnE,cAAc,CAAA,EAAG;AAC9D,MAAA,IAAIkE,UAAUE,MAAAA,EAAW;AACvBjH,QAAAA,OAAAA,CAAQ/C,GAAAA,CAAAA,GAAO0J,MAAAA,CAAOI,KAAAA,CAAAA;AACxB,MAAA;AACF,IAAA;AAGA,IAAA,IAAIxH,QAAQS,OAAAA,EAAS;AACnB,MAAA,KAAA,MAAW,CAAC/C,KAAK8J,KAAAA,CAAAA,IAAUtH,OAAOuH,OAAAA,CAAQzH,OAAAA,CAAQS,OAAO,CAAA,EAAG;AAC1D,QAAA,IAAI+G,UAAUE,MAAAA,EAAW;AACvBjH,UAAAA,OAAAA,CAAQ/C,GAAAA,CAAAA,GAAO0J,MAAAA,CAAOI,KAAAA,CAAAA;AACxB,QAAA;AACF,MAAA;AACF,IAAA;AAGA,IAAA,IAAIxC,gBAAAA,EAAkB;AACpBvE,MAAAA,OAAAA,CAAQ,qBAAA,IAAyBG,4BAAAA,EAAAA;AACjCH,MAAAA,OAAAA,CAAQ,iBAAA,CAAA,GAAqB,IAAA,CAAKyC,YAAAA,CAAakB,kBAAAA,EAAkB;AACjE3D,MAAAA,OAAAA,CAAQ,oBAAA,CAAA,GAAwB3C,IAAAA,CAAKC,GAAAA,GAAM4J,QAAAA,EAAQ;AACrD,IAAA;AAEA,IAAA,OAAOlH,OAAAA;AACT,EAAA;;;;EAKQmH,mBAAAA,CACNV,MAAAA,EACArC,OAAAA,EACAlF,UAAAA,EACAkI,QAAAA,EACM;AACN,IAAA,IAAI,CAACX,MAAAA,CAAOY,MAAAA,IAAUZ,MAAAA,CAAOY,MAAAA,CAAOxF,WAAW,CAAA,EAAG;AAChD,MAAA;AACF,IAAA;AAEA,IAAA,MAAMyF,aAAAA,GAAgBb,MAAAA,CAAOY,MAAAA,CAAOE,GAAAA,CAAI,CAACC,MAAoBA,CAAAA,CAAElI,OAAO,CAAA,CAAEmI,IAAAA,CAAK,IAAA,CAAA;AAE7E,IAAA,IAAI,IAAA,CAAKzG,OAAO+B,aAAAA,EAAe;AAC7B1B,MAAAA,MAAAA,CAAOW,KAAK,gCAAA,EAAkC;AAC5CoD,QAAAA,SAAAA,EAAWhB,OAAAA,CAAQgB,SAAAA;AACnBiC,QAAAA,MAAAA,EAAQZ,MAAAA,CAAOY,MAAAA;AACfD,QAAAA;OACF,CAAA;AACF,IAAA;AAEA,IAAA,MAAM,IAAIrI,YAAAA,CAAa,CAAA,eAAA,EAAkBuI,aAAAA,CAAAA,CAAAA,EAAiBxI,gBAAAA,CAAiB2G,eAAevG,UAAAA,EAAY;AACpGE,MAAAA,aAAAA,EAAeqH,MAAAA,CAAOY;KACxB,CAAA;AACF,EAAA;;;;AAKQK,EAAAA,gBAAAA,CACNlC,KAAAA,EACApB,OAAAA,EACAlF,UAAAA,EACA4D,OAAAA,EACAsE,QAAAA,EACO;AACP,IAAA,IAAI5B,iBAAiBzG,YAAAA,EAAc;AACjC,MAAA,MAAMyG,KAAAA;AACR,IAAA;AAEA,IAAA,IAAIA,iBAAiBxG,KAAAA,EAAO;AAC1B,MAAA,IAAIwG,KAAAA,CAAMhG,SAAS,YAAA,EAAc;AAC/B,QAAA,MAAM,IAAIT,YAAAA,CAAa,CAAA,wBAAA,EAA2B+D,OAAAA,CAAAA,EAAAA,CAAAA,EAAahE,gBAAAA,CAAiB6I,eAAezI,UAAAA,EAAY;UACzGG,KAAAA,EAAOmG;SACT,CAAA;AACF,MAAA;AAEA,MAAA,IAAI,IAAA,CAAKxE,OAAO+B,aAAAA,EAAe;AAC7B1B,QAAAA,MAAAA,CAAOmE,MAAM,gCAAA,EAAkC;AAC7CJ,UAAAA,SAAAA,EAAWhB,OAAAA,CAAQgB,SAAAA;AACnBI,UAAAA,KAAAA,EAAOA,KAAAA,CAAMlG,OAAAA;AACb8H,UAAAA;SACF,CAAA;AACF,MAAA;AAEA,MAAA,MAAM,IAAIrI,YAAAA,CAAayG,KAAAA,CAAMlG,OAAAA,EAASR,gBAAAA,CAAiB8I,eAAe1I,UAAAA,EAAY;QAChFG,KAAAA,EAAOmG;OACT,CAAA;AACF,IAAA;AAEA,IAAA,MAAM,IAAIzG,YAAAA,CAAa4H,MAAAA,CAAOnB,KAAAA,CAAAA,EAAQ1G,gBAAAA,CAAiB+H,eAAe3H,UAAAA,CAAAA;AACxE,EAAA;AAEA,EAAA,MAAcwH,cAAAA,CACZxH,UAAAA,EACAK,OAAAA,EACA6E,OAAAA,EACAG,gBAAAA,EAC6B;AAC7B,IAAA,MAAMzB,OAAAA,GAAUvD,OAAAA,CAAQuD,OAAAA,IAAW,IAAA,CAAK9B,OAAO8B,OAAAA,IAAW,GAAA;AAC1D,IAAA,MAAM9C,OAAAA,GAAU,IAAA,CAAK8G,mBAAAA,CAAoB1C,OAAAA,EAAS7E,SAASgF,gBAAAA,CAAAA;AAQ3D,IAAA,IAAIH,QAAQe,QAAAA,KAAa,aAAA,IAAiB,CAACpF,sBAAAA,CAAuBC,OAAAA,CAAAA,EAAU;AAC1E,MAAA,MAAM6H,cAAAA,GAAiB,IAAA,CAAKpF,YAAAA,CAAakB,kBAAAA,EAAkB;AAC3D,MAAA,MAAMmE,UAAAA,GAAa,MAAMjL,cAAAA,CAAegL,cAAAA,CAAAA;AACxC,MAAA,IAAIC,UAAAA,EAAY;AACd9H,QAAAA,OAAAA,CAAQ,eAAA,CAAA,GAAmB,CAAA,OAAA,EAAU8H,UAAAA,CAAAA,CAAAA;MACvC,CAAA,MAAA,IAAW,IAAA,CAAK9G,OAAO+B,aAAAA,EAAe;AAKpC1B,QAAAA,MAAAA,CAAOuC,MACL,4GAAA,EACA;AAAEwB,UAAAA,SAAAA,EAAWhB,OAAAA,CAAQgB,SAAAA;AAAWlG,UAAAA;SAAW,CAAA;AAE/C,MAAA;AACF,IAAA;AAEA,IAAA,MAAM6I,IAAAA,GAAOC,KAAKC,SAAAA,CAAU;AAC1BxD,MAAAA,KAAAA,EAAOlF,OAAAA,CAAQkF,KAAAA;MACfyD,SAAAA,EAAW3I,OAAAA,CAAQ2I,aAAa,EAAC;AACjCC,MAAAA,aAAAA,EAAe5I,OAAAA,CAAQ4I;KACzB,CAAA;AAEA,IAAA,IAAI,IAAA,CAAKnH,OAAO+B,aAAAA,EAAe;AAC7B1B,MAAAA,MAAAA,CAAOuC,MAAM,mCAAA,EAAqC;AAChDwB,QAAAA,SAAAA,EAAWhB,OAAAA,CAAQgB,SAAAA;AACnBlG,QAAAA,UAAAA;AACAiJ,QAAAA,aAAAA,EAAe5I,OAAAA,CAAQ4I,aAAAA;AACvBhD,QAAAA,QAAAA,EAAUf,OAAAA,CAAQe,QAAAA;AAClBZ,QAAAA;OACF,CAAA;AACF,IAAA;AAEA,IAAA,IAAI;AACF,MAAA,MAAM6D,UAAAA,GAAa,IAAIC,eAAAA,EAAAA;AACvB,MAAA,MAAMC,YAAYC,UAAAA,CAAW,MAAMH,UAAAA,CAAWI,KAAAA,IAAS1F,OAAAA,CAAAA;AAEvD,MAAA,MAAM2F,QAAAA,GAAW,MAAMC,KAAAA,CAAMxJ,UAAAA,EAAY;QACvCyJ,MAAAA,EAAQ,MAAA;AACR3I,QAAAA,OAAAA;AACA+H,QAAAA,IAAAA;AACAa,QAAAA,MAAAA,EAAQR,UAAAA,CAAWQ;OACrB,CAAA;AAEAC,MAAAA,YAAAA,CAAaP,SAAAA,CAAAA;AACb,MAAA,MAAMlB,QAAAA,GAAW/J,IAAAA,CAAKC,GAAAA,EAAG,GAAK8G,OAAAA,CAAQkB,SAAAA;AAEtC,MAAA,IAAI,CAACmD,SAASK,EAAAA,EAAI;AAChB,QAAA,MAAM,IAAI/J,YAAAA,CACR,CAAA,KAAA,EAAQ0J,QAAAA,CAASM,MAAM,CAAA,EAAA,EAAKN,QAAAA,CAASO,UAAU,CAAA,CAAA,EAC/ClK,gBAAAA,CAAiB8I,aAAAA,EACjB1I,UAAAA,EACA;AAAEC,UAAAA,UAAAA,EAAYsJ,QAAAA,CAASM;SAAO,CAAA;AAElC,MAAA;AAEA,MAAA,MAAMtC,MAAAA,GAAU,MAAMgC,QAAAA,CAASQ,IAAAA,EAAI;AACnC,MAAA,IAAA,CAAK9B,mBAAAA,CAAoBV,MAAAA,EAAQrC,OAAAA,EAASlF,UAAAA,EAAYkI,QAAAA,CAAAA;AAEtD,MAAA,IAAI,IAAA,CAAKpG,OAAO+B,aAAAA,EAAe;AAC7B1B,QAAAA,MAAAA,CAAOuC,MAAM,mCAAA,EAAqC;AAChDwB,UAAAA,SAAAA,EAAWhB,OAAAA,CAAQgB,SAAAA;AACnBgC,UAAAA,QAAAA;UACA8B,OAAAA,EAAS,CAAC,CAACzC,MAAAA,CAAO0C;SACpB,CAAA;AACF,MAAA;AAEA,MAAA,OAAO1C,MAAAA;AACT,IAAA,CAAA,CAAA,OAASjB,KAAAA,EAAO;AACd,MAAA,MAAM4B,QAAAA,GAAW/J,IAAAA,CAAKC,GAAAA,EAAG,GAAK8G,OAAAA,CAAQkB,SAAAA;AACtC,MAAA,IAAA,CAAKoC,gBAAAA,CAAiBlC,KAAAA,EAAOpB,OAAAA,EAASlF,UAAAA,EAAY4D,SAASsE,QAAAA,CAAAA;AAC7D,IAAA;AACF,EAAA;AAEQR,EAAAA,KAAAA,CAAMwC,EAAAA,EAA2B;AACvC,IAAA,OAAO,IAAIC,OAAAA,CAAQ,CAACC,YAAYf,UAAAA,CAAWe,OAAAA,EAASF,EAAAA,CAAAA,CAAAA;AACtD,EAAA;AACF;AAKO,SAASG,oBAAoBvI,MAAAA,EAA2B;AAC7D,EAAA,OAAO,IAAIwB,cAAcxB,MAAAA,CAAAA;AAC3B;AAFgBuI,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAgBT,SAASC,0BAAAA,GAAAA;AACd,EAAA,MAAMvG,KAAAA,GAAQlG,OAAAA,CAAQC,GAAAA,CAAI,eAAA,CAAA;AAE1B,EAAA,IAAI,CAACiG,KAAAA,IAAUA,KAAAA,KAAU,QAAA,IAAYA,UAAU,QAAA,EAAW;AACxD,IAAA,MAAM,IAAIjE,KAAAA,CAAM,CAAA,sFAAA,EAAyFiE,KAAAA,CAAAA,CAAAA,CAAQ,CAAA;AACnH,EAAA;AAEA,EAAA,MAAMC,WAAAA,GAAcnG,OAAAA,CAAQC,GAAAA,CAAI,cAAA,CAAA;AAChC,EAAA,IAAI,CAACkG,WAAAA,EAAa;AAChB,IAAA,MAAM,IAAIlE,MAAM,+DAAA,CAAA;AAClB,EAAA;AAEA,EAAA,MAAMmE,eAAAA,GAAkBpG,OAAAA,CAAQC,GAAAA,CAAI,kBAAA,CAAA,IAAuBkG,WAAAA;AAE3D,EAAA,OAAO,IAAIV,aAAAA,CAAc;AACvBS,IAAAA,KAAAA;AACAC,IAAAA,WAAAA;AACAC,IAAAA;GACF,CAAA;AACF;AAnBgBqG,MAAAA,CAAAA,0BAAAA,EAAAA,4BAAAA,CAAAA","file":"chunk-TXW7ZKA2.js","sourcesContent":["/**\n * Gateway Module\n *\n * Provides unified gateway client for layer-aware M2M communication\n * with circuit breaker and retry logic.\n *\n * @module gateway\n * @category Gateway\n *\n * @example\n * ```typescript\n * import { GatewayClient, createGatewayClientFromEnv } from '@burdenoff/be-sdk/gateway';\n *\n * // Create from environment variables\n * const client = createGatewayClientFromEnv();\n *\n * // Or create manually\n * const client = new GatewayClient({\n *   layer: 'wspace',\n *   serviceName: 'wspace-tags-svc',\n * });\n *\n * // Internal call (same layer, uses int-gateway with bypass)\n * const internalResult = await client.internalQuery({\n *   query: `query { getTag(id: \"123\") { id name } }`,\n * });\n *\n * // Cross-layer call (via public gateway)\n * const crossLayerResult = await client.crossLayerQuery({\n *   query: `query { getCurrentUser { id email } }`,\n * });\n * ```\n */\n\n// Client exports\nexport { GatewayClient, createGatewayClient, createGatewayClientFromEnv } from './client.js';\n\n// Type exports\nexport {\n  CircuitState,\n  GatewayErrorType,\n  GatewayError,\n  type GatewayClientConfig,\n  type GraphQLRequestOptions,\n  type GraphQLResponse,\n  type GraphQLError,\n  type IGatewayClient,\n  type ICircuitBreaker,\n  type CircuitBreakerStats,\n  type GatewayClientHealth,\n  type RequestContext,\n} from './types.js';\n\n// Gateway-side security plugin stack (for public gateways).\n// Imported by consumers as `@burdenoff/be-sdk/gateway/security` — this\n// re-export lets `@burdenoff/be-sdk/gateway` also resolve the namespace.\nexport * as Security from './security/index.js';\n","/**\n * Service JWT minting + caching for M2M cross-layer calls.\n *\n * The public gateways (global-public-gateway, wspace-public-gateway) validate\n * every incoming request's Authorization header and only propagate `x-actor-*`\n * context headers to subgraphs when the JWT is valid. Without a JWT, raw\n * actor headers are stripped as potential client spoofing. For service-to-\n * service cross-layer calls there is no user JWT to forward — we mint a short-\n * lived service JWT with `actor_type: 'service'` so the gateway admits the\n * call and the subgraph sees a trusted service context.\n *\n * Signing key: SERVICE_JWT_SECRET — a dedicated, separate secret from\n * GLOBAL_AUTH_SECRET (which signs user tokens). Keeping them distinct means a\n * service minter that leaks its env cannot forge user logins. The gateways\n * hold both secrets and pick between them by the JWT's `kid` header\n * (this minter stamps `kid: service-v1`).\n */\nimport type * as jose from 'jose';\n\n/**\n * Dedicated secret for service-minted JWTs.\n *\n * Deliberately separate from `GLOBAL_AUTH_SECRET` (which signs user tokens)\n * so that services that mint service JWTs do not also hold the ability to\n * forge user logins. Blast radius of a leaked secret stays scoped to 60s\n * service tokens with no PII.\n *\n * Gateways hold both secrets and select by the JWT's `kid` header.\n */\nconst SIGNING_ENV_VAR = 'SERVICE_JWT_SECRET';\nconst KEY_ID = 'service-v1';\nconst DEFAULT_TTL_SECONDS = 60;\nconst REFRESH_BEFORE_EXP_MS = 10_000;\n\nlet joseModule: typeof jose | null = null;\n\nasync function getJose(): Promise<typeof jose> {\n  if (!joseModule) {\n    joseModule = await import('jose');\n  }\n  return joseModule;\n}\n\ninterface CachedToken {\n  token: string;\n  expiresAtMs: number;\n}\n\nconst cache = new Map<string, CachedToken>();\n\nfunction cacheKey(actorId: string, ttlSeconds: number): string {\n  return `${actorId}:${ttlSeconds}`;\n}\n\n/**\n * Sign a service-actor JWT.\n * Returns null when no signing secret is configured (opt-in).\n */\nexport async function signServiceJwt(\n  actorId: string,\n  ttlSeconds: number = DEFAULT_TTL_SECONDS\n): Promise<string | null> {\n  const secret = process.env[SIGNING_ENV_VAR];\n  if (!secret) {\n    return null;\n  }\n\n  const key = cacheKey(actorId, ttlSeconds);\n  const cached = cache.get(key);\n  if (cached && cached.expiresAtMs - REFRESH_BEFORE_EXP_MS > Date.now()) {\n    return cached.token;\n  }\n\n  const joseLib = await getJose();\n  const encoder = new TextEncoder();\n  const keyBytes = encoder.encode(secret);\n\n  const nowSec = Math.floor(Date.now() / 1000);\n  const expSec = nowSec + ttlSeconds;\n\n  const token = await new joseLib.SignJWT({\n    actor_type: 'service',\n  })\n    .setProtectedHeader({ alg: 'HS256', typ: 'JWT', kid: KEY_ID })\n    .setSubject(actorId)\n    // `iss` = the service identity that minted the token. Matches `sub`\n    // because these are self-minted tokens (caller is asserting itself).\n    // Gives the gateway room to enforce a minter allowlist later without\n    // a token-format change.\n    .setIssuer(actorId)\n    .setIssuedAt(nowSec)\n    .setExpirationTime(expSec)\n    .sign(keyBytes);\n\n  cache.set(key, { token, expiresAtMs: expSec * 1000 });\n  return token;\n}\n\n/** Test hook to clear the cache between tests. */\nexport function __clearServiceJwtCache(): void {\n  cache.clear();\n}\n","/**\n * Gateway Client Types\n *\n * Type definitions for the unified gateway client with\n * circuit breaker and retry logic.\n *\n * @module gateway/types\n * @category Gateway\n */\n\nimport type { ServiceLayer, CircuitBreakerConfig, GatewayRetryConfig, GatewayRequestHeaders } from '../types/layer.js';\n\n/**\n * Gateway client configuration\n */\nexport interface GatewayClientConfig {\n  /**\n   * Layer this client belongs to\n   */\n  layer: ServiceLayer;\n\n  /**\n   * Service name (for logging and headers)\n   */\n  serviceName: string;\n\n  /**\n   * Service identity for bypass headers\n   * @default serviceName\n   */\n  serviceIdentity?: string;\n\n  /**\n   * Internal gateway URL (same layer M2M)\n   * @default Resolved from layer defaults or environment\n   */\n  internalGatewayUrl?: string;\n\n  /**\n   * Cross-layer gateway URL (cross layer via public gateway)\n   * @default Resolved from layer defaults or environment\n   */\n  crossLayerGatewayUrl?: string;\n\n  /**\n   * Request timeout in milliseconds\n   * @default 30000 (30 seconds)\n   */\n  timeout?: number;\n\n  /**\n   * Circuit breaker configuration\n   */\n  circuitBreaker?: Partial<CircuitBreakerConfig>;\n\n  /**\n   * Retry configuration\n   */\n  retry?: Partial<GatewayRetryConfig>;\n\n  /**\n   * Enable request logging\n   * @default true\n   */\n  enableLogging?: boolean;\n\n  /**\n   * Default headers to include in all requests\n   */\n  defaultHeaders?: GatewayRequestHeaders;\n}\n\n/**\n * Circuit breaker states\n */\nexport enum CircuitState {\n  CLOSED = 'CLOSED',\n  OPEN = 'OPEN',\n  HALF_OPEN = 'HALF_OPEN',\n}\n\n/**\n * Circuit breaker instance interface\n */\nexport interface ICircuitBreaker {\n  /**\n   * Get current circuit state\n   */\n  getState(): CircuitState;\n\n  /**\n   * Record a successful call\n   */\n  recordSuccess(): void;\n\n  /**\n   * Record a failed call\n   */\n  recordFailure(): void;\n\n  /**\n   * Check if circuit allows calls\n   */\n  allowRequest(): boolean;\n\n  /**\n   * Force open the circuit\n   */\n  forceOpen(): void;\n\n  /**\n   * Force close the circuit\n   */\n  forceClose(): void;\n\n  /**\n   * Get circuit statistics\n   */\n  getStats(): CircuitBreakerStats;\n}\n\n/**\n * Circuit breaker statistics\n */\nexport interface CircuitBreakerStats {\n  state: CircuitState;\n  failures: number;\n  successes: number;\n  consecutiveFailures: number;\n  lastFailureTime: number | null;\n  lastSuccessTime: number | null;\n  openedAt: number | null;\n}\n\n/**\n * GraphQL request options\n */\nexport interface GraphQLRequestOptions {\n  /**\n   * GraphQL query or mutation string\n   */\n  query: string;\n\n  /**\n   * GraphQL variables\n   */\n  variables?: Record<string, unknown>;\n\n  /**\n   * Operation name (for multi-operation documents)\n   */\n  operationName?: string;\n\n  /**\n   * Additional headers for this request\n   */\n  headers?: GatewayRequestHeaders;\n\n  /**\n   * Override timeout for this request\n   */\n  timeout?: number;\n\n  /**\n   * Skip circuit breaker for this request\n   * @default false\n   */\n  skipCircuitBreaker?: boolean;\n\n  /**\n   * Skip retry logic for this request\n   * @default false\n   */\n  skipRetry?: boolean;\n}\n\n/**\n * GraphQL response\n */\nexport interface GraphQLResponse<T = unknown> {\n  /**\n   * Response data\n   */\n  data?: T;\n\n  /**\n   * GraphQL errors\n   */\n  errors?: GraphQLError[];\n}\n\n/**\n * GraphQL error structure\n */\nexport interface GraphQLError {\n  message: string;\n  locations?: Array<{ line: number; column: number }>;\n  path?: Array<string | number>;\n  extensions?: Record<string, unknown>;\n}\n\n/**\n * Gateway client interface\n */\nexport interface IGatewayClient {\n  /**\n   * Execute internal (same layer) GraphQL query/mutation\n   *\n   * Uses internal gateway with bypass headers for M2M communication.\n   *\n   * @param options - Request options\n   * @returns GraphQL response\n   */\n  internalQuery<T = unknown>(options: GraphQLRequestOptions): Promise<GraphQLResponse<T>>;\n\n  /**\n   * Execute cross-layer GraphQL query/mutation\n   *\n   * Uses public gateway for cross-layer communication.\n   *\n   * @param options - Request options\n   * @returns GraphQL response\n   */\n  crossLayerQuery<T = unknown>(options: GraphQLRequestOptions): Promise<GraphQLResponse<T>>;\n\n  /**\n   * Execute GraphQL query/mutation with explicit gateway URL\n   *\n   * @param gatewayUrl - Gateway URL to use\n   * @param options - Request options\n   * @returns GraphQL response\n   */\n  query<T = unknown>(gatewayUrl: string, options: GraphQLRequestOptions): Promise<GraphQLResponse<T>>;\n\n  /**\n   * Get internal gateway circuit breaker\n   */\n  getInternalCircuitBreaker(): ICircuitBreaker;\n\n  /**\n   * Get cross-layer gateway circuit breaker\n   */\n  getCrossLayerCircuitBreaker(): ICircuitBreaker;\n\n  /**\n   * Get client health status\n   */\n  getHealthStatus(): GatewayClientHealth;\n\n  /**\n   * Update default headers\n   */\n  updateDefaultHeaders(headers: Partial<GatewayRequestHeaders>): void;\n}\n\n/**\n * Gateway client health status\n */\nexport interface GatewayClientHealth {\n  /**\n   * Internal gateway status\n   */\n  internal: {\n    url: string;\n    circuitState: CircuitState;\n    stats: CircuitBreakerStats;\n  };\n\n  /**\n   * Cross-layer gateway status\n   */\n  crossLayer: {\n    url: string;\n    circuitState: CircuitState;\n    stats: CircuitBreakerStats;\n  };\n}\n\n/**\n * Gateway error types\n */\nexport enum GatewayErrorType {\n  NETWORK_ERROR = 'NETWORK_ERROR',\n  TIMEOUT_ERROR = 'TIMEOUT_ERROR',\n  CIRCUIT_OPEN = 'CIRCUIT_OPEN',\n  GRAPHQL_ERROR = 'GRAPHQL_ERROR',\n  UNKNOWN_ERROR = 'UNKNOWN_ERROR',\n}\n\n/**\n * Gateway error class\n */\nexport class GatewayError extends Error {\n  type: GatewayErrorType;\n  gatewayUrl: string;\n  statusCode?: number;\n  graphqlErrors?: GraphQLError[];\n  override cause?: Error;\n\n  constructor(\n    message: string,\n    type: GatewayErrorType,\n    gatewayUrl: string,\n    options?: {\n      statusCode?: number;\n      graphqlErrors?: GraphQLError[];\n      cause?: Error;\n    }\n  ) {\n    super(message);\n    this.name = 'GatewayError';\n    this.type = type;\n    this.gatewayUrl = gatewayUrl;\n    this.statusCode = options?.statusCode;\n    this.graphqlErrors = options?.graphqlErrors;\n    this.cause = options?.cause;\n    Object.setPrototypeOf(this, GatewayError.prototype);\n  }\n}\n\n/**\n * Request context for logging and tracing\n */\nexport interface RequestContext {\n  /**\n   * Request ID for tracing\n   */\n  requestId: string;\n\n  /**\n   * Actor ID making the request\n   */\n  actorId?: string;\n\n  /**\n   * Workspace ID context\n   */\n  workspaceId?: string;\n\n  /**\n   * Timestamp when request started\n   */\n  startTime: number;\n\n  /**\n   * Call type\n   */\n  callType: 'internal' | 'cross-layer' | 'direct';\n}\n","/**\n * Unified Gateway Client\n *\n * Provides a layer-aware GraphQL client with circuit breaker,\n * retry logic, and automatic header management for M2M communication.\n *\n * @module gateway/client\n * @category Gateway\n *\n * @example\n * ```typescript\n * import { GatewayClient } from '@burdenoff/be-sdk/gateway';\n *\n * const client = new GatewayClient({\n *   layer: 'wspace',\n *   serviceName: 'wspace-tags-svc',\n * });\n *\n * // Internal call (same layer)\n * const result = await client.internalQuery({\n *   query: `query { getTag(id: \"123\") { id name } }`,\n * });\n *\n * // Cross-layer call\n * const authResult = await client.crossLayerQuery({\n *   query: `query { getCurrentUser { id email } }`,\n * });\n * ```\n */\n\nimport { LayerManager } from '../layer/index.js';\nimport { logger } from '../logger/index.js';\nimport { signServiceJwt } from './service-jwt.js';\nimport {\n  DEFAULT_CIRCUIT_BREAKER_CONFIG,\n  DEFAULT_GATEWAY_RETRY_CONFIG,\n  type CircuitBreakerConfig,\n  type GatewayRequestHeaders,\n  type GatewayRetryConfig,\n  type ServiceLayer,\n} from '../types/layer.js';\nimport {\n  CircuitState,\n  GatewayError,\n  GatewayErrorType,\n  type CircuitBreakerStats,\n  type GatewayClientConfig,\n  type GatewayClientHealth,\n  type GraphQLError,\n  type GraphQLRequestOptions,\n  type GraphQLResponse,\n  type ICircuitBreaker,\n  type IGatewayClient,\n  type RequestContext,\n} from './types.js';\n\nconst uuidv4 = (): string => crypto.randomUUID();\n\n/**\n * Case-insensitive presence check for the `Authorization` header. HTTP header\n * names are case-insensitive (RFC 7230), and while the outbound `fetch` will\n * preserve whatever casing the caller supplies, callers may legitimately set\n * `authorization` / `Authorization` / even `AUTHORIZATION` via defaultHeaders\n * or options.headers. We must not overwrite an already-supplied token.\n */\nfunction hasAuthorizationHeader(headers: Record<string, string>): boolean {\n  for (const key of Object.keys(headers)) {\n    if (key.toLowerCase() === 'authorization') return true;\n  }\n  return false;\n}\n\nexport function resolveBypassPermissionValue(\n  token: string | undefined = process.env['INTERNAL_SERVICE_TOKEN']\n): string {\n  const normalizedToken = token?.trim();\n\n  if (!normalizedToken) {\n    throw new Error('INTERNAL_SERVICE_TOKEN must be configured for bypass-enabled gateway calls');\n  }\n\n  return normalizedToken;\n}\n\n/**\n * Circuit Breaker Implementation\n */\nclass CircuitBreaker implements ICircuitBreaker {\n  private state: CircuitState = CircuitState.CLOSED;\n  private failures = 0;\n  private successes = 0;\n  private consecutiveFailures = 0;\n  private lastFailureTime: number | null = null;\n  private lastSuccessTime: number | null = null;\n  private openedAt: number | null = null;\n  private failureTimestamps: number[] = [];\n  private config: CircuitBreakerConfig;\n\n  constructor(config: CircuitBreakerConfig) {\n    this.config = config;\n  }\n\n  getState(): CircuitState {\n    this.checkStateTransition();\n    return this.state;\n  }\n\n  recordSuccess(): void {\n    this.successes++;\n    this.consecutiveFailures = 0;\n    this.lastSuccessTime = Date.now();\n\n    if (this.state === CircuitState.HALF_OPEN) {\n      this.state = CircuitState.CLOSED;\n      this.failures = 0;\n      this.failureTimestamps = [];\n      this.openedAt = null;\n      logger.info('[CircuitBreaker] Circuit closed after successful test');\n    }\n  }\n\n  recordFailure(): void {\n    this.failures++;\n    this.consecutiveFailures++;\n    this.lastFailureTime = Date.now();\n    this.failureTimestamps.push(Date.now());\n\n    // Clean up old timestamps\n    const windowStart = Date.now() - this.config.failureWindow;\n    this.failureTimestamps = this.failureTimestamps.filter((t) => t > windowStart);\n\n    // Check if we should open the circuit\n    if (this.state === CircuitState.CLOSED && this.failureTimestamps.length >= this.config.failureThreshold) {\n      this.state = CircuitState.OPEN;\n      this.openedAt = Date.now();\n      logger.warn('[CircuitBreaker] Circuit opened due to failures', {\n        failures: this.failureTimestamps.length,\n        threshold: this.config.failureThreshold,\n      });\n    }\n\n    // If we're half-open and fail, go back to open\n    if (this.state === CircuitState.HALF_OPEN) {\n      this.state = CircuitState.OPEN;\n      this.openedAt = Date.now();\n      logger.warn('[CircuitBreaker] Circuit re-opened after failed test');\n    }\n  }\n\n  allowRequest(): boolean {\n    this.checkStateTransition();\n\n    switch (this.state) {\n      case CircuitState.CLOSED:\n        return true;\n      case CircuitState.OPEN:\n        return false;\n      case CircuitState.HALF_OPEN:\n        // Allow one test request\n        return true;\n      default:\n        return true;\n    }\n  }\n\n  forceOpen(): void {\n    this.state = CircuitState.OPEN;\n    this.openedAt = Date.now();\n    logger.info('[CircuitBreaker] Circuit force-opened');\n  }\n\n  forceClose(): void {\n    this.state = CircuitState.CLOSED;\n    this.failures = 0;\n    this.consecutiveFailures = 0;\n    this.failureTimestamps = [];\n    this.openedAt = null;\n    logger.info('[CircuitBreaker] Circuit force-closed');\n  }\n\n  getStats(): CircuitBreakerStats {\n    return {\n      state: this.state,\n      failures: this.failures,\n      successes: this.successes,\n      consecutiveFailures: this.consecutiveFailures,\n      lastFailureTime: this.lastFailureTime,\n      lastSuccessTime: this.lastSuccessTime,\n      openedAt: this.openedAt,\n    };\n  }\n\n  private checkStateTransition(): void {\n    if (this.state === CircuitState.OPEN && this.openedAt) {\n      const elapsed = Date.now() - this.openedAt;\n      if (elapsed >= this.config.resetTimeout) {\n        this.state = CircuitState.HALF_OPEN;\n        logger.info('[CircuitBreaker] Circuit transitioning to half-open');\n      }\n    }\n  }\n}\n\n/**\n * Unified Gateway Client\n */\nexport class GatewayClient implements IGatewayClient {\n  private config: GatewayClientConfig;\n  private layerManager: LayerManager;\n  private internalCircuitBreaker: CircuitBreaker;\n  private crossLayerCircuitBreaker: CircuitBreaker;\n  private retryConfig: GatewayRetryConfig;\n  private defaultHeaders: GatewayRequestHeaders;\n\n  constructor(config: GatewayClientConfig) {\n    this.config = {\n      timeout: 30000,\n      enableLogging: true,\n      ...config,\n    };\n\n    // Initialize layer manager\n    this.layerManager = new LayerManager({\n      layer: config.layer,\n      serviceName: config.serviceName,\n      serviceIdentity: config.serviceIdentity,\n    });\n\n    // Override URLs if provided\n    if (config.internalGatewayUrl) {\n      // Use getter internally, but we'll store the override\n    }\n    if (config.crossLayerGatewayUrl) {\n      // Use getter internally, but we'll store the override\n    }\n\n    // Initialize circuit breakers\n    const cbConfig: CircuitBreakerConfig = {\n      ...DEFAULT_CIRCUIT_BREAKER_CONFIG,\n      ...config.circuitBreaker,\n    };\n    this.internalCircuitBreaker = new CircuitBreaker(cbConfig);\n    this.crossLayerCircuitBreaker = new CircuitBreaker(cbConfig);\n\n    // Initialize retry config\n    this.retryConfig = {\n      ...DEFAULT_GATEWAY_RETRY_CONFIG,\n      ...config.retry,\n    };\n\n    // Initialize default headers\n    this.defaultHeaders = {\n      'x-service-identity': this.layerManager.getServiceIdentity(),\n      'x-actor-type': 'service',\n      ...config.defaultHeaders,\n    };\n\n    logger.debug('[GatewayClient] Initialized', {\n      layer: config.layer,\n      serviceName: config.serviceName,\n      internalUrl: this.getInternalUrl(),\n      crossLayerUrl: this.getCrossLayerUrl(),\n    });\n  }\n\n  private getInternalUrl(): string {\n    return this.config.internalGatewayUrl || this.layerManager.getInternalGatewayUrl();\n  }\n\n  private getCrossLayerUrl(): string {\n    return this.config.crossLayerGatewayUrl || this.layerManager.getCrossLayerGatewayUrl();\n  }\n\n  /**\n   * Execute internal (same layer) GraphQL query/mutation\n   */\n  async internalQuery<T = unknown>(options: GraphQLRequestOptions): Promise<GraphQLResponse<T>> {\n    const context = this.createRequestContext('internal', options);\n\n    return this.executeWithRetry(this.getInternalUrl(), options, this.internalCircuitBreaker, context, {\n      bypassPermission: true,\n    });\n  }\n\n  /**\n   * Execute cross-layer GraphQL query/mutation\n   */\n  async crossLayerQuery<T = unknown>(options: GraphQLRequestOptions): Promise<GraphQLResponse<T>> {\n    const context = this.createRequestContext('cross-layer', options);\n\n    return this.executeWithRetry(\n      this.getCrossLayerUrl(),\n      options,\n      this.crossLayerCircuitBreaker,\n      context,\n      { bypassPermission: false } // Cross-layer calls go through public gateway\n    );\n  }\n\n  /**\n   * Execute GraphQL query/mutation with explicit gateway URL\n   */\n  async query<T = unknown>(gatewayUrl: string, options: GraphQLRequestOptions): Promise<GraphQLResponse<T>> {\n    const context = this.createRequestContext('direct', options);\n\n    // Use internal circuit breaker for direct calls\n    return this.executeWithRetry(gatewayUrl, options, this.internalCircuitBreaker, context, {\n      bypassPermission: false,\n    });\n  }\n\n  getInternalCircuitBreaker(): ICircuitBreaker {\n    return this.internalCircuitBreaker;\n  }\n\n  getCrossLayerCircuitBreaker(): ICircuitBreaker {\n    return this.crossLayerCircuitBreaker;\n  }\n\n  getHealthStatus(): GatewayClientHealth {\n    return {\n      internal: {\n        url: this.getInternalUrl(),\n        circuitState: this.internalCircuitBreaker.getState(),\n        stats: this.internalCircuitBreaker.getStats(),\n      },\n      crossLayer: {\n        url: this.getCrossLayerUrl(),\n        circuitState: this.crossLayerCircuitBreaker.getState(),\n        stats: this.crossLayerCircuitBreaker.getStats(),\n      },\n    };\n  }\n\n  updateDefaultHeaders(headers: Partial<GatewayRequestHeaders>): void {\n    this.defaultHeaders = { ...this.defaultHeaders, ...headers };\n  }\n\n  private createRequestContext(\n    callType: 'internal' | 'cross-layer' | 'direct',\n    options: GraphQLRequestOptions\n  ): RequestContext {\n    return {\n      requestId: uuidv4(),\n      actorId: options.headers?.['x-actor-id'] || this.defaultHeaders['x-actor-id'],\n      workspaceId: options.headers?.['x-workspace-id'] || this.defaultHeaders['x-workspace-id'],\n      startTime: Date.now(),\n      callType,\n    };\n  }\n\n  /**\n   * Check if an error should be retried\n   */\n  private shouldRetryError(error: unknown): boolean {\n    if (!(error instanceof GatewayError)) {\n      return true;\n    }\n    // Don't retry GraphQL errors or circuit open errors\n    return error.type !== GatewayErrorType.GRAPHQL_ERROR && error.type !== GatewayErrorType.CIRCUIT_OPEN;\n  }\n\n  /**\n   * Calculate retry delay with exponential backoff\n   */\n  private calculateRetryDelay(attempt: number): number {\n    return Math.min(\n      this.retryConfig.initialDelay * Math.pow(this.retryConfig.backoffMultiplier, attempt - 1),\n      this.retryConfig.maxDelay\n    );\n  }\n\n  /**\n   * Log retry attempt if logging is enabled\n   */\n  private logRetryAttempt(\n    context: RequestContext,\n    attempt: number,\n    maxAttempts: number,\n    delay: number,\n    error: Error\n  ): void {\n    if (this.config.enableLogging) {\n      logger.warn('[GatewayClient] Request failed, retrying', {\n        requestId: context.requestId,\n        attempt,\n        maxAttempts,\n        delay,\n        error: error.message,\n      });\n    }\n  }\n\n  private async executeWithRetry<T>(\n    gatewayUrl: string,\n    options: GraphQLRequestOptions,\n    circuitBreaker: CircuitBreaker,\n    context: RequestContext,\n    settings: { bypassPermission: boolean }\n  ): Promise<GraphQLResponse<T>> {\n    // Check circuit breaker\n    if (!options.skipCircuitBreaker && !circuitBreaker.allowRequest()) {\n      throw new GatewayError(`Circuit breaker is open for ${gatewayUrl}`, GatewayErrorType.CIRCUIT_OPEN, gatewayUrl);\n    }\n\n    const maxAttempts = options.skipRetry ? 1 : this.retryConfig.maxAttempts;\n    let lastError: Error | null = null;\n\n    for (let attempt = 1; attempt <= maxAttempts; attempt++) {\n      try {\n        const result = await this.executeRequest<T>(gatewayUrl, options, context, settings.bypassPermission);\n        if (!options.skipCircuitBreaker) {\n          circuitBreaker.recordSuccess();\n        }\n        return result;\n      } catch (error) {\n        lastError = error instanceof Error ? error : new Error(String(error));\n        if (!options.skipCircuitBreaker) {\n          circuitBreaker.recordFailure();\n        }\n\n        if (!this.shouldRetryError(error)) {\n          throw error;\n        }\n\n        if (attempt < maxAttempts) {\n          const delay = this.calculateRetryDelay(attempt);\n          this.logRetryAttempt(context, attempt, maxAttempts, delay, lastError);\n          await this.sleep(delay);\n        }\n      }\n    }\n\n    throw lastError || new GatewayError('Request failed after retries', GatewayErrorType.UNKNOWN_ERROR, gatewayUrl);\n  }\n\n  /**\n   * Build headers for a request\n   */\n  private buildRequestHeaders(\n    context: RequestContext,\n    options: GraphQLRequestOptions,\n    bypassPermission: boolean\n  ): Record<string, string> {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      'x-request-id': context.requestId,\n      'x-call-type': context.callType,\n    };\n\n    // Add default headers\n    for (const [key, value] of Object.entries(this.defaultHeaders)) {\n      if (value !== undefined) {\n        headers[key] = String(value);\n      }\n    }\n\n    // Add request-specific headers\n    if (options.headers) {\n      for (const [key, value] of Object.entries(options.headers)) {\n        if (value !== undefined) {\n          headers[key] = String(value);\n        }\n      }\n    }\n\n    // Add bypass headers for internal calls\n    if (bypassPermission) {\n      headers['x-bypass-permission'] = resolveBypassPermissionValue();\n      headers['x-bypass-source'] = this.layerManager.getServiceIdentity();\n      headers['x-bypass-timestamp'] = Date.now().toString();\n    }\n\n    return headers;\n  }\n\n  /**\n   * Handle GraphQL errors in response\n   */\n  private handleGraphQLErrors<T>(\n    result: GraphQLResponse<T>,\n    context: RequestContext,\n    gatewayUrl: string,\n    duration: number\n  ): void {\n    if (!result.errors || result.errors.length === 0) {\n      return;\n    }\n\n    const errorMessages = result.errors.map((e: GraphQLError) => e.message).join(', ');\n\n    if (this.config.enableLogging) {\n      logger.warn('[GatewayClient] GraphQL errors', {\n        requestId: context.requestId,\n        errors: result.errors,\n        duration,\n      });\n    }\n\n    throw new GatewayError(`GraphQL error: ${errorMessages}`, GatewayErrorType.GRAPHQL_ERROR, gatewayUrl, {\n      graphqlErrors: result.errors,\n    });\n  }\n\n  /**\n   * Handle fetch errors\n   */\n  private handleFetchError(\n    error: unknown,\n    context: RequestContext,\n    gatewayUrl: string,\n    timeout: number,\n    duration: number\n  ): never {\n    if (error instanceof GatewayError) {\n      throw error;\n    }\n\n    if (error instanceof Error) {\n      if (error.name === 'AbortError') {\n        throw new GatewayError(`Request timed out after ${timeout}ms`, GatewayErrorType.TIMEOUT_ERROR, gatewayUrl, {\n          cause: error,\n        });\n      }\n\n      if (this.config.enableLogging) {\n        logger.error('[GatewayClient] Request failed', {\n          requestId: context.requestId,\n          error: error.message,\n          duration,\n        });\n      }\n\n      throw new GatewayError(error.message, GatewayErrorType.NETWORK_ERROR, gatewayUrl, {\n        cause: error,\n      });\n    }\n\n    throw new GatewayError(String(error), GatewayErrorType.UNKNOWN_ERROR, gatewayUrl);\n  }\n\n  private async executeRequest<T>(\n    gatewayUrl: string,\n    options: GraphQLRequestOptions,\n    context: RequestContext,\n    bypassPermission: boolean\n  ): Promise<GraphQLResponse<T>> {\n    const timeout = options.timeout || this.config.timeout || 30000;\n    const headers = this.buildRequestHeaders(context, options, bypassPermission);\n\n    // Cross-layer calls transit the peer layer's PUBLIC gateway, which\n    // requires JWT auth to propagate actor context. Mint a short-lived\n    // service-actor JWT so the gateway admits the call and preserves\n    // `x-actor-type: service` downstream. Skipped when the caller has\n    // already supplied an Authorization header (e.g., user-originated\n    // cross-layer flows) or when SERVICE_JWT_SECRET is unset.\n    if (context.callType === 'cross-layer' && !hasAuthorizationHeader(headers)) {\n      const serviceActorId = this.layerManager.getServiceIdentity();\n      const serviceJwt = await signServiceJwt(serviceActorId);\n      if (serviceJwt) {\n        headers['Authorization'] = `Bearer ${serviceJwt}`;\n      } else if (this.config.enableLogging) {\n        // Subtle failure mode: without the JWT the public gateway strips\n        // actor headers and the subgraph rejects with `authenticationRequired`.\n        // Surface the root cause so operators rolling out a new caller don't\n        // spend time debugging the downstream error.\n        logger.debug(\n          '[GatewayClient] SERVICE_JWT_SECRET not configured — cross-layer call will proceed without service JWT',\n          { requestId: context.requestId, gatewayUrl }\n        );\n      }\n    }\n\n    const body = JSON.stringify({\n      query: options.query,\n      variables: options.variables || {},\n      operationName: options.operationName,\n    });\n\n    if (this.config.enableLogging) {\n      logger.debug('[GatewayClient] Executing request', {\n        requestId: context.requestId,\n        gatewayUrl,\n        operationName: options.operationName,\n        callType: context.callType,\n        bypassPermission,\n      });\n    }\n\n    try {\n      const controller = new AbortController();\n      const timeoutId = setTimeout(() => controller.abort(), timeout);\n\n      const response = await fetch(gatewayUrl, {\n        method: 'POST',\n        headers,\n        body,\n        signal: controller.signal,\n      });\n\n      clearTimeout(timeoutId);\n      const duration = Date.now() - context.startTime;\n\n      if (!response.ok) {\n        throw new GatewayError(\n          `HTTP ${response.status}: ${response.statusText}`,\n          GatewayErrorType.NETWORK_ERROR,\n          gatewayUrl,\n          { statusCode: response.status }\n        );\n      }\n\n      const result = (await response.json()) as GraphQLResponse<T>;\n      this.handleGraphQLErrors(result, context, gatewayUrl, duration);\n\n      if (this.config.enableLogging) {\n        logger.debug('[GatewayClient] Request completed', {\n          requestId: context.requestId,\n          duration,\n          hasData: !!result.data,\n        });\n      }\n\n      return result;\n    } catch (error) {\n      const duration = Date.now() - context.startTime;\n      this.handleFetchError(error, context, gatewayUrl, timeout, duration);\n    }\n  }\n\n  private sleep(ms: number): Promise<void> {\n    return new Promise((resolve) => setTimeout(resolve, ms));\n  }\n}\n\n/**\n * Create a gateway client for a specific layer\n */\nexport function createGatewayClient(config: GatewayClientConfig): GatewayClient {\n  return new GatewayClient(config);\n}\n\n/**\n * Create a gateway client from environment variables\n *\n * Required environment variables:\n * - SERVICE_LAYER: 'wspace' | 'global'\n * - SERVICE_NAME: Service name\n *\n * Optional:\n * - SERVICE_IDENTITY: Service identity (defaults to SERVICE_NAME)\n * - {LAYER}_INT_GATEWAY_URL: Internal gateway URL\n * - {OPPOSITE_LAYER}_PUBLIC_GATEWAY_URL: Cross-layer gateway URL\n */\nexport function createGatewayClientFromEnv(): GatewayClient {\n  const layer = process.env['SERVICE_LAYER'] as ServiceLayer;\n\n  if (!layer || (layer !== 'wspace' && layer !== 'global')) {\n    throw new Error(`[GatewayClient] Invalid or missing SERVICE_LAYER. Expected 'wspace' or 'global', got '${layer}'`);\n  }\n\n  const serviceName = process.env['SERVICE_NAME'];\n  if (!serviceName) {\n    throw new Error('[GatewayClient] SERVICE_NAME environment variable is required');\n  }\n\n  const serviceIdentity = process.env['SERVICE_IDENTITY'] || serviceName;\n\n  return new GatewayClient({\n    layer,\n    serviceName,\n    serviceIdentity,\n  });\n}\n"]}

package/dist/{chunk-75VTKG4Q.js → chunk-U2GLUZAO.js}

@@ -1,5 +1,5 @@
-import { GatewayClient } from './chunk-U455UF4O.js';
-import { LayerManager } from './chunk-HIWTWIGQ.js';
+import { GatewayClient } from './chunk-TXW7ZKA2.js';
+import { LayerManager } from './chunk-UIJWXPOQ.js';
 import { logger } from './chunk-CBZNP6RF.js';
 import { __export, __name } from './chunk-XE4OXN2W.js';
 
@@ -38,8 +38,6 @@ async function initializeBurdenoffSDK(config) {
       valkey,
       clickhouse,
       eventPublisher,
-      // Deprecated alias kept for one release; remove after svcs migrate to `eventPublisher`.
-      nats: eventPublisher,
       layerManager,
       gatewayClient,
       graphSyncEnabled: config.graph?.enabled ?? false,
@@ -239,5 +237,5 @@ async function initializeLayerStreams(config) {
 __name(initializeLayerStreams, "initializeLayerStreams");
 
 export { getSDKState, init_exports, initializeBurdenoffSDK, isSDKInitialized, resetSDK };
-//# sourceMappingURL=chunk-75VTKG4Q.js.map
-//# sourceMappingURL=chunk-75VTKG4Q.js.map
+//# sourceMappingURL=chunk-U2GLUZAO.js.map
+//# sourceMappingURL=chunk-U2GLUZAO.js.map

package/dist/chunk-U2GLUZAO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/init/index.ts"],"names":["sdkState","isInitialized","initializeBurdenoffSDK","config","logger","warn","info","startTime","Date","now","initializeLogging","layerManager","gatewayClient","initializeLayer","prisma","initializeDatabase","valkey","initializeCache","eventPublisher","initializeEventQueue","layer","autoCreateStreams","initializeLayerStreams","graphSync","initializeGraphSync","clickhouse","initializeAnalytics","initializeObservability","graphSyncEnabled","graph","enabled","analyticsEnabled","analytics","observabilityEnabled","observability","metrics","layerAwareEnabled","duration","initializedState","type","serviceName","error","getSDKState","Error","isSDKInitialized","resetSDK","loggingConfig","logging","isDevelopment","app","nodeEnv","level","setLevel","console","setConsoleEnabled","format","database","url","maxConnections","enableQueryLogging","undefined","cacheConfig","cache","defaultTTL","_config","process","env","EventQueueFactory","publisher","createPublisherFromEnv","connect","message","String","note","eventsEnabled","productSource","streamName","syncInterval","batchSize","requestTimeout","openTelemetry","port","endpoint","samplingRate","LayerManager","serviceIdentity","GatewayClient","internalGatewayUrl","getInternalGatewayUrl","crossLayerGatewayUrl","getCrossLayerGatewayUrl","debug"],"mappings":";;;;;;AAAA,IAAA,YAAA,GAAA;;;;;;;AAkBA,IAAIA,QAAAA,GAAuC,IAAA;AAC3C,IAAIC,aAAAA,GAAgB,KAAA;AAsCpB,eAAsBC,uBAAuBC,MAAAA,EAA8B;AACzE,EAAA,IAAIF,iBAAiBD,QAAAA,EAAU;AAC7BI,IAAAA,MAAAA,CAAOC,KAAK,8DAAA,CAAA;AACZ,IAAA,OAAOL,QAAAA;AACT,EAAA;AAEAI,EAAAA,MAAAA,CAAOE,KAAK,2CAAA,CAAA;AACZ,EAAA,MAAMC,SAAAA,GAAYC,KAAKC,GAAAA,EAAG;AAE1B,EAAA,IAAI;AAEF,IAAA,MAAMC,kBAAkBP,MAAAA,CAAAA;AAGxB,IAAA,MAAM,EAAEQ,YAAAA,EAAcC,aAAAA,EAAa,GAAK,MAAMC,gBAAgBV,MAAAA,CAAAA;AAG9D,IAAA,MAAMW,MAAAA,GAAS,MAAMC,kBAAAA,CAAmBZ,MAAAA,CAAAA;AAGxC,IAAA,MAAMa,MAAAA,GAAS,MAAMC,eAAAA,CAAgBd,MAAAA,CAAAA;AAGrC,IAAA,MAAMe,cAAAA,GAAiB,MAAMC,oBAAAA,CAAqBhB,MAAAA,CAAAA;AAGlD,IAAA,IAAIA,MAAAA,CAAOiB,KAAAA,EAAOC,iBAAAA,KAAsB,KAAA,IAASlB,OAAOiB,KAAAA,EAAO;AAC7D,MAAA,MAAME,uBAAuBnB,MAAAA,CAAAA;AAC/B,IAAA;AAIA,IAAA,MAAMoB,SAAAA,GAAY,MAAMC,mBAAAA,CAAoBrB,MAAAA,CAAAA;AAG5C,IAAA,MAAMsB,UAAAA,GAAa,MAAMC,mBAAAA,CAAoBvB,MAAAA,CAAAA;AAG7C,IAAA,MAAMwB,wBAAwBxB,MAAAA,CAAAA;AAK9B,IAAA,KAAKoB,SAAAA;AACLvB,IAAAA,QAAAA,GAAW;AACTc,MAAAA,MAAAA;AACAE,MAAAA,MAAAA;AACAS,MAAAA,UAAAA;AACAP,MAAAA,cAAAA;AACAP,MAAAA,YAAAA;AACAC,MAAAA,aAAAA;MACAgB,gBAAAA,EAAkBzB,MAAAA,CAAO0B,OAAOC,OAAAA,IAAW,KAAA;MAC3CC,gBAAAA,EAAkB,CAAC,CAAC5B,MAAAA,CAAO6B,SAAAA,EAAWP,UAAAA;MACtCQ,oBAAAA,EAAsB9B,MAAAA,CAAO+B,aAAAA,EAAeC,OAAAA,EAASL,OAAAA,IAAW,KAAA;MAChEM,iBAAAA,EAAmB,CAAC,CAACjC,MAAAA,CAAOiB;AAC9B,KAAA;AAEAnB,IAAAA,aAAAA,GAAgB,IAAA;AAEhB,IAAA,MAAMoC,QAAAA,GAAW7B,IAAAA,CAAKC,GAAAA,EAAG,GAAKF,SAAAA;AAE9B,IAAA,MAAM+B,gBAAAA,GAAmBtC,QAAAA;AACzBI,IAAAA,MAAAA,CAAOE,IAAAA,CAAK,CAAA,2CAAA,EAA8C+B,QAAAA,CAAAA,EAAAA,CAAAA,EAAc;AACtET,MAAAA,gBAAAA,EAAkBU,gBAAAA,CAAiBV,gBAAAA;AACnCG,MAAAA,gBAAAA,EAAkBO,gBAAAA,CAAiBP,gBAAAA;AACnCE,MAAAA,oBAAAA,EAAsBK,gBAAAA,CAAiBL,oBAAAA;AACvCG,MAAAA,iBAAAA,EAAmBE,gBAAAA,CAAiBF,iBAAAA;AACpChB,MAAAA,KAAAA,EAAOjB,OAAOiB,KAAAA,EAAOmB,IAAAA;AACrBC,MAAAA,WAAAA,EAAarC,OAAOiB,KAAAA,EAAOoB;KAC7B,CAAA;AAEA,IAAA,OAAOF,gBAAAA;AACT,EAAA,CAAA,CAAA,OAASG,KAAAA,EAAO;AACdrC,IAAAA,MAAAA,CAAOqC,KAAAA,CAAM,wCAAwCA,KAAAA,CAAAA;AACrD,IAAA,MAAMA,KAAAA;AACR,EAAA;AACF;AA5EsBvC,MAAAA,CAAAA,sBAAAA,EAAAA,wBAAAA,CAAAA;AAkFf,SAASwC,WAAAA,GAAAA;AACd,EAAA,IAAI,CAACzC,aAAAA,IAAiB,CAACD,QAAAA,EAAU;AAC/B,IAAA,MAAM,IAAI2C,MAAM,2DAAA,CAAA;AAClB,EAAA;AACA,EAAA,OAAO3C,QAAAA;AACT;AALgB0C,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;AAUT,SAASE,gBAAAA,GAAAA;AACd,EAAA,OAAO3C,aAAAA;AACT;AAFgB2C,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAOhB,eAAsBC,QAAAA,GAAAA;AACpBzC,EAAAA,MAAAA,CAAOE,KAAK,mCAAA,CAAA;AAEZ,EAAA,IAAIN,QAAAA,EAAU;AAGZA,IAAAA,QAAAA,GAAW,IAAA;AACb,EAAA;AAEAC,EAAAA,aAAAA,GAAgB,KAAA;AAChBG,EAAAA,MAAAA,CAAOE,KAAK,4BAAA,CAAA;AACd;AAXsBuC,MAAAA,CAAAA,QAAAA,EAAAA,UAAAA,CAAAA;AAgBtB,eAAenC,kBAAkBP,MAAAA,EAA8B;AAC7DC,EAAAA,MAAAA,CAAOE,KAAK,mCAAA,CAAA;AAEZ,EAAA,MAAMwC,aAAAA,GAAgB3C,MAAAA,CAAO4C,OAAAA,IAAW,EAAC;AACzC,EAAA,MAAMC,aAAAA,GAAgB7C,MAAAA,CAAO8C,GAAAA,EAAKC,OAAAA,KAAY,aAAA;AAG9C,EAAA,MAAMC,KAAAA,GAAQL,cAAcK,KAAAA,IAAS,MAAA;AACrC/C,EAAAA,MAAAA,CAAOgD,SAASD,KAAAA,CAAAA;AAGhB,EAAA,MAAME,OAAAA,GAAUP,cAAcO,OAAAA,IAAW,IAAA;AACzCjD,EAAAA,MAAAA,CAAOkD,kBAAkBD,OAAAA,CAAAA;AAEzBjD,EAAAA,MAAAA,CAAOE,KAAK,+BAAA,EAAiC;AAC3C6C,IAAAA,KAAAA;AACAE,IAAAA,OAAAA;IACAE,MAAAA,EAAQT,aAAAA,CAAcS,MAAAA,KAAWP,aAAAA,GAAgB,QAAA,GAAW,MAAA;GAC9D,CAAA;AACF;AAnBetC,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAwBf,eAAeK,mBAAmBZ,MAAAA,EAA8B;AAC9DC,EAAAA,MAAAA,CAAOE,KAAK,qCAAA,CAAA;AAKZ,EAAA,IAAI,CAACH,MAAAA,CAAOqD,QAAAA,EAAUC,GAAAA,EAAK;AACzB,IAAA,MAAM,IAAId,MAAM,0BAAA,CAAA;AAClB,EAAA;AAEAvC,EAAAA,MAAAA,CAAOE,KAAK,6CAAA,EAA+C;IACzDoD,cAAAA,EAAgBvD,MAAAA,CAAOqD,SAASE,cAAAA,IAAkB,EAAA;IAClDC,kBAAAA,EAAoBxD,MAAAA,CAAOqD,SAASG,kBAAAA,IAAsB;GAC5D,CAAA;AAGA,EAAA,OAAOC,MAAAA;AACT;AAjBe7C,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA;AAsBf,eAAeE,gBAAgBd,MAAAA,EAA8B;AAC3D,EAAA,MAAM0D,WAAAA,GAAc1D,OAAO2D,KAAAA,EAAO9C,MAAAA;AAElC,EAAA,IAAI,CAAC6C,WAAAA,EAAa;AAChBzD,IAAAA,MAAAA,CAAOE,KAAK,2CAAA,CAAA;AACZ,IAAA,OAAOsD,MAAAA;AACT,EAAA;AAEAxD,EAAAA,MAAAA,CAAOE,KAAK,yCAAA,CAAA;AAIZF,EAAAA,MAAAA,CAAOE,KAAK,iDAAA,EAAmD;IAC7DmD,GAAAA,EAAKI,WAAAA,CAAYJ,MAAM,KAAA,GAAQG,MAAAA;AAC/BG,IAAAA,UAAAA,EAAYF,YAAYE,UAAAA,IAAc;GACxC,CAAA;AAEA,EAAA,OAAOH,MAAAA;AACT;AAlBe3C,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AA2Bf,eAAeE,qBAAqB6C,OAAAA,EAA+B;AACjE,EAAA,IAAI,CAACC,OAAAA,CAAQC,GAAAA,CAAI,WAAA,CAAA,EAAc;AAC7B9D,IAAAA,MAAAA,CAAOE,KAAK,yDAAA,CAAA;AACZ,IAAA,OAAOsD,MAAAA;AACT,EAAA;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,EAAEO,iBAAAA,EAAiB,GAAK,MAAM,OAAO,iCAAA,CAAA;AAC3C,IAAA,MAAMC,SAAAA,GAAYD,kBAAkBE,sBAAAA,EAAsB;AAC1D,IAAA,MAAMD,UAAUE,OAAAA,EAAO;AAEvBlE,IAAAA,MAAAA,CAAOE,KAAK,oDAAA,CAAA;AAEZ,IAAA,OAAO8D,SAAAA;AACT,EAAA,CAAA,CAAA,OAAS3B,KAAAA,EAAO;AACdrC,IAAAA,MAAAA,CAAOC,KAAK,wEAAA,EAA0E;AACpFoC,MAAAA,KAAAA,EAAOA,KAAAA,YAAiBE,KAAAA,GAAQF,KAAAA,CAAM8B,OAAAA,GAAUC,OAAO/B,KAAAA,CAAAA;MACvDgC,IAAAA,EAAM;KACR,CAAA;AACA,IAAA,OAAOb,MAAAA;AACT,EAAA;AACF;AArBezC,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AA+Bf,eAAeK,oBAAoBrB,MAAAA,EAA8B;AAC/D,EAAA,IAAI,CAACA,MAAAA,CAAO0B,KAAAA,EAAOC,OAAAA,EAAS;AAC1B1B,IAAAA,MAAAA,CAAOE,KAAK,6CAAA,CAAA;AACZ,IAAA,OAAOsD,MAAAA;AACT,EAAA;AAEAxD,EAAAA,MAAAA,CAAOE,KAAK,qDAAA,EAAuD;IACjEoE,aAAAA,EAAevE,MAAAA,CAAO0B,MAAM6C,aAAAA,IAAiB,IAAA;AAC7CC,IAAAA,aAAAA,EAAexE,OAAO0B,KAAAA,CAAM8C,aAAAA;IAC5BC,UAAAA,EAAYzE,MAAAA,CAAO0B,MAAM+C,UAAAA,IAAc,cAAA;IACvCC,YAAAA,EAAc1E,MAAAA,CAAO0B,MAAMgD,YAAAA,IAAgB,GAAA;IAC3CC,SAAAA,EAAW3E,MAAAA,CAAO0B,MAAMiD,SAAAA,IAAa;GACvC,CAAA;AAEA,EAAA,OAAOlB,MAAAA;AACT;AAfepC,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAoBf,eAAeE,oBAAoBvB,MAAAA,EAA8B;AAC/D,EAAA,IAAI,CAACA,MAAAA,CAAO6B,SAAAA,EAAWP,UAAAA,EAAY;AACjCrB,IAAAA,MAAAA,CAAOE,KAAK,+CAAA,CAAA;AACZ,IAAA,OAAOsD,MAAAA;AACT,EAAA;AAEAxD,EAAAA,MAAAA,CAAOE,KAAK,qDAAA,CAAA;AAIZF,EAAAA,MAAAA,CAAOE,KAAK,+CAAA,EAAiD;IAC3DmD,GAAAA,EAAKtD,MAAAA,CAAO6B,UAAUP,UAAAA,CAAWgC,GAAAA;IACjCD,QAAAA,EAAUrD,MAAAA,CAAO6B,UAAUP,UAAAA,CAAW+B,QAAAA;IACtCuB,cAAAA,EAAgB5E,MAAAA,CAAO6B,SAAAA,CAAUP,UAAAA,CAAWsD,cAAAA,IAAkB;GAChE,CAAA;AAEA,EAAA,OAAOnB,MAAAA;AACT;AAjBelC,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAsBf,eAAeC,wBAAwBxB,MAAAA,EAA8B;AACnE,EAAA,IAAI,CAACA,OAAO+B,aAAAA,EAAeC,OAAAA,EAASL,WAAW,CAAC3B,MAAAA,CAAO+B,aAAAA,EAAe8C,aAAAA,EAAelD,OAAAA,EAAS;AAC5F1B,IAAAA,MAAAA,CAAOE,KAAK,mDAAA,CAAA;AACZ,IAAA;AACF,EAAA;AAEAF,EAAAA,MAAAA,CAAOE,KAAK,0CAAA,CAAA;AAIZ,EAAA,IAAIH,MAAAA,CAAO+B,aAAAA,CAAcC,OAAAA,EAASL,OAAAA,EAAS;AACzC1B,IAAAA,MAAAA,CAAOE,KAAK,4CAAA,EAA8C;MACxD2E,IAAAA,EAAM9E,MAAAA,CAAO+B,aAAAA,CAAcC,OAAAA,CAAQ8C,IAAAA,IAAQ,IAAA;MAC3CC,QAAAA,EAAU/E,MAAAA,CAAO+B,aAAAA,CAAcC,OAAAA,CAAQ+C,QAAAA,IAAY;KACrD,CAAA;AACF,EAAA;AAEA,EAAA,IAAI/E,MAAAA,CAAO+B,aAAAA,CAAc8C,aAAAA,EAAelD,OAAAA,EAAS;AAC/C1B,IAAAA,MAAAA,CAAOE,KAAK,kDAAA,EAAoD;MAC9DkC,WAAAA,EAAarC,MAAAA,CAAO+B,cAAc8C,aAAAA,CAAcxC,WAAAA;MAChD2C,YAAAA,EAAchF,MAAAA,CAAO+B,aAAAA,CAAc8C,aAAAA,CAAcG,YAAAA,IAAgB;KACnE,CAAA;AACF,EAAA;AACF;AAvBexD,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AA4Bf,eAAed,gBACbV,MAAAA,EAA8B;AAE9B,EAAA,IAAI,CAACA,OAAOiB,KAAAA,EAAO;AACjBhB,IAAAA,MAAAA,CAAOE,KAAK,4EAAA,CAAA;AACZ,IAAA,OAAO,EAAC;AACV,EAAA;AAEAF,EAAAA,MAAAA,CAAOE,KAAK,0CAAA,EAA4C;AACtDc,IAAAA,KAAAA,EAAOjB,OAAOiB,KAAAA,CAAMmB,IAAAA;AACpBC,IAAAA,WAAAA,EAAarC,OAAOiB,KAAAA,CAAMoB;GAC5B,CAAA;AAGA,EAAA,MAAM7B,YAAAA,GAAe,IAAIyE,YAAAA,CAAa;AACpChE,IAAAA,KAAAA,EAAOjB,OAAOiB,KAAAA,CAAMmB,IAAAA;AACpBC,IAAAA,WAAAA,EAAarC,OAAOiB,KAAAA,CAAMoB,WAAAA;AAC1B6C,IAAAA,eAAAA,EAAiBlF,OAAOiB,KAAAA,CAAMiE;GAChC,CAAA;AAGA,EAAA,MAAMzE,aAAAA,GAAgB,IAAI0E,aAAAA,CAAc;AACtClE,IAAAA,KAAAA,EAAOjB,OAAOiB,KAAAA,CAAMmB,IAAAA;AACpBC,IAAAA,WAAAA,EAAarC,OAAOiB,KAAAA,CAAMoB,WAAAA;AAC1B6C,IAAAA,eAAAA,EAAiBlF,OAAOiB,KAAAA,CAAMiE,eAAAA;AAC9BE,IAAAA,kBAAAA,EAAoB5E,aAAa6E,qBAAAA,EAAqB;AACtDC,IAAAA,oBAAAA,EAAsB9E,aAAa+E,uBAAAA;GACrC,CAAA;AAEAtF,EAAAA,MAAAA,CAAOE,KAAK,sCAAA,EAAwC;AAClDc,IAAAA,KAAAA,EAAOjB,OAAOiB,KAAAA,CAAMmB,IAAAA;AACpBC,IAAAA,WAAAA,EAAarC,OAAOiB,KAAAA,CAAMoB,WAAAA;AAC1B+C,IAAAA,kBAAAA,EAAoB5E,aAAa6E,qBAAAA,EAAqB;AACtDC,IAAAA,oBAAAA,EAAsB9E,aAAa+E,uBAAAA;GACrC,CAAA;AAEA,EAAA,OAAO;AAAE/E,IAAAA,YAAAA;AAAcC,IAAAA;AAAc,GAAA;AACvC;AArCeC,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AA8Cf,eAAeS,uBAAuBnB,MAAAA,EAA8B;AAClE,EAAA,IAAI,CAACA,OAAOiB,KAAAA,EAAO;AACjB,IAAA;AACF,EAAA;AACAhB,EAAAA,MAAAA,CAAOuF,MAAM,gGAAA,EAAkG;AAC7GvE,IAAAA,KAAAA,EAAOjB,OAAOiB,KAAAA,CAAMmB;GACtB,CAAA;AACF;AAPejB,MAAAA,CAAAA,sBAAAA,EAAAA,wBAAAA,CAAAA","file":"chunk-U2GLUZAO.js","sourcesContent":["/**\n * Burdenoff SDK Initialization Module\n *\n * Provides a unified initialization function for all state services\n * including database, cache, analytics, event queue, and graph sync.\n *\n * @module init\n * @category Initialization\n */\n\nimport { logger } from '../logger/index.js';\nimport { LayerManager } from '../layer/index.js';\nimport { GatewayClient } from '../gateway/index.js';\nimport type { BurdenoffSDKInitConfig, InitializedSDKState } from './types.js';\n\n/**\n * Global SDK state\n */\nlet sdkState: InitializedSDKState | null = null;\nlet isInitialized = false;\n\n/**\n * Initialize Burdenoff SDK with unified configuration\n *\n * This function initializes all configured state services in the correct order:\n * 1. Logging configuration\n * 2. Database (Prisma with PostgreSQL)\n * 3. Cache (Valkey)\n * 4. Event Queue (Redis Streams)\n * 5. Graph Sync (Redis Streams-based — NebulaGraph writes happen inside wspace-graph-svc)\n * 6. Analytics (ClickHouse)\n * 7. Observability (Metrics, OpenTelemetry)\n *\n * @param config - SDK initialization configuration\n * @returns Initialized SDK state\n *\n * @example\n * ```typescript\n * import { initializeBurdenoffSDK } from '@burdenoff/be-sdk/init';\n *\n * const state = await initializeBurdenoffSDK({\n *   database: {\n *     url: process.env.DATABASE_URL!,\n *     maxConnections: 20,\n *   },\n *   graph: {\n *     enabled: true,\n *     eventsEnabled: true,\n *   },\n *   cache: {\n *     valkey: {\n *       url: process.env.VALKEY_URL!,\n *     },\n *   },\n * });\n * ```\n */\nexport async function initializeBurdenoffSDK(config: BurdenoffSDKInitConfig): Promise<InitializedSDKState> {\n  if (isInitialized && sdkState) {\n    logger.warn('[SDK Init] SDK already initialized, returning existing state');\n    return sdkState;\n  }\n\n  logger.info('[SDK Init] Starting SDK initialization...');\n  const startTime = Date.now();\n\n  try {\n    // 1. Configure logging\n    await initializeLogging(config);\n\n    // 2. Initialize layer manager (if configured)\n    const { layerManager, gatewayClient } = await initializeLayer(config);\n\n    // 3. Initialize database (required)\n    const prisma = await initializeDatabase(config);\n\n    // 4. Initialize cache (optional)\n    const valkey = await initializeCache(config);\n\n    // 5. Initialize event queue (optional) — Redis Streams via REDIS_URL\n    const eventPublisher = await initializeEventQueue(config);\n\n    // 6. Initialize layer streams (if layer configured)\n    if (config.layer?.autoCreateStreams !== false && config.layer) {\n      await initializeLayerStreams(config);\n    }\n\n    // 7. Initialize graph sync (optional) — publisher emits to Redis Streams,\n    //    never opens a graph-DB connection\n    const graphSync = await initializeGraphSync(config);\n\n    // 8. Initialize analytics (optional)\n    const clickhouse = await initializeAnalytics(config);\n\n    // 9. Initialize observability (optional)\n    await initializeObservability(config);\n\n    // Create SDK state\n    // graphSync is a publisher-side placeholder; services emit Redis Streams\n    // events and wspace-graph-svc owns the sole NebulaGraph connection.\n    void graphSync;\n    sdkState = {\n      prisma,\n      valkey,\n      clickhouse,\n      eventPublisher,\n      layerManager,\n      gatewayClient,\n      graphSyncEnabled: config.graph?.enabled ?? false,\n      analyticsEnabled: !!config.analytics?.clickhouse,\n      observabilityEnabled: config.observability?.metrics?.enabled ?? false,\n      layerAwareEnabled: !!config.layer,\n    };\n\n    isInitialized = true;\n\n    const duration = Date.now() - startTime;\n    // sdkState is guaranteed non-null here since we just assigned it above\n    const initializedState = sdkState;\n    logger.info(`[SDK Init] SDK initialized successfully in ${duration}ms`, {\n      graphSyncEnabled: initializedState.graphSyncEnabled,\n      analyticsEnabled: initializedState.analyticsEnabled,\n      observabilityEnabled: initializedState.observabilityEnabled,\n      layerAwareEnabled: initializedState.layerAwareEnabled,\n      layer: config.layer?.type,\n      serviceName: config.layer?.serviceName,\n    });\n\n    return initializedState;\n  } catch (error) {\n    logger.error('[SDK Init] Failed to initialize SDK:', error);\n    throw error;\n  }\n}\n\n/**\n * Get current SDK state\n * @throws Error if SDK is not initialized\n */\nexport function getSDKState(): InitializedSDKState {\n  if (!isInitialized || !sdkState) {\n    throw new Error('SDK not initialized. Call initializeBurdenoffSDK() first.');\n  }\n  return sdkState;\n}\n\n/**\n * Check if SDK is initialized\n */\nexport function isSDKInitialized(): boolean {\n  return isInitialized;\n}\n\n/**\n * Reset SDK state (useful for testing)\n */\nexport async function resetSDK(): Promise<void> {\n  logger.info('[SDK Init] Resetting SDK state...');\n\n  if (sdkState) {\n    // Cleanup resources\n    // Note: Individual cleanup will be handled by service-specific shutdown handlers\n    sdkState = null;\n  }\n\n  isInitialized = false;\n  logger.info('[SDK Init] SDK state reset');\n}\n\n/**\n * Initialize logging configuration\n */\nasync function initializeLogging(config: BurdenoffSDKInitConfig): Promise<void> {\n  logger.info('[SDK Init] Configuring logging...');\n\n  const loggingConfig = config.logging ?? {};\n  const isDevelopment = config.app?.nodeEnv === 'development';\n\n  // Set log level\n  const level = loggingConfig.level ?? 'info';\n  logger.setLevel(level);\n\n  // Set console logging\n  const console = loggingConfig.console ?? true;\n  logger.setConsoleEnabled(console);\n\n  logger.info('[SDK Init] Logging configured', {\n    level,\n    console,\n    format: loggingConfig.format ?? (isDevelopment ? 'pretty' : 'json'),\n  });\n}\n\n/**\n * Initialize database (Prisma with PostgreSQL)\n */\nasync function initializeDatabase(config: BurdenoffSDKInitConfig): Promise<unknown> {\n  logger.info('[SDK Init] Initializing database...');\n\n  // Note: Database initialization is handled by createPrismaClient in prisma/client.ts\n  // This is called by the application (e.g., workspaces-backend)\n  // We just validate the config here\n  if (!config.database?.url) {\n    throw new Error('Database URL is required');\n  }\n\n  logger.info('[SDK Init] Database configuration validated', {\n    maxConnections: config.database.maxConnections ?? 20,\n    enableQueryLogging: config.database.enableQueryLogging ?? false,\n  });\n\n  // Return undefined as database client is created separately\n  return undefined;\n}\n\n/**\n * Initialize cache (Valkey)\n */\nasync function initializeCache(config: BurdenoffSDKInitConfig): Promise<unknown> {\n  const cacheConfig = config.cache?.valkey;\n\n  if (!cacheConfig) {\n    logger.info('[SDK Init] Cache not configured, skipping');\n    return undefined;\n  }\n\n  logger.info('[SDK Init] Initializing Valkey cache...');\n\n  // Note: Valkey initialization is handled by cache module\n  // This is a placeholder for future implementation\n  logger.info('[SDK Init] Valkey cache configuration validated', {\n    url: cacheConfig.url ? '***' : undefined,\n    defaultTTL: cacheConfig.defaultTTL ?? 3600,\n  });\n\n  return undefined;\n}\n\n/**\n * Initialize event queue (Redis Streams).\n *\n * NATS was retired on 2026-05-16. The publisher is created from\n * `REDIS_URL` (set platform-wide in KV). Legacy `config.eventQueue.nats`\n * values are ignored — kept on the type only as a back-compat shim.\n */\nasync function initializeEventQueue(_config: BurdenoffSDKInitConfig): Promise<unknown> {\n  if (!process.env['REDIS_URL']) {\n    logger.info('[SDK Init] REDIS_URL not set, skipping event queue init');\n    return undefined;\n  }\n\n  try {\n    const { EventQueueFactory } = await import('../event-queue/factory/EventQueueFactory.js');\n    const publisher = EventQueueFactory.createPublisherFromEnv();\n    await publisher.connect();\n\n    logger.info('[SDK Init] Redis Streams event publisher connected');\n\n    return publisher;\n  } catch (error) {\n    logger.warn('[SDK Init] Failed to connect Redis Streams event publisher (non-fatal)', {\n      error: error instanceof Error ? error.message : String(error),\n      note: 'Service will continue without event publishing. Use direct API calls as fallback.',\n    });\n    return undefined;\n  }\n}\n\n/**\n * Initialize graph sync (Redis Streams publisher side).\n *\n * Services publish entity events to Redis Streams; the `wspace-graph-svc`\n * consumer (and only it) persists them into NebulaGraph via its Python\n * sidecar. This SDK function does no DB work — it just validates that the\n * publisher-side config is sensible and logs it.\n */\nasync function initializeGraphSync(config: BurdenoffSDKInitConfig): Promise<unknown> {\n  if (!config.graph?.enabled) {\n    logger.info('[SDK Init] Graph sync not enabled, skipping');\n    return undefined;\n  }\n\n  logger.info('[SDK Init] Graph sync enabled (publisher-only mode)', {\n    eventsEnabled: config.graph.eventsEnabled ?? true,\n    productSource: config.graph.productSource,\n    streamName: config.graph.streamName ?? 'graph_events',\n    syncInterval: config.graph.syncInterval ?? 1000,\n    batchSize: config.graph.batchSize ?? 10,\n  });\n\n  return undefined;\n}\n\n/**\n * Initialize analytics (ClickHouse)\n */\nasync function initializeAnalytics(config: BurdenoffSDKInitConfig): Promise<unknown> {\n  if (!config.analytics?.clickhouse) {\n    logger.info('[SDK Init] Analytics not configured, skipping');\n    return undefined;\n  }\n\n  logger.info('[SDK Init] Initializing ClickHouse for analytics...');\n\n  // Note: ClickHouse initialization is handled by analytics module\n  // This is a placeholder for future implementation\n  logger.info('[SDK Init] ClickHouse configuration validated', {\n    url: config.analytics.clickhouse.url,\n    database: config.analytics.clickhouse.database,\n    requestTimeout: config.analytics.clickhouse.requestTimeout ?? 60000,\n  });\n\n  return undefined;\n}\n\n/**\n * Initialize observability (metrics, tracing)\n */\nasync function initializeObservability(config: BurdenoffSDKInitConfig): Promise<void> {\n  if (!config.observability?.metrics?.enabled && !config.observability?.openTelemetry?.enabled) {\n    logger.info('[SDK Init] Observability not configured, skipping');\n    return;\n  }\n\n  logger.info('[SDK Init] Initializing observability...');\n\n  // Note: Observability initialization is handled by observability module\n  // This is a placeholder for future implementation\n  if (config.observability.metrics?.enabled) {\n    logger.info('[SDK Init] Metrics configuration validated', {\n      port: config.observability.metrics.port ?? 9090,\n      endpoint: config.observability.metrics.endpoint ?? '/metrics',\n    });\n  }\n\n  if (config.observability.openTelemetry?.enabled) {\n    logger.info('[SDK Init] OpenTelemetry configuration validated', {\n      serviceName: config.observability.openTelemetry.serviceName,\n      samplingRate: config.observability.openTelemetry.samplingRate ?? 1.0,\n    });\n  }\n}\n\n/**\n * Initialize layer manager and gateway client\n */\nasync function initializeLayer(\n  config: BurdenoffSDKInitConfig\n): Promise<{ layerManager?: LayerManager; gatewayClient?: GatewayClient }> {\n  if (!config.layer) {\n    logger.info('[SDK Init] Layer configuration not provided, skipping layer initialization');\n    return {};\n  }\n\n  logger.info('[SDK Init] Initializing layer manager...', {\n    layer: config.layer.type,\n    serviceName: config.layer.serviceName,\n  });\n\n  // Create layer manager\n  const layerManager = new LayerManager({\n    layer: config.layer.type,\n    serviceName: config.layer.serviceName,\n    serviceIdentity: config.layer.serviceIdentity,\n  });\n\n  // Create gateway client\n  const gatewayClient = new GatewayClient({\n    layer: config.layer.type,\n    serviceName: config.layer.serviceName,\n    serviceIdentity: config.layer.serviceIdentity,\n    internalGatewayUrl: layerManager.getInternalGatewayUrl(),\n    crossLayerGatewayUrl: layerManager.getCrossLayerGatewayUrl(),\n  });\n\n  logger.info('[SDK Init] Layer manager initialized', {\n    layer: config.layer.type,\n    serviceName: config.layer.serviceName,\n    internalGatewayUrl: layerManager.getInternalGatewayUrl(),\n    crossLayerGatewayUrl: layerManager.getCrossLayerGatewayUrl(),\n  });\n\n  return { layerManager, gatewayClient };\n}\n\n/**\n * Initialize layer-specific Redis streams.\n *\n * No-op since the 2026-05-16 NATS retirement: Redis Streams are created\n * on demand by `XGROUP CREATE ... MKSTREAM` inside the consumer, so no\n * upfront connect-and-provision step is needed.\n */\nasync function initializeLayerStreams(config: BurdenoffSDKInitConfig): Promise<void> {\n  if (!config.layer) {\n    return;\n  }\n  logger.debug('[SDK Init] Layer streams init is a no-op for Redis Streams (auto-created on first XADD/XGROUP)', {\n    layer: config.layer.type,\n  });\n}\n\n// Export types\nexport type * from './types.js';\n"]}

package/dist/{chunk-HIWTWIGQ.js → chunk-UIJWXPOQ.js}

@@ -1,4 +1,4 @@
-import { DEFAULT_LAYER_STREAMS, DEFAULT_LAYER_RESOURCES, DEFAULT_GATEWAY_ROUTING } from './chunk-NGMEI42S.js';
+import { DEFAULT_LAYER_STREAMS, DEFAULT_LAYER_RESOURCES, DEFAULT_GATEWAY_ROUTING } from './chunk-ZA3IGCDJ.js';
 import { logger } from './chunk-CBZNP6RF.js';
 import { __export, __name } from './chunk-XE4OXN2W.js';
 
@@ -56,7 +56,7 @@ var LayerManager = class {
     const envPrefix = this.config.layer.toUpperCase();
     const defaults = DEFAULT_LAYER_RESOURCES[this.config.layer];
     return {
-      natsUrl: process.env[`${envPrefix}_NATS_URL`] || defaults.natsUrl,
+      eventQueueUrl: process.env["REDIS_URL"] || process.env[`${envPrefix}_REDIS_URL`] || defaults.eventQueueUrl,
       valkeyUrl: process.env[`${envPrefix}_VALKEY_URL`] || defaults.valkeyUrl,
       temporalAddress: process.env[`${envPrefix}_TEMPORAL_ADDRESS`] || defaults.temporalAddress,
       temporalNamespace: process.env[`${envPrefix}_TEMPORAL_NAMESPACE`] || defaults.temporalNamespace,
@@ -94,10 +94,10 @@ var LayerManager = class {
     return this.gatewayConfig.crossLayerGatewayUrl;
   }
   /**
-  * Get NATS URL for this layer
+  * Get event queue (Redis Streams) URL for this layer
   */
-  getNatsUrl() {
-    return this.resourceConfig.natsUrl;
+  getEventQueueUrl() {
+    return this.resourceConfig.eventQueueUrl;
   }
   /**
   * Get Valkey URL for this layer
@@ -222,5 +222,5 @@ function validateLayerConfig(config) {
 __name(validateLayerConfig, "validateLayerConfig");
 
 export { LayerManager, createLayerManagerFromEnv, detectLayerFromServiceName, getGatewayUrlForLayer, layer_exports, validateLayerConfig };
-//# sourceMappingURL=chunk-HIWTWIGQ.js.map
-//# sourceMappingURL=chunk-HIWTWIGQ.js.map
+//# sourceMappingURL=chunk-UIJWXPOQ.js.map
+//# sourceMappingURL=chunk-UIJWXPOQ.js.map

package/dist/chunk-UIJWXPOQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/layer/index.ts"],"names":["LayerManager","config","gatewayConfig","resourceConfig","routingConfig","serviceIdentity","serviceName","DEFAULT_GATEWAY_ROUTING","layer","resolveGatewayConfig","resolveResourceConfig","logger","debug","envPrefix","toUpperCase","internalGatewayUrl","process","env","internalGateway","host","port","graphqlPath","crossLayerEnvPrefix","crossLayerGatewayUrl","crossLayerGateway","defaults","DEFAULT_LAYER_RESOURCES","eventQueueUrl","valkeyUrl","temporalAddress","temporalNamespace","rbacGatewayUrl","getLayer","getServiceName","getServiceIdentity","getInternalGatewayUrl","getCrossLayerGatewayUrl","getEventQueueUrl","getValkeyUrl","getTemporalAddress","getTemporalNamespace","getRbacGatewayUrl","getDefaultStreams","DEFAULT_LAYER_STREAMS","getFullConfig","gateways","resources","isWspaceLayer","isGlobalLayer","getOppositeLayer","createLayerManagerFromEnv","Error","detectLayerFromServiceName","startsWith","undefined","getGatewayUrlForLayer","sourceLayer","targetLayer","sourceManager","routing","validateLayerConfig","expectedPrefix","warn"],"mappings":";;;;;AAAA,IAAA,aAAA,GAAA;;;;;;;;;;;AAyCO,IAAMA,eAAN,MAAMA;EAzCb;;;AA0CUC,EAAAA,MAAAA;AACAC,EAAAA,aAAAA;AACAC,EAAAA,cAAAA;AACAC,EAAAA,aAAAA;AAER,EAAA,WAAA,CAAYH,MAAAA,EAAqB;AAC/B,IAAA,IAAA,CAAKA,MAAAA,GAAS;AACZI,MAAAA,eAAAA,EAAiBJ,MAAAA,CAAOK,WAAAA;MACxB,GAAGL;AACL,KAAA;AAGA,IAAA,IAAA,CAAKG,aAAAA,GAAgBG,uBAAAA,CAAwBN,MAAAA,CAAOO,KAAK,CAAA;AAGzD,IAAA,IAAA,CAAKN,aAAAA,GAAgB,KAAKO,oBAAAA,EAAoB;AAG9C,IAAA,IAAA,CAAKN,cAAAA,GAAiB,KAAKO,qBAAAA,EAAqB;AAEhDC,IAAAA,MAAAA,CAAOC,MAAM,4BAAA,EAA8B;AACzCJ,MAAAA,KAAAA,EAAO,KAAKP,MAAAA,CAAOO,KAAAA;AACnBF,MAAAA,WAAAA,EAAa,KAAKL,MAAAA,CAAOK,WAAAA;AACzBD,MAAAA,eAAAA,EAAiB,KAAKJ,MAAAA,CAAOI;KAC/B,CAAA;AACF,EAAA;;;;EAKQI,oBAAAA,GAA2C;AACjD,IAAA,MAAMI,SAAAA,GAAY,IAAA,CAAKZ,MAAAA,CAAOO,KAAAA,CAAMM,WAAAA,EAAW;AAG/C,IAAA,MAAMC,kBAAAA,GACJC,QAAQC,GAAAA,CAAI,CAAA,EAAGJ,SAAAA,CAAAA,gBAAAA,CAA2B,CAAA,IAC1C,UAAU,IAAA,CAAKT,aAAAA,CAAcc,gBAAgBC,IAAI,CAAA,CAAA,EAAI,KAAKf,aAAAA,CAAcc,eAAAA,CAAgBE,IAAI,CAAA,EAAG,IAAA,CAAKhB,aAAAA,CAAcc,eAAAA,CAAgBG,WAAW,CAAA,CAAA;AAG/I,IAAA,MAAMC,mBAAAA,GAAsB,IAAA,CAAKrB,MAAAA,CAAOO,KAAAA,KAAU,WAAW,QAAA,GAAW,QAAA;AACxE,IAAA,MAAMe,oBAAAA,GACJP,QAAQC,GAAAA,CAAI,CAAA,EAAGK,mBAAAA,CAAAA,mBAAAA,CAAwC,CAAA,IACvD,UAAU,IAAA,CAAKlB,aAAAA,CAAcoB,kBAAkBL,IAAI,CAAA,CAAA,EAAI,KAAKf,aAAAA,CAAcoB,iBAAAA,CAAkBJ,IAAI,CAAA,EAAG,IAAA,CAAKhB,aAAAA,CAAcoB,iBAAAA,CAAkBH,WAAW,CAAA,CAAA;AAErJ,IAAA,OAAO;AACLN,MAAAA,kBAAAA;AACAQ,MAAAA;AACF,KAAA;AACF,EAAA;;;;EAKQb,qBAAAA,GAA2C;AACjD,IAAA,MAAMG,SAAAA,GAAY,IAAA,CAAKZ,MAAAA,CAAOO,KAAAA,CAAMM,WAAAA,EAAW;AAC/C,IAAA,MAAMW,QAAAA,GAAWC,uBAAAA,CAAwB,IAAA,CAAKzB,MAAAA,CAAOO,KAAK,CAAA;AAE1D,IAAA,OAAO;MACLmB,aAAAA,EAAeX,OAAAA,CAAQC,GAAAA,CAAI,WAAA,CAAA,IAAgBD,OAAAA,CAAQC,IAAI,CAAA,EAAGJ,SAAAA,CAAAA,UAAAA,CAAqB,CAAA,IAAKY,QAAAA,CAASE,aAAAA;AAC7FC,MAAAA,SAAAA,EAAWZ,QAAQC,GAAAA,CAAI,CAAA,EAAGJ,SAAAA,CAAAA,WAAAA,CAAsB,KAAKY,QAAAA,CAASG,SAAAA;AAC9DC,MAAAA,eAAAA,EAAiBb,QAAQC,GAAAA,CAAI,CAAA,EAAGJ,SAAAA,CAAAA,iBAAAA,CAA4B,KAAKY,QAAAA,CAASI,eAAAA;AAC1EC,MAAAA,iBAAAA,EAAmBd,QAAQC,GAAAA,CAAI,CAAA,EAAGJ,SAAAA,CAAAA,mBAAAA,CAA8B,KAAKY,QAAAA,CAASK,iBAAAA;AAC9EC,MAAAA,cAAAA,EAAgBf,QAAQC,GAAAA,CAAI,CAAA,EAAGJ,SAAAA,CAAAA,iBAAAA,CAA4B,KAAKY,QAAAA,CAASM;AAC3E,KAAA;AACF,EAAA;;;;EAKAC,QAAAA,GAAyB;AACvB,IAAA,OAAO,KAAK/B,MAAAA,CAAOO,KAAAA;AACrB,EAAA;;;;EAKAyB,cAAAA,GAAyB;AACvB,IAAA,OAAO,KAAKhC,MAAAA,CAAOK,WAAAA;AACrB,EAAA;;;;EAKA4B,kBAAAA,GAA6B;AAC3B,IAAA,OAAO,IAAA,CAAKjC,MAAAA,CAAOI,eAAAA,IAAmB,IAAA,CAAKJ,MAAAA,CAAOK,WAAAA;AACpD,EAAA;;;;EAKA6B,qBAAAA,GAAgC;AAC9B,IAAA,OAAO,KAAKjC,aAAAA,CAAca,kBAAAA;AAC5B,EAAA;;;;EAKAqB,uBAAAA,GAAkC;AAChC,IAAA,OAAO,KAAKlC,aAAAA,CAAcqB,oBAAAA;AAC5B,EAAA;;;;EAKAc,gBAAAA,GAA2B;AACzB,IAAA,OAAO,KAAKlC,cAAAA,CAAewB,aAAAA;AAC7B,EAAA;;;;EAKAW,YAAAA,GAAuB;AACrB,IAAA,OAAO,KAAKnC,cAAAA,CAAeyB,SAAAA;AAC7B,EAAA;;;;EAKAW,kBAAAA,GAA6B;AAC3B,IAAA,OAAO,KAAKpC,cAAAA,CAAe0B,eAAAA;AAC7B,EAAA;;;;EAKAW,oBAAAA,GAA+B;AAC7B,IAAA,OAAO,KAAKrC,cAAAA,CAAe2B,iBAAAA;AAC7B,EAAA;;;;EAKAW,iBAAAA,GAA4B;AAC1B,IAAA,OAAO,KAAKtC,cAAAA,CAAe4B,cAAAA;AAC7B,EAAA;;;;EAKAW,iBAAAA,GAAuF;AACrF,IAAA,OAAOC,qBAAAA,CAAsB,IAAA,CAAK1C,MAAAA,CAAOO,KAAK,CAAA;AAChD,EAAA;;;;EAKAoC,aAAAA,GAAiC;AAC/B,IAAA,OAAO;AACL,MAAA,GAAG,IAAA,CAAK3C,MAAAA;AACR4C,MAAAA,QAAAA,EAAU,IAAA,CAAK3C,aAAAA;AACf4C,MAAAA,SAAAA,EAAW,IAAA,CAAK3C;AAClB,KAAA;AACF,EAAA;;;;EAKA4C,aAAAA,GAAyB;AACvB,IAAA,OAAO,IAAA,CAAK9C,OAAOO,KAAAA,KAAU,QAAA;AAC/B,EAAA;;;;EAKAwC,aAAAA,GAAyB;AACvB,IAAA,OAAO,IAAA,CAAK/C,OAAOO,KAAAA,KAAU,QAAA;AAC/B,EAAA;;;;EAKAyC,gBAAAA,GAAiC;AAC/B,IAAA,OAAO,IAAA,CAAKhD,MAAAA,CAAOO,KAAAA,KAAU,QAAA,GAAW,QAAA,GAAW,QAAA;AACrD,EAAA;AACF;AAYO,SAAS0C,yBAAAA,GAAAA;AACd,EAAA,MAAM1C,KAAAA,GAAQQ,OAAAA,CAAQC,GAAAA,CAAI,eAAA,CAAA;AAE1B,EAAA,IAAI,CAACT,KAAAA,IAAUA,KAAAA,KAAU,QAAA,IAAYA,UAAU,QAAA,EAAW;AACxD,IAAA,MAAM,IAAI2C,KAAAA,CACR,CAAA,0GAAA,EACyC3C,KAAAA,CAAAA,CAAAA,CAAQ,CAAA;AAErD,EAAA;AAEA,EAAA,MAAMF,WAAAA,GAAcU,OAAAA,CAAQC,GAAAA,CAAI,cAAA,CAAA;AAChC,EAAA,IAAI,CAACX,WAAAA,EAAa;AAChB,IAAA,MAAM,IAAI6C,MAAM,8DAAA,CAAA;AAClB,EAAA;AAEA,EAAA,MAAM9C,eAAAA,GAAkBW,OAAAA,CAAQC,GAAAA,CAAI,kBAAA,CAAA,IAAuBX,WAAAA;AAE3D,EAAA,OAAO,IAAIN,YAAAA,CAAa;AACtBQ,IAAAA,KAAAA;AACAF,IAAAA,WAAAA;AACAD,IAAAA;GACF,CAAA;AACF;AAtBgB6C,MAAAA,CAAAA,yBAAAA,EAAAA,2BAAAA,CAAAA;AA8BT,SAASE,2BAA2B9C,WAAAA,EAAmB;AAC5D,EAAA,IAAIA,WAAAA,CAAY+C,UAAAA,CAAW,SAAA,CAAA,EAAY;AACrC,IAAA,OAAO,QAAA;AACT,EAAA;AACA,EAAA,IAAI/C,WAAAA,CAAY+C,UAAAA,CAAW,SAAA,CAAA,EAAY;AACrC,IAAA,OAAO,QAAA;AACT,EAAA;AACA,EAAA,OAAOC,MAAAA;AACT;AARgBF,MAAAA,CAAAA,0BAAAA,EAAAA,4BAAAA,CAAAA;AAkBT,SAASG,qBAAAA,CACdC,WAAAA,EACAC,WAAAA,EACAC,aAAAA,EAA4B;AAG5B,EAAA,IAAIF,gBAAgBC,WAAAA,EAAa;AAC/B,IAAA,IAAIC,aAAAA,EAAe;AACjB,MAAA,OAAOA,cAAcvB,qBAAAA,EAAqB;AAC5C,IAAA;AACA,IAAA,MAAMwB,QAAAA,GAAUpD,wBAAwBiD,WAAAA,CAAAA;AACxC,IAAA,OAAO,CAAA,OAAA,EAAUG,QAAAA,CAAQzC,eAAAA,CAAgBC,IAAI,CAAA,CAAA,EAAIwC,QAAAA,CAAQzC,eAAAA,CAAgBE,IAAI,CAAA,EAAGuC,QAAAA,CAAQzC,eAAAA,CAAgBG,WAAW,CAAA,CAAA;AACrH,EAAA;AAGA,EAAA,IAAIqC,aAAAA,EAAe;AACjB,IAAA,OAAOA,cAActB,uBAAAA,EAAuB;AAC9C,EAAA;AACA,EAAA,MAAMuB,OAAAA,GAAUpD,wBAAwBiD,WAAAA,CAAAA;AACxC,EAAA,OAAO,CAAA,OAAA,EAAUG,OAAAA,CAAQnC,iBAAAA,CAAkBL,IAAI,CAAA,CAAA,EAAIwC,OAAAA,CAAQnC,iBAAAA,CAAkBJ,IAAI,CAAA,EAAGuC,OAAAA,CAAQnC,iBAAAA,CAAkBH,WAAW,CAAA,CAAA;AAC3H;AApBgBkC,MAAAA,CAAAA,qBAAAA,EAAAA,uBAAAA,CAAAA;AA4BT,SAASK,oBAAoB3D,MAAAA,EAAmB;AACrD,EAAA,IAAI,CAACA,OAAOO,KAAAA,EAAO;AACjB,IAAA,MAAM,IAAI2C,MAAM,kCAAA,CAAA;AAClB,EAAA;AACA,EAAA,IAAIlD,MAAAA,CAAOO,KAAAA,KAAU,QAAA,IAAYP,MAAAA,CAAOO,UAAU,QAAA,EAAU;AAC1D,IAAA,MAAM,IAAI2C,KAAAA,CAAM,CAAA,8BAAA,EAAiClD,MAAAA,CAAOO,KAAK,CAAA,+BAAA,CAAiC,CAAA;AAChG,EAAA;AACA,EAAA,IAAI,CAACP,OAAOK,WAAAA,EAAa;AACvB,IAAA,MAAM,IAAI6C,MAAM,wCAAA,CAAA;AAClB,EAAA;AAGA,EAAA,MAAMU,cAAAA,GAAiB,CAAA,EAAG5D,MAAAA,CAAOO,KAAK,CAAA,CAAA,CAAA;AACtC,EAAA,IAAI,CAACP,MAAAA,CAAOK,WAAAA,CAAY+C,UAAAA,CAAWQ,cAAAA,CAAAA,EAAiB;AAClDlD,IAAAA,MAAAA,CAAOmD,KAAK,+DAAA,EAAiE;AAC3ExD,MAAAA,WAAAA,EAAaL,MAAAA,CAAOK,WAAAA;AACpBuD,MAAAA,cAAAA;AACArD,MAAAA,KAAAA,EAAOP,MAAAA,CAAOO;KAChB,CAAA;AACF,EAAA;AACF;AApBgBoD,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA","file":"chunk-UIJWXPOQ.js","sourcesContent":["/**\n * Layer Detection and Configuration Module\n *\n * Provides layer-aware configuration and gateway URL resolution\n * for wspace (workspace) and global (tenant) service layers.\n *\n * @module layer\n * @category Configuration\n *\n * @example\n * ```typescript\n * import { LayerManager } from '@burdenoff/be-sdk/layer';\n *\n * // Create layer manager for a wspace service\n * const layer = new LayerManager({\n *   layer: 'wspace',\n *   serviceName: 'wspace-tags-svc',\n * });\n *\n * // Get gateway URLs\n * const internalUrl = layer.getInternalGatewayUrl();  // wspace-int-gateway\n * const crossLayerUrl = layer.getCrossLayerGatewayUrl(); // global-public-gateway\n * ```\n */\n\nimport {\n  type ServiceLayer,\n  type LayerConfig,\n  type LayerGatewayConfig,\n  type LayerResourceUrls,\n  type LayerFullConfig,\n  type GatewayRoutingConfig,\n  DEFAULT_GATEWAY_ROUTING,\n  DEFAULT_LAYER_RESOURCES,\n  DEFAULT_LAYER_STREAMS,\n} from '../types/layer.js';\nimport { logger } from '../logger/index.js';\n\n/**\n * Layer Manager - Provides layer-aware configuration and URL resolution\n */\nexport class LayerManager {\n  private config: LayerConfig;\n  private gatewayConfig: LayerGatewayConfig;\n  private resourceConfig: LayerResourceUrls;\n  private routingConfig: GatewayRoutingConfig;\n\n  constructor(config: LayerConfig) {\n    this.config = {\n      serviceIdentity: config.serviceName, // Default to service name\n      ...config,\n    };\n\n    // Load routing config for layer\n    this.routingConfig = DEFAULT_GATEWAY_ROUTING[config.layer];\n\n    // Initialize gateway config\n    this.gatewayConfig = this.resolveGatewayConfig();\n\n    // Initialize resource config\n    this.resourceConfig = this.resolveResourceConfig();\n\n    logger.debug('[LayerManager] Initialized', {\n      layer: this.config.layer,\n      serviceName: this.config.serviceName,\n      serviceIdentity: this.config.serviceIdentity,\n    });\n  }\n\n  /**\n   * Resolve gateway configuration from environment or defaults\n   */\n  private resolveGatewayConfig(): LayerGatewayConfig {\n    const envPrefix = this.config.layer.toUpperCase();\n\n    // Internal gateway URL\n    const internalGatewayUrl =\n      process.env[`${envPrefix}_INT_GATEWAY_URL`] ||\n      `http://${this.routingConfig.internalGateway.host}:${this.routingConfig.internalGateway.port}${this.routingConfig.internalGateway.graphqlPath}`;\n\n    // Cross-layer gateway URL\n    const crossLayerEnvPrefix = this.config.layer === 'wspace' ? 'GLOBAL' : 'WSPACE';\n    const crossLayerGatewayUrl =\n      process.env[`${crossLayerEnvPrefix}_PUBLIC_GATEWAY_URL`] ||\n      `http://${this.routingConfig.crossLayerGateway.host}:${this.routingConfig.crossLayerGateway.port}${this.routingConfig.crossLayerGateway.graphqlPath}`;\n\n    return {\n      internalGatewayUrl,\n      crossLayerGatewayUrl,\n    };\n  }\n\n  /**\n   * Resolve resource configuration from environment or defaults\n   */\n  private resolveResourceConfig(): LayerResourceUrls {\n    const envPrefix = this.config.layer.toUpperCase();\n    const defaults = DEFAULT_LAYER_RESOURCES[this.config.layer];\n\n    return {\n      eventQueueUrl: process.env['REDIS_URL'] || process.env[`${envPrefix}_REDIS_URL`] || defaults.eventQueueUrl,\n      valkeyUrl: process.env[`${envPrefix}_VALKEY_URL`] || defaults.valkeyUrl,\n      temporalAddress: process.env[`${envPrefix}_TEMPORAL_ADDRESS`] || defaults.temporalAddress,\n      temporalNamespace: process.env[`${envPrefix}_TEMPORAL_NAMESPACE`] || defaults.temporalNamespace,\n      rbacGatewayUrl: process.env[`${envPrefix}_RBAC_GATEWAY_URL`] || defaults.rbacGatewayUrl,\n    };\n  }\n\n  /**\n   * Get the layer type\n   */\n  getLayer(): ServiceLayer {\n    return this.config.layer;\n  }\n\n  /**\n   * Get the service name\n   */\n  getServiceName(): string {\n    return this.config.serviceName;\n  }\n\n  /**\n   * Get the service identity (for bypass headers)\n   */\n  getServiceIdentity(): string {\n    return this.config.serviceIdentity || this.config.serviceName;\n  }\n\n  /**\n   * Get internal gateway URL (same layer M2M calls)\n   */\n  getInternalGatewayUrl(): string {\n    return this.gatewayConfig.internalGatewayUrl;\n  }\n\n  /**\n   * Get cross-layer gateway URL (cross layer calls via public gateway)\n   */\n  getCrossLayerGatewayUrl(): string {\n    return this.gatewayConfig.crossLayerGatewayUrl;\n  }\n\n  /**\n   * Get event queue (Redis Streams) URL for this layer\n   */\n  getEventQueueUrl(): string {\n    return this.resourceConfig.eventQueueUrl;\n  }\n\n  /**\n   * Get Valkey URL for this layer\n   */\n  getValkeyUrl(): string {\n    return this.resourceConfig.valkeyUrl;\n  }\n\n  /**\n   * Get Temporal address for this layer\n   */\n  getTemporalAddress(): string {\n    return this.resourceConfig.temporalAddress;\n  }\n\n  /**\n   * Get Temporal namespace for this layer\n   */\n  getTemporalNamespace(): string {\n    return this.resourceConfig.temporalNamespace;\n  }\n\n  /**\n   * Get RBAC gateway URL for this layer\n   */\n  getRbacGatewayUrl(): string {\n    return this.resourceConfig.rbacGatewayUrl;\n  }\n\n  /**\n   * Get default streams for this layer\n   */\n  getDefaultStreams(): Array<{ name: string; subjects: string[]; description?: string }> {\n    return DEFAULT_LAYER_STREAMS[this.config.layer];\n  }\n\n  /**\n   * Get full configuration\n   */\n  getFullConfig(): LayerFullConfig {\n    return {\n      ...this.config,\n      gateways: this.gatewayConfig,\n      resources: this.resourceConfig,\n    };\n  }\n\n  /**\n   * Check if this is a wspace layer service\n   */\n  isWspaceLayer(): boolean {\n    return this.config.layer === 'wspace';\n  }\n\n  /**\n   * Check if this is a global layer service\n   */\n  isGlobalLayer(): boolean {\n    return this.config.layer === 'global';\n  }\n\n  /**\n   * Get the opposite layer\n   */\n  getOppositeLayer(): ServiceLayer {\n    return this.config.layer === 'wspace' ? 'global' : 'wspace';\n  }\n}\n\n/**\n * Create LayerManager from environment variables\n *\n * Environment variables:\n * - SERVICE_LAYER: 'wspace' | 'global'\n * - SERVICE_NAME: Service name (e.g., 'wspace-tags-svc')\n * - SERVICE_IDENTITY: Service identity for bypass headers (defaults to SERVICE_NAME)\n *\n * @throws Error if SERVICE_LAYER is not set or invalid\n */\nexport function createLayerManagerFromEnv(): LayerManager {\n  const layer = process.env['SERVICE_LAYER'] as ServiceLayer;\n\n  if (!layer || (layer !== 'wspace' && layer !== 'global')) {\n    throw new Error(\n      `[LayerManager] Invalid or missing SERVICE_LAYER environment variable. ` +\n        `Expected 'wspace' or 'global', got '${layer}'`\n    );\n  }\n\n  const serviceName = process.env['SERVICE_NAME'];\n  if (!serviceName) {\n    throw new Error('[LayerManager] SERVICE_NAME environment variable is required');\n  }\n\n  const serviceIdentity = process.env['SERVICE_IDENTITY'] || serviceName;\n\n  return new LayerManager({\n    layer,\n    serviceName,\n    serviceIdentity,\n  });\n}\n\n/**\n * Detect layer from service name\n *\n * @param serviceName - Service name (e.g., 'wspace-tags-svc', 'global-auth-svc')\n * @returns Detected layer or undefined if unable to detect\n */\nexport function detectLayerFromServiceName(serviceName: string): ServiceLayer | undefined {\n  if (serviceName.startsWith('wspace-')) {\n    return 'wspace';\n  }\n  if (serviceName.startsWith('global-')) {\n    return 'global';\n  }\n  return undefined;\n}\n\n/**\n * Get gateway URL for a target layer from a source layer\n *\n * @param sourceLayer - Layer making the call\n * @param targetLayer - Layer being called\n * @param sourceManager - LayerManager for the source layer (optional, for URL resolution)\n * @returns Gateway URL to use for the call\n */\nexport function getGatewayUrlForLayer(\n  sourceLayer: ServiceLayer,\n  targetLayer: ServiceLayer,\n  sourceManager?: LayerManager\n): string {\n  // Same layer = internal gateway\n  if (sourceLayer === targetLayer) {\n    if (sourceManager) {\n      return sourceManager.getInternalGatewayUrl();\n    }\n    const routing = DEFAULT_GATEWAY_ROUTING[sourceLayer];\n    return `http://${routing.internalGateway.host}:${routing.internalGateway.port}${routing.internalGateway.graphqlPath}`;\n  }\n\n  // Different layer = cross-layer public gateway\n  if (sourceManager) {\n    return sourceManager.getCrossLayerGatewayUrl();\n  }\n  const routing = DEFAULT_GATEWAY_ROUTING[sourceLayer];\n  return `http://${routing.crossLayerGateway.host}:${routing.crossLayerGateway.port}${routing.crossLayerGateway.graphqlPath}`;\n}\n\n/**\n * Validate layer configuration\n *\n * @param config - Layer configuration to validate\n * @throws Error if configuration is invalid\n */\nexport function validateLayerConfig(config: LayerConfig): void {\n  if (!config.layer) {\n    throw new Error('[LayerManager] layer is required');\n  }\n  if (config.layer !== 'wspace' && config.layer !== 'global') {\n    throw new Error(`[LayerManager] Invalid layer '${config.layer}'. Must be 'wspace' or 'global'`);\n  }\n  if (!config.serviceName) {\n    throw new Error('[LayerManager] serviceName is required');\n  }\n\n  // Validate naming convention\n  const expectedPrefix = `${config.layer}-`;\n  if (!config.serviceName.startsWith(expectedPrefix)) {\n    logger.warn('[LayerManager] Service name does not follow naming convention', {\n      serviceName: config.serviceName,\n      expectedPrefix,\n      layer: config.layer,\n    });\n  }\n}\n\n// Re-export types for convenience\nexport type {\n  ServiceLayer,\n  LayerConfig,\n  LayerGatewayConfig,\n  LayerResourceUrls,\n  LayerFullConfig,\n  GatewayRoutingConfig,\n} from '../types/layer.js';\n\nexport { DEFAULT_GATEWAY_ROUTING, DEFAULT_LAYER_RESOURCES, DEFAULT_LAYER_STREAMS } from '../types/layer.js';\n"]}

package/dist/{chunk-WBWM7UY7.js → chunk-UNPJMENC.js}

@@ -1,5 +1,5 @@
 import { isTokenExpired, parseJWT } from './chunk-MOCUBSTW.js';
-import { AuthenticationError } from './chunk-RTQIRGVB.js';
+import { AuthenticationError } from './chunk-O6RHB2YP.js';
 import { logger } from './chunk-CBZNP6RF.js';
 import { __name } from './chunk-XE4OXN2W.js';
 
@@ -194,5 +194,5 @@ var AuthModule = class {
 };
 
 export { AuthCookieHelper, AuthModule };
-//# sourceMappingURL=chunk-WBWM7UY7.js.map
-//# sourceMappingURL=chunk-WBWM7UY7.js.map
+//# sourceMappingURL=chunk-UNPJMENC.js.map
+//# sourceMappingURL=chunk-UNPJMENC.js.map

package/dist/{chunk-WBWM7UY7.js.map → chunk-UNPJMENC.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth/index.ts"],"names":["ACCESS_TOKEN_COOKIE","REFRESH_TOKEN_COOKIE","ACCESS_TOKEN_MAX_AGE","REFRESH_TOKEN_MAX_AGE","REFRESH_TOKEN_REMEMBER_MAX_AGE","buildCookieString","name","value","maxAge","buildClearCookieString","AuthCookieHelper","setAuthCookies","context","tokens","options","headers","responseHeaders","rememberMe","refreshMaxAge","append","accessToken","refreshToken","clearAuthCookies","AuthModule","client","verifyToken","token","logger","debug","isTokenExpired","valid","error","query","response","Error","message","decodeToken","payload","parseJWT","mutation","info","AuthenticationError","validatePermission","userId","permission","resourceId","allowed","isTokenValid","getUserIdFromToken","user_id","getWorkspaceIdFromToken","workspace_id","getTokenClaims","willExpireSoon","withinSeconds","exp","now","Math","floor","Date"],"mappings":";;;;;;AAgBA,IAAMA,mBAAAA,GAAsB,iBAAA;AAC5B,IAAMC,oBAAAA,GAAuB,kBAAA;AAC7B,IAAMC,uBAAuB,EAAA,GAAK,EAAA;AAClC,IAAMC,qBAAAA,GAAwB,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAC7C,IAAMC,8BAAAA,GAAiC,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAEtD,SAASC,iBAAAA,CAAkBC,IAAAA,EAAcC,KAAAA,EAAeC,MAAAA,EAAc;AACpE,EAAA,OAAO,CAAA,EAAGF,IAAAA,CAAAA,CAAAA,EAAQC,KAAAA,aAAkBC,MAAAA,CAAAA,mCAAAA,CAAAA;AACtC;AAFSH,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAIT,SAASI,uBAAuBH,IAAAA,EAAY;AAC1C,EAAA,OAAO,GAAGA,IAAAA,CAAAA,+CAAAA,CAAAA;AACZ;AAFSG,MAAAA,CAAAA,sBAAAA,EAAAA,wBAAAA,CAAAA;AAIF,IAAMC,gBAAAA,GAAmB;EAC9BC,cAAAA,CACEC,OAAAA,EACAC,QACAC,OAAAA,EAAkC;AAElC,IAAA,MAAMC,UAAUH,OAAAA,CAAQI,eAAAA;AACxB,IAAA,IAAI,CAACD,OAAAA,EAAS;AAEd,IAAA,MAAME,UAAAA,GAAaH,SAASG,UAAAA,IAAc,KAAA;AAC1C,IAAA,MAAMC,aAAAA,GAAgBD,aAAab,8BAAAA,GAAiCD,qBAAAA;AAEpEY,IAAAA,OAAAA,CAAQI,OAAO,YAAA,EAAcd,iBAAAA,CAAkBL,qBAAqBa,MAAAA,CAAOO,WAAAA,EAAalB,oBAAAA,CAAAA,CAAAA;AACxFa,IAAAA,OAAAA,CAAQI,OAAO,YAAA,EAAcd,iBAAAA,CAAkBJ,sBAAsBY,MAAAA,CAAOQ,YAAAA,EAAcH,aAAAA,CAAAA,CAAAA;AAC5F,EAAA,CAAA;AAEAI,EAAAA,gBAAAA,CAAiBV,OAAAA,EAAsB;AACrC,IAAA,MAAMG,UAAUH,OAAAA,CAAQI,eAAAA;AACxB,IAAA,IAAI,CAACD,OAAAA,EAAS;AAEdA,IAAAA,OAAAA,CAAQI,MAAAA,CAAO,YAAA,EAAcV,sBAAAA,CAAuBT,mBAAAA,CAAAA,CAAAA;AACpDe,IAAAA,OAAAA,CAAQI,MAAAA,CAAO,YAAA,EAAcV,sBAAAA,CAAuBR,oBAAAA,CAAAA,CAAAA;AACtD,EAAA;AACF;AA+BO,IAAMsB,aAAN,MAAMA;EApFb;;;;;AAqFE,EAAA,WAAA,CACUC,QACAZ,OAAAA,EACR;SAFQY,MAAAA,GAAAA,MAAAA;SACAZ,OAAAA,GAAAA,OAAAA;AACP,EAAA;;;;AAKH,EAAA,MAAaa,YAAYC,KAAAA,EAA2C;AAClEC,IAAAA,MAAAA,CAAOC,MAAM,wBAAA,CAAA;AAGb,IAAA,IAAIC,cAAAA,CAAeH,KAAAA,CAAAA,EAAQ;AACzB,MAAA,OAAO;QACLI,KAAAA,EAAO,KAAA;QACPC,KAAAA,EAAO;AACT,OAAA;AACF,IAAA;AAEA,IAAA,MAAMC,KAAAA,GAAQ;;;;;;;;;AAUd,IAAA,IAAI;AACF,MAAA,MAAMC,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MAA0CA,KAAAA,EAAO;AAAEN,QAAAA;AAAM,OAAA,EAAG,KAAKd,OAAO,CAAA;AAE3Ge,MAAAA,MAAAA,CAAOC,MAAM,kCAAA,EAAoC;AAAEE,QAAAA,KAAAA,EAAOG,SAASR,WAAAA,CAAYK;OAAM,CAAA;AAErF,MAAA,OAAOG,QAAAA,CAASR,WAAAA;AAClB,IAAA,CAAA,CAAA,OAASM,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,kCAAA,EAAoC;AAAEA,QAAAA;OAAM,CAAA;AACzD,MAAA,OAAO;QACLD,KAAAA,EAAO,KAAA;QACPC,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMI,OAAAA,GAAU;AAClD,OAAA;AACF,IAAA;AACF,EAAA;;;;AAKOC,EAAAA,WAAAA,CAAYV,KAAAA,EAAoC;AACrD,IAAA,MAAMW,OAAAA,GAAUC,SAASZ,KAAAA,CAAAA;AACzB,IAAA,IAAI,CAACW,OAAAA,EAAS;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AACA,IAAA,OAAOA,OAAAA;AACT,EAAA;;;;AAKA,EAAA,MAAahB,aAAaA,YAAAA,EAAmD;AAC3EM,IAAAA,MAAAA,CAAOC,MAAM,yBAAA,CAAA;AAEb,IAAA,MAAMW,QAAAA,GAAW;;;;;;;;;AAUjB,IAAA,IAAI;AACF,MAAA,MAAMN,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MACjCO,QAAAA,EACA;AAAElB,QAAAA;AAAa,OAAA,EACf,KAAKT,OAAO,CAAA;AAGde,MAAAA,MAAAA,CAAOa,KAAK,qCAAA,CAAA;AAEZ,MAAA,OAAOP,QAAAA,CAASZ,YAAAA;AAClB,IAAA,CAAA,CAAA,OAASU,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,6BAAA,EAA+B;AAAEA,QAAAA;OAAM,CAAA;AACpD,MAAA,MAAM,IAAIU,oBAAoB,yBAAA,EAA2B;QACvDV,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMI,OAAAA,GAAU;OAClD,CAAA;AACF,IAAA;AACF,EAAA;;;;EAKA,MAAaO,kBAAAA,CAAmBC,MAAAA,EAAgBC,UAAAA,EAAoBC,UAAAA,EAAuC;AACzGlB,IAAAA,MAAAA,CAAOC,MAAM,8BAAA,EAAgC;AAAEe,MAAAA,MAAAA;AAAQC,MAAAA,UAAAA;AAAYC,MAAAA;KAAW,CAAA;AAE9E,IAAA,MAAMb,KAAAA,GAAQ;;;;;;;AAQd,IAAA,IAAI;AACF,MAAA,MAAMC,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MAEhCA,KAAAA,EAAO;AAAEW,QAAAA,MAAAA;AAAQC,QAAAA,UAAAA;AAAYC,QAAAA;AAAW,OAAA,EAAG,KAAKjC,OAAO,CAAA;AAE1De,MAAAA,MAAAA,CAAOC,MAAM,qCAAA,EAAuC;AAClDkB,QAAAA,OAAAA,EAASb,SAASS,kBAAAA,CAAmBI;OACvC,CAAA;AAEA,MAAA,OAAOb,SAASS,kBAAAA,CAAmBI,OAAAA;AACrC,IAAA,CAAA,CAAA,OAASf,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,qCAAA,EAAuC;AAAEA,QAAAA;OAAM,CAAA;AAC5D,MAAA,OAAO,KAAA;AACT,IAAA;AACF,EAAA;;;;AAKOgB,EAAAA,YAAAA,CAAarB,KAAAA,EAAwB;AAC1C,IAAA,OAAO,CAACG,eAAeH,KAAAA,CAAAA;AACzB,EAAA;;;;AAKOsB,EAAAA,kBAAAA,CAAmBtB,KAAAA,EAA8B;AACtD,IAAA,MAAMW,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,OAAOW,SAASY,OAAAA,IAAW,IAAA;AAC7B,EAAA;;;;AAKOC,EAAAA,uBAAAA,CAAwBxB,KAAAA,EAA8B;AAC3D,IAAA,MAAMW,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,OAAOW,SAASc,YAAAA,IAAgB,IAAA;AAClC,EAAA;;;;AAKOC,EAAAA,cAAAA,CAAe1B,KAAAA,EAA+C;AACnE,IAAA,MAAMW,OAAAA,GAAUC,SAASZ,KAAAA,CAAAA;AACzB,IAAA,OAAOW,OAAAA;AACT,EAAA;;;;EAKOgB,cAAAA,CAAe3B,KAAAA,EAAe4B,gBAAwB,GAAA,EAAc;AACzE,IAAA,MAAMjB,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,IAAI,CAACW,OAAAA,IAAW,OAAOA,OAAAA,CAAQkB,QAAQ,QAAA,EAAU;AAC/C,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMC,MAAMC,IAAAA,CAAKC,KAAAA,CAAMC,IAAAA,CAAKH,GAAAA,KAAQ,GAAA,CAAA;AACpC,IAAA,OAAOnB,OAAAA,CAAQkB,MAAMC,GAAAA,GAAMF,aAAAA;AAC7B,EAAA;AACF","file":"chunk-WBWM7UY7.js","sourcesContent":["/**\n * Authentication Module\n * JWT verification, token management, and user authentication\n */\n\nimport type { BurdenoffGraphQLClient } from '../client/graphql.js';\nimport type { SDKContext } from '../types/index.js';\nimport { AuthenticationError } from '../types/index.js';\nimport { logger } from '../logger/index.js';\nimport { parseJWT, isTokenExpired } from '../utils/index.js';\n\ninterface CookieContext {\n  responseHeaders?: Headers;\n  [key: string]: unknown;\n}\n\nconst ACCESS_TOKEN_COOKIE = 'bf_access_token';\nconst REFRESH_TOKEN_COOKIE = 'bf_refresh_token';\nconst ACCESS_TOKEN_MAX_AGE = 15 * 60; // 15 minutes\nconst REFRESH_TOKEN_MAX_AGE = 30 * 24 * 60 * 60; // 30 days\nconst REFRESH_TOKEN_REMEMBER_MAX_AGE = 30 * 24 * 60 * 60; // 30 days (same, controlled by backend)\n\nfunction buildCookieString(name: string, value: string, maxAge: number): string {\n  return `${name}=${value}; Max-Age=${maxAge}; Path=/; HttpOnly; SameSite=Strict`;\n}\n\nfunction buildClearCookieString(name: string): string {\n  return `${name}=; Max-Age=0; Path=/; HttpOnly; SameSite=Strict`;\n}\n\nexport const AuthCookieHelper = {\n  setAuthCookies(\n    context: CookieContext,\n    tokens: { accessToken: string; refreshToken: string },\n    options?: { rememberMe?: boolean }\n  ): void {\n    const headers = context.responseHeaders;\n    if (!headers) return;\n\n    const rememberMe = options?.rememberMe ?? false;\n    const refreshMaxAge = rememberMe ? REFRESH_TOKEN_REMEMBER_MAX_AGE : REFRESH_TOKEN_MAX_AGE;\n\n    headers.append('Set-Cookie', buildCookieString(ACCESS_TOKEN_COOKIE, tokens.accessToken, ACCESS_TOKEN_MAX_AGE));\n    headers.append('Set-Cookie', buildCookieString(REFRESH_TOKEN_COOKIE, tokens.refreshToken, refreshMaxAge));\n  },\n\n  clearAuthCookies(context: CookieContext): void {\n    const headers = context.responseHeaders;\n    if (!headers) return;\n\n    headers.append('Set-Cookie', buildClearCookieString(ACCESS_TOKEN_COOKIE));\n    headers.append('Set-Cookie', buildClearCookieString(REFRESH_TOKEN_COOKIE));\n  },\n};\n\nexport interface TokenPayload {\n  jti: string;\n  sub: string;\n  user_id: string;\n  workspace_id?: string;\n  org_id?: string;\n  tenant_endpoint?: string;\n  iat: number;\n  exp: number;\n  scope?: string;\n}\n\nexport interface VerifyTokenResult {\n  valid: boolean;\n  payload?: TokenPayload;\n  error?: string;\n}\n\nexport interface RefreshTokenResult {\n  accessToken: string;\n  refreshToken: string;\n  expiresIn: number;\n}\n\nexport * from './cookie-helper.js';\n\n/**\n * Authentication Module\n */\nexport class AuthModule {\n  constructor(\n    private client: BurdenoffGraphQLClient,\n    private context: SDKContext\n  ) {}\n\n  /**\n   * Verify JWT token\n   */\n  public async verifyToken(token: string): Promise<VerifyTokenResult> {\n    logger.debug('[Auth] Verifying token');\n\n    // First check if token is expired locally\n    if (isTokenExpired(token)) {\n      return {\n        valid: false,\n        error: 'Token expired',\n      };\n    }\n\n    const query = `\n      query VerifyToken($token: String!) {\n        verifyToken(token: $token) {\n          valid\n          payload\n          error\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{ verifyToken: VerifyTokenResult }>(query, { token }, this.context);\n\n      logger.debug('[Auth] Token verification result', { valid: response.verifyToken.valid });\n\n      return response.verifyToken;\n    } catch (error) {\n      logger.error('[Auth] Token verification failed', { error });\n      return {\n        valid: false,\n        error: error instanceof Error ? error.message : 'Unknown error',\n      };\n    }\n  }\n\n  /**\n   * Decode token without verification\n   */\n  public decodeToken(token: string): TokenPayload | null {\n    const payload = parseJWT(token);\n    if (!payload) {\n      return null;\n    }\n    return payload as unknown as TokenPayload;\n  }\n\n  /**\n   * Refresh access token using refresh token\n   */\n  public async refreshToken(refreshToken: string): Promise<RefreshTokenResult> {\n    logger.debug('[Auth] Refreshing token');\n\n    const mutation = `\n      mutation RefreshToken($refreshToken: String!) {\n        refreshToken(refreshToken: $refreshToken) {\n          accessToken\n          refreshToken\n          expiresIn\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{ refreshToken: RefreshTokenResult }>(\n        mutation,\n        { refreshToken },\n        this.context\n      );\n\n      logger.info('[Auth] Token refreshed successfully');\n\n      return response.refreshToken;\n    } catch (error) {\n      logger.error('[Auth] Token refresh failed', { error });\n      throw new AuthenticationError('Failed to refresh token', {\n        error: error instanceof Error ? error.message : 'Unknown error',\n      });\n    }\n  }\n\n  /**\n   * Validate user has specific permission\n   */\n  public async validatePermission(userId: string, permission: string, resourceId?: string): Promise<boolean> {\n    logger.debug('[Auth] Validating permission', { userId, permission, resourceId });\n\n    const query = `\n      query ValidatePermission($userId: ID!, $permission: String!, $resourceId: ID) {\n        validatePermission(userId: $userId, permission: $permission, resourceId: $resourceId) {\n          allowed\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{\n        validatePermission: { allowed: boolean };\n      }>(query, { userId, permission, resourceId }, this.context);\n\n      logger.debug('[Auth] Permission validation result', {\n        allowed: response.validatePermission.allowed,\n      });\n\n      return response.validatePermission.allowed;\n    } catch (error) {\n      logger.error('[Auth] Permission validation failed', { error });\n      return false;\n    }\n  }\n\n  /**\n   * Check if token is valid and not expired\n   */\n  public isTokenValid(token: string): boolean {\n    return !isTokenExpired(token);\n  }\n\n  /**\n   * Get user ID from token\n   */\n  public getUserIdFromToken(token: string): string | null {\n    const payload = this.decodeToken(token);\n    return payload?.user_id || null;\n  }\n\n  /**\n   * Get workspace ID from token\n   */\n  public getWorkspaceIdFromToken(token: string): string | null {\n    const payload = this.decodeToken(token);\n    return payload?.workspace_id || null;\n  }\n\n  /**\n   * Extract all claims from token\n   */\n  public getTokenClaims(token: string): Record<string, unknown> | null {\n    const payload = parseJWT(token);\n    return payload;\n  }\n\n  /**\n   * Check if token will expire soon (within given seconds)\n   */\n  public willExpireSoon(token: string, withinSeconds: number = 300): boolean {\n    const payload = this.decodeToken(token);\n    if (!payload || typeof payload.exp !== 'number') {\n      return true;\n    }\n\n    const now = Math.floor(Date.now() / 1000);\n    return payload.exp - now < withinSeconds;\n  }\n}\n"]}
+{"version":3,"sources":["../src/auth/index.ts"],"names":["ACCESS_TOKEN_COOKIE","REFRESH_TOKEN_COOKIE","ACCESS_TOKEN_MAX_AGE","REFRESH_TOKEN_MAX_AGE","REFRESH_TOKEN_REMEMBER_MAX_AGE","buildCookieString","name","value","maxAge","buildClearCookieString","AuthCookieHelper","setAuthCookies","context","tokens","options","headers","responseHeaders","rememberMe","refreshMaxAge","append","accessToken","refreshToken","clearAuthCookies","AuthModule","client","verifyToken","token","logger","debug","isTokenExpired","valid","error","query","response","Error","message","decodeToken","payload","parseJWT","mutation","info","AuthenticationError","validatePermission","userId","permission","resourceId","allowed","isTokenValid","getUserIdFromToken","user_id","getWorkspaceIdFromToken","workspace_id","getTokenClaims","willExpireSoon","withinSeconds","exp","now","Math","floor","Date"],"mappings":";;;;;;AAgBA,IAAMA,mBAAAA,GAAsB,iBAAA;AAC5B,IAAMC,oBAAAA,GAAuB,kBAAA;AAC7B,IAAMC,uBAAuB,EAAA,GAAK,EAAA;AAClC,IAAMC,qBAAAA,GAAwB,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAC7C,IAAMC,8BAAAA,GAAiC,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAEtD,SAASC,iBAAAA,CAAkBC,IAAAA,EAAcC,KAAAA,EAAeC,MAAAA,EAAc;AACpE,EAAA,OAAO,CAAA,EAAGF,IAAAA,CAAAA,CAAAA,EAAQC,KAAAA,aAAkBC,MAAAA,CAAAA,mCAAAA,CAAAA;AACtC;AAFSH,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAIT,SAASI,uBAAuBH,IAAAA,EAAY;AAC1C,EAAA,OAAO,GAAGA,IAAAA,CAAAA,+CAAAA,CAAAA;AACZ;AAFSG,MAAAA,CAAAA,sBAAAA,EAAAA,wBAAAA,CAAAA;AAIF,IAAMC,gBAAAA,GAAmB;EAC9BC,cAAAA,CACEC,OAAAA,EACAC,QACAC,OAAAA,EAAkC;AAElC,IAAA,MAAMC,UAAUH,OAAAA,CAAQI,eAAAA;AACxB,IAAA,IAAI,CAACD,OAAAA,EAAS;AAEd,IAAA,MAAME,UAAAA,GAAaH,SAASG,UAAAA,IAAc,KAAA;AAC1C,IAAA,MAAMC,aAAAA,GAAgBD,aAAab,8BAAAA,GAAiCD,qBAAAA;AAEpEY,IAAAA,OAAAA,CAAQI,OAAO,YAAA,EAAcd,iBAAAA,CAAkBL,qBAAqBa,MAAAA,CAAOO,WAAAA,EAAalB,oBAAAA,CAAAA,CAAAA;AACxFa,IAAAA,OAAAA,CAAQI,OAAO,YAAA,EAAcd,iBAAAA,CAAkBJ,sBAAsBY,MAAAA,CAAOQ,YAAAA,EAAcH,aAAAA,CAAAA,CAAAA;AAC5F,EAAA,CAAA;AAEAI,EAAAA,gBAAAA,CAAiBV,OAAAA,EAAsB;AACrC,IAAA,MAAMG,UAAUH,OAAAA,CAAQI,eAAAA;AACxB,IAAA,IAAI,CAACD,OAAAA,EAAS;AAEdA,IAAAA,OAAAA,CAAQI,MAAAA,CAAO,YAAA,EAAcV,sBAAAA,CAAuBT,mBAAAA,CAAAA,CAAAA;AACpDe,IAAAA,OAAAA,CAAQI,MAAAA,CAAO,YAAA,EAAcV,sBAAAA,CAAuBR,oBAAAA,CAAAA,CAAAA;AACtD,EAAA;AACF;AA+BO,IAAMsB,aAAN,MAAMA;EApFb;;;;;AAqFE,EAAA,WAAA,CACUC,QACAZ,OAAAA,EACR;SAFQY,MAAAA,GAAAA,MAAAA;SACAZ,OAAAA,GAAAA,OAAAA;AACP,EAAA;;;;AAKH,EAAA,MAAaa,YAAYC,KAAAA,EAA2C;AAClEC,IAAAA,MAAAA,CAAOC,MAAM,wBAAA,CAAA;AAGb,IAAA,IAAIC,cAAAA,CAAeH,KAAAA,CAAAA,EAAQ;AACzB,MAAA,OAAO;QACLI,KAAAA,EAAO,KAAA;QACPC,KAAAA,EAAO;AACT,OAAA;AACF,IAAA;AAEA,IAAA,MAAMC,KAAAA,GAAQ;;;;;;;;;AAUd,IAAA,IAAI;AACF,MAAA,MAAMC,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MAA0CA,KAAAA,EAAO;AAAEN,QAAAA;AAAM,OAAA,EAAG,KAAKd,OAAO,CAAA;AAE3Ge,MAAAA,MAAAA,CAAOC,MAAM,kCAAA,EAAoC;AAAEE,QAAAA,KAAAA,EAAOG,SAASR,WAAAA,CAAYK;OAAM,CAAA;AAErF,MAAA,OAAOG,QAAAA,CAASR,WAAAA;AAClB,IAAA,CAAA,CAAA,OAASM,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,kCAAA,EAAoC;AAAEA,QAAAA;OAAM,CAAA;AACzD,MAAA,OAAO;QACLD,KAAAA,EAAO,KAAA;QACPC,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMI,OAAAA,GAAU;AAClD,OAAA;AACF,IAAA;AACF,EAAA;;;;AAKOC,EAAAA,WAAAA,CAAYV,KAAAA,EAAoC;AACrD,IAAA,MAAMW,OAAAA,GAAUC,SAASZ,KAAAA,CAAAA;AACzB,IAAA,IAAI,CAACW,OAAAA,EAAS;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AACA,IAAA,OAAOA,OAAAA;AACT,EAAA;;;;AAKA,EAAA,MAAahB,aAAaA,YAAAA,EAAmD;AAC3EM,IAAAA,MAAAA,CAAOC,MAAM,yBAAA,CAAA;AAEb,IAAA,MAAMW,QAAAA,GAAW;;;;;;;;;AAUjB,IAAA,IAAI;AACF,MAAA,MAAMN,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MACjCO,QAAAA,EACA;AAAElB,QAAAA;AAAa,OAAA,EACf,KAAKT,OAAO,CAAA;AAGde,MAAAA,MAAAA,CAAOa,KAAK,qCAAA,CAAA;AAEZ,MAAA,OAAOP,QAAAA,CAASZ,YAAAA;AAClB,IAAA,CAAA,CAAA,OAASU,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,6BAAA,EAA+B;AAAEA,QAAAA;OAAM,CAAA;AACpD,MAAA,MAAM,IAAIU,oBAAoB,yBAAA,EAA2B;QACvDV,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMI,OAAAA,GAAU;OAClD,CAAA;AACF,IAAA;AACF,EAAA;;;;EAKA,MAAaO,kBAAAA,CAAmBC,MAAAA,EAAgBC,UAAAA,EAAoBC,UAAAA,EAAuC;AACzGlB,IAAAA,MAAAA,CAAOC,MAAM,8BAAA,EAAgC;AAAEe,MAAAA,MAAAA;AAAQC,MAAAA,UAAAA;AAAYC,MAAAA;KAAW,CAAA;AAE9E,IAAA,MAAMb,KAAAA,GAAQ;;;;;;;AAQd,IAAA,IAAI;AACF,MAAA,MAAMC,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MAEhCA,KAAAA,EAAO;AAAEW,QAAAA,MAAAA;AAAQC,QAAAA,UAAAA;AAAYC,QAAAA;AAAW,OAAA,EAAG,KAAKjC,OAAO,CAAA;AAE1De,MAAAA,MAAAA,CAAOC,MAAM,qCAAA,EAAuC;AAClDkB,QAAAA,OAAAA,EAASb,SAASS,kBAAAA,CAAmBI;OACvC,CAAA;AAEA,MAAA,OAAOb,SAASS,kBAAAA,CAAmBI,OAAAA;AACrC,IAAA,CAAA,CAAA,OAASf,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,qCAAA,EAAuC;AAAEA,QAAAA;OAAM,CAAA;AAC5D,MAAA,OAAO,KAAA;AACT,IAAA;AACF,EAAA;;;;AAKOgB,EAAAA,YAAAA,CAAarB,KAAAA,EAAwB;AAC1C,IAAA,OAAO,CAACG,eAAeH,KAAAA,CAAAA;AACzB,EAAA;;;;AAKOsB,EAAAA,kBAAAA,CAAmBtB,KAAAA,EAA8B;AACtD,IAAA,MAAMW,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,OAAOW,SAASY,OAAAA,IAAW,IAAA;AAC7B,EAAA;;;;AAKOC,EAAAA,uBAAAA,CAAwBxB,KAAAA,EAA8B;AAC3D,IAAA,MAAMW,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,OAAOW,SAASc,YAAAA,IAAgB,IAAA;AAClC,EAAA;;;;AAKOC,EAAAA,cAAAA,CAAe1B,KAAAA,EAA+C;AACnE,IAAA,MAAMW,OAAAA,GAAUC,SAASZ,KAAAA,CAAAA;AACzB,IAAA,OAAOW,OAAAA;AACT,EAAA;;;;EAKOgB,cAAAA,CAAe3B,KAAAA,EAAe4B,gBAAwB,GAAA,EAAc;AACzE,IAAA,MAAMjB,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,IAAI,CAACW,OAAAA,IAAW,OAAOA,OAAAA,CAAQkB,QAAQ,QAAA,EAAU;AAC/C,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMC,MAAMC,IAAAA,CAAKC,KAAAA,CAAMC,IAAAA,CAAKH,GAAAA,KAAQ,GAAA,CAAA;AACpC,IAAA,OAAOnB,OAAAA,CAAQkB,MAAMC,GAAAA,GAAMF,aAAAA;AAC7B,EAAA;AACF","file":"chunk-UNPJMENC.js","sourcesContent":["/**\n * Authentication Module\n * JWT verification, token management, and user authentication\n */\n\nimport type { BurdenoffGraphQLClient } from '../client/graphql.js';\nimport type { SDKContext } from '../types/index.js';\nimport { AuthenticationError } from '../types/index.js';\nimport { logger } from '../logger/index.js';\nimport { parseJWT, isTokenExpired } from '../utils/index.js';\n\ninterface CookieContext {\n  responseHeaders?: Headers;\n  [key: string]: unknown;\n}\n\nconst ACCESS_TOKEN_COOKIE = 'bf_access_token';\nconst REFRESH_TOKEN_COOKIE = 'bf_refresh_token';\nconst ACCESS_TOKEN_MAX_AGE = 15 * 60; // 15 minutes\nconst REFRESH_TOKEN_MAX_AGE = 30 * 24 * 60 * 60; // 30 days\nconst REFRESH_TOKEN_REMEMBER_MAX_AGE = 30 * 24 * 60 * 60; // 30 days (same, controlled by backend)\n\nfunction buildCookieString(name: string, value: string, maxAge: number): string {\n  return `${name}=${value}; Max-Age=${maxAge}; Path=/; HttpOnly; SameSite=Strict`;\n}\n\nfunction buildClearCookieString(name: string): string {\n  return `${name}=; Max-Age=0; Path=/; HttpOnly; SameSite=Strict`;\n}\n\nexport const AuthCookieHelper = {\n  setAuthCookies(\n    context: CookieContext,\n    tokens: { accessToken: string; refreshToken: string },\n    options?: { rememberMe?: boolean }\n  ): void {\n    const headers = context.responseHeaders;\n    if (!headers) return;\n\n    const rememberMe = options?.rememberMe ?? false;\n    const refreshMaxAge = rememberMe ? REFRESH_TOKEN_REMEMBER_MAX_AGE : REFRESH_TOKEN_MAX_AGE;\n\n    headers.append('Set-Cookie', buildCookieString(ACCESS_TOKEN_COOKIE, tokens.accessToken, ACCESS_TOKEN_MAX_AGE));\n    headers.append('Set-Cookie', buildCookieString(REFRESH_TOKEN_COOKIE, tokens.refreshToken, refreshMaxAge));\n  },\n\n  clearAuthCookies(context: CookieContext): void {\n    const headers = context.responseHeaders;\n    if (!headers) return;\n\n    headers.append('Set-Cookie', buildClearCookieString(ACCESS_TOKEN_COOKIE));\n    headers.append('Set-Cookie', buildClearCookieString(REFRESH_TOKEN_COOKIE));\n  },\n};\n\nexport interface TokenPayload {\n  jti: string;\n  sub: string;\n  user_id: string;\n  workspace_id?: string;\n  org_id?: string;\n  tenant_endpoint?: string;\n  iat: number;\n  exp: number;\n  scope?: string;\n}\n\nexport interface VerifyTokenResult {\n  valid: boolean;\n  payload?: TokenPayload;\n  error?: string;\n}\n\nexport interface RefreshTokenResult {\n  accessToken: string;\n  refreshToken: string;\n  expiresIn: number;\n}\n\nexport * from './cookie-helper.js';\n\n/**\n * Authentication Module\n */\nexport class AuthModule {\n  constructor(\n    private client: BurdenoffGraphQLClient,\n    private context: SDKContext\n  ) {}\n\n  /**\n   * Verify JWT token\n   */\n  public async verifyToken(token: string): Promise<VerifyTokenResult> {\n    logger.debug('[Auth] Verifying token');\n\n    // First check if token is expired locally\n    if (isTokenExpired(token)) {\n      return {\n        valid: false,\n        error: 'Token expired',\n      };\n    }\n\n    const query = `\n      query VerifyToken($token: String!) {\n        verifyToken(token: $token) {\n          valid\n          payload\n          error\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{ verifyToken: VerifyTokenResult }>(query, { token }, this.context);\n\n      logger.debug('[Auth] Token verification result', { valid: response.verifyToken.valid });\n\n      return response.verifyToken;\n    } catch (error) {\n      logger.error('[Auth] Token verification failed', { error });\n      return {\n        valid: false,\n        error: error instanceof Error ? error.message : 'Unknown error',\n      };\n    }\n  }\n\n  /**\n   * Decode token without verification\n   */\n  public decodeToken(token: string): TokenPayload | null {\n    const payload = parseJWT(token);\n    if (!payload) {\n      return null;\n    }\n    return payload as unknown as TokenPayload;\n  }\n\n  /**\n   * Refresh access token using refresh token\n   */\n  public async refreshToken(refreshToken: string): Promise<RefreshTokenResult> {\n    logger.debug('[Auth] Refreshing token');\n\n    const mutation = `\n      mutation RefreshToken($refreshToken: String!) {\n        refreshToken(refreshToken: $refreshToken) {\n          accessToken\n          refreshToken\n          expiresIn\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{ refreshToken: RefreshTokenResult }>(\n        mutation,\n        { refreshToken },\n        this.context\n      );\n\n      logger.info('[Auth] Token refreshed successfully');\n\n      return response.refreshToken;\n    } catch (error) {\n      logger.error('[Auth] Token refresh failed', { error });\n      throw new AuthenticationError('Failed to refresh token', {\n        error: error instanceof Error ? error.message : 'Unknown error',\n      });\n    }\n  }\n\n  /**\n   * Validate user has specific permission\n   */\n  public async validatePermission(userId: string, permission: string, resourceId?: string): Promise<boolean> {\n    logger.debug('[Auth] Validating permission', { userId, permission, resourceId });\n\n    const query = `\n      query ValidatePermission($userId: ID!, $permission: String!, $resourceId: ID) {\n        validatePermission(userId: $userId, permission: $permission, resourceId: $resourceId) {\n          allowed\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{\n        validatePermission: { allowed: boolean };\n      }>(query, { userId, permission, resourceId }, this.context);\n\n      logger.debug('[Auth] Permission validation result', {\n        allowed: response.validatePermission.allowed,\n      });\n\n      return response.validatePermission.allowed;\n    } catch (error) {\n      logger.error('[Auth] Permission validation failed', { error });\n      return false;\n    }\n  }\n\n  /**\n   * Check if token is valid and not expired\n   */\n  public isTokenValid(token: string): boolean {\n    return !isTokenExpired(token);\n  }\n\n  /**\n   * Get user ID from token\n   */\n  public getUserIdFromToken(token: string): string | null {\n    const payload = this.decodeToken(token);\n    return payload?.user_id || null;\n  }\n\n  /**\n   * Get workspace ID from token\n   */\n  public getWorkspaceIdFromToken(token: string): string | null {\n    const payload = this.decodeToken(token);\n    return payload?.workspace_id || null;\n  }\n\n  /**\n   * Extract all claims from token\n   */\n  public getTokenClaims(token: string): Record<string, unknown> | null {\n    const payload = parseJWT(token);\n    return payload;\n  }\n\n  /**\n   * Check if token will expire soon (within given seconds)\n   */\n  public willExpireSoon(token: string, withinSeconds: number = 300): boolean {\n    const payload = this.decodeToken(token);\n    if (!payload || typeof payload.exp !== 'number') {\n      return true;\n    }\n\n    const now = Math.floor(Date.now() / 1000);\n    return payload.exp - now < withinSeconds;\n  }\n}\n"]}

package/dist/{chunk-MQ6OE5QR.js → chunk-WCBKW3CL.js}

@@ -1,4 +1,4 @@
-import { resetGraphEventEmitter, getGraphEventEmitter, createMemoryPublisher, createGraphEventEmitter, createMemoryConsumer, createGraphEventEmitter2, NatsGraphEventEmitter, MemoryEventQueue, MemoryEventPublisher, MemoryEventConsumer, MemoryEventBus, GraphEventEmitterImpl } from './chunk-VKSB2K5E.js';
+import { resetGraphEventEmitter, getGraphEventEmitter, createMemoryPublisher, createGraphEventEmitter, createMemoryConsumer, createGraphEventEmitter2, MemoryEventQueue, MemoryEventPublisher, MemoryEventConsumer, MemoryEventBus, GraphEventEmitterImpl } from './chunk-SO57HNXV.js';
 import { RedisStreamsEventPublisher, RedisStreamsEventConsumer, QueueType, EventQueueFactory } from './chunk-TM5RQ6P2.js';
 import { streamKey, dlqKey, RedisStreamsConnection } from './chunk-MVHOP4IG.js';
 import { logger } from './chunk-CBZNP6RF.js';
@@ -16,7 +16,6 @@ __export(event_queue_exports, {
   MemoryEventPublisher: () => MemoryEventPublisher,
   MemoryEventQueue: () => MemoryEventQueue,
   ModuleEventsService: () => ModuleEventsService,
-  NatsGraphEventEmitter: () => NatsGraphEventEmitter,
   QueueType: () => QueueType,
   RedisStreamsConnection: () => RedisStreamsConnection,
   RedisStreamsEventConsumer: () => RedisStreamsEventConsumer,
@@ -49,16 +48,12 @@ var ModuleEventsService = class {
     this.productSource = config.moduleName;
     this.subjectPrefix = config.subjectPrefix || config.moduleName;
     this.loggerLabel = config.loggerLabel || `${config.moduleName.charAt(0).toUpperCase()}${config.moduleName.slice(1)}EventsService`;
-    const natsServers = process.env["NATS_SERVERS"] || process.env["NATS_URL"];
-    if (natsServers) {
-      if (!process.env["NATS_SERVERS"] && process.env["NATS_URL"]) {
-        process.env["NATS_SERVERS"] = process.env["NATS_URL"];
-      }
+    if (process.env["REDIS_URL"]) {
       this.publisher = EventQueueFactory.createPublisherFromEnv();
-      logger.info(`[${this.loggerLabel}] Using NATS publisher`);
+      logger.info(`[${this.loggerLabel}] Using Redis Streams publisher`);
     } else {
       this.publisher = new MemoryEventPublisher();
-      logger.info(`[${this.loggerLabel}] Using in-memory publisher (NATS_SERVERS not configured)`);
+      logger.info(`[${this.loggerLabel}] Using in-memory publisher (REDIS_URL not configured)`);
     }
   }
   /**
@@ -465,5 +460,5 @@ function createConsumer(stream, consumer) {
 __name(createConsumer, "createConsumer");
 
 export { EventPriority, EventsModule, ModuleEventsService, createConsumer, createModuleEventsService, createPublisher, event_queue_exports };
-//# sourceMappingURL=chunk-MQ6OE5QR.js.map
-//# sourceMappingURL=chunk-MQ6OE5QR.js.map
+//# sourceMappingURL=chunk-WCBKW3CL.js.map
+//# sourceMappingURL=chunk-WCBKW3CL.js.map