@burdenoff/be-sdk 2026.527.3 → 2026.528.2

package/dist/chunk-XUU5IBVU.js

@@ -0,0 +1,449 @@
+import { logger } from './chunk-CBZNP6RF.js';
+import { __name } from './chunk-XE4OXN2W.js';
+import { GraphQLError } from 'graphql';
+
+var DEFAULT_ERROR_CODE = "INTERNAL_SERVER_ERROR";
+var DEFAULT_HTTP_STATUS = 500;
+var DEFAULT_USER_MESSAGES = {
+  BAD_REQUEST: "Please check the request and try again.",
+  BAD_USER_INPUT: "Please check the information and try again.",
+  CAPTCHA_FAILED: "The verification failed. Please try again.",
+  CAPTCHA_REQUIRED: "Please complete the verification to continue.",
+  COMPLEXITY_TOO_HIGH: "This request is too large to process. Please simplify it and try again.",
+  CONFLICT: "This change conflicts with existing data. Please refresh and try again.",
+  FORBIDDEN: "You do not have permission to do that.",
+  INTERNAL_SERVER_ERROR: "Something went wrong. Please try again.",
+  INVALID_PASSWORD: "The password you entered is incorrect.",
+  NOT_FOUND: "We could not find the requested item.",
+  PERMISSION_DENIED: "You do not have permission to do that.",
+  QUOTA_EXCEEDED: "You've reached your usage limit.",
+  QUOTA_EXHAUSTED: "You've reached your usage limit.",
+  RATE_LIMITED: "Too many requests. Please wait a moment and try again.",
+  RESOURCE_CAP_EXCEEDED: "You've reached your plan limit. Upgrade your plan to continue.",
+  STORAGE_QUOTA_EXCEEDED: "You've reached your storage limit. Upgrade your plan to continue.",
+  TIMEOUT: "The request took too long. Please try again.",
+  UNAUTHENTICATED: "Please sign in to continue.",
+  VALIDATION_ERROR: "Please check the information and try again.",
+  WORKSPACE_REQUIRED: "Please choose a workspace and try again."
+};
+var DEFAULT_STATUS_BY_CODE = {
+  BAD_REQUEST: 400,
+  BAD_USER_INPUT: 400,
+  CAPTCHA_FAILED: 400,
+  CAPTCHA_REQUIRED: 400,
+  COMPLEXITY_TOO_HIGH: 400,
+  CONFLICT: 409,
+  FORBIDDEN: 403,
+  INVALID_PASSWORD: 400,
+  NOT_FOUND: 404,
+  PERMISSION_DENIED: 403,
+  QUOTA_EXCEEDED: 429,
+  QUOTA_EXHAUSTED: 429,
+  RATE_LIMITED: 429,
+  RESOURCE_CAP_EXCEEDED: 429,
+  STORAGE_QUOTA_EXCEEDED: 429,
+  TIMEOUT: 504,
+  UNAUTHENTICATED: 401,
+  VALIDATION_ERROR: 400,
+  WORKSPACE_REQUIRED: 403
+};
+var SENSITIVE_EXTENSION_KEYS = /* @__PURE__ */ new Set([
+  "exception",
+  "originalError",
+  "stack",
+  "stacktrace"
+]);
+var TECHNICAL_MESSAGE_PATTERNS = [
+  /\bprisma\b/i,
+  /\bsql\b/i,
+  /\bconstraint\b/i,
+  /\bstack\b/i,
+  /\bundefined\b/i,
+  /\bnull\b/i,
+  /\bECONN[A-Z_]*\b/,
+  /\bETIMEDOUT\b/,
+  /\bENOTFOUND\b/,
+  /\bP\d{4}\b/,
+  /Cannot (read|set|find|access)/i,
+  /Build failed \(exit \d+\)/i,
+  /JSON\.stringify/i
+];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+__name(isRecord, "isRecord");
+function readString(record, key) {
+  const value = record[key];
+  return typeof value === "string" && value.trim().length > 0 ? value : null;
+}
+__name(readString, "readString");
+function readExtensions(error) {
+  if (!isRecord(error)) return {};
+  const extensions = error["extensions"];
+  return isRecord(extensions) ? extensions : {};
+}
+__name(readExtensions, "readExtensions");
+function readOriginalError(error) {
+  if (error instanceof GraphQLError && error.originalError instanceof Error) {
+    return error.originalError;
+  }
+  return void 0;
+}
+__name(readOriginalError, "readOriginalError");
+function sanitizeExtensions(extensions) {
+  const sanitized = {};
+  for (const [key, value] of Object.entries(extensions)) {
+    if (!SENSITIVE_EXTENSION_KEYS.has(key)) {
+      sanitized[key] = value;
+    }
+  }
+  return sanitized;
+}
+__name(sanitizeExtensions, "sanitizeExtensions");
+function normalizeCode(code) {
+  if (!code) return DEFAULT_ERROR_CODE;
+  return code.trim().replace(/[\s-]+/g, "_").toUpperCase();
+}
+__name(normalizeCode, "normalizeCode");
+function inferCodeFromMessage(message) {
+  const lower = message.toLowerCase();
+  if (lower.includes("unauthenticated") || lower.includes("not authenticated") || lower.includes("authentication required") || lower.includes("unauthorized") || lower.includes("please sign in") || lower.includes("sign in to")) {
+    return "UNAUTHENTICATED";
+  }
+  if (lower.includes("workspace context") || lower.includes("switch to a workspace")) {
+    return "WORKSPACE_REQUIRED";
+  }
+  if (lower.includes("forbidden") || lower.includes("access denied") || lower.includes("permission denied") || lower.includes("not authorized")) {
+    return "FORBIDDEN";
+  }
+  if (lower.includes("not found") || lower.includes("disappeared")) {
+    return "NOT_FOUND";
+  }
+  if (lower.includes("already exists") || lower.includes("already taken") || lower.includes("conflict")) {
+    return "CONFLICT";
+  }
+  if (lower.includes("quota") || lower.includes("cap exceeded") || lower.includes("limit reached")) {
+    return "QUOTA_EXCEEDED";
+  }
+  if (lower.includes("timeout") || lower.includes("timed out")) {
+    return "TIMEOUT";
+  }
+  if (lower.includes("required") || lower.includes("invalid") || lower.includes("missing") || lower.includes("unsupported")) {
+    return "BAD_USER_INPUT";
+  }
+  return DEFAULT_ERROR_CODE;
+}
+__name(inferCodeFromMessage, "inferCodeFromMessage");
+function inferCode(error, extensions, originalError) {
+  const extensionCode = typeof extensions["code"] === "string" ? extensions["code"] : null;
+  if (extensionCode) return normalizeCode(extensionCode);
+  if (isRecord(originalError)) {
+    const originalCode = readString(originalError, "code");
+    if (originalCode) return normalizeCode(originalCode);
+  }
+  if (isRecord(error)) {
+    const directCode = readString(error, "code");
+    if (directCode) return normalizeCode(directCode);
+  }
+  const message = readErrorMessage(error);
+  return inferCodeFromMessage(message);
+}
+__name(inferCode, "inferCode");
+function readErrorMessage(error) {
+  if (error instanceof Error && error.message.trim().length > 0) {
+    return error.message;
+  }
+  if (isRecord(error)) {
+    const message = readString(error, "message");
+    if (message) return message;
+  }
+  return DEFAULT_USER_MESSAGES[DEFAULT_ERROR_CODE];
+}
+__name(readErrorMessage, "readErrorMessage");
+function isLikelyTechnicalMessage(message) {
+  if (message.length > 220) return true;
+  if (message.includes("\n")) return true;
+  if (message.includes("{") && message.includes("}")) return true;
+  return TECHNICAL_MESSAGE_PATTERNS.some((pattern) => pattern.test(message));
+}
+__name(isLikelyTechnicalMessage, "isLikelyTechnicalMessage");
+function readExplicitUserMessage(extensions) {
+  return readString(extensions, "userMessage") ?? readString(extensions, "humanMessage") ?? readString(extensions, "displayMessage");
+}
+__name(readExplicitUserMessage, "readExplicitUserMessage");
+function resolveUserMessage(code, message, extensions) {
+  const explicit = readExplicitUserMessage(extensions);
+  if (explicit) return explicit;
+  const fallback = DEFAULT_USER_MESSAGES[code] ?? DEFAULT_USER_MESSAGES[DEFAULT_ERROR_CODE] ?? "Something went wrong. Please try again.";
+  if (code === DEFAULT_ERROR_CODE) {
+    return fallback;
+  }
+  if (!isLikelyTechnicalMessage(message)) {
+    return message;
+  }
+  return fallback;
+}
+__name(resolveUserMessage, "resolveUserMessage");
+function resolveTechnicalMessage(code, message, extensions, options) {
+  const explicit = readString(extensions, "technicalMessage");
+  if (explicit) return explicit;
+  if (options.environment === "production" && code === DEFAULT_ERROR_CODE) {
+    return options.serviceName ? `${options.serviceName} returned ${DEFAULT_ERROR_CODE}` : DEFAULT_ERROR_CODE;
+  }
+  return message;
+}
+__name(resolveTechnicalMessage, "resolveTechnicalMessage");
+function readHttpStatus(extensions, code) {
+  const http = extensions["http"];
+  if (isRecord(http) && typeof http["status"] === "number") {
+    return http["status"];
+  }
+  return DEFAULT_STATUS_BY_CODE[code] ?? DEFAULT_HTTP_STATUS;
+}
+__name(readHttpStatus, "readHttpStatus");
+function normalizeError(error, options = {}) {
+  const originalError = readOriginalError(error);
+  const originalExtensions = readExtensions(originalError);
+  const directExtensions = readExtensions(error);
+  const mergedExtensions = sanitizeExtensions({
+    ...originalExtensions,
+    ...directExtensions
+  });
+  const message = readErrorMessage(error);
+  const code = inferCode(error, mergedExtensions, originalError);
+  const userMessage = resolveUserMessage(code, message, mergedExtensions);
+  const technicalMessage = resolveTechnicalMessage(code, message, mergedExtensions, options);
+  const status = readHttpStatus(mergedExtensions, code);
+  const extensions = {
+    ...mergedExtensions,
+    code,
+    userMessage,
+    technicalMessage
+  };
+  if (options.serviceName) {
+    extensions["serviceName"] = options.serviceName;
+  }
+  if (!isRecord(extensions["http"])) {
+    extensions["http"] = {
+      status
+    };
+  }
+  return {
+    code,
+    userMessage,
+    technicalMessage,
+    extensions,
+    status
+  };
+}
+__name(normalizeError, "normalizeError");
+var UserFacingGraphQLError = class extends GraphQLError {
+  static {
+    __name(this, "UserFacingGraphQLError");
+  }
+  constructor(options) {
+    const extensions = {
+      code: normalizeCode(options.code),
+      userMessage: options.userMessage,
+      technicalMessage: options.technicalMessage ?? options.userMessage
+    };
+    if (options.details) {
+      extensions["details"] = options.details;
+    }
+    if (options.httpStatus) {
+      extensions["http"] = {
+        status: options.httpStatus
+      };
+    }
+    super(options.userMessage, {
+      originalError: options.cause,
+      extensions
+    });
+    this.name = "UserFacingGraphQLError";
+  }
+};
+function toUserFacingGraphQLError(error, options = {}) {
+  const normalized = normalizeError(error, options);
+  if (error instanceof GraphQLError) {
+    return new GraphQLError(normalized.userMessage, {
+      nodes: error.nodes,
+      source: error.source,
+      positions: error.positions,
+      path: error.path,
+      originalError: error.originalError,
+      extensions: normalized.extensions
+    });
+  }
+  return new GraphQLError(normalized.userMessage, {
+    originalError: error instanceof Error ? error : void 0,
+    extensions: normalized.extensions
+  });
+}
+__name(toUserFacingGraphQLError, "toUserFacingGraphQLError");
+function normalizeExecutionResultErrors(result, options = {}) {
+  if (!isRecord(result)) return;
+  const errors = result["errors"];
+  if (!Array.isArray(errors) || errors.length === 0) return;
+  result["errors"] = errors.map((error) => toUserFacingGraphQLError(error, options));
+}
+__name(normalizeExecutionResultErrors, "normalizeExecutionResultErrors");
+function createHumanReadableErrorPlugin(options = {}) {
+  return {
+    onExecute() {
+      return {
+        onExecuteDone({ result }) {
+          normalizeExecutionResultErrors(result, options);
+        }
+      };
+    }
+  };
+}
+__name(createHumanReadableErrorPlugin, "createHumanReadableErrorPlugin");
+function formatHttpError(error, options = {}) {
+  const normalized = normalizeError(error, options);
+  return {
+    status: normalized.status,
+    body: {
+      error: normalized.userMessage,
+      message: normalized.userMessage,
+      userMessage: normalized.userMessage,
+      technicalMessage: normalized.technicalMessage,
+      code: normalized.code,
+      extensions: normalized.extensions
+    }
+  };
+}
+__name(formatHttpError, "formatHttpError");
+function createHttpErrorResponse(error, options = {}) {
+  const formatted = formatHttpError(error, options);
+  return new Response(JSON.stringify(formatted.body), {
+    status: formatted.status,
+    headers: {
+      "Content-Type": "application/json"
+    }
+  });
+}
+__name(createHttpErrorResponse, "createHttpErrorResponse");
+
+// src/server/workspace-guard.ts
+var WorkspaceRequiredError = class WorkspaceRequiredError2 extends UserFacingGraphQLError {
+  static {
+    __name(this, "WorkspaceRequiredError");
+  }
+  constructor(message) {
+    super({
+      code: "WORKSPACE_REQUIRED",
+      userMessage: "Please choose a workspace and try again.",
+      technicalMessage: message,
+      httpStatus: 403
+    });
+    this.name = "WorkspaceRequiredError";
+  }
+};
+function isFieldPublic(field) {
+  const directives = field?.astNode?.directives;
+  if (!directives || directives.length === 0) return false;
+  for (const dir of directives) {
+    const name = dir.name?.value;
+    if (name === "public") return true;
+    if (name === "rbac") {
+      const args = dir.arguments ?? [];
+      for (const arg of args) {
+        if (arg.name?.value === "public" && arg.value?.kind === "BooleanValue" && arg.value.value === true) {
+          return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+__name(isFieldPublic, "isFieldPublic");
+function resolveOperationType(document, operationName) {
+  const defs = document?.definitions ?? [];
+  for (const def of defs) {
+    if (def.kind !== "OperationDefinition") ;
+    if (def.operation && (!operationName || def.name?.value === operationName)) {
+      return def.operation;
+    }
+  }
+  return "query";
+}
+__name(resolveOperationType, "resolveOperationType");
+function allRootFieldsPublic(schema, document, operationName) {
+  if (!schema || !document) return false;
+  const opType = resolveOperationType(document, operationName);
+  let rootType;
+  if (opType === "mutation") {
+    rootType = schema.getMutationType?.();
+  } else if (opType === "subscription") {
+    rootType = schema.getSubscriptionType?.();
+  } else {
+    rootType = schema.getQueryType?.();
+  }
+  if (!rootType) return false;
+  const fields = rootType.getFields();
+  const defs = document.definitions ?? [];
+  const opDef = defs.find((d) => d.operation && (!operationName || d.name?.value === operationName));
+  const selections = opDef?.selectionSet?.selections ?? [];
+  if (selections.length === 0) return false;
+  for (const sel of selections) {
+    if (sel.kind && sel.kind !== "Field") return false;
+    const fieldName = sel.name?.value;
+    if (!fieldName) return false;
+    if (fieldName.startsWith("__")) continue;
+    const fieldDef = fields[fieldName];
+    if (!isFieldPublic(fieldDef)) return false;
+  }
+  return true;
+}
+__name(allRootFieldsPublic, "allRootFieldsPublic");
+function createWorkspaceGuardPlugin(config) {
+  const enabled = config?.enabled ?? true;
+  const whitelistedOperations = new Set(config?.whitelistedOperations ?? []);
+  const allowPublicDirective = config?.allowPublicDirective ?? true;
+  const errorMessage = config?.errorMessage ?? "Workspace context required. Ensure the request includes a valid workspace context (x-workspace-id header).";
+  if (!enabled) {
+    logger.info("[WorkspaceGuard] Workspace guard disabled");
+    return {};
+  }
+  logger.info("[WorkspaceGuard] Workspace guard enabled", {
+    whitelistedOperations: [
+      ...whitelistedOperations
+    ],
+    allowPublicDirective
+  });
+  return {
+    onExecute({ args }) {
+      let operationName = args.operationName;
+      if (!operationName && args.document?.definitions) {
+        for (const def of args.document.definitions) {
+          if (def.operation && def.name?.value) {
+            operationName = def.name.value;
+            break;
+          }
+        }
+      }
+      if (operationName && whitelistedOperations.has(operationName)) {
+        return void 0;
+      }
+      if (allowPublicDirective && allRootFieldsPublic(args.schema, args.document, operationName)) {
+        return void 0;
+      }
+      const context = args.contextValue;
+      const workspaceId = context?.workspace?.id;
+      const headerWorkspaceId = context?.request?.headers?.get?.("x-workspace-id");
+      if (!workspaceId && !headerWorkspaceId) {
+        logger.warn("[WorkspaceGuard] Blocked operation without workspace context", {
+          operationName: operationName ?? "<anonymous>"
+        });
+        throw new WorkspaceRequiredError(errorMessage);
+      }
+      return void 0;
+    }
+  };
+}
+__name(createWorkspaceGuardPlugin, "createWorkspaceGuardPlugin");
+
+export { UserFacingGraphQLError, createHttpErrorResponse, createHumanReadableErrorPlugin, createWorkspaceGuardPlugin, formatHttpError, normalizeError, normalizeExecutionResultErrors, toUserFacingGraphQLError };
+//# sourceMappingURL=chunk-XUU5IBVU.js.map
+//# sourceMappingURL=chunk-XUU5IBVU.js.map

package/dist/chunk-XUU5IBVU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/errors.ts","../src/server/workspace-guard.ts"],"names":["DEFAULT_ERROR_CODE","DEFAULT_HTTP_STATUS","DEFAULT_USER_MESSAGES","BAD_REQUEST","BAD_USER_INPUT","CAPTCHA_FAILED","CAPTCHA_REQUIRED","COMPLEXITY_TOO_HIGH","CONFLICT","FORBIDDEN","INTERNAL_SERVER_ERROR","INVALID_PASSWORD","NOT_FOUND","PERMISSION_DENIED","QUOTA_EXCEEDED","QUOTA_EXHAUSTED","RATE_LIMITED","RESOURCE_CAP_EXCEEDED","STORAGE_QUOTA_EXCEEDED","TIMEOUT","UNAUTHENTICATED","VALIDATION_ERROR","WORKSPACE_REQUIRED","DEFAULT_STATUS_BY_CODE","SENSITIVE_EXTENSION_KEYS","Set","TECHNICAL_MESSAGE_PATTERNS","isRecord","value","Array","isArray","readString","record","key","trim","length","readExtensions","error","extensions","readOriginalError","GraphQLError","originalError","Error","undefined","sanitizeExtensions","sanitized","Object","entries","has","normalizeCode","code","replace","toUpperCase","inferCodeFromMessage","message","lower","toLowerCase","includes","inferCode","extensionCode","originalCode","directCode","readErrorMessage","isLikelyTechnicalMessage","some","pattern","test","readExplicitUserMessage","resolveUserMessage","explicit","fallback","resolveTechnicalMessage","options","environment","serviceName","readHttpStatus","http","normalizeError","originalExtensions","directExtensions","mergedExtensions","userMessage","technicalMessage","status","UserFacingGraphQLError","details","httpStatus","cause","name","toUserFacingGraphQLError","normalized","nodes","source","positions","path","normalizeExecutionResultErrors","result","errors","map","createHumanReadableErrorPlugin","onExecute","onExecuteDone","formatHttpError","body","createHttpErrorResponse","formatted","Response","JSON","stringify","headers","WorkspaceRequiredError","isFieldPublic","field","directives","astNode","dir","args","arguments","arg","kind","resolveOperationType","document","operationName","defs","definitions","def","operation","allRootFieldsPublic","schema","opType","rootType","getMutationType","getSubscriptionType","getQueryType","fields","getFields","opDef","find","d","selections","selectionSet","sel","fieldName","startsWith","fieldDef","createWorkspaceGuardPlugin","config","enabled","whitelistedOperations","allowPublicDirective","errorMessage","logger","info","context","contextValue","workspaceId","workspace","id","headerWorkspaceId","request","get","warn"],"mappings":";;;;AAwCA,IAAMA,kBAAAA,GAAqB,uBAAA;AAC3B,IAAMC,mBAAAA,GAAsB,GAAA;AAE5B,IAAMC,qBAAAA,GAAgD;EACpDC,WAAAA,EAAa,yCAAA;EACbC,cAAAA,EAAgB,6CAAA;EAChBC,cAAAA,EAAgB,4CAAA;EAChBC,gBAAAA,EAAkB,+CAAA;EAClBC,mBAAAA,EAAqB,yEAAA;EACrBC,QAAAA,EAAU,yEAAA;EACVC,SAAAA,EAAW,wCAAA;EACXC,qBAAAA,EAAuB,yCAAA;EACvBC,gBAAAA,EAAkB,wCAAA;EAClBC,SAAAA,EAAW,uCAAA;EACXC,iBAAAA,EAAmB,wCAAA;EACnBC,cAAAA,EAAgB,kCAAA;EAChBC,eAAAA,EAAiB,kCAAA;EACjBC,YAAAA,EAAc,wDAAA;EACdC,qBAAAA,EAAuB,gEAAA;EACvBC,sBAAAA,EAAwB,mEAAA;EACxBC,OAAAA,EAAS,8CAAA;EACTC,eAAAA,EAAiB,6BAAA;EACjBC,gBAAAA,EAAkB,6CAAA;EAClBC,kBAAAA,EAAoB;AACtB,CAAA;AAEA,IAAMC,sBAAAA,GAAiD;EACrDpB,WAAAA,EAAa,GAAA;EACbC,cAAAA,EAAgB,GAAA;EAChBC,cAAAA,EAAgB,GAAA;EAChBC,gBAAAA,EAAkB,GAAA;EAClBC,mBAAAA,EAAqB,GAAA;EACrBC,QAAAA,EAAU,GAAA;EACVC,SAAAA,EAAW,GAAA;EACXE,gBAAAA,EAAkB,GAAA;EAClBC,SAAAA,EAAW,GAAA;EACXC,iBAAAA,EAAmB,GAAA;EACnBC,cAAAA,EAAgB,GAAA;EAChBC,eAAAA,EAAiB,GAAA;EACjBC,YAAAA,EAAc,GAAA;EACdC,qBAAAA,EAAuB,GAAA;EACvBC,sBAAAA,EAAwB,GAAA;EACxBC,OAAAA,EAAS,GAAA;EACTC,eAAAA,EAAiB,GAAA;EACjBC,gBAAAA,EAAkB,GAAA;EAClBC,kBAAAA,EAAoB;AACtB,CAAA;AAEA,IAAME,wBAAAA,uBAA+BC,GAAAA,CAAI;AAAC,EAAA,WAAA;AAAa,EAAA,eAAA;AAAiB,EAAA,OAAA;AAAS,EAAA;AAAa,CAAA,CAAA;AAE9F,IAAMC,0BAAAA,GAA6B;AACjC,EAAA,aAAA;AACA,EAAA,UAAA;AACA,EAAA,iBAAA;AACA,EAAA,YAAA;AACA,EAAA,gBAAA;AACA,EAAA,WAAA;AACA,EAAA,kBAAA;AACA,EAAA,eAAA;AACA,EAAA,eAAA;AACA,EAAA,YAAA;AACA,EAAA,gCAAA;AACA,EAAA,4BAAA;AACA,EAAA;;AAGF,SAASC,SAASC,KAAAA,EAAc;AAC9B,EAAA,OAAO,OAAOA,UAAU,QAAA,IAAYA,KAAAA,KAAU,QAAQ,CAACC,KAAAA,CAAMC,QAAQF,KAAAA,CAAAA;AACvE;AAFSD,MAAAA,CAAAA,QAAAA,EAAAA,UAAAA,CAAAA;AAIT,SAASI,UAAAA,CAAWC,QAAiCC,GAAAA,EAAW;AAC9D,EAAA,MAAML,KAAAA,GAAQI,OAAOC,GAAAA,CAAAA;AACrB,EAAA,OAAO,OAAOL,UAAU,QAAA,IAAYA,KAAAA,CAAMM,MAAI,CAAGC,MAAAA,GAAS,IAAIP,KAAAA,GAAQ,IAAA;AACxE;AAHSG,MAAAA,CAAAA,UAAAA,EAAAA,YAAAA,CAAAA;AAKT,SAASK,eAAeC,KAAAA,EAAc;AACpC,EAAA,IAAI,CAACV,QAAAA,CAASU,KAAAA,CAAAA,SAAe,EAAC;AAC9B,EAAA,MAAMC,UAAAA,GAAaD,MAAM,YAAA,CAAA;AACzB,EAAA,OAAOV,QAAAA,CAASW,UAAAA,CAAAA,GAAcA,UAAAA,GAAa,EAAC;AAC9C;AAJSF,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAMT,SAASG,kBAAkBF,KAAAA,EAAc;AACvC,EAAA,IAAIA,KAAAA,YAAiBG,YAAAA,IAAgBH,KAAAA,CAAMI,aAAAA,YAAyBC,KAAAA,EAAO;AACzE,IAAA,OAAOL,KAAAA,CAAMI,aAAAA;AACf,EAAA;AACA,EAAA,OAAOE,MAAAA;AACT;AALSJ,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAOT,SAASK,mBAAmBN,UAAAA,EAAmC;AAC7D,EAAA,MAAMO,YAAqC,EAAC;AAC5C,EAAA,KAAA,MAAW,CAACZ,GAAAA,EAAKL,KAAAA,KAAUkB,MAAAA,CAAOC,OAAAA,CAAQT,UAAAA,CAAAA,EAAa;AACrD,IAAA,IAAI,CAACd,wBAAAA,CAAyBwB,GAAAA,CAAIf,GAAAA,CAAAA,EAAM;AACtCY,MAAAA,SAAAA,CAAUZ,GAAAA,CAAAA,GAAOL,KAAAA;AACnB,IAAA;AACF,EAAA;AACA,EAAA,OAAOiB,SAAAA;AACT;AARSD,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA;AAUT,SAASK,cAAcC,IAAAA,EAAmB;AACxC,EAAA,IAAI,CAACA,MAAM,OAAOlD,kBAAAA;AAClB,EAAA,OAAOkD,KACJhB,IAAAA,EAAI,CACJiB,QAAQ,SAAA,EAAW,GAAA,EACnBC,WAAAA,EAAW;AAChB;AANSH,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAQT,SAASI,qBAAqBC,OAAAA,EAAe;AAC3C,EAAA,MAAMC,KAAAA,GAAQD,QAAQE,WAAAA,EAAW;AAEjC,EAAA,IACED,KAAAA,CAAME,SAAS,iBAAA,CAAA,IACfF,MAAME,QAAAA,CAAS,mBAAA,CAAA,IACfF,KAAAA,CAAME,QAAAA,CAAS,yBAAA,KACfF,KAAAA,CAAME,QAAAA,CAAS,cAAA,CAAA,IACfF,KAAAA,CAAME,QAAAA,CAAS,gBAAA,CAAA,IACfF,KAAAA,CAAME,QAAAA,CAAS,YAAA,CAAA,EACf;AACA,IAAA,OAAO,iBAAA;AACT,EAAA;AAEA,EAAA,IAAIF,MAAME,QAAAA,CAAS,mBAAA,KAAwBF,KAAAA,CAAME,QAAAA,CAAS,uBAAA,CAAA,EAA0B;AAClF,IAAA,OAAO,oBAAA;AACT,EAAA;AAEA,EAAA,IACEF,KAAAA,CAAME,QAAAA,CAAS,WAAA,CAAA,IACfF,MAAME,QAAAA,CAAS,eAAA,CAAA,IACfF,KAAAA,CAAME,SAAS,mBAAA,CAAA,IACfF,KAAAA,CAAME,QAAAA,CAAS,gBAAA,CAAA,EACf;AACA,IAAA,OAAO,WAAA;AACT,EAAA;AAEA,EAAA,IAAIF,MAAME,QAAAA,CAAS,WAAA,KAAgBF,KAAAA,CAAME,QAAAA,CAAS,aAAA,CAAA,EAAgB;AAChE,IAAA,OAAO,WAAA;AACT,EAAA;AAEA,EAAA,IAAIF,KAAAA,CAAME,QAAAA,CAAS,gBAAA,CAAA,IAAqBF,KAAAA,CAAME,QAAAA,CAAS,eAAA,CAAA,IAAoBF,KAAAA,CAAME,QAAAA,CAAS,UAAA,CAAA,EAAa;AACrG,IAAA,OAAO,UAAA;AACT,EAAA;AAEA,EAAA,IAAIF,KAAAA,CAAME,QAAAA,CAAS,OAAA,CAAA,IAAYF,KAAAA,CAAME,QAAAA,CAAS,cAAA,CAAA,IAAmBF,KAAAA,CAAME,QAAAA,CAAS,eAAA,CAAA,EAAkB;AAChG,IAAA,OAAO,gBAAA;AACT,EAAA;AAEA,EAAA,IAAIF,MAAME,QAAAA,CAAS,SAAA,KAAcF,KAAAA,CAAME,QAAAA,CAAS,WAAA,CAAA,EAAc;AAC5D,IAAA,OAAO,SAAA;AACT,EAAA;AAEA,EAAA,IACEF,KAAAA,CAAME,QAAAA,CAAS,UAAA,CAAA,IACfF,MAAME,QAAAA,CAAS,SAAA,CAAA,IACfF,KAAAA,CAAME,SAAS,SAAA,CAAA,IACfF,KAAAA,CAAME,QAAAA,CAAS,aAAA,CAAA,EACf;AACA,IAAA,OAAO,gBAAA;AACT,EAAA;AAEA,EAAA,OAAOzD,kBAAAA;AACT;AArDSqD,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAuDT,SAASK,SAAAA,CAAUrB,KAAAA,EAAgBC,UAAAA,EAAqCG,aAAAA,EAAgC;AACtG,EAAA,MAAMkB,aAAAA,GAAgB,OAAOrB,UAAAA,CAAW,MAAA,MAAY,QAAA,GAAWA,UAAAA,CAAW,MAAA,CAAA,GAAU,IAAA;AACpF,EAAA,IAAIqB,aAAAA,EAAe,OAAOV,aAAAA,CAAcU,aAAAA,CAAAA;AAExC,EAAA,IAAIhC,QAAAA,CAASc,aAAAA,CAAAA,EAAgB;AAC3B,IAAA,MAAMmB,YAAAA,GAAe7B,UAAAA,CAAWU,aAAAA,EAAe,MAAA,CAAA;AAC/C,IAAA,IAAImB,YAAAA,EAAc,OAAOX,aAAAA,CAAcW,YAAAA,CAAAA;AACzC,EAAA;AAEA,EAAA,IAAIjC,QAAAA,CAASU,KAAAA,CAAAA,EAAQ;AACnB,IAAA,MAAMwB,UAAAA,GAAa9B,UAAAA,CAAWM,KAAAA,EAAO,MAAA,CAAA;AACrC,IAAA,IAAIwB,UAAAA,EAAY,OAAOZ,aAAAA,CAAcY,UAAAA,CAAAA;AACvC,EAAA;AAEA,EAAA,MAAMP,OAAAA,GAAUQ,iBAAiBzB,KAAAA,CAAAA;AACjC,EAAA,OAAOgB,qBAAqBC,OAAAA,CAAAA;AAC9B;AAhBSI,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAkBT,SAASI,iBAAiBzB,KAAAA,EAAc;AACtC,EAAA,IAAIA,iBAAiBK,KAAAA,IAASL,KAAAA,CAAMiB,QAAQpB,IAAAA,EAAI,CAAGC,SAAS,CAAA,EAAG;AAC7D,IAAA,OAAOE,KAAAA,CAAMiB,OAAAA;AACf,EAAA;AACA,EAAA,IAAI3B,QAAAA,CAASU,KAAAA,CAAAA,EAAQ;AACnB,IAAA,MAAMiB,OAAAA,GAAUvB,UAAAA,CAAWM,KAAAA,EAAO,SAAA,CAAA;AAClC,IAAA,IAAIiB,SAAS,OAAOA,OAAAA;AACtB,EAAA;AACA,EAAA,OAAOpD,qBAAAA,CAAsBF,kBAAAA,CAAuB;AACtD;AATS8D,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAWT,SAASC,yBAAyBT,OAAAA,EAAe;AAC/C,EAAA,IAAIA,OAAAA,CAAQnB,MAAAA,GAAS,GAAA,EAAK,OAAO,IAAA;AACjC,EAAA,IAAImB,OAAAA,CAAQG,QAAAA,CAAS,IAAA,CAAA,EAAO,OAAO,IAAA;AACnC,EAAA,IAAIH,OAAAA,CAAQG,SAAS,GAAA,CAAA,IAAQH,QAAQG,QAAAA,CAAS,GAAA,GAAM,OAAO,IAAA;AAC3D,EAAA,OAAO/B,2BAA2BsC,IAAAA,CAAK,CAACC,YAAYA,OAAAA,CAAQC,IAAAA,CAAKZ,OAAAA,CAAAA,CAAAA;AACnE;AALSS,MAAAA,CAAAA,wBAAAA,EAAAA,0BAAAA,CAAAA;AAOT,SAASI,wBAAwB7B,UAAAA,EAAmC;AAClE,EAAA,OACEP,UAAAA,CAAWO,UAAAA,EAAY,aAAA,CAAA,IACvBP,UAAAA,CAAWO,YAAY,cAAA,CAAA,IACvBP,UAAAA,CAAWO,UAAAA,EAAY,gBAAA,CAAA;AAE3B;AANS6B,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AAQT,SAASC,kBAAAA,CAAmBlB,IAAAA,EAAcI,OAAAA,EAAiBhB,UAAAA,EAAmC;AAC5F,EAAA,MAAM+B,QAAAA,GAAWF,wBAAwB7B,UAAAA,CAAAA;AACzC,EAAA,IAAI+B,UAAU,OAAOA,QAAAA;AAErB,EAAA,MAAMC,WACJpE,qBAAAA,CAAsBgD,IAAAA,CAAAA,IACtBhD,qBAAAA,CAAsBF,kBAAAA,CAAAA,IACtB,yCAAA;AACF,EAAA,IAAIkD,SAASlD,kBAAAA,EAAoB;AAC/B,IAAA,OAAOsE,QAAAA;AACT,EAAA;AAEA,EAAA,IAAI,CAACP,wBAAAA,CAAyBT,OAAAA,CAAAA,EAAU;AACtC,IAAA,OAAOA,OAAAA;AACT,EAAA;AAEA,EAAA,OAAOgB,QAAAA;AACT;AAjBSF,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA;AAmBT,SAASG,uBAAAA,CACPrB,IAAAA,EACAI,OAAAA,EACAhB,UAAAA,EACAkC,OAAAA,EAAkC;AAElC,EAAA,MAAMH,QAAAA,GAAWtC,UAAAA,CAAWO,UAAAA,EAAY,kBAAA,CAAA;AACxC,EAAA,IAAI+B,UAAU,OAAOA,QAAAA;AAErB,EAAA,IAAIG,OAAAA,CAAQC,WAAAA,KAAgB,YAAA,IAAgBvB,IAAAA,KAASlD,kBAAAA,EAAoB;AACvE,IAAA,OAAOwE,QAAQE,WAAAA,GAAc,CAAA,EAAGF,QAAQE,WAAW,CAAA,UAAA,EAAa1E,kBAAAA,CAAAA,CAAAA,GAAuBA,kBAAAA;AACzF,EAAA;AAEA,EAAA,OAAOsD,OAAAA;AACT;AAdSiB,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AAgBT,SAASI,cAAAA,CAAerC,YAAqCY,IAAAA,EAAY;AACvE,EAAA,MAAM0B,IAAAA,GAAOtC,WAAW,MAAA,CAAA;AACxB,EAAA,IAAIX,SAASiD,IAAAA,CAAAA,IAAS,OAAOA,IAAAA,CAAK,QAAA,MAAc,QAAA,EAAU;AACxD,IAAA,OAAOA,KAAK,QAAA,CAAA;AACd,EAAA;AACA,EAAA,OAAOrD,sBAAAA,CAAuB2B,IAAAA,CAAAA,IAASjD,mBAAAA;AACzC;AANS0E,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAQF,SAASE,cAAAA,CAAexC,KAAAA,EAAgBmC,OAAAA,GAAqC,EAAC,EAAC;AACpF,EAAA,MAAM/B,aAAAA,GAAgBF,kBAAkBF,KAAAA,CAAAA;AACxC,EAAA,MAAMyC,kBAAAA,GAAqB1C,eAAeK,aAAAA,CAAAA;AAC1C,EAAA,MAAMsC,gBAAAA,GAAmB3C,eAAeC,KAAAA,CAAAA;AACxC,EAAA,MAAM2C,mBAAmBpC,kBAAAA,CAAmB;IAAE,GAAGkC,kBAAAA;IAAoB,GAAGC;GAAiB,CAAA;AACzF,EAAA,MAAMzB,OAAAA,GAAUQ,iBAAiBzB,KAAAA,CAAAA;AACjC,EAAA,MAAMa,IAAAA,GAAOQ,SAAAA,CAAUrB,KAAAA,EAAO2C,gBAAAA,EAAkBvC,aAAAA,CAAAA;AAChD,EAAA,MAAMwC,WAAAA,GAAcb,kBAAAA,CAAmBlB,IAAAA,EAAMI,OAAAA,EAAS0B,gBAAAA,CAAAA;AACtD,EAAA,MAAME,gBAAAA,GAAmBX,uBAAAA,CAAwBrB,IAAAA,EAAMI,OAAAA,EAAS0B,kBAAkBR,OAAAA,CAAAA;AAClF,EAAA,MAAMW,MAAAA,GAASR,cAAAA,CAAeK,gBAAAA,EAAkB9B,IAAAA,CAAAA;AAEhD,EAAA,MAAMZ,UAAAA,GAAsC;IAC1C,GAAG0C,gBAAAA;AACH9B,IAAAA,IAAAA;AACA+B,IAAAA,WAAAA;AACAC,IAAAA;AACF,GAAA;AAEA,EAAA,IAAIV,QAAQE,WAAAA,EAAa;AACvBpC,IAAAA,UAAAA,CAAW,aAAA,IAAiBkC,OAAAA,CAAQE,WAAAA;AACtC,EAAA;AAEA,EAAA,IAAI,CAAC/C,QAAAA,CAASW,UAAAA,CAAW,MAAA,CAAO,CAAA,EAAG;AACjCA,IAAAA,UAAAA,CAAW,MAAA,CAAA,GAAU;AAAE6C,MAAAA;AAAO,KAAA;AAChC,EAAA;AAEA,EAAA,OAAO;AACLjC,IAAAA,IAAAA;AACA+B,IAAAA,WAAAA;AACAC,IAAAA,gBAAAA;AACA5C,IAAAA,UAAAA;AACA6C,IAAAA;AACF,GAAA;AACF;AAjCgBN,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAmCT,IAAMO,sBAAAA,GAAN,cAAqC5C,YAAAA,CAAAA;EAnU5C;;;AAoUE,EAAA,WAAA,CAAYgC,OAAAA,EAAiC;AAC3C,IAAA,MAAMlC,UAAAA,GAAsC;MAC1CY,IAAAA,EAAMD,aAAAA,CAAcuB,QAAQtB,IAAI,CAAA;AAChC+B,MAAAA,WAAAA,EAAaT,OAAAA,CAAQS,WAAAA;MACrBC,gBAAAA,EAAkBV,OAAAA,CAAQU,oBAAoBV,OAAAA,CAAQS;AACxD,KAAA;AAEA,IAAA,IAAIT,QAAQa,OAAAA,EAAS;AACnB/C,MAAAA,UAAAA,CAAW,SAAA,IAAakC,OAAAA,CAAQa,OAAAA;AAClC,IAAA;AAEA,IAAA,IAAIb,QAAQc,UAAAA,EAAY;AACtBhD,MAAAA,UAAAA,CAAW,MAAA,CAAA,GAAU;AAAE6C,QAAAA,MAAAA,EAAQX,OAAAA,CAAQc;AAAW,OAAA;AACpD,IAAA;AAEA,IAAA,KAAA,CAAMd,QAAQS,WAAAA,EAAa;AACzBxC,MAAAA,aAAAA,EAAe+B,OAAAA,CAAQe,KAAAA;AACvBjD,MAAAA;KACF,CAAA;AACA,IAAA,IAAA,CAAKkD,IAAAA,GAAO,wBAAA;AACd,EAAA;AACF;AAEO,SAASC,wBAAAA,CAAyBpD,KAAAA,EAAgBmC,OAAAA,GAAqC,EAAC,EAAC;AAC9F,EAAA,MAAMkB,UAAAA,GAAab,cAAAA,CAAexC,KAAAA,EAAOmC,OAAAA,CAAAA;AAEzC,EAAA,IAAInC,iBAAiBG,YAAAA,EAAc;AACjC,IAAA,OAAO,IAAIA,YAAAA,CAAakD,UAAAA,CAAWT,WAAAA,EAAa;AAC9CU,MAAAA,KAAAA,EAAOtD,KAAAA,CAAMsD,KAAAA;AACbC,MAAAA,MAAAA,EAAQvD,KAAAA,CAAMuD,MAAAA;AACdC,MAAAA,SAAAA,EAAWxD,KAAAA,CAAMwD,SAAAA;AACjBC,MAAAA,IAAAA,EAAMzD,KAAAA,CAAMyD,IAAAA;AACZrD,MAAAA,aAAAA,EAAeJ,KAAAA,CAAMI,aAAAA;AACrBH,MAAAA,UAAAA,EAAYoD,UAAAA,CAAWpD;KACzB,CAAA;AACF,EAAA;AAEA,EAAA,OAAO,IAAIE,YAAAA,CAAakD,UAAAA,CAAWT,WAAAA,EAAa;IAC9CxC,aAAAA,EAAeJ,KAAAA,YAAiBK,QAAQL,KAAAA,GAAQM,MAAAA;AAChDL,IAAAA,UAAAA,EAAYoD,UAAAA,CAAWpD;GACzB,CAAA;AACF;AAlBgBmD,MAAAA,CAAAA,wBAAAA,EAAAA,0BAAAA,CAAAA;AAoBT,SAASM,8BAAAA,CAA+BC,MAAAA,EAAiBxB,OAAAA,GAAqC,EAAC,EAAC;AACrG,EAAA,IAAI,CAAC7C,QAAAA,CAASqE,MAAAA,CAAAA,EAAS;AACvB,EAAA,MAAMC,MAAAA,GAASD,OAAO,QAAA,CAAA;AACtB,EAAA,IAAI,CAACnE,KAAAA,CAAMC,OAAAA,CAAQmE,MAAAA,CAAAA,IAAWA,MAAAA,CAAO9D,WAAW,CAAA,EAAG;AAEnD6D,EAAAA,MAAAA,CAAO,QAAA,IAAYC,MAAAA,CAAOC,GAAAA,CAAI,CAAC7D,KAAAA,KAAUoD,wBAAAA,CAAyBpD,KAAAA,EAAOmC,OAAAA,CAAAA,CAAAA;AAC3E;AANgBuB,MAAAA,CAAAA,8BAAAA,EAAAA,gCAAAA,CAAAA;AAQT,SAASI,8BAAAA,CAA+B3B,OAAAA,GAAqC,EAAC,EAAC;AACpF,EAAA,OAAO;IACL4B,SAAAA,GAAAA;AACE,MAAA,OAAO;QACLC,aAAAA,CAAc,EAAEL,QAAM,EAAuB;AAC3CD,UAAAA,8BAAAA,CAA+BC,QAAQxB,OAAAA,CAAAA;AACzC,QAAA;AACF,OAAA;AACF,IAAA;AACF,GAAA;AACF;AAVgB2B,MAAAA,CAAAA,8BAAAA,EAAAA,gCAAAA,CAAAA;AAYT,SAASG,eAAAA,CAAgBjE,KAAAA,EAAgBmC,OAAAA,GAAqC,EAAC,EAAC;AACrF,EAAA,MAAMkB,UAAAA,GAAab,cAAAA,CAAexC,KAAAA,EAAOmC,OAAAA,CAAAA;AACzC,EAAA,OAAO;AACLW,IAAAA,MAAAA,EAAQO,UAAAA,CAAWP,MAAAA;IACnBoB,IAAAA,EAAM;AACJlE,MAAAA,KAAAA,EAAOqD,UAAAA,CAAWT,WAAAA;AAClB3B,MAAAA,OAAAA,EAASoC,UAAAA,CAAWT,WAAAA;AACpBA,MAAAA,WAAAA,EAAaS,UAAAA,CAAWT,WAAAA;AACxBC,MAAAA,gBAAAA,EAAkBQ,UAAAA,CAAWR,gBAAAA;AAC7BhC,MAAAA,IAAAA,EAAMwC,UAAAA,CAAWxC,IAAAA;AACjBZ,MAAAA,UAAAA,EAAYoD,UAAAA,CAAWpD;AACzB;AACF,GAAA;AACF;AAbgBgE,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAeT,SAASE,uBAAAA,CAAwBnE,KAAAA,EAAgBmC,OAAAA,GAAqC,EAAC,EAAC;AAC7F,EAAA,MAAMiC,SAAAA,GAAYH,eAAAA,CAAgBjE,KAAAA,EAAOmC,OAAAA,CAAAA;AACzC,EAAA,OAAO,IAAIkC,QAAAA,CAASC,IAAAA,CAAKC,SAAAA,CAAUH,SAAAA,CAAUF,IAAI,CAAA,EAAG;AAClDpB,IAAAA,MAAAA,EAAQsB,SAAAA,CAAUtB,MAAAA;IAClB0B,OAAAA,EAAS;MAAE,cAAA,EAAgB;AAAmB;GAChD,CAAA;AACF;AANgBL,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;;;ACrUhB,IAAMM,sBAAAA,GAAN,MAAMA,uBAAAA,SAA+B1B,sBAAAA,CAAAA;EA7ErC;;;AA8EE,EAAA,WAAA,CAAY9B,OAAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM;MACJJ,IAAAA,EAAM,oBAAA;MACN+B,WAAAA,EAAa,0CAAA;MACbC,gBAAAA,EAAkB5B,OAAAA;MAClBgC,UAAAA,EAAY;KACd,CAAA;AACA,IAAA,IAAA,CAAKE,IAAAA,GAAO,wBAAA;AACd,EAAA;AACF,CAAA;AAkCA,SAASuB,cAAcC,KAAAA,EAA+B;AACpD,EAAA,MAAMC,UAAAA,GAAaD,OAAOE,OAAAA,EAASD,UAAAA;AACnC,EAAA,IAAI,CAACA,UAAAA,IAAcA,UAAAA,CAAW9E,MAAAA,KAAW,GAAG,OAAO,KAAA;AAEnD,EAAA,KAAA,MAAWgF,OAAOF,UAAAA,EAAY;AAC5B,IAAA,MAAMzB,IAAAA,GAAO2B,IAAI3B,IAAAA,EAAM5D,KAAAA;AACvB,IAAA,IAAI4D,IAAAA,KAAS,UAAU,OAAO,IAAA;AAC9B,IAAA,IAAIA,SAAS,MAAA,EAAQ;AACnB,MAAA,MAAM4B,IAAAA,GAAOD,GAAAA,CAAIE,SAAAA,IAAa,EAAA;AAC9B,MAAA,KAAA,MAAWC,OAAOF,IAAAA,EAAM;AACtB,QAAA,IAAIE,GAAAA,CAAI9B,IAAAA,EAAM5D,KAAAA,KAAU,QAAA,IAAY0F,GAAAA,CAAI1F,KAAAA,EAAO2F,IAAAA,KAAS,cAAA,IAAkBD,GAAAA,CAAI1F,KAAAA,CAAMA,KAAAA,KAAU,IAAA,EAAM;AAClG,UAAA,OAAO,IAAA;AACT,QAAA;AACF,MAAA;AACF,IAAA;AACF,EAAA;AACA,EAAA,OAAO,KAAA;AACT;AAjBSmF,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAqCT,SAASS,oBAAAA,CACPC,UACAC,aAAAA,EAAwC;AAExC,EAAA,MAAMC,IAAAA,GAAOF,QAAAA,EAAUG,WAAAA,IAAe,EAAA;AACtC,EAAA,KAAA,MAAWC,OAAOF,IAAAA,EAAM;AACtB,IAAA,IAAIE,GAAAA,CAAIN,SAAS,qBAAA,EAAuB;AAGxC,IAAA,IAAIM,IAAIC,SAAAA,KAAc,CAACJ,iBAAiBG,GAAAA,CAAIrC,IAAAA,EAAM5D,UAAU8F,aAAAA,CAAAA,EAAgB;AAC1E,MAAA,OAAOG,GAAAA,CAAIC,SAAAA;AACb,IAAA;AACF,EAAA;AACA,EAAA,OAAO,OAAA;AACT;AAdSN,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAoBT,SAASO,mBAAAA,CACPC,MAAAA,EACAP,QAAAA,EACAC,aAAAA,EAAwC;AAExC,EAAA,IAAI,CAACM,MAAAA,IAAU,CAACP,QAAAA,EAAU,OAAO,KAAA;AAEjC,EAAA,MAAMQ,MAAAA,GAAST,oBAAAA,CAAqBC,QAAAA,EAAUC,aAAAA,CAAAA;AAC9C,EAAA,IAAIQ,QAAAA;AACJ,EAAA,IAAID,WAAW,UAAA,EAAY;AACzBC,IAAAA,QAAAA,GAAWF,OAAOG,eAAAA,IAAe;AACnC,EAAA,CAAA,MAAA,IAAWF,WAAW,cAAA,EAAgB;AACpCC,IAAAA,QAAAA,GAAWF,OAAOI,mBAAAA,IAAmB;EACvC,CAAA,MAAO;AACLF,IAAAA,QAAAA,GAAWF,OAAOK,YAAAA,IAAY;AAChC,EAAA;AAEA,EAAA,IAAI,CAACH,UAAU,OAAO,KAAA;AAEtB,EAAA,MAAMI,MAAAA,GAASJ,SAASK,SAAAA,EAAS;AACjC,EAAA,MAAMZ,IAAAA,GAAOF,QAAAA,CAASG,WAAAA,IAAe,EAAA;AAGrC,EAAA,MAAMY,KAAAA,GAAQb,IAAAA,CAAKc,IAAAA,CAAK,CAACC,CAAAA,KAAMA,CAAAA,CAAEZ,SAAAA,KAAc,CAACJ,aAAAA,IAAiBgB,CAAAA,CAAElD,IAAAA,EAAM5D,KAAAA,KAAU8F,aAAAA,CAAY,CAAA;AAC/F,EAAA,MAAMiB,UAAAA,GAAaH,KAAAA,EAAOI,YAAAA,EAAcD,UAAAA,IAAc,EAAA;AACtD,EAAA,IAAIA,UAAAA,CAAWxG,MAAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAEpC,EAAA,KAAA,MAAW0G,OAAOF,UAAAA,EAAY;AAG5B,IAAA,IAAIE,GAAAA,CAAItB,IAAAA,IAAQsB,GAAAA,CAAItB,IAAAA,KAAS,SAAS,OAAO,KAAA;AAC7C,IAAA,MAAMuB,SAAAA,GAAYD,IAAIrD,IAAAA,EAAM5D,KAAAA;AAC5B,IAAA,IAAI,CAACkH,WAAW,OAAO,KAAA;AAGvB,IAAA,IAAIA,SAAAA,CAAUC,UAAAA,CAAW,IAAA,CAAA,EAAO;AAChC,IAAA,MAAMC,QAAAA,GAAWV,OAAOQ,SAAAA,CAAAA;AACxB,IAAA,IAAI,CAAC/B,aAAAA,CAAciC,QAAAA,CAAAA,EAAW,OAAO,KAAA;AACvC,EAAA;AACA,EAAA,OAAO,IAAA;AACT;AAxCSjB,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAkEF,SAASkB,2BAA2BC,MAAAA,EAA6B;AACtE,EAAA,MAAMC,OAAAA,GAAUD,QAAQC,OAAAA,IAAW,IAAA;AACnC,EAAA,MAAMC,wBAAwB,IAAI3H,GAAAA,CAAIyH,MAAAA,EAAQE,qBAAAA,IAAyB,EAAE,CAAA;AACzE,EAAA,MAAMC,oBAAAA,GAAuBH,QAAQG,oBAAAA,IAAwB,IAAA;AAC7D,EAAA,MAAMC,YAAAA,GACJJ,QAAQI,YAAAA,IACR,4GAAA;AAEF,EAAA,IAAI,CAACH,OAAAA,EAAS;AACZI,IAAAA,MAAAA,CAAOC,KAAK,2CAAA,CAAA;AACZ,IAAA,OAAO,EAAC;AACV,EAAA;AAEAD,EAAAA,MAAAA,CAAOC,KAAK,0CAAA,EAA4C;IACtDJ,qBAAAA,EAAuB;AAAIA,MAAAA,GAAAA;;AAC3BC,IAAAA;GACF,CAAA;AAEA,EAAA,OAAO;IACLjD,SAAAA,CAAU,EACRgB,MAAI,EAQL;AAEC,MAAA,IAAIM,gBAAgBN,IAAAA,CAAKM,aAAAA;AAEzB,MAAA,IAAI,CAACA,aAAAA,IAAiBN,IAAAA,CAAKK,QAAAA,EAAUG,WAAAA,EAAa;AAChD,QAAA,KAAA,MAAWC,GAAAA,IAAOT,IAAAA,CAAKK,QAAAA,CAASG,WAAAA,EAAa;AAC3C,UAAA,IAAIC,GAAAA,CAAIC,SAAAA,IAAaD,GAAAA,CAAIrC,IAAAA,EAAM5D,KAAAA,EAAO;AACpC8F,YAAAA,aAAAA,GAAgBG,IAAIrC,IAAAA,CAAK5D,KAAAA;AACzB,YAAA;AACF,UAAA;AACF,QAAA;AACF,MAAA;AAGA,MAAA,IAAI8F,aAAAA,IAAiB0B,qBAAAA,CAAsBpG,GAAAA,CAAI0E,aAAAA,CAAAA,EAAgB;AAC7D,QAAA,OAAO/E,MAAAA;AACT,MAAA;AAGA,MAAA,IAAI0G,wBAAwBtB,mBAAAA,CAAoBX,IAAAA,CAAKY,QAAQZ,IAAAA,CAAKK,QAAAA,EAAUC,aAAAA,CAAAA,EAAgB;AAC1F,QAAA,OAAO/E,MAAAA;AACT,MAAA;AAGA,MAAA,MAAM8G,UAAUrC,IAAAA,CAAKsC,YAAAA;AACrB,MAAA,MAAMC,WAAAA,GAAcF,SAASG,SAAAA,EAAWC,EAAAA;AAGxC,MAAA,MAAMC,iBAAAA,GAAoBL,OAAAA,EAASM,OAAAA,EAASlD,OAAAA,EAASmD,MAAM,gBAAA,CAAA;AAE3D,MAAA,IAAI,CAACL,WAAAA,IAAe,CAACG,iBAAAA,EAAmB;AACtCP,QAAAA,MAAAA,CAAOU,KAAK,8DAAA,EAAgE;AAC1EvC,UAAAA,aAAAA,EAAeA,aAAAA,IAAiB;SAClC,CAAA;AACA,QAAA,MAAM,IAAIZ,uBAAuBwC,YAAAA,CAAAA;AACnC,MAAA;AAEA,MAAA,OAAO3G,MAAAA;AACT,IAAA;AACF,GAAA;AACF;AApEgBsG,MAAAA,CAAAA,0BAAAA,EAAAA,4BAAAA,CAAAA","file":"chunk-XUU5IBVU.js","sourcesContent":["import { GraphQLError } from 'graphql';\n\nimport type { YogaPlugin } from './types.js';\n\nexport interface UserFacingErrorOptions {\n  code: string;\n  userMessage: string;\n  technicalMessage?: string;\n  details?: Record<string, unknown>;\n  httpStatus?: number;\n  cause?: Error;\n}\n\nexport interface ErrorNormalizationOptions {\n  serviceName?: string;\n  environment?: string;\n}\n\nexport interface NormalizedErrorState {\n  code: string;\n  userMessage: string;\n  technicalMessage: string;\n  extensions: Record<string, unknown>;\n  status: number;\n}\n\nexport interface HttpErrorPayload {\n  error: string;\n  message: string;\n  userMessage: string;\n  technicalMessage: string;\n  code: string;\n  extensions: Record<string, unknown>;\n}\n\nexport interface HttpErrorResult {\n  status: number;\n  body: HttpErrorPayload;\n}\n\nconst DEFAULT_ERROR_CODE = 'INTERNAL_SERVER_ERROR';\nconst DEFAULT_HTTP_STATUS = 500;\n\nconst DEFAULT_USER_MESSAGES: Record<string, string> = {\n  BAD_REQUEST: 'Please check the request and try again.',\n  BAD_USER_INPUT: 'Please check the information and try again.',\n  CAPTCHA_FAILED: 'The verification failed. Please try again.',\n  CAPTCHA_REQUIRED: 'Please complete the verification to continue.',\n  COMPLEXITY_TOO_HIGH: 'This request is too large to process. Please simplify it and try again.',\n  CONFLICT: 'This change conflicts with existing data. Please refresh and try again.',\n  FORBIDDEN: 'You do not have permission to do that.',\n  INTERNAL_SERVER_ERROR: 'Something went wrong. Please try again.',\n  INVALID_PASSWORD: 'The password you entered is incorrect.',\n  NOT_FOUND: 'We could not find the requested item.',\n  PERMISSION_DENIED: 'You do not have permission to do that.',\n  QUOTA_EXCEEDED: \"You've reached your usage limit.\",\n  QUOTA_EXHAUSTED: \"You've reached your usage limit.\",\n  RATE_LIMITED: 'Too many requests. Please wait a moment and try again.',\n  RESOURCE_CAP_EXCEEDED: \"You've reached your plan limit. Upgrade your plan to continue.\",\n  STORAGE_QUOTA_EXCEEDED: \"You've reached your storage limit. Upgrade your plan to continue.\",\n  TIMEOUT: 'The request took too long. Please try again.',\n  UNAUTHENTICATED: 'Please sign in to continue.',\n  VALIDATION_ERROR: 'Please check the information and try again.',\n  WORKSPACE_REQUIRED: 'Please choose a workspace and try again.',\n};\n\nconst DEFAULT_STATUS_BY_CODE: Record<string, number> = {\n  BAD_REQUEST: 400,\n  BAD_USER_INPUT: 400,\n  CAPTCHA_FAILED: 400,\n  CAPTCHA_REQUIRED: 400,\n  COMPLEXITY_TOO_HIGH: 400,\n  CONFLICT: 409,\n  FORBIDDEN: 403,\n  INVALID_PASSWORD: 400,\n  NOT_FOUND: 404,\n  PERMISSION_DENIED: 403,\n  QUOTA_EXCEEDED: 429,\n  QUOTA_EXHAUSTED: 429,\n  RATE_LIMITED: 429,\n  RESOURCE_CAP_EXCEEDED: 429,\n  STORAGE_QUOTA_EXCEEDED: 429,\n  TIMEOUT: 504,\n  UNAUTHENTICATED: 401,\n  VALIDATION_ERROR: 400,\n  WORKSPACE_REQUIRED: 403,\n};\n\nconst SENSITIVE_EXTENSION_KEYS = new Set(['exception', 'originalError', 'stack', 'stacktrace']);\n\nconst TECHNICAL_MESSAGE_PATTERNS = [\n  /\\bprisma\\b/i,\n  /\\bsql\\b/i,\n  /\\bconstraint\\b/i,\n  /\\bstack\\b/i,\n  /\\bundefined\\b/i,\n  /\\bnull\\b/i,\n  /\\bECONN[A-Z_]*\\b/,\n  /\\bETIMEDOUT\\b/,\n  /\\bENOTFOUND\\b/,\n  /\\bP\\d{4}\\b/,\n  /Cannot (read|set|find|access)/i,\n  /Build failed \\(exit \\d+\\)/i,\n  /JSON\\.stringify/i,\n];\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction readString(record: Record<string, unknown>, key: string): string | null {\n  const value = record[key];\n  return typeof value === 'string' && value.trim().length > 0 ? value : null;\n}\n\nfunction readExtensions(error: unknown): Record<string, unknown> {\n  if (!isRecord(error)) return {};\n  const extensions = error['extensions'];\n  return isRecord(extensions) ? extensions : {};\n}\n\nfunction readOriginalError(error: unknown): Error | undefined {\n  if (error instanceof GraphQLError && error.originalError instanceof Error) {\n    return error.originalError;\n  }\n  return undefined;\n}\n\nfunction sanitizeExtensions(extensions: Record<string, unknown>): Record<string, unknown> {\n  const sanitized: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(extensions)) {\n    if (!SENSITIVE_EXTENSION_KEYS.has(key)) {\n      sanitized[key] = value;\n    }\n  }\n  return sanitized;\n}\n\nfunction normalizeCode(code: string | null): string {\n  if (!code) return DEFAULT_ERROR_CODE;\n  return code\n    .trim()\n    .replace(/[\\s-]+/g, '_')\n    .toUpperCase();\n}\n\nfunction inferCodeFromMessage(message: string): string {\n  const lower = message.toLowerCase();\n\n  if (\n    lower.includes('unauthenticated') ||\n    lower.includes('not authenticated') ||\n    lower.includes('authentication required') ||\n    lower.includes('unauthorized') ||\n    lower.includes('please sign in') ||\n    lower.includes('sign in to')\n  ) {\n    return 'UNAUTHENTICATED';\n  }\n\n  if (lower.includes('workspace context') || lower.includes('switch to a workspace')) {\n    return 'WORKSPACE_REQUIRED';\n  }\n\n  if (\n    lower.includes('forbidden') ||\n    lower.includes('access denied') ||\n    lower.includes('permission denied') ||\n    lower.includes('not authorized')\n  ) {\n    return 'FORBIDDEN';\n  }\n\n  if (lower.includes('not found') || lower.includes('disappeared')) {\n    return 'NOT_FOUND';\n  }\n\n  if (lower.includes('already exists') || lower.includes('already taken') || lower.includes('conflict')) {\n    return 'CONFLICT';\n  }\n\n  if (lower.includes('quota') || lower.includes('cap exceeded') || lower.includes('limit reached')) {\n    return 'QUOTA_EXCEEDED';\n  }\n\n  if (lower.includes('timeout') || lower.includes('timed out')) {\n    return 'TIMEOUT';\n  }\n\n  if (\n    lower.includes('required') ||\n    lower.includes('invalid') ||\n    lower.includes('missing') ||\n    lower.includes('unsupported')\n  ) {\n    return 'BAD_USER_INPUT';\n  }\n\n  return DEFAULT_ERROR_CODE;\n}\n\nfunction inferCode(error: unknown, extensions: Record<string, unknown>, originalError: Error | undefined): string {\n  const extensionCode = typeof extensions['code'] === 'string' ? extensions['code'] : null;\n  if (extensionCode) return normalizeCode(extensionCode);\n\n  if (isRecord(originalError)) {\n    const originalCode = readString(originalError, 'code');\n    if (originalCode) return normalizeCode(originalCode);\n  }\n\n  if (isRecord(error)) {\n    const directCode = readString(error, 'code');\n    if (directCode) return normalizeCode(directCode);\n  }\n\n  const message = readErrorMessage(error);\n  return inferCodeFromMessage(message);\n}\n\nfunction readErrorMessage(error: unknown): string {\n  if (error instanceof Error && error.message.trim().length > 0) {\n    return error.message;\n  }\n  if (isRecord(error)) {\n    const message = readString(error, 'message');\n    if (message) return message;\n  }\n  return DEFAULT_USER_MESSAGES[DEFAULT_ERROR_CODE] ?? 'Something went wrong. Please try again.';\n}\n\nfunction isLikelyTechnicalMessage(message: string): boolean {\n  if (message.length > 220) return true;\n  if (message.includes('\\n')) return true;\n  if (message.includes('{') && message.includes('}')) return true;\n  return TECHNICAL_MESSAGE_PATTERNS.some((pattern) => pattern.test(message));\n}\n\nfunction readExplicitUserMessage(extensions: Record<string, unknown>): string | null {\n  return (\n    readString(extensions, 'userMessage') ??\n    readString(extensions, 'humanMessage') ??\n    readString(extensions, 'displayMessage')\n  );\n}\n\nfunction resolveUserMessage(code: string, message: string, extensions: Record<string, unknown>): string {\n  const explicit = readExplicitUserMessage(extensions);\n  if (explicit) return explicit;\n\n  const fallback =\n    DEFAULT_USER_MESSAGES[code] ??\n    DEFAULT_USER_MESSAGES[DEFAULT_ERROR_CODE] ??\n    'Something went wrong. Please try again.';\n  if (code === DEFAULT_ERROR_CODE) {\n    return fallback;\n  }\n\n  if (!isLikelyTechnicalMessage(message)) {\n    return message;\n  }\n\n  return fallback;\n}\n\nfunction resolveTechnicalMessage(\n  code: string,\n  message: string,\n  extensions: Record<string, unknown>,\n  options: ErrorNormalizationOptions\n): string {\n  const explicit = readString(extensions, 'technicalMessage');\n  if (explicit) return explicit;\n\n  if (options.environment === 'production' && code === DEFAULT_ERROR_CODE) {\n    return options.serviceName ? `${options.serviceName} returned ${DEFAULT_ERROR_CODE}` : DEFAULT_ERROR_CODE;\n  }\n\n  return message;\n}\n\nfunction readHttpStatus(extensions: Record<string, unknown>, code: string): number {\n  const http = extensions['http'];\n  if (isRecord(http) && typeof http['status'] === 'number') {\n    return http['status'];\n  }\n  return DEFAULT_STATUS_BY_CODE[code] ?? DEFAULT_HTTP_STATUS;\n}\n\nexport function normalizeError(error: unknown, options: ErrorNormalizationOptions = {}): NormalizedErrorState {\n  const originalError = readOriginalError(error);\n  const originalExtensions = readExtensions(originalError);\n  const directExtensions = readExtensions(error);\n  const mergedExtensions = sanitizeExtensions({ ...originalExtensions, ...directExtensions });\n  const message = readErrorMessage(error);\n  const code = inferCode(error, mergedExtensions, originalError);\n  const userMessage = resolveUserMessage(code, message, mergedExtensions);\n  const technicalMessage = resolveTechnicalMessage(code, message, mergedExtensions, options);\n  const status = readHttpStatus(mergedExtensions, code);\n\n  const extensions: Record<string, unknown> = {\n    ...mergedExtensions,\n    code,\n    userMessage,\n    technicalMessage,\n  };\n\n  if (options.serviceName) {\n    extensions['serviceName'] = options.serviceName;\n  }\n\n  if (!isRecord(extensions['http'])) {\n    extensions['http'] = { status };\n  }\n\n  return {\n    code,\n    userMessage,\n    technicalMessage,\n    extensions,\n    status,\n  };\n}\n\nexport class UserFacingGraphQLError extends GraphQLError {\n  constructor(options: UserFacingErrorOptions) {\n    const extensions: Record<string, unknown> = {\n      code: normalizeCode(options.code),\n      userMessage: options.userMessage,\n      technicalMessage: options.technicalMessage ?? options.userMessage,\n    };\n\n    if (options.details) {\n      extensions['details'] = options.details;\n    }\n\n    if (options.httpStatus) {\n      extensions['http'] = { status: options.httpStatus };\n    }\n\n    super(options.userMessage, {\n      originalError: options.cause,\n      extensions,\n    });\n    this.name = 'UserFacingGraphQLError';\n  }\n}\n\nexport function toUserFacingGraphQLError(error: unknown, options: ErrorNormalizationOptions = {}): GraphQLError {\n  const normalized = normalizeError(error, options);\n\n  if (error instanceof GraphQLError) {\n    return new GraphQLError(normalized.userMessage, {\n      nodes: error.nodes,\n      source: error.source,\n      positions: error.positions,\n      path: error.path,\n      originalError: error.originalError,\n      extensions: normalized.extensions,\n    });\n  }\n\n  return new GraphQLError(normalized.userMessage, {\n    originalError: error instanceof Error ? error : undefined,\n    extensions: normalized.extensions,\n  });\n}\n\nexport function normalizeExecutionResultErrors(result: unknown, options: ErrorNormalizationOptions = {}): void {\n  if (!isRecord(result)) return;\n  const errors = result['errors'];\n  if (!Array.isArray(errors) || errors.length === 0) return;\n\n  result['errors'] = errors.map((error) => toUserFacingGraphQLError(error, options));\n}\n\nexport function createHumanReadableErrorPlugin(options: ErrorNormalizationOptions = {}): YogaPlugin {\n  return {\n    onExecute() {\n      return {\n        onExecuteDone({ result }: { result: unknown }) {\n          normalizeExecutionResultErrors(result, options);\n        },\n      };\n    },\n  };\n}\n\nexport function formatHttpError(error: unknown, options: ErrorNormalizationOptions = {}): HttpErrorResult {\n  const normalized = normalizeError(error, options);\n  return {\n    status: normalized.status,\n    body: {\n      error: normalized.userMessage,\n      message: normalized.userMessage,\n      userMessage: normalized.userMessage,\n      technicalMessage: normalized.technicalMessage,\n      code: normalized.code,\n      extensions: normalized.extensions,\n    },\n  };\n}\n\nexport function createHttpErrorResponse(error: unknown, options: ErrorNormalizationOptions = {}): Response {\n  const formatted = formatHttpError(error, options);\n  return new Response(JSON.stringify(formatted.body), {\n    status: formatted.status,\n    headers: { 'Content-Type': 'application/json' },\n  });\n}\n","/**\n * Workspace Guard Plugin for GraphQL Yoga\n *\n * Blocks GraphQL operations that lack a valid workspace context (x-workspace-id header).\n * This provides defense-in-depth at the GraphQL layer — even if the gateway allows a request\n * through, the service itself will reject it if workspace context is missing.\n *\n * **Whitelisted operations** (e.g., workspace creation) can bypass the guard.\n *\n * **Public schema fields** marked with `@public` or `@rbac(public: true)` are auto-bypassed\n * when `allowPublicDirective` is enabled (default true). This lets anonymous public-link\n * resolvers (e.g. `accessShare`) be reached through the federation gateway without an\n * `x-workspace-id` header.\n *\n * @module server/workspace-guard\n * @category Security\n */\n\nimport { logger } from '../logger/index.js';\nimport { UserFacingGraphQLError } from './errors.js';\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/**\n * Configuration for the workspace guard plugin\n */\nexport interface WorkspaceGuardConfig {\n  /**\n   * Enable the workspace guard.\n   * @default true\n   */\n  enabled?: boolean;\n\n  /**\n   * GraphQL operation names that can run without workspace context.\n   * These are typically operations like `createWorkspace` that execute\n   * before a workspace exists.\n   *\n   * Matching is case-sensitive against the operation name in the GraphQL document.\n   *\n   * @default []\n   *\n   * @example\n   * ```typescript\n   * whitelistedOperations: ['createWorkspace', 'validateTokens']\n   * ```\n   */\n  whitelistedOperations?: string[];\n\n  /**\n   * Custom error message when workspace context is missing.\n   * @default 'Workspace context required. Provide a valid X-Workspace-Authorization header.'\n   */\n  errorMessage?: string;\n\n  /**\n   * If true, fields whose schema definition carries the `@public` directive or\n   * `@rbac(public: true)` are bypassed by the guard automatically — no need to\n   * list them in `whitelistedOperations`. The check uses the GraphQL schema\n   * passed to the executor at request time.\n   *\n   * Set to false to fall back to the legacy operation-name allowlist only.\n   *\n   * @default true\n   */\n  allowPublicDirective?: boolean;\n}\n\n// ============================================================================\n// GraphQL Error\n// ============================================================================\n\n/**\n * Workspace required error with proper GraphQL error extensions\n */\nclass WorkspaceRequiredError extends UserFacingGraphQLError {\n  constructor(message: string) {\n    super({\n      code: 'WORKSPACE_REQUIRED',\n      userMessage: 'Please choose a workspace and try again.',\n      technicalMessage: message,\n      httpStatus: 403,\n    });\n    this.name = 'WorkspaceRequiredError';\n  }\n}\n\n// ============================================================================\n// Schema directive helpers\n// ============================================================================\n\n/**\n * Minimal structural typings for the bits of the GraphQL schema we look at.\n * We avoid importing the GraphQL types directly so the SDK keeps `graphql`\n * as a peer dep without a runtime hard dependency.\n */\ninterface FieldLikeDef {\n  astNode?: {\n    directives?: ReadonlyArray<{\n      name: { value: string };\n      arguments?: ReadonlyArray<{\n        name: { value: string };\n        value: { kind: string; value?: unknown };\n      }>;\n    }>;\n  };\n}\n\ninterface SchemaLike {\n  getQueryType?: () => { getFields: () => Record<string, FieldLikeDef> } | null | undefined;\n  getMutationType?: () => { getFields: () => Record<string, FieldLikeDef> } | null | undefined;\n  getSubscriptionType?: () => { getFields: () => Record<string, FieldLikeDef> } | null | undefined;\n}\n\n/**\n * Returns true iff the field carries either:\n *   - `@public` directive, OR\n *   - `@rbac(public: true)` directive (any arg-order)\n */\nfunction isFieldPublic(field: FieldLikeDef | undefined): boolean {\n  const directives = field?.astNode?.directives;\n  if (!directives || directives.length === 0) return false;\n\n  for (const dir of directives) {\n    const name = dir.name?.value;\n    if (name === 'public') return true;\n    if (name === 'rbac') {\n      const args = dir.arguments ?? [];\n      for (const arg of args) {\n        if (arg.name?.value === 'public' && arg.value?.kind === 'BooleanValue' && arg.value.value === true) {\n          return true;\n        }\n      }\n    }\n  }\n  return false;\n}\n\ninterface DocumentLike {\n  definitions?: ReadonlyArray<{\n    kind?: string;\n    operation?: string;\n    name?: { value?: string };\n    selectionSet?: {\n      selections?: ReadonlyArray<{\n        kind?: string;\n        name?: { value?: string };\n      }>;\n    };\n  }>;\n}\n\n/**\n * Resolve the operation type ('query' | 'mutation' | 'subscription') for the\n * primary operation in the document. Falls back to 'query'.\n */\nfunction resolveOperationType(\n  document: DocumentLike | undefined,\n  operationName: string | null | undefined\n): 'query' | 'mutation' | 'subscription' {\n  const defs = document?.definitions ?? [];\n  for (const def of defs) {\n    if (def.kind !== 'OperationDefinition') {\n      // Older parsers may not set kind; fall through to the operation property check below.\n    }\n    if (def.operation && (!operationName || def.name?.value === operationName)) {\n      return def.operation as 'query' | 'mutation' | 'subscription';\n    }\n  }\n  return 'query';\n}\n\n/**\n * Returns true iff every root field in the document selection set is marked\n * public on the schema. Empty selection sets return false (fail-closed).\n */\nfunction allRootFieldsPublic(\n  schema: SchemaLike | undefined,\n  document: DocumentLike | undefined,\n  operationName: string | null | undefined\n): boolean {\n  if (!schema || !document) return false;\n\n  const opType = resolveOperationType(document, operationName);\n  let rootType: ReturnType<NonNullable<SchemaLike['getQueryType']>> | undefined;\n  if (opType === 'mutation') {\n    rootType = schema.getMutationType?.();\n  } else if (opType === 'subscription') {\n    rootType = schema.getSubscriptionType?.();\n  } else {\n    rootType = schema.getQueryType?.();\n  }\n\n  if (!rootType) return false;\n\n  const fields = rootType.getFields();\n  const defs = document.definitions ?? [];\n\n  // Find the operation definition matching operationName (or first one).\n  const opDef = defs.find((d) => d.operation && (!operationName || d.name?.value === operationName));\n  const selections = opDef?.selectionSet?.selections ?? [];\n  if (selections.length === 0) return false;\n\n  for (const sel of selections) {\n    // Only consider plain Field selections (skip fragments — fragments at the root\n    // shouldn't drive a public bypass; fail-closed there).\n    if (sel.kind && sel.kind !== 'Field') return false;\n    const fieldName = sel.name?.value;\n    if (!fieldName) return false;\n    // __schema / __type introspection is always allowed without workspace context;\n    // treat them as public.\n    if (fieldName.startsWith('__')) continue;\n    const fieldDef = fields[fieldName];\n    if (!isFieldPublic(fieldDef)) return false;\n  }\n  return true;\n}\n\n// ============================================================================\n// Plugin\n// ============================================================================\n\n/**\n * Create a GraphQL Yoga plugin that guards operations requiring workspace context.\n *\n * The plugin inspects the GraphQL context for workspace information (set by the SDK's\n * buildContext from the x-workspace-id header). If missing and the operation is not\n * whitelisted (and not all-public per directive), it throws a WORKSPACE_REQUIRED error.\n *\n * @param config - Guard configuration\n * @returns A Yoga-compatible plugin\n *\n * @example\n * ```typescript\n * import { createWorkspaceGuardPlugin } from '@burdenoff/be-sdk/server';\n *\n * const guardPlugin = createWorkspaceGuardPlugin({\n *   whitelistedOperations: ['createWorkspace'],\n *   allowPublicDirective: true, // default\n * });\n * ```\n */\nexport function createWorkspaceGuardPlugin(config?: WorkspaceGuardConfig) {\n  const enabled = config?.enabled ?? true;\n  const whitelistedOperations = new Set(config?.whitelistedOperations ?? []);\n  const allowPublicDirective = config?.allowPublicDirective ?? true;\n  const errorMessage =\n    config?.errorMessage ??\n    'Workspace context required. Ensure the request includes a valid workspace context (x-workspace-id header).';\n\n  if (!enabled) {\n    logger.info('[WorkspaceGuard] Workspace guard disabled');\n    return {};\n  }\n\n  logger.info('[WorkspaceGuard] Workspace guard enabled', {\n    whitelistedOperations: [...whitelistedOperations],\n    allowPublicDirective,\n  });\n\n  return {\n    onExecute({\n      args,\n    }: {\n      args: {\n        schema?: SchemaLike;\n        document?: DocumentLike;\n        operationName?: string | null;\n        contextValue?: { workspace?: { id?: string }; request?: Request };\n      };\n    }) {\n      // Extract operation name from args or document\n      let operationName = args.operationName;\n\n      if (!operationName && args.document?.definitions) {\n        for (const def of args.document.definitions) {\n          if (def.operation && def.name?.value) {\n            operationName = def.name.value;\n            break;\n          }\n        }\n      }\n\n      // Check if operation is whitelisted by name\n      if (operationName && whitelistedOperations.has(operationName)) {\n        return undefined;\n      }\n\n      // Check schema-directive-based public bypass (Option C)\n      if (allowPublicDirective && allRootFieldsPublic(args.schema, args.document, operationName)) {\n        return undefined;\n      }\n\n      // Check for workspace context\n      const context = args.contextValue;\n      const workspaceId = context?.workspace?.id;\n\n      // Also check the raw header as a fallback\n      const headerWorkspaceId = context?.request?.headers?.get?.('x-workspace-id');\n\n      if (!workspaceId && !headerWorkspaceId) {\n        logger.warn('[WorkspaceGuard] Blocked operation without workspace context', {\n          operationName: operationName ?? '<anonymous>',\n        });\n        throw new WorkspaceRequiredError(errorMessage);\n      }\n\n      return undefined;\n    },\n  };\n}\n"]}

package/dist/index.js

@@ -1,5 +1,5 @@
-export { prisma_exports as Prisma } from './chunk-BRYRHBAC.js';
-export { RESOURCE_CAP_DEFAULTS, ResourceCapExceededError, ResourceCapsModule, getResourceCaps } from './chunk-7BMKOD7N.js';
+export { prisma_exports as Prisma } from './chunk-54BMP5OJ.js';
+export { RESOURCE_CAP_DEFAULTS, ResourceCapExceededError, ResourceCapsModule, getResourceCaps } from './chunk-VDDOGIWY.js';
 import './chunk-GTEMQXCA.js';
 export { TemporalClient, TemporalClientFactory, TemporalModule, TemporalWorker, TemporalWorkerFactory, TemporalWorkerManager } from './chunk-5SD7DU3L.js';
 import { ActivityModule, UsageModule, TrackerModule } from './chunk-PPIDJP2W.js';
@@ -34,8 +34,8 @@ import { AuthModule } from './chunk-7NUQXGA7.js';
 export { AuthModule } from './chunk-7NUQXGA7.js';
 export { utils_exports as Utils } from './chunk-B7I4TABG.js';
 export { cache_exports as Cache } from './chunk-PDSV3TFO.js';
-export { captcha_exports as Captcha, isCaptchaEnabled, verifyCaptcha, verifyCaptchaIfEnabled } from './chunk-YMZEUTD2.js';
 export { createInternalClient, createInternalClientForTenant, createInternalClientForWorkspaces } from './chunk-VI4VSNTI.js';
+export { captcha_exports as Captcha, isCaptchaEnabled, verifyCaptcha, verifyCaptchaIfEnabled } from './chunk-YMZEUTD2.js';
 export { crypto_exports as Crypto } from './chunk-SBS4S2PJ.js';
 import { DatabaseModule } from './chunk-UFQQSQG6.js';
 export { DatabaseModule } from './chunk-UFQQSQG6.js';

package/dist/prisma/index.js

@@ -1,4 +1,4 @@
-export { PrismaClientWrapper, buildContextWhereClause, buildContextWhereConditions, checkDatabaseHealth, configurePrismaLogging, contextMatches, createConnectionPool, createContextFromSDK, createDatabaseClient, createDatabaseClientFromEnv, createPrismaAdapter, createPrismaClient, extractFieldsFromModel, getAllModelNames, getDatabaseManager, getDatabaseProductName, getDatabaseStats, getDatabaseVersion, getDb, getModelFields, hasModel, initializeDatabase, initializeDatabaseWithConfig, isDatabaseInitialized, loadGeneratedFields, mergeContext, parseContext, resetDatabaseManager, testConnection, toContextJson } from '../chunk-BRYRHBAC.js';
+export { PrismaClientWrapper, buildContextWhereClause, buildContextWhereConditions, checkDatabaseHealth, configurePrismaLogging, contextMatches, createConnectionPool, createContextFromSDK, createDatabaseClient, createDatabaseClientFromEnv, createPrismaAdapter, createPrismaClient, extractFieldsFromModel, getAllModelNames, getDatabaseManager, getDatabaseProductName, getDatabaseStats, getDatabaseVersion, getDb, getModelFields, hasModel, initializeDatabase, initializeDatabaseWithConfig, isDatabaseInitialized, loadGeneratedFields, mergeContext, parseContext, resetDatabaseManager, testConnection, toContextJson } from '../chunk-54BMP5OJ.js';
 export { addWorkspaceExtension, getWorkspaceContext, injectWhereWorkspaceId, setWorkspaceContext, withWorkspaceContext, withWorkspaceContextSync } from '../chunk-GTEMQXCA.js';
 import '../chunk-5CESUKWC.js';
 import '../chunk-QRWTLPW5.js';

package/dist/resource-caps/index.js

@@ -1,4 +1,4 @@
-export { RESOURCE_CAP_DEFAULTS, ResourceCapExceededError, ResourceCapsModule, __resetResourceCapsForTests, getResourceCaps } from '../chunk-7BMKOD7N.js';
+export { RESOURCE_CAP_DEFAULTS, ResourceCapExceededError, ResourceCapsModule, __resetResourceCapsForTests, getResourceCaps } from '../chunk-VDDOGIWY.js';
 import '../chunk-CBZNP6RF.js';
 import '../chunk-XE4OXN2W.js';
 //# sourceMappingURL=index.js.map

package/dist/server/index.d.ts

@@ -1,4 +1,4 @@
-import { GraphQLSchema } from 'graphql';
+import { GraphQLSchema, GraphQLError } from 'graphql';
 import { PubSub } from 'graphql-yoga';
 import { P as PrismaClientBase, a as PrismaClientConstructorOptions } from '../client-CSjIrYKS.js';
 import { I as I18nContext, L as LocaleCode, d as I18n } from '../i18n-DA6IPnYy.js';
@@ -356,4 +356,45 @@ declare function createWorkspaceGuardPlugin(config?: WorkspaceGuardConfig): {
     }): undefined;
 };
 
-export { type AuthConfig, type ConsentContext, type ContextBuilderOptions, type ElysiaApp, type FetchWorkspaceSecretFn, type GraphQLContext, I18nContext, type IActor, type IContextFilterInput, type IOperationContext, type IOrganization, type IProduct, type IProject, type ITenant, type ITracking, type IWorkspace, type JWTPayload, LocaleCode, type ModuleGraphConfig, PrismaClientBase, type PrismaClientConstructor, type RESTEndpoint, type ServerConfig, type ServerDefinition, type ServerI18nConfig, type ServerInfo, type ServerInstance, type WorkspaceGuardConfig, type WorkspaceSecret, type WspaceGraphQLContext, type YogaPlugin, authCheck, buildContext, configureAuth, configureContext, configureDefaultAuth, configureServerAuth, createServer, createWorkspaceGuardPlugin, decodeJWT, fetchWorkspaceSecret, generateSymmetricSecret, getContextOptions, orgCheck, requireWorkspace, tenantCheck, verifyJWT, workspaceCheck };
+interface UserFacingErrorOptions {
+    code: string;
+    userMessage: string;
+    technicalMessage?: string;
+    details?: Record<string, unknown>;
+    httpStatus?: number;
+    cause?: Error;
+}
+interface ErrorNormalizationOptions {
+    serviceName?: string;
+    environment?: string;
+}
+interface NormalizedErrorState {
+    code: string;
+    userMessage: string;
+    technicalMessage: string;
+    extensions: Record<string, unknown>;
+    status: number;
+}
+interface HttpErrorPayload {
+    error: string;
+    message: string;
+    userMessage: string;
+    technicalMessage: string;
+    code: string;
+    extensions: Record<string, unknown>;
+}
+interface HttpErrorResult {
+    status: number;
+    body: HttpErrorPayload;
+}
+declare function normalizeError(error: unknown, options?: ErrorNormalizationOptions): NormalizedErrorState;
+declare class UserFacingGraphQLError extends GraphQLError {
+    constructor(options: UserFacingErrorOptions);
+}
+declare function toUserFacingGraphQLError(error: unknown, options?: ErrorNormalizationOptions): GraphQLError;
+declare function normalizeExecutionResultErrors(result: unknown, options?: ErrorNormalizationOptions): void;
+declare function createHumanReadableErrorPlugin(options?: ErrorNormalizationOptions): YogaPlugin;
+declare function formatHttpError(error: unknown, options?: ErrorNormalizationOptions): HttpErrorResult;
+declare function createHttpErrorResponse(error: unknown, options?: ErrorNormalizationOptions): Response;
+
+export { type AuthConfig, type ConsentContext, type ContextBuilderOptions, type ElysiaApp, type ErrorNormalizationOptions, type FetchWorkspaceSecretFn, type GraphQLContext, type HttpErrorPayload, type HttpErrorResult, I18nContext, type IActor, type IContextFilterInput, type IOperationContext, type IOrganization, type IProduct, type IProject, type ITenant, type ITracking, type IWorkspace, type JWTPayload, LocaleCode, type ModuleGraphConfig, type NormalizedErrorState, PrismaClientBase, type PrismaClientConstructor, type RESTEndpoint, type ServerConfig, type ServerDefinition, type ServerI18nConfig, type ServerInfo, type ServerInstance, type UserFacingErrorOptions, UserFacingGraphQLError, type WorkspaceGuardConfig, type WorkspaceSecret, type WspaceGraphQLContext, type YogaPlugin, authCheck, buildContext, configureAuth, configureContext, configureDefaultAuth, configureServerAuth, createHttpErrorResponse, createHumanReadableErrorPlugin, createServer, createWorkspaceGuardPlugin, decodeJWT, fetchWorkspaceSecret, formatHttpError, generateSymmetricSecret, getContextOptions, normalizeError, normalizeExecutionResultErrors, orgCheck, requireWorkspace, tenantCheck, toUserFacingGraphQLError, verifyJWT, workspaceCheck };