@burdenoff/be-sdk 2026.528.1 → 2026.529.1

package/dist/{chunk-7BMKOD7N.js → chunk-VDDOGIWY.js}

@@ -87,6 +87,8 @@ var ResourceCapExceededError = class extends GraphQLError {
     super(`Resource cap exceeded for ${detail.resource}: ${detail.currentCount}/${detail.limit} on plan '${detail.planName}'.`, {
       extensions: {
         code: "RESOURCE_CAP_EXCEEDED",
+        userMessage: "You've reached your plan limit. Upgrade your plan to continue.",
+        technicalMessage: `Resource cap exceeded for ${detail.resource}: ${detail.currentCount}/${detail.limit} on plan '${detail.planName}'.`,
         resource: detail.resource,
         currentCount: detail.currentCount,
         limit: detail.limit,
@@ -261,5 +263,5 @@ function __resetResourceCapsForTests() {
 __name(__resetResourceCapsForTests, "__resetResourceCapsForTests");
 
 export { RESOURCE_CAP_DEFAULTS, ResourceCapExceededError, ResourceCapsModule, __resetResourceCapsForTests, getResourceCaps };
-//# sourceMappingURL=chunk-7BMKOD7N.js.map
-//# sourceMappingURL=chunk-7BMKOD7N.js.map
+//# sourceMappingURL=chunk-VDDOGIWY.js.map
+//# sourceMappingURL=chunk-VDDOGIWY.js.map

package/dist/chunk-VDDOGIWY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/resource-caps/index.ts"],"names":["RESOURCE_CAP_DEFAULTS","workspace","free","paidDefault","scope","workspaceMember","sandbox","vibe","agent","conversation","message","tag","file","group","calendar","scheduledTask","form","apiKey","webhook","ResourceCapExceededError","GraphQLError","detail","resource","currentCount","limit","planName","extensions","code","userMessage","technicalMessage","name","PLAN_QUERY","ResourceCapsModule","client","cacheTtlMs","defaultTier","planCache","Map","config","getResourceCap","userId","Error","defaults","plan","resolvePlan","override","overrides","planTier","isFallback","enforceResourceCap","cap","invalidate","delete","invalidateAll","clear","cached","get","Date","now","fetchedAt","fetchPlan","set","fallbackPlan","res","query","planNode","userBillingPlan","tier","normaliseTier","sanitizeOverrides","resourceCaps","err","logger","warn","raw","fallback","lc","toLowerCase","out","key","value","Object","entries","Number","isFinite","Math","max","floor","defaultInstance","getResourceCaps","__resetResourceCapsForTests"],"mappings":";;;;AAiEO,IAAMA,qBAAAA,GAAmE;EAC9EC,SAAAA,EAAW;IAAEC,IAAAA,EAAM,CAAA;IAAGC,WAAAA,EAAa,EAAA;IAAIC,KAAAA,EAAO;AAAO,GAAA;EACrDC,eAAAA,EAAiB;IAAEH,IAAAA,EAAM,CAAA;IAAGC,WAAAA,EAAa,GAAA;IAAKC,KAAAA,EAAO;AAAY,GAAA;EACjEE,OAAAA,EAAS;IAAEJ,IAAAA,EAAM,CAAA;IAAGC,WAAAA,EAAa,EAAA;IAAIC,KAAAA,EAAO;AAAO,GAAA;EACnDG,IAAAA,EAAM;IAAEL,IAAAA,EAAM,EAAA;IAAIC,WAAAA,EAAa,GAAA;IAAKC,KAAAA,EAAO;AAAO,GAAA;EAClDI,KAAAA,EAAO;IAAEN,IAAAA,EAAM,CAAA;IAAGC,WAAAA,EAAa,EAAA;IAAIC,KAAAA,EAAO;AAAY,GAAA;EACtDK,YAAAA,EAAc;IAAEP,IAAAA,EAAM,EAAA;IAAIC,WAAAA,EAAa,GAAA;IAAMC,KAAAA,EAAO;AAAW,GAAA;EAC/DM,OAAAA,EAAS;IAAER,IAAAA,EAAM,GAAA;IAAKC,WAAAA,EAAa,GAAA;IAAOC,KAAAA,EAAO;AAAW,GAAA;EAC5DO,GAAAA,EAAK;IAAET,IAAAA,EAAM,EAAA;IAAIC,WAAAA,EAAa,GAAA;IAAMC,KAAAA,EAAO;AAAY,GAAA;EACvDQ,IAAAA,EAAM;IAAEV,IAAAA,EAAM,GAAA;IAAKC,WAAAA,EAAa,GAAA;IAAOC,KAAAA,EAAO;AAAO,GAAA;EACrDS,KAAAA,EAAO;IAAEX,IAAAA,EAAM,CAAA;IAAGC,WAAAA,EAAa,GAAA;IAAKC,KAAAA,EAAO;AAAY,GAAA;EACvDU,QAAAA,EAAU;IAAEZ,IAAAA,EAAM,CAAA;IAAGC,WAAAA,EAAa,GAAA;IAAKC,KAAAA,EAAO;AAAO,GAAA;EACrDW,aAAAA,EAAe;IAAEb,IAAAA,EAAM,CAAA;IAAGC,WAAAA,EAAa,GAAA;IAAKC,KAAAA,EAAO;AAAO,GAAA;EAC1DY,IAAAA,EAAM;IAAEd,IAAAA,EAAM,CAAA;IAAGC,WAAAA,EAAa,GAAA;IAAKC,KAAAA,EAAO;AAAO,GAAA;EACjDa,MAAAA,EAAQ;IAAEf,IAAAA,EAAM,CAAA;IAAGC,WAAAA,EAAa,EAAA;IAAIC,KAAAA,EAAO;AAAO,GAAA;EAClDc,OAAAA,EAAS;IAAEhB,IAAAA,EAAM,CAAA;IAAGC,WAAAA,EAAa,GAAA;IAAKC,KAAAA,EAAO;AAAY;AAC3D;AAmCO,IAAMe,wBAAAA,GAAN,cAAuCC,YAAAA,CAAAA;EApH9C;;;AAqHE,EAAA,WAAA,CAAYC,MAAAA,EAA2F;AACrG,IAAA,KAAA,CACE,CAAA,0BAAA,EAA6BA,MAAAA,CAAOC,QAAQ,CAAA,EAAA,EAAKD,MAAAA,CAAOE,YAAY,CAAA,CAAA,EAAIF,MAAAA,CAAOG,KAAK,CAAA,UAAA,EAAaH,MAAAA,CAAOI,QAAQ,CAAA,EAAA,CAAA,EAChH;MACEC,UAAAA,EAAY;QACVC,IAAAA,EAAM,uBAAA;QACNC,WAAAA,EAAa,gEAAA;QACbC,gBAAAA,EAAkB,CAAA,0BAAA,EAA6BR,MAAAA,CAAOC,QAAQ,CAAA,EAAA,EAAKD,MAAAA,CAAOE,YAAY,CAAA,CAAA,EAAIF,MAAAA,CAAOG,KAAK,CAAA,UAAA,EAAaH,MAAAA,CAAOI,QAAQ,CAAA,EAAA,CAAA;AAClIH,QAAAA,QAAAA,EAAUD,MAAAA,CAAOC,QAAAA;AACjBC,QAAAA,YAAAA,EAAcF,MAAAA,CAAOE,YAAAA;AACrBC,QAAAA,KAAAA,EAAOH,MAAAA,CAAOG,KAAAA;AACdC,QAAAA,QAAAA,EAAUJ,MAAAA,CAAOI;AACnB;KACF,CAAA;AAEF,IAAA,IAAA,CAAKK,IAAAA,GAAO,0BAAA;AACd,EAAA;AACF;AAMA,IAAMC,UAAAA;;AAA2B,EAAA;;;;;;;;;;AAkB1B,IAAMC,qBAAN,MAAMA;EA9Jb;;;AA+JmBC,EAAAA,MAAAA;AACAC,EAAAA,UAAAA;AACAC,EAAAA,WAAAA;AACAC,EAAAA,SAAAA,uBAAgBC,GAAAA,EAAAA;EAEjC,WAAA,CAAYC,MAAAA,GAA6B,EAAC,EAAG;AAC3C,IAAA,IAAA,CAAKL,SAASK,MAAAA,CAAOL,MAAAA;AACrB,IAAA,IAAA,CAAKC,UAAAA,GAAaI,OAAOJ,UAAAA,IAAc,GAAA;AACvC,IAAA,IAAA,CAAKC,WAAAA,GAAcG,OAAOH,WAAAA,IAAe,MAAA;AAC3C,EAAA;;;;;EAMA,MAAMI,cAAAA,CAAeC,QAAgBlB,QAAAA,EAA8C;AACjF,IAAA,IAAI,CAACkB,MAAAA,EAAQ;AACX,MAAA,MAAM,IAAIC,MAAM,oCAAA,CAAA;AAClB,IAAA;AACA,IAAA,MAAMC,QAAAA,GAAW1C,sBAAsBsB,QAAAA,CAAAA;AACvC,IAAA,IAAI,CAACoB,QAAAA,EAAU;AACb,MAAA,MAAM,IAAID,KAAAA,CAAM,CAAA,kCAAA,EAAqCnB,QAAAA,CAAAA,CAAAA,CAAW,CAAA;AAClE,IAAA;AAEA,IAAA,MAAMqB,IAAAA,GAAO,MAAM,IAAA,CAAKC,WAAAA,CAAYJ,MAAAA,CAAAA;AACpC,IAAA,MAAMK,QAAAA,GAAWF,IAAAA,CAAKG,SAAAA,CAAUxB,QAAAA,CAAAA;AAChC,IAAA,IAAI,OAAOuB,QAAAA,KAAa,QAAA,IAAYA,QAAAA,IAAY,CAAA,EAAG;AACjD,MAAA,OAAO;AACLvB,QAAAA,QAAAA;QACAE,KAAAA,EAAOqB,QAAAA;AACPpB,QAAAA,QAAAA,EAAUkB,IAAAA,CAAKlB,QAAAA;AACfsB,QAAAA,QAAAA,EAAUJ,IAAAA,CAAKI,QAAAA;QACfC,UAAAA,EAAY;AACd,OAAA;AACF,IAAA;AAEA,IAAA,MAAMxB,QAAQmB,IAAAA,CAAKI,QAAAA,KAAa,MAAA,GAASL,QAAAA,CAASvC,cAAcuC,QAAAA,CAASxC,IAAAA;AACzE,IAAA,OAAO;AACLoB,MAAAA,QAAAA;AACAE,MAAAA,KAAAA;AACAC,MAAAA,QAAAA,EAAUkB,IAAAA,CAAKlB,QAAAA;AACfsB,MAAAA,QAAAA,EAAUJ,IAAAA,CAAKI,QAAAA;AACfC,MAAAA,UAAAA,EAAYL,IAAAA,CAAKlB,QAAAA,KAAa,eAAA,IAAmBkB,IAAAA,CAAKlB,QAAAA,KAAa;AACrE,KAAA;AACF,EAAA;;;;;EAMA,MAAMwB,kBAAAA,CAAmBT,MAAAA,EAAgBlB,QAAAA,EAAwBC,YAAAA,EAA4C;AAC3G,IAAA,MAAM2B,GAAAA,GAAM,MAAM,IAAA,CAAKX,cAAAA,CAAeC,QAAQlB,QAAAA,CAAAA;AAC9C,IAAA,IAAIC,YAAAA,IAAgB2B,IAAI1B,KAAAA,EAAO;AAC7B,MAAA,MAAM,IAAIL,wBAAAA,CAAyB;AACjCG,QAAAA,QAAAA;AACAC,QAAAA,YAAAA;AACAC,QAAAA,KAAAA,EAAO0B,GAAAA,CAAI1B,KAAAA;AACXC,QAAAA,QAAAA,EAAUyB,GAAAA,CAAIzB;OAChB,CAAA;AACF,IAAA;AACA,IAAA,OAAOyB,GAAAA;AACT,EAAA;;AAGAC,EAAAA,UAAAA,CAAWX,MAAAA,EAAsB;AAC/B,IAAA,IAAA,CAAKJ,SAAAA,CAAUgB,OAAOZ,MAAAA,CAAAA;AACxB,EAAA;;EAGAa,aAAAA,GAAsB;AACpB,IAAA,IAAA,CAAKjB,UAAUkB,KAAAA,EAAK;AACtB,EAAA;;;;AAMA,EAAA,MAAcV,YAAYJ,MAAAA,EAAqC;AAC7D,IAAA,MAAMe,MAAAA,GAAS,IAAA,CAAKnB,SAAAA,CAAUoB,GAAAA,CAAIhB,MAAAA,CAAAA;AAClC,IAAA,IAAIe,UAAUE,IAAAA,CAAKC,GAAAA,KAAQH,MAAAA,CAAOI,SAAAA,GAAY,KAAKzB,UAAAA,EAAY;AAC7D,MAAA,OAAOqB,MAAAA;AACT,IAAA;AAEA,IAAA,MAAMZ,IAAAA,GAAO,MAAM,IAAA,CAAKiB,SAAAA,CAAUpB,MAAAA,CAAAA;AAClC,IAAA,IAAA,CAAKJ,SAAAA,CAAUyB,GAAAA,CAAIrB,MAAAA,EAAQG,IAAAA,CAAAA;AAC3B,IAAA,OAAOA,IAAAA;AACT,EAAA;AAEA,EAAA,MAAciB,UAAUpB,MAAAA,EAAqC;AAC3D,IAAA,IAAI,CAAC,KAAKP,MAAAA,EAAQ;AAChB,MAAA,OAAO,KAAK6B,YAAAA,EAAY;AAC1B,IAAA;AACA,IAAA,IAAI;AACF,MAAA,MAAMC,GAAAA,GAAM,MAAM,IAAA,CAAK9B,MAAAA,CAAO+B,MAAyBjC,UAAAA,EAAY;AAAES,QAAAA;OAAO,CAAA;AAC5E,MAAA,MAAMyB,WAAWF,GAAAA,EAAKG,eAAAA;AACtB,MAAA,IAAI,CAACD,QAAAA,EAAU;AACb,QAAA,OAAO,KAAKH,YAAAA,EAAY;AAC1B,MAAA;AACA,MAAA,MAAMK,IAAAA,GAAOC,aAAAA,CAAcH,QAAAA,CAASE,IAAAA,EAAM,KAAKhC,WAAW,CAAA;AAC1D,MAAA,MAAMW,SAAAA,GAAYuB,iBAAAA,CAAkBJ,QAAAA,CAASK,YAAY,CAAA;AACzD,MAAA,OAAO;AACL7C,QAAAA,QAAAA,EAAUwC,QAAAA,CAASxC,QAAAA,KAAa0C,IAAAA,KAAS,MAAA,GAAS,MAAA,GAAS,MAAA,CAAA;QAC3DpB,QAAAA,EAAUoB,IAAAA;AACVrB,QAAAA,SAAAA;AACAa,QAAAA,SAAAA,EAAWF,KAAKC,GAAAA;AAClB,OAAA;AACF,IAAA,CAAA,CAAA,OAASa,GAAAA,EAAK;AACZC,MAAAA,MAAAA,CAAOC,KAAK,iEAAA,EAAmE;AAC7EF,QAAAA,GAAAA;AACA/B,QAAAA;OACF,CAAA;AACA,MAAA,OAAO,KAAKsB,YAAAA,EAAY;AAC1B,IAAA;AACF,EAAA;EAEQA,YAAAA,GAA2B;AACjC,IAAA,OAAO;MACLrC,QAAAA,EAAU,IAAA,CAAKU,WAAAA,KAAgB,MAAA,GAAS,eAAA,GAAkB,eAAA;AAC1DY,MAAAA,QAAAA,EAAU,IAAA,CAAKZ,WAAAA;AACfW,MAAAA,SAAAA,EAAW,EAAC;AACZa,MAAAA,SAAAA,EAAWF,KAAKC,GAAAA;AAClB,KAAA;AACF,EAAA;AACF;AAMA,SAASU,aAAAA,CAAcM,KAAgCC,QAAAA,EAAkB;AACvE,EAAA,IAAI,CAACD,KAAK,OAAOC,QAAAA;AACjB,EAAA,MAAMC,EAAAA,GAAKF,IAAIG,WAAAA,EAAW;AAC1B,EAAA,IAAID,EAAAA,KAAO,MAAA,IAAUA,EAAAA,KAAO,MAAA,EAAQ,OAAOA,EAAAA;AAE3C,EAAA,IAAIA,OAAO,YAAA,IAAgBA,EAAAA,KAAO,cAAcA,EAAAA,KAAO,KAAA,IAASA,OAAO,MAAA,EAAQ;AAC7E,IAAA,OAAO,MAAA;AACT,EAAA;AACA,EAAA,OAAOD,QAAAA;AACT;AATSP,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAWT,SAASC,kBAAkBK,GAAAA,EAA8C;AACvE,EAAA,IAAI,CAACA,GAAAA,IAAO,OAAOA,GAAAA,KAAQ,QAAA,SAAiB,EAAC;AAC7C,EAAA,MAAMI,MAA6C,EAAC;AACpD,EAAA,KAAA,MAAW,CAACC,GAAAA,EAAKC,KAAAA,KAAUC,MAAAA,CAAOC,OAAAA,CAAQR,GAAAA,CAAAA,EAAM;AAC9C,IAAA,IAAIK,GAAAA,IAAO/E,yBAAyB,OAAOgF,KAAAA,KAAU,YAAYG,MAAAA,CAAOC,QAAAA,CAASJ,KAAAA,CAAAA,EAAQ;AACvFF,MAAAA,GAAAA,CAAIC,GAAAA,IAAuBM,IAAAA,CAAKC,GAAAA,CAAI,GAAGD,IAAAA,CAAKE,KAAAA,CAAMP,KAAAA,CAAAA,CAAAA;AACpD,IAAA;AACF,EAAA;AACA,EAAA,OAAOF,GAAAA;AACT;AATST,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAeT,IAAImB,eAAAA,GAA6C,IAAA;AAM1C,SAASC,gBAAgBnD,MAAAA,EAA2B;AACzD,EAAA,IAAI,CAACkD,eAAAA,EAAiB;AACpBA,IAAAA,eAAAA,GAAkB,IAAIxD,mBAAmBM,MAAAA,CAAAA;AAC3C,EAAA;AACA,EAAA,OAAOkD,eAAAA;AACT;AALgBC,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAQT,SAASC,2BAAAA,GAAAA;AACdF,EAAAA,eAAAA,GAAkB,IAAA;AACpB;AAFgBE,MAAAA,CAAAA,2BAAAA,EAAAA,6BAAAA,CAAAA","file":"chunk-VDDOGIWY.js","sourcesContent":["/**\n * Resource Caps Module\n *\n * Enforces per-user / per-workspace resource ceilings to prevent unbounded\n * resource use on a multi-tenant SaaS. Caps come from the user's billing plan\n * (resolved via global-billing-svc) and fall back to static defaults defined\n * here when the plan lookup fails or the resource isn't overridden.\n *\n * Two plan tiers exist by default:\n *   - free: tight per-user / per-workspace ceilings\n *   - paid (default): ~100x looser; individual paid plans can override via the\n *     `Plan.resourceCaps` JSON column in global-billing-svc.\n *\n * @example\n * ```ts\n * import { resourceCaps } from '@burdenoff/be-sdk/resource-caps';\n *\n * const { limit } = await resourceCaps.getResourceCap(userId, 'tag');\n * await resourceCaps.enforceResourceCap(userId, 'tag', currentCount);\n * ```\n */\n\nimport { GraphQLError } from 'graphql';\n\nimport type { BurdenoffGraphQLClient } from '../client/graphql.js';\nimport { logger } from '../logger/index.js';\n\n// ---------------------------------------------------------------------------\n// Resource registry\n// ---------------------------------------------------------------------------\n\n/**\n * Canonical resource names. Adding a new capped resource? Append it here,\n * extend RESOURCE_CAP_DEFAULTS, and reference it from the relevant svc.\n */\nexport type ResourceName =\n  | 'workspace' // per user\n  | 'workspaceMember' // per workspace\n  | 'sandbox' // per user\n  | 'vibe' // per user\n  | 'agent' // per workspace\n  | 'conversation' // per user/day\n  | 'message' // per user/day\n  | 'tag' // per workspace\n  | 'file' // per user (count only)\n  | 'group' // per workspace\n  | 'calendar' // per user\n  | 'scheduledTask' // per user\n  | 'form' // per user\n  | 'apiKey' // per user\n  | 'webhook'; // per workspace\n\nexport type PlanTier = 'free' | 'paid';\n\nexport interface ResourceCapDefaults {\n  free: number;\n  paidDefault: number;\n  /** Optional scope hint used by callers when wiring guards */\n  scope: 'user' | 'workspace' | 'user/day';\n}\n\n/**\n * Static fallback caps. Real values may be overridden per plan in\n * global-billing-svc Plan.resourceCaps JSON.\n */\nexport const RESOURCE_CAP_DEFAULTS: Record<ResourceName, ResourceCapDefaults> = {\n  workspace: { free: 3, paidDefault: 50, scope: 'user' },\n  workspaceMember: { free: 5, paidDefault: 500, scope: 'workspace' },\n  sandbox: { free: 2, paidDefault: 50, scope: 'user' },\n  vibe: { free: 10, paidDefault: 500, scope: 'user' },\n  agent: { free: 2, paidDefault: 20, scope: 'workspace' },\n  conversation: { free: 20, paidDefault: 2000, scope: 'user/day' },\n  message: { free: 200, paidDefault: 20000, scope: 'user/day' },\n  tag: { free: 50, paidDefault: 5000, scope: 'workspace' },\n  file: { free: 100, paidDefault: 10000, scope: 'user' },\n  group: { free: 5, paidDefault: 500, scope: 'workspace' },\n  calendar: { free: 3, paidDefault: 100, scope: 'user' },\n  scheduledTask: { free: 5, paidDefault: 500, scope: 'user' },\n  form: { free: 5, paidDefault: 500, scope: 'user' },\n  apiKey: { free: 2, paidDefault: 50, scope: 'user' },\n  webhook: { free: 2, paidDefault: 100, scope: 'workspace' },\n};\n\n// ---------------------------------------------------------------------------\n// Types & errors\n// ---------------------------------------------------------------------------\n\nexport interface ResourceCap {\n  resource: ResourceName;\n  limit: number;\n  planName: string;\n  planTier: PlanTier;\n  /** True when the cap came from defaults, not from the billing service */\n  isFallback: boolean;\n}\n\nexport interface ResourceCapsConfig {\n  client?: BurdenoffGraphQLClient;\n  /** Optional in-memory TTL for plan lookups; defaults to 60s */\n  cacheTtlMs?: number;\n  /** Default plan tier when billing lookup fails */\n  defaultTier?: PlanTier;\n}\n\ninterface CachedPlan {\n  planName: string;\n  planTier: PlanTier;\n  overrides: Partial<Record<ResourceName, number>>;\n  fetchedAt: number;\n}\n\n/**\n * Thrown when an entity create operation would push the user past the cap.\n * The matching GraphQL error has extensions.code = RESOURCE_CAP_EXCEEDED\n * so clients can detect and route to an upgrade flow.\n */\nexport class ResourceCapExceededError extends GraphQLError {\n  constructor(detail: { resource: ResourceName; currentCount: number; limit: number; planName: string }) {\n    super(\n      `Resource cap exceeded for ${detail.resource}: ${detail.currentCount}/${detail.limit} on plan '${detail.planName}'.`,\n      {\n        extensions: {\n          code: 'RESOURCE_CAP_EXCEEDED',\n          userMessage: \"You've reached your plan limit. Upgrade your plan to continue.\",\n          technicalMessage: `Resource cap exceeded for ${detail.resource}: ${detail.currentCount}/${detail.limit} on plan '${detail.planName}'.`,\n          resource: detail.resource,\n          currentCount: detail.currentCount,\n          limit: detail.limit,\n          planName: detail.planName,\n        },\n      }\n    );\n    this.name = 'ResourceCapExceededError';\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Module\n// ---------------------------------------------------------------------------\n\nconst PLAN_QUERY = /* GraphQL */ `\n  query GetUserPlanForCaps($userId: ID!) {\n    userBillingPlan(userId: $userId) {\n      planName\n      tier\n      resourceCaps\n    }\n  }\n`;\n\ninterface PlanQueryResponse {\n  userBillingPlan?: {\n    planName?: string | null;\n    tier?: string | null;\n    resourceCaps?: Record<string, number> | null;\n  } | null;\n}\n\nexport class ResourceCapsModule {\n  private readonly client?: BurdenoffGraphQLClient;\n  private readonly cacheTtlMs: number;\n  private readonly defaultTier: PlanTier;\n  private readonly planCache = new Map<string, CachedPlan>();\n\n  constructor(config: ResourceCapsConfig = {}) {\n    this.client = config.client;\n    this.cacheTtlMs = config.cacheTtlMs ?? 60_000;\n    this.defaultTier = config.defaultTier ?? 'free';\n  }\n\n  /**\n   * Resolve the cap for a given resource for the supplied user.\n   * Order: plan-override → plan-tier-default → static free default.\n   */\n  async getResourceCap(userId: string, resource: ResourceName): Promise<ResourceCap> {\n    if (!userId) {\n      throw new Error('getResourceCap: userId is required');\n    }\n    const defaults = RESOURCE_CAP_DEFAULTS[resource];\n    if (!defaults) {\n      throw new Error(`getResourceCap: unknown resource '${resource}'`);\n    }\n\n    const plan = await this.resolvePlan(userId);\n    const override = plan.overrides[resource];\n    if (typeof override === 'number' && override >= 0) {\n      return {\n        resource,\n        limit: override,\n        planName: plan.planName,\n        planTier: plan.planTier,\n        isFallback: false,\n      };\n    }\n\n    const limit = plan.planTier === 'paid' ? defaults.paidDefault : defaults.free;\n    return {\n      resource,\n      limit,\n      planName: plan.planName,\n      planTier: plan.planTier,\n      isFallback: plan.planName === 'fallback-free' || plan.planName === 'fallback-paid',\n    };\n  }\n\n  /**\n   * Throws ResourceCapExceededError when currentCount >= limit.\n   * Use BEFORE the create transaction to avoid orphan rows.\n   */\n  async enforceResourceCap(userId: string, resource: ResourceName, currentCount: number): Promise<ResourceCap> {\n    const cap = await this.getResourceCap(userId, resource);\n    if (currentCount >= cap.limit) {\n      throw new ResourceCapExceededError({\n        resource,\n        currentCount,\n        limit: cap.limit,\n        planName: cap.planName,\n      });\n    }\n    return cap;\n  }\n\n  /** Invalidate cache for a user (e.g. after plan upgrade) */\n  invalidate(userId: string): void {\n    this.planCache.delete(userId);\n  }\n\n  /** Clear entire plan cache */\n  invalidateAll(): void {\n    this.planCache.clear();\n  }\n\n  // -------------------------------------------------------------------------\n  // Internals\n  // -------------------------------------------------------------------------\n\n  private async resolvePlan(userId: string): Promise<CachedPlan> {\n    const cached = this.planCache.get(userId);\n    if (cached && Date.now() - cached.fetchedAt < this.cacheTtlMs) {\n      return cached;\n    }\n\n    const plan = await this.fetchPlan(userId);\n    this.planCache.set(userId, plan);\n    return plan;\n  }\n\n  private async fetchPlan(userId: string): Promise<CachedPlan> {\n    if (!this.client) {\n      return this.fallbackPlan();\n    }\n    try {\n      const res = await this.client.query<PlanQueryResponse>(PLAN_QUERY, { userId });\n      const planNode = res?.userBillingPlan;\n      if (!planNode) {\n        return this.fallbackPlan();\n      }\n      const tier = normaliseTier(planNode.tier, this.defaultTier);\n      const overrides = sanitizeOverrides(planNode.resourceCaps);\n      return {\n        planName: planNode.planName ?? (tier === 'paid' ? 'paid' : 'free'),\n        planTier: tier,\n        overrides,\n        fetchedAt: Date.now(),\n      };\n    } catch (err) {\n      logger.warn('resource-caps: plan lookup failed; falling back to default tier', {\n        err,\n        userId,\n      });\n      return this.fallbackPlan();\n    }\n  }\n\n  private fallbackPlan(): CachedPlan {\n    return {\n      planName: this.defaultTier === 'paid' ? 'fallback-paid' : 'fallback-free',\n      planTier: this.defaultTier,\n      overrides: {},\n      fetchedAt: Date.now(),\n    };\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nfunction normaliseTier(raw: string | null | undefined, fallback: PlanTier): PlanTier {\n  if (!raw) return fallback;\n  const lc = raw.toLowerCase();\n  if (lc === 'free' || lc === 'paid') return lc;\n  // Treat anything non-free as paid (enterprise, business, pro, etc.)\n  if (lc === 'enterprise' || lc === 'business' || lc === 'pro' || lc === 'team') {\n    return 'paid';\n  }\n  return fallback;\n}\n\nfunction sanitizeOverrides(raw: Record<string, number> | null | undefined): Partial<Record<ResourceName, number>> {\n  if (!raw || typeof raw !== 'object') return {};\n  const out: Partial<Record<ResourceName, number>> = {};\n  for (const [key, value] of Object.entries(raw)) {\n    if (key in RESOURCE_CAP_DEFAULTS && typeof value === 'number' && Number.isFinite(value)) {\n      out[key as ResourceName] = Math.max(0, Math.floor(value));\n    }\n  }\n  return out;\n}\n\n// ---------------------------------------------------------------------------\n// Convenience singleton\n// ---------------------------------------------------------------------------\n\nlet defaultInstance: ResourceCapsModule | null = null;\n\n/**\n * Obtain a process-wide singleton. The first call binds the GraphQL client\n * (typically the SDK's internal client). Later calls return the same instance.\n */\nexport function getResourceCaps(config?: ResourceCapsConfig): ResourceCapsModule {\n  if (!defaultInstance) {\n    defaultInstance = new ResourceCapsModule(config);\n  }\n  return defaultInstance;\n}\n\n/** Reset the singleton (for tests) */\nexport function __resetResourceCapsForTests(): void {\n  defaultInstance = null;\n}\n"]}

package/dist/chunk-VWNL2O3G.js

@@ -0,0 +1,506 @@
+import { logger } from './chunk-CBZNP6RF.js';
+import { __name } from './chunk-XE4OXN2W.js';
+import { GraphQLError } from 'graphql';
+
+var DEFAULT_ERROR_CODE = "INTERNAL_SERVER_ERROR";
+var DEFAULT_HTTP_STATUS = 500;
+var DEFAULT_USER_MESSAGES = {
+  BAD_REQUEST: "Please check the request and try again.",
+  BAD_USER_INPUT: "Please check the information and try again.",
+  CAPTCHA_FAILED: "The verification failed. Please try again.",
+  CAPTCHA_REQUIRED: "Please complete the verification to continue.",
+  COMPLEXITY_TOO_HIGH: "This request is too large to process. Please simplify it and try again.",
+  CONFLICT: "This change conflicts with existing data. Please refresh and try again.",
+  FORBIDDEN: "You do not have permission to do that.",
+  INTERNAL_SERVER_ERROR: "Something went wrong. Please try again.",
+  INVALID_PASSWORD: "The password you entered is incorrect.",
+  NOT_FOUND: "We could not find the requested item.",
+  PERMISSION_DENIED: "You do not have permission to do that.",
+  QUOTA_EXCEEDED: "You've reached your usage limit.",
+  QUOTA_EXHAUSTED: "You've reached your usage limit.",
+  RATE_LIMITED: "Too many requests. Please wait a moment and try again.",
+  RESOURCE_CAP_EXCEEDED: "You've reached your plan limit. Upgrade your plan to continue.",
+  STORAGE_QUOTA_EXCEEDED: "You've reached your storage limit. Upgrade your plan to continue.",
+  TIMEOUT: "The request took too long. Please try again.",
+  UNAUTHENTICATED: "Please sign in to continue.",
+  VALIDATION_ERROR: "Please check the information and try again.",
+  WORKSPACE_REQUIRED: "Please choose a workspace and try again."
+};
+var DEFAULT_STATUS_BY_CODE = {
+  BAD_REQUEST: 400,
+  BAD_USER_INPUT: 400,
+  CAPTCHA_FAILED: 400,
+  CAPTCHA_REQUIRED: 400,
+  COMPLEXITY_TOO_HIGH: 400,
+  CONFLICT: 409,
+  FORBIDDEN: 403,
+  INVALID_PASSWORD: 400,
+  NOT_FOUND: 404,
+  PERMISSION_DENIED: 403,
+  QUOTA_EXCEEDED: 429,
+  QUOTA_EXHAUSTED: 429,
+  RATE_LIMITED: 429,
+  RESOURCE_CAP_EXCEEDED: 429,
+  STORAGE_QUOTA_EXCEEDED: 429,
+  TIMEOUT: 504,
+  UNAUTHENTICATED: 401,
+  VALIDATION_ERROR: 400,
+  WORKSPACE_REQUIRED: 403
+};
+var SENSITIVE_EXTENSION_KEYS = /* @__PURE__ */ new Set([
+  "exception",
+  "originalError",
+  "stack",
+  "stacktrace"
+]);
+var TECHNICAL_MESSAGE_PATTERNS = [
+  /\bprisma\b/i,
+  /\bsql\b/i,
+  /\bconstraint\b/i,
+  /\bstack\b/i,
+  /\bundefined\b/i,
+  /\bnull\b/i,
+  /\bECONN[A-Z_]*\b/,
+  /\bETIMEDOUT\b/,
+  /\bENOTFOUND\b/,
+  /\bP\d{4}\b/,
+  /Cannot (read|set|find|access)/i,
+  /Build failed \(exit \d+\)/i,
+  /JSON\.stringify/i
+];
+var GRAPHQL_VALIDATION_MESSAGE_PATTERNS = [
+  /^Syntax Error:/i,
+  /^Cannot query field\b/i,
+  /^Cannot return null for non-nullable field\b/i,
+  /^Unknown (argument|directive|type)\b/i,
+  /^Variable "\$[^\"]+" got invalid value/i,
+  /^Field "[^"]+" of required type/i,
+  /^Field "[^"]+" must not have a selection/i,
+  /^Field "[^"]+" must have a selection/i,
+  /^Fragment "[^"]+" cannot be spread here/i,
+  /^There can be only one/i,
+  /Did you mean /i
+];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+__name(isRecord, "isRecord");
+function readString(record, key) {
+  const value = record[key];
+  return typeof value === "string" && value.trim().length > 0 ? value : null;
+}
+__name(readString, "readString");
+function readExtensions(error) {
+  if (!isRecord(error)) return {};
+  const extensions = error["extensions"];
+  return isRecord(extensions) ? extensions : {};
+}
+__name(readExtensions, "readExtensions");
+function readOriginalError(error) {
+  if (error instanceof GraphQLError && error.originalError instanceof Error) {
+    return error.originalError;
+  }
+  return void 0;
+}
+__name(readOriginalError, "readOriginalError");
+function sanitizeExtensions(extensions) {
+  const sanitized = {};
+  for (const [key, value] of Object.entries(extensions)) {
+    if (!SENSITIVE_EXTENSION_KEYS.has(key)) {
+      sanitized[key] = value;
+    }
+  }
+  return sanitized;
+}
+__name(sanitizeExtensions, "sanitizeExtensions");
+function normalizeCode(code) {
+  if (!code) return DEFAULT_ERROR_CODE;
+  return code.trim().replace(/[\s-]+/g, "_").toUpperCase();
+}
+__name(normalizeCode, "normalizeCode");
+function inferCodeFromMessage(message) {
+  const lower = message.toLowerCase();
+  if (GRAPHQL_VALIDATION_MESSAGE_PATTERNS.some((pattern) => pattern.test(message))) {
+    return "BAD_USER_INPUT";
+  }
+  if (lower.includes("unauthenticated") || lower.includes("not authenticated") || lower.includes("authentication required") || lower.includes("unauthorized") || lower.includes("please sign in") || lower.includes("sign in to")) {
+    return "UNAUTHENTICATED";
+  }
+  if (lower.includes("workspace context") || lower.includes("switch to a workspace")) {
+    return "WORKSPACE_REQUIRED";
+  }
+  if (lower.includes("forbidden") || lower.includes("access denied") || lower.includes("permission denied") || lower.includes("not authorized")) {
+    return "FORBIDDEN";
+  }
+  if (lower.includes("not found") || lower.includes("disappeared")) {
+    return "NOT_FOUND";
+  }
+  if (lower.includes("already exists") || lower.includes("already taken") || lower.includes("conflict")) {
+    return "CONFLICT";
+  }
+  if (lower.includes("quota") || lower.includes("cap exceeded") || lower.includes("limit reached")) {
+    return "QUOTA_EXCEEDED";
+  }
+  if (lower.includes("timeout") || lower.includes("timed out")) {
+    return "TIMEOUT";
+  }
+  if (lower.includes("required") || lower.includes("invalid") || lower.includes("missing") || lower.includes("unsupported")) {
+    return "BAD_USER_INPUT";
+  }
+  return DEFAULT_ERROR_CODE;
+}
+__name(inferCodeFromMessage, "inferCodeFromMessage");
+function inferCode(error, extensions, originalError) {
+  const extensionCode = typeof extensions["code"] === "string" ? extensions["code"] : null;
+  if (extensionCode) return normalizeCode(extensionCode);
+  if (isRecord(originalError)) {
+    const originalCode = readString(originalError, "code");
+    if (originalCode) return normalizeCode(originalCode);
+  }
+  if (isRecord(error)) {
+    const directCode = readString(error, "code");
+    if (directCode) return normalizeCode(directCode);
+  }
+  const message = readErrorMessage(error);
+  return inferCodeFromMessage(message);
+}
+__name(inferCode, "inferCode");
+function readErrorMessage(error) {
+  if (error instanceof Error && error.message.trim().length > 0) {
+    return error.message;
+  }
+  if (isRecord(error)) {
+    const message = readString(error, "message");
+    if (message) return message;
+  }
+  return DEFAULT_USER_MESSAGES[DEFAULT_ERROR_CODE];
+}
+__name(readErrorMessage, "readErrorMessage");
+function isLikelyTechnicalMessage(message) {
+  if (message.length > 220) return true;
+  if (message.includes("\n")) return true;
+  if (message.includes("{") && message.includes("}")) return true;
+  if (GRAPHQL_VALIDATION_MESSAGE_PATTERNS.some((pattern) => pattern.test(message))) return true;
+  return TECHNICAL_MESSAGE_PATTERNS.some((pattern) => pattern.test(message));
+}
+__name(isLikelyTechnicalMessage, "isLikelyTechnicalMessage");
+function readExplicitUserMessage(extensions) {
+  return readString(extensions, "userMessage") ?? readString(extensions, "humanMessage") ?? readString(extensions, "displayMessage");
+}
+__name(readExplicitUserMessage, "readExplicitUserMessage");
+function resolveUserMessage(code, message, extensions) {
+  const explicit = readExplicitUserMessage(extensions);
+  if (explicit) return explicit;
+  const fallback = DEFAULT_USER_MESSAGES[code] ?? DEFAULT_USER_MESSAGES[DEFAULT_ERROR_CODE] ?? "Something went wrong. Please try again.";
+  if (code === DEFAULT_ERROR_CODE) {
+    return fallback;
+  }
+  if (!isLikelyTechnicalMessage(message)) {
+    return message;
+  }
+  return fallback;
+}
+__name(resolveUserMessage, "resolveUserMessage");
+function resolveTechnicalMessage(code, message, extensions, options) {
+  const explicit = readString(extensions, "technicalMessage");
+  if (explicit) return explicit;
+  if (options.environment === "production" && code === DEFAULT_ERROR_CODE) {
+    return options.serviceName ? `${options.serviceName} returned ${DEFAULT_ERROR_CODE}` : DEFAULT_ERROR_CODE;
+  }
+  return message;
+}
+__name(resolveTechnicalMessage, "resolveTechnicalMessage");
+function readHttpStatus(extensions, code) {
+  const http = extensions["http"];
+  if (isRecord(http) && typeof http["status"] === "number") {
+    return http["status"];
+  }
+  return DEFAULT_STATUS_BY_CODE[code] ?? DEFAULT_HTTP_STATUS;
+}
+__name(readHttpStatus, "readHttpStatus");
+function normalizeError(error, options = {}) {
+  const originalError = readOriginalError(error);
+  const originalExtensions = readExtensions(originalError);
+  const directExtensions = readExtensions(error);
+  const mergedExtensions = sanitizeExtensions({
+    ...originalExtensions,
+    ...directExtensions
+  });
+  const message = readErrorMessage(error);
+  const code = inferCode(error, mergedExtensions, originalError);
+  const userMessage = resolveUserMessage(code, message, mergedExtensions);
+  const technicalMessage = resolveTechnicalMessage(code, message, mergedExtensions, options);
+  const status = readHttpStatus(mergedExtensions, code);
+  const extensions = {
+    ...mergedExtensions,
+    code,
+    userMessage,
+    technicalMessage
+  };
+  if (options.serviceName) {
+    extensions["serviceName"] = options.serviceName;
+  }
+  if (!isRecord(extensions["http"])) {
+    extensions["http"] = {
+      status
+    };
+  }
+  return {
+    code,
+    userMessage,
+    technicalMessage,
+    extensions,
+    status
+  };
+}
+__name(normalizeError, "normalizeError");
+var UserFacingGraphQLError = class extends GraphQLError {
+  static {
+    __name(this, "UserFacingGraphQLError");
+  }
+  constructor(options) {
+    const extensions = {
+      code: normalizeCode(options.code),
+      userMessage: options.userMessage,
+      technicalMessage: options.technicalMessage ?? options.userMessage
+    };
+    if (options.details) {
+      extensions["details"] = options.details;
+    }
+    if (options.httpStatus) {
+      extensions["http"] = {
+        status: options.httpStatus
+      };
+    }
+    super(options.userMessage, {
+      originalError: options.cause,
+      extensions
+    });
+    this.name = "UserFacingGraphQLError";
+  }
+};
+function toUserFacingGraphQLError(error, options = {}) {
+  const normalized = normalizeError(error, options);
+  if (error instanceof GraphQLError) {
+    return new GraphQLError(normalized.userMessage, {
+      nodes: error.nodes,
+      source: error.source,
+      positions: error.positions,
+      path: error.path,
+      originalError: error.originalError,
+      extensions: normalized.extensions
+    });
+  }
+  return new GraphQLError(normalized.userMessage, {
+    originalError: error instanceof Error ? error : void 0,
+    extensions: normalized.extensions
+  });
+}
+__name(toUserFacingGraphQLError, "toUserFacingGraphQLError");
+function normalizeExecutionResultErrors(result, options = {}) {
+  if (Array.isArray(result)) {
+    result.forEach((entry) => normalizeExecutionResultErrors(entry, options));
+    return;
+  }
+  if (!isRecord(result)) return;
+  const errors = result["errors"];
+  if (!Array.isArray(errors) || errors.length === 0) return;
+  result["errors"] = errors.map((error) => toUserFacingGraphQLError(error, options));
+}
+__name(normalizeExecutionResultErrors, "normalizeExecutionResultErrors");
+function normalizeGraphQLResponsePayload(payload, options = {}) {
+  normalizeExecutionResultErrors(payload, options);
+  return payload;
+}
+__name(normalizeGraphQLResponsePayload, "normalizeGraphQLResponsePayload");
+async function normalizeGraphQLResponse(response, options = {}) {
+  const contentType = response.headers.get("content-type") ?? "";
+  if (!contentType.toLowerCase().includes("json")) {
+    return response;
+  }
+  const text = await response.text();
+  if (!text) {
+    return new Response(text, {
+      status: response.status,
+      statusText: response.statusText,
+      headers: response.headers
+    });
+  }
+  let payload;
+  try {
+    payload = JSON.parse(text);
+  } catch {
+    return new Response(text, {
+      status: response.status,
+      statusText: response.statusText,
+      headers: response.headers
+    });
+  }
+  normalizeGraphQLResponsePayload(payload, options);
+  return new Response(JSON.stringify(payload), {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers
+  });
+}
+__name(normalizeGraphQLResponse, "normalizeGraphQLResponse");
+function createHumanReadableErrorPlugin(options = {}) {
+  return {
+    onExecute() {
+      return {
+        onExecuteDone({ result }) {
+          normalizeExecutionResultErrors(result, options);
+        }
+      };
+    }
+  };
+}
+__name(createHumanReadableErrorPlugin, "createHumanReadableErrorPlugin");
+function formatHttpError(error, options = {}) {
+  const normalized = normalizeError(error, options);
+  return {
+    status: normalized.status,
+    body: {
+      error: normalized.userMessage,
+      message: normalized.userMessage,
+      userMessage: normalized.userMessage,
+      technicalMessage: normalized.technicalMessage,
+      code: normalized.code,
+      extensions: normalized.extensions
+    }
+  };
+}
+__name(formatHttpError, "formatHttpError");
+function createHttpErrorResponse(error, options = {}) {
+  const formatted = formatHttpError(error, options);
+  return new Response(JSON.stringify(formatted.body), {
+    status: formatted.status,
+    headers: {
+      "Content-Type": "application/json"
+    }
+  });
+}
+__name(createHttpErrorResponse, "createHttpErrorResponse");
+
+// src/server/workspace-guard.ts
+var WorkspaceRequiredError = class WorkspaceRequiredError2 extends UserFacingGraphQLError {
+  static {
+    __name(this, "WorkspaceRequiredError");
+  }
+  constructor(message) {
+    super({
+      code: "WORKSPACE_REQUIRED",
+      userMessage: "Please choose a workspace and try again.",
+      technicalMessage: message,
+      httpStatus: 403
+    });
+    this.name = "WorkspaceRequiredError";
+  }
+};
+function isFieldPublic(field) {
+  const directives = field?.astNode?.directives;
+  if (!directives || directives.length === 0) return false;
+  for (const dir of directives) {
+    const name = dir.name?.value;
+    if (name === "public") return true;
+    if (name === "rbac") {
+      const args = dir.arguments ?? [];
+      for (const arg of args) {
+        if (arg.name?.value === "public" && arg.value?.kind === "BooleanValue" && arg.value.value === true) {
+          return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+__name(isFieldPublic, "isFieldPublic");
+function resolveOperationType(document, operationName) {
+  const defs = document?.definitions ?? [];
+  for (const def of defs) {
+    if (def.kind !== "OperationDefinition") ;
+    if (def.operation && (!operationName || def.name?.value === operationName)) {
+      return def.operation;
+    }
+  }
+  return "query";
+}
+__name(resolveOperationType, "resolveOperationType");
+function allRootFieldsPublic(schema, document, operationName) {
+  if (!schema || !document) return false;
+  const opType = resolveOperationType(document, operationName);
+  let rootType;
+  if (opType === "mutation") {
+    rootType = schema.getMutationType?.();
+  } else if (opType === "subscription") {
+    rootType = schema.getSubscriptionType?.();
+  } else {
+    rootType = schema.getQueryType?.();
+  }
+  if (!rootType) return false;
+  const fields = rootType.getFields();
+  const defs = document.definitions ?? [];
+  const opDef = defs.find((d) => d.operation && (!operationName || d.name?.value === operationName));
+  const selections = opDef?.selectionSet?.selections ?? [];
+  if (selections.length === 0) return false;
+  for (const sel of selections) {
+    if (sel.kind && sel.kind !== "Field") return false;
+    const fieldName = sel.name?.value;
+    if (!fieldName) return false;
+    if (fieldName.startsWith("__")) continue;
+    const fieldDef = fields[fieldName];
+    if (!isFieldPublic(fieldDef)) return false;
+  }
+  return true;
+}
+__name(allRootFieldsPublic, "allRootFieldsPublic");
+function createWorkspaceGuardPlugin(config) {
+  const enabled = config?.enabled ?? true;
+  const whitelistedOperations = new Set(config?.whitelistedOperations ?? []);
+  const allowPublicDirective = config?.allowPublicDirective ?? true;
+  const errorMessage = config?.errorMessage ?? "Workspace context required. Ensure the request includes a valid workspace context (x-workspace-id header).";
+  if (!enabled) {
+    logger.info("[WorkspaceGuard] Workspace guard disabled");
+    return {};
+  }
+  logger.info("[WorkspaceGuard] Workspace guard enabled", {
+    whitelistedOperations: [
+      ...whitelistedOperations
+    ],
+    allowPublicDirective
+  });
+  return {
+    onExecute({ args }) {
+      let operationName = args.operationName;
+      if (!operationName && args.document?.definitions) {
+        for (const def of args.document.definitions) {
+          if (def.operation && def.name?.value) {
+            operationName = def.name.value;
+            break;
+          }
+        }
+      }
+      if (operationName && whitelistedOperations.has(operationName)) {
+        return void 0;
+      }
+      if (allowPublicDirective && allRootFieldsPublic(args.schema, args.document, operationName)) {
+        return void 0;
+      }
+      const context = args.contextValue;
+      const workspaceId = context?.workspace?.id;
+      const headerWorkspaceId = context?.request?.headers?.get?.("x-workspace-id");
+      if (!workspaceId && !headerWorkspaceId) {
+        logger.warn("[WorkspaceGuard] Blocked operation without workspace context", {
+          operationName: operationName ?? "<anonymous>"
+        });
+        throw new WorkspaceRequiredError(errorMessage);
+      }
+      return void 0;
+    }
+  };
+}
+__name(createWorkspaceGuardPlugin, "createWorkspaceGuardPlugin");
+
+export { UserFacingGraphQLError, createHttpErrorResponse, createHumanReadableErrorPlugin, createWorkspaceGuardPlugin, formatHttpError, normalizeError, normalizeExecutionResultErrors, normalizeGraphQLResponse, normalizeGraphQLResponsePayload, toUserFacingGraphQLError };
+//# sourceMappingURL=chunk-VWNL2O3G.js.map
+//# sourceMappingURL=chunk-VWNL2O3G.js.map