@burdenoff/be-sdk 2026.528.1 → 2026.529.1

package/dist/chunk-BTQREMD4.js

@@ -1,127 +0,0 @@
-import { logger } from './chunk-CBZNP6RF.js';
-import { __name } from './chunk-XE4OXN2W.js';
-
-// src/server/workspace-guard.ts
-var WorkspaceRequiredError = class WorkspaceRequiredError2 extends Error {
-  static {
-    __name(this, "WorkspaceRequiredError");
-  }
-  extensions;
-  constructor(message) {
-    super(message);
-    this.name = "WorkspaceRequiredError";
-    this.extensions = {
-      code: "WORKSPACE_REQUIRED",
-      http: {
-        status: 403
-      }
-    };
-  }
-};
-function isFieldPublic(field) {
-  const directives = field?.astNode?.directives;
-  if (!directives || directives.length === 0) return false;
-  for (const dir of directives) {
-    const name = dir.name?.value;
-    if (name === "public") return true;
-    if (name === "rbac") {
-      const args = dir.arguments ?? [];
-      for (const arg of args) {
-        if (arg.name?.value === "public" && arg.value?.kind === "BooleanValue" && arg.value.value === true) {
-          return true;
-        }
-      }
-    }
-  }
-  return false;
-}
-__name(isFieldPublic, "isFieldPublic");
-function resolveOperationType(document, operationName) {
-  const defs = document?.definitions ?? [];
-  for (const def of defs) {
-    if (def.kind !== "OperationDefinition") ;
-    if (def.operation && (!operationName || def.name?.value === operationName)) {
-      return def.operation;
-    }
-  }
-  return "query";
-}
-__name(resolveOperationType, "resolveOperationType");
-function allRootFieldsPublic(schema, document, operationName) {
-  if (!schema || !document) return false;
-  const opType = resolveOperationType(document, operationName);
-  let rootType;
-  if (opType === "mutation") {
-    rootType = schema.getMutationType?.();
-  } else if (opType === "subscription") {
-    rootType = schema.getSubscriptionType?.();
-  } else {
-    rootType = schema.getQueryType?.();
-  }
-  if (!rootType) return false;
-  const fields = rootType.getFields();
-  const defs = document.definitions ?? [];
-  const opDef = defs.find((d) => d.operation && (!operationName || d.name?.value === operationName));
-  const selections = opDef?.selectionSet?.selections ?? [];
-  if (selections.length === 0) return false;
-  for (const sel of selections) {
-    if (sel.kind && sel.kind !== "Field") return false;
-    const fieldName = sel.name?.value;
-    if (!fieldName) return false;
-    if (fieldName.startsWith("__")) continue;
-    const fieldDef = fields[fieldName];
-    if (!isFieldPublic(fieldDef)) return false;
-  }
-  return true;
-}
-__name(allRootFieldsPublic, "allRootFieldsPublic");
-function createWorkspaceGuardPlugin(config) {
-  const enabled = config?.enabled ?? true;
-  const whitelistedOperations = new Set(config?.whitelistedOperations ?? []);
-  const allowPublicDirective = config?.allowPublicDirective ?? true;
-  const errorMessage = config?.errorMessage ?? "Workspace context required. Ensure the request includes a valid workspace context (x-workspace-id header).";
-  if (!enabled) {
-    logger.info("[WorkspaceGuard] Workspace guard disabled");
-    return {};
-  }
-  logger.info("[WorkspaceGuard] Workspace guard enabled", {
-    whitelistedOperations: [
-      ...whitelistedOperations
-    ],
-    allowPublicDirective
-  });
-  return {
-    onExecute({ args }) {
-      let operationName = args.operationName;
-      if (!operationName && args.document?.definitions) {
-        for (const def of args.document.definitions) {
-          if (def.operation && def.name?.value) {
-            operationName = def.name.value;
-            break;
-          }
-        }
-      }
-      if (operationName && whitelistedOperations.has(operationName)) {
-        return void 0;
-      }
-      if (allowPublicDirective && allRootFieldsPublic(args.schema, args.document, operationName)) {
-        return void 0;
-      }
-      const context = args.contextValue;
-      const workspaceId = context?.workspace?.id;
-      const headerWorkspaceId = context?.request?.headers?.get?.("x-workspace-id");
-      if (!workspaceId && !headerWorkspaceId) {
-        logger.warn("[WorkspaceGuard] Blocked operation without workspace context", {
-          operationName: operationName ?? "<anonymous>"
-        });
-        throw new WorkspaceRequiredError(errorMessage);
-      }
-      return void 0;
-    }
-  };
-}
-__name(createWorkspaceGuardPlugin, "createWorkspaceGuardPlugin");
-
-export { createWorkspaceGuardPlugin };
-//# sourceMappingURL=chunk-BTQREMD4.js.map
-//# sourceMappingURL=chunk-BTQREMD4.js.map

package/dist/chunk-BTQREMD4.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/workspace-guard.ts"],"names":["WorkspaceRequiredError","Error","extensions","message","name","code","http","status","isFieldPublic","field","directives","astNode","length","dir","value","args","arguments","arg","kind","resolveOperationType","document","operationName","defs","definitions","def","operation","allRootFieldsPublic","schema","opType","rootType","getMutationType","getSubscriptionType","getQueryType","fields","getFields","opDef","find","d","selections","selectionSet","sel","fieldName","startsWith","fieldDef","createWorkspaceGuardPlugin","config","enabled","whitelistedOperations","Set","allowPublicDirective","errorMessage","logger","info","onExecute","has","undefined","context","contextValue","workspaceId","workspace","id","headerWorkspaceId","request","headers","get","warn"],"mappings":";;;;AA4EA,IAAMA,sBAAAA,GAAN,MAAMA,uBAAAA,SAA+BC,KAAAA,CAAAA;EA5ErC;;;AA6EkBC,EAAAA,UAAAA;AAEhB,EAAA,WAAA,CAAYC,OAAAA,EAAiB;AAC3B,IAAA,KAAA,CAAMA,OAAAA,CAAAA;AACN,IAAA,IAAA,CAAKC,IAAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAKF,UAAAA,GAAa;MAChBG,IAAAA,EAAM,oBAAA;MACNC,IAAAA,EAAM;QAAEC,MAAAA,EAAQ;AAAI;AACtB,KAAA;AACF,EAAA;AACF,CAAA;AAkCA,SAASC,cAAcC,KAAAA,EAA+B;AACpD,EAAA,MAAMC,UAAAA,GAAaD,OAAOE,OAAAA,EAASD,UAAAA;AACnC,EAAA,IAAI,CAACA,UAAAA,IAAcA,UAAAA,CAAWE,MAAAA,KAAW,GAAG,OAAO,KAAA;AAEnD,EAAA,KAAA,MAAWC,OAAOH,UAAAA,EAAY;AAC5B,IAAA,MAAMN,IAAAA,GAAOS,IAAIT,IAAAA,EAAMU,KAAAA;AACvB,IAAA,IAAIV,IAAAA,KAAS,UAAU,OAAO,IAAA;AAC9B,IAAA,IAAIA,SAAS,MAAA,EAAQ;AACnB,MAAA,MAAMW,IAAAA,GAAOF,GAAAA,CAAIG,SAAAA,IAAa,EAAA;AAC9B,MAAA,KAAA,MAAWC,OAAOF,IAAAA,EAAM;AACtB,QAAA,IAAIE,GAAAA,CAAIb,IAAAA,EAAMU,KAAAA,KAAU,QAAA,IAAYG,GAAAA,CAAIH,KAAAA,EAAOI,IAAAA,KAAS,cAAA,IAAkBD,GAAAA,CAAIH,KAAAA,CAAMA,KAAAA,KAAU,IAAA,EAAM;AAClG,UAAA,OAAO,IAAA;AACT,QAAA;AACF,MAAA;AACF,IAAA;AACF,EAAA;AACA,EAAA,OAAO,KAAA;AACT;AAjBSN,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAqCT,SAASW,oBAAAA,CACPC,UACAC,aAAAA,EAAwC;AAExC,EAAA,MAAMC,IAAAA,GAAOF,QAAAA,EAAUG,WAAAA,IAAe,EAAA;AACtC,EAAA,KAAA,MAAWC,OAAOF,IAAAA,EAAM;AACtB,IAAA,IAAIE,GAAAA,CAAIN,SAAS,qBAAA,EAAuB;AAGxC,IAAA,IAAIM,IAAIC,SAAAA,KAAc,CAACJ,iBAAiBG,GAAAA,CAAIpB,IAAAA,EAAMU,UAAUO,aAAAA,CAAAA,EAAgB;AAC1E,MAAA,OAAOG,GAAAA,CAAIC,SAAAA;AACb,IAAA;AACF,EAAA;AACA,EAAA,OAAO,OAAA;AACT;AAdSN,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAoBT,SAASO,mBAAAA,CACPC,MAAAA,EACAP,QAAAA,EACAC,aAAAA,EAAwC;AAExC,EAAA,IAAI,CAACM,MAAAA,IAAU,CAACP,QAAAA,EAAU,OAAO,KAAA;AAEjC,EAAA,MAAMQ,MAAAA,GAAST,oBAAAA,CAAqBC,QAAAA,EAAUC,aAAAA,CAAAA;AAC9C,EAAA,IAAIQ,QAAAA;AACJ,EAAA,IAAID,WAAW,UAAA,EAAY;AACzBC,IAAAA,QAAAA,GAAWF,OAAOG,eAAAA,IAAe;AACnC,EAAA,CAAA,MAAA,IAAWF,WAAW,cAAA,EAAgB;AACpCC,IAAAA,QAAAA,GAAWF,OAAOI,mBAAAA,IAAmB;EACvC,CAAA,MAAO;AACLF,IAAAA,QAAAA,GAAWF,OAAOK,YAAAA,IAAY;AAChC,EAAA;AAEA,EAAA,IAAI,CAACH,UAAU,OAAO,KAAA;AAEtB,EAAA,MAAMI,MAAAA,GAASJ,SAASK,SAAAA,EAAS;AACjC,EAAA,MAAMZ,IAAAA,GAAOF,QAAAA,CAASG,WAAAA,IAAe,EAAA;AAGrC,EAAA,MAAMY,KAAAA,GAAQb,IAAAA,CAAKc,IAAAA,CAAK,CAACC,CAAAA,KAAMA,CAAAA,CAAEZ,SAAAA,KAAc,CAACJ,aAAAA,IAAiBgB,CAAAA,CAAEjC,IAAAA,EAAMU,KAAAA,KAAUO,aAAAA,CAAY,CAAA;AAC/F,EAAA,MAAMiB,UAAAA,GAAaH,KAAAA,EAAOI,YAAAA,EAAcD,UAAAA,IAAc,EAAA;AACtD,EAAA,IAAIA,UAAAA,CAAW1B,MAAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAEpC,EAAA,KAAA,MAAW4B,OAAOF,UAAAA,EAAY;AAG5B,IAAA,IAAIE,GAAAA,CAAItB,IAAAA,IAAQsB,GAAAA,CAAItB,IAAAA,KAAS,SAAS,OAAO,KAAA;AAC7C,IAAA,MAAMuB,SAAAA,GAAYD,IAAIpC,IAAAA,EAAMU,KAAAA;AAC5B,IAAA,IAAI,CAAC2B,WAAW,OAAO,KAAA;AAGvB,IAAA,IAAIA,SAAAA,CAAUC,UAAAA,CAAW,IAAA,CAAA,EAAO;AAChC,IAAA,MAAMC,QAAAA,GAAWV,OAAOQ,SAAAA,CAAAA;AACxB,IAAA,IAAI,CAACjC,aAAAA,CAAcmC,QAAAA,CAAAA,EAAW,OAAO,KAAA;AACvC,EAAA;AACA,EAAA,OAAO,IAAA;AACT;AAxCSjB,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAkEF,SAASkB,2BAA2BC,MAAAA,EAA6B;AACtE,EAAA,MAAMC,OAAAA,GAAUD,QAAQC,OAAAA,IAAW,IAAA;AACnC,EAAA,MAAMC,wBAAwB,IAAIC,GAAAA,CAAIH,MAAAA,EAAQE,qBAAAA,IAAyB,EAAE,CAAA;AACzE,EAAA,MAAME,oBAAAA,GAAuBJ,QAAQI,oBAAAA,IAAwB,IAAA;AAC7D,EAAA,MAAMC,YAAAA,GACJL,QAAQK,YAAAA,IACR,4GAAA;AAEF,EAAA,IAAI,CAACJ,OAAAA,EAAS;AACZK,IAAAA,MAAAA,CAAOC,KAAK,2CAAA,CAAA;AACZ,IAAA,OAAO,EAAC;AACV,EAAA;AAEAD,EAAAA,MAAAA,CAAOC,KAAK,0CAAA,EAA4C;IACtDL,qBAAAA,EAAuB;AAAIA,MAAAA,GAAAA;;AAC3BE,IAAAA;GACF,CAAA;AAEA,EAAA,OAAO;IACLI,SAAAA,CAAU,EACRtC,MAAI,EAQL;AAEC,MAAA,IAAIM,gBAAgBN,IAAAA,CAAKM,aAAAA;AAEzB,MAAA,IAAI,CAACA,aAAAA,IAAiBN,IAAAA,CAAKK,QAAAA,EAAUG,WAAAA,EAAa;AAChD,QAAA,KAAA,MAAWC,GAAAA,IAAOT,IAAAA,CAAKK,QAAAA,CAASG,WAAAA,EAAa;AAC3C,UAAA,IAAIC,GAAAA,CAAIC,SAAAA,IAAaD,GAAAA,CAAIpB,IAAAA,EAAMU,KAAAA,EAAO;AACpCO,YAAAA,aAAAA,GAAgBG,IAAIpB,IAAAA,CAAKU,KAAAA;AACzB,YAAA;AACF,UAAA;AACF,QAAA;AACF,MAAA;AAGA,MAAA,IAAIO,aAAAA,IAAiB0B,qBAAAA,CAAsBO,GAAAA,CAAIjC,aAAAA,CAAAA,EAAgB;AAC7D,QAAA,OAAOkC,MAAAA;AACT,MAAA;AAGA,MAAA,IAAIN,wBAAwBvB,mBAAAA,CAAoBX,IAAAA,CAAKY,QAAQZ,IAAAA,CAAKK,QAAAA,EAAUC,aAAAA,CAAAA,EAAgB;AAC1F,QAAA,OAAOkC,MAAAA;AACT,MAAA;AAGA,MAAA,MAAMC,UAAUzC,IAAAA,CAAK0C,YAAAA;AACrB,MAAA,MAAMC,WAAAA,GAAcF,SAASG,SAAAA,EAAWC,EAAAA;AAGxC,MAAA,MAAMC,iBAAAA,GAAoBL,OAAAA,EAASM,OAAAA,EAASC,OAAAA,EAASC,MAAM,gBAAA,CAAA;AAE3D,MAAA,IAAI,CAACN,WAAAA,IAAe,CAACG,iBAAAA,EAAmB;AACtCV,QAAAA,MAAAA,CAAOc,KAAK,8DAAA,EAAgE;AAC1E5C,UAAAA,aAAAA,EAAeA,aAAAA,IAAiB;SAClC,CAAA;AACA,QAAA,MAAM,IAAIrB,uBAAuBkD,YAAAA,CAAAA;AACnC,MAAA;AAEA,MAAA,OAAOK,MAAAA;AACT,IAAA;AACF,GAAA;AACF;AApEgBX,MAAAA,CAAAA,0BAAAA,EAAAA,4BAAAA,CAAAA","file":"chunk-BTQREMD4.js","sourcesContent":["/**\n * Workspace Guard Plugin for GraphQL Yoga\n *\n * Blocks GraphQL operations that lack a valid workspace context (x-workspace-id header).\n * This provides defense-in-depth at the GraphQL layer — even if the gateway allows a request\n * through, the service itself will reject it if workspace context is missing.\n *\n * **Whitelisted operations** (e.g., workspace creation) can bypass the guard.\n *\n * **Public schema fields** marked with `@public` or `@rbac(public: true)` are auto-bypassed\n * when `allowPublicDirective` is enabled (default true). This lets anonymous public-link\n * resolvers (e.g. `accessShare`) be reached through the federation gateway without an\n * `x-workspace-id` header.\n *\n * @module server/workspace-guard\n * @category Security\n */\n\nimport { logger } from '../logger/index.js';\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/**\n * Configuration for the workspace guard plugin\n */\nexport interface WorkspaceGuardConfig {\n  /**\n   * Enable the workspace guard.\n   * @default true\n   */\n  enabled?: boolean;\n\n  /**\n   * GraphQL operation names that can run without workspace context.\n   * These are typically operations like `createWorkspace` that execute\n   * before a workspace exists.\n   *\n   * Matching is case-sensitive against the operation name in the GraphQL document.\n   *\n   * @default []\n   *\n   * @example\n   * ```typescript\n   * whitelistedOperations: ['createWorkspace', 'validateTokens']\n   * ```\n   */\n  whitelistedOperations?: string[];\n\n  /**\n   * Custom error message when workspace context is missing.\n   * @default 'Workspace context required. Provide a valid X-Workspace-Authorization header.'\n   */\n  errorMessage?: string;\n\n  /**\n   * If true, fields whose schema definition carries the `@public` directive or\n   * `@rbac(public: true)` are bypassed by the guard automatically — no need to\n   * list them in `whitelistedOperations`. The check uses the GraphQL schema\n   * passed to the executor at request time.\n   *\n   * Set to false to fall back to the legacy operation-name allowlist only.\n   *\n   * @default true\n   */\n  allowPublicDirective?: boolean;\n}\n\n// ============================================================================\n// GraphQL Error\n// ============================================================================\n\n/**\n * Workspace required error with proper GraphQL error extensions\n */\nclass WorkspaceRequiredError extends Error {\n  public readonly extensions: { code: string; http: { status: number } };\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'WorkspaceRequiredError';\n    this.extensions = {\n      code: 'WORKSPACE_REQUIRED',\n      http: { status: 403 },\n    };\n  }\n}\n\n// ============================================================================\n// Schema directive helpers\n// ============================================================================\n\n/**\n * Minimal structural typings for the bits of the GraphQL schema we look at.\n * We avoid importing the GraphQL types directly so the SDK keeps `graphql`\n * as a peer dep without a runtime hard dependency.\n */\ninterface FieldLikeDef {\n  astNode?: {\n    directives?: ReadonlyArray<{\n      name: { value: string };\n      arguments?: ReadonlyArray<{\n        name: { value: string };\n        value: { kind: string; value?: unknown };\n      }>;\n    }>;\n  };\n}\n\ninterface SchemaLike {\n  getQueryType?: () => { getFields: () => Record<string, FieldLikeDef> } | null | undefined;\n  getMutationType?: () => { getFields: () => Record<string, FieldLikeDef> } | null | undefined;\n  getSubscriptionType?: () => { getFields: () => Record<string, FieldLikeDef> } | null | undefined;\n}\n\n/**\n * Returns true iff the field carries either:\n *   - `@public` directive, OR\n *   - `@rbac(public: true)` directive (any arg-order)\n */\nfunction isFieldPublic(field: FieldLikeDef | undefined): boolean {\n  const directives = field?.astNode?.directives;\n  if (!directives || directives.length === 0) return false;\n\n  for (const dir of directives) {\n    const name = dir.name?.value;\n    if (name === 'public') return true;\n    if (name === 'rbac') {\n      const args = dir.arguments ?? [];\n      for (const arg of args) {\n        if (arg.name?.value === 'public' && arg.value?.kind === 'BooleanValue' && arg.value.value === true) {\n          return true;\n        }\n      }\n    }\n  }\n  return false;\n}\n\ninterface DocumentLike {\n  definitions?: ReadonlyArray<{\n    kind?: string;\n    operation?: string;\n    name?: { value?: string };\n    selectionSet?: {\n      selections?: ReadonlyArray<{\n        kind?: string;\n        name?: { value?: string };\n      }>;\n    };\n  }>;\n}\n\n/**\n * Resolve the operation type ('query' | 'mutation' | 'subscription') for the\n * primary operation in the document. Falls back to 'query'.\n */\nfunction resolveOperationType(\n  document: DocumentLike | undefined,\n  operationName: string | null | undefined\n): 'query' | 'mutation' | 'subscription' {\n  const defs = document?.definitions ?? [];\n  for (const def of defs) {\n    if (def.kind !== 'OperationDefinition') {\n      // Older parsers may not set kind; fall through to the operation property check below.\n    }\n    if (def.operation && (!operationName || def.name?.value === operationName)) {\n      return def.operation as 'query' | 'mutation' | 'subscription';\n    }\n  }\n  return 'query';\n}\n\n/**\n * Returns true iff every root field in the document selection set is marked\n * public on the schema. Empty selection sets return false (fail-closed).\n */\nfunction allRootFieldsPublic(\n  schema: SchemaLike | undefined,\n  document: DocumentLike | undefined,\n  operationName: string | null | undefined\n): boolean {\n  if (!schema || !document) return false;\n\n  const opType = resolveOperationType(document, operationName);\n  let rootType: ReturnType<NonNullable<SchemaLike['getQueryType']>> | undefined;\n  if (opType === 'mutation') {\n    rootType = schema.getMutationType?.();\n  } else if (opType === 'subscription') {\n    rootType = schema.getSubscriptionType?.();\n  } else {\n    rootType = schema.getQueryType?.();\n  }\n\n  if (!rootType) return false;\n\n  const fields = rootType.getFields();\n  const defs = document.definitions ?? [];\n\n  // Find the operation definition matching operationName (or first one).\n  const opDef = defs.find((d) => d.operation && (!operationName || d.name?.value === operationName));\n  const selections = opDef?.selectionSet?.selections ?? [];\n  if (selections.length === 0) return false;\n\n  for (const sel of selections) {\n    // Only consider plain Field selections (skip fragments — fragments at the root\n    // shouldn't drive a public bypass; fail-closed there).\n    if (sel.kind && sel.kind !== 'Field') return false;\n    const fieldName = sel.name?.value;\n    if (!fieldName) return false;\n    // __schema / __type introspection is always allowed without workspace context;\n    // treat them as public.\n    if (fieldName.startsWith('__')) continue;\n    const fieldDef = fields[fieldName];\n    if (!isFieldPublic(fieldDef)) return false;\n  }\n  return true;\n}\n\n// ============================================================================\n// Plugin\n// ============================================================================\n\n/**\n * Create a GraphQL Yoga plugin that guards operations requiring workspace context.\n *\n * The plugin inspects the GraphQL context for workspace information (set by the SDK's\n * buildContext from the x-workspace-id header). If missing and the operation is not\n * whitelisted (and not all-public per directive), it throws a WORKSPACE_REQUIRED error.\n *\n * @param config - Guard configuration\n * @returns A Yoga-compatible plugin\n *\n * @example\n * ```typescript\n * import { createWorkspaceGuardPlugin } from '@burdenoff/be-sdk/server';\n *\n * const guardPlugin = createWorkspaceGuardPlugin({\n *   whitelistedOperations: ['createWorkspace'],\n *   allowPublicDirective: true, // default\n * });\n * ```\n */\nexport function createWorkspaceGuardPlugin(config?: WorkspaceGuardConfig) {\n  const enabled = config?.enabled ?? true;\n  const whitelistedOperations = new Set(config?.whitelistedOperations ?? []);\n  const allowPublicDirective = config?.allowPublicDirective ?? true;\n  const errorMessage =\n    config?.errorMessage ??\n    'Workspace context required. Ensure the request includes a valid workspace context (x-workspace-id header).';\n\n  if (!enabled) {\n    logger.info('[WorkspaceGuard] Workspace guard disabled');\n    return {};\n  }\n\n  logger.info('[WorkspaceGuard] Workspace guard enabled', {\n    whitelistedOperations: [...whitelistedOperations],\n    allowPublicDirective,\n  });\n\n  return {\n    onExecute({\n      args,\n    }: {\n      args: {\n        schema?: SchemaLike;\n        document?: DocumentLike;\n        operationName?: string | null;\n        contextValue?: { workspace?: { id?: string }; request?: Request };\n      };\n    }) {\n      // Extract operation name from args or document\n      let operationName = args.operationName;\n\n      if (!operationName && args.document?.definitions) {\n        for (const def of args.document.definitions) {\n          if (def.operation && def.name?.value) {\n            operationName = def.name.value;\n            break;\n          }\n        }\n      }\n\n      // Check if operation is whitelisted by name\n      if (operationName && whitelistedOperations.has(operationName)) {\n        return undefined;\n      }\n\n      // Check schema-directive-based public bypass (Option C)\n      if (allowPublicDirective && allRootFieldsPublic(args.schema, args.document, operationName)) {\n        return undefined;\n      }\n\n      // Check for workspace context\n      const context = args.contextValue;\n      const workspaceId = context?.workspace?.id;\n\n      // Also check the raw header as a fallback\n      const headerWorkspaceId = context?.request?.headers?.get?.('x-workspace-id');\n\n      if (!workspaceId && !headerWorkspaceId) {\n        logger.warn('[WorkspaceGuard] Blocked operation without workspace context', {\n          operationName: operationName ?? '<anonymous>',\n        });\n        throw new WorkspaceRequiredError(errorMessage);\n      }\n\n      return undefined;\n    },\n  };\n}\n"]}

package/dist/workspace-guard-524GBJQ6.js

@@ -1,5 +0,0 @@
-export { createWorkspaceGuardPlugin } from './chunk-BTQREMD4.js';
-import './chunk-CBZNP6RF.js';
-import './chunk-XE4OXN2W.js';
-//# sourceMappingURL=workspace-guard-524GBJQ6.js.map
-//# sourceMappingURL=workspace-guard-524GBJQ6.js.map