@burdenoff/be-sdk 2026.529.2 → 2026.530.1

package/dist/auth/index.d.ts

@@ -1,6 +1,13 @@
 import { B as BurdenoffGraphQLClient } from '../graphql-DH3L5Hj7.js';
 import { S as SDKContext } from '../index-Caqvetqq.js';
+import { G as GraphQLContext } from '../types-sKXodL2N.js';
 import 'graphql-request';
+import 'graphql';
+import 'graphql-yoga';
+import '../client-CSjIrYKS.js';
+import '@prisma/adapter-pg';
+import 'pg';
+import '../types-C8TbSdEj.js';
 
 interface CookieOptions {
     name: string;
@@ -12,20 +19,21 @@ interface CookieOptions {
     secure?: boolean;
     sameSite?: 'Strict' | 'Lax' | 'None';
 }
-
-interface CookieContext {
-    responseHeaders?: Headers;
-    [key: string]: unknown;
-}
-declare const AuthCookieHelper: {
-    setAuthCookies(context: CookieContext, tokens: {
+declare class AuthCookieHelper {
+    private static readonly ACCESS_TOKEN_COOKIE;
+    private static readonly REFRESH_TOKEN_COOKIE;
+    private static readonly PROFILE_ID_COOKIE;
+    static setAuthCookies(context: GraphQLContext, tokens: {
         accessToken: string;
-        refreshToken: string;
+        refreshToken?: string;
     }, options?: {
+        profileId?: string;
         rememberMe?: boolean;
     }): void;
-    clearAuthCookies(context: CookieContext): void;
-};
+    static clearAuthCookies(context: GraphQLContext): void;
+    private static setCookie;
+}
+
 interface TokenPayload {
     jti: string;
     sub: string;

package/dist/auth/index.js

@@ -1,4 +1,4 @@
-export { AuthCookieHelper, AuthModule } from '../chunk-7NUQXGA7.js';
+export { AuthCookieHelper, AuthModule } from '../chunk-KKCC3Z4I.js';
 import '../chunk-B7I4TABG.js';
 import '../chunk-O6RHB2YP.js';
 import '../chunk-HP6JTFNR.js';

package/dist/{chunk-7NUQXGA7.js → chunk-KKCC3Z4I.js}

@@ -3,36 +3,114 @@ import { AuthenticationError } from './chunk-O6RHB2YP.js';
 import { logger } from './chunk-CBZNP6RF.js';
 import { __name } from './chunk-XE4OXN2W.js';
 
-// src/auth/index.ts
-var ACCESS_TOKEN_COOKIE = "bf_access_token";
-var REFRESH_TOKEN_COOKIE = "bf_refresh_token";
-var ACCESS_TOKEN_MAX_AGE = 15 * 60;
-var REFRESH_TOKEN_MAX_AGE = 30 * 24 * 60 * 60;
-var REFRESH_TOKEN_REMEMBER_MAX_AGE = 30 * 24 * 60 * 60;
-function buildCookieString(name, value, maxAge) {
-  return `${name}=${value}; Max-Age=${maxAge}; Path=/; HttpOnly; SameSite=Strict`;
-}
-__name(buildCookieString, "buildCookieString");
-function buildClearCookieString(name) {
-  return `${name}=; Max-Age=0; Path=/; HttpOnly; SameSite=Strict`;
-}
-__name(buildClearCookieString, "buildClearCookieString");
-var AuthCookieHelper = {
-  setAuthCookies(context, tokens, options) {
-    const headers = context.responseHeaders;
-    if (!headers) return;
-    const rememberMe = options?.rememberMe ?? false;
-    const refreshMaxAge = rememberMe ? REFRESH_TOKEN_REMEMBER_MAX_AGE : REFRESH_TOKEN_MAX_AGE;
-    headers.append("Set-Cookie", buildCookieString(ACCESS_TOKEN_COOKIE, tokens.accessToken, ACCESS_TOKEN_MAX_AGE));
-    headers.append("Set-Cookie", buildCookieString(REFRESH_TOKEN_COOKIE, tokens.refreshToken, refreshMaxAge));
-  },
-  clearAuthCookies(context) {
-    const headers = context.responseHeaders;
-    if (!headers) return;
-    headers.append("Set-Cookie", buildClearCookieString(ACCESS_TOKEN_COOKIE));
-    headers.append("Set-Cookie", buildClearCookieString(REFRESH_TOKEN_COOKIE));
+// src/auth/cookie-helper.ts
+var AuthCookieHelper = class {
+  static {
+    __name(this, "AuthCookieHelper");
+  }
+  static ACCESS_TOKEN_COOKIE = "bf_at";
+  static REFRESH_TOKEN_COOKIE = "bf_rt";
+  static PROFILE_ID_COOKIE = "bf_pid";
+  /**
+  * Set authentication cookies in the context response headers
+  */
+  static setAuthCookies(context, tokens, options = {}) {
+    const isProd = process.env["NODE_ENV"] === "production";
+    const domain = process.env["COOKIE_DOMAIN"];
+    this.setCookie(context, {
+      name: this.ACCESS_TOKEN_COOKIE,
+      value: tokens.accessToken,
+      maxAge: 15 * 60,
+      httpOnly: true,
+      secure: isProd,
+      sameSite: "Lax",
+      domain,
+      path: "/"
+    });
+    if (tokens.refreshToken) {
+      this.setCookie(context, {
+        name: this.REFRESH_TOKEN_COOKIE,
+        value: tokens.refreshToken,
+        maxAge: options.rememberMe ? 30 * 24 * 60 * 60 : 7 * 24 * 60 * 60,
+        httpOnly: true,
+        secure: isProd,
+        sameSite: "Lax",
+        domain,
+        path: "/global/graphql"
+      });
+    }
+    if (options.profileId) {
+      this.setCookie(context, {
+        name: this.PROFILE_ID_COOKIE,
+        value: options.profileId,
+        maxAge: 30 * 24 * 60 * 60,
+        httpOnly: false,
+        secure: isProd,
+        sameSite: "Lax",
+        domain,
+        path: "/"
+      });
+    }
+  }
+  /**
+  * Clear authentication cookies
+  */
+  static clearAuthCookies(context) {
+    const domain = process.env["COOKIE_DOMAIN"];
+    const isProd = process.env["NODE_ENV"] === "production";
+    const clearOptions = {
+      value: "",
+      maxAge: 0,
+      domain,
+      path: "/",
+      secure: isProd,
+      sameSite: "Lax"
+    };
+    this.setCookie(context, {
+      ...clearOptions,
+      name: this.ACCESS_TOKEN_COOKIE,
+      httpOnly: true
+    });
+    this.setCookie(context, {
+      ...clearOptions,
+      name: this.REFRESH_TOKEN_COOKIE,
+      httpOnly: true,
+      path: "/global/graphql"
+    });
+    this.setCookie(context, {
+      ...clearOptions,
+      name: this.PROFILE_ID_COOKIE,
+      httpOnly: false
+    });
+  }
+  /**
+  * Internal helper to set a cookie header
+  */
+  static setCookie(context, options) {
+    let cookie = `${options.name}=${options.value}`;
+    if (options.maxAge !== void 0) {
+      cookie += `; Max-Age=${options.maxAge}`;
+    }
+    if (options.domain) {
+      cookie += `; Domain=${options.domain}`;
+    }
+    if (options.path) {
+      cookie += `; Path=${options.path}`;
+    }
+    if (options.httpOnly) {
+      cookie += "; HttpOnly";
+    }
+    if (options.secure) {
+      cookie += "; Secure";
+    }
+    if (options.sameSite) {
+      cookie += `; SameSite=${options.sameSite}`;
+    }
+    context.responseHeaders.append("Set-Cookie", cookie);
   }
 };
+
+// src/auth/index.ts
 var AuthModule = class {
   static {
     __name(this, "AuthModule");
@@ -194,5 +272,5 @@ var AuthModule = class {
 };
 
 export { AuthCookieHelper, AuthModule };
-//# sourceMappingURL=chunk-7NUQXGA7.js.map
-//# sourceMappingURL=chunk-7NUQXGA7.js.map
+//# sourceMappingURL=chunk-KKCC3Z4I.js.map
+//# sourceMappingURL=chunk-KKCC3Z4I.js.map

package/dist/chunk-KKCC3Z4I.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth/cookie-helper.ts","../src/auth/index.ts"],"names":["AuthCookieHelper","ACCESS_TOKEN_COOKIE","REFRESH_TOKEN_COOKIE","PROFILE_ID_COOKIE","setAuthCookies","context","tokens","options","isProd","process","env","domain","setCookie","name","value","accessToken","maxAge","httpOnly","secure","sameSite","path","refreshToken","rememberMe","profileId","clearAuthCookies","clearOptions","cookie","undefined","responseHeaders","append","AuthModule","client","verifyToken","token","logger","debug","isTokenExpired","valid","error","query","response","Error","message","decodeToken","payload","parseJWT","mutation","info","AuthenticationError","validatePermission","userId","permission","resourceId","allowed","isTokenValid","getUserIdFromToken","user_id","getWorkspaceIdFromToken","workspace_id","getTokenClaims","willExpireSoon","withinSeconds","exp","now","Math","floor","Date"],"mappings":";;;;;;AAoBO,IAAMA,mBAAN,MAAMA;EApBb;;;AAqBE,EAAA,OAAwBC,mBAAAA,GAAsB,OAAA;AAC9C,EAAA,OAAwBC,oBAAAA,GAAuB,OAAA;AAC/C,EAAA,OAAwBC,iBAAAA,GAAoB,QAAA;;;;AAK5C,EAAA,OAAcC,cAAAA,CACZC,OAAAA,EACAC,MAAAA,EACAC,OAAAA,GAAwD,EAAC,EACnD;AACN,IAAA,MAAMC,MAAAA,GAASC,OAAAA,CAAQC,GAAAA,CAAI,UAAA,CAAA,KAAgB,YAAA;AAC3C,IAAA,MAAMC,MAAAA,GAASF,OAAAA,CAAQC,GAAAA,CAAI,eAAA,CAAA;AAG3B,IAAA,IAAA,CAAKE,UAAUP,OAAAA,EAAS;AACtBQ,MAAAA,IAAAA,EAAM,IAAA,CAAKZ,mBAAAA;AACXa,MAAAA,KAAAA,EAAOR,MAAAA,CAAOS,WAAAA;AACdC,MAAAA,MAAAA,EAAQ,EAAA,GAAK,EAAA;MACbC,QAAAA,EAAU,IAAA;MACVC,MAAAA,EAAQV,MAAAA;MACRW,QAAAA,EAAU,KAAA;AACVR,MAAAA,MAAAA;MACAS,IAAAA,EAAM;KACR,CAAA;AAGA,IAAA,IAAId,OAAOe,YAAAA,EAAc;AACvB,MAAA,IAAA,CAAKT,UAAUP,OAAAA,EAAS;AACtBQ,QAAAA,IAAAA,EAAM,IAAA,CAAKX,oBAAAA;AACXY,QAAAA,KAAAA,EAAOR,MAAAA,CAAOe,YAAAA;QACdL,MAAAA,EAAQT,OAAAA,CAAQe,aAAa,EAAA,GAAK,EAAA,GAAK,KAAK,EAAA,GAAK,CAAA,GAAI,KAAK,EAAA,GAAK,EAAA;QAC/DL,QAAAA,EAAU,IAAA;QACVC,MAAAA,EAAQV,MAAAA;QACRW,QAAAA,EAAU,KAAA;AACVR,QAAAA,MAAAA;QACAS,IAAAA,EAAM;OACR,CAAA;AACF,IAAA;AAGA,IAAA,IAAIb,QAAQgB,SAAAA,EAAW;AACrB,MAAA,IAAA,CAAKX,UAAUP,OAAAA,EAAS;AACtBQ,QAAAA,IAAAA,EAAM,IAAA,CAAKV,iBAAAA;AACXW,QAAAA,KAAAA,EAAOP,OAAAA,CAAQgB,SAAAA;QACfP,MAAAA,EAAQ,EAAA,GAAK,KAAK,EAAA,GAAK,EAAA;QACvBC,QAAAA,EAAU,KAAA;QACVC,MAAAA,EAAQV,MAAAA;QACRW,QAAAA,EAAU,KAAA;AACVR,QAAAA,MAAAA;QACAS,IAAAA,EAAM;OACR,CAAA;AACF,IAAA;AACF,EAAA;;;;AAKA,EAAA,OAAcI,iBAAiBnB,OAAAA,EAA+B;AAC5D,IAAA,MAAMM,MAAAA,GAASF,OAAAA,CAAQC,GAAAA,CAAI,eAAA,CAAA;AAC3B,IAAA,MAAMF,MAAAA,GAASC,OAAAA,CAAQC,GAAAA,CAAI,UAAA,CAAA,KAAgB,YAAA;AAE3C,IAAA,MAAMe,YAAAA,GAAe;MACnBX,KAAAA,EAAO,EAAA;MACPE,MAAAA,EAAQ,CAAA;AACRL,MAAAA,MAAAA;MACAS,IAAAA,EAAM,GAAA;MACNF,MAAAA,EAAQV,MAAAA;MACRW,QAAAA,EAAU;AACZ,KAAA;AAEA,IAAA,IAAA,CAAKP,UAAUP,OAAAA,EAAS;MAAE,GAAGoB,YAAAA;AAAcZ,MAAAA,IAAAA,EAAM,IAAA,CAAKZ,mBAAAA;MAAqBgB,QAAAA,EAAU;KAAK,CAAA;AAC1F,IAAA,IAAA,CAAKL,UAAUP,OAAAA,EAAS;MACtB,GAAGoB,YAAAA;AACHZ,MAAAA,IAAAA,EAAM,IAAA,CAAKX,oBAAAA;MACXe,QAAAA,EAAU,IAAA;MACVG,IAAAA,EAAM;KACR,CAAA;AACA,IAAA,IAAA,CAAKR,UAAUP,OAAAA,EAAS;MAAE,GAAGoB,YAAAA;AAAcZ,MAAAA,IAAAA,EAAM,IAAA,CAAKV,iBAAAA;MAAmBc,QAAAA,EAAU;KAAM,CAAA;AAC3F,EAAA;;;;EAKA,OAAeL,SAAAA,CAAUP,SAAyBE,OAAAA,EAA8B;AAC9E,IAAA,IAAImB,SAAS,CAAA,EAAGnB,OAAAA,CAAQM,IAAI,CAAA,CAAA,EAAIN,QAAQO,KAAK,CAAA,CAAA;AAE7C,IAAA,IAAIP,OAAAA,CAAQS,WAAWW,MAAAA,EAAW;AAChCD,MAAAA,MAAAA,IAAU,CAAA,UAAA,EAAanB,QAAQS,MAAM,CAAA,CAAA;AACvC,IAAA;AAEA,IAAA,IAAIT,QAAQI,MAAAA,EAAQ;AAClBe,MAAAA,MAAAA,IAAU,CAAA,SAAA,EAAYnB,QAAQI,MAAM,CAAA,CAAA;AACtC,IAAA;AAEA,IAAA,IAAIJ,QAAQa,IAAAA,EAAM;AAChBM,MAAAA,MAAAA,IAAU,CAAA,OAAA,EAAUnB,QAAQa,IAAI,CAAA,CAAA;AAClC,IAAA;AAEA,IAAA,IAAIb,QAAQU,QAAAA,EAAU;AACpBS,MAAAA,MAAAA,IAAU,YAAA;AACZ,IAAA;AAEA,IAAA,IAAInB,QAAQW,MAAAA,EAAQ;AAClBQ,MAAAA,MAAAA,IAAU,UAAA;AACZ,IAAA;AAEA,IAAA,IAAInB,QAAQY,QAAAA,EAAU;AACpBO,MAAAA,MAAAA,IAAU,CAAA,WAAA,EAAcnB,QAAQY,QAAQ,CAAA,CAAA;AAC1C,IAAA;AAEAd,IAAAA,OAAAA,CAAQuB,eAAAA,CAAgBC,MAAAA,CAAO,YAAA,EAAcH,MAAAA,CAAAA;AAC/C,EAAA;AACF;;;AC7FO,IAAMI,aAAN,MAAMA;EA1Cb;;;;;AA2CE,EAAA,WAAA,CACUC,QACA1B,OAAAA,EACR;SAFQ0B,MAAAA,GAAAA,MAAAA;SACA1B,OAAAA,GAAAA,OAAAA;AACP,EAAA;;;;AAKH,EAAA,MAAa2B,YAAYC,KAAAA,EAA2C;AAClEC,IAAAA,MAAAA,CAAOC,MAAM,wBAAA,CAAA;AAGb,IAAA,IAAIC,cAAAA,CAAeH,KAAAA,CAAAA,EAAQ;AACzB,MAAA,OAAO;QACLI,KAAAA,EAAO,KAAA;QACPC,KAAAA,EAAO;AACT,OAAA;AACF,IAAA;AAEA,IAAA,MAAMC,KAAAA,GAAQ;;;;;;;;;AAUd,IAAA,IAAI;AACF,MAAA,MAAMC,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MAA0CA,KAAAA,EAAO;AAAEN,QAAAA;AAAM,OAAA,EAAG,KAAK5B,OAAO,CAAA;AAE3G6B,MAAAA,MAAAA,CAAOC,MAAM,kCAAA,EAAoC;AAAEE,QAAAA,KAAAA,EAAOG,SAASR,WAAAA,CAAYK;OAAM,CAAA;AAErF,MAAA,OAAOG,QAAAA,CAASR,WAAAA;AAClB,IAAA,CAAA,CAAA,OAASM,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,kCAAA,EAAoC;AAAEA,QAAAA;OAAM,CAAA;AACzD,MAAA,OAAO;QACLD,KAAAA,EAAO,KAAA;QACPC,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMI,OAAAA,GAAU;AAClD,OAAA;AACF,IAAA;AACF,EAAA;;;;AAKOC,EAAAA,WAAAA,CAAYV,KAAAA,EAAoC;AACrD,IAAA,MAAMW,OAAAA,GAAUC,SAASZ,KAAAA,CAAAA;AACzB,IAAA,IAAI,CAACW,OAAAA,EAAS;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AACA,IAAA,OAAOA,OAAAA;AACT,EAAA;;;;AAKA,EAAA,MAAavB,aAAaA,YAAAA,EAAmD;AAC3Ea,IAAAA,MAAAA,CAAOC,MAAM,yBAAA,CAAA;AAEb,IAAA,MAAMW,QAAAA,GAAW;;;;;;;;;AAUjB,IAAA,IAAI;AACF,MAAA,MAAMN,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MACjCO,QAAAA,EACA;AAAEzB,QAAAA;AAAa,OAAA,EACf,KAAKhB,OAAO,CAAA;AAGd6B,MAAAA,MAAAA,CAAOa,KAAK,qCAAA,CAAA;AAEZ,MAAA,OAAOP,QAAAA,CAASnB,YAAAA;AAClB,IAAA,CAAA,CAAA,OAASiB,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,6BAAA,EAA+B;AAAEA,QAAAA;OAAM,CAAA;AACpD,MAAA,MAAM,IAAIU,oBAAoB,yBAAA,EAA2B;QACvDV,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMI,OAAAA,GAAU;OAClD,CAAA;AACF,IAAA;AACF,EAAA;;;;EAKA,MAAaO,kBAAAA,CAAmBC,MAAAA,EAAgBC,UAAAA,EAAoBC,UAAAA,EAAuC;AACzGlB,IAAAA,MAAAA,CAAOC,MAAM,8BAAA,EAAgC;AAAEe,MAAAA,MAAAA;AAAQC,MAAAA,UAAAA;AAAYC,MAAAA;KAAW,CAAA;AAE9E,IAAA,MAAMb,KAAAA,GAAQ;;;;;;;AAQd,IAAA,IAAI;AACF,MAAA,MAAMC,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MAEhCA,KAAAA,EAAO;AAAEW,QAAAA,MAAAA;AAAQC,QAAAA,UAAAA;AAAYC,QAAAA;AAAW,OAAA,EAAG,KAAK/C,OAAO,CAAA;AAE1D6B,MAAAA,MAAAA,CAAOC,MAAM,qCAAA,EAAuC;AAClDkB,QAAAA,OAAAA,EAASb,SAASS,kBAAAA,CAAmBI;OACvC,CAAA;AAEA,MAAA,OAAOb,SAASS,kBAAAA,CAAmBI,OAAAA;AACrC,IAAA,CAAA,CAAA,OAASf,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,qCAAA,EAAuC;AAAEA,QAAAA;OAAM,CAAA;AAC5D,MAAA,OAAO,KAAA;AACT,IAAA;AACF,EAAA;;;;AAKOgB,EAAAA,YAAAA,CAAarB,KAAAA,EAAwB;AAC1C,IAAA,OAAO,CAACG,eAAeH,KAAAA,CAAAA;AACzB,EAAA;;;;AAKOsB,EAAAA,kBAAAA,CAAmBtB,KAAAA,EAA8B;AACtD,IAAA,MAAMW,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,OAAOW,SAASY,OAAAA,IAAW,IAAA;AAC7B,EAAA;;;;AAKOC,EAAAA,uBAAAA,CAAwBxB,KAAAA,EAA8B;AAC3D,IAAA,MAAMW,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,OAAOW,SAASc,YAAAA,IAAgB,IAAA;AAClC,EAAA;;;;AAKOC,EAAAA,cAAAA,CAAe1B,KAAAA,EAA+C;AACnE,IAAA,MAAMW,OAAAA,GAAUC,SAASZ,KAAAA,CAAAA;AACzB,IAAA,OAAOW,OAAAA;AACT,EAAA;;;;EAKOgB,cAAAA,CAAe3B,KAAAA,EAAe4B,gBAAwB,GAAA,EAAc;AACzE,IAAA,MAAMjB,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,IAAI,CAACW,OAAAA,IAAW,OAAOA,OAAAA,CAAQkB,QAAQ,QAAA,EAAU;AAC/C,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMC,MAAMC,IAAAA,CAAKC,KAAAA,CAAMC,IAAAA,CAAKH,GAAAA,KAAQ,GAAA,CAAA;AACpC,IAAA,OAAOnB,OAAAA,CAAQkB,MAAMC,GAAAA,GAAMF,aAAAA;AAC7B,EAAA;AACF","file":"chunk-KKCC3Z4I.js","sourcesContent":["/**\n * Auth Cookie Helper\n *\n * Utilities for setting secure, HttpOnly cookies for authentication.\n * Used by auth services to transition from localStorage to secure cookies.\n */\n\nimport type { GraphQLContext } from '../server/types.js';\n\nexport interface CookieOptions {\n  name: string;\n  value: string;\n  maxAge?: number;\n  domain?: string;\n  path?: string;\n  httpOnly?: boolean;\n  secure?: boolean;\n  sameSite?: 'Strict' | 'Lax' | 'None';\n}\n\nexport class AuthCookieHelper {\n  private static readonly ACCESS_TOKEN_COOKIE = 'bf_at';\n  private static readonly REFRESH_TOKEN_COOKIE = 'bf_rt';\n  private static readonly PROFILE_ID_COOKIE = 'bf_pid';\n\n  /**\n   * Set authentication cookies in the context response headers\n   */\n  public static setAuthCookies(\n    context: GraphQLContext,\n    tokens: { accessToken: string; refreshToken?: string },\n    options: { profileId?: string; rememberMe?: boolean } = {}\n  ): void {\n    const isProd = process.env['NODE_ENV'] === 'production';\n    const domain = process.env['COOKIE_DOMAIN'];\n\n    // Access token cookie (short-lived, 15m)\n    this.setCookie(context, {\n      name: this.ACCESS_TOKEN_COOKIE,\n      value: tokens.accessToken,\n      maxAge: 15 * 60,\n      httpOnly: true,\n      secure: isProd,\n      sameSite: 'Lax',\n      domain,\n      path: '/',\n    });\n\n    // Refresh token cookie (long-lived, 7d or 30d)\n    if (tokens.refreshToken) {\n      this.setCookie(context, {\n        name: this.REFRESH_TOKEN_COOKIE,\n        value: tokens.refreshToken,\n        maxAge: options.rememberMe ? 30 * 24 * 60 * 60 : 7 * 24 * 60 * 60,\n        httpOnly: true,\n        secure: isProd,\n        sameSite: 'Lax',\n        domain,\n        path: '/global/graphql', // Only send to global gateway for refresh\n      });\n    }\n\n    // Profile ID cookie (not HttpOnly, needed for UI profile resolution)\n    if (options.profileId) {\n      this.setCookie(context, {\n        name: this.PROFILE_ID_COOKIE,\n        value: options.profileId,\n        maxAge: 30 * 24 * 60 * 60,\n        httpOnly: false,\n        secure: isProd,\n        sameSite: 'Lax',\n        domain,\n        path: '/',\n      });\n    }\n  }\n\n  /**\n   * Clear authentication cookies\n   */\n  public static clearAuthCookies(context: GraphQLContext): void {\n    const domain = process.env['COOKIE_DOMAIN'];\n    const isProd = process.env['NODE_ENV'] === 'production';\n\n    const clearOptions = {\n      value: '',\n      maxAge: 0,\n      domain,\n      path: '/',\n      secure: isProd,\n      sameSite: 'Lax' as const,\n    };\n\n    this.setCookie(context, { ...clearOptions, name: this.ACCESS_TOKEN_COOKIE, httpOnly: true });\n    this.setCookie(context, {\n      ...clearOptions,\n      name: this.REFRESH_TOKEN_COOKIE,\n      httpOnly: true,\n      path: '/global/graphql',\n    });\n    this.setCookie(context, { ...clearOptions, name: this.PROFILE_ID_COOKIE, httpOnly: false });\n  }\n\n  /**\n   * Internal helper to set a cookie header\n   */\n  private static setCookie(context: GraphQLContext, options: CookieOptions): void {\n    let cookie = `${options.name}=${options.value}`;\n\n    if (options.maxAge !== undefined) {\n      cookie += `; Max-Age=${options.maxAge}`;\n    }\n\n    if (options.domain) {\n      cookie += `; Domain=${options.domain}`;\n    }\n\n    if (options.path) {\n      cookie += `; Path=${options.path}`;\n    }\n\n    if (options.httpOnly) {\n      cookie += '; HttpOnly';\n    }\n\n    if (options.secure) {\n      cookie += '; Secure';\n    }\n\n    if (options.sameSite) {\n      cookie += `; SameSite=${options.sameSite}`;\n    }\n\n    context.responseHeaders.append('Set-Cookie', cookie);\n  }\n}\n","/**\n * Authentication Module\n * JWT verification, token management, and user authentication\n */\n\nimport type { BurdenoffGraphQLClient } from '../client/graphql.js';\nimport type { SDKContext } from '../types/index.js';\nimport { AuthenticationError } from '../types/index.js';\nimport { logger } from '../logger/index.js';\nimport { parseJWT, isTokenExpired } from '../utils/index.js';\n\nexport { AuthCookieHelper } from './cookie-helper.js';\n\nexport interface TokenPayload {\n  jti: string;\n  sub: string;\n  user_id: string;\n  workspace_id?: string;\n  org_id?: string;\n  tenant_endpoint?: string;\n  iat: number;\n  exp: number;\n  scope?: string;\n}\n\nexport interface VerifyTokenResult {\n  valid: boolean;\n  payload?: TokenPayload;\n  error?: string;\n}\n\nexport interface RefreshTokenResult {\n  accessToken: string;\n  refreshToken: string;\n  expiresIn: number;\n}\n\nexport * from './cookie-helper.js';\n\n/**\n * Authentication Module\n */\nexport class AuthModule {\n  constructor(\n    private client: BurdenoffGraphQLClient,\n    private context: SDKContext\n  ) {}\n\n  /**\n   * Verify JWT token\n   */\n  public async verifyToken(token: string): Promise<VerifyTokenResult> {\n    logger.debug('[Auth] Verifying token');\n\n    // First check if token is expired locally\n    if (isTokenExpired(token)) {\n      return {\n        valid: false,\n        error: 'Token expired',\n      };\n    }\n\n    const query = `\n      query VerifyToken($token: String!) {\n        verifyToken(token: $token) {\n          valid\n          payload\n          error\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{ verifyToken: VerifyTokenResult }>(query, { token }, this.context);\n\n      logger.debug('[Auth] Token verification result', { valid: response.verifyToken.valid });\n\n      return response.verifyToken;\n    } catch (error) {\n      logger.error('[Auth] Token verification failed', { error });\n      return {\n        valid: false,\n        error: error instanceof Error ? error.message : 'Unknown error',\n      };\n    }\n  }\n\n  /**\n   * Decode token without verification\n   */\n  public decodeToken(token: string): TokenPayload | null {\n    const payload = parseJWT(token);\n    if (!payload) {\n      return null;\n    }\n    return payload as unknown as TokenPayload;\n  }\n\n  /**\n   * Refresh access token using refresh token\n   */\n  public async refreshToken(refreshToken: string): Promise<RefreshTokenResult> {\n    logger.debug('[Auth] Refreshing token');\n\n    const mutation = `\n      mutation RefreshToken($refreshToken: String!) {\n        refreshToken(refreshToken: $refreshToken) {\n          accessToken\n          refreshToken\n          expiresIn\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{ refreshToken: RefreshTokenResult }>(\n        mutation,\n        { refreshToken },\n        this.context\n      );\n\n      logger.info('[Auth] Token refreshed successfully');\n\n      return response.refreshToken;\n    } catch (error) {\n      logger.error('[Auth] Token refresh failed', { error });\n      throw new AuthenticationError('Failed to refresh token', {\n        error: error instanceof Error ? error.message : 'Unknown error',\n      });\n    }\n  }\n\n  /**\n   * Validate user has specific permission\n   */\n  public async validatePermission(userId: string, permission: string, resourceId?: string): Promise<boolean> {\n    logger.debug('[Auth] Validating permission', { userId, permission, resourceId });\n\n    const query = `\n      query ValidatePermission($userId: ID!, $permission: String!, $resourceId: ID) {\n        validatePermission(userId: $userId, permission: $permission, resourceId: $resourceId) {\n          allowed\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{\n        validatePermission: { allowed: boolean };\n      }>(query, { userId, permission, resourceId }, this.context);\n\n      logger.debug('[Auth] Permission validation result', {\n        allowed: response.validatePermission.allowed,\n      });\n\n      return response.validatePermission.allowed;\n    } catch (error) {\n      logger.error('[Auth] Permission validation failed', { error });\n      return false;\n    }\n  }\n\n  /**\n   * Check if token is valid and not expired\n   */\n  public isTokenValid(token: string): boolean {\n    return !isTokenExpired(token);\n  }\n\n  /**\n   * Get user ID from token\n   */\n  public getUserIdFromToken(token: string): string | null {\n    const payload = this.decodeToken(token);\n    return payload?.user_id || null;\n  }\n\n  /**\n   * Get workspace ID from token\n   */\n  public getWorkspaceIdFromToken(token: string): string | null {\n    const payload = this.decodeToken(token);\n    return payload?.workspace_id || null;\n  }\n\n  /**\n   * Extract all claims from token\n   */\n  public getTokenClaims(token: string): Record<string, unknown> | null {\n    const payload = parseJWT(token);\n    return payload;\n  }\n\n  /**\n   * Check if token will expire soon (within given seconds)\n   */\n  public willExpireSoon(token: string, withinSeconds: number = 300): boolean {\n    const payload = this.decodeToken(token);\n    if (!payload || typeof payload.exp !== 'number') {\n      return true;\n    }\n\n    const now = Math.floor(Date.now() / 1000);\n    return payload.exp - now < withinSeconds;\n  }\n}\n"]}

package/dist/i18n/index.d.ts

@@ -1,2 +1,3 @@
-export { F as FlatTranslationMap, d as I18n, c as I18nConfig, I as I18nContext, e as II18n, a as LanguageCode, f as LanguageInfo, L as LocaleCode, P as ParsedLocale, g as PluralForms, h as PluralTranslateFunction, R as RTL_LANGUAGES, i as TextDirection, j as TranslateFunction, b as TranslationDictionary, T as TranslationVariables, k as createI18n, l as getI18n, m as getTextDirection, n as initializeI18n } from '../i18n-DA6IPnYy.js';
-export { D as DEFAULT_I18N_CONFIG, I as I18nCapableContext, L as Locales, T as Translator, b as clearTranslationCache, c as createTranslator, d as discoverLocales, e as extractLocaleFromRequest, f as findBestMatch, j as flattenDictionary, k as getCachedTranslations, g as getLanguage, l as getLanguageFromLocale, a as getLocale, m as getRegionFromLocale, h as hasI18n, n as loadTranslationFile, o as loadTranslationsForLocale, p as normalizeLocale, q as parseAcceptLanguage, r as parseLocaleString, s as preloadAllTranslations, u as setCachedTranslations, t } from '../index-BV3G48cH.js';
+export { I as I18n, c as createI18n, g as getI18n, i as initializeI18n } from '../i18n-DrdPTann.js';
+export { D as DEFAULT_I18N_CONFIG, I as I18nCapableContext, L as Locales, T as Translator, b as clearTranslationCache, c as createTranslator, d as discoverLocales, e as extractLocaleFromRequest, f as findBestMatch, j as flattenDictionary, k as getCachedTranslations, g as getLanguage, l as getLanguageFromLocale, a as getLocale, m as getRegionFromLocale, h as hasI18n, n as loadTranslationFile, o as loadTranslationsForLocale, p as normalizeLocale, q as parseAcceptLanguage, r as parseLocaleString, s as preloadAllTranslations, u as setCachedTranslations, t } from '../index-D4l1u8VR.js';
+export { F as FlatTranslationMap, b as I18nConfig, I as I18nContext, a as II18n, c as LanguageCode, g as LanguageInfo, L as LocaleCode, e as ParsedLocale, h as PluralForms, P as PluralTranslateFunction, R as RTL_LANGUAGES, i as TextDirection, T as TranslateFunction, f as TranslationDictionary, d as TranslationVariables, j as getTextDirection } from '../types-C8TbSdEj.js';

package/dist/i18n-DrdPTann.d.ts

@@ -0,0 +1,33 @@
+import { a as II18n, b as I18nConfig, L as LocaleCode, F as FlatTranslationMap, T as TranslateFunction, P as PluralTranslateFunction, I as I18nContext, c as LanguageCode } from './types-C8TbSdEj.js';
+
+declare class I18n implements II18n {
+    private config;
+    private currentLocale;
+    private supportedLocales;
+    private initialized;
+    constructor(config: I18nConfig);
+    initialize(): Promise<void>;
+    getLocale(): LocaleCode;
+    setLocale(locale: LocaleCode): void;
+    getSupportedLocales(): LocaleCode[];
+    isSupported(locale: LocaleCode): boolean;
+    loadLocale(locale: LocaleCode): Promise<void>;
+    getTranslations(locale: LocaleCode): FlatTranslationMap | undefined;
+    t: TranslateFunction;
+    tp: PluralTranslateFunction;
+    private translate;
+    private translatePlural;
+    createContext(locale: LocaleCode): I18nContext;
+    createContextFromRequest(request: Request): I18nContext;
+    getLanguageInfo(locale: LocaleCode): {
+        code: LanguageCode;
+        direction: 'ltr' | 'rtl';
+        locale: LocaleCode;
+        region?: string;
+    };
+}
+declare function initializeI18n(config: I18nConfig): Promise<I18n>;
+declare function getI18n(): I18n | null;
+declare function createI18n(config: I18nConfig): I18n;
+
+export { I18n as I, createI18n as c, getI18n as g, initializeI18n as i };

package/dist/{index-BV3G48cH.d.ts → index-D4l1u8VR.d.ts}

@@ -1,4 +1,5 @@
-import { I as I18nContext, T as TranslationVariables, L as LocaleCode, P as ParsedLocale, a as LanguageCode, b as TranslationDictionary, F as FlatTranslationMap, c as I18nConfig, d as I18n, e as II18n, f as LanguageInfo, g as PluralForms, h as PluralTranslateFunction, R as RTL_LANGUAGES, i as TextDirection, j as TranslateFunction, k as createI18n, l as getI18n, m as getTextDirection, n as initializeI18n } from './i18n-DA6IPnYy.js';
+import { I as I18n, c as createI18n, g as getI18n, i as initializeI18n } from './i18n-DrdPTann.js';
+import { I as I18nContext, d as TranslationVariables, L as LocaleCode, e as ParsedLocale, c as LanguageCode, f as TranslationDictionary, F as FlatTranslationMap, b as I18nConfig, a as II18n, g as LanguageInfo, h as PluralForms, P as PluralTranslateFunction, R as RTL_LANGUAGES, i as TextDirection, T as TranslateFunction, j as getTextDirection } from './types-C8TbSdEj.js';
 
 interface I18nCapableContext {
     i18n?: I18nContext;

package/dist/index.d.ts

@@ -24,7 +24,7 @@ export { i as Observability } from './index-4gKQKZ2B.js';
 export { i as GraphQL } from './index-joONjwLt.js';
 export { i as Prisma } from './index-Dtf6FBaD.js';
 export { i as Utils } from './index-PaojfSdd.js';
-export { i as I18n, I as I18nCapableContext, T as Translator, c as createTranslator, g as getLanguage, a as getLocale, h as hasI18n, t } from './index-BV3G48cH.js';
+export { i as I18n, I as I18nCapableContext, T as Translator, c as createTranslator, g as getLanguage, a as getLocale, h as hasI18n, t } from './index-D4l1u8VR.js';
 export { i as Export } from './index-Dg4kH1VJ.js';
 export { i as Init } from './index-BqSh1K8I.js';
 export { i as DataLoader } from './index-DW9q22GH.js';
@@ -36,23 +36,25 @@ export { i as FeatureFlags } from './index-jOuh_TKn.js';
 export { i as Captcha, R as RecaptchaVerifyOptions, a as RecaptchaVerifyResult, b as isCaptchaEnabled, v as verifyCaptcha, c as verifyCaptchaIfEnabled } from './index-B70b5mYS.js';
 export { i as Platform } from './index-BQ1yJn1K.js';
 export { C as CircuitBreakerConfig, h as DEFAULT_CIRCUIT_BREAKER_CONFIG, i as DEFAULT_GATEWAY_RETRY_CONFIG, D as DEFAULT_GATEWAY_ROUTING, b as DEFAULT_LAYER_RESOURCES, c as DEFAULT_LAYER_STREAMS, f as GatewayRequestHeaders, g as GatewayRetryConfig, G as GatewayRoutingConfig, L as LayerConfig, a as LayerFullConfig, d as LayerGatewayConfig, e as LayerResourceUrls, S as ServiceLayer } from './layer-CUu_cZ7d.js';
+import './types-sKXodL2N.js';
+import 'graphql';
+import 'graphql-yoga';
+import './client-CSjIrYKS.js';
+import '@prisma/adapter-pg';
+import 'pg';
+import './types-C8TbSdEj.js';
 import 'graphql-request';
 import '@envelop/core';
 import '@clickhouse/client';
 import './graph-emitter-r5TylDBm.js';
-import './client-CSjIrYKS.js';
-import '@prisma/adapter-pg';
-import 'pg';
 import './prisma-extension-krXnYnrN.js';
 import '@temporalio/client';
 import '@temporalio/common';
-import 'graphql';
 import 'elysia';
 import './types-Bo2wkjSP.js';
 import './graphql/services/index.js';
-import './i18n-DA6IPnYy.js';
+import './i18n-DrdPTann.js';
 import './index-UhkH2eaB.js';
-import 'graphql-yoga';
 
 declare class ContextManager {
     static getContext(): SDKContext | undefined;

package/dist/index.js

@@ -11,8 +11,8 @@ import './chunk-REF7PANB.js';
 export { middleware_exports as Middleware } from './chunk-2HANKZZM.js';
 import { TenantNotificationsModule, NotificationsModule } from './chunk-RMDKB5O7.js';
 export { tenant_notifications_exports as Notifications, NotificationsModule } from './chunk-RMDKB5O7.js';
-export { platform_exports as Platform } from './chunk-PHKK7725.js';
 export { observability_exports as Observability } from './chunk-5LXDPGDH.js';
+export { platform_exports as Platform } from './chunk-PHKK7725.js';
 export { export_exports as Export } from './chunk-SVONGBQR.js';
 export { feature_flags_exports as FeatureFlags } from './chunk-VWCN5PMD.js';
 import { GraphModule } from './chunk-TGTJ653K.js';
@@ -30,8 +30,8 @@ export { init_exports as Init } from './chunk-2BG75H2K.js';
 export { gateway_exports as Gateway } from './chunk-DMPS4Y53.js';
 import './chunk-LD7ETTWG.js';
 export { layer_exports as Layer } from './chunk-GSEPF2B6.js';
-import { AuthModule } from './chunk-7NUQXGA7.js';
-export { AuthModule } from './chunk-7NUQXGA7.js';
+import { AuthModule } from './chunk-KKCC3Z4I.js';
+export { AuthModule } from './chunk-KKCC3Z4I.js';
 export { utils_exports as Utils } from './chunk-B7I4TABG.js';
 export { cache_exports as Cache } from './chunk-PDSV3TFO.js';
 export { captcha_exports as Captcha, isCaptchaEnabled, verifyCaptcha, verifyCaptchaIfEnabled } from './chunk-YMZEUTD2.js';

package/dist/server/index.d.ts

@@ -1,233 +1,15 @@
-import { GraphQLSchema, GraphQLError } from 'graphql';
-import { PubSub } from 'graphql-yoga';
-import { P as PrismaClientBase, a as PrismaClientConstructorOptions } from '../client-CSjIrYKS.js';
-import { I as I18nContext, L as LocaleCode, d as I18n } from '../i18n-DA6IPnYy.js';
+import { W as WorkspaceSecret, I as IActor, J as JWTPayload, S as ServerDefinition, a as ServerInstance, b as ITenant, G as GraphQLContext, Y as YogaPlugin } from '../types-sKXodL2N.js';
+export { C as ConsentContext, E as ElysiaApp, c as IContextFilterInput, d as IOperationContext, e as IOrganization, f as IProduct, g as IProject, h as ITracking, i as IWorkspace, M as ModuleGraphConfig, P as PrismaClientConstructor, R as RESTEndpoint, j as ServerConfig, k as ServerI18nConfig, l as ServerInfo, m as WspaceGraphQLContext } from '../types-sKXodL2N.js';
 import * as jose from 'jose';
 import { VerifyOptions } from 'jsonwebtoken';
+import { I as I18n } from '../i18n-DrdPTann.js';
+import { GraphQLError } from 'graphql';
+export { I as I18nContext, L as LocaleCode } from '../types-C8TbSdEj.js';
+export { P as PrismaClientBase } from '../client-CSjIrYKS.js';
+import 'graphql-yoga';
 import '@prisma/adapter-pg';
 import 'pg';
 
-interface IActor {
-    id: string;
-    type: string;
-    workspace_id?: string;
-    tenant_id?: string;
-    org_id?: string;
-    isAdmin?: boolean;
-}
-interface ITenant {
-    id: string;
-    endpoint: string;
-}
-interface IOrganization {
-    id: string;
-}
-interface IWorkspace {
-    id: string;
-}
-interface IProject {
-    id: string;
-}
-interface IProduct {
-    id: string;
-}
-interface ITracking {
-    ip?: string;
-    userAgent?: string;
-}
-interface ConsentContext {
-    grantedBy: string;
-    scopes?: string[];
-    grantedAt?: Date;
-    expiresAt?: Date;
-}
-interface GraphQLContext {
-    request: Request;
-    actor: IActor | null;
-    tenant: ITenant | null;
-    organization: IOrganization | null;
-    workspace: IWorkspace | null;
-    project: IProject | null;
-    product: IProduct | null;
-    tracking: ITracking;
-    consentContext?: ConsentContext;
-    onBehalfOf: string;
-    db: unknown;
-    pubsub?: PubSub<Record<string, [unknown]>>;
-    i18n?: I18nContext;
-    responseHeaders: Headers;
-}
-interface WspaceGraphQLContext extends Omit<GraphQLContext, 'workspace' | 'actor'> {
-    actor: IActor;
-    workspace: IWorkspace;
-}
-
-interface IOperationContext {
-    workspaceId?: string | null;
-    actorId?: string | null;
-    projectId?: string | null;
-    appId?: string | null;
-    custom?: Record<string, unknown> | null;
-}
-interface IContextFilterInput {
-    workspaceId?: string | null;
-    actorId?: string | null;
-    projectId?: string | null;
-    appId?: string | null;
-}
-interface ServerI18nConfig {
-    enabled?: boolean;
-    defaultLocale?: LocaleCode;
-    fallbackLocale?: LocaleCode;
-    localesPath?: string;
-    supportedLocales?: LocaleCode[];
-    namespace?: string;
-    lazyLoad?: boolean;
-    logMissing?: boolean;
-}
-interface ServerConfig {
-    serviceName: string;
-    serviceVersion?: string;
-    port: number;
-    host?: string;
-    environment?: 'development' | 'staging' | 'production';
-    boundary?: 'wspace' | 'global';
-    graphqlEndpoint?: string;
-    corsOrigins?: string | string[];
-    sessionSecret?: string;
-    enablePlayground?: boolean;
-    enableIntrospection?: boolean;
-    csrfSkipRoutes?: string[];
-    loginEndpoints?: string[];
-    enableCSRF?: boolean;
-    enableSessionSecurity?: boolean;
-    i18n?: ServerI18nConfig;
-    workspaceGuard?: {
-        enabled?: boolean;
-        whitelistedOperations?: string[];
-    };
-}
-interface ModuleGraphConfig {
-    getSchema: () => unknown;
-    exportAll: (orgId?: string, workspaceId?: string) => Promise<unknown>;
-    exportEntities: (orgId?: string, workspaceId?: string, types?: string[]) => Promise<unknown>;
-    exportRelationships: (orgId?: string, workspaceId?: string) => Promise<unknown>;
-    initialize: () => Promise<void>;
-    shutdown: () => Promise<void>;
-}
-interface RESTEndpoint {
-    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
-    path: string;
-    handler: (request: Request, context: GraphQLContext, rawBody?: string) => Promise<unknown>;
-    rawBody?: boolean;
-}
-type PrismaClientConstructor<T extends PrismaClientBase = PrismaClientBase> = new (options: PrismaClientConstructorOptions) => T;
-interface YogaPlugin {
-    onExecute?: (args: {
-        args: {
-            document?: unknown;
-            operationName?: string | null;
-            variableValues?: Record<string, unknown>;
-            contextValue?: unknown;
-        };
-    }) => {
-        onExecuteDone: (args: {
-            result: unknown;
-        }) => void;
-    } | undefined | void;
-    onSubscribe?: (args: {
-        args: unknown;
-    }) => void;
-    [key: string]: unknown;
-}
-interface ServerDefinition {
-    config: ServerConfig;
-    prismaClient: PrismaClientConstructor;
-    schema: GraphQLSchema;
-    moduleGraph?: ModuleGraphConfig;
-    restEndpoints?: RESTEndpoint[];
-    yogaPlugins?: YogaPlugin[];
-    buildContext?: (defaultContext: GraphQLContext) => Promise<GraphQLContext> | GraphQLContext;
-    workspaceExtensionConfig?: {
-        strictMode?: boolean;
-        excludeModels?: string[];
-        excludeModelsFromReadIsolation?: string[];
-        allowedUnguardedOperations?: string[];
-        enableReadIsolation?: boolean;
-        enableDeleteIsolation?: boolean;
-        enableUpdateWhereIsolation?: boolean;
-        debug?: boolean;
-    };
-    disableWorkspaceExtension?: boolean;
-    onShutdown?: () => Promise<void>;
-}
-interface BunServerHandle {
-    stop(): void;
-    port: number;
-    hostname: string;
-}
-interface ElysiaLikeServer {
-    server: BunServerHandle | null;
-    listen(options: {
-        port: number;
-        hostname?: string;
-    }): ElysiaLikeServer;
-    use(plugin: unknown): ElysiaLikeServer;
-    all(path: string, handler: (ctx: {
-        request: Request;
-    }) => unknown): ElysiaLikeServer;
-    get(path: string, handler: (ctx: {
-        request: Request;
-        query: Record<string, string | undefined>;
-    }) => unknown): ElysiaLikeServer;
-    post(path: string, handler: (ctx: {
-        request: Request;
-    }) => unknown): ElysiaLikeServer;
-    put(path: string, handler: (ctx: {
-        request: Request;
-    }) => unknown): ElysiaLikeServer;
-    patch(path: string, handler: (ctx: {
-        request: Request;
-    }) => unknown): ElysiaLikeServer;
-    delete(path: string, handler: (ctx: {
-        request: Request;
-    }) => unknown): ElysiaLikeServer;
-}
-type ElysiaApp = ElysiaLikeServer;
-interface ServerInstance {
-    app: ElysiaApp;
-    server: BunServerHandle | null;
-    start: () => Promise<void>;
-    stop: () => Promise<void>;
-    getInfo: () => ServerInfo;
-}
-interface ServerInfo {
-    serviceName: string;
-    serviceVersion: string;
-    environment: string;
-    port: number;
-    host: string;
-    graphqlEndpoint: string;
-    startedAt: string;
-    uptime: number;
-}
-interface JWTPayload {
-    sub: string;
-    actor_type?: string;
-    workspace_id?: string;
-    org_id?: string;
-    tenant_id?: string;
-    iat?: number;
-    exp?: number;
-    [key: string]: unknown;
-}
-interface WorkspaceSecret {
-    kty: string;
-    k: string;
-    alg?: string;
-    [key: string]: unknown;
-}
-
 type FetchWorkspaceSecretFn = (workspaceId: string) => Promise<WorkspaceSecret | null>;
 interface AuthConfig {
     fetchWorkspaceSecret: FetchWorkspaceSecretFn;
@@ -399,4 +181,4 @@ declare function createHumanReadableErrorPlugin(options?: ErrorNormalizationOpti
 declare function formatHttpError(error: unknown, options?: ErrorNormalizationOptions): HttpErrorResult;
 declare function createHttpErrorResponse(error: unknown, options?: ErrorNormalizationOptions): Response;
 
-export { type AuthConfig, type ConsentContext, type ContextBuilderOptions, type ElysiaApp, type ErrorNormalizationOptions, type FetchWorkspaceSecretFn, type GraphQLContext, type HttpErrorPayload, type HttpErrorResult, I18nContext, type IActor, type IContextFilterInput, type IOperationContext, type IOrganization, type IProduct, type IProject, type ITenant, type ITracking, type IWorkspace, type JWTPayload, LocaleCode, type ModuleGraphConfig, type NormalizedErrorState, PrismaClientBase, type PrismaClientConstructor, type RESTEndpoint, type ServerConfig, type ServerDefinition, type ServerI18nConfig, type ServerInfo, type ServerInstance, type UserFacingErrorOptions, UserFacingGraphQLError, type WorkspaceGuardConfig, type WorkspaceSecret, type WspaceGraphQLContext, type YogaPlugin, authCheck, buildContext, configureAuth, configureContext, configureDefaultAuth, configureServerAuth, createHttpErrorResponse, createHumanReadableErrorPlugin, createServer, createWorkspaceGuardPlugin, decodeJWT, fetchWorkspaceSecret, formatHttpError, generateSymmetricSecret, getContextOptions, normalizeError, normalizeExecutionResultErrors, normalizeGraphQLResponse, normalizeGraphQLResponsePayload, orgCheck, requireWorkspace, tenantCheck, toUserFacingGraphQLError, verifyJWT, workspaceCheck };
+export { type AuthConfig, type ContextBuilderOptions, type ErrorNormalizationOptions, type FetchWorkspaceSecretFn, GraphQLContext, type HttpErrorPayload, type HttpErrorResult, IActor, ITenant, JWTPayload, type NormalizedErrorState, ServerDefinition, ServerInstance, type UserFacingErrorOptions, UserFacingGraphQLError, type WorkspaceGuardConfig, WorkspaceSecret, YogaPlugin, authCheck, buildContext, configureAuth, configureContext, configureDefaultAuth, configureServerAuth, createHttpErrorResponse, createHumanReadableErrorPlugin, createServer, createWorkspaceGuardPlugin, decodeJWT, fetchWorkspaceSecret, formatHttpError, generateSymmetricSecret, getContextOptions, normalizeError, normalizeExecutionResultErrors, normalizeGraphQLResponse, normalizeGraphQLResponsePayload, orgCheck, requireWorkspace, tenantCheck, toUserFacingGraphQLError, verifyJWT, workspaceCheck };

package/dist/{i18n-DA6IPnYy.d.ts → types-C8TbSdEj.d.ts}

@@ -68,34 +68,4 @@ interface LanguageInfo {
 declare const RTL_LANGUAGES: LanguageCode[];
 declare function getTextDirection(language: LanguageCode): TextDirection;
 
-declare class I18n implements II18n {
-    private config;
-    private currentLocale;
-    private supportedLocales;
-    private initialized;
-    constructor(config: I18nConfig);
-    initialize(): Promise<void>;
-    getLocale(): LocaleCode;
-    setLocale(locale: LocaleCode): void;
-    getSupportedLocales(): LocaleCode[];
-    isSupported(locale: LocaleCode): boolean;
-    loadLocale(locale: LocaleCode): Promise<void>;
-    getTranslations(locale: LocaleCode): FlatTranslationMap | undefined;
-    t: TranslateFunction;
-    tp: PluralTranslateFunction;
-    private translate;
-    private translatePlural;
-    createContext(locale: LocaleCode): I18nContext;
-    createContextFromRequest(request: Request): I18nContext;
-    getLanguageInfo(locale: LocaleCode): {
-        code: LanguageCode;
-        direction: 'ltr' | 'rtl';
-        locale: LocaleCode;
-        region?: string;
-    };
-}
-declare function initializeI18n(config: I18nConfig): Promise<I18n>;
-declare function getI18n(): I18n | null;
-declare function createI18n(config: I18nConfig): I18n;
-
-export { type FlatTranslationMap as F, type I18nContext as I, type LocaleCode as L, type ParsedLocale as P, RTL_LANGUAGES as R, type TranslationVariables as T, type LanguageCode as a, type TranslationDictionary as b, type I18nConfig as c, I18n as d, type II18n as e, type LanguageInfo as f, type PluralForms as g, type PluralTranslateFunction as h, type TextDirection as i, type TranslateFunction as j, createI18n as k, getI18n as l, getTextDirection as m, initializeI18n as n };
+export { type FlatTranslationMap as F, type I18nContext as I, type LocaleCode as L, type PluralTranslateFunction as P, RTL_LANGUAGES as R, type TranslateFunction as T, type II18n as a, type I18nConfig as b, type LanguageCode as c, type TranslationVariables as d, type ParsedLocale as e, type TranslationDictionary as f, type LanguageInfo as g, type PluralForms as h, type TextDirection as i, getTextDirection as j };

package/dist/types-sKXodL2N.d.ts

@@ -0,0 +1,227 @@
+import { GraphQLSchema } from 'graphql';
+import { PubSub } from 'graphql-yoga';
+import { P as PrismaClientBase, a as PrismaClientConstructorOptions } from './client-CSjIrYKS.js';
+import { I as I18nContext, L as LocaleCode } from './types-C8TbSdEj.js';
+
+interface IActor {
+    id: string;
+    type: string;
+    workspace_id?: string;
+    tenant_id?: string;
+    org_id?: string;
+    isAdmin?: boolean;
+}
+interface ITenant {
+    id: string;
+    endpoint: string;
+}
+interface IOrganization {
+    id: string;
+}
+interface IWorkspace {
+    id: string;
+}
+interface IProject {
+    id: string;
+}
+interface IProduct {
+    id: string;
+}
+interface ITracking {
+    ip?: string;
+    userAgent?: string;
+}
+interface ConsentContext {
+    grantedBy: string;
+    scopes?: string[];
+    grantedAt?: Date;
+    expiresAt?: Date;
+}
+interface GraphQLContext {
+    request: Request;
+    actor: IActor | null;
+    tenant: ITenant | null;
+    organization: IOrganization | null;
+    workspace: IWorkspace | null;
+    project: IProject | null;
+    product: IProduct | null;
+    tracking: ITracking;
+    consentContext?: ConsentContext;
+    onBehalfOf: string;
+    db: unknown;
+    pubsub?: PubSub<Record<string, [unknown]>>;
+    i18n?: I18nContext;
+    responseHeaders: Headers;
+}
+interface WspaceGraphQLContext extends Omit<GraphQLContext, 'workspace' | 'actor'> {
+    actor: IActor;
+    workspace: IWorkspace;
+}
+
+interface IOperationContext {
+    workspaceId?: string | null;
+    actorId?: string | null;
+    projectId?: string | null;
+    appId?: string | null;
+    custom?: Record<string, unknown> | null;
+}
+interface IContextFilterInput {
+    workspaceId?: string | null;
+    actorId?: string | null;
+    projectId?: string | null;
+    appId?: string | null;
+}
+interface ServerI18nConfig {
+    enabled?: boolean;
+    defaultLocale?: LocaleCode;
+    fallbackLocale?: LocaleCode;
+    localesPath?: string;
+    supportedLocales?: LocaleCode[];
+    namespace?: string;
+    lazyLoad?: boolean;
+    logMissing?: boolean;
+}
+interface ServerConfig {
+    serviceName: string;
+    serviceVersion?: string;
+    port: number;
+    host?: string;
+    environment?: 'development' | 'staging' | 'production';
+    boundary?: 'wspace' | 'global';
+    graphqlEndpoint?: string;
+    corsOrigins?: string | string[];
+    sessionSecret?: string;
+    enablePlayground?: boolean;
+    enableIntrospection?: boolean;
+    csrfSkipRoutes?: string[];
+    loginEndpoints?: string[];
+    enableCSRF?: boolean;
+    enableSessionSecurity?: boolean;
+    i18n?: ServerI18nConfig;
+    workspaceGuard?: {
+        enabled?: boolean;
+        whitelistedOperations?: string[];
+    };
+}
+interface ModuleGraphConfig {
+    getSchema: () => unknown;
+    exportAll: (orgId?: string, workspaceId?: string) => Promise<unknown>;
+    exportEntities: (orgId?: string, workspaceId?: string, types?: string[]) => Promise<unknown>;
+    exportRelationships: (orgId?: string, workspaceId?: string) => Promise<unknown>;
+    initialize: () => Promise<void>;
+    shutdown: () => Promise<void>;
+}
+interface RESTEndpoint {
+    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+    path: string;
+    handler: (request: Request, context: GraphQLContext, rawBody?: string) => Promise<unknown>;
+    rawBody?: boolean;
+}
+type PrismaClientConstructor<T extends PrismaClientBase = PrismaClientBase> = new (options: PrismaClientConstructorOptions) => T;
+interface YogaPlugin {
+    onExecute?: (args: {
+        args: {
+            document?: unknown;
+            operationName?: string | null;
+            variableValues?: Record<string, unknown>;
+            contextValue?: unknown;
+        };
+    }) => {
+        onExecuteDone: (args: {
+            result: unknown;
+        }) => void;
+    } | undefined | void;
+    onSubscribe?: (args: {
+        args: unknown;
+    }) => void;
+    [key: string]: unknown;
+}
+interface ServerDefinition {
+    config: ServerConfig;
+    prismaClient: PrismaClientConstructor;
+    schema: GraphQLSchema;
+    moduleGraph?: ModuleGraphConfig;
+    restEndpoints?: RESTEndpoint[];
+    yogaPlugins?: YogaPlugin[];
+    buildContext?: (defaultContext: GraphQLContext) => Promise<GraphQLContext> | GraphQLContext;
+    workspaceExtensionConfig?: {
+        strictMode?: boolean;
+        excludeModels?: string[];
+        excludeModelsFromReadIsolation?: string[];
+        allowedUnguardedOperations?: string[];
+        enableReadIsolation?: boolean;
+        enableDeleteIsolation?: boolean;
+        enableUpdateWhereIsolation?: boolean;
+        debug?: boolean;
+    };
+    disableWorkspaceExtension?: boolean;
+    onShutdown?: () => Promise<void>;
+}
+interface BunServerHandle {
+    stop(): void;
+    port: number;
+    hostname: string;
+}
+interface ElysiaLikeServer {
+    server: BunServerHandle | null;
+    listen(options: {
+        port: number;
+        hostname?: string;
+    }): ElysiaLikeServer;
+    use(plugin: unknown): ElysiaLikeServer;
+    all(path: string, handler: (ctx: {
+        request: Request;
+    }) => unknown): ElysiaLikeServer;
+    get(path: string, handler: (ctx: {
+        request: Request;
+        query: Record<string, string | undefined>;
+    }) => unknown): ElysiaLikeServer;
+    post(path: string, handler: (ctx: {
+        request: Request;
+    }) => unknown): ElysiaLikeServer;
+    put(path: string, handler: (ctx: {
+        request: Request;
+    }) => unknown): ElysiaLikeServer;
+    patch(path: string, handler: (ctx: {
+        request: Request;
+    }) => unknown): ElysiaLikeServer;
+    delete(path: string, handler: (ctx: {
+        request: Request;
+    }) => unknown): ElysiaLikeServer;
+}
+type ElysiaApp = ElysiaLikeServer;
+interface ServerInstance {
+    app: ElysiaApp;
+    server: BunServerHandle | null;
+    start: () => Promise<void>;
+    stop: () => Promise<void>;
+    getInfo: () => ServerInfo;
+}
+interface ServerInfo {
+    serviceName: string;
+    serviceVersion: string;
+    environment: string;
+    port: number;
+    host: string;
+    graphqlEndpoint: string;
+    startedAt: string;
+    uptime: number;
+}
+interface JWTPayload {
+    sub: string;
+    actor_type?: string;
+    workspace_id?: string;
+    org_id?: string;
+    tenant_id?: string;
+    iat?: number;
+    exp?: number;
+    [key: string]: unknown;
+}
+interface WorkspaceSecret {
+    kty: string;
+    k: string;
+    alg?: string;
+    [key: string]: unknown;
+}
+
+export type { ConsentContext as C, ElysiaApp as E, GraphQLContext as G, IActor as I, JWTPayload as J, ModuleGraphConfig as M, PrismaClientConstructor as P, RESTEndpoint as R, ServerDefinition as S, WorkspaceSecret as W, YogaPlugin as Y, ServerInstance as a, ITenant as b, IContextFilterInput as c, IOperationContext as d, IOrganization as e, IProduct as f, IProject as g, ITracking as h, IWorkspace as i, ServerConfig as j, ServerI18nConfig as k, ServerInfo as l, WspaceGraphQLContext as m };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/be-sdk",
-  "version": "2026.529.2",
+  "version": "2026.530.1",
   "description": "Backend SDK for Burdenoff products providing unified access to notifications, RBAC, activity tracking, usage monitoring, and more",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/dist/chunk-7NUQXGA7.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/auth/index.ts"],"names":["ACCESS_TOKEN_COOKIE","REFRESH_TOKEN_COOKIE","ACCESS_TOKEN_MAX_AGE","REFRESH_TOKEN_MAX_AGE","REFRESH_TOKEN_REMEMBER_MAX_AGE","buildCookieString","name","value","maxAge","buildClearCookieString","AuthCookieHelper","setAuthCookies","context","tokens","options","headers","responseHeaders","rememberMe","refreshMaxAge","append","accessToken","refreshToken","clearAuthCookies","AuthModule","client","verifyToken","token","logger","debug","isTokenExpired","valid","error","query","response","Error","message","decodeToken","payload","parseJWT","mutation","info","AuthenticationError","validatePermission","userId","permission","resourceId","allowed","isTokenValid","getUserIdFromToken","user_id","getWorkspaceIdFromToken","workspace_id","getTokenClaims","willExpireSoon","withinSeconds","exp","now","Math","floor","Date"],"mappings":";;;;;;AAgBA,IAAMA,mBAAAA,GAAsB,iBAAA;AAC5B,IAAMC,oBAAAA,GAAuB,kBAAA;AAC7B,IAAMC,uBAAuB,EAAA,GAAK,EAAA;AAClC,IAAMC,qBAAAA,GAAwB,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAC7C,IAAMC,8BAAAA,GAAiC,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAEtD,SAASC,iBAAAA,CAAkBC,IAAAA,EAAcC,KAAAA,EAAeC,MAAAA,EAAc;AACpE,EAAA,OAAO,CAAA,EAAGF,IAAAA,CAAAA,CAAAA,EAAQC,KAAAA,aAAkBC,MAAAA,CAAAA,mCAAAA,CAAAA;AACtC;AAFSH,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAIT,SAASI,uBAAuBH,IAAAA,EAAY;AAC1C,EAAA,OAAO,GAAGA,IAAAA,CAAAA,+CAAAA,CAAAA;AACZ;AAFSG,MAAAA,CAAAA,sBAAAA,EAAAA,wBAAAA,CAAAA;AAIF,IAAMC,gBAAAA,GAAmB;EAC9BC,cAAAA,CACEC,OAAAA,EACAC,QACAC,OAAAA,EAAkC;AAElC,IAAA,MAAMC,UAAUH,OAAAA,CAAQI,eAAAA;AACxB,IAAA,IAAI,CAACD,OAAAA,EAAS;AAEd,IAAA,MAAME,UAAAA,GAAaH,SAASG,UAAAA,IAAc,KAAA;AAC1C,IAAA,MAAMC,aAAAA,GAAgBD,aAAab,8BAAAA,GAAiCD,qBAAAA;AAEpEY,IAAAA,OAAAA,CAAQI,OAAO,YAAA,EAAcd,iBAAAA,CAAkBL,qBAAqBa,MAAAA,CAAOO,WAAAA,EAAalB,oBAAAA,CAAAA,CAAAA;AACxFa,IAAAA,OAAAA,CAAQI,OAAO,YAAA,EAAcd,iBAAAA,CAAkBJ,sBAAsBY,MAAAA,CAAOQ,YAAAA,EAAcH,aAAAA,CAAAA,CAAAA;AAC5F,EAAA,CAAA;AAEAI,EAAAA,gBAAAA,CAAiBV,OAAAA,EAAsB;AACrC,IAAA,MAAMG,UAAUH,OAAAA,CAAQI,eAAAA;AACxB,IAAA,IAAI,CAACD,OAAAA,EAAS;AAEdA,IAAAA,OAAAA,CAAQI,MAAAA,CAAO,YAAA,EAAcV,sBAAAA,CAAuBT,mBAAAA,CAAAA,CAAAA;AACpDe,IAAAA,OAAAA,CAAQI,MAAAA,CAAO,YAAA,EAAcV,sBAAAA,CAAuBR,oBAAAA,CAAAA,CAAAA;AACtD,EAAA;AACF;AA+BO,IAAMsB,aAAN,MAAMA;EApFb;;;;;AAqFE,EAAA,WAAA,CACUC,QACAZ,OAAAA,EACR;SAFQY,MAAAA,GAAAA,MAAAA;SACAZ,OAAAA,GAAAA,OAAAA;AACP,EAAA;;;;AAKH,EAAA,MAAaa,YAAYC,KAAAA,EAA2C;AAClEC,IAAAA,MAAAA,CAAOC,MAAM,wBAAA,CAAA;AAGb,IAAA,IAAIC,cAAAA,CAAeH,KAAAA,CAAAA,EAAQ;AACzB,MAAA,OAAO;QACLI,KAAAA,EAAO,KAAA;QACPC,KAAAA,EAAO;AACT,OAAA;AACF,IAAA;AAEA,IAAA,MAAMC,KAAAA,GAAQ;;;;;;;;;AAUd,IAAA,IAAI;AACF,MAAA,MAAMC,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MAA0CA,KAAAA,EAAO;AAAEN,QAAAA;AAAM,OAAA,EAAG,KAAKd,OAAO,CAAA;AAE3Ge,MAAAA,MAAAA,CAAOC,MAAM,kCAAA,EAAoC;AAAEE,QAAAA,KAAAA,EAAOG,SAASR,WAAAA,CAAYK;OAAM,CAAA;AAErF,MAAA,OAAOG,QAAAA,CAASR,WAAAA;AAClB,IAAA,CAAA,CAAA,OAASM,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,kCAAA,EAAoC;AAAEA,QAAAA;OAAM,CAAA;AACzD,MAAA,OAAO;QACLD,KAAAA,EAAO,KAAA;QACPC,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMI,OAAAA,GAAU;AAClD,OAAA;AACF,IAAA;AACF,EAAA;;;;AAKOC,EAAAA,WAAAA,CAAYV,KAAAA,EAAoC;AACrD,IAAA,MAAMW,OAAAA,GAAUC,SAASZ,KAAAA,CAAAA;AACzB,IAAA,IAAI,CAACW,OAAAA,EAAS;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AACA,IAAA,OAAOA,OAAAA;AACT,EAAA;;;;AAKA,EAAA,MAAahB,aAAaA,YAAAA,EAAmD;AAC3EM,IAAAA,MAAAA,CAAOC,MAAM,yBAAA,CAAA;AAEb,IAAA,MAAMW,QAAAA,GAAW;;;;;;;;;AAUjB,IAAA,IAAI;AACF,MAAA,MAAMN,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MACjCO,QAAAA,EACA;AAAElB,QAAAA;AAAa,OAAA,EACf,KAAKT,OAAO,CAAA;AAGde,MAAAA,MAAAA,CAAOa,KAAK,qCAAA,CAAA;AAEZ,MAAA,OAAOP,QAAAA,CAASZ,YAAAA;AAClB,IAAA,CAAA,CAAA,OAASU,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,6BAAA,EAA+B;AAAEA,QAAAA;OAAM,CAAA;AACpD,MAAA,MAAM,IAAIU,oBAAoB,yBAAA,EAA2B;QACvDV,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMI,OAAAA,GAAU;OAClD,CAAA;AACF,IAAA;AACF,EAAA;;;;EAKA,MAAaO,kBAAAA,CAAmBC,MAAAA,EAAgBC,UAAAA,EAAoBC,UAAAA,EAAuC;AACzGlB,IAAAA,MAAAA,CAAOC,MAAM,8BAAA,EAAgC;AAAEe,MAAAA,MAAAA;AAAQC,MAAAA,UAAAA;AAAYC,MAAAA;KAAW,CAAA;AAE9E,IAAA,MAAMb,KAAAA,GAAQ;;;;;;;AAQd,IAAA,IAAI;AACF,MAAA,MAAMC,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MAEhCA,KAAAA,EAAO;AAAEW,QAAAA,MAAAA;AAAQC,QAAAA,UAAAA;AAAYC,QAAAA;AAAW,OAAA,EAAG,KAAKjC,OAAO,CAAA;AAE1De,MAAAA,MAAAA,CAAOC,MAAM,qCAAA,EAAuC;AAClDkB,QAAAA,OAAAA,EAASb,SAASS,kBAAAA,CAAmBI;OACvC,CAAA;AAEA,MAAA,OAAOb,SAASS,kBAAAA,CAAmBI,OAAAA;AACrC,IAAA,CAAA,CAAA,OAASf,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,qCAAA,EAAuC;AAAEA,QAAAA;OAAM,CAAA;AAC5D,MAAA,OAAO,KAAA;AACT,IAAA;AACF,EAAA;;;;AAKOgB,EAAAA,YAAAA,CAAarB,KAAAA,EAAwB;AAC1C,IAAA,OAAO,CAACG,eAAeH,KAAAA,CAAAA;AACzB,EAAA;;;;AAKOsB,EAAAA,kBAAAA,CAAmBtB,KAAAA,EAA8B;AACtD,IAAA,MAAMW,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,OAAOW,SAASY,OAAAA,IAAW,IAAA;AAC7B,EAAA;;;;AAKOC,EAAAA,uBAAAA,CAAwBxB,KAAAA,EAA8B;AAC3D,IAAA,MAAMW,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,OAAOW,SAASc,YAAAA,IAAgB,IAAA;AAClC,EAAA;;;;AAKOC,EAAAA,cAAAA,CAAe1B,KAAAA,EAA+C;AACnE,IAAA,MAAMW,OAAAA,GAAUC,SAASZ,KAAAA,CAAAA;AACzB,IAAA,OAAOW,OAAAA;AACT,EAAA;;;;EAKOgB,cAAAA,CAAe3B,KAAAA,EAAe4B,gBAAwB,GAAA,EAAc;AACzE,IAAA,MAAMjB,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,IAAI,CAACW,OAAAA,IAAW,OAAOA,OAAAA,CAAQkB,QAAQ,QAAA,EAAU;AAC/C,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMC,MAAMC,IAAAA,CAAKC,KAAAA,CAAMC,IAAAA,CAAKH,GAAAA,KAAQ,GAAA,CAAA;AACpC,IAAA,OAAOnB,OAAAA,CAAQkB,MAAMC,GAAAA,GAAMF,aAAAA;AAC7B,EAAA;AACF","file":"chunk-7NUQXGA7.js","sourcesContent":["/**\n * Authentication Module\n * JWT verification, token management, and user authentication\n */\n\nimport type { BurdenoffGraphQLClient } from '../client/graphql.js';\nimport type { SDKContext } from '../types/index.js';\nimport { AuthenticationError } from '../types/index.js';\nimport { logger } from '../logger/index.js';\nimport { parseJWT, isTokenExpired } from '../utils/index.js';\n\ninterface CookieContext {\n  responseHeaders?: Headers;\n  [key: string]: unknown;\n}\n\nconst ACCESS_TOKEN_COOKIE = 'bf_access_token';\nconst REFRESH_TOKEN_COOKIE = 'bf_refresh_token';\nconst ACCESS_TOKEN_MAX_AGE = 15 * 60; // 15 minutes\nconst REFRESH_TOKEN_MAX_AGE = 30 * 24 * 60 * 60; // 30 days\nconst REFRESH_TOKEN_REMEMBER_MAX_AGE = 30 * 24 * 60 * 60; // 30 days (same, controlled by backend)\n\nfunction buildCookieString(name: string, value: string, maxAge: number): string {\n  return `${name}=${value}; Max-Age=${maxAge}; Path=/; HttpOnly; SameSite=Strict`;\n}\n\nfunction buildClearCookieString(name: string): string {\n  return `${name}=; Max-Age=0; Path=/; HttpOnly; SameSite=Strict`;\n}\n\nexport const AuthCookieHelper = {\n  setAuthCookies(\n    context: CookieContext,\n    tokens: { accessToken: string; refreshToken: string },\n    options?: { rememberMe?: boolean }\n  ): void {\n    const headers = context.responseHeaders;\n    if (!headers) return;\n\n    const rememberMe = options?.rememberMe ?? false;\n    const refreshMaxAge = rememberMe ? REFRESH_TOKEN_REMEMBER_MAX_AGE : REFRESH_TOKEN_MAX_AGE;\n\n    headers.append('Set-Cookie', buildCookieString(ACCESS_TOKEN_COOKIE, tokens.accessToken, ACCESS_TOKEN_MAX_AGE));\n    headers.append('Set-Cookie', buildCookieString(REFRESH_TOKEN_COOKIE, tokens.refreshToken, refreshMaxAge));\n  },\n\n  clearAuthCookies(context: CookieContext): void {\n    const headers = context.responseHeaders;\n    if (!headers) return;\n\n    headers.append('Set-Cookie', buildClearCookieString(ACCESS_TOKEN_COOKIE));\n    headers.append('Set-Cookie', buildClearCookieString(REFRESH_TOKEN_COOKIE));\n  },\n};\n\nexport interface TokenPayload {\n  jti: string;\n  sub: string;\n  user_id: string;\n  workspace_id?: string;\n  org_id?: string;\n  tenant_endpoint?: string;\n  iat: number;\n  exp: number;\n  scope?: string;\n}\n\nexport interface VerifyTokenResult {\n  valid: boolean;\n  payload?: TokenPayload;\n  error?: string;\n}\n\nexport interface RefreshTokenResult {\n  accessToken: string;\n  refreshToken: string;\n  expiresIn: number;\n}\n\nexport * from './cookie-helper.js';\n\n/**\n * Authentication Module\n */\nexport class AuthModule {\n  constructor(\n    private client: BurdenoffGraphQLClient,\n    private context: SDKContext\n  ) {}\n\n  /**\n   * Verify JWT token\n   */\n  public async verifyToken(token: string): Promise<VerifyTokenResult> {\n    logger.debug('[Auth] Verifying token');\n\n    // First check if token is expired locally\n    if (isTokenExpired(token)) {\n      return {\n        valid: false,\n        error: 'Token expired',\n      };\n    }\n\n    const query = `\n      query VerifyToken($token: String!) {\n        verifyToken(token: $token) {\n          valid\n          payload\n          error\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{ verifyToken: VerifyTokenResult }>(query, { token }, this.context);\n\n      logger.debug('[Auth] Token verification result', { valid: response.verifyToken.valid });\n\n      return response.verifyToken;\n    } catch (error) {\n      logger.error('[Auth] Token verification failed', { error });\n      return {\n        valid: false,\n        error: error instanceof Error ? error.message : 'Unknown error',\n      };\n    }\n  }\n\n  /**\n   * Decode token without verification\n   */\n  public decodeToken(token: string): TokenPayload | null {\n    const payload = parseJWT(token);\n    if (!payload) {\n      return null;\n    }\n    return payload as unknown as TokenPayload;\n  }\n\n  /**\n   * Refresh access token using refresh token\n   */\n  public async refreshToken(refreshToken: string): Promise<RefreshTokenResult> {\n    logger.debug('[Auth] Refreshing token');\n\n    const mutation = `\n      mutation RefreshToken($refreshToken: String!) {\n        refreshToken(refreshToken: $refreshToken) {\n          accessToken\n          refreshToken\n          expiresIn\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{ refreshToken: RefreshTokenResult }>(\n        mutation,\n        { refreshToken },\n        this.context\n      );\n\n      logger.info('[Auth] Token refreshed successfully');\n\n      return response.refreshToken;\n    } catch (error) {\n      logger.error('[Auth] Token refresh failed', { error });\n      throw new AuthenticationError('Failed to refresh token', {\n        error: error instanceof Error ? error.message : 'Unknown error',\n      });\n    }\n  }\n\n  /**\n   * Validate user has specific permission\n   */\n  public async validatePermission(userId: string, permission: string, resourceId?: string): Promise<boolean> {\n    logger.debug('[Auth] Validating permission', { userId, permission, resourceId });\n\n    const query = `\n      query ValidatePermission($userId: ID!, $permission: String!, $resourceId: ID) {\n        validatePermission(userId: $userId, permission: $permission, resourceId: $resourceId) {\n          allowed\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{\n        validatePermission: { allowed: boolean };\n      }>(query, { userId, permission, resourceId }, this.context);\n\n      logger.debug('[Auth] Permission validation result', {\n        allowed: response.validatePermission.allowed,\n      });\n\n      return response.validatePermission.allowed;\n    } catch (error) {\n      logger.error('[Auth] Permission validation failed', { error });\n      return false;\n    }\n  }\n\n  /**\n   * Check if token is valid and not expired\n   */\n  public isTokenValid(token: string): boolean {\n    return !isTokenExpired(token);\n  }\n\n  /**\n   * Get user ID from token\n   */\n  public getUserIdFromToken(token: string): string | null {\n    const payload = this.decodeToken(token);\n    return payload?.user_id || null;\n  }\n\n  /**\n   * Get workspace ID from token\n   */\n  public getWorkspaceIdFromToken(token: string): string | null {\n    const payload = this.decodeToken(token);\n    return payload?.workspace_id || null;\n  }\n\n  /**\n   * Extract all claims from token\n   */\n  public getTokenClaims(token: string): Record<string, unknown> | null {\n    const payload = parseJWT(token);\n    return payload;\n  }\n\n  /**\n   * Check if token will expire soon (within given seconds)\n   */\n  public willExpireSoon(token: string, withinSeconds: number = 300): boolean {\n    const payload = this.decodeToken(token);\n    if (!payload || typeof payload.exp !== 'number') {\n      return true;\n    }\n\n    const now = Math.floor(Date.now() / 1000);\n    return payload.exp - now < withinSeconds;\n  }\n}\n"]}