@burdenoff/be-sdk 2026.529.3 → 2026.601.1

package/dist/server/index.d.ts

@@ -1,233 +1,15 @@
-import { GraphQLSchema, GraphQLError } from 'graphql';
-import { PubSub } from 'graphql-yoga';
-import { P as PrismaClientBase, a as PrismaClientConstructorOptions } from '../client-CSjIrYKS.js';
-import { I as I18nContext, L as LocaleCode, d as I18n } from '../i18n-DA6IPnYy.js';
+import { W as WorkspaceSecret, I as IActor, J as JWTPayload, S as ServerDefinition, a as ServerInstance, b as ITenant, G as GraphQLContext, Y as YogaPlugin } from '../types-sKXodL2N.js';
+export { C as ConsentContext, E as ElysiaApp, c as IContextFilterInput, d as IOperationContext, e as IOrganization, f as IProduct, g as IProject, h as ITracking, i as IWorkspace, M as ModuleGraphConfig, P as PrismaClientConstructor, R as RESTEndpoint, j as ServerConfig, k as ServerI18nConfig, l as ServerInfo, m as WspaceGraphQLContext } from '../types-sKXodL2N.js';
 import * as jose from 'jose';
 import { VerifyOptions } from 'jsonwebtoken';
+import { I as I18n } from '../i18n-DrdPTann.js';
+import { GraphQLError } from 'graphql';
+export { I as I18nContext, L as LocaleCode } from '../types-C8TbSdEj.js';
+export { P as PrismaClientBase } from '../client-CSjIrYKS.js';
+import 'graphql-yoga';
 import '@prisma/adapter-pg';
 import 'pg';
 
-interface IActor {
-    id: string;
-    type: string;
-    workspace_id?: string;
-    tenant_id?: string;
-    org_id?: string;
-    isAdmin?: boolean;
-}
-interface ITenant {
-    id: string;
-    endpoint: string;
-}
-interface IOrganization {
-    id: string;
-}
-interface IWorkspace {
-    id: string;
-}
-interface IProject {
-    id: string;
-}
-interface IProduct {
-    id: string;
-}
-interface ITracking {
-    ip?: string;
-    userAgent?: string;
-}
-interface ConsentContext {
-    grantedBy: string;
-    scopes?: string[];
-    grantedAt?: Date;
-    expiresAt?: Date;
-}
-interface GraphQLContext {
-    request: Request;
-    actor: IActor | null;
-    tenant: ITenant | null;
-    organization: IOrganization | null;
-    workspace: IWorkspace | null;
-    project: IProject | null;
-    product: IProduct | null;
-    tracking: ITracking;
-    consentContext?: ConsentContext;
-    onBehalfOf: string;
-    db: unknown;
-    pubsub?: PubSub<Record<string, [unknown]>>;
-    i18n?: I18nContext;
-    responseHeaders: Headers;
-}
-interface WspaceGraphQLContext extends Omit<GraphQLContext, 'workspace' | 'actor'> {
-    actor: IActor;
-    workspace: IWorkspace;
-}
-
-interface IOperationContext {
-    workspaceId?: string | null;
-    actorId?: string | null;
-    projectId?: string | null;
-    appId?: string | null;
-    custom?: Record<string, unknown> | null;
-}
-interface IContextFilterInput {
-    workspaceId?: string | null;
-    actorId?: string | null;
-    projectId?: string | null;
-    appId?: string | null;
-}
-interface ServerI18nConfig {
-    enabled?: boolean;
-    defaultLocale?: LocaleCode;
-    fallbackLocale?: LocaleCode;
-    localesPath?: string;
-    supportedLocales?: LocaleCode[];
-    namespace?: string;
-    lazyLoad?: boolean;
-    logMissing?: boolean;
-}
-interface ServerConfig {
-    serviceName: string;
-    serviceVersion?: string;
-    port: number;
-    host?: string;
-    environment?: 'development' | 'staging' | 'production';
-    boundary?: 'wspace' | 'global';
-    graphqlEndpoint?: string;
-    corsOrigins?: string | string[];
-    sessionSecret?: string;
-    enablePlayground?: boolean;
-    enableIntrospection?: boolean;
-    csrfSkipRoutes?: string[];
-    loginEndpoints?: string[];
-    enableCSRF?: boolean;
-    enableSessionSecurity?: boolean;
-    i18n?: ServerI18nConfig;
-    workspaceGuard?: {
-        enabled?: boolean;
-        whitelistedOperations?: string[];
-    };
-}
-interface ModuleGraphConfig {
-    getSchema: () => unknown;
-    exportAll: (orgId?: string, workspaceId?: string) => Promise<unknown>;
-    exportEntities: (orgId?: string, workspaceId?: string, types?: string[]) => Promise<unknown>;
-    exportRelationships: (orgId?: string, workspaceId?: string) => Promise<unknown>;
-    initialize: () => Promise<void>;
-    shutdown: () => Promise<void>;
-}
-interface RESTEndpoint {
-    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
-    path: string;
-    handler: (request: Request, context: GraphQLContext, rawBody?: string) => Promise<unknown>;
-    rawBody?: boolean;
-}
-type PrismaClientConstructor<T extends PrismaClientBase = PrismaClientBase> = new (options: PrismaClientConstructorOptions) => T;
-interface YogaPlugin {
-    onExecute?: (args: {
-        args: {
-            document?: unknown;
-            operationName?: string | null;
-            variableValues?: Record<string, unknown>;
-            contextValue?: unknown;
-        };
-    }) => {
-        onExecuteDone: (args: {
-            result: unknown;
-        }) => void;
-    } | undefined | void;
-    onSubscribe?: (args: {
-        args: unknown;
-    }) => void;
-    [key: string]: unknown;
-}
-interface ServerDefinition {
-    config: ServerConfig;
-    prismaClient: PrismaClientConstructor;
-    schema: GraphQLSchema;
-    moduleGraph?: ModuleGraphConfig;
-    restEndpoints?: RESTEndpoint[];
-    yogaPlugins?: YogaPlugin[];
-    buildContext?: (defaultContext: GraphQLContext) => Promise<GraphQLContext> | GraphQLContext;
-    workspaceExtensionConfig?: {
-        strictMode?: boolean;
-        excludeModels?: string[];
-        excludeModelsFromReadIsolation?: string[];
-        allowedUnguardedOperations?: string[];
-        enableReadIsolation?: boolean;
-        enableDeleteIsolation?: boolean;
-        enableUpdateWhereIsolation?: boolean;
-        debug?: boolean;
-    };
-    disableWorkspaceExtension?: boolean;
-    onShutdown?: () => Promise<void>;
-}
-interface BunServerHandle {
-    stop(): void;
-    port: number;
-    hostname: string;
-}
-interface ElysiaLikeServer {
-    server: BunServerHandle | null;
-    listen(options: {
-        port: number;
-        hostname?: string;
-    }): ElysiaLikeServer;
-    use(plugin: unknown): ElysiaLikeServer;
-    all(path: string, handler: (ctx: {
-        request: Request;
-    }) => unknown): ElysiaLikeServer;
-    get(path: string, handler: (ctx: {
-        request: Request;
-        query: Record<string, string | undefined>;
-    }) => unknown): ElysiaLikeServer;
-    post(path: string, handler: (ctx: {
-        request: Request;
-    }) => unknown): ElysiaLikeServer;
-    put(path: string, handler: (ctx: {
-        request: Request;
-    }) => unknown): ElysiaLikeServer;
-    patch(path: string, handler: (ctx: {
-        request: Request;
-    }) => unknown): ElysiaLikeServer;
-    delete(path: string, handler: (ctx: {
-        request: Request;
-    }) => unknown): ElysiaLikeServer;
-}
-type ElysiaApp = ElysiaLikeServer;
-interface ServerInstance {
-    app: ElysiaApp;
-    server: BunServerHandle | null;
-    start: () => Promise<void>;
-    stop: () => Promise<void>;
-    getInfo: () => ServerInfo;
-}
-interface ServerInfo {
-    serviceName: string;
-    serviceVersion: string;
-    environment: string;
-    port: number;
-    host: string;
-    graphqlEndpoint: string;
-    startedAt: string;
-    uptime: number;
-}
-interface JWTPayload {
-    sub: string;
-    actor_type?: string;
-    workspace_id?: string;
-    org_id?: string;
-    tenant_id?: string;
-    iat?: number;
-    exp?: number;
-    [key: string]: unknown;
-}
-interface WorkspaceSecret {
-    kty: string;
-    k: string;
-    alg?: string;
-    [key: string]: unknown;
-}
-
 type FetchWorkspaceSecretFn = (workspaceId: string) => Promise<WorkspaceSecret | null>;
 interface AuthConfig {
     fetchWorkspaceSecret: FetchWorkspaceSecretFn;
@@ -399,4 +181,4 @@ declare function createHumanReadableErrorPlugin(options?: ErrorNormalizationOpti
 declare function formatHttpError(error: unknown, options?: ErrorNormalizationOptions): HttpErrorResult;
 declare function createHttpErrorResponse(error: unknown, options?: ErrorNormalizationOptions): Response;
 
-export { type AuthConfig, type ConsentContext, type ContextBuilderOptions, type ElysiaApp, type ErrorNormalizationOptions, type FetchWorkspaceSecretFn, type GraphQLContext, type HttpErrorPayload, type HttpErrorResult, I18nContext, type IActor, type IContextFilterInput, type IOperationContext, type IOrganization, type IProduct, type IProject, type ITenant, type ITracking, type IWorkspace, type JWTPayload, LocaleCode, type ModuleGraphConfig, type NormalizedErrorState, PrismaClientBase, type PrismaClientConstructor, type RESTEndpoint, type ServerConfig, type ServerDefinition, type ServerI18nConfig, type ServerInfo, type ServerInstance, type UserFacingErrorOptions, UserFacingGraphQLError, type WorkspaceGuardConfig, type WorkspaceSecret, type WspaceGraphQLContext, type YogaPlugin, authCheck, buildContext, configureAuth, configureContext, configureDefaultAuth, configureServerAuth, createHttpErrorResponse, createHumanReadableErrorPlugin, createServer, createWorkspaceGuardPlugin, decodeJWT, fetchWorkspaceSecret, formatHttpError, generateSymmetricSecret, getContextOptions, normalizeError, normalizeExecutionResultErrors, normalizeGraphQLResponse, normalizeGraphQLResponsePayload, orgCheck, requireWorkspace, tenantCheck, toUserFacingGraphQLError, verifyJWT, workspaceCheck };
+export { type AuthConfig, type ContextBuilderOptions, type ErrorNormalizationOptions, type FetchWorkspaceSecretFn, GraphQLContext, type HttpErrorPayload, type HttpErrorResult, IActor, ITenant, JWTPayload, type NormalizedErrorState, ServerDefinition, ServerInstance, type UserFacingErrorOptions, UserFacingGraphQLError, type WorkspaceGuardConfig, WorkspaceSecret, YogaPlugin, authCheck, buildContext, configureAuth, configureContext, configureDefaultAuth, configureServerAuth, createHttpErrorResponse, createHumanReadableErrorPlugin, createServer, createWorkspaceGuardPlugin, decodeJWT, fetchWorkspaceSecret, formatHttpError, generateSymmetricSecret, getContextOptions, normalizeError, normalizeExecutionResultErrors, normalizeGraphQLResponse, normalizeGraphQLResponsePayload, orgCheck, requireWorkspace, tenantCheck, toUserFacingGraphQLError, verifyJWT, workspaceCheck };

package/dist/sharing/index.d.ts

@@ -0,0 +1 @@
+export { A as AccessResult, a as AccessVia, C as CreateLinkShareInput, b as CreateUserShareInput, R as RESOURCE_CAPABILITY_MAP, c as RESOURCE_TYPE_LABELS, d as ROLE_CAPABILITIES, e as ROLE_ORDER, f as ResourceMeta, S as SHARE_EMAIL_TEMPLATE_SLUG, g as SHARE_GRANT_PARTIAL_UNIQUE_SQL, h as SHARE_GRANT_PRISMA, j as SHARE_GRANT_SDL, k as SendShareEmailArgs, l as ShareActor, m as ShareCapabilities, n as ShareEmailNotifier, o as ShareGrantDelegate, p as ShareGrantRecord, q as ShareRole, r as ShareService, s as ShareServiceConfig, t as ShareServiceDeps, u as ShareServiceOptions, v as ShareStatus, w as ShareVisibility, x as buildPerEntityShareSdl, y as buildShareEmailVariables, z as capabilitiesFor, B as legacyToRole, D as makeSendShareEmail, E as maxRole, F as normalizeStatus, G as resourceTypeLabel, H as roleAtLeast, I as roleLabel, J as roleToLegacy } from '../index-kssw5ziY.js';

package/dist/sharing/index.js

@@ -0,0 +1,5 @@
+export { RESOURCE_CAPABILITY_MAP, RESOURCE_TYPE_LABELS, ROLE_CAPABILITIES, ROLE_ORDER, SHARE_EMAIL_TEMPLATE_SLUG, SHARE_GRANT_PARTIAL_UNIQUE_SQL, SHARE_GRANT_PRISMA, SHARE_GRANT_SDL, ShareRole, ShareService, ShareStatus, ShareVisibility, buildPerEntityShareSdl, buildShareEmailVariables, capabilitiesFor, legacyToRole, makeSendShareEmail, maxRole, normalizeStatus, resourceTypeLabel, roleAtLeast, roleLabel, roleToLegacy } from '../chunk-DVAZQEOL.js';
+import '../chunk-CBZNP6RF.js';
+import '../chunk-XE4OXN2W.js';
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/sharing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}

package/dist/{i18n-DA6IPnYy.d.ts → types-C8TbSdEj.d.ts}

@@ -68,34 +68,4 @@ interface LanguageInfo {
 declare const RTL_LANGUAGES: LanguageCode[];
 declare function getTextDirection(language: LanguageCode): TextDirection;
 
-declare class I18n implements II18n {
-    private config;
-    private currentLocale;
-    private supportedLocales;
-    private initialized;
-    constructor(config: I18nConfig);
-    initialize(): Promise<void>;
-    getLocale(): LocaleCode;
-    setLocale(locale: LocaleCode): void;
-    getSupportedLocales(): LocaleCode[];
-    isSupported(locale: LocaleCode): boolean;
-    loadLocale(locale: LocaleCode): Promise<void>;
-    getTranslations(locale: LocaleCode): FlatTranslationMap | undefined;
-    t: TranslateFunction;
-    tp: PluralTranslateFunction;
-    private translate;
-    private translatePlural;
-    createContext(locale: LocaleCode): I18nContext;
-    createContextFromRequest(request: Request): I18nContext;
-    getLanguageInfo(locale: LocaleCode): {
-        code: LanguageCode;
-        direction: 'ltr' | 'rtl';
-        locale: LocaleCode;
-        region?: string;
-    };
-}
-declare function initializeI18n(config: I18nConfig): Promise<I18n>;
-declare function getI18n(): I18n | null;
-declare function createI18n(config: I18nConfig): I18n;
-
-export { type FlatTranslationMap as F, type I18nContext as I, type LocaleCode as L, type ParsedLocale as P, RTL_LANGUAGES as R, type TranslationVariables as T, type LanguageCode as a, type TranslationDictionary as b, type I18nConfig as c, I18n as d, type II18n as e, type LanguageInfo as f, type PluralForms as g, type PluralTranslateFunction as h, type TextDirection as i, type TranslateFunction as j, createI18n as k, getI18n as l, getTextDirection as m, initializeI18n as n };
+export { type FlatTranslationMap as F, type I18nContext as I, type LocaleCode as L, type PluralTranslateFunction as P, RTL_LANGUAGES as R, type TranslateFunction as T, type II18n as a, type I18nConfig as b, type LanguageCode as c, type TranslationVariables as d, type ParsedLocale as e, type TranslationDictionary as f, type LanguageInfo as g, type PluralForms as h, type TextDirection as i, getTextDirection as j };

package/dist/types-sKXodL2N.d.ts

@@ -0,0 +1,227 @@
+import { GraphQLSchema } from 'graphql';
+import { PubSub } from 'graphql-yoga';
+import { P as PrismaClientBase, a as PrismaClientConstructorOptions } from './client-CSjIrYKS.js';
+import { I as I18nContext, L as LocaleCode } from './types-C8TbSdEj.js';
+
+interface IActor {
+    id: string;
+    type: string;
+    workspace_id?: string;
+    tenant_id?: string;
+    org_id?: string;
+    isAdmin?: boolean;
+}
+interface ITenant {
+    id: string;
+    endpoint: string;
+}
+interface IOrganization {
+    id: string;
+}
+interface IWorkspace {
+    id: string;
+}
+interface IProject {
+    id: string;
+}
+interface IProduct {
+    id: string;
+}
+interface ITracking {
+    ip?: string;
+    userAgent?: string;
+}
+interface ConsentContext {
+    grantedBy: string;
+    scopes?: string[];
+    grantedAt?: Date;
+    expiresAt?: Date;
+}
+interface GraphQLContext {
+    request: Request;
+    actor: IActor | null;
+    tenant: ITenant | null;
+    organization: IOrganization | null;
+    workspace: IWorkspace | null;
+    project: IProject | null;
+    product: IProduct | null;
+    tracking: ITracking;
+    consentContext?: ConsentContext;
+    onBehalfOf: string;
+    db: unknown;
+    pubsub?: PubSub<Record<string, [unknown]>>;
+    i18n?: I18nContext;
+    responseHeaders: Headers;
+}
+interface WspaceGraphQLContext extends Omit<GraphQLContext, 'workspace' | 'actor'> {
+    actor: IActor;
+    workspace: IWorkspace;
+}
+
+interface IOperationContext {
+    workspaceId?: string | null;
+    actorId?: string | null;
+    projectId?: string | null;
+    appId?: string | null;
+    custom?: Record<string, unknown> | null;
+}
+interface IContextFilterInput {
+    workspaceId?: string | null;
+    actorId?: string | null;
+    projectId?: string | null;
+    appId?: string | null;
+}
+interface ServerI18nConfig {
+    enabled?: boolean;
+    defaultLocale?: LocaleCode;
+    fallbackLocale?: LocaleCode;
+    localesPath?: string;
+    supportedLocales?: LocaleCode[];
+    namespace?: string;
+    lazyLoad?: boolean;
+    logMissing?: boolean;
+}
+interface ServerConfig {
+    serviceName: string;
+    serviceVersion?: string;
+    port: number;
+    host?: string;
+    environment?: 'development' | 'staging' | 'production';
+    boundary?: 'wspace' | 'global';
+    graphqlEndpoint?: string;
+    corsOrigins?: string | string[];
+    sessionSecret?: string;
+    enablePlayground?: boolean;
+    enableIntrospection?: boolean;
+    csrfSkipRoutes?: string[];
+    loginEndpoints?: string[];
+    enableCSRF?: boolean;
+    enableSessionSecurity?: boolean;
+    i18n?: ServerI18nConfig;
+    workspaceGuard?: {
+        enabled?: boolean;
+        whitelistedOperations?: string[];
+    };
+}
+interface ModuleGraphConfig {
+    getSchema: () => unknown;
+    exportAll: (orgId?: string, workspaceId?: string) => Promise<unknown>;
+    exportEntities: (orgId?: string, workspaceId?: string, types?: string[]) => Promise<unknown>;
+    exportRelationships: (orgId?: string, workspaceId?: string) => Promise<unknown>;
+    initialize: () => Promise<void>;
+    shutdown: () => Promise<void>;
+}
+interface RESTEndpoint {
+    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+    path: string;
+    handler: (request: Request, context: GraphQLContext, rawBody?: string) => Promise<unknown>;
+    rawBody?: boolean;
+}
+type PrismaClientConstructor<T extends PrismaClientBase = PrismaClientBase> = new (options: PrismaClientConstructorOptions) => T;
+interface YogaPlugin {
+    onExecute?: (args: {
+        args: {
+            document?: unknown;
+            operationName?: string | null;
+            variableValues?: Record<string, unknown>;
+            contextValue?: unknown;
+        };
+    }) => {
+        onExecuteDone: (args: {
+            result: unknown;
+        }) => void;
+    } | undefined | void;
+    onSubscribe?: (args: {
+        args: unknown;
+    }) => void;
+    [key: string]: unknown;
+}
+interface ServerDefinition {
+    config: ServerConfig;
+    prismaClient: PrismaClientConstructor;
+    schema: GraphQLSchema;
+    moduleGraph?: ModuleGraphConfig;
+    restEndpoints?: RESTEndpoint[];
+    yogaPlugins?: YogaPlugin[];
+    buildContext?: (defaultContext: GraphQLContext) => Promise<GraphQLContext> | GraphQLContext;
+    workspaceExtensionConfig?: {
+        strictMode?: boolean;
+        excludeModels?: string[];
+        excludeModelsFromReadIsolation?: string[];
+        allowedUnguardedOperations?: string[];
+        enableReadIsolation?: boolean;
+        enableDeleteIsolation?: boolean;
+        enableUpdateWhereIsolation?: boolean;
+        debug?: boolean;
+    };
+    disableWorkspaceExtension?: boolean;
+    onShutdown?: () => Promise<void>;
+}
+interface BunServerHandle {
+    stop(): void;
+    port: number;
+    hostname: string;
+}
+interface ElysiaLikeServer {
+    server: BunServerHandle | null;
+    listen(options: {
+        port: number;
+        hostname?: string;
+    }): ElysiaLikeServer;
+    use(plugin: unknown): ElysiaLikeServer;
+    all(path: string, handler: (ctx: {
+        request: Request;
+    }) => unknown): ElysiaLikeServer;
+    get(path: string, handler: (ctx: {
+        request: Request;
+        query: Record<string, string | undefined>;
+    }) => unknown): ElysiaLikeServer;
+    post(path: string, handler: (ctx: {
+        request: Request;
+    }) => unknown): ElysiaLikeServer;
+    put(path: string, handler: (ctx: {
+        request: Request;
+    }) => unknown): ElysiaLikeServer;
+    patch(path: string, handler: (ctx: {
+        request: Request;
+    }) => unknown): ElysiaLikeServer;
+    delete(path: string, handler: (ctx: {
+        request: Request;
+    }) => unknown): ElysiaLikeServer;
+}
+type ElysiaApp = ElysiaLikeServer;
+interface ServerInstance {
+    app: ElysiaApp;
+    server: BunServerHandle | null;
+    start: () => Promise<void>;
+    stop: () => Promise<void>;
+    getInfo: () => ServerInfo;
+}
+interface ServerInfo {
+    serviceName: string;
+    serviceVersion: string;
+    environment: string;
+    port: number;
+    host: string;
+    graphqlEndpoint: string;
+    startedAt: string;
+    uptime: number;
+}
+interface JWTPayload {
+    sub: string;
+    actor_type?: string;
+    workspace_id?: string;
+    org_id?: string;
+    tenant_id?: string;
+    iat?: number;
+    exp?: number;
+    [key: string]: unknown;
+}
+interface WorkspaceSecret {
+    kty: string;
+    k: string;
+    alg?: string;
+    [key: string]: unknown;
+}
+
+export type { ConsentContext as C, ElysiaApp as E, GraphQLContext as G, IActor as I, JWTPayload as J, ModuleGraphConfig as M, PrismaClientConstructor as P, RESTEndpoint as R, ServerDefinition as S, WorkspaceSecret as W, YogaPlugin as Y, ServerInstance as a, ITenant as b, IContextFilterInput as c, IOperationContext as d, IOrganization as e, IProduct as f, IProject as g, ITracking as h, IWorkspace as i, ServerConfig as j, ServerI18nConfig as k, ServerInfo as l, WspaceGraphQLContext as m };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/be-sdk",
-  "version": "2026.529.3",
+  "version": "2026.601.1",
   "description": "Backend SDK for Burdenoff products providing unified access to notifications, RBAC, activity tracking, usage monitoring, and more",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -71,8 +71,8 @@
     "deps:status": "bun scripts/deps-mode.ts status",
     "deps:workspace": "bun scripts/deps-mode.ts workspace",
     "dev": "tsx watch ./src/index.ts",
-    "build": "NODE_OPTIONS=--max-old-space-size=4096 tsup src/index.ts src/init/index.ts src/logger/index.ts src/cache/index.ts src/database/index.ts src/event-queue/index.ts src/graph/index.ts src/middleware/index.ts src/observability/index.ts src/graphql/index.ts src/graphql/services/index.ts src/prisma/index.ts src/utils/index.ts src/notifications/index.ts src/tracker/index.ts src/export/index.ts src/dataloader/index.ts src/prisma/generator/index.ts src/server/index.ts src/i18n/index.ts src/instrumentation/index.ts src/rbac/index.ts src/temporal/index.ts src/client/internal-client.ts src/layer/index.ts src/gateway/index.ts src/gateway/security/index.ts src/crypto/index.ts src/feature-flags/index.ts src/telemetry/index.ts src/auth/index.ts src/captcha/index.ts src/metrics/index.ts src/platform/index.ts src/resource-caps/index.ts --format esm --dts --clean --shims",
-    "build:watch": "tsup src/index.ts src/init/index.ts src/logger/index.ts src/cache/index.ts src/database/index.ts src/event-queue/index.ts src/graph/index.ts src/middleware/index.ts src/observability/index.ts src/graphql/index.ts src/graphql/services/index.ts src/prisma/index.ts src/utils/index.ts src/notifications/index.ts src/tracker/index.ts src/export/index.ts src/dataloader/index.ts src/prisma/generator/index.ts src/server/index.ts src/i18n/index.ts src/instrumentation/index.ts src/rbac/index.ts src/temporal/index.ts src/client/internal-client.ts src/layer/index.ts src/gateway/index.ts src/gateway/security/index.ts src/crypto/index.ts src/feature-flags/index.ts src/telemetry/index.ts src/auth/index.ts src/captcha/index.ts src/metrics/index.ts src/platform/index.ts src/resource-caps/index.ts --format esm --dts --watch --shims",
+    "build": "NODE_OPTIONS=--max-old-space-size=4096 tsup src/index.ts src/init/index.ts src/logger/index.ts src/cache/index.ts src/database/index.ts src/event-queue/index.ts src/graph/index.ts src/middleware/index.ts src/observability/index.ts src/graphql/index.ts src/graphql/services/index.ts src/prisma/index.ts src/utils/index.ts src/notifications/index.ts src/tracker/index.ts src/export/index.ts src/dataloader/index.ts src/prisma/generator/index.ts src/server/index.ts src/i18n/index.ts src/instrumentation/index.ts src/rbac/index.ts src/temporal/index.ts src/client/internal-client.ts src/layer/index.ts src/gateway/index.ts src/gateway/security/index.ts src/crypto/index.ts src/feature-flags/index.ts src/telemetry/index.ts src/auth/index.ts src/captcha/index.ts src/metrics/index.ts src/platform/index.ts src/resource-caps/index.ts src/sharing/index.ts --format esm --dts --clean --shims",
+    "build:watch": "tsup src/index.ts src/init/index.ts src/logger/index.ts src/cache/index.ts src/database/index.ts src/event-queue/index.ts src/graph/index.ts src/middleware/index.ts src/observability/index.ts src/graphql/index.ts src/graphql/services/index.ts src/prisma/index.ts src/utils/index.ts src/notifications/index.ts src/tracker/index.ts src/export/index.ts src/dataloader/index.ts src/prisma/generator/index.ts src/server/index.ts src/i18n/index.ts src/instrumentation/index.ts src/rbac/index.ts src/temporal/index.ts src/client/internal-client.ts src/layer/index.ts src/gateway/index.ts src/gateway/security/index.ts src/crypto/index.ts src/feature-flags/index.ts src/telemetry/index.ts src/auth/index.ts src/captcha/index.ts src/metrics/index.ts src/platform/index.ts src/resource-caps/index.ts src/sharing/index.ts --format esm --dts --watch --shims",
     "typecheck": "tsc --noEmit",
     "lint": "eslint ./src",
     "lint:sanity": "if [ \"${CI:-}\" = \"true\" ]; then bun run lint; else bun run lint -- --cache --cache-location .eslintcache; fi",

package/dist/chunk-7NUQXGA7.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/auth/index.ts"],"names":["ACCESS_TOKEN_COOKIE","REFRESH_TOKEN_COOKIE","ACCESS_TOKEN_MAX_AGE","REFRESH_TOKEN_MAX_AGE","REFRESH_TOKEN_REMEMBER_MAX_AGE","buildCookieString","name","value","maxAge","buildClearCookieString","AuthCookieHelper","setAuthCookies","context","tokens","options","headers","responseHeaders","rememberMe","refreshMaxAge","append","accessToken","refreshToken","clearAuthCookies","AuthModule","client","verifyToken","token","logger","debug","isTokenExpired","valid","error","query","response","Error","message","decodeToken","payload","parseJWT","mutation","info","AuthenticationError","validatePermission","userId","permission","resourceId","allowed","isTokenValid","getUserIdFromToken","user_id","getWorkspaceIdFromToken","workspace_id","getTokenClaims","willExpireSoon","withinSeconds","exp","now","Math","floor","Date"],"mappings":";;;;;;AAgBA,IAAMA,mBAAAA,GAAsB,iBAAA;AAC5B,IAAMC,oBAAAA,GAAuB,kBAAA;AAC7B,IAAMC,uBAAuB,EAAA,GAAK,EAAA;AAClC,IAAMC,qBAAAA,GAAwB,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAC7C,IAAMC,8BAAAA,GAAiC,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAEtD,SAASC,iBAAAA,CAAkBC,IAAAA,EAAcC,KAAAA,EAAeC,MAAAA,EAAc;AACpE,EAAA,OAAO,CAAA,EAAGF,IAAAA,CAAAA,CAAAA,EAAQC,KAAAA,aAAkBC,MAAAA,CAAAA,mCAAAA,CAAAA;AACtC;AAFSH,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAIT,SAASI,uBAAuBH,IAAAA,EAAY;AAC1C,EAAA,OAAO,GAAGA,IAAAA,CAAAA,+CAAAA,CAAAA;AACZ;AAFSG,MAAAA,CAAAA,sBAAAA,EAAAA,wBAAAA,CAAAA;AAIF,IAAMC,gBAAAA,GAAmB;EAC9BC,cAAAA,CACEC,OAAAA,EACAC,QACAC,OAAAA,EAAkC;AAElC,IAAA,MAAMC,UAAUH,OAAAA,CAAQI,eAAAA;AACxB,IAAA,IAAI,CAACD,OAAAA,EAAS;AAEd,IAAA,MAAME,UAAAA,GAAaH,SAASG,UAAAA,IAAc,KAAA;AAC1C,IAAA,MAAMC,aAAAA,GAAgBD,aAAab,8BAAAA,GAAiCD,qBAAAA;AAEpEY,IAAAA,OAAAA,CAAQI,OAAO,YAAA,EAAcd,iBAAAA,CAAkBL,qBAAqBa,MAAAA,CAAOO,WAAAA,EAAalB,oBAAAA,CAAAA,CAAAA;AACxFa,IAAAA,OAAAA,CAAQI,OAAO,YAAA,EAAcd,iBAAAA,CAAkBJ,sBAAsBY,MAAAA,CAAOQ,YAAAA,EAAcH,aAAAA,CAAAA,CAAAA;AAC5F,EAAA,CAAA;AAEAI,EAAAA,gBAAAA,CAAiBV,OAAAA,EAAsB;AACrC,IAAA,MAAMG,UAAUH,OAAAA,CAAQI,eAAAA;AACxB,IAAA,IAAI,CAACD,OAAAA,EAAS;AAEdA,IAAAA,OAAAA,CAAQI,MAAAA,CAAO,YAAA,EAAcV,sBAAAA,CAAuBT,mBAAAA,CAAAA,CAAAA;AACpDe,IAAAA,OAAAA,CAAQI,MAAAA,CAAO,YAAA,EAAcV,sBAAAA,CAAuBR,oBAAAA,CAAAA,CAAAA;AACtD,EAAA;AACF;AA+BO,IAAMsB,aAAN,MAAMA;EApFb;;;;;AAqFE,EAAA,WAAA,CACUC,QACAZ,OAAAA,EACR;SAFQY,MAAAA,GAAAA,MAAAA;SACAZ,OAAAA,GAAAA,OAAAA;AACP,EAAA;;;;AAKH,EAAA,MAAaa,YAAYC,KAAAA,EAA2C;AAClEC,IAAAA,MAAAA,CAAOC,MAAM,wBAAA,CAAA;AAGb,IAAA,IAAIC,cAAAA,CAAeH,KAAAA,CAAAA,EAAQ;AACzB,MAAA,OAAO;QACLI,KAAAA,EAAO,KAAA;QACPC,KAAAA,EAAO;AACT,OAAA;AACF,IAAA;AAEA,IAAA,MAAMC,KAAAA,GAAQ;;;;;;;;;AAUd,IAAA,IAAI;AACF,MAAA,MAAMC,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MAA0CA,KAAAA,EAAO;AAAEN,QAAAA;AAAM,OAAA,EAAG,KAAKd,OAAO,CAAA;AAE3Ge,MAAAA,MAAAA,CAAOC,MAAM,kCAAA,EAAoC;AAAEE,QAAAA,KAAAA,EAAOG,SAASR,WAAAA,CAAYK;OAAM,CAAA;AAErF,MAAA,OAAOG,QAAAA,CAASR,WAAAA;AAClB,IAAA,CAAA,CAAA,OAASM,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,kCAAA,EAAoC;AAAEA,QAAAA;OAAM,CAAA;AACzD,MAAA,OAAO;QACLD,KAAAA,EAAO,KAAA;QACPC,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMI,OAAAA,GAAU;AAClD,OAAA;AACF,IAAA;AACF,EAAA;;;;AAKOC,EAAAA,WAAAA,CAAYV,KAAAA,EAAoC;AACrD,IAAA,MAAMW,OAAAA,GAAUC,SAASZ,KAAAA,CAAAA;AACzB,IAAA,IAAI,CAACW,OAAAA,EAAS;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AACA,IAAA,OAAOA,OAAAA;AACT,EAAA;;;;AAKA,EAAA,MAAahB,aAAaA,YAAAA,EAAmD;AAC3EM,IAAAA,MAAAA,CAAOC,MAAM,yBAAA,CAAA;AAEb,IAAA,MAAMW,QAAAA,GAAW;;;;;;;;;AAUjB,IAAA,IAAI;AACF,MAAA,MAAMN,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MACjCO,QAAAA,EACA;AAAElB,QAAAA;AAAa,OAAA,EACf,KAAKT,OAAO,CAAA;AAGde,MAAAA,MAAAA,CAAOa,KAAK,qCAAA,CAAA;AAEZ,MAAA,OAAOP,QAAAA,CAASZ,YAAAA;AAClB,IAAA,CAAA,CAAA,OAASU,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,6BAAA,EAA+B;AAAEA,QAAAA;OAAM,CAAA;AACpD,MAAA,MAAM,IAAIU,oBAAoB,yBAAA,EAA2B;QACvDV,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMI,OAAAA,GAAU;OAClD,CAAA;AACF,IAAA;AACF,EAAA;;;;EAKA,MAAaO,kBAAAA,CAAmBC,MAAAA,EAAgBC,UAAAA,EAAoBC,UAAAA,EAAuC;AACzGlB,IAAAA,MAAAA,CAAOC,MAAM,8BAAA,EAAgC;AAAEe,MAAAA,MAAAA;AAAQC,MAAAA,UAAAA;AAAYC,MAAAA;KAAW,CAAA;AAE9E,IAAA,MAAMb,KAAAA,GAAQ;;;;;;;AAQd,IAAA,IAAI;AACF,MAAA,MAAMC,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MAEhCA,KAAAA,EAAO;AAAEW,QAAAA,MAAAA;AAAQC,QAAAA,UAAAA;AAAYC,QAAAA;AAAW,OAAA,EAAG,KAAKjC,OAAO,CAAA;AAE1De,MAAAA,MAAAA,CAAOC,MAAM,qCAAA,EAAuC;AAClDkB,QAAAA,OAAAA,EAASb,SAASS,kBAAAA,CAAmBI;OACvC,CAAA;AAEA,MAAA,OAAOb,SAASS,kBAAAA,CAAmBI,OAAAA;AACrC,IAAA,CAAA,CAAA,OAASf,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,qCAAA,EAAuC;AAAEA,QAAAA;OAAM,CAAA;AAC5D,MAAA,OAAO,KAAA;AACT,IAAA;AACF,EAAA;;;;AAKOgB,EAAAA,YAAAA,CAAarB,KAAAA,EAAwB;AAC1C,IAAA,OAAO,CAACG,eAAeH,KAAAA,CAAAA;AACzB,EAAA;;;;AAKOsB,EAAAA,kBAAAA,CAAmBtB,KAAAA,EAA8B;AACtD,IAAA,MAAMW,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,OAAOW,SAASY,OAAAA,IAAW,IAAA;AAC7B,EAAA;;;;AAKOC,EAAAA,uBAAAA,CAAwBxB,KAAAA,EAA8B;AAC3D,IAAA,MAAMW,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,OAAOW,SAASc,YAAAA,IAAgB,IAAA;AAClC,EAAA;;;;AAKOC,EAAAA,cAAAA,CAAe1B,KAAAA,EAA+C;AACnE,IAAA,MAAMW,OAAAA,GAAUC,SAASZ,KAAAA,CAAAA;AACzB,IAAA,OAAOW,OAAAA;AACT,EAAA;;;;EAKOgB,cAAAA,CAAe3B,KAAAA,EAAe4B,gBAAwB,GAAA,EAAc;AACzE,IAAA,MAAMjB,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,IAAI,CAACW,OAAAA,IAAW,OAAOA,OAAAA,CAAQkB,QAAQ,QAAA,EAAU;AAC/C,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMC,MAAMC,IAAAA,CAAKC,KAAAA,CAAMC,IAAAA,CAAKH,GAAAA,KAAQ,GAAA,CAAA;AACpC,IAAA,OAAOnB,OAAAA,CAAQkB,MAAMC,GAAAA,GAAMF,aAAAA;AAC7B,EAAA;AACF","file":"chunk-7NUQXGA7.js","sourcesContent":["/**\n * Authentication Module\n * JWT verification, token management, and user authentication\n */\n\nimport type { BurdenoffGraphQLClient } from '../client/graphql.js';\nimport type { SDKContext } from '../types/index.js';\nimport { AuthenticationError } from '../types/index.js';\nimport { logger } from '../logger/index.js';\nimport { parseJWT, isTokenExpired } from '../utils/index.js';\n\ninterface CookieContext {\n  responseHeaders?: Headers;\n  [key: string]: unknown;\n}\n\nconst ACCESS_TOKEN_COOKIE = 'bf_access_token';\nconst REFRESH_TOKEN_COOKIE = 'bf_refresh_token';\nconst ACCESS_TOKEN_MAX_AGE = 15 * 60; // 15 minutes\nconst REFRESH_TOKEN_MAX_AGE = 30 * 24 * 60 * 60; // 30 days\nconst REFRESH_TOKEN_REMEMBER_MAX_AGE = 30 * 24 * 60 * 60; // 30 days (same, controlled by backend)\n\nfunction buildCookieString(name: string, value: string, maxAge: number): string {\n  return `${name}=${value}; Max-Age=${maxAge}; Path=/; HttpOnly; SameSite=Strict`;\n}\n\nfunction buildClearCookieString(name: string): string {\n  return `${name}=; Max-Age=0; Path=/; HttpOnly; SameSite=Strict`;\n}\n\nexport const AuthCookieHelper = {\n  setAuthCookies(\n    context: CookieContext,\n    tokens: { accessToken: string; refreshToken: string },\n    options?: { rememberMe?: boolean }\n  ): void {\n    const headers = context.responseHeaders;\n    if (!headers) return;\n\n    const rememberMe = options?.rememberMe ?? false;\n    const refreshMaxAge = rememberMe ? REFRESH_TOKEN_REMEMBER_MAX_AGE : REFRESH_TOKEN_MAX_AGE;\n\n    headers.append('Set-Cookie', buildCookieString(ACCESS_TOKEN_COOKIE, tokens.accessToken, ACCESS_TOKEN_MAX_AGE));\n    headers.append('Set-Cookie', buildCookieString(REFRESH_TOKEN_COOKIE, tokens.refreshToken, refreshMaxAge));\n  },\n\n  clearAuthCookies(context: CookieContext): void {\n    const headers = context.responseHeaders;\n    if (!headers) return;\n\n    headers.append('Set-Cookie', buildClearCookieString(ACCESS_TOKEN_COOKIE));\n    headers.append('Set-Cookie', buildClearCookieString(REFRESH_TOKEN_COOKIE));\n  },\n};\n\nexport interface TokenPayload {\n  jti: string;\n  sub: string;\n  user_id: string;\n  workspace_id?: string;\n  org_id?: string;\n  tenant_endpoint?: string;\n  iat: number;\n  exp: number;\n  scope?: string;\n}\n\nexport interface VerifyTokenResult {\n  valid: boolean;\n  payload?: TokenPayload;\n  error?: string;\n}\n\nexport interface RefreshTokenResult {\n  accessToken: string;\n  refreshToken: string;\n  expiresIn: number;\n}\n\nexport * from './cookie-helper.js';\n\n/**\n * Authentication Module\n */\nexport class AuthModule {\n  constructor(\n    private client: BurdenoffGraphQLClient,\n    private context: SDKContext\n  ) {}\n\n  /**\n   * Verify JWT token\n   */\n  public async verifyToken(token: string): Promise<VerifyTokenResult> {\n    logger.debug('[Auth] Verifying token');\n\n    // First check if token is expired locally\n    if (isTokenExpired(token)) {\n      return {\n        valid: false,\n        error: 'Token expired',\n      };\n    }\n\n    const query = `\n      query VerifyToken($token: String!) {\n        verifyToken(token: $token) {\n          valid\n          payload\n          error\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{ verifyToken: VerifyTokenResult }>(query, { token }, this.context);\n\n      logger.debug('[Auth] Token verification result', { valid: response.verifyToken.valid });\n\n      return response.verifyToken;\n    } catch (error) {\n      logger.error('[Auth] Token verification failed', { error });\n      return {\n        valid: false,\n        error: error instanceof Error ? error.message : 'Unknown error',\n      };\n    }\n  }\n\n  /**\n   * Decode token without verification\n   */\n  public decodeToken(token: string): TokenPayload | null {\n    const payload = parseJWT(token);\n    if (!payload) {\n      return null;\n    }\n    return payload as unknown as TokenPayload;\n  }\n\n  /**\n   * Refresh access token using refresh token\n   */\n  public async refreshToken(refreshToken: string): Promise<RefreshTokenResult> {\n    logger.debug('[Auth] Refreshing token');\n\n    const mutation = `\n      mutation RefreshToken($refreshToken: String!) {\n        refreshToken(refreshToken: $refreshToken) {\n          accessToken\n          refreshToken\n          expiresIn\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{ refreshToken: RefreshTokenResult }>(\n        mutation,\n        { refreshToken },\n        this.context\n      );\n\n      logger.info('[Auth] Token refreshed successfully');\n\n      return response.refreshToken;\n    } catch (error) {\n      logger.error('[Auth] Token refresh failed', { error });\n      throw new AuthenticationError('Failed to refresh token', {\n        error: error instanceof Error ? error.message : 'Unknown error',\n      });\n    }\n  }\n\n  /**\n   * Validate user has specific permission\n   */\n  public async validatePermission(userId: string, permission: string, resourceId?: string): Promise<boolean> {\n    logger.debug('[Auth] Validating permission', { userId, permission, resourceId });\n\n    const query = `\n      query ValidatePermission($userId: ID!, $permission: String!, $resourceId: ID) {\n        validatePermission(userId: $userId, permission: $permission, resourceId: $resourceId) {\n          allowed\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{\n        validatePermission: { allowed: boolean };\n      }>(query, { userId, permission, resourceId }, this.context);\n\n      logger.debug('[Auth] Permission validation result', {\n        allowed: response.validatePermission.allowed,\n      });\n\n      return response.validatePermission.allowed;\n    } catch (error) {\n      logger.error('[Auth] Permission validation failed', { error });\n      return false;\n    }\n  }\n\n  /**\n   * Check if token is valid and not expired\n   */\n  public isTokenValid(token: string): boolean {\n    return !isTokenExpired(token);\n  }\n\n  /**\n   * Get user ID from token\n   */\n  public getUserIdFromToken(token: string): string | null {\n    const payload = this.decodeToken(token);\n    return payload?.user_id || null;\n  }\n\n  /**\n   * Get workspace ID from token\n   */\n  public getWorkspaceIdFromToken(token: string): string | null {\n    const payload = this.decodeToken(token);\n    return payload?.workspace_id || null;\n  }\n\n  /**\n   * Extract all claims from token\n   */\n  public getTokenClaims(token: string): Record<string, unknown> | null {\n    const payload = parseJWT(token);\n    return payload;\n  }\n\n  /**\n   * Check if token will expire soon (within given seconds)\n   */\n  public willExpireSoon(token: string, withinSeconds: number = 300): boolean {\n    const payload = this.decodeToken(token);\n    if (!payload || typeof payload.exp !== 'number') {\n      return true;\n    }\n\n    const now = Math.floor(Date.now() / 1000);\n    return payload.exp - now < withinSeconds;\n  }\n}\n"]}