@burdenoff/be-sdk 2026.530.1 → 2026.601.2

package/dist/chunk-XD5ZK727.js

@@ -0,0 +1,1006 @@
+import { logger } from './chunk-CBZNP6RF.js';
+import { __export, __name } from './chunk-XE4OXN2W.js';
+import { randomBytes } from 'crypto';
+import { GraphQLError } from 'graphql';
+
+// src/sharing/index.ts
+var sharing_exports = {};
+__export(sharing_exports, {
+  RESOURCE_CAPABILITY_MAP: () => RESOURCE_CAPABILITY_MAP,
+  RESOURCE_TYPE_LABELS: () => RESOURCE_TYPE_LABELS,
+  ROLE_CAPABILITIES: () => ROLE_CAPABILITIES,
+  ROLE_ORDER: () => ROLE_ORDER,
+  SHARE_EMAIL_TEMPLATE_SLUG: () => SHARE_EMAIL_TEMPLATE_SLUG,
+  SHARE_GRANT_PARTIAL_UNIQUE_SQL: () => SHARE_GRANT_PARTIAL_UNIQUE_SQL,
+  SHARE_GRANT_PRISMA: () => SHARE_GRANT_PRISMA,
+  SHARE_GRANT_SDL: () => SHARE_GRANT_SDL,
+  ShareRole: () => ShareRole,
+  ShareService: () => ShareService,
+  ShareStatus: () => ShareStatus,
+  ShareVisibility: () => ShareVisibility,
+  buildPerEntityShareSdl: () => buildPerEntityShareSdl,
+  buildShareEmailVariables: () => buildShareEmailVariables,
+  capabilitiesFor: () => capabilitiesFor,
+  legacyToRole: () => legacyToRole,
+  makeSendShareEmail: () => makeSendShareEmail,
+  maxRole: () => maxRole,
+  normalizeStatus: () => normalizeStatus,
+  resourceTypeLabel: () => resourceTypeLabel,
+  roleAtLeast: () => roleAtLeast,
+  roleLabel: () => roleLabel,
+  roleToLegacy: () => roleToLegacy
+});
+
+// src/sharing/types.ts
+var ShareVisibility = /* @__PURE__ */ (function(ShareVisibility2) {
+  ShareVisibility2["PRIVATE"] = "PRIVATE";
+  ShareVisibility2["SHARED_WITH_USERS"] = "SHARED_WITH_USERS";
+  ShareVisibility2["SHARED_WITH_VIBE"] = "SHARED_WITH_VIBE";
+  ShareVisibility2["PUBLIC_LINK"] = "PUBLIC_LINK";
+  return ShareVisibility2;
+})({});
+var ShareRole = /* @__PURE__ */ (function(ShareRole2) {
+  ShareRole2["VIEWER"] = "VIEWER";
+  ShareRole2["COMMENTER"] = "COMMENTER";
+  ShareRole2["EDITOR"] = "EDITOR";
+  ShareRole2["MANAGER"] = "MANAGER";
+  return ShareRole2;
+})({});
+var ShareStatus = /* @__PURE__ */ (function(ShareStatus2) {
+  ShareStatus2["PENDING"] = "PENDING";
+  ShareStatus2["ACCEPTED"] = "ACCEPTED";
+  ShareStatus2["REVOKED"] = "REVOKED";
+  ShareStatus2["EXPIRED"] = "EXPIRED";
+  return ShareStatus2;
+})({});
+var ROLE_ORDER = {
+  ["VIEWER"]: 0,
+  ["COMMENTER"]: 1,
+  ["EDITOR"]: 2,
+  ["MANAGER"]: 3
+};
+function roleAtLeast(role, required) {
+  return ROLE_ORDER[role] >= ROLE_ORDER[required];
+}
+__name(roleAtLeast, "roleAtLeast");
+function maxRole(a, b) {
+  return ROLE_ORDER[a] >= ROLE_ORDER[b] ? a : b;
+}
+__name(maxRole, "maxRole");
+var ROLE_CAPABILITIES = {
+  ["VIEWER"]: {
+    canView: true,
+    canComment: false,
+    canEdit: false,
+    canManage: false,
+    canExecute: false
+  },
+  ["COMMENTER"]: {
+    canView: true,
+    canComment: true,
+    canEdit: false,
+    canManage: false,
+    canExecute: false
+  },
+  ["EDITOR"]: {
+    canView: true,
+    canComment: true,
+    canEdit: true,
+    canManage: false,
+    canExecute: true
+  },
+  ["MANAGER"]: {
+    canView: true,
+    canComment: true,
+    canEdit: true,
+    canManage: true,
+    canExecute: true
+  }
+};
+function capabilitiesFor(role) {
+  return ROLE_CAPABILITIES[role];
+}
+__name(capabilitiesFor, "capabilitiesFor");
+var RESOURCE_CAPABILITY_MAP = {
+  session: {
+    ["VIEWER"]: "VIEW",
+    ["COMMENTER"]: "VIEW",
+    ["EDITOR"]: "INTERACT",
+    ["MANAGER"]: "INTERACT"
+  },
+  vibedeck: {
+    ["VIEWER"]: "VIEW",
+    ["COMMENTER"]: "VIEW",
+    ["EDITOR"]: "EXECUTE",
+    ["MANAGER"]: "EXECUTE"
+  },
+  file: {
+    ["VIEWER"]: "VIEW",
+    ["COMMENTER"]: "COMMENT",
+    ["EDITOR"]: "EDIT",
+    ["MANAGER"]: "EDIT"
+  },
+  folder: {
+    ["VIEWER"]: "VIEW",
+    ["COMMENTER"]: "COMMENT",
+    ["EDITOR"]: "EDIT",
+    ["MANAGER"]: "EDIT"
+  }
+};
+function roleToLegacy(resourceType, role) {
+  return RESOURCE_CAPABILITY_MAP[resourceType]?.[role] ?? role;
+}
+__name(roleToLegacy, "roleToLegacy");
+function legacyToRole(resourceType, legacy) {
+  const table = RESOURCE_CAPABILITY_MAP[resourceType];
+  if (table) {
+    for (const role of [
+      "VIEWER",
+      "COMMENTER",
+      "EDITOR",
+      "MANAGER"
+    ]) {
+      if (table[role] === legacy) return role;
+    }
+  }
+  switch (legacy.toUpperCase()) {
+    case "MANAGER":
+    case "OWNER":
+    case "ADMIN":
+      return "MANAGER";
+    case "EDITOR":
+    case "EDIT":
+    case "INTERACT":
+    case "EXECUTE":
+    case "WRITE":
+      return "EDITOR";
+    case "COMMENTER":
+    case "COMMENT":
+      return "COMMENTER";
+    default:
+      return "VIEWER";
+  }
+}
+__name(legacyToRole, "legacyToRole");
+function normalizeStatus(status) {
+  const upper = status.toUpperCase();
+  if (upper === "ACTIVE") return "ACCEPTED";
+  if (upper in ShareStatus) return upper;
+  return "PENDING";
+}
+__name(normalizeStatus, "normalizeStatus");
+var ACTIVE_STATUSES = [
+  ShareStatus.ACCEPTED
+];
+var DENY = {
+  allowed: false,
+  effectiveRole: null,
+  via: "none"
+};
+function notFound(message = "Not found") {
+  return new GraphQLError(message, {
+    extensions: {
+      code: "NOT_FOUND"
+    }
+  });
+}
+__name(notFound, "notFound");
+function forbidden(message = "Forbidden") {
+  return new GraphQLError(message, {
+    extensions: {
+      code: "FORBIDDEN"
+    }
+  });
+}
+__name(forbidden, "forbidden");
+function badRequest(message) {
+  return new GraphQLError(message, {
+    extensions: {
+      code: "BAD_REQUEST"
+    }
+  });
+}
+__name(badRequest, "badRequest");
+function generateToken() {
+  return randomBytes(32).toString("hex");
+}
+__name(generateToken, "generateToken");
+function emailsMatch(a, b) {
+  return !!a && !!b && a.trim().toLowerCase() === b.trim().toLowerCase();
+}
+__name(emailsMatch, "emailsMatch");
+function pickHighestRole(candidates) {
+  let best = null;
+  for (const c of candidates) {
+    if (!best || maxRole(best.role, c.role) === c.role && c.role !== best.role) best = c;
+  }
+  return best;
+}
+__name(pickHighestRole, "pickHighestRole");
+var ShareService = class {
+  static {
+    __name(this, "ShareService");
+  }
+  prisma;
+  resourceType;
+  workspaceId;
+  deps;
+  sharedWithVibeRole;
+  requireWorkspaceMember;
+  constructor(config) {
+    this.prisma = config.prisma;
+    this.resourceType = config.resourceType;
+    this.workspaceId = config.workspaceId;
+    this.deps = config.deps;
+    this.sharedWithVibeRole = config.options?.sharedWithVibeRole ?? ShareRole.VIEWER;
+    this.requireWorkspaceMember = config.options?.requireWorkspaceMember ?? true;
+  }
+  // -------------------------------------------------------------------------
+  // Access decisions
+  // -------------------------------------------------------------------------
+  /**
+  * Resolve the EFFECTIVE access of `actorId` on `resourceId`.
+  *
+  * Default-DENY. Considers (highest wins): owner ⇒ MANAGER, an active
+  * PUBLIC_LINK grant ⇒ its role, SHARED_WITH_VIBE + hasVibeAccess ⇒ baseline,
+  * an ACCEPTED (never PENDING) non-expired SHARED_WITH_USERS grant ⇒ its role.
+  * Fails CLOSED if a dependency throws.
+  */
+  async resolveAccess(actorId, resourceId) {
+    try {
+      const meta = await this.deps.loadResourceMeta(resourceId);
+      if (!meta) return DENY;
+      if (actorId && meta.ownerId === actorId) {
+        return {
+          allowed: true,
+          effectiveRole: ShareRole.MANAGER,
+          via: "owner"
+        };
+      }
+      const candidates = [];
+      if (meta.visibility === ShareVisibility.SHARED_WITH_VIBE && meta.vibeId && actorId) {
+        if (await this.deps.hasVibeAccess(actorId, meta.vibeId, this.workspaceId)) {
+          candidates.push({
+            role: this.sharedWithVibeRole,
+            via: "vibe"
+          });
+        }
+      }
+      for (const grant of await this.queryActiveAccessGrants(actorId, resourceId)) {
+        const isPublic = grant.visibility === ShareVisibility.PUBLIC_LINK;
+        const isMyUserGrant = grant.visibility === ShareVisibility.SHARED_WITH_USERS && grant.granteeUserId === actorId;
+        if (isPublic) candidates.push({
+          role: grant.role,
+          via: "public_link"
+        });
+        else if (isMyUserGrant) candidates.push({
+          role: grant.role,
+          via: "user_grant"
+        });
+      }
+      const best = pickHighestRole(candidates);
+      if (!best) return DENY;
+      return {
+        allowed: true,
+        effectiveRole: best.role,
+        via: best.via
+      };
+    } catch (err) {
+      logger.warn("[ShareService] resolveAccess failed; denying", {
+        resourceType: this.resourceType,
+        resourceId,
+        err
+      });
+      return DENY;
+    }
+  }
+  /** Active (non-expired) PUBLIC_LINK grants + this actor's SHARED_WITH_USERS grants. */
+  async queryActiveAccessGrants(actorId, resourceId) {
+    return this.prisma.findMany({
+      where: {
+        resourceType: this.resourceType,
+        resourceId,
+        deletedAt: null,
+        status: {
+          in: [
+            ...ACTIVE_STATUSES
+          ]
+        },
+        OR: [
+          {
+            visibility: ShareVisibility.PUBLIC_LINK
+          },
+          ...actorId ? [
+            {
+              granteeUserId: actorId,
+              visibility: ShareVisibility.SHARED_WITH_USERS
+            }
+          ] : []
+        ],
+        AND: [
+          {
+            OR: [
+              {
+                expiresAt: null
+              },
+              {
+                expiresAt: {
+                  gt: /* @__PURE__ */ new Date()
+                }
+              }
+            ]
+          }
+        ]
+      }
+    });
+  }
+  /** True if `actorId` may act on `resourceId` at >= `requiredRole`. */
+  async canAccess(actorId, resourceId, requiredRole) {
+    const result = await this.resolveAccess(actorId, resourceId);
+    return result.allowed && result.effectiveRole !== null && roleAtLeast(result.effectiveRole, requiredRole);
+  }
+  /** Assert >= requiredRole; throws NOT_FOUND (read) / FORBIDDEN (mutate) otherwise. */
+  async assertAccess(actorId, resourceId, requiredRole, mode = "read") {
+    if (await this.canAccess(actorId, resourceId, requiredRole)) return;
+    throw mode === "read" ? notFound() : forbidden("You do not have permission to perform this action");
+  }
+  // -------------------------------------------------------------------------
+  // Share creation
+  // -------------------------------------------------------------------------
+  /** Invite a specific person by email (PENDING + token + email). */
+  async createUserShare(actor, input) {
+    const meta = await this.deps.loadResourceMeta(input.resourceId);
+    if (!meta) throw notFound("Resource not found");
+    await this.assertAccess(actor.id, input.resourceId, ShareRole.MANAGER, "mutate");
+    const email = input.granteeEmail.trim().toLowerCase();
+    if (!email) throw badRequest("A recipient email is required");
+    const granteeUserId = await this.deps.resolveUserByEmail(email);
+    if (granteeUserId && granteeUserId === actor.id) {
+      throw badRequest("You cannot share a resource with yourself");
+    }
+    if (granteeUserId && this.requireWorkspaceMember) {
+      const isMember = await this.deps.isWorkspaceMember(granteeUserId, this.workspaceId);
+      if (isMember === false) {
+        throw forbidden("You can only share with members of this workspace");
+      }
+    }
+    const existing = await this.prisma.findFirst({
+      where: {
+        resourceType: this.resourceType,
+        resourceId: input.resourceId,
+        deletedAt: null,
+        status: {
+          in: [
+            ShareStatus.PENDING,
+            ShareStatus.ACCEPTED
+          ]
+        },
+        OR: [
+          ...granteeUserId ? [
+            {
+              granteeUserId
+            }
+          ] : [],
+          {
+            granteeEmail: email
+          }
+        ]
+      }
+    });
+    let grant;
+    if (existing) {
+      grant = await this.prisma.update({
+        where: {
+          id: existing.id
+        },
+        data: {
+          role: input.role,
+          message: input.message ?? null,
+          expiresAt: input.expiresAt ?? null,
+          ...granteeUserId && !existing.granteeUserId ? {
+            granteeUserId
+          } : {}
+        }
+      });
+    } else {
+      grant = await this.prisma.create({
+        data: {
+          workspaceId: this.workspaceId,
+          resourceType: this.resourceType,
+          resourceId: input.resourceId,
+          granteeUserId: granteeUserId ?? null,
+          granteeEmail: email,
+          role: input.role,
+          visibility: ShareVisibility.SHARED_WITH_USERS,
+          status: ShareStatus.PENDING,
+          token: generateToken(),
+          expiresAt: input.expiresAt ?? null,
+          message: input.message ?? null,
+          createdBy: actor.id,
+          onBehalfOf: actor.id
+        }
+      });
+    }
+    await this.fireShareEmail(actor, grant, meta.name);
+    return grant;
+  }
+  /** Create an immediately-active public link (anyone with the URL). */
+  async createLinkShare(actor, input) {
+    const meta = await this.deps.loadResourceMeta(input.resourceId);
+    if (!meta) throw notFound("Resource not found");
+    await this.assertAccess(actor.id, input.resourceId, ShareRole.MANAGER, "mutate");
+    return this.prisma.create({
+      data: {
+        workspaceId: this.workspaceId,
+        resourceType: this.resourceType,
+        resourceId: input.resourceId,
+        granteeUserId: null,
+        granteeEmail: null,
+        role: input.role,
+        visibility: ShareVisibility.PUBLIC_LINK,
+        status: ShareStatus.ACCEPTED,
+        token: generateToken(),
+        expiresAt: input.expiresAt ?? null,
+        message: null,
+        createdBy: actor.id,
+        onBehalfOf: actor.id
+      }
+    });
+  }
+  // -------------------------------------------------------------------------
+  // Accept / decline
+  // -------------------------------------------------------------------------
+  /** Explicitly accept a SHARED_WITH_USERS invite. Idempotent. */
+  async acceptShare(token, actor) {
+    const grant = await this.findActiveByToken(token);
+    if (!grant) throw notFound("This share link is invalid or has expired");
+    if (grant.visibility === ShareVisibility.PUBLIC_LINK) {
+      return grant;
+    }
+    const idMatches = !!grant.granteeUserId && grant.granteeUserId === actor.id;
+    const emailMatches = emailsMatch(grant.granteeEmail, actor.email);
+    if (!idMatches && !emailMatches) {
+      throw forbidden("This invitation was sent to a different account");
+    }
+    if (grant.status === ShareStatus.ACCEPTED) {
+      if (!grant.granteeUserId) {
+        return this.prisma.update({
+          where: {
+            id: grant.id
+          },
+          data: {
+            granteeUserId: actor.id
+          }
+        });
+      }
+      return grant;
+    }
+    const now = /* @__PURE__ */ new Date();
+    const res = await this.prisma.updateMany({
+      where: {
+        id: grant.id,
+        status: ShareStatus.PENDING
+      },
+      data: {
+        status: ShareStatus.ACCEPTED,
+        acceptedAt: now,
+        acceptedBy: actor.id,
+        granteeUserId: actor.id
+      }
+    });
+    if (res.count === 0) {
+      const fresh = await this.prisma.findFirst({
+        where: {
+          id: grant.id
+        }
+      });
+      if (fresh) return fresh;
+    }
+    const updated = await this.prisma.findFirst({
+      where: {
+        id: grant.id
+      }
+    });
+    if (!updated) throw notFound();
+    return updated;
+  }
+  /** Decline an invite (marks it REVOKED). */
+  async declineShare(token, actor) {
+    const grant = await this.findActiveByToken(token);
+    if (!grant) return false;
+    const idMatches = !!grant.granteeUserId && grant.granteeUserId === actor.id;
+    const emailMatches = emailsMatch(grant.granteeEmail, actor.email);
+    if (!idMatches && !emailMatches) throw forbidden("This invitation was sent to a different account");
+    await this.prisma.update({
+      where: {
+        id: grant.id
+      },
+      data: {
+        status: ShareStatus.REVOKED,
+        revokedAt: /* @__PURE__ */ new Date(),
+        revokedBy: actor.id
+      }
+    });
+    return true;
+  }
+  /** Public preview of a grant by token (safe fields only — never the resource body). */
+  async shareGrantByToken(token) {
+    return this.findActiveByToken(token);
+  }
+  // -------------------------------------------------------------------------
+  // Management
+  // -------------------------------------------------------------------------
+  /** Revoke a grant or link. Owner/MANAGER only. */
+  async revoke(grantId, actor) {
+    const grant = await this.prisma.findFirst({
+      where: {
+        id: grantId,
+        resourceType: this.resourceType
+      }
+    });
+    if (!grant || grant.deletedAt) throw notFound();
+    await this.assertAccess(actor.id, grant.resourceId, ShareRole.MANAGER, "mutate");
+    return this.prisma.update({
+      where: {
+        id: grantId
+      },
+      data: {
+        status: ShareStatus.REVOKED,
+        revokedAt: /* @__PURE__ */ new Date(),
+        revokedBy: actor.id
+      }
+    });
+  }
+  /** Change the role on a grant. Owner/MANAGER only. */
+  async updateRole(grantId, role, actor) {
+    const grant = await this.prisma.findFirst({
+      where: {
+        id: grantId,
+        resourceType: this.resourceType
+      }
+    });
+    if (!grant || grant.deletedAt) throw notFound();
+    await this.assertAccess(actor.id, grant.resourceId, ShareRole.MANAGER, "mutate");
+    return this.prisma.update({
+      where: {
+        id: grantId
+      },
+      data: {
+        role
+      }
+    });
+  }
+  // -------------------------------------------------------------------------
+  // Reads
+  // -------------------------------------------------------------------------
+  /** All active grants on a resource (caller must be owner/MANAGER — gate in resolver). */
+  async resourceShares(resourceId) {
+    return this.prisma.findMany({
+      where: {
+        resourceType: this.resourceType,
+        resourceId,
+        deletedAt: null,
+        status: {
+          in: [
+            ShareStatus.PENDING,
+            ShareStatus.ACCEPTED
+          ]
+        }
+      },
+      orderBy: {
+        createdAt: "desc"
+      }
+    });
+  }
+  /** Grants where the actor is the (accepted-or-pending) grantee. */
+  async sharesSharedWithMe(actorId, opts) {
+    return this.prisma.findMany({
+      where: {
+        ...opts?.resourceType ? {
+          resourceType: opts.resourceType
+        } : {},
+        granteeUserId: actorId,
+        deletedAt: null,
+        status: ShareStatus.ACCEPTED,
+        OR: [
+          {
+            expiresAt: null
+          },
+          {
+            expiresAt: {
+              gt: /* @__PURE__ */ new Date()
+            }
+          }
+        ]
+      },
+      orderBy: {
+        acceptedAt: "desc"
+      },
+      take: opts?.take,
+      skip: opts?.skip
+    });
+  }
+  /**
+  * Resource ids the actor can see via an ACCEPTED user grant — for narrowing
+  * list resolvers (`WHERE id IN (...)`).
+  */
+  async listAccessibleResourceIds(actorId) {
+    const grants = await this.prisma.findMany({
+      where: {
+        resourceType: this.resourceType,
+        granteeUserId: actorId,
+        deletedAt: null,
+        status: ShareStatus.ACCEPTED,
+        visibility: ShareVisibility.SHARED_WITH_USERS,
+        OR: [
+          {
+            expiresAt: null
+          },
+          {
+            expiresAt: {
+              gt: /* @__PURE__ */ new Date()
+            }
+          }
+        ]
+      }
+    });
+    return Array.from(new Set(grants.map((g) => g.resourceId)));
+  }
+  /** Resource ids with an active public link — for list narrowing. */
+  async listPublicResourceIds() {
+    const grants = await this.prisma.findMany({
+      where: {
+        resourceType: this.resourceType,
+        deletedAt: null,
+        status: {
+          in: [
+            ...ACTIVE_STATUSES
+          ]
+        },
+        visibility: ShareVisibility.PUBLIC_LINK,
+        OR: [
+          {
+            expiresAt: null
+          },
+          {
+            expiresAt: {
+              gt: /* @__PURE__ */ new Date()
+            }
+          }
+        ]
+      }
+    });
+    return Array.from(new Set(grants.map((g) => g.resourceId)));
+  }
+  /** Increment access analytics (best-effort). */
+  async touchAccess(grantId) {
+    try {
+      await this.prisma.update({
+        where: {
+          id: grantId
+        },
+        data: {
+          lastAccessAt: /* @__PURE__ */ new Date(),
+          accessCount: {
+            increment: 1
+          }
+        }
+      });
+    } catch (err) {
+      logger.debug("[ShareService] touchAccess failed", {
+        grantId,
+        err
+      });
+    }
+  }
+  // -------------------------------------------------------------------------
+  // Internals
+  // -------------------------------------------------------------------------
+  async findActiveByToken(token) {
+    if (!token) return null;
+    const grant = await this.prisma.findFirst({
+      where: {
+        token,
+        deletedAt: null
+      }
+    });
+    if (!grant) return null;
+    if (grant.status === ShareStatus.REVOKED) return null;
+    if (grant.expiresAt && grant.expiresAt.getTime() <= Date.now()) return null;
+    return grant;
+  }
+  async fireShareEmail(actor, grant, resourceName) {
+    if (!grant.token) return;
+    try {
+      await this.deps.sendShareEmail({
+        recipientEmail: grant.granteeEmail,
+        recipientUserId: grant.granteeUserId,
+        resourceType: this.resourceType,
+        resourceName,
+        role: grant.role,
+        acceptUrl: this.deps.buildAcceptUrl(grant.token),
+        message: grant.message,
+        sharerName: actor.name ?? null,
+        idempotencyKey: grant.id
+      });
+    } catch (err) {
+      logger.warn("[ShareService] share email failed; grant still created", {
+        grantId: grant.id,
+        resourceType: this.resourceType,
+        err
+      });
+    }
+  }
+};
+
+// src/sharing/email.ts
+var SHARE_EMAIL_TEMPLATE_SLUG = "resource-shared";
+var RESOURCE_TYPE_LABELS = {
+  session: "terminal session",
+  vibe: "Vibe",
+  vibedeck: "VibeDeck",
+  note: "note",
+  aiprompt: "AI prompt",
+  aicontext: "AI context",
+  instructionfile: "instruction file",
+  tunnel: "tunnel",
+  action: "action",
+  file: "file",
+  folder: "folder",
+  conversation: "conversation",
+  catalog: "catalog",
+  component: "component",
+  template: "template",
+  docs: "docs site"
+};
+function resourceTypeLabel(resourceType) {
+  return RESOURCE_TYPE_LABELS[resourceType] ?? resourceType;
+}
+__name(resourceTypeLabel, "resourceTypeLabel");
+var ROLE_LABELS = {
+  [ShareRole.VIEWER]: "Viewer",
+  [ShareRole.COMMENTER]: "Commenter",
+  [ShareRole.EDITOR]: "Editor",
+  [ShareRole.MANAGER]: "Manager"
+};
+function roleLabel(role) {
+  return ROLE_LABELS[role];
+}
+__name(roleLabel, "roleLabel");
+function buildShareEmailVariables(args) {
+  return {
+    sharerName: args.sharerName ?? "A teammate",
+    resourceType: resourceTypeLabel(args.resourceType),
+    resourceName: args.resourceName,
+    roleLabel: roleLabel(args.role),
+    acceptUrl: args.acceptUrl,
+    message: args.message ?? ""
+  };
+}
+__name(buildShareEmailVariables, "buildShareEmailVariables");
+function makeSendShareEmail(notifier) {
+  return async (args) => {
+    const recipient = {};
+    if (args.recipientEmail) recipient.email = args.recipientEmail;
+    if (args.recipientUserId) recipient.userId = args.recipientUserId;
+    if (!recipient.email && !recipient.userId) {
+      logger.warn("[ShareEmail] no addressable recipient; skipping", {
+        idempotencyKey: args.idempotencyKey
+      });
+      return;
+    }
+    logger.info("[ShareEmail] Sending resource-shared", {
+      templateSlug: SHARE_EMAIL_TEMPLATE_SLUG,
+      resourceType: args.resourceType,
+      idempotencyKey: args.idempotencyKey
+    });
+    await notifier.sendWithTemplate({
+      templateSlug: SHARE_EMAIL_TEMPLATE_SLUG,
+      variables: buildShareEmailVariables(args),
+      recipient
+    });
+  };
+}
+__name(makeSendShareEmail, "makeSendShareEmail");
+
+// src/sharing/sdl.ts
+var SHARE_GRANT_SDL = (
+  /* GraphQL */
+  `
+  enum ShareRole {
+    VIEWER
+    COMMENTER
+    EDITOR
+    MANAGER
+  }
+
+  enum ShareGrantVisibility {
+    PRIVATE
+    SHARED_WITH_USERS
+    SHARED_WITH_VIBE
+    PUBLIC_LINK
+  }
+
+  enum ShareGrantStatus {
+    PENDING
+    ACCEPTED
+    REVOKED
+    EXPIRED
+  }
+
+  type ShareCapabilities {
+    canView: Boolean!
+    canComment: Boolean!
+    canEdit: Boolean!
+    canManage: Boolean!
+    canExecute: Boolean!
+  }
+
+  type ShareGrant @key(fields: "id") {
+    id: ID!
+    resourceType: String!
+    resourceId: ID!
+    granteeUserId: ID
+    granteeEmail: String
+    role: ShareRole!
+    visibility: ShareGrantVisibility!
+    status: ShareGrantStatus!
+    expiresAt: DateTime
+    message: String
+    createdBy: ID!
+    acceptedAt: DateTime
+    createdAt: DateTime!
+    "Public accept/link URL (present for invites and public links)."
+    shareUrl: String
+    "Capabilities implied by this grant's role."
+    capabilities: ShareCapabilities!
+  }
+
+  type ShareGrantList {
+    items: [ShareGrant!]!
+    total: Int!
+  }
+
+  "Safe, pre-login preview of a share invitation."
+  type ShareGrantPreview {
+    id: ID!
+    resourceType: String!
+    resourceName: String
+    role: ShareRole!
+    visibility: ShareGrantVisibility!
+    status: ShareGrantStatus!
+    sharerName: String
+    expiresAt: DateTime
+  }
+
+  input ShareEntityInput {
+    resourceId: ID!
+    email: String!
+    role: ShareRole!
+    message: String
+    expiresAt: DateTime
+  }
+
+  input UpdateShareRoleInput {
+    resourceId: ID!
+    shareId: ID!
+    role: ShareRole!
+  }
+
+  input RevokeShareInput {
+    resourceId: ID!
+    shareId: ID!
+  }
+
+  input CreateShareLinkInput {
+    resourceId: ID!
+    role: ShareRole!
+    expiresAt: DateTime
+  }
+
+  extend type Query {
+    "Pre-login preview of a share invite by token."
+    shareGrantByToken(token: String!): ShareGrantPreview @rbac(public: true)
+    "Grants where the current user is the accepted grantee."
+    sharesSharedWithMe(resourceType: String, pagination: PaginationInput): ShareGrantList! @rbac(scopeType: "self")
+  }
+
+  extend type Mutation {
+    "Accept a share invitation (recipient identified by the opaque token + email/id)."
+    acceptShare(token: String!): ShareGrant! @rbac(public: true)
+    "Decline a share invitation."
+    declineShare(token: String!): Boolean! @rbac(public: true)
+  }
+`
+);
+function buildPerEntityShareSdl(entity, rbacResource) {
+  return (
+    /* GraphQL */
+    `
+extend type Mutation {
+  share${entity}(input: ShareEntityInput!): ShareGrant!
+    @rbac(action: "share", resource: "${rbacResource}", resourceIdArg: "input.resourceId", scopeType: "wspace")
+  revoke${entity}Share(input: RevokeShareInput!): ShareGrant!
+    @rbac(action: "share", resource: "${rbacResource}", resourceIdArg: "input.resourceId", scopeType: "wspace")
+  update${entity}ShareRole(input: UpdateShareRoleInput!): ShareGrant!
+    @rbac(action: "share", resource: "${rbacResource}", resourceIdArg: "input.resourceId", scopeType: "wspace")
+  create${entity}ShareLink(input: CreateShareLinkInput!): ShareGrant!
+    @rbac(action: "share", resource: "${rbacResource}", resourceIdArg: "input.resourceId", scopeType: "wspace")
+  revoke${entity}ShareLink(input: RevokeShareInput!): ShareGrant!
+    @rbac(action: "share", resource: "${rbacResource}", resourceIdArg: "input.resourceId", scopeType: "wspace")
+}
+`
+  );
+}
+__name(buildPerEntityShareSdl, "buildPerEntityShareSdl");
+
+// src/sharing/prisma-fragment.ts
+var SHARE_GRANT_PRISMA = `
+enum ShareRole {
+  VIEWER
+  COMMENTER
+  EDITOR
+  MANAGER
+}
+
+enum ShareGrantVisibility {
+  PRIVATE
+  SHARED_WITH_USERS
+  SHARED_WITH_VIBE
+  PUBLIC_LINK
+}
+
+enum ShareGrantStatus {
+  PENDING
+  ACCEPTED
+  REVOKED
+  EXPIRED
+}
+
+/// Generic resource share grant. \`resourceType\` discriminates the entity; one
+/// row per (resource, recipient) or per public link. See @burdenoff/be-sdk/sharing.
+model ShareGrant {
+  id            String                @id @default(uuid())
+  workspaceId   String                @map("workspace_id") @db.VarChar(255)
+  resourceType  String                @map("resource_type") @db.VarChar(64)
+  resourceId    String                @map("resource_id") @db.VarChar(255)
+  granteeUserId String?               @map("grantee_user_id") @db.VarChar(255)
+  granteeEmail  String?               @map("grantee_email") @db.VarChar(320)
+  role          ShareRole             @default(VIEWER)
+  visibility    ShareGrantVisibility  @default(SHARED_WITH_USERS)
+  status        ShareGrantStatus      @default(PENDING)
+  token         String?               @unique @db.VarChar(64)
+  expiresAt     DateTime?             @map("expires_at")
+  message       String?               @db.Text
+  createdBy     String                @map("created_by") @db.VarChar(255)
+  onBehalfOf    String                @map("on_behalf_of") @db.VarChar(255)
+  acceptedAt    DateTime?             @map("accepted_at")
+  acceptedBy    String?               @map("accepted_by") @db.VarChar(255)
+  revokedAt     DateTime?             @map("revoked_at")
+  revokedBy     String?               @map("revoked_by") @db.VarChar(255)
+  lastAccessAt  DateTime?             @map("last_access_at")
+  accessCount   Int                   @default(0) @map("access_count")
+  context       Json?
+  createdAt     DateTime              @default(now()) @map("created_at")
+  updatedAt     DateTime              @updatedAt @map("updated_at")
+  deletedAt     DateTime?             @map("deleted_at")
+
+  @@index([workspaceId])
+  @@index([resourceType, resourceId])
+  @@index([granteeUserId])
+  @@index([granteeEmail])
+  @@index([status])
+  @@index([expiresAt])
+  @@index([resourceType, resourceId, status])
+  @@map("share_grants")
+}
+`;
+var SHARE_GRANT_PARTIAL_UNIQUE_SQL = `
+CREATE UNIQUE INDEX IF NOT EXISTS share_grants_active_user_uq
+  ON share_grants (resource_type, resource_id, grantee_user_id)
+  WHERE status IN ('PENDING', 'ACCEPTED') AND deleted_at IS NULL AND grantee_user_id IS NOT NULL;
+`;
+
+export { RESOURCE_CAPABILITY_MAP, RESOURCE_TYPE_LABELS, ROLE_CAPABILITIES, ROLE_ORDER, SHARE_EMAIL_TEMPLATE_SLUG, SHARE_GRANT_PARTIAL_UNIQUE_SQL, SHARE_GRANT_PRISMA, SHARE_GRANT_SDL, ShareRole, ShareService, ShareStatus, ShareVisibility, buildPerEntityShareSdl, buildShareEmailVariables, capabilitiesFor, legacyToRole, makeSendShareEmail, maxRole, normalizeStatus, resourceTypeLabel, roleAtLeast, roleLabel, roleToLegacy, sharing_exports };
+//# sourceMappingURL=chunk-XD5ZK727.js.map
+//# sourceMappingURL=chunk-XD5ZK727.js.map