@burdenoff/be-sdk 2026.611.1 → 2026.618.1

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
-import { B as BurdenoffGraphQLClient } from '../graphql-DH3L5Hj7.js';
-import { S as SDKContext } from '../index-Caqvetqq.js';
+import { B as BurdenoffGraphQLClient } from '../graphql-CNhiZ89U.js';
+import { S as SDKContext } from '../index-D9RN6jp1.js';
 import { G as GraphQLContext } from '../types-sKXodL2N.js';
 import 'graphql-request';
 import 'graphql';

package/dist/auth/index.js

@@ -1,7 +1,7 @@
-export { AuthCookieHelper, AuthModule } from '../chunk-KKCC3Z4I.js';
+export { AuthCookieHelper, AuthModule } from '../chunk-FKSMQLIV.js';
 import '../chunk-B7I4TABG.js';
-import '../chunk-O6RHB2YP.js';
-import '../chunk-HP6JTFNR.js';
+import '../chunk-SMGTXYFR.js';
+import '../chunk-YFOHAHZE.js';
 import '../chunk-CBZNP6RF.js';
 import '../chunk-XE4OXN2W.js';
 //# sourceMappingURL=index.js.map

package/dist/cache/index.d.ts

@@ -1,2 +1,2 @@
-export { B as BaseCacheConfig, a as BatchCacheOptions, C as CacheConfig, b as CacheEntry, c as CacheFactory, d as CacheHealthCheckResult, e as CacheOptions, f as CacheProviderType, g as CacheProviderTypeLiteral, h as CacheStatistics, I as ICache, j as ICacheProvider, M as MemcachedCacheConfig, k as MemoryCacheConfig, l as MemoryCacheProvider, P as PatternOptions, m as PatternResult, V as ValkeyCacheConfig, n as ValkeyGlideClient, o as ValkeyGlideConfig, p as ValkeyGlideProvider, q as closeAllCaches, r as createCache, s as getCache, t as getValkeyClient } from '../index-DBF8VqIf.js';
-import '../layer-CUu_cZ7d.js';
+export { B as BaseCacheConfig, a as BatchCacheOptions, C as CacheConfig, b as CacheEntry, c as CacheFactory, d as CacheHealthCheckResult, e as CacheOptions, f as CacheProviderType, g as CacheProviderTypeLiteral, h as CacheStatistics, I as ICache, j as ICacheProvider, M as MemcachedCacheConfig, k as MemoryCacheConfig, l as MemoryCacheProvider, P as PatternOptions, m as PatternResult, V as ValkeyCacheConfig, n as ValkeyGlideClient, o as ValkeyGlideConfig, p as ValkeyGlideProvider, q as closeAllCaches, r as createCache, s as getCache, t as getValkeyClient } from '../index-DkObbJD_.js';
+import '../layer-GNAVXBMf.js';

package/dist/cache/index.js

@@ -1,5 +1,5 @@
-export { CacheFactory, CacheProviderType, MemoryCacheProvider, ValkeyGlideProvider, closeAllCaches, createCache, getCache, getValkeyClient } from '../chunk-7NYCLQFJ.js';
-import '../chunk-HP6JTFNR.js';
+export { CacheFactory, CacheProviderType, MemoryCacheProvider, ValkeyGlideProvider, closeAllCaches, createCache, getCache, getValkeyClient } from '../chunk-UYE4IEPT.js';
+import '../chunk-YFOHAHZE.js';
 import '../chunk-CBZNP6RF.js';
 import '../chunk-XE4OXN2W.js';
 //# sourceMappingURL=index.js.map

package/dist/{chunk-ZRRLY7SM.js → chunk-5FEOFBQ4.js}

@@ -1,5 +1,5 @@
-import { GatewayClient } from './chunk-BJVXHIUV.js';
-import { LayerManager } from './chunk-GSEPF2B6.js';
+import { GatewayClient } from './chunk-N7UJFZQH.js';
+import { LayerManager } from './chunk-UIMPJNWC.js';
 import { logger } from './chunk-CBZNP6RF.js';
 import { __export, __name } from './chunk-XE4OXN2W.js';
 
@@ -237,5 +237,5 @@ async function initializeLayerStreams(config) {
 __name(initializeLayerStreams, "initializeLayerStreams");
 
 export { getSDKState, init_exports, initializeBurdenoffSDK, isSDKInitialized, resetSDK };
-//# sourceMappingURL=chunk-ZRRLY7SM.js.map
-//# sourceMappingURL=chunk-ZRRLY7SM.js.map
+//# sourceMappingURL=chunk-5FEOFBQ4.js.map
+//# sourceMappingURL=chunk-5FEOFBQ4.js.map

package/dist/{chunk-ZRRLY7SM.js.map → chunk-5FEOFBQ4.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/init/index.ts"],"names":["sdkState","isInitialized","initializeBurdenoffSDK","config","logger","warn","info","startTime","Date","now","initializeLogging","layerManager","gatewayClient","initializeLayer","prisma","initializeDatabase","valkey","initializeCache","eventPublisher","initializeEventQueue","layer","autoCreateStreams","initializeLayerStreams","graphSync","initializeGraphSync","clickhouse","initializeAnalytics","initializeObservability","graphSyncEnabled","graph","enabled","analyticsEnabled","analytics","observabilityEnabled","observability","metrics","layerAwareEnabled","duration","initializedState","type","serviceName","error","getSDKState","Error","isSDKInitialized","resetSDK","loggingConfig","logging","isDevelopment","app","nodeEnv","level","setLevel","console","setConsoleEnabled","format","database","url","maxConnections","enableQueryLogging","undefined","cacheConfig","cache","defaultTTL","_config","process","env","EventQueueFactory","publisher","createPublisherFromEnv","connect","message","String","note","eventsEnabled","productSource","streamName","syncInterval","batchSize","requestTimeout","openTelemetry","port","endpoint","samplingRate","LayerManager","serviceIdentity","GatewayClient","internalGatewayUrl","getInternalGatewayUrl","crossLayerGatewayUrl","getCrossLayerGatewayUrl","debug"],"mappings":";;;;;;AAAA,IAAA,YAAA,GAAA;;;;;;;AAkBA,IAAIA,QAAAA,GAAuC,IAAA;AAC3C,IAAIC,aAAAA,GAAgB,KAAA;AAsCpB,eAAsBC,uBAAuBC,MAAAA,EAA8B;AACzE,EAAA,IAAIF,iBAAiBD,QAAAA,EAAU;AAC7BI,IAAAA,MAAAA,CAAOC,KAAK,8DAAA,CAAA;AACZ,IAAA,OAAOL,QAAAA;AACT,EAAA;AAEAI,EAAAA,MAAAA,CAAOE,KAAK,2CAAA,CAAA;AACZ,EAAA,MAAMC,SAAAA,GAAYC,KAAKC,GAAAA,EAAG;AAE1B,EAAA,IAAI;AAEF,IAAA,MAAMC,kBAAkBP,MAAAA,CAAAA;AAGxB,IAAA,MAAM,EAAEQ,YAAAA,EAAcC,aAAAA,EAAa,GAAK,MAAMC,gBAAgBV,MAAAA,CAAAA;AAG9D,IAAA,MAAMW,MAAAA,GAAS,MAAMC,kBAAAA,CAAmBZ,MAAAA,CAAAA;AAGxC,IAAA,MAAMa,MAAAA,GAAS,MAAMC,eAAAA,CAAgBd,MAAAA,CAAAA;AAGrC,IAAA,MAAMe,cAAAA,GAAiB,MAAMC,oBAAAA,CAAqBhB,MAAAA,CAAAA;AAGlD,IAAA,IAAIA,MAAAA,CAAOiB,KAAAA,EAAOC,iBAAAA,KAAsB,KAAA,IAASlB,OAAOiB,KAAAA,EAAO;AAC7D,MAAA,MAAME,uBAAuBnB,MAAAA,CAAAA;AAC/B,IAAA;AAIA,IAAA,MAAMoB,SAAAA,GAAY,MAAMC,mBAAAA,CAAoBrB,MAAAA,CAAAA;AAG5C,IAAA,MAAMsB,UAAAA,GAAa,MAAMC,mBAAAA,CAAoBvB,MAAAA,CAAAA;AAG7C,IAAA,MAAMwB,wBAAwBxB,MAAAA,CAAAA;AAK9B,IAAA,KAAKoB,SAAAA;AACLvB,IAAAA,QAAAA,GAAW;AACTc,MAAAA,MAAAA;AACAE,MAAAA,MAAAA;AACAS,MAAAA,UAAAA;AACAP,MAAAA,cAAAA;AACAP,MAAAA,YAAAA;AACAC,MAAAA,aAAAA;MACAgB,gBAAAA,EAAkBzB,MAAAA,CAAO0B,OAAOC,OAAAA,IAAW,KAAA;MAC3CC,gBAAAA,EAAkB,CAAC,CAAC5B,MAAAA,CAAO6B,SAAAA,EAAWP,UAAAA;MACtCQ,oBAAAA,EAAsB9B,MAAAA,CAAO+B,aAAAA,EAAeC,OAAAA,EAASL,OAAAA,IAAW,KAAA;MAChEM,iBAAAA,EAAmB,CAAC,CAACjC,MAAAA,CAAOiB;AAC9B,KAAA;AAEAnB,IAAAA,aAAAA,GAAgB,IAAA;AAEhB,IAAA,MAAMoC,QAAAA,GAAW7B,IAAAA,CAAKC,GAAAA,EAAG,GAAKF,SAAAA;AAE9B,IAAA,MAAM+B,gBAAAA,GAAmBtC,QAAAA;AACzBI,IAAAA,MAAAA,CAAOE,IAAAA,CAAK,CAAA,2CAAA,EAA8C+B,QAAAA,CAAAA,EAAAA,CAAAA,EAAc;AACtET,MAAAA,gBAAAA,EAAkBU,gBAAAA,CAAiBV,gBAAAA;AACnCG,MAAAA,gBAAAA,EAAkBO,gBAAAA,CAAiBP,gBAAAA;AACnCE,MAAAA,oBAAAA,EAAsBK,gBAAAA,CAAiBL,oBAAAA;AACvCG,MAAAA,iBAAAA,EAAmBE,gBAAAA,CAAiBF,iBAAAA;AACpChB,MAAAA,KAAAA,EAAOjB,OAAOiB,KAAAA,EAAOmB,IAAAA;AACrBC,MAAAA,WAAAA,EAAarC,OAAOiB,KAAAA,EAAOoB;KAC7B,CAAA;AAEA,IAAA,OAAOF,gBAAAA;AACT,EAAA,CAAA,CAAA,OAASG,KAAAA,EAAO;AACdrC,IAAAA,MAAAA,CAAOqC,KAAAA,CAAM,wCAAwCA,KAAAA,CAAAA;AACrD,IAAA,MAAMA,KAAAA;AACR,EAAA;AACF;AA5EsBvC,MAAAA,CAAAA,sBAAAA,EAAAA,wBAAAA,CAAAA;AAkFf,SAASwC,WAAAA,GAAAA;AACd,EAAA,IAAI,CAACzC,aAAAA,IAAiB,CAACD,QAAAA,EAAU;AAC/B,IAAA,MAAM,IAAI2C,MAAM,2DAAA,CAAA;AAClB,EAAA;AACA,EAAA,OAAO3C,QAAAA;AACT;AALgB0C,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;AAUT,SAASE,gBAAAA,GAAAA;AACd,EAAA,OAAO3C,aAAAA;AACT;AAFgB2C,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAOhB,eAAsBC,QAAAA,GAAAA;AACpBzC,EAAAA,MAAAA,CAAOE,KAAK,mCAAA,CAAA;AAEZ,EAAA,IAAIN,QAAAA,EAAU;AAGZA,IAAAA,QAAAA,GAAW,IAAA;AACb,EAAA;AAEAC,EAAAA,aAAAA,GAAgB,KAAA;AAChBG,EAAAA,MAAAA,CAAOE,KAAK,4BAAA,CAAA;AACd;AAXsBuC,MAAAA,CAAAA,QAAAA,EAAAA,UAAAA,CAAAA;AAgBtB,eAAenC,kBAAkBP,MAAAA,EAA8B;AAC7DC,EAAAA,MAAAA,CAAOE,KAAK,mCAAA,CAAA;AAEZ,EAAA,MAAMwC,aAAAA,GAAgB3C,MAAAA,CAAO4C,OAAAA,IAAW,EAAC;AACzC,EAAA,MAAMC,aAAAA,GAAgB7C,MAAAA,CAAO8C,GAAAA,EAAKC,OAAAA,KAAY,aAAA;AAG9C,EAAA,MAAMC,KAAAA,GAAQL,cAAcK,KAAAA,IAAS,MAAA;AACrC/C,EAAAA,MAAAA,CAAOgD,SAASD,KAAAA,CAAAA;AAGhB,EAAA,MAAME,OAAAA,GAAUP,cAAcO,OAAAA,IAAW,IAAA;AACzCjD,EAAAA,MAAAA,CAAOkD,kBAAkBD,OAAAA,CAAAA;AAEzBjD,EAAAA,MAAAA,CAAOE,KAAK,+BAAA,EAAiC;AAC3C6C,IAAAA,KAAAA;AACAE,IAAAA,OAAAA;IACAE,MAAAA,EAAQT,aAAAA,CAAcS,MAAAA,KAAWP,aAAAA,GAAgB,QAAA,GAAW,MAAA;GAC9D,CAAA;AACF;AAnBetC,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAwBf,eAAeK,mBAAmBZ,MAAAA,EAA8B;AAC9DC,EAAAA,MAAAA,CAAOE,KAAK,qCAAA,CAAA;AAKZ,EAAA,IAAI,CAACH,MAAAA,CAAOqD,QAAAA,EAAUC,GAAAA,EAAK;AACzB,IAAA,MAAM,IAAId,MAAM,0BAAA,CAAA;AAClB,EAAA;AAEAvC,EAAAA,MAAAA,CAAOE,KAAK,6CAAA,EAA+C;IACzDoD,cAAAA,EAAgBvD,MAAAA,CAAOqD,SAASE,cAAAA,IAAkB,EAAA;IAClDC,kBAAAA,EAAoBxD,MAAAA,CAAOqD,SAASG,kBAAAA,IAAsB;GAC5D,CAAA;AAGA,EAAA,OAAOC,MAAAA;AACT;AAjBe7C,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA;AAsBf,eAAeE,gBAAgBd,MAAAA,EAA8B;AAC3D,EAAA,MAAM0D,WAAAA,GAAc1D,OAAO2D,KAAAA,EAAO9C,MAAAA;AAElC,EAAA,IAAI,CAAC6C,WAAAA,EAAa;AAChBzD,IAAAA,MAAAA,CAAOE,KAAK,2CAAA,CAAA;AACZ,IAAA,OAAOsD,MAAAA;AACT,EAAA;AAEAxD,EAAAA,MAAAA,CAAOE,KAAK,yCAAA,CAAA;AAIZF,EAAAA,MAAAA,CAAOE,KAAK,iDAAA,EAAmD;IAC7DmD,GAAAA,EAAKI,WAAAA,CAAYJ,MAAM,KAAA,GAAQG,MAAAA;AAC/BG,IAAAA,UAAAA,EAAYF,YAAYE,UAAAA,IAAc;GACxC,CAAA;AAEA,EAAA,OAAOH,MAAAA;AACT;AAlBe3C,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AA2Bf,eAAeE,qBAAqB6C,OAAAA,EAA+B;AACjE,EAAA,IAAI,CAACC,OAAAA,CAAQC,GAAAA,CAAI,WAAA,CAAA,EAAc;AAC7B9D,IAAAA,MAAAA,CAAOE,KAAK,yDAAA,CAAA;AACZ,IAAA,OAAOsD,MAAAA;AACT,EAAA;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,EAAEO,iBAAAA,EAAiB,GAAK,MAAM,OAAO,iCAAA,CAAA;AAC3C,IAAA,MAAMC,SAAAA,GAAYD,kBAAkBE,sBAAAA,EAAsB;AAC1D,IAAA,MAAMD,UAAUE,OAAAA,EAAO;AAEvBlE,IAAAA,MAAAA,CAAOE,KAAK,oDAAA,CAAA;AAEZ,IAAA,OAAO8D,SAAAA;AACT,EAAA,CAAA,CAAA,OAAS3B,KAAAA,EAAO;AACdrC,IAAAA,MAAAA,CAAOC,KAAK,wEAAA,EAA0E;AACpFoC,MAAAA,KAAAA,EAAOA,KAAAA,YAAiBE,KAAAA,GAAQF,KAAAA,CAAM8B,OAAAA,GAAUC,OAAO/B,KAAAA,CAAAA;MACvDgC,IAAAA,EAAM;KACR,CAAA;AACA,IAAA,OAAOb,MAAAA;AACT,EAAA;AACF;AArBezC,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AA+Bf,eAAeK,oBAAoBrB,MAAAA,EAA8B;AAC/D,EAAA,IAAI,CAACA,MAAAA,CAAO0B,KAAAA,EAAOC,OAAAA,EAAS;AAC1B1B,IAAAA,MAAAA,CAAOE,KAAK,6CAAA,CAAA;AACZ,IAAA,OAAOsD,MAAAA;AACT,EAAA;AAEAxD,EAAAA,MAAAA,CAAOE,KAAK,qDAAA,EAAuD;IACjEoE,aAAAA,EAAevE,MAAAA,CAAO0B,MAAM6C,aAAAA,IAAiB,IAAA;AAC7CC,IAAAA,aAAAA,EAAexE,OAAO0B,KAAAA,CAAM8C,aAAAA;IAC5BC,UAAAA,EAAYzE,MAAAA,CAAO0B,MAAM+C,UAAAA,IAAc,cAAA;IACvCC,YAAAA,EAAc1E,MAAAA,CAAO0B,MAAMgD,YAAAA,IAAgB,GAAA;IAC3CC,SAAAA,EAAW3E,MAAAA,CAAO0B,MAAMiD,SAAAA,IAAa;GACvC,CAAA;AAEA,EAAA,OAAOlB,MAAAA;AACT;AAfepC,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAoBf,eAAeE,oBAAoBvB,MAAAA,EAA8B;AAC/D,EAAA,IAAI,CAACA,MAAAA,CAAO6B,SAAAA,EAAWP,UAAAA,EAAY;AACjCrB,IAAAA,MAAAA,CAAOE,KAAK,+CAAA,CAAA;AACZ,IAAA,OAAOsD,MAAAA;AACT,EAAA;AAEAxD,EAAAA,MAAAA,CAAOE,KAAK,qDAAA,CAAA;AAIZF,EAAAA,MAAAA,CAAOE,KAAK,+CAAA,EAAiD;IAC3DmD,GAAAA,EAAKtD,MAAAA,CAAO6B,UAAUP,UAAAA,CAAWgC,GAAAA;IACjCD,QAAAA,EAAUrD,MAAAA,CAAO6B,UAAUP,UAAAA,CAAW+B,QAAAA;IACtCuB,cAAAA,EAAgB5E,MAAAA,CAAO6B,SAAAA,CAAUP,UAAAA,CAAWsD,cAAAA,IAAkB;GAChE,CAAA;AAEA,EAAA,OAAOnB,MAAAA;AACT;AAjBelC,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAsBf,eAAeC,wBAAwBxB,MAAAA,EAA8B;AACnE,EAAA,IAAI,CAACA,OAAO+B,aAAAA,EAAeC,OAAAA,EAASL,WAAW,CAAC3B,MAAAA,CAAO+B,aAAAA,EAAe8C,aAAAA,EAAelD,OAAAA,EAAS;AAC5F1B,IAAAA,MAAAA,CAAOE,KAAK,mDAAA,CAAA;AACZ,IAAA;AACF,EAAA;AAEAF,EAAAA,MAAAA,CAAOE,KAAK,0CAAA,CAAA;AAIZ,EAAA,IAAIH,MAAAA,CAAO+B,aAAAA,CAAcC,OAAAA,EAASL,OAAAA,EAAS;AACzC1B,IAAAA,MAAAA,CAAOE,KAAK,4CAAA,EAA8C;MACxD2E,IAAAA,EAAM9E,MAAAA,CAAO+B,aAAAA,CAAcC,OAAAA,CAAQ8C,IAAAA,IAAQ,IAAA;MAC3CC,QAAAA,EAAU/E,MAAAA,CAAO+B,aAAAA,CAAcC,OAAAA,CAAQ+C,QAAAA,IAAY;KACrD,CAAA;AACF,EAAA;AAEA,EAAA,IAAI/E,MAAAA,CAAO+B,aAAAA,CAAc8C,aAAAA,EAAelD,OAAAA,EAAS;AAC/C1B,IAAAA,MAAAA,CAAOE,KAAK,kDAAA,EAAoD;MAC9DkC,WAAAA,EAAarC,MAAAA,CAAO+B,cAAc8C,aAAAA,CAAcxC,WAAAA;MAChD2C,YAAAA,EAAchF,MAAAA,CAAO+B,aAAAA,CAAc8C,aAAAA,CAAcG,YAAAA,IAAgB;KACnE,CAAA;AACF,EAAA;AACF;AAvBexD,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AA4Bf,eAAed,gBACbV,MAAAA,EAA8B;AAE9B,EAAA,IAAI,CAACA,OAAOiB,KAAAA,EAAO;AACjBhB,IAAAA,MAAAA,CAAOE,KAAK,4EAAA,CAAA;AACZ,IAAA,OAAO,EAAC;AACV,EAAA;AAEAF,EAAAA,MAAAA,CAAOE,KAAK,0CAAA,EAA4C;AACtDc,IAAAA,KAAAA,EAAOjB,OAAOiB,KAAAA,CAAMmB,IAAAA;AACpBC,IAAAA,WAAAA,EAAarC,OAAOiB,KAAAA,CAAMoB;GAC5B,CAAA;AAGA,EAAA,MAAM7B,YAAAA,GAAe,IAAIyE,YAAAA,CAAa;AACpChE,IAAAA,KAAAA,EAAOjB,OAAOiB,KAAAA,CAAMmB,IAAAA;AACpBC,IAAAA,WAAAA,EAAarC,OAAOiB,KAAAA,CAAMoB,WAAAA;AAC1B6C,IAAAA,eAAAA,EAAiBlF,OAAOiB,KAAAA,CAAMiE;GAChC,CAAA;AAGA,EAAA,MAAMzE,aAAAA,GAAgB,IAAI0E,aAAAA,CAAc;AACtClE,IAAAA,KAAAA,EAAOjB,OAAOiB,KAAAA,CAAMmB,IAAAA;AACpBC,IAAAA,WAAAA,EAAarC,OAAOiB,KAAAA,CAAMoB,WAAAA;AAC1B6C,IAAAA,eAAAA,EAAiBlF,OAAOiB,KAAAA,CAAMiE,eAAAA;AAC9BE,IAAAA,kBAAAA,EAAoB5E,aAAa6E,qBAAAA,EAAqB;AACtDC,IAAAA,oBAAAA,EAAsB9E,aAAa+E,uBAAAA;GACrC,CAAA;AAEAtF,EAAAA,MAAAA,CAAOE,KAAK,sCAAA,EAAwC;AAClDc,IAAAA,KAAAA,EAAOjB,OAAOiB,KAAAA,CAAMmB,IAAAA;AACpBC,IAAAA,WAAAA,EAAarC,OAAOiB,KAAAA,CAAMoB,WAAAA;AAC1B+C,IAAAA,kBAAAA,EAAoB5E,aAAa6E,qBAAAA,EAAqB;AACtDC,IAAAA,oBAAAA,EAAsB9E,aAAa+E,uBAAAA;GACrC,CAAA;AAEA,EAAA,OAAO;AAAE/E,IAAAA,YAAAA;AAAcC,IAAAA;AAAc,GAAA;AACvC;AArCeC,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AA8Cf,eAAeS,uBAAuBnB,MAAAA,EAA8B;AAClE,EAAA,IAAI,CAACA,OAAOiB,KAAAA,EAAO;AACjB,IAAA;AACF,EAAA;AACAhB,EAAAA,MAAAA,CAAOuF,MAAM,gGAAA,EAAkG;AAC7GvE,IAAAA,KAAAA,EAAOjB,OAAOiB,KAAAA,CAAMmB;GACtB,CAAA;AACF;AAPejB,MAAAA,CAAAA,sBAAAA,EAAAA,wBAAAA,CAAAA","file":"chunk-ZRRLY7SM.js","sourcesContent":["/**\n * Burdenoff SDK Initialization Module\n *\n * Provides a unified initialization function for all state services\n * including database, cache, analytics, event queue, and graph sync.\n *\n * @module init\n * @category Initialization\n */\n\nimport { logger } from '../logger/index.js';\nimport { LayerManager } from '../layer/index.js';\nimport { GatewayClient } from '../gateway/index.js';\nimport type { BurdenoffSDKInitConfig, InitializedSDKState } from './types.js';\n\n/**\n * Global SDK state\n */\nlet sdkState: InitializedSDKState | null = null;\nlet isInitialized = false;\n\n/**\n * Initialize Burdenoff SDK with unified configuration\n *\n * This function initializes all configured state services in the correct order:\n * 1. Logging configuration\n * 2. Database (Prisma with PostgreSQL)\n * 3. Cache (Valkey)\n * 4. Event Queue (Redis Streams)\n * 5. Graph Sync (Redis Streams-based — Apache AGE writes happen inside wspace-graph-svc)\n * 6. Analytics (ClickHouse)\n * 7. Observability (Metrics, OpenTelemetry)\n *\n * @param config - SDK initialization configuration\n * @returns Initialized SDK state\n *\n * @example\n * ```typescript\n * import { initializeBurdenoffSDK } from '@burdenoff/be-sdk/init';\n *\n * const state = await initializeBurdenoffSDK({\n *   database: {\n *     url: process.env.DATABASE_URL!,\n *     maxConnections: 20,\n *   },\n *   graph: {\n *     enabled: true,\n *     eventsEnabled: true,\n *   },\n *   cache: {\n *     valkey: {\n *       url: process.env.VALKEY_URL!,\n *     },\n *   },\n * });\n * ```\n */\nexport async function initializeBurdenoffSDK(config: BurdenoffSDKInitConfig): Promise<InitializedSDKState> {\n  if (isInitialized && sdkState) {\n    logger.warn('[SDK Init] SDK already initialized, returning existing state');\n    return sdkState;\n  }\n\n  logger.info('[SDK Init] Starting SDK initialization...');\n  const startTime = Date.now();\n\n  try {\n    // 1. Configure logging\n    await initializeLogging(config);\n\n    // 2. Initialize layer manager (if configured)\n    const { layerManager, gatewayClient } = await initializeLayer(config);\n\n    // 3. Initialize database (required)\n    const prisma = await initializeDatabase(config);\n\n    // 4. Initialize cache (optional)\n    const valkey = await initializeCache(config);\n\n    // 5. Initialize event queue (optional) — Redis Streams via REDIS_URL\n    const eventPublisher = await initializeEventQueue(config);\n\n    // 6. Initialize layer streams (if layer configured)\n    if (config.layer?.autoCreateStreams !== false && config.layer) {\n      await initializeLayerStreams(config);\n    }\n\n    // 7. Initialize graph sync (optional) — publisher emits to Redis Streams,\n    //    never opens a graph-DB connection\n    const graphSync = await initializeGraphSync(config);\n\n    // 8. Initialize analytics (optional)\n    const clickhouse = await initializeAnalytics(config);\n\n    // 9. Initialize observability (optional)\n    await initializeObservability(config);\n\n    // Create SDK state\n    // graphSync is a publisher-side placeholder; services emit Redis Streams\n    // events and wspace-graph-svc owns the sole Apache AGE connection.\n    void graphSync;\n    sdkState = {\n      prisma,\n      valkey,\n      clickhouse,\n      eventPublisher,\n      layerManager,\n      gatewayClient,\n      graphSyncEnabled: config.graph?.enabled ?? false,\n      analyticsEnabled: !!config.analytics?.clickhouse,\n      observabilityEnabled: config.observability?.metrics?.enabled ?? false,\n      layerAwareEnabled: !!config.layer,\n    };\n\n    isInitialized = true;\n\n    const duration = Date.now() - startTime;\n    // sdkState is guaranteed non-null here since we just assigned it above\n    const initializedState = sdkState;\n    logger.info(`[SDK Init] SDK initialized successfully in ${duration}ms`, {\n      graphSyncEnabled: initializedState.graphSyncEnabled,\n      analyticsEnabled: initializedState.analyticsEnabled,\n      observabilityEnabled: initializedState.observabilityEnabled,\n      layerAwareEnabled: initializedState.layerAwareEnabled,\n      layer: config.layer?.type,\n      serviceName: config.layer?.serviceName,\n    });\n\n    return initializedState;\n  } catch (error) {\n    logger.error('[SDK Init] Failed to initialize SDK:', error);\n    throw error;\n  }\n}\n\n/**\n * Get current SDK state\n * @throws Error if SDK is not initialized\n */\nexport function getSDKState(): InitializedSDKState {\n  if (!isInitialized || !sdkState) {\n    throw new Error('SDK not initialized. Call initializeBurdenoffSDK() first.');\n  }\n  return sdkState;\n}\n\n/**\n * Check if SDK is initialized\n */\nexport function isSDKInitialized(): boolean {\n  return isInitialized;\n}\n\n/**\n * Reset SDK state (useful for testing)\n */\nexport async function resetSDK(): Promise<void> {\n  logger.info('[SDK Init] Resetting SDK state...');\n\n  if (sdkState) {\n    // Cleanup resources\n    // Note: Individual cleanup will be handled by service-specific shutdown handlers\n    sdkState = null;\n  }\n\n  isInitialized = false;\n  logger.info('[SDK Init] SDK state reset');\n}\n\n/**\n * Initialize logging configuration\n */\nasync function initializeLogging(config: BurdenoffSDKInitConfig): Promise<void> {\n  logger.info('[SDK Init] Configuring logging...');\n\n  const loggingConfig = config.logging ?? {};\n  const isDevelopment = config.app?.nodeEnv === 'development';\n\n  // Set log level\n  const level = loggingConfig.level ?? 'info';\n  logger.setLevel(level);\n\n  // Set console logging\n  const console = loggingConfig.console ?? true;\n  logger.setConsoleEnabled(console);\n\n  logger.info('[SDK Init] Logging configured', {\n    level,\n    console,\n    format: loggingConfig.format ?? (isDevelopment ? 'pretty' : 'json'),\n  });\n}\n\n/**\n * Initialize database (Prisma with PostgreSQL)\n */\nasync function initializeDatabase(config: BurdenoffSDKInitConfig): Promise<unknown> {\n  logger.info('[SDK Init] Initializing database...');\n\n  // Note: Database initialization is handled by createPrismaClient in prisma/client.ts\n  // This is called by the application (e.g., workspaces-backend)\n  // We just validate the config here\n  if (!config.database?.url) {\n    throw new Error('Database URL is required');\n  }\n\n  logger.info('[SDK Init] Database configuration validated', {\n    maxConnections: config.database.maxConnections ?? 20,\n    enableQueryLogging: config.database.enableQueryLogging ?? false,\n  });\n\n  // Return undefined as database client is created separately\n  return undefined;\n}\n\n/**\n * Initialize cache (Valkey)\n */\nasync function initializeCache(config: BurdenoffSDKInitConfig): Promise<unknown> {\n  const cacheConfig = config.cache?.valkey;\n\n  if (!cacheConfig) {\n    logger.info('[SDK Init] Cache not configured, skipping');\n    return undefined;\n  }\n\n  logger.info('[SDK Init] Initializing Valkey cache...');\n\n  // Note: Valkey initialization is handled by cache module\n  // This is a placeholder for future implementation\n  logger.info('[SDK Init] Valkey cache configuration validated', {\n    url: cacheConfig.url ? '***' : undefined,\n    defaultTTL: cacheConfig.defaultTTL ?? 3600,\n  });\n\n  return undefined;\n}\n\n/**\n * Initialize event queue (Redis Streams).\n *\n * NATS was retired on 2026-05-16. The publisher is created from\n * `REDIS_URL` (set platform-wide in KV). Legacy `config.eventQueue.nats`\n * values are ignored — kept on the type only as a back-compat shim.\n */\nasync function initializeEventQueue(_config: BurdenoffSDKInitConfig): Promise<unknown> {\n  if (!process.env['REDIS_URL']) {\n    logger.info('[SDK Init] REDIS_URL not set, skipping event queue init');\n    return undefined;\n  }\n\n  try {\n    const { EventQueueFactory } = await import('../event-queue/factory/EventQueueFactory.js');\n    const publisher = EventQueueFactory.createPublisherFromEnv();\n    await publisher.connect();\n\n    logger.info('[SDK Init] Redis Streams event publisher connected');\n\n    return publisher;\n  } catch (error) {\n    logger.warn('[SDK Init] Failed to connect Redis Streams event publisher (non-fatal)', {\n      error: error instanceof Error ? error.message : String(error),\n      note: 'Service will continue without event publishing. Use direct API calls as fallback.',\n    });\n    return undefined;\n  }\n}\n\n/**\n * Initialize graph sync (Redis Streams publisher side).\n *\n * Services publish entity events to Redis Streams; the `wspace-graph-svc`\n * consumer (and only it) persists them into Apache AGE via Azure PG\n * sidecar. This SDK function does no DB work — it just validates that the\n * publisher-side config is sensible and logs it.\n */\nasync function initializeGraphSync(config: BurdenoffSDKInitConfig): Promise<unknown> {\n  if (!config.graph?.enabled) {\n    logger.info('[SDK Init] Graph sync not enabled, skipping');\n    return undefined;\n  }\n\n  logger.info('[SDK Init] Graph sync enabled (publisher-only mode)', {\n    eventsEnabled: config.graph.eventsEnabled ?? true,\n    productSource: config.graph.productSource,\n    streamName: config.graph.streamName ?? 'graph_events',\n    syncInterval: config.graph.syncInterval ?? 1000,\n    batchSize: config.graph.batchSize ?? 10,\n  });\n\n  return undefined;\n}\n\n/**\n * Initialize analytics (ClickHouse)\n */\nasync function initializeAnalytics(config: BurdenoffSDKInitConfig): Promise<unknown> {\n  if (!config.analytics?.clickhouse) {\n    logger.info('[SDK Init] Analytics not configured, skipping');\n    return undefined;\n  }\n\n  logger.info('[SDK Init] Initializing ClickHouse for analytics...');\n\n  // Note: ClickHouse initialization is handled by analytics module\n  // This is a placeholder for future implementation\n  logger.info('[SDK Init] ClickHouse configuration validated', {\n    url: config.analytics.clickhouse.url,\n    database: config.analytics.clickhouse.database,\n    requestTimeout: config.analytics.clickhouse.requestTimeout ?? 60000,\n  });\n\n  return undefined;\n}\n\n/**\n * Initialize observability (metrics, tracing)\n */\nasync function initializeObservability(config: BurdenoffSDKInitConfig): Promise<void> {\n  if (!config.observability?.metrics?.enabled && !config.observability?.openTelemetry?.enabled) {\n    logger.info('[SDK Init] Observability not configured, skipping');\n    return;\n  }\n\n  logger.info('[SDK Init] Initializing observability...');\n\n  // Note: Observability initialization is handled by observability module\n  // This is a placeholder for future implementation\n  if (config.observability.metrics?.enabled) {\n    logger.info('[SDK Init] Metrics configuration validated', {\n      port: config.observability.metrics.port ?? 9090,\n      endpoint: config.observability.metrics.endpoint ?? '/metrics',\n    });\n  }\n\n  if (config.observability.openTelemetry?.enabled) {\n    logger.info('[SDK Init] OpenTelemetry configuration validated', {\n      serviceName: config.observability.openTelemetry.serviceName,\n      samplingRate: config.observability.openTelemetry.samplingRate ?? 1.0,\n    });\n  }\n}\n\n/**\n * Initialize layer manager and gateway client\n */\nasync function initializeLayer(\n  config: BurdenoffSDKInitConfig\n): Promise<{ layerManager?: LayerManager; gatewayClient?: GatewayClient }> {\n  if (!config.layer) {\n    logger.info('[SDK Init] Layer configuration not provided, skipping layer initialization');\n    return {};\n  }\n\n  logger.info('[SDK Init] Initializing layer manager...', {\n    layer: config.layer.type,\n    serviceName: config.layer.serviceName,\n  });\n\n  // Create layer manager\n  const layerManager = new LayerManager({\n    layer: config.layer.type,\n    serviceName: config.layer.serviceName,\n    serviceIdentity: config.layer.serviceIdentity,\n  });\n\n  // Create gateway client\n  const gatewayClient = new GatewayClient({\n    layer: config.layer.type,\n    serviceName: config.layer.serviceName,\n    serviceIdentity: config.layer.serviceIdentity,\n    internalGatewayUrl: layerManager.getInternalGatewayUrl(),\n    crossLayerGatewayUrl: layerManager.getCrossLayerGatewayUrl(),\n  });\n\n  logger.info('[SDK Init] Layer manager initialized', {\n    layer: config.layer.type,\n    serviceName: config.layer.serviceName,\n    internalGatewayUrl: layerManager.getInternalGatewayUrl(),\n    crossLayerGatewayUrl: layerManager.getCrossLayerGatewayUrl(),\n  });\n\n  return { layerManager, gatewayClient };\n}\n\n/**\n * Initialize layer-specific Redis streams.\n *\n * No-op since the 2026-05-16 NATS retirement: Redis Streams are created\n * on demand by `XGROUP CREATE ... MKSTREAM` inside the consumer, so no\n * upfront connect-and-provision step is needed.\n */\nasync function initializeLayerStreams(config: BurdenoffSDKInitConfig): Promise<void> {\n  if (!config.layer) {\n    return;\n  }\n  logger.debug('[SDK Init] Layer streams init is a no-op for Redis Streams (auto-created on first XADD/XGROUP)', {\n    layer: config.layer.type,\n  });\n}\n\n// Export types\nexport type * from './types.js';\n"]}
+{"version":3,"sources":["../src/init/index.ts"],"names":["sdkState","isInitialized","initializeBurdenoffSDK","config","logger","warn","info","startTime","Date","now","initializeLogging","layerManager","gatewayClient","initializeLayer","prisma","initializeDatabase","valkey","initializeCache","eventPublisher","initializeEventQueue","layer","autoCreateStreams","initializeLayerStreams","graphSync","initializeGraphSync","clickhouse","initializeAnalytics","initializeObservability","graphSyncEnabled","graph","enabled","analyticsEnabled","analytics","observabilityEnabled","observability","metrics","layerAwareEnabled","duration","initializedState","type","serviceName","error","getSDKState","Error","isSDKInitialized","resetSDK","loggingConfig","logging","isDevelopment","app","nodeEnv","level","setLevel","console","setConsoleEnabled","format","database","url","maxConnections","enableQueryLogging","undefined","cacheConfig","cache","defaultTTL","_config","process","env","EventQueueFactory","publisher","createPublisherFromEnv","connect","message","String","note","eventsEnabled","productSource","streamName","syncInterval","batchSize","requestTimeout","openTelemetry","port","endpoint","samplingRate","LayerManager","serviceIdentity","GatewayClient","internalGatewayUrl","getInternalGatewayUrl","crossLayerGatewayUrl","getCrossLayerGatewayUrl","debug"],"mappings":";;;;;;AAAA,IAAA,YAAA,GAAA;;;;;;;AAkBA,IAAIA,QAAAA,GAAuC,IAAA;AAC3C,IAAIC,aAAAA,GAAgB,KAAA;AAsCpB,eAAsBC,uBAAuBC,MAAAA,EAA8B;AACzE,EAAA,IAAIF,iBAAiBD,QAAAA,EAAU;AAC7BI,IAAAA,MAAAA,CAAOC,KAAK,8DAAA,CAAA;AACZ,IAAA,OAAOL,QAAAA;AACT,EAAA;AAEAI,EAAAA,MAAAA,CAAOE,KAAK,2CAAA,CAAA;AACZ,EAAA,MAAMC,SAAAA,GAAYC,KAAKC,GAAAA,EAAG;AAE1B,EAAA,IAAI;AAEF,IAAA,MAAMC,kBAAkBP,MAAAA,CAAAA;AAGxB,IAAA,MAAM,EAAEQ,YAAAA,EAAcC,aAAAA,EAAa,GAAK,MAAMC,gBAAgBV,MAAAA,CAAAA;AAG9D,IAAA,MAAMW,MAAAA,GAAS,MAAMC,kBAAAA,CAAmBZ,MAAAA,CAAAA;AAGxC,IAAA,MAAMa,MAAAA,GAAS,MAAMC,eAAAA,CAAgBd,MAAAA,CAAAA;AAGrC,IAAA,MAAMe,cAAAA,GAAiB,MAAMC,oBAAAA,CAAqBhB,MAAAA,CAAAA;AAGlD,IAAA,IAAIA,MAAAA,CAAOiB,KAAAA,EAAOC,iBAAAA,KAAsB,KAAA,IAASlB,OAAOiB,KAAAA,EAAO;AAC7D,MAAA,MAAME,uBAAuBnB,MAAAA,CAAAA;AAC/B,IAAA;AAIA,IAAA,MAAMoB,SAAAA,GAAY,MAAMC,mBAAAA,CAAoBrB,MAAAA,CAAAA;AAG5C,IAAA,MAAMsB,UAAAA,GAAa,MAAMC,mBAAAA,CAAoBvB,MAAAA,CAAAA;AAG7C,IAAA,MAAMwB,wBAAwBxB,MAAAA,CAAAA;AAK9B,IAAA,KAAKoB,SAAAA;AACLvB,IAAAA,QAAAA,GAAW;AACTc,MAAAA,MAAAA;AACAE,MAAAA,MAAAA;AACAS,MAAAA,UAAAA;AACAP,MAAAA,cAAAA;AACAP,MAAAA,YAAAA;AACAC,MAAAA,aAAAA;MACAgB,gBAAAA,EAAkBzB,MAAAA,CAAO0B,OAAOC,OAAAA,IAAW,KAAA;MAC3CC,gBAAAA,EAAkB,CAAC,CAAC5B,MAAAA,CAAO6B,SAAAA,EAAWP,UAAAA;MACtCQ,oBAAAA,EAAsB9B,MAAAA,CAAO+B,aAAAA,EAAeC,OAAAA,EAASL,OAAAA,IAAW,KAAA;MAChEM,iBAAAA,EAAmB,CAAC,CAACjC,MAAAA,CAAOiB;AAC9B,KAAA;AAEAnB,IAAAA,aAAAA,GAAgB,IAAA;AAEhB,IAAA,MAAMoC,QAAAA,GAAW7B,IAAAA,CAAKC,GAAAA,EAAG,GAAKF,SAAAA;AAE9B,IAAA,MAAM+B,gBAAAA,GAAmBtC,QAAAA;AACzBI,IAAAA,MAAAA,CAAOE,IAAAA,CAAK,CAAA,2CAAA,EAA8C+B,QAAAA,CAAAA,EAAAA,CAAAA,EAAc;AACtET,MAAAA,gBAAAA,EAAkBU,gBAAAA,CAAiBV,gBAAAA;AACnCG,MAAAA,gBAAAA,EAAkBO,gBAAAA,CAAiBP,gBAAAA;AACnCE,MAAAA,oBAAAA,EAAsBK,gBAAAA,CAAiBL,oBAAAA;AACvCG,MAAAA,iBAAAA,EAAmBE,gBAAAA,CAAiBF,iBAAAA;AACpChB,MAAAA,KAAAA,EAAOjB,OAAOiB,KAAAA,EAAOmB,IAAAA;AACrBC,MAAAA,WAAAA,EAAarC,OAAOiB,KAAAA,EAAOoB;KAC7B,CAAA;AAEA,IAAA,OAAOF,gBAAAA;AACT,EAAA,CAAA,CAAA,OAASG,KAAAA,EAAO;AACdrC,IAAAA,MAAAA,CAAOqC,KAAAA,CAAM,wCAAwCA,KAAAA,CAAAA;AACrD,IAAA,MAAMA,KAAAA;AACR,EAAA;AACF;AA5EsBvC,MAAAA,CAAAA,sBAAAA,EAAAA,wBAAAA,CAAAA;AAkFf,SAASwC,WAAAA,GAAAA;AACd,EAAA,IAAI,CAACzC,aAAAA,IAAiB,CAACD,QAAAA,EAAU;AAC/B,IAAA,MAAM,IAAI2C,MAAM,2DAAA,CAAA;AAClB,EAAA;AACA,EAAA,OAAO3C,QAAAA;AACT;AALgB0C,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;AAUT,SAASE,gBAAAA,GAAAA;AACd,EAAA,OAAO3C,aAAAA;AACT;AAFgB2C,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAOhB,eAAsBC,QAAAA,GAAAA;AACpBzC,EAAAA,MAAAA,CAAOE,KAAK,mCAAA,CAAA;AAEZ,EAAA,IAAIN,QAAAA,EAAU;AAGZA,IAAAA,QAAAA,GAAW,IAAA;AACb,EAAA;AAEAC,EAAAA,aAAAA,GAAgB,KAAA;AAChBG,EAAAA,MAAAA,CAAOE,KAAK,4BAAA,CAAA;AACd;AAXsBuC,MAAAA,CAAAA,QAAAA,EAAAA,UAAAA,CAAAA;AAgBtB,eAAenC,kBAAkBP,MAAAA,EAA8B;AAC7DC,EAAAA,MAAAA,CAAOE,KAAK,mCAAA,CAAA;AAEZ,EAAA,MAAMwC,aAAAA,GAAgB3C,MAAAA,CAAO4C,OAAAA,IAAW,EAAC;AACzC,EAAA,MAAMC,aAAAA,GAAgB7C,MAAAA,CAAO8C,GAAAA,EAAKC,OAAAA,KAAY,aAAA;AAG9C,EAAA,MAAMC,KAAAA,GAAQL,cAAcK,KAAAA,IAAS,MAAA;AACrC/C,EAAAA,MAAAA,CAAOgD,SAASD,KAAAA,CAAAA;AAGhB,EAAA,MAAME,OAAAA,GAAUP,cAAcO,OAAAA,IAAW,IAAA;AACzCjD,EAAAA,MAAAA,CAAOkD,kBAAkBD,OAAAA,CAAAA;AAEzBjD,EAAAA,MAAAA,CAAOE,KAAK,+BAAA,EAAiC;AAC3C6C,IAAAA,KAAAA;AACAE,IAAAA,OAAAA;IACAE,MAAAA,EAAQT,aAAAA,CAAcS,MAAAA,KAAWP,aAAAA,GAAgB,QAAA,GAAW,MAAA;GAC9D,CAAA;AACF;AAnBetC,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAwBf,eAAeK,mBAAmBZ,MAAAA,EAA8B;AAC9DC,EAAAA,MAAAA,CAAOE,KAAK,qCAAA,CAAA;AAKZ,EAAA,IAAI,CAACH,MAAAA,CAAOqD,QAAAA,EAAUC,GAAAA,EAAK;AACzB,IAAA,MAAM,IAAId,MAAM,0BAAA,CAAA;AAClB,EAAA;AAEAvC,EAAAA,MAAAA,CAAOE,KAAK,6CAAA,EAA+C;IACzDoD,cAAAA,EAAgBvD,MAAAA,CAAOqD,SAASE,cAAAA,IAAkB,EAAA;IAClDC,kBAAAA,EAAoBxD,MAAAA,CAAOqD,SAASG,kBAAAA,IAAsB;GAC5D,CAAA;AAGA,EAAA,OAAOC,MAAAA;AACT;AAjBe7C,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA;AAsBf,eAAeE,gBAAgBd,MAAAA,EAA8B;AAC3D,EAAA,MAAM0D,WAAAA,GAAc1D,OAAO2D,KAAAA,EAAO9C,MAAAA;AAElC,EAAA,IAAI,CAAC6C,WAAAA,EAAa;AAChBzD,IAAAA,MAAAA,CAAOE,KAAK,2CAAA,CAAA;AACZ,IAAA,OAAOsD,MAAAA;AACT,EAAA;AAEAxD,EAAAA,MAAAA,CAAOE,KAAK,yCAAA,CAAA;AAIZF,EAAAA,MAAAA,CAAOE,KAAK,iDAAA,EAAmD;IAC7DmD,GAAAA,EAAKI,WAAAA,CAAYJ,MAAM,KAAA,GAAQG,MAAAA;AAC/BG,IAAAA,UAAAA,EAAYF,YAAYE,UAAAA,IAAc;GACxC,CAAA;AAEA,EAAA,OAAOH,MAAAA;AACT;AAlBe3C,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AA2Bf,eAAeE,qBAAqB6C,OAAAA,EAA+B;AACjE,EAAA,IAAI,CAACC,OAAAA,CAAQC,GAAAA,CAAI,WAAA,CAAA,EAAc;AAC7B9D,IAAAA,MAAAA,CAAOE,KAAK,yDAAA,CAAA;AACZ,IAAA,OAAOsD,MAAAA;AACT,EAAA;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,EAAEO,iBAAAA,EAAiB,GAAK,MAAM,OAAO,iCAAA,CAAA;AAC3C,IAAA,MAAMC,SAAAA,GAAYD,kBAAkBE,sBAAAA,EAAsB;AAC1D,IAAA,MAAMD,UAAUE,OAAAA,EAAO;AAEvBlE,IAAAA,MAAAA,CAAOE,KAAK,oDAAA,CAAA;AAEZ,IAAA,OAAO8D,SAAAA;AACT,EAAA,CAAA,CAAA,OAAS3B,KAAAA,EAAO;AACdrC,IAAAA,MAAAA,CAAOC,KAAK,wEAAA,EAA0E;AACpFoC,MAAAA,KAAAA,EAAOA,KAAAA,YAAiBE,KAAAA,GAAQF,KAAAA,CAAM8B,OAAAA,GAAUC,OAAO/B,KAAAA,CAAAA;MACvDgC,IAAAA,EAAM;KACR,CAAA;AACA,IAAA,OAAOb,MAAAA;AACT,EAAA;AACF;AArBezC,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AA+Bf,eAAeK,oBAAoBrB,MAAAA,EAA8B;AAC/D,EAAA,IAAI,CAACA,MAAAA,CAAO0B,KAAAA,EAAOC,OAAAA,EAAS;AAC1B1B,IAAAA,MAAAA,CAAOE,KAAK,6CAAA,CAAA;AACZ,IAAA,OAAOsD,MAAAA;AACT,EAAA;AAEAxD,EAAAA,MAAAA,CAAOE,KAAK,qDAAA,EAAuD;IACjEoE,aAAAA,EAAevE,MAAAA,CAAO0B,MAAM6C,aAAAA,IAAiB,IAAA;AAC7CC,IAAAA,aAAAA,EAAexE,OAAO0B,KAAAA,CAAM8C,aAAAA;IAC5BC,UAAAA,EAAYzE,MAAAA,CAAO0B,MAAM+C,UAAAA,IAAc,cAAA;IACvCC,YAAAA,EAAc1E,MAAAA,CAAO0B,MAAMgD,YAAAA,IAAgB,GAAA;IAC3CC,SAAAA,EAAW3E,MAAAA,CAAO0B,MAAMiD,SAAAA,IAAa;GACvC,CAAA;AAEA,EAAA,OAAOlB,MAAAA;AACT;AAfepC,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAoBf,eAAeE,oBAAoBvB,MAAAA,EAA8B;AAC/D,EAAA,IAAI,CAACA,MAAAA,CAAO6B,SAAAA,EAAWP,UAAAA,EAAY;AACjCrB,IAAAA,MAAAA,CAAOE,KAAK,+CAAA,CAAA;AACZ,IAAA,OAAOsD,MAAAA;AACT,EAAA;AAEAxD,EAAAA,MAAAA,CAAOE,KAAK,qDAAA,CAAA;AAIZF,EAAAA,MAAAA,CAAOE,KAAK,+CAAA,EAAiD;IAC3DmD,GAAAA,EAAKtD,MAAAA,CAAO6B,UAAUP,UAAAA,CAAWgC,GAAAA;IACjCD,QAAAA,EAAUrD,MAAAA,CAAO6B,UAAUP,UAAAA,CAAW+B,QAAAA;IACtCuB,cAAAA,EAAgB5E,MAAAA,CAAO6B,SAAAA,CAAUP,UAAAA,CAAWsD,cAAAA,IAAkB;GAChE,CAAA;AAEA,EAAA,OAAOnB,MAAAA;AACT;AAjBelC,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAsBf,eAAeC,wBAAwBxB,MAAAA,EAA8B;AACnE,EAAA,IAAI,CAACA,OAAO+B,aAAAA,EAAeC,OAAAA,EAASL,WAAW,CAAC3B,MAAAA,CAAO+B,aAAAA,EAAe8C,aAAAA,EAAelD,OAAAA,EAAS;AAC5F1B,IAAAA,MAAAA,CAAOE,KAAK,mDAAA,CAAA;AACZ,IAAA;AACF,EAAA;AAEAF,EAAAA,MAAAA,CAAOE,KAAK,0CAAA,CAAA;AAIZ,EAAA,IAAIH,MAAAA,CAAO+B,aAAAA,CAAcC,OAAAA,EAASL,OAAAA,EAAS;AACzC1B,IAAAA,MAAAA,CAAOE,KAAK,4CAAA,EAA8C;MACxD2E,IAAAA,EAAM9E,MAAAA,CAAO+B,aAAAA,CAAcC,OAAAA,CAAQ8C,IAAAA,IAAQ,IAAA;MAC3CC,QAAAA,EAAU/E,MAAAA,CAAO+B,aAAAA,CAAcC,OAAAA,CAAQ+C,QAAAA,IAAY;KACrD,CAAA;AACF,EAAA;AAEA,EAAA,IAAI/E,MAAAA,CAAO+B,aAAAA,CAAc8C,aAAAA,EAAelD,OAAAA,EAAS;AAC/C1B,IAAAA,MAAAA,CAAOE,KAAK,kDAAA,EAAoD;MAC9DkC,WAAAA,EAAarC,MAAAA,CAAO+B,cAAc8C,aAAAA,CAAcxC,WAAAA;MAChD2C,YAAAA,EAAchF,MAAAA,CAAO+B,aAAAA,CAAc8C,aAAAA,CAAcG,YAAAA,IAAgB;KACnE,CAAA;AACF,EAAA;AACF;AAvBexD,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AA4Bf,eAAed,gBACbV,MAAAA,EAA8B;AAE9B,EAAA,IAAI,CAACA,OAAOiB,KAAAA,EAAO;AACjBhB,IAAAA,MAAAA,CAAOE,KAAK,4EAAA,CAAA;AACZ,IAAA,OAAO,EAAC;AACV,EAAA;AAEAF,EAAAA,MAAAA,CAAOE,KAAK,0CAAA,EAA4C;AACtDc,IAAAA,KAAAA,EAAOjB,OAAOiB,KAAAA,CAAMmB,IAAAA;AACpBC,IAAAA,WAAAA,EAAarC,OAAOiB,KAAAA,CAAMoB;GAC5B,CAAA;AAGA,EAAA,MAAM7B,YAAAA,GAAe,IAAIyE,YAAAA,CAAa;AACpChE,IAAAA,KAAAA,EAAOjB,OAAOiB,KAAAA,CAAMmB,IAAAA;AACpBC,IAAAA,WAAAA,EAAarC,OAAOiB,KAAAA,CAAMoB,WAAAA;AAC1B6C,IAAAA,eAAAA,EAAiBlF,OAAOiB,KAAAA,CAAMiE;GAChC,CAAA;AAGA,EAAA,MAAMzE,aAAAA,GAAgB,IAAI0E,aAAAA,CAAc;AACtClE,IAAAA,KAAAA,EAAOjB,OAAOiB,KAAAA,CAAMmB,IAAAA;AACpBC,IAAAA,WAAAA,EAAarC,OAAOiB,KAAAA,CAAMoB,WAAAA;AAC1B6C,IAAAA,eAAAA,EAAiBlF,OAAOiB,KAAAA,CAAMiE,eAAAA;AAC9BE,IAAAA,kBAAAA,EAAoB5E,aAAa6E,qBAAAA,EAAqB;AACtDC,IAAAA,oBAAAA,EAAsB9E,aAAa+E,uBAAAA;GACrC,CAAA;AAEAtF,EAAAA,MAAAA,CAAOE,KAAK,sCAAA,EAAwC;AAClDc,IAAAA,KAAAA,EAAOjB,OAAOiB,KAAAA,CAAMmB,IAAAA;AACpBC,IAAAA,WAAAA,EAAarC,OAAOiB,KAAAA,CAAMoB,WAAAA;AAC1B+C,IAAAA,kBAAAA,EAAoB5E,aAAa6E,qBAAAA,EAAqB;AACtDC,IAAAA,oBAAAA,EAAsB9E,aAAa+E,uBAAAA;GACrC,CAAA;AAEA,EAAA,OAAO;AAAE/E,IAAAA,YAAAA;AAAcC,IAAAA;AAAc,GAAA;AACvC;AArCeC,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AA8Cf,eAAeS,uBAAuBnB,MAAAA,EAA8B;AAClE,EAAA,IAAI,CAACA,OAAOiB,KAAAA,EAAO;AACjB,IAAA;AACF,EAAA;AACAhB,EAAAA,MAAAA,CAAOuF,MAAM,gGAAA,EAAkG;AAC7GvE,IAAAA,KAAAA,EAAOjB,OAAOiB,KAAAA,CAAMmB;GACtB,CAAA;AACF;AAPejB,MAAAA,CAAAA,sBAAAA,EAAAA,wBAAAA,CAAAA","file":"chunk-5FEOFBQ4.js","sourcesContent":["/**\n * Burdenoff SDK Initialization Module\n *\n * Provides a unified initialization function for all state services\n * including database, cache, analytics, event queue, and graph sync.\n *\n * @module init\n * @category Initialization\n */\n\nimport { logger } from '../logger/index.js';\nimport { LayerManager } from '../layer/index.js';\nimport { GatewayClient } from '../gateway/index.js';\nimport type { BurdenoffSDKInitConfig, InitializedSDKState } from './types.js';\n\n/**\n * Global SDK state\n */\nlet sdkState: InitializedSDKState | null = null;\nlet isInitialized = false;\n\n/**\n * Initialize Burdenoff SDK with unified configuration\n *\n * This function initializes all configured state services in the correct order:\n * 1. Logging configuration\n * 2. Database (Prisma with PostgreSQL)\n * 3. Cache (Valkey)\n * 4. Event Queue (Redis Streams)\n * 5. Graph Sync (Redis Streams-based — Apache AGE writes happen inside wspace-graph-svc)\n * 6. Analytics (ClickHouse)\n * 7. Observability (Metrics, OpenTelemetry)\n *\n * @param config - SDK initialization configuration\n * @returns Initialized SDK state\n *\n * @example\n * ```typescript\n * import { initializeBurdenoffSDK } from '@burdenoff/be-sdk/init';\n *\n * const state = await initializeBurdenoffSDK({\n *   database: {\n *     url: process.env.DATABASE_URL!,\n *     maxConnections: 20,\n *   },\n *   graph: {\n *     enabled: true,\n *     eventsEnabled: true,\n *   },\n *   cache: {\n *     valkey: {\n *       url: process.env.VALKEY_URL!,\n *     },\n *   },\n * });\n * ```\n */\nexport async function initializeBurdenoffSDK(config: BurdenoffSDKInitConfig): Promise<InitializedSDKState> {\n  if (isInitialized && sdkState) {\n    logger.warn('[SDK Init] SDK already initialized, returning existing state');\n    return sdkState;\n  }\n\n  logger.info('[SDK Init] Starting SDK initialization...');\n  const startTime = Date.now();\n\n  try {\n    // 1. Configure logging\n    await initializeLogging(config);\n\n    // 2. Initialize layer manager (if configured)\n    const { layerManager, gatewayClient } = await initializeLayer(config);\n\n    // 3. Initialize database (required)\n    const prisma = await initializeDatabase(config);\n\n    // 4. Initialize cache (optional)\n    const valkey = await initializeCache(config);\n\n    // 5. Initialize event queue (optional) — Redis Streams via REDIS_URL\n    const eventPublisher = await initializeEventQueue(config);\n\n    // 6. Initialize layer streams (if layer configured)\n    if (config.layer?.autoCreateStreams !== false && config.layer) {\n      await initializeLayerStreams(config);\n    }\n\n    // 7. Initialize graph sync (optional) — publisher emits to Redis Streams,\n    //    never opens a graph-DB connection\n    const graphSync = await initializeGraphSync(config);\n\n    // 8. Initialize analytics (optional)\n    const clickhouse = await initializeAnalytics(config);\n\n    // 9. Initialize observability (optional)\n    await initializeObservability(config);\n\n    // Create SDK state\n    // graphSync is a publisher-side placeholder; services emit Redis Streams\n    // events and wspace-graph-svc owns the sole Apache AGE connection.\n    void graphSync;\n    sdkState = {\n      prisma,\n      valkey,\n      clickhouse,\n      eventPublisher,\n      layerManager,\n      gatewayClient,\n      graphSyncEnabled: config.graph?.enabled ?? false,\n      analyticsEnabled: !!config.analytics?.clickhouse,\n      observabilityEnabled: config.observability?.metrics?.enabled ?? false,\n      layerAwareEnabled: !!config.layer,\n    };\n\n    isInitialized = true;\n\n    const duration = Date.now() - startTime;\n    // sdkState is guaranteed non-null here since we just assigned it above\n    const initializedState = sdkState;\n    logger.info(`[SDK Init] SDK initialized successfully in ${duration}ms`, {\n      graphSyncEnabled: initializedState.graphSyncEnabled,\n      analyticsEnabled: initializedState.analyticsEnabled,\n      observabilityEnabled: initializedState.observabilityEnabled,\n      layerAwareEnabled: initializedState.layerAwareEnabled,\n      layer: config.layer?.type,\n      serviceName: config.layer?.serviceName,\n    });\n\n    return initializedState;\n  } catch (error) {\n    logger.error('[SDK Init] Failed to initialize SDK:', error);\n    throw error;\n  }\n}\n\n/**\n * Get current SDK state\n * @throws Error if SDK is not initialized\n */\nexport function getSDKState(): InitializedSDKState {\n  if (!isInitialized || !sdkState) {\n    throw new Error('SDK not initialized. Call initializeBurdenoffSDK() first.');\n  }\n  return sdkState;\n}\n\n/**\n * Check if SDK is initialized\n */\nexport function isSDKInitialized(): boolean {\n  return isInitialized;\n}\n\n/**\n * Reset SDK state (useful for testing)\n */\nexport async function resetSDK(): Promise<void> {\n  logger.info('[SDK Init] Resetting SDK state...');\n\n  if (sdkState) {\n    // Cleanup resources\n    // Note: Individual cleanup will be handled by service-specific shutdown handlers\n    sdkState = null;\n  }\n\n  isInitialized = false;\n  logger.info('[SDK Init] SDK state reset');\n}\n\n/**\n * Initialize logging configuration\n */\nasync function initializeLogging(config: BurdenoffSDKInitConfig): Promise<void> {\n  logger.info('[SDK Init] Configuring logging...');\n\n  const loggingConfig = config.logging ?? {};\n  const isDevelopment = config.app?.nodeEnv === 'development';\n\n  // Set log level\n  const level = loggingConfig.level ?? 'info';\n  logger.setLevel(level);\n\n  // Set console logging\n  const console = loggingConfig.console ?? true;\n  logger.setConsoleEnabled(console);\n\n  logger.info('[SDK Init] Logging configured', {\n    level,\n    console,\n    format: loggingConfig.format ?? (isDevelopment ? 'pretty' : 'json'),\n  });\n}\n\n/**\n * Initialize database (Prisma with PostgreSQL)\n */\nasync function initializeDatabase(config: BurdenoffSDKInitConfig): Promise<unknown> {\n  logger.info('[SDK Init] Initializing database...');\n\n  // Note: Database initialization is handled by createPrismaClient in prisma/client.ts\n  // This is called by the application (e.g., workspaces-backend)\n  // We just validate the config here\n  if (!config.database?.url) {\n    throw new Error('Database URL is required');\n  }\n\n  logger.info('[SDK Init] Database configuration validated', {\n    maxConnections: config.database.maxConnections ?? 20,\n    enableQueryLogging: config.database.enableQueryLogging ?? false,\n  });\n\n  // Return undefined as database client is created separately\n  return undefined;\n}\n\n/**\n * Initialize cache (Valkey)\n */\nasync function initializeCache(config: BurdenoffSDKInitConfig): Promise<unknown> {\n  const cacheConfig = config.cache?.valkey;\n\n  if (!cacheConfig) {\n    logger.info('[SDK Init] Cache not configured, skipping');\n    return undefined;\n  }\n\n  logger.info('[SDK Init] Initializing Valkey cache...');\n\n  // Note: Valkey initialization is handled by cache module\n  // This is a placeholder for future implementation\n  logger.info('[SDK Init] Valkey cache configuration validated', {\n    url: cacheConfig.url ? '***' : undefined,\n    defaultTTL: cacheConfig.defaultTTL ?? 3600,\n  });\n\n  return undefined;\n}\n\n/**\n * Initialize event queue (Redis Streams).\n *\n * NATS was retired on 2026-05-16. The publisher is created from\n * `REDIS_URL` (set platform-wide in KV). Legacy `config.eventQueue.nats`\n * values are ignored — kept on the type only as a back-compat shim.\n */\nasync function initializeEventQueue(_config: BurdenoffSDKInitConfig): Promise<unknown> {\n  if (!process.env['REDIS_URL']) {\n    logger.info('[SDK Init] REDIS_URL not set, skipping event queue init');\n    return undefined;\n  }\n\n  try {\n    const { EventQueueFactory } = await import('../event-queue/factory/EventQueueFactory.js');\n    const publisher = EventQueueFactory.createPublisherFromEnv();\n    await publisher.connect();\n\n    logger.info('[SDK Init] Redis Streams event publisher connected');\n\n    return publisher;\n  } catch (error) {\n    logger.warn('[SDK Init] Failed to connect Redis Streams event publisher (non-fatal)', {\n      error: error instanceof Error ? error.message : String(error),\n      note: 'Service will continue without event publishing. Use direct API calls as fallback.',\n    });\n    return undefined;\n  }\n}\n\n/**\n * Initialize graph sync (Redis Streams publisher side).\n *\n * Services publish entity events to Redis Streams; the `wspace-graph-svc`\n * consumer (and only it) persists them into Apache AGE via Azure PG\n * sidecar. This SDK function does no DB work — it just validates that the\n * publisher-side config is sensible and logs it.\n */\nasync function initializeGraphSync(config: BurdenoffSDKInitConfig): Promise<unknown> {\n  if (!config.graph?.enabled) {\n    logger.info('[SDK Init] Graph sync not enabled, skipping');\n    return undefined;\n  }\n\n  logger.info('[SDK Init] Graph sync enabled (publisher-only mode)', {\n    eventsEnabled: config.graph.eventsEnabled ?? true,\n    productSource: config.graph.productSource,\n    streamName: config.graph.streamName ?? 'graph_events',\n    syncInterval: config.graph.syncInterval ?? 1000,\n    batchSize: config.graph.batchSize ?? 10,\n  });\n\n  return undefined;\n}\n\n/**\n * Initialize analytics (ClickHouse)\n */\nasync function initializeAnalytics(config: BurdenoffSDKInitConfig): Promise<unknown> {\n  if (!config.analytics?.clickhouse) {\n    logger.info('[SDK Init] Analytics not configured, skipping');\n    return undefined;\n  }\n\n  logger.info('[SDK Init] Initializing ClickHouse for analytics...');\n\n  // Note: ClickHouse initialization is handled by analytics module\n  // This is a placeholder for future implementation\n  logger.info('[SDK Init] ClickHouse configuration validated', {\n    url: config.analytics.clickhouse.url,\n    database: config.analytics.clickhouse.database,\n    requestTimeout: config.analytics.clickhouse.requestTimeout ?? 60000,\n  });\n\n  return undefined;\n}\n\n/**\n * Initialize observability (metrics, tracing)\n */\nasync function initializeObservability(config: BurdenoffSDKInitConfig): Promise<void> {\n  if (!config.observability?.metrics?.enabled && !config.observability?.openTelemetry?.enabled) {\n    logger.info('[SDK Init] Observability not configured, skipping');\n    return;\n  }\n\n  logger.info('[SDK Init] Initializing observability...');\n\n  // Note: Observability initialization is handled by observability module\n  // This is a placeholder for future implementation\n  if (config.observability.metrics?.enabled) {\n    logger.info('[SDK Init] Metrics configuration validated', {\n      port: config.observability.metrics.port ?? 9090,\n      endpoint: config.observability.metrics.endpoint ?? '/metrics',\n    });\n  }\n\n  if (config.observability.openTelemetry?.enabled) {\n    logger.info('[SDK Init] OpenTelemetry configuration validated', {\n      serviceName: config.observability.openTelemetry.serviceName,\n      samplingRate: config.observability.openTelemetry.samplingRate ?? 1.0,\n    });\n  }\n}\n\n/**\n * Initialize layer manager and gateway client\n */\nasync function initializeLayer(\n  config: BurdenoffSDKInitConfig\n): Promise<{ layerManager?: LayerManager; gatewayClient?: GatewayClient }> {\n  if (!config.layer) {\n    logger.info('[SDK Init] Layer configuration not provided, skipping layer initialization');\n    return {};\n  }\n\n  logger.info('[SDK Init] Initializing layer manager...', {\n    layer: config.layer.type,\n    serviceName: config.layer.serviceName,\n  });\n\n  // Create layer manager\n  const layerManager = new LayerManager({\n    layer: config.layer.type,\n    serviceName: config.layer.serviceName,\n    serviceIdentity: config.layer.serviceIdentity,\n  });\n\n  // Create gateway client\n  const gatewayClient = new GatewayClient({\n    layer: config.layer.type,\n    serviceName: config.layer.serviceName,\n    serviceIdentity: config.layer.serviceIdentity,\n    internalGatewayUrl: layerManager.getInternalGatewayUrl(),\n    crossLayerGatewayUrl: layerManager.getCrossLayerGatewayUrl(),\n  });\n\n  logger.info('[SDK Init] Layer manager initialized', {\n    layer: config.layer.type,\n    serviceName: config.layer.serviceName,\n    internalGatewayUrl: layerManager.getInternalGatewayUrl(),\n    crossLayerGatewayUrl: layerManager.getCrossLayerGatewayUrl(),\n  });\n\n  return { layerManager, gatewayClient };\n}\n\n/**\n * Initialize layer-specific Redis streams.\n *\n * No-op since the 2026-05-16 NATS retirement: Redis Streams are created\n * on demand by `XGROUP CREATE ... MKSTREAM` inside the consumer, so no\n * upfront connect-and-provision step is needed.\n */\nasync function initializeLayerStreams(config: BurdenoffSDKInitConfig): Promise<void> {\n  if (!config.layer) {\n    return;\n  }\n  logger.debug('[SDK Init] Layer streams init is a no-op for Redis Streams (auto-created on first XADD/XGROUP)', {\n    layer: config.layer.type,\n  });\n}\n\n// Export types\nexport type * from './types.js';\n"]}

package/dist/chunk-DXX6C6X6.js

@@ -0,0 +1,210 @@
+import { __name } from './chunk-XE4OXN2W.js';
+import { AsyncLocalStorage } from 'async_hooks';
+
+var asyncLocalStorage = new AsyncLocalStorage();
+var cfAccessFallback;
+var ContextManager = class {
+  static {
+    __name(this, "ContextManager");
+  }
+  /**
+  * Get current context from async local storage
+  */
+  static getContext() {
+    return asyncLocalStorage.getStore();
+  }
+  /**
+  * Set context for current async scope
+  * Merges with existing context if present
+  */
+  static setContext(context) {
+    const currentContext = this.getContext() || {};
+    asyncLocalStorage.enterWith({
+      ...currentContext,
+      ...context
+    });
+    if (context.cfAccessClientId && context.cfAccessClientSecret) {
+      this.setCfAccessContext(context.cfAccessClientId, context.cfAccessClientSecret);
+    }
+  }
+  /**
+  * Record the Cloudflare Access service token for the current process.
+  *
+  * Call this from every request-context builder that may receive CF headers
+  * (the SDK `createServer` `buildContext` and the bootstrap HTTP middleware
+  * both do). Stored in a module-level fallback because `enterWith()` is not a
+  * reliable carrier under Bun + Yoga — see the `cfAccessFallback` note above.
+  *
+  * Deliberately a NO-OP when either cred is absent: `buildContext` runs on
+  * every request, so clearing here on a tokenless request could wipe the value
+  * a concurrent CF request just stored. The token is constant per environment,
+  * so "remember, never clear on absence" is both safe and correct. Use
+  * `clearContext()` to reset (shutdown / tests).
+  */
+  static setCfAccessContext(clientId, clientSecret) {
+    if (clientId && clientSecret) {
+      cfAccessFallback = {
+        clientId,
+        clientSecret
+      };
+    }
+  }
+  /**
+  * Run function with specific context
+  * Context is isolated to this execution and its children
+  */
+  static async withContext(context, fn) {
+    return asyncLocalStorage.run(context, fn);
+  }
+  /**
+  * Run synchronous function with specific context
+  */
+  static withContextSync(context, fn) {
+    return asyncLocalStorage.run(context, fn);
+  }
+  /**
+  * Clear current context (including the module-level CF Access fallback).
+  */
+  static clearContext() {
+    asyncLocalStorage.disable();
+    cfAccessFallback = void 0;
+  }
+  /**
+  * Get actor ID from context
+  */
+  static getActorId() {
+    return this.getContext()?.actorId;
+  }
+  /**
+  * Get legacy user ID from context.
+  */
+  static getUser() {
+    const context = this.getContext();
+    const userId = context?.["userId"];
+    return typeof userId === "string" ? userId : context?.actorId;
+  }
+  /**
+  * Get workspace ID from context
+  */
+  static getWorkspace() {
+    return this.getContext()?.workspaceId;
+  }
+  /**
+  * Get tenant ID from context
+  */
+  static getTenant() {
+    return this.getContext()?.tenantId;
+  }
+  /**
+  * Get legacy organization ID from context.
+  */
+  static getOrganization() {
+    const organizationId = this.getContext()?.["organizationId"];
+    return typeof organizationId === "string" ? organizationId : void 0;
+  }
+  /**
+  * Get project ID from context
+  */
+  static getProject() {
+    return this.getContext()?.projectId;
+  }
+  /**
+  * Get app ID from context
+  */
+  static getApp() {
+    return this.getContext()?.appId;
+  }
+  /**
+  * Get JWT token from context
+  */
+  static getToken() {
+    return this.getContext()?.token;
+  }
+  /**
+  * Get product ID from context
+  */
+  static getProduct() {
+    return this.getContext()?.productId;
+  }
+  /**
+  * Get the Cloudflare Access service-token client id (ALS first, then the
+  * module-level fallback — see `cfAccessFallback`).
+  */
+  static getCfAccessClientId() {
+    return this.getContext()?.cfAccessClientId ?? cfAccessFallback?.clientId;
+  }
+  /**
+  * Get the Cloudflare Access service-token client secret (ALS first, then the
+  * module-level fallback — see `cfAccessFallback`).
+  */
+  static getCfAccessClientSecret() {
+    return this.getContext()?.cfAccessClientSecret ?? cfAccessFallback?.clientSecret;
+  }
+  /**
+  * Build the Cloudflare Access service-token header pair to re-present on a
+  * cross-layer outbound call.
+  *
+  * Cross-layer calls (wspace ↔ global) traverse the peer layer's PUBLIC
+  * gateway, which on alpha sits behind Cloudflare Access. Without the CF
+  * service token the request is rejected at the CF edge before reaching the
+  * gateway. We reuse the *inbound* request's CF creds (propagated by the
+  * public gateway into request-scoped context) so the cross-layer leg passes.
+  *
+  * Inbound-only: sourced from the request context (AsyncLocalStorage first,
+  * module-level fallback second — see `cfAccessFallback`). Returns `{}` unless
+  * BOTH creds are present — so it is a no-op in environments without CF in
+  * front of the gateways (local dev, and production, which is not
+  * CF-Access-gated and has no CF service token).
+  */
+  static getCfAccessHeaders() {
+    const clientId = this.getCfAccessClientId();
+    const clientSecret = this.getCfAccessClientSecret();
+    if (clientId && clientSecret) {
+      return {
+        "cf-access-client-id": clientId,
+        "cf-access-client-secret": clientSecret
+      };
+    }
+    return {};
+  }
+  /**
+  * Update specific context fields
+  */
+  static updateContext(updates) {
+    const current = this.getContext();
+    if (current) {
+      this.setContext({
+        ...current,
+        ...updates
+      });
+    } else {
+      this.setContext(updates);
+    }
+  }
+  /**
+  * Check if context exists
+  */
+  static hasContext() {
+    return this.getContext() !== void 0;
+  }
+  /**
+  * Get custom field from context
+  */
+  static getCustomField(key) {
+    return this.getContext()?.[key];
+  }
+  /**
+  * Set custom field in context
+  */
+  static setCustomField(key, value) {
+    const current = this.getContext() || {};
+    this.setContext({
+      ...current,
+      [key]: value
+    });
+  }
+};
+
+export { ContextManager };
+//# sourceMappingURL=chunk-DXX6C6X6.js.map
+//# sourceMappingURL=chunk-DXX6C6X6.js.map

package/dist/chunk-DXX6C6X6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/context/index.ts"],"names":["asyncLocalStorage","AsyncLocalStorage","cfAccessFallback","ContextManager","getContext","getStore","setContext","context","currentContext","enterWith","cfAccessClientId","cfAccessClientSecret","setCfAccessContext","clientId","clientSecret","withContext","fn","run","withContextSync","clearContext","disable","undefined","getActorId","actorId","getUser","userId","getWorkspace","workspaceId","getTenant","tenantId","getOrganization","organizationId","getProject","projectId","getApp","appId","getToken","token","getProduct","productId","getCfAccessClientId","getCfAccessClientSecret","getCfAccessHeaders","updateContext","updates","current","hasContext","getCustomField","key","setCustomField","value"],"mappings":";;;AASA,IAAMA,iBAAAA,GAAoB,IAAIC,iBAAAA,EAAAA;AAuB9B,IAAIC,gBAAAA;AAKG,IAAMC,iBAAN,MAAMA;EArCb;;;;;;AAyCE,EAAA,OAAcC,UAAAA,GAAqC;AACjD,IAAA,OAAOJ,kBAAkBK,QAAAA,EAAQ;AACnC,EAAA;;;;;AAMA,EAAA,OAAcC,WAAWC,OAAAA,EAA2B;AAClD,IAAA,MAAMC,cAAAA,GAAiB,IAAA,CAAKJ,UAAAA,EAAU,IAAM,EAAC;AAC7CJ,IAAAA,iBAAAA,CAAkBS,SAAAA,CAAU;MAAE,GAAGD,cAAAA;MAAgB,GAAGD;KAAQ,CAAA;AAG5D,IAAA,IAAIA,OAAAA,CAAQG,gBAAAA,IAAoBH,OAAAA,CAAQI,oBAAAA,EAAsB;AAC5D,MAAA,IAAA,CAAKC,kBAAAA,CAAmBL,OAAAA,CAAQG,gBAAAA,EAAkBH,OAAAA,CAAQI,oBAAoB,CAAA;AAChF,IAAA;AACF,EAAA;;;;;;;;;;;;;;;EAgBA,OAAcC,kBAAAA,CAAmBC,UAAmBC,YAAAA,EAA6B;AAC/E,IAAA,IAAID,YAAYC,YAAAA,EAAc;AAC5BZ,MAAAA,gBAAAA,GAAmB;AAAEW,QAAAA,QAAAA;AAAUC,QAAAA;AAAa,OAAA;AAC9C,IAAA;AACF,EAAA;;;;;EAMA,aAAoBC,WAAAA,CAAeR,SAAqBS,EAAAA,EAAkC;AACxF,IAAA,OAAOhB,iBAAAA,CAAkBiB,GAAAA,CAAIV,OAAAA,EAASS,EAAAA,CAAAA;AACxC,EAAA;;;;EAKA,OAAcE,eAAAA,CAAmBX,SAAqBS,EAAAA,EAAgB;AACpE,IAAA,OAAOhB,iBAAAA,CAAkBiB,GAAAA,CAAIV,OAAAA,EAASS,EAAAA,CAAAA;AACxC,EAAA;;;;AAKA,EAAA,OAAcG,YAAAA,GAAqB;AACjCnB,IAAAA,iBAAAA,CAAkBoB,OAAAA,EAAO;AACzBlB,IAAAA,gBAAAA,GAAmBmB,MAAAA;AACrB,EAAA;;;;AAKA,EAAA,OAAcC,UAAAA,GAAiC;AAC7C,IAAA,OAAO,IAAA,CAAKlB,YAAU,EAAImB,OAAAA;AAC5B,EAAA;;;;AAKA,EAAA,OAAcC,OAAAA,GAA8B;AAC1C,IAAA,MAAMjB,OAAAA,GAAU,KAAKH,UAAAA,EAAU;AAC/B,IAAA,MAAMqB,MAAAA,GAASlB,UAAU,QAAA,CAAA;AACzB,IAAA,OAAO,OAAOkB,MAAAA,KAAW,QAAA,GAAWA,MAAAA,GAASlB,OAAAA,EAASgB,OAAAA;AACxD,EAAA;;;;AAKA,EAAA,OAAcG,YAAAA,GAAmC;AAC/C,IAAA,OAAO,IAAA,CAAKtB,YAAU,EAAIuB,WAAAA;AAC5B,EAAA;;;;AAKA,EAAA,OAAcC,SAAAA,GAAgC;AAC5C,IAAA,OAAO,IAAA,CAAKxB,YAAU,EAAIyB,QAAAA;AAC5B,EAAA;;;;AAKA,EAAA,OAAcC,eAAAA,GAAsC;AAClD,IAAA,MAAMC,cAAAA,GAAiB,IAAA,CAAK3B,UAAAA,EAAU,GAAK,gBAAA,CAAA;AAC3C,IAAA,OAAO,OAAO2B,cAAAA,KAAmB,QAAA,GAAWA,cAAAA,GAAiBV,MAAAA;AAC/D,EAAA;;;;AAKA,EAAA,OAAcW,UAAAA,GAAiC;AAC7C,IAAA,OAAO,IAAA,CAAK5B,YAAU,EAAI6B,SAAAA;AAC5B,EAAA;;;;AAKA,EAAA,OAAcC,MAAAA,GAA6B;AACzC,IAAA,OAAO,IAAA,CAAK9B,YAAU,EAAI+B,KAAAA;AAC5B,EAAA;;;;AAKA,EAAA,OAAcC,QAAAA,GAA+B;AAC3C,IAAA,OAAO,IAAA,CAAKhC,YAAU,EAAIiC,KAAAA;AAC5B,EAAA;;;;AAKA,EAAA,OAAcC,UAAAA,GAAiC;AAC7C,IAAA,OAAO,IAAA,CAAKlC,YAAU,EAAImC,SAAAA;AAC5B,EAAA;;;;;AAMA,EAAA,OAAcC,mBAAAA,GAA0C;AACtD,IAAA,OAAO,IAAA,CAAKpC,UAAAA,EAAU,EAAIM,gBAAAA,IAAoBR,gBAAAA,EAAkBW,QAAAA;AAClE,EAAA;;;;;AAMA,EAAA,OAAc4B,uBAAAA,GAA8C;AAC1D,IAAA,OAAO,IAAA,CAAKrC,UAAAA,EAAU,EAAIO,oBAAAA,IAAwBT,gBAAAA,EAAkBY,YAAAA;AACtE,EAAA;;;;;;;;;;;;;;;;;AAkBA,EAAA,OAAc4B,kBAAAA,GAA6C;AACzD,IAAA,MAAM7B,QAAAA,GAAW,KAAK2B,mBAAAA,EAAmB;AACzC,IAAA,MAAM1B,YAAAA,GAAe,KAAK2B,uBAAAA,EAAuB;AACjD,IAAA,IAAI5B,YAAYC,YAAAA,EAAc;AAC5B,MAAA,OAAO;QACL,qBAAA,EAAuBD,QAAAA;QACvB,yBAAA,EAA2BC;AAC7B,OAAA;AACF,IAAA;AACA,IAAA,OAAO,EAAC;AACV,EAAA;;;;AAKA,EAAA,OAAc6B,cAAcC,OAAAA,EAAoC;AAC9D,IAAA,MAAMC,OAAAA,GAAU,KAAKzC,UAAAA,EAAU;AAC/B,IAAA,IAAIyC,OAAAA,EAAS;AACX,MAAA,IAAA,CAAKvC,UAAAA,CAAW;QAAE,GAAGuC,OAAAA;QAAS,GAAGD;OAAQ,CAAA;IAC3C,CAAA,MAAO;AACL,MAAA,IAAA,CAAKtC,WAAWsC,OAAAA,CAAAA;AAClB,IAAA;AACF,EAAA;;;;AAKA,EAAA,OAAcE,UAAAA,GAAsB;AAClC,IAAA,OAAO,IAAA,CAAK1C,YAAU,KAAOiB,MAAAA;AAC/B,EAAA;;;;AAKA,EAAA,OAAc0B,eAAeC,GAAAA,EAAsB;AACjD,IAAA,OAAO,IAAA,CAAK5C,UAAAA,EAAU,GAAK4C,GAAAA,CAAAA;AAC7B,EAAA;;;;EAKA,OAAcC,cAAAA,CAAeD,KAAaE,KAAAA,EAAsB;AAC9D,IAAA,MAAML,OAAAA,GAAU,IAAA,CAAKzC,UAAAA,EAAU,IAAM,EAAC;AACtC,IAAA,IAAA,CAAKE,UAAAA,CAAW;MAAE,GAAGuC,OAAAA;AAAS,MAAA,CAACG,GAAAA,GAAME;KAAM,CAAA;AAC7C,EAAA;AACF","file":"chunk-DXX6C6X6.js","sourcesContent":["/**\n * Context Module\n * Manages request-scoped context using AsyncLocalStorage\n * Thread-safe context propagation for async operations\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport type { SDKContext } from '../types/index.js';\n\nconst asyncLocalStorage = new AsyncLocalStorage<SDKContext>();\n\n/**\n * Module-level fallback for the Cloudflare Access service token.\n *\n * WHY THIS EXISTS — read before \"simplifying\" it away:\n * `asyncLocalStorage.enterWith()` (used by `setContext`) does NOT reliably\n * propagate across every async boundary under Bun + GraphQL Yoga — the same\n * limitation documented for the Prisma workspace context store\n * (see `src/prisma/workspace-extension.ts`). On top of that, the `createServer`\n * request path (`src/server/context.ts` `buildContext`) populates the *Prisma*\n * workspace store, not this `ContextManager` ALS at all. So a resolver-initiated\n * cross-layer call would otherwise read an empty context and attach no CF creds,\n * making the propagation a silent no-op on alpha.\n *\n * Unlike workspaceId/actorId (which differ per request and would race in a\n * module-level singleton), the CF Access service token is effectively\n * CONSTANT per environment — it's a single service-token pair fronting the\n * gateway. So caching it module-side is race-safe: concurrent requests all\n * carry the same value. It is only ever set when a request actually presents\n * the headers (gated upstream on `cf-ray`), and stays unset in dev/prod where\n * no CF Access sits in front of the gateways.\n */\nlet cfAccessFallback: { clientId: string; clientSecret: string } | undefined;\n\n/**\n * Context Manager for handling request-scoped context\n */\nexport class ContextManager {\n  /**\n   * Get current context from async local storage\n   */\n  public static getContext(): SDKContext | undefined {\n    return asyncLocalStorage.getStore();\n  }\n\n  /**\n   * Set context for current async scope\n   * Merges with existing context if present\n   */\n  public static setContext(context: SDKContext): void {\n    const currentContext = this.getContext() || {};\n    asyncLocalStorage.enterWith({ ...currentContext, ...context });\n    // Mirror CF creds to the module-level fallback so cross-layer calls can\n    // recover them even when enterWith() doesn't reach the resolver chain.\n    if (context.cfAccessClientId && context.cfAccessClientSecret) {\n      this.setCfAccessContext(context.cfAccessClientId, context.cfAccessClientSecret);\n    }\n  }\n\n  /**\n   * Record the Cloudflare Access service token for the current process.\n   *\n   * Call this from every request-context builder that may receive CF headers\n   * (the SDK `createServer` `buildContext` and the bootstrap HTTP middleware\n   * both do). Stored in a module-level fallback because `enterWith()` is not a\n   * reliable carrier under Bun + Yoga — see the `cfAccessFallback` note above.\n   *\n   * Deliberately a NO-OP when either cred is absent: `buildContext` runs on\n   * every request, so clearing here on a tokenless request could wipe the value\n   * a concurrent CF request just stored. The token is constant per environment,\n   * so \"remember, never clear on absence\" is both safe and correct. Use\n   * `clearContext()` to reset (shutdown / tests).\n   */\n  public static setCfAccessContext(clientId?: string, clientSecret?: string): void {\n    if (clientId && clientSecret) {\n      cfAccessFallback = { clientId, clientSecret };\n    }\n  }\n\n  /**\n   * Run function with specific context\n   * Context is isolated to this execution and its children\n   */\n  public static async withContext<T>(context: SDKContext, fn: () => Promise<T>): Promise<T> {\n    return asyncLocalStorage.run(context, fn);\n  }\n\n  /**\n   * Run synchronous function with specific context\n   */\n  public static withContextSync<T>(context: SDKContext, fn: () => T): T {\n    return asyncLocalStorage.run(context, fn);\n  }\n\n  /**\n   * Clear current context (including the module-level CF Access fallback).\n   */\n  public static clearContext(): void {\n    asyncLocalStorage.disable();\n    cfAccessFallback = undefined;\n  }\n\n  /**\n   * Get actor ID from context\n   */\n  public static getActorId(): string | undefined {\n    return this.getContext()?.actorId;\n  }\n\n  /**\n   * Get legacy user ID from context.\n   */\n  public static getUser(): string | undefined {\n    const context = this.getContext();\n    const userId = context?.['userId'];\n    return typeof userId === 'string' ? userId : context?.actorId;\n  }\n\n  /**\n   * Get workspace ID from context\n   */\n  public static getWorkspace(): string | undefined {\n    return this.getContext()?.workspaceId;\n  }\n\n  /**\n   * Get tenant ID from context\n   */\n  public static getTenant(): string | undefined {\n    return this.getContext()?.tenantId;\n  }\n\n  /**\n   * Get legacy organization ID from context.\n   */\n  public static getOrganization(): string | undefined {\n    const organizationId = this.getContext()?.['organizationId'];\n    return typeof organizationId === 'string' ? organizationId : undefined;\n  }\n\n  /**\n   * Get project ID from context\n   */\n  public static getProject(): string | undefined {\n    return this.getContext()?.projectId;\n  }\n\n  /**\n   * Get app ID from context\n   */\n  public static getApp(): string | undefined {\n    return this.getContext()?.appId;\n  }\n\n  /**\n   * Get JWT token from context\n   */\n  public static getToken(): string | undefined {\n    return this.getContext()?.token;\n  }\n\n  /**\n   * Get product ID from context\n   */\n  public static getProduct(): string | undefined {\n    return this.getContext()?.productId;\n  }\n\n  /**\n   * Get the Cloudflare Access service-token client id (ALS first, then the\n   * module-level fallback — see `cfAccessFallback`).\n   */\n  public static getCfAccessClientId(): string | undefined {\n    return this.getContext()?.cfAccessClientId ?? cfAccessFallback?.clientId;\n  }\n\n  /**\n   * Get the Cloudflare Access service-token client secret (ALS first, then the\n   * module-level fallback — see `cfAccessFallback`).\n   */\n  public static getCfAccessClientSecret(): string | undefined {\n    return this.getContext()?.cfAccessClientSecret ?? cfAccessFallback?.clientSecret;\n  }\n\n  /**\n   * Build the Cloudflare Access service-token header pair to re-present on a\n   * cross-layer outbound call.\n   *\n   * Cross-layer calls (wspace ↔ global) traverse the peer layer's PUBLIC\n   * gateway, which on alpha sits behind Cloudflare Access. Without the CF\n   * service token the request is rejected at the CF edge before reaching the\n   * gateway. We reuse the *inbound* request's CF creds (propagated by the\n   * public gateway into request-scoped context) so the cross-layer leg passes.\n   *\n   * Inbound-only: sourced from the request context (AsyncLocalStorage first,\n   * module-level fallback second — see `cfAccessFallback`). Returns `{}` unless\n   * BOTH creds are present — so it is a no-op in environments without CF in\n   * front of the gateways (local dev, and production, which is not\n   * CF-Access-gated and has no CF service token).\n   */\n  public static getCfAccessHeaders(): Record<string, string> {\n    const clientId = this.getCfAccessClientId();\n    const clientSecret = this.getCfAccessClientSecret();\n    if (clientId && clientSecret) {\n      return {\n        'cf-access-client-id': clientId,\n        'cf-access-client-secret': clientSecret,\n      };\n    }\n    return {};\n  }\n\n  /**\n   * Update specific context fields\n   */\n  public static updateContext(updates: Partial<SDKContext>): void {\n    const current = this.getContext();\n    if (current) {\n      this.setContext({ ...current, ...updates });\n    } else {\n      this.setContext(updates);\n    }\n  }\n\n  /**\n   * Check if context exists\n   */\n  public static hasContext(): boolean {\n    return this.getContext() !== undefined;\n  }\n\n  /**\n   * Get custom field from context\n   */\n  public static getCustomField(key: string): unknown {\n    return this.getContext()?.[key];\n  }\n\n  /**\n   * Set custom field in context\n   */\n  public static setCustomField(key: string, value: unknown): void {\n    const current = this.getContext() || {};\n    this.setContext({ ...current, [key]: value });\n  }\n}\n\n/**\n * Default export for convenience\n */\nexport const contextManager = ContextManager;\n\n/**\n * Helper function to extract context from HTTP request\n */\nexport function extractContextFromRequest(req: {\n  headers: Record<string, string | string[] | undefined>;\n  user?: { user_id?: string; workspace_id?: string; tenant_endpoint?: string };\n}): SDKContext {\n  const context: SDKContext = {};\n\n  // Extract from user object (if JWT already verified)\n  if (req.user) {\n    context.actorId = req.user.user_id;\n    context.workspaceId = req.user.workspace_id;\n    context.tenantId = req.user.tenant_endpoint;\n  }\n\n  // Extract from headers\n  const getHeader = (key: string): string | undefined => {\n    const value = req.headers[key.toLowerCase()];\n    return Array.isArray(value) ? value[0] : value;\n  };\n\n  const authHeader = getHeader('authorization');\n  if (authHeader) {\n    context.token = authHeader.replace('Bearer ', '');\n  }\n\n  const workspaceId = getHeader('x-workspace-id');\n  if (workspaceId && !context.workspaceId) {\n    context.workspaceId = workspaceId;\n  }\n\n  const productId = getHeader('x-product-id');\n  if (productId) {\n    context.productId = productId;\n  }\n\n  const projectId = getHeader('x-project-id');\n  if (projectId) {\n    context.projectId = projectId;\n  }\n\n  const appId = getHeader('x-app-id');\n  if (appId) {\n    context.appId = appId;\n  }\n\n  // Cloudflare Access service token. Forwarded to subgraphs by the public\n  // gateways only when the request actually transited CF (cf-ray present), so\n  // we can capture whatever arrives here. Re-presented on cross-layer outbound\n  // calls — see ContextManager.getCfAccessHeaders.\n  const cfAccessClientId = getHeader('cf-access-client-id');\n  if (cfAccessClientId) {\n    context.cfAccessClientId = cfAccessClientId;\n  }\n\n  const cfAccessClientSecret = getHeader('cf-access-client-secret');\n  if (cfAccessClientSecret) {\n    context.cfAccessClientSecret = cfAccessClientSecret;\n  }\n\n  return context;\n}\n"]}

package/dist/{chunk-KKCC3Z4I.js → chunk-FKSMQLIV.js}

@@ -1,5 +1,5 @@
 import { isTokenExpired, parseJWT } from './chunk-B7I4TABG.js';
-import { AuthenticationError } from './chunk-O6RHB2YP.js';
+import { AuthenticationError } from './chunk-SMGTXYFR.js';
 import { logger } from './chunk-CBZNP6RF.js';
 import { __name } from './chunk-XE4OXN2W.js';
 
@@ -272,5 +272,5 @@ var AuthModule = class {
 };
 
 export { AuthCookieHelper, AuthModule };
-//# sourceMappingURL=chunk-KKCC3Z4I.js.map
-//# sourceMappingURL=chunk-KKCC3Z4I.js.map
+//# sourceMappingURL=chunk-FKSMQLIV.js.map
+//# sourceMappingURL=chunk-FKSMQLIV.js.map

package/dist/{chunk-KKCC3Z4I.js.map → chunk-FKSMQLIV.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth/cookie-helper.ts","../src/auth/index.ts"],"names":["AuthCookieHelper","ACCESS_TOKEN_COOKIE","REFRESH_TOKEN_COOKIE","PROFILE_ID_COOKIE","setAuthCookies","context","tokens","options","isProd","process","env","domain","setCookie","name","value","accessToken","maxAge","httpOnly","secure","sameSite","path","refreshToken","rememberMe","profileId","clearAuthCookies","clearOptions","cookie","undefined","responseHeaders","append","AuthModule","client","verifyToken","token","logger","debug","isTokenExpired","valid","error","query","response","Error","message","decodeToken","payload","parseJWT","mutation","info","AuthenticationError","validatePermission","userId","permission","resourceId","allowed","isTokenValid","getUserIdFromToken","user_id","getWorkspaceIdFromToken","workspace_id","getTokenClaims","willExpireSoon","withinSeconds","exp","now","Math","floor","Date"],"mappings":";;;;;;AAoBO,IAAMA,mBAAN,MAAMA;EApBb;;;AAqBE,EAAA,OAAwBC,mBAAAA,GAAsB,OAAA;AAC9C,EAAA,OAAwBC,oBAAAA,GAAuB,OAAA;AAC/C,EAAA,OAAwBC,iBAAAA,GAAoB,QAAA;;;;AAK5C,EAAA,OAAcC,cAAAA,CACZC,OAAAA,EACAC,MAAAA,EACAC,OAAAA,GAAwD,EAAC,EACnD;AACN,IAAA,MAAMC,MAAAA,GAASC,OAAAA,CAAQC,GAAAA,CAAI,UAAA,CAAA,KAAgB,YAAA;AAC3C,IAAA,MAAMC,MAAAA,GAASF,OAAAA,CAAQC,GAAAA,CAAI,eAAA,CAAA;AAG3B,IAAA,IAAA,CAAKE,UAAUP,OAAAA,EAAS;AACtBQ,MAAAA,IAAAA,EAAM,IAAA,CAAKZ,mBAAAA;AACXa,MAAAA,KAAAA,EAAOR,MAAAA,CAAOS,WAAAA;AACdC,MAAAA,MAAAA,EAAQ,EAAA,GAAK,EAAA;MACbC,QAAAA,EAAU,IAAA;MACVC,MAAAA,EAAQV,MAAAA;MACRW,QAAAA,EAAU,KAAA;AACVR,MAAAA,MAAAA;MACAS,IAAAA,EAAM;KACR,CAAA;AAGA,IAAA,IAAId,OAAOe,YAAAA,EAAc;AACvB,MAAA,IAAA,CAAKT,UAAUP,OAAAA,EAAS;AACtBQ,QAAAA,IAAAA,EAAM,IAAA,CAAKX,oBAAAA;AACXY,QAAAA,KAAAA,EAAOR,MAAAA,CAAOe,YAAAA;QACdL,MAAAA,EAAQT,OAAAA,CAAQe,aAAa,EAAA,GAAK,EAAA,GAAK,KAAK,EAAA,GAAK,CAAA,GAAI,KAAK,EAAA,GAAK,EAAA;QAC/DL,QAAAA,EAAU,IAAA;QACVC,MAAAA,EAAQV,MAAAA;QACRW,QAAAA,EAAU,KAAA;AACVR,QAAAA,MAAAA;QACAS,IAAAA,EAAM;OACR,CAAA;AACF,IAAA;AAGA,IAAA,IAAIb,QAAQgB,SAAAA,EAAW;AACrB,MAAA,IAAA,CAAKX,UAAUP,OAAAA,EAAS;AACtBQ,QAAAA,IAAAA,EAAM,IAAA,CAAKV,iBAAAA;AACXW,QAAAA,KAAAA,EAAOP,OAAAA,CAAQgB,SAAAA;QACfP,MAAAA,EAAQ,EAAA,GAAK,KAAK,EAAA,GAAK,EAAA;QACvBC,QAAAA,EAAU,KAAA;QACVC,MAAAA,EAAQV,MAAAA;QACRW,QAAAA,EAAU,KAAA;AACVR,QAAAA,MAAAA;QACAS,IAAAA,EAAM;OACR,CAAA;AACF,IAAA;AACF,EAAA;;;;AAKA,EAAA,OAAcI,iBAAiBnB,OAAAA,EAA+B;AAC5D,IAAA,MAAMM,MAAAA,GAASF,OAAAA,CAAQC,GAAAA,CAAI,eAAA,CAAA;AAC3B,IAAA,MAAMF,MAAAA,GAASC,OAAAA,CAAQC,GAAAA,CAAI,UAAA,CAAA,KAAgB,YAAA;AAE3C,IAAA,MAAMe,YAAAA,GAAe;MACnBX,KAAAA,EAAO,EAAA;MACPE,MAAAA,EAAQ,CAAA;AACRL,MAAAA,MAAAA;MACAS,IAAAA,EAAM,GAAA;MACNF,MAAAA,EAAQV,MAAAA;MACRW,QAAAA,EAAU;AACZ,KAAA;AAEA,IAAA,IAAA,CAAKP,UAAUP,OAAAA,EAAS;MAAE,GAAGoB,YAAAA;AAAcZ,MAAAA,IAAAA,EAAM,IAAA,CAAKZ,mBAAAA;MAAqBgB,QAAAA,EAAU;KAAK,CAAA;AAC1F,IAAA,IAAA,CAAKL,UAAUP,OAAAA,EAAS;MACtB,GAAGoB,YAAAA;AACHZ,MAAAA,IAAAA,EAAM,IAAA,CAAKX,oBAAAA;MACXe,QAAAA,EAAU,IAAA;MACVG,IAAAA,EAAM;KACR,CAAA;AACA,IAAA,IAAA,CAAKR,UAAUP,OAAAA,EAAS;MAAE,GAAGoB,YAAAA;AAAcZ,MAAAA,IAAAA,EAAM,IAAA,CAAKV,iBAAAA;MAAmBc,QAAAA,EAAU;KAAM,CAAA;AAC3F,EAAA;;;;EAKA,OAAeL,SAAAA,CAAUP,SAAyBE,OAAAA,EAA8B;AAC9E,IAAA,IAAImB,SAAS,CAAA,EAAGnB,OAAAA,CAAQM,IAAI,CAAA,CAAA,EAAIN,QAAQO,KAAK,CAAA,CAAA;AAE7C,IAAA,IAAIP,OAAAA,CAAQS,WAAWW,MAAAA,EAAW;AAChCD,MAAAA,MAAAA,IAAU,CAAA,UAAA,EAAanB,QAAQS,MAAM,CAAA,CAAA;AACvC,IAAA;AAEA,IAAA,IAAIT,QAAQI,MAAAA,EAAQ;AAClBe,MAAAA,MAAAA,IAAU,CAAA,SAAA,EAAYnB,QAAQI,MAAM,CAAA,CAAA;AACtC,IAAA;AAEA,IAAA,IAAIJ,QAAQa,IAAAA,EAAM;AAChBM,MAAAA,MAAAA,IAAU,CAAA,OAAA,EAAUnB,QAAQa,IAAI,CAAA,CAAA;AAClC,IAAA;AAEA,IAAA,IAAIb,QAAQU,QAAAA,EAAU;AACpBS,MAAAA,MAAAA,IAAU,YAAA;AACZ,IAAA;AAEA,IAAA,IAAInB,QAAQW,MAAAA,EAAQ;AAClBQ,MAAAA,MAAAA,IAAU,UAAA;AACZ,IAAA;AAEA,IAAA,IAAInB,QAAQY,QAAAA,EAAU;AACpBO,MAAAA,MAAAA,IAAU,CAAA,WAAA,EAAcnB,QAAQY,QAAQ,CAAA,CAAA;AAC1C,IAAA;AAEAd,IAAAA,OAAAA,CAAQuB,eAAAA,CAAgBC,MAAAA,CAAO,YAAA,EAAcH,MAAAA,CAAAA;AAC/C,EAAA;AACF;;;AC7FO,IAAMI,aAAN,MAAMA;EA1Cb;;;;;AA2CE,EAAA,WAAA,CACUC,QACA1B,OAAAA,EACR;SAFQ0B,MAAAA,GAAAA,MAAAA;SACA1B,OAAAA,GAAAA,OAAAA;AACP,EAAA;;;;AAKH,EAAA,MAAa2B,YAAYC,KAAAA,EAA2C;AAClEC,IAAAA,MAAAA,CAAOC,MAAM,wBAAA,CAAA;AAGb,IAAA,IAAIC,cAAAA,CAAeH,KAAAA,CAAAA,EAAQ;AACzB,MAAA,OAAO;QACLI,KAAAA,EAAO,KAAA;QACPC,KAAAA,EAAO;AACT,OAAA;AACF,IAAA;AAEA,IAAA,MAAMC,KAAAA,GAAQ;;;;;;;;;AAUd,IAAA,IAAI;AACF,MAAA,MAAMC,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MAA0CA,KAAAA,EAAO;AAAEN,QAAAA;AAAM,OAAA,EAAG,KAAK5B,OAAO,CAAA;AAE3G6B,MAAAA,MAAAA,CAAOC,MAAM,kCAAA,EAAoC;AAAEE,QAAAA,KAAAA,EAAOG,SAASR,WAAAA,CAAYK;OAAM,CAAA;AAErF,MAAA,OAAOG,QAAAA,CAASR,WAAAA;AAClB,IAAA,CAAA,CAAA,OAASM,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,kCAAA,EAAoC;AAAEA,QAAAA;OAAM,CAAA;AACzD,MAAA,OAAO;QACLD,KAAAA,EAAO,KAAA;QACPC,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMI,OAAAA,GAAU;AAClD,OAAA;AACF,IAAA;AACF,EAAA;;;;AAKOC,EAAAA,WAAAA,CAAYV,KAAAA,EAAoC;AACrD,IAAA,MAAMW,OAAAA,GAAUC,SAASZ,KAAAA,CAAAA;AACzB,IAAA,IAAI,CAACW,OAAAA,EAAS;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AACA,IAAA,OAAOA,OAAAA;AACT,EAAA;;;;AAKA,EAAA,MAAavB,aAAaA,YAAAA,EAAmD;AAC3Ea,IAAAA,MAAAA,CAAOC,MAAM,yBAAA,CAAA;AAEb,IAAA,MAAMW,QAAAA,GAAW;;;;;;;;;AAUjB,IAAA,IAAI;AACF,MAAA,MAAMN,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MACjCO,QAAAA,EACA;AAAEzB,QAAAA;AAAa,OAAA,EACf,KAAKhB,OAAO,CAAA;AAGd6B,MAAAA,MAAAA,CAAOa,KAAK,qCAAA,CAAA;AAEZ,MAAA,OAAOP,QAAAA,CAASnB,YAAAA;AAClB,IAAA,CAAA,CAAA,OAASiB,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,6BAAA,EAA+B;AAAEA,QAAAA;OAAM,CAAA;AACpD,MAAA,MAAM,IAAIU,oBAAoB,yBAAA,EAA2B;QACvDV,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMI,OAAAA,GAAU;OAClD,CAAA;AACF,IAAA;AACF,EAAA;;;;EAKA,MAAaO,kBAAAA,CAAmBC,MAAAA,EAAgBC,UAAAA,EAAoBC,UAAAA,EAAuC;AACzGlB,IAAAA,MAAAA,CAAOC,MAAM,8BAAA,EAAgC;AAAEe,MAAAA,MAAAA;AAAQC,MAAAA,UAAAA;AAAYC,MAAAA;KAAW,CAAA;AAE9E,IAAA,MAAMb,KAAAA,GAAQ;;;;;;;AAQd,IAAA,IAAI;AACF,MAAA,MAAMC,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MAEhCA,KAAAA,EAAO;AAAEW,QAAAA,MAAAA;AAAQC,QAAAA,UAAAA;AAAYC,QAAAA;AAAW,OAAA,EAAG,KAAK/C,OAAO,CAAA;AAE1D6B,MAAAA,MAAAA,CAAOC,MAAM,qCAAA,EAAuC;AAClDkB,QAAAA,OAAAA,EAASb,SAASS,kBAAAA,CAAmBI;OACvC,CAAA;AAEA,MAAA,OAAOb,SAASS,kBAAAA,CAAmBI,OAAAA;AACrC,IAAA,CAAA,CAAA,OAASf,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,qCAAA,EAAuC;AAAEA,QAAAA;OAAM,CAAA;AAC5D,MAAA,OAAO,KAAA;AACT,IAAA;AACF,EAAA;;;;AAKOgB,EAAAA,YAAAA,CAAarB,KAAAA,EAAwB;AAC1C,IAAA,OAAO,CAACG,eAAeH,KAAAA,CAAAA;AACzB,EAAA;;;;AAKOsB,EAAAA,kBAAAA,CAAmBtB,KAAAA,EAA8B;AACtD,IAAA,MAAMW,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,OAAOW,SAASY,OAAAA,IAAW,IAAA;AAC7B,EAAA;;;;AAKOC,EAAAA,uBAAAA,CAAwBxB,KAAAA,EAA8B;AAC3D,IAAA,MAAMW,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,OAAOW,SAASc,YAAAA,IAAgB,IAAA;AAClC,EAAA;;;;AAKOC,EAAAA,cAAAA,CAAe1B,KAAAA,EAA+C;AACnE,IAAA,MAAMW,OAAAA,GAAUC,SAASZ,KAAAA,CAAAA;AACzB,IAAA,OAAOW,OAAAA;AACT,EAAA;;;;EAKOgB,cAAAA,CAAe3B,KAAAA,EAAe4B,gBAAwB,GAAA,EAAc;AACzE,IAAA,MAAMjB,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,IAAI,CAACW,OAAAA,IAAW,OAAOA,OAAAA,CAAQkB,QAAQ,QAAA,EAAU;AAC/C,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMC,MAAMC,IAAAA,CAAKC,KAAAA,CAAMC,IAAAA,CAAKH,GAAAA,KAAQ,GAAA,CAAA;AACpC,IAAA,OAAOnB,OAAAA,CAAQkB,MAAMC,GAAAA,GAAMF,aAAAA;AAC7B,EAAA;AACF","file":"chunk-KKCC3Z4I.js","sourcesContent":["/**\n * Auth Cookie Helper\n *\n * Utilities for setting secure, HttpOnly cookies for authentication.\n * Used by auth services to transition from localStorage to secure cookies.\n */\n\nimport type { GraphQLContext } from '../server/types.js';\n\nexport interface CookieOptions {\n  name: string;\n  value: string;\n  maxAge?: number;\n  domain?: string;\n  path?: string;\n  httpOnly?: boolean;\n  secure?: boolean;\n  sameSite?: 'Strict' | 'Lax' | 'None';\n}\n\nexport class AuthCookieHelper {\n  private static readonly ACCESS_TOKEN_COOKIE = 'bf_at';\n  private static readonly REFRESH_TOKEN_COOKIE = 'bf_rt';\n  private static readonly PROFILE_ID_COOKIE = 'bf_pid';\n\n  /**\n   * Set authentication cookies in the context response headers\n   */\n  public static setAuthCookies(\n    context: GraphQLContext,\n    tokens: { accessToken: string; refreshToken?: string },\n    options: { profileId?: string; rememberMe?: boolean } = {}\n  ): void {\n    const isProd = process.env['NODE_ENV'] === 'production';\n    const domain = process.env['COOKIE_DOMAIN'];\n\n    // Access token cookie (short-lived, 15m)\n    this.setCookie(context, {\n      name: this.ACCESS_TOKEN_COOKIE,\n      value: tokens.accessToken,\n      maxAge: 15 * 60,\n      httpOnly: true,\n      secure: isProd,\n      sameSite: 'Lax',\n      domain,\n      path: '/',\n    });\n\n    // Refresh token cookie (long-lived, 7d or 30d)\n    if (tokens.refreshToken) {\n      this.setCookie(context, {\n        name: this.REFRESH_TOKEN_COOKIE,\n        value: tokens.refreshToken,\n        maxAge: options.rememberMe ? 30 * 24 * 60 * 60 : 7 * 24 * 60 * 60,\n        httpOnly: true,\n        secure: isProd,\n        sameSite: 'Lax',\n        domain,\n        path: '/global/graphql', // Only send to global gateway for refresh\n      });\n    }\n\n    // Profile ID cookie (not HttpOnly, needed for UI profile resolution)\n    if (options.profileId) {\n      this.setCookie(context, {\n        name: this.PROFILE_ID_COOKIE,\n        value: options.profileId,\n        maxAge: 30 * 24 * 60 * 60,\n        httpOnly: false,\n        secure: isProd,\n        sameSite: 'Lax',\n        domain,\n        path: '/',\n      });\n    }\n  }\n\n  /**\n   * Clear authentication cookies\n   */\n  public static clearAuthCookies(context: GraphQLContext): void {\n    const domain = process.env['COOKIE_DOMAIN'];\n    const isProd = process.env['NODE_ENV'] === 'production';\n\n    const clearOptions = {\n      value: '',\n      maxAge: 0,\n      domain,\n      path: '/',\n      secure: isProd,\n      sameSite: 'Lax' as const,\n    };\n\n    this.setCookie(context, { ...clearOptions, name: this.ACCESS_TOKEN_COOKIE, httpOnly: true });\n    this.setCookie(context, {\n      ...clearOptions,\n      name: this.REFRESH_TOKEN_COOKIE,\n      httpOnly: true,\n      path: '/global/graphql',\n    });\n    this.setCookie(context, { ...clearOptions, name: this.PROFILE_ID_COOKIE, httpOnly: false });\n  }\n\n  /**\n   * Internal helper to set a cookie header\n   */\n  private static setCookie(context: GraphQLContext, options: CookieOptions): void {\n    let cookie = `${options.name}=${options.value}`;\n\n    if (options.maxAge !== undefined) {\n      cookie += `; Max-Age=${options.maxAge}`;\n    }\n\n    if (options.domain) {\n      cookie += `; Domain=${options.domain}`;\n    }\n\n    if (options.path) {\n      cookie += `; Path=${options.path}`;\n    }\n\n    if (options.httpOnly) {\n      cookie += '; HttpOnly';\n    }\n\n    if (options.secure) {\n      cookie += '; Secure';\n    }\n\n    if (options.sameSite) {\n      cookie += `; SameSite=${options.sameSite}`;\n    }\n\n    context.responseHeaders.append('Set-Cookie', cookie);\n  }\n}\n","/**\n * Authentication Module\n * JWT verification, token management, and user authentication\n */\n\nimport type { BurdenoffGraphQLClient } from '../client/graphql.js';\nimport type { SDKContext } from '../types/index.js';\nimport { AuthenticationError } from '../types/index.js';\nimport { logger } from '../logger/index.js';\nimport { parseJWT, isTokenExpired } from '../utils/index.js';\n\nexport { AuthCookieHelper } from './cookie-helper.js';\n\nexport interface TokenPayload {\n  jti: string;\n  sub: string;\n  user_id: string;\n  workspace_id?: string;\n  org_id?: string;\n  tenant_endpoint?: string;\n  iat: number;\n  exp: number;\n  scope?: string;\n}\n\nexport interface VerifyTokenResult {\n  valid: boolean;\n  payload?: TokenPayload;\n  error?: string;\n}\n\nexport interface RefreshTokenResult {\n  accessToken: string;\n  refreshToken: string;\n  expiresIn: number;\n}\n\nexport * from './cookie-helper.js';\n\n/**\n * Authentication Module\n */\nexport class AuthModule {\n  constructor(\n    private client: BurdenoffGraphQLClient,\n    private context: SDKContext\n  ) {}\n\n  /**\n   * Verify JWT token\n   */\n  public async verifyToken(token: string): Promise<VerifyTokenResult> {\n    logger.debug('[Auth] Verifying token');\n\n    // First check if token is expired locally\n    if (isTokenExpired(token)) {\n      return {\n        valid: false,\n        error: 'Token expired',\n      };\n    }\n\n    const query = `\n      query VerifyToken($token: String!) {\n        verifyToken(token: $token) {\n          valid\n          payload\n          error\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{ verifyToken: VerifyTokenResult }>(query, { token }, this.context);\n\n      logger.debug('[Auth] Token verification result', { valid: response.verifyToken.valid });\n\n      return response.verifyToken;\n    } catch (error) {\n      logger.error('[Auth] Token verification failed', { error });\n      return {\n        valid: false,\n        error: error instanceof Error ? error.message : 'Unknown error',\n      };\n    }\n  }\n\n  /**\n   * Decode token without verification\n   */\n  public decodeToken(token: string): TokenPayload | null {\n    const payload = parseJWT(token);\n    if (!payload) {\n      return null;\n    }\n    return payload as unknown as TokenPayload;\n  }\n\n  /**\n   * Refresh access token using refresh token\n   */\n  public async refreshToken(refreshToken: string): Promise<RefreshTokenResult> {\n    logger.debug('[Auth] Refreshing token');\n\n    const mutation = `\n      mutation RefreshToken($refreshToken: String!) {\n        refreshToken(refreshToken: $refreshToken) {\n          accessToken\n          refreshToken\n          expiresIn\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{ refreshToken: RefreshTokenResult }>(\n        mutation,\n        { refreshToken },\n        this.context\n      );\n\n      logger.info('[Auth] Token refreshed successfully');\n\n      return response.refreshToken;\n    } catch (error) {\n      logger.error('[Auth] Token refresh failed', { error });\n      throw new AuthenticationError('Failed to refresh token', {\n        error: error instanceof Error ? error.message : 'Unknown error',\n      });\n    }\n  }\n\n  /**\n   * Validate user has specific permission\n   */\n  public async validatePermission(userId: string, permission: string, resourceId?: string): Promise<boolean> {\n    logger.debug('[Auth] Validating permission', { userId, permission, resourceId });\n\n    const query = `\n      query ValidatePermission($userId: ID!, $permission: String!, $resourceId: ID) {\n        validatePermission(userId: $userId, permission: $permission, resourceId: $resourceId) {\n          allowed\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{\n        validatePermission: { allowed: boolean };\n      }>(query, { userId, permission, resourceId }, this.context);\n\n      logger.debug('[Auth] Permission validation result', {\n        allowed: response.validatePermission.allowed,\n      });\n\n      return response.validatePermission.allowed;\n    } catch (error) {\n      logger.error('[Auth] Permission validation failed', { error });\n      return false;\n    }\n  }\n\n  /**\n   * Check if token is valid and not expired\n   */\n  public isTokenValid(token: string): boolean {\n    return !isTokenExpired(token);\n  }\n\n  /**\n   * Get user ID from token\n   */\n  public getUserIdFromToken(token: string): string | null {\n    const payload = this.decodeToken(token);\n    return payload?.user_id || null;\n  }\n\n  /**\n   * Get workspace ID from token\n   */\n  public getWorkspaceIdFromToken(token: string): string | null {\n    const payload = this.decodeToken(token);\n    return payload?.workspace_id || null;\n  }\n\n  /**\n   * Extract all claims from token\n   */\n  public getTokenClaims(token: string): Record<string, unknown> | null {\n    const payload = parseJWT(token);\n    return payload;\n  }\n\n  /**\n   * Check if token will expire soon (within given seconds)\n   */\n  public willExpireSoon(token: string, withinSeconds: number = 300): boolean {\n    const payload = this.decodeToken(token);\n    if (!payload || typeof payload.exp !== 'number') {\n      return true;\n    }\n\n    const now = Math.floor(Date.now() / 1000);\n    return payload.exp - now < withinSeconds;\n  }\n}\n"]}
+{"version":3,"sources":["../src/auth/cookie-helper.ts","../src/auth/index.ts"],"names":["AuthCookieHelper","ACCESS_TOKEN_COOKIE","REFRESH_TOKEN_COOKIE","PROFILE_ID_COOKIE","setAuthCookies","context","tokens","options","isProd","process","env","domain","setCookie","name","value","accessToken","maxAge","httpOnly","secure","sameSite","path","refreshToken","rememberMe","profileId","clearAuthCookies","clearOptions","cookie","undefined","responseHeaders","append","AuthModule","client","verifyToken","token","logger","debug","isTokenExpired","valid","error","query","response","Error","message","decodeToken","payload","parseJWT","mutation","info","AuthenticationError","validatePermission","userId","permission","resourceId","allowed","isTokenValid","getUserIdFromToken","user_id","getWorkspaceIdFromToken","workspace_id","getTokenClaims","willExpireSoon","withinSeconds","exp","now","Math","floor","Date"],"mappings":";;;;;;AAoBO,IAAMA,mBAAN,MAAMA;EApBb;;;AAqBE,EAAA,OAAwBC,mBAAAA,GAAsB,OAAA;AAC9C,EAAA,OAAwBC,oBAAAA,GAAuB,OAAA;AAC/C,EAAA,OAAwBC,iBAAAA,GAAoB,QAAA;;;;AAK5C,EAAA,OAAcC,cAAAA,CACZC,OAAAA,EACAC,MAAAA,EACAC,OAAAA,GAAwD,EAAC,EACnD;AACN,IAAA,MAAMC,MAAAA,GAASC,OAAAA,CAAQC,GAAAA,CAAI,UAAA,CAAA,KAAgB,YAAA;AAC3C,IAAA,MAAMC,MAAAA,GAASF,OAAAA,CAAQC,GAAAA,CAAI,eAAA,CAAA;AAG3B,IAAA,IAAA,CAAKE,UAAUP,OAAAA,EAAS;AACtBQ,MAAAA,IAAAA,EAAM,IAAA,CAAKZ,mBAAAA;AACXa,MAAAA,KAAAA,EAAOR,MAAAA,CAAOS,WAAAA;AACdC,MAAAA,MAAAA,EAAQ,EAAA,GAAK,EAAA;MACbC,QAAAA,EAAU,IAAA;MACVC,MAAAA,EAAQV,MAAAA;MACRW,QAAAA,EAAU,KAAA;AACVR,MAAAA,MAAAA;MACAS,IAAAA,EAAM;KACR,CAAA;AAGA,IAAA,IAAId,OAAOe,YAAAA,EAAc;AACvB,MAAA,IAAA,CAAKT,UAAUP,OAAAA,EAAS;AACtBQ,QAAAA,IAAAA,EAAM,IAAA,CAAKX,oBAAAA;AACXY,QAAAA,KAAAA,EAAOR,MAAAA,CAAOe,YAAAA;QACdL,MAAAA,EAAQT,OAAAA,CAAQe,aAAa,EAAA,GAAK,EAAA,GAAK,KAAK,EAAA,GAAK,CAAA,GAAI,KAAK,EAAA,GAAK,EAAA;QAC/DL,QAAAA,EAAU,IAAA;QACVC,MAAAA,EAAQV,MAAAA;QACRW,QAAAA,EAAU,KAAA;AACVR,QAAAA,MAAAA;QACAS,IAAAA,EAAM;OACR,CAAA;AACF,IAAA;AAGA,IAAA,IAAIb,QAAQgB,SAAAA,EAAW;AACrB,MAAA,IAAA,CAAKX,UAAUP,OAAAA,EAAS;AACtBQ,QAAAA,IAAAA,EAAM,IAAA,CAAKV,iBAAAA;AACXW,QAAAA,KAAAA,EAAOP,OAAAA,CAAQgB,SAAAA;QACfP,MAAAA,EAAQ,EAAA,GAAK,KAAK,EAAA,GAAK,EAAA;QACvBC,QAAAA,EAAU,KAAA;QACVC,MAAAA,EAAQV,MAAAA;QACRW,QAAAA,EAAU,KAAA;AACVR,QAAAA,MAAAA;QACAS,IAAAA,EAAM;OACR,CAAA;AACF,IAAA;AACF,EAAA;;;;AAKA,EAAA,OAAcI,iBAAiBnB,OAAAA,EAA+B;AAC5D,IAAA,MAAMM,MAAAA,GAASF,OAAAA,CAAQC,GAAAA,CAAI,eAAA,CAAA;AAC3B,IAAA,MAAMF,MAAAA,GAASC,OAAAA,CAAQC,GAAAA,CAAI,UAAA,CAAA,KAAgB,YAAA;AAE3C,IAAA,MAAMe,YAAAA,GAAe;MACnBX,KAAAA,EAAO,EAAA;MACPE,MAAAA,EAAQ,CAAA;AACRL,MAAAA,MAAAA;MACAS,IAAAA,EAAM,GAAA;MACNF,MAAAA,EAAQV,MAAAA;MACRW,QAAAA,EAAU;AACZ,KAAA;AAEA,IAAA,IAAA,CAAKP,UAAUP,OAAAA,EAAS;MAAE,GAAGoB,YAAAA;AAAcZ,MAAAA,IAAAA,EAAM,IAAA,CAAKZ,mBAAAA;MAAqBgB,QAAAA,EAAU;KAAK,CAAA;AAC1F,IAAA,IAAA,CAAKL,UAAUP,OAAAA,EAAS;MACtB,GAAGoB,YAAAA;AACHZ,MAAAA,IAAAA,EAAM,IAAA,CAAKX,oBAAAA;MACXe,QAAAA,EAAU,IAAA;MACVG,IAAAA,EAAM;KACR,CAAA;AACA,IAAA,IAAA,CAAKR,UAAUP,OAAAA,EAAS;MAAE,GAAGoB,YAAAA;AAAcZ,MAAAA,IAAAA,EAAM,IAAA,CAAKV,iBAAAA;MAAmBc,QAAAA,EAAU;KAAM,CAAA;AAC3F,EAAA;;;;EAKA,OAAeL,SAAAA,CAAUP,SAAyBE,OAAAA,EAA8B;AAC9E,IAAA,IAAImB,SAAS,CAAA,EAAGnB,OAAAA,CAAQM,IAAI,CAAA,CAAA,EAAIN,QAAQO,KAAK,CAAA,CAAA;AAE7C,IAAA,IAAIP,OAAAA,CAAQS,WAAWW,MAAAA,EAAW;AAChCD,MAAAA,MAAAA,IAAU,CAAA,UAAA,EAAanB,QAAQS,MAAM,CAAA,CAAA;AACvC,IAAA;AAEA,IAAA,IAAIT,QAAQI,MAAAA,EAAQ;AAClBe,MAAAA,MAAAA,IAAU,CAAA,SAAA,EAAYnB,QAAQI,MAAM,CAAA,CAAA;AACtC,IAAA;AAEA,IAAA,IAAIJ,QAAQa,IAAAA,EAAM;AAChBM,MAAAA,MAAAA,IAAU,CAAA,OAAA,EAAUnB,QAAQa,IAAI,CAAA,CAAA;AAClC,IAAA;AAEA,IAAA,IAAIb,QAAQU,QAAAA,EAAU;AACpBS,MAAAA,MAAAA,IAAU,YAAA;AACZ,IAAA;AAEA,IAAA,IAAInB,QAAQW,MAAAA,EAAQ;AAClBQ,MAAAA,MAAAA,IAAU,UAAA;AACZ,IAAA;AAEA,IAAA,IAAInB,QAAQY,QAAAA,EAAU;AACpBO,MAAAA,MAAAA,IAAU,CAAA,WAAA,EAAcnB,QAAQY,QAAQ,CAAA,CAAA;AAC1C,IAAA;AAEAd,IAAAA,OAAAA,CAAQuB,eAAAA,CAAgBC,MAAAA,CAAO,YAAA,EAAcH,MAAAA,CAAAA;AAC/C,EAAA;AACF;;;AC7FO,IAAMI,aAAN,MAAMA;EA1Cb;;;;;AA2CE,EAAA,WAAA,CACUC,QACA1B,OAAAA,EACR;SAFQ0B,MAAAA,GAAAA,MAAAA;SACA1B,OAAAA,GAAAA,OAAAA;AACP,EAAA;;;;AAKH,EAAA,MAAa2B,YAAYC,KAAAA,EAA2C;AAClEC,IAAAA,MAAAA,CAAOC,MAAM,wBAAA,CAAA;AAGb,IAAA,IAAIC,cAAAA,CAAeH,KAAAA,CAAAA,EAAQ;AACzB,MAAA,OAAO;QACLI,KAAAA,EAAO,KAAA;QACPC,KAAAA,EAAO;AACT,OAAA;AACF,IAAA;AAEA,IAAA,MAAMC,KAAAA,GAAQ;;;;;;;;;AAUd,IAAA,IAAI;AACF,MAAA,MAAMC,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MAA0CA,KAAAA,EAAO;AAAEN,QAAAA;AAAM,OAAA,EAAG,KAAK5B,OAAO,CAAA;AAE3G6B,MAAAA,MAAAA,CAAOC,MAAM,kCAAA,EAAoC;AAAEE,QAAAA,KAAAA,EAAOG,SAASR,WAAAA,CAAYK;OAAM,CAAA;AAErF,MAAA,OAAOG,QAAAA,CAASR,WAAAA;AAClB,IAAA,CAAA,CAAA,OAASM,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,kCAAA,EAAoC;AAAEA,QAAAA;OAAM,CAAA;AACzD,MAAA,OAAO;QACLD,KAAAA,EAAO,KAAA;QACPC,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMI,OAAAA,GAAU;AAClD,OAAA;AACF,IAAA;AACF,EAAA;;;;AAKOC,EAAAA,WAAAA,CAAYV,KAAAA,EAAoC;AACrD,IAAA,MAAMW,OAAAA,GAAUC,SAASZ,KAAAA,CAAAA;AACzB,IAAA,IAAI,CAACW,OAAAA,EAAS;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AACA,IAAA,OAAOA,OAAAA;AACT,EAAA;;;;AAKA,EAAA,MAAavB,aAAaA,YAAAA,EAAmD;AAC3Ea,IAAAA,MAAAA,CAAOC,MAAM,yBAAA,CAAA;AAEb,IAAA,MAAMW,QAAAA,GAAW;;;;;;;;;AAUjB,IAAA,IAAI;AACF,MAAA,MAAMN,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MACjCO,QAAAA,EACA;AAAEzB,QAAAA;AAAa,OAAA,EACf,KAAKhB,OAAO,CAAA;AAGd6B,MAAAA,MAAAA,CAAOa,KAAK,qCAAA,CAAA;AAEZ,MAAA,OAAOP,QAAAA,CAASnB,YAAAA;AAClB,IAAA,CAAA,CAAA,OAASiB,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,6BAAA,EAA+B;AAAEA,QAAAA;OAAM,CAAA;AACpD,MAAA,MAAM,IAAIU,oBAAoB,yBAAA,EAA2B;QACvDV,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMI,OAAAA,GAAU;OAClD,CAAA;AACF,IAAA;AACF,EAAA;;;;EAKA,MAAaO,kBAAAA,CAAmBC,MAAAA,EAAgBC,UAAAA,EAAoBC,UAAAA,EAAuC;AACzGlB,IAAAA,MAAAA,CAAOC,MAAM,8BAAA,EAAgC;AAAEe,MAAAA,MAAAA;AAAQC,MAAAA,UAAAA;AAAYC,MAAAA;KAAW,CAAA;AAE9E,IAAA,MAAMb,KAAAA,GAAQ;;;;;;;AAQd,IAAA,IAAI;AACF,MAAA,MAAMC,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MAEhCA,KAAAA,EAAO;AAAEW,QAAAA,MAAAA;AAAQC,QAAAA,UAAAA;AAAYC,QAAAA;AAAW,OAAA,EAAG,KAAK/C,OAAO,CAAA;AAE1D6B,MAAAA,MAAAA,CAAOC,MAAM,qCAAA,EAAuC;AAClDkB,QAAAA,OAAAA,EAASb,SAASS,kBAAAA,CAAmBI;OACvC,CAAA;AAEA,MAAA,OAAOb,SAASS,kBAAAA,CAAmBI,OAAAA;AACrC,IAAA,CAAA,CAAA,OAASf,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,qCAAA,EAAuC;AAAEA,QAAAA;OAAM,CAAA;AAC5D,MAAA,OAAO,KAAA;AACT,IAAA;AACF,EAAA;;;;AAKOgB,EAAAA,YAAAA,CAAarB,KAAAA,EAAwB;AAC1C,IAAA,OAAO,CAACG,eAAeH,KAAAA,CAAAA;AACzB,EAAA;;;;AAKOsB,EAAAA,kBAAAA,CAAmBtB,KAAAA,EAA8B;AACtD,IAAA,MAAMW,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,OAAOW,SAASY,OAAAA,IAAW,IAAA;AAC7B,EAAA;;;;AAKOC,EAAAA,uBAAAA,CAAwBxB,KAAAA,EAA8B;AAC3D,IAAA,MAAMW,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,OAAOW,SAASc,YAAAA,IAAgB,IAAA;AAClC,EAAA;;;;AAKOC,EAAAA,cAAAA,CAAe1B,KAAAA,EAA+C;AACnE,IAAA,MAAMW,OAAAA,GAAUC,SAASZ,KAAAA,CAAAA;AACzB,IAAA,OAAOW,OAAAA;AACT,EAAA;;;;EAKOgB,cAAAA,CAAe3B,KAAAA,EAAe4B,gBAAwB,GAAA,EAAc;AACzE,IAAA,MAAMjB,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,IAAI,CAACW,OAAAA,IAAW,OAAOA,OAAAA,CAAQkB,QAAQ,QAAA,EAAU;AAC/C,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMC,MAAMC,IAAAA,CAAKC,KAAAA,CAAMC,IAAAA,CAAKH,GAAAA,KAAQ,GAAA,CAAA;AACpC,IAAA,OAAOnB,OAAAA,CAAQkB,MAAMC,GAAAA,GAAMF,aAAAA;AAC7B,EAAA;AACF","file":"chunk-FKSMQLIV.js","sourcesContent":["/**\n * Auth Cookie Helper\n *\n * Utilities for setting secure, HttpOnly cookies for authentication.\n * Used by auth services to transition from localStorage to secure cookies.\n */\n\nimport type { GraphQLContext } from '../server/types.js';\n\nexport interface CookieOptions {\n  name: string;\n  value: string;\n  maxAge?: number;\n  domain?: string;\n  path?: string;\n  httpOnly?: boolean;\n  secure?: boolean;\n  sameSite?: 'Strict' | 'Lax' | 'None';\n}\n\nexport class AuthCookieHelper {\n  private static readonly ACCESS_TOKEN_COOKIE = 'bf_at';\n  private static readonly REFRESH_TOKEN_COOKIE = 'bf_rt';\n  private static readonly PROFILE_ID_COOKIE = 'bf_pid';\n\n  /**\n   * Set authentication cookies in the context response headers\n   */\n  public static setAuthCookies(\n    context: GraphQLContext,\n    tokens: { accessToken: string; refreshToken?: string },\n    options: { profileId?: string; rememberMe?: boolean } = {}\n  ): void {\n    const isProd = process.env['NODE_ENV'] === 'production';\n    const domain = process.env['COOKIE_DOMAIN'];\n\n    // Access token cookie (short-lived, 15m)\n    this.setCookie(context, {\n      name: this.ACCESS_TOKEN_COOKIE,\n      value: tokens.accessToken,\n      maxAge: 15 * 60,\n      httpOnly: true,\n      secure: isProd,\n      sameSite: 'Lax',\n      domain,\n      path: '/',\n    });\n\n    // Refresh token cookie (long-lived, 7d or 30d)\n    if (tokens.refreshToken) {\n      this.setCookie(context, {\n        name: this.REFRESH_TOKEN_COOKIE,\n        value: tokens.refreshToken,\n        maxAge: options.rememberMe ? 30 * 24 * 60 * 60 : 7 * 24 * 60 * 60,\n        httpOnly: true,\n        secure: isProd,\n        sameSite: 'Lax',\n        domain,\n        path: '/global/graphql', // Only send to global gateway for refresh\n      });\n    }\n\n    // Profile ID cookie (not HttpOnly, needed for UI profile resolution)\n    if (options.profileId) {\n      this.setCookie(context, {\n        name: this.PROFILE_ID_COOKIE,\n        value: options.profileId,\n        maxAge: 30 * 24 * 60 * 60,\n        httpOnly: false,\n        secure: isProd,\n        sameSite: 'Lax',\n        domain,\n        path: '/',\n      });\n    }\n  }\n\n  /**\n   * Clear authentication cookies\n   */\n  public static clearAuthCookies(context: GraphQLContext): void {\n    const domain = process.env['COOKIE_DOMAIN'];\n    const isProd = process.env['NODE_ENV'] === 'production';\n\n    const clearOptions = {\n      value: '',\n      maxAge: 0,\n      domain,\n      path: '/',\n      secure: isProd,\n      sameSite: 'Lax' as const,\n    };\n\n    this.setCookie(context, { ...clearOptions, name: this.ACCESS_TOKEN_COOKIE, httpOnly: true });\n    this.setCookie(context, {\n      ...clearOptions,\n      name: this.REFRESH_TOKEN_COOKIE,\n      httpOnly: true,\n      path: '/global/graphql',\n    });\n    this.setCookie(context, { ...clearOptions, name: this.PROFILE_ID_COOKIE, httpOnly: false });\n  }\n\n  /**\n   * Internal helper to set a cookie header\n   */\n  private static setCookie(context: GraphQLContext, options: CookieOptions): void {\n    let cookie = `${options.name}=${options.value}`;\n\n    if (options.maxAge !== undefined) {\n      cookie += `; Max-Age=${options.maxAge}`;\n    }\n\n    if (options.domain) {\n      cookie += `; Domain=${options.domain}`;\n    }\n\n    if (options.path) {\n      cookie += `; Path=${options.path}`;\n    }\n\n    if (options.httpOnly) {\n      cookie += '; HttpOnly';\n    }\n\n    if (options.secure) {\n      cookie += '; Secure';\n    }\n\n    if (options.sameSite) {\n      cookie += `; SameSite=${options.sameSite}`;\n    }\n\n    context.responseHeaders.append('Set-Cookie', cookie);\n  }\n}\n","/**\n * Authentication Module\n * JWT verification, token management, and user authentication\n */\n\nimport type { BurdenoffGraphQLClient } from '../client/graphql.js';\nimport type { SDKContext } from '../types/index.js';\nimport { AuthenticationError } from '../types/index.js';\nimport { logger } from '../logger/index.js';\nimport { parseJWT, isTokenExpired } from '../utils/index.js';\n\nexport { AuthCookieHelper } from './cookie-helper.js';\n\nexport interface TokenPayload {\n  jti: string;\n  sub: string;\n  user_id: string;\n  workspace_id?: string;\n  org_id?: string;\n  tenant_endpoint?: string;\n  iat: number;\n  exp: number;\n  scope?: string;\n}\n\nexport interface VerifyTokenResult {\n  valid: boolean;\n  payload?: TokenPayload;\n  error?: string;\n}\n\nexport interface RefreshTokenResult {\n  accessToken: string;\n  refreshToken: string;\n  expiresIn: number;\n}\n\nexport * from './cookie-helper.js';\n\n/**\n * Authentication Module\n */\nexport class AuthModule {\n  constructor(\n    private client: BurdenoffGraphQLClient,\n    private context: SDKContext\n  ) {}\n\n  /**\n   * Verify JWT token\n   */\n  public async verifyToken(token: string): Promise<VerifyTokenResult> {\n    logger.debug('[Auth] Verifying token');\n\n    // First check if token is expired locally\n    if (isTokenExpired(token)) {\n      return {\n        valid: false,\n        error: 'Token expired',\n      };\n    }\n\n    const query = `\n      query VerifyToken($token: String!) {\n        verifyToken(token: $token) {\n          valid\n          payload\n          error\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{ verifyToken: VerifyTokenResult }>(query, { token }, this.context);\n\n      logger.debug('[Auth] Token verification result', { valid: response.verifyToken.valid });\n\n      return response.verifyToken;\n    } catch (error) {\n      logger.error('[Auth] Token verification failed', { error });\n      return {\n        valid: false,\n        error: error instanceof Error ? error.message : 'Unknown error',\n      };\n    }\n  }\n\n  /**\n   * Decode token without verification\n   */\n  public decodeToken(token: string): TokenPayload | null {\n    const payload = parseJWT(token);\n    if (!payload) {\n      return null;\n    }\n    return payload as unknown as TokenPayload;\n  }\n\n  /**\n   * Refresh access token using refresh token\n   */\n  public async refreshToken(refreshToken: string): Promise<RefreshTokenResult> {\n    logger.debug('[Auth] Refreshing token');\n\n    const mutation = `\n      mutation RefreshToken($refreshToken: String!) {\n        refreshToken(refreshToken: $refreshToken) {\n          accessToken\n          refreshToken\n          expiresIn\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{ refreshToken: RefreshTokenResult }>(\n        mutation,\n        { refreshToken },\n        this.context\n      );\n\n      logger.info('[Auth] Token refreshed successfully');\n\n      return response.refreshToken;\n    } catch (error) {\n      logger.error('[Auth] Token refresh failed', { error });\n      throw new AuthenticationError('Failed to refresh token', {\n        error: error instanceof Error ? error.message : 'Unknown error',\n      });\n    }\n  }\n\n  /**\n   * Validate user has specific permission\n   */\n  public async validatePermission(userId: string, permission: string, resourceId?: string): Promise<boolean> {\n    logger.debug('[Auth] Validating permission', { userId, permission, resourceId });\n\n    const query = `\n      query ValidatePermission($userId: ID!, $permission: String!, $resourceId: ID) {\n        validatePermission(userId: $userId, permission: $permission, resourceId: $resourceId) {\n          allowed\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{\n        validatePermission: { allowed: boolean };\n      }>(query, { userId, permission, resourceId }, this.context);\n\n      logger.debug('[Auth] Permission validation result', {\n        allowed: response.validatePermission.allowed,\n      });\n\n      return response.validatePermission.allowed;\n    } catch (error) {\n      logger.error('[Auth] Permission validation failed', { error });\n      return false;\n    }\n  }\n\n  /**\n   * Check if token is valid and not expired\n   */\n  public isTokenValid(token: string): boolean {\n    return !isTokenExpired(token);\n  }\n\n  /**\n   * Get user ID from token\n   */\n  public getUserIdFromToken(token: string): string | null {\n    const payload = this.decodeToken(token);\n    return payload?.user_id || null;\n  }\n\n  /**\n   * Get workspace ID from token\n   */\n  public getWorkspaceIdFromToken(token: string): string | null {\n    const payload = this.decodeToken(token);\n    return payload?.workspace_id || null;\n  }\n\n  /**\n   * Extract all claims from token\n   */\n  public getTokenClaims(token: string): Record<string, unknown> | null {\n    const payload = parseJWT(token);\n    return payload;\n  }\n\n  /**\n   * Check if token will expire soon (within given seconds)\n   */\n  public willExpireSoon(token: string, withinSeconds: number = 300): boolean {\n    const payload = this.decodeToken(token);\n    if (!payload || typeof payload.exp !== 'number') {\n      return true;\n    }\n\n    const now = Math.floor(Date.now() / 1000);\n    return payload.exp - now < withinSeconds;\n  }\n}\n"]}

package/dist/{chunk-BNJFEOGH.js → chunk-FTDQ6NY5.js}

@@ -1,5 +1,5 @@
-import { ValidationError, PermissionDeniedError } from './chunk-O6RHB2YP.js';
-import { DEFAULT_GATEWAY_ROUTING, DEFAULT_LAYER_RESOURCES } from './chunk-HP6JTFNR.js';
+import { ValidationError, PermissionDeniedError } from './chunk-SMGTXYFR.js';
+import { DEFAULT_GATEWAY_ROUTING, DEFAULT_LAYER_RESOURCES } from './chunk-YFOHAHZE.js';
 import { logger } from './chunk-CBZNP6RF.js';
 import { __name } from './chunk-XE4OXN2W.js';
 import { GraphQLError } from 'graphql';
@@ -1491,5 +1491,5 @@ var RBACModule = class {
 };
 
 export { RBACClient, RBACModule, createRBACClientFromEnv, createRBACDirective, createRBACDirectiveForLayer, createRBACDirectiveFromEnv };
-//# sourceMappingURL=chunk-BNJFEOGH.js.map
-//# sourceMappingURL=chunk-BNJFEOGH.js.map
+//# sourceMappingURL=chunk-FTDQ6NY5.js.map
+//# sourceMappingURL=chunk-FTDQ6NY5.js.map