@burdenoff/be-sdk 2026.611.1 → 2026.622.1

package/dist/{chunk-HP6JTFNR.js.map → chunk-YFOHAHZE.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/types/layer.ts"],"names":["DEFAULT_GATEWAY_ROUTING","wspace","layer","internalGateway","host","port","graphqlPath","crossLayerGateway","global","DEFAULT_LAYER_STREAMS","name","subjects","description","buildInternalGatewayUrl","routing","protocol","DEFAULT_LAYER_RESOURCES","eventQueueUrl","valkeyUrl","temporalAddress","temporalNamespace","rbacGatewayUrl","DEFAULT_CIRCUIT_BREAKER_CONFIG","failureThreshold","resetTimeout","failureWindow","DEFAULT_GATEWAY_RETRY_CONFIG","maxAttempts","initialDelay","maxDelay","backoffMultiplier"],"mappings":";;;AAyJO,IAAMA,uBAAAA,GAAsE;EACjFC,MAAAA,EAAQ;IACNC,KAAAA,EAAO,QAAA;IACPC,eAAAA,EAAiB;MACfC,IAAAA,EAAM,oBAAA;MACNC,IAAAA,EAAM,IAAA;MACNC,WAAAA,EAAa;AACf,KAAA;IACAC,iBAAAA,EAAmB;MACjBH,IAAAA,EAAM,uBAAA;MACNC,IAAAA,EAAM,GAAA;MACNC,WAAAA,EAAa;AACf;AACF,GAAA;EACAE,MAAAA,EAAQ;IACNN,KAAAA,EAAO,QAAA;IACPC,eAAAA,EAAiB;MACfC,IAAAA,EAAM,oBAAA;MACNC,IAAAA,EAAM,IAAA;MACNC,WAAAA,EAAa;AACf,KAAA;IACAC,iBAAAA,EAAmB;MACjBH,IAAAA,EAAM,uBAAA;MACNC,IAAAA,EAAM,IAAA;MACNC,WAAAA,EAAa;AACf;AACF;AACF;AAKO,IAAMG,qBAAAA,GAGT;EACFR,MAAAA,EAAQ;AACN,IAAA;MACES,IAAAA,EAAM,eAAA;MACNC,QAAAA,EAAU;AAAC,QAAA;;MACXC,WAAAA,EAAa;AACf,KAAA;AACA,IAAA;MACEF,IAAAA,EAAM,qBAAA;MACNC,QAAAA,EAAU;AAAC,QAAA;;MACXC,WAAAA,EAAa;AACf;;EAEFJ,MAAAA,EAAQ;AACN,IAAA;MACEE,IAAAA,EAAM,eAAA;MACNC,QAAAA,EAAU;AAAC,QAAA;;MACXC,WAAAA,EAAa;AACf,KAAA;AACA,IAAA;MACEF,IAAAA,EAAM,qBAAA;MACNC,QAAAA,EAAU;AAAC,QAAA;;MACXC,WAAAA,EAAa;AACf;;AAEJ;AAMA,SAASC,wBAAwBX,KAAAA,EAAmB;AAClD,EAAA,MAAMY,OAAAA,GAAUd,wBAAwBE,KAAAA,CAAAA;AACxC,EAAA,MAAM,EAAEE,IAAAA,EAAMC,IAAAA,EAAMC,WAAAA,KAAgBQ,OAAAA,CAAQX,eAAAA;AAE5C,EAAA,MAAMY,QAAAA,GAAW,MAAA;AACjB,EAAA,OAAO,GAAGA,QAAAA,CAAAA,GAAAA,EAAcX,IAAAA,CAAAA,CAAAA,EAAQC,IAAAA,GAAOC,WAAAA,CAAAA,CAAAA;AACzC;AANSO,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AAcF,IAAMG,uBAAAA,GAAmE;;;;;EAK9Ef,MAAAA,EAAQ;IACNgB,aAAAA,EAAe,mCAAA;IACfC,SAAAA,EAAW,6BAAA;IACXC,eAAAA,EAAiB,sBAAA;IACjBC,iBAAAA,EAAmB,gBAAA;AACnBC,IAAAA,cAAAA,EAAgBR,wBAAwB,QAAA;AAC1C,GAAA;EACAL,MAAAA,EAAQ;IACNS,aAAAA,EAAe,mCAAA;IACfC,SAAAA,EAAW,6BAAA;IACXC,eAAAA,EAAiB,sBAAA;IACjBC,iBAAAA,EAAmB,gBAAA;AACnBC,IAAAA,cAAAA,EAAgBR,wBAAwB,QAAA;AAC1C;AACF;AA4BO,IAAMS,8BAAAA,GAAuD;EAClEC,gBAAAA,EAAkB,CAAA;EAClBC,YAAAA,EAAc,GAAA;EACdC,aAAAA,EAAe;AACjB;AAkCO,IAAMC,4BAAAA,GAAmD;EAC9DC,WAAAA,EAAa,CAAA;EACbC,YAAAA,EAAc,GAAA;EACdC,QAAAA,EAAU,GAAA;EACVC,iBAAAA,EAAmB;AACrB","file":"chunk-HP6JTFNR.js","sourcesContent":["/**\n * Layer Type Definitions for Burdenoff Backend SDK\n *\n * This module defines types for the layer-aware architecture,\n * supporting wspace (workspace) and global (tenant) service layers.\n *\n * @module types/layer\n * @category Configuration\n */\n\n/**\n * Service layer types\n * - wspace: Workspace layer services (product-specific operations)\n * - global: Global/tenant layer services (cross-product services)\n */\nexport type ServiceLayer = 'wspace' | 'global';\n\n/**\n * Layer configuration for a service\n */\nexport interface LayerConfig {\n  /**\n   * Layer type this service belongs to\n   * @example 'wspace' or 'global'\n   */\n  layer: ServiceLayer;\n\n  /**\n   * Service name (e.g., 'wspace-tags-svc', 'global-auth-svc')\n   */\n  serviceName: string;\n\n  /**\n   * Service identity for bypass headers\n   * Used for M2M authentication\n   * @default serviceName\n   */\n  serviceIdentity?: string;\n}\n\n/**\n * Gateway configuration per layer\n */\nexport interface LayerGatewayConfig {\n  /**\n   * Internal gateway URL (same layer int-gateway)\n   * - wspace services use: wspace-int-gateway\n   * - global services use: global-int-gateway\n   */\n  internalGatewayUrl: string;\n\n  /**\n   * Cross-layer gateway URL (cross layer public-gateway)\n   * - wspace services use: global-public-gateway\n   * - global services use: wspace-public-gateway\n   */\n  crossLayerGatewayUrl: string;\n}\n\n/**\n * Resource URLs per layer\n */\nexport interface LayerResourceUrls {\n  /**\n   * Event queue (Redis Streams) URL.\n   *\n   * Single fleet-shared Redis instance in every environment:\n   *   - ACA (prod/alpha): Azure Managed Redis — `REDIS_URL` injected from\n   *     KeyVault overrides this default.\n   *   - Local dev: self-hosted `shared-valkey` reachable via\n   *     docker-compose; the default below points at the same container\n   *     name used by `~/products/dev`'s compose graph.\n   *\n   * `LayerManager.resolveResourceConfig()` always prefers `REDIS_URL`\n   * from the environment, so the layer-scoped default is only the\n   * local-dev fallback.\n   */\n  eventQueueUrl: string;\n\n  /**\n   * Valkey/Redis URL for the layer\n   */\n  valkeyUrl: string;\n\n  /**\n   * Temporal server address for the layer\n   */\n  temporalAddress: string;\n\n  /**\n   * Temporal namespace for the layer\n   */\n  temporalNamespace: string;\n\n  /**\n   * RBAC gateway URL (for permission checks)\n   */\n  rbacGatewayUrl: string;\n}\n\n/**\n * Complete layer configuration including gateways and resources\n */\nexport interface LayerFullConfig extends LayerConfig {\n  /**\n   * Gateway configuration\n   */\n  gateways: LayerGatewayConfig;\n\n  /**\n   * Resource URLs\n   */\n  resources: LayerResourceUrls;\n}\n\n/**\n * Gateway routing rules by layer\n * Defines which gateway to use for same-layer vs cross-layer communication\n */\nexport interface GatewayRoutingConfig {\n  /**\n   * Layer this config applies to\n   */\n  layer: ServiceLayer;\n\n  /**\n   * Internal gateway for same-layer M2M calls\n   */\n  internalGateway: {\n    /** Gateway host (without protocol) */\n    host: string;\n    /** Gateway port */\n    port: number;\n    /** GraphQL endpoint path */\n    graphqlPath: string;\n  };\n\n  /**\n   * Public gateway for cross-layer calls\n   */\n  crossLayerGateway: {\n    /** Gateway host (without protocol) */\n    host: string;\n    /** Gateway port */\n    port: number;\n    /** GraphQL endpoint path */\n    graphqlPath: string;\n  };\n}\n\n/**\n * Default gateway routing configuration\n */\nexport const DEFAULT_GATEWAY_ROUTING: Record<ServiceLayer, GatewayRoutingConfig> = {\n  wspace: {\n    layer: 'wspace',\n    internalGateway: {\n      host: 'wspace-int-gateway',\n      port: 4001,\n      graphqlPath: '/workspaces/graphql',\n    },\n    crossLayerGateway: {\n      host: 'global-public-gateway',\n      port: 4000,\n      graphqlPath: '/global/graphql',\n    },\n  },\n  global: {\n    layer: 'global',\n    internalGateway: {\n      host: 'global-int-gateway',\n      port: 4002,\n      graphqlPath: '/global/graphql',\n    },\n    crossLayerGateway: {\n      host: 'wspace-public-gateway',\n      port: 4003,\n      graphqlPath: '/workspaces/graphql',\n    },\n  },\n};\n\n/**\n * Default stream configurations per layer\n */\nexport const DEFAULT_LAYER_STREAMS: Record<\n  ServiceLayer,\n  Array<{ name: string; subjects: string[]; description?: string }>\n> = {\n  wspace: [\n    {\n      name: 'WSPACE_EVENTS',\n      subjects: ['wspace.>'],\n      description: 'Workspace layer events stream',\n    },\n    {\n      name: 'WSPACE_GRAPH_EVENTS',\n      subjects: ['graph.>'],\n      description: 'Workspace layer graph events stream (captures all graph entity events)',\n    },\n  ],\n  global: [\n    {\n      name: 'GLOBAL_EVENTS',\n      subjects: ['global.>'],\n      description: 'Global layer events stream',\n    },\n    {\n      name: 'GLOBAL_GRAPH_EVENTS',\n      subjects: ['graph.>'],\n      description: 'Global layer graph events stream (captures all graph entity events)',\n    },\n  ],\n};\n\n/**\n * Build internal gateway URL for a layer\n * Uses HTTP for internal K8s communication (mTLS via Istio service mesh)\n */\nfunction buildInternalGatewayUrl(layer: ServiceLayer): string {\n  const routing = DEFAULT_GATEWAY_ROUTING[layer];\n  const { host, port, graphqlPath } = routing.internalGateway;\n  // Internal K8s services use plain HTTP with mTLS handled by Istio\n  const protocol = 'http';\n  return `${protocol}://${host}:${port}${graphqlPath}`;\n}\n\n/**\n * Default resource URLs per layer\n *\n * Note: Internal K8s service communication uses plain HTTP with mTLS via Istio.\n * External traffic uses HTTPS via ingress gateway.\n */\nexport const DEFAULT_LAYER_RESOURCES: Record<ServiceLayer, LayerResourceUrls> = {\n  // The event queue is a single fleet-shared Redis (Azure Managed Redis in\n  // ACA, fed via REDIS_URL; self-hosted shared-valkey in local dev). The\n  // layer-scoped default URL below is only the local-dev compose hostname —\n  // production always overrides via REDIS_URL.\n  wspace: {\n    eventQueueUrl: 'redis://wspace-shared-valkey:6379',\n    valkeyUrl: 'valkey://wspace-valkey:6379',\n    temporalAddress: 'wspace-temporal:7233',\n    temporalNamespace: 'wspace-default',\n    rbacGatewayUrl: buildInternalGatewayUrl('wspace'),\n  },\n  global: {\n    eventQueueUrl: 'redis://global-shared-valkey:6379',\n    valkeyUrl: 'valkey://global-valkey:6379',\n    temporalAddress: 'global-temporal:7233',\n    temporalNamespace: 'global-default',\n    rbacGatewayUrl: buildInternalGatewayUrl('global'),\n  },\n};\n\n/**\n * Circuit breaker configuration for gateway client\n */\nexport interface CircuitBreakerConfig {\n  /**\n   * Number of failures before opening circuit\n   * @default 5\n   */\n  failureThreshold: number;\n\n  /**\n   * Time in milliseconds to wait before attempting to close circuit\n   * @default 30000 (30 seconds)\n   */\n  resetTimeout: number;\n\n  /**\n   * Time window in milliseconds for counting failures\n   * @default 60000 (60 seconds)\n   */\n  failureWindow: number;\n}\n\n/**\n * Default circuit breaker configuration\n */\nexport const DEFAULT_CIRCUIT_BREAKER_CONFIG: CircuitBreakerConfig = {\n  failureThreshold: 5,\n  resetTimeout: 30000,\n  failureWindow: 60000,\n};\n\n/**\n * Retry configuration for gateway client\n */\nexport interface GatewayRetryConfig {\n  /**\n   * Maximum number of retry attempts\n   * @default 3\n   */\n  maxAttempts: number;\n\n  /**\n   * Initial delay in milliseconds before first retry\n   * @default 1000 (1 second)\n   */\n  initialDelay: number;\n\n  /**\n   * Maximum delay in milliseconds between retries\n   * @default 10000 (10 seconds)\n   */\n  maxDelay: number;\n\n  /**\n   * Backoff multiplier for exponential backoff\n   * @default 2\n   */\n  backoffMultiplier: number;\n}\n\n/**\n * Default retry configuration\n */\nexport const DEFAULT_GATEWAY_RETRY_CONFIG: GatewayRetryConfig = {\n  maxAttempts: 3,\n  initialDelay: 1000,\n  maxDelay: 10000,\n  backoffMultiplier: 2,\n};\n\n/**\n * Headers automatically added by gateway client for M2M calls\n */\nexport interface GatewayRequestHeaders {\n  /**\n   * Actor ID making the request\n   */\n  'x-actor-id'?: string;\n\n  /**\n   * Actor type\n   */\n  'x-actor-type'?: 'user' | 'app' | 'service' | 'super_admin';\n\n  /**\n   * Workspace ID for the request context\n   */\n  'x-workspace-id'?: string;\n\n  /**\n   * Service identity for bypass validation\n   */\n  'x-service-identity'?: string;\n\n  /**\n   * Call type indicator\n   */\n  'x-call-type'?: 'internal' | 'cross-layer';\n\n  /**\n   * Permission bypass flag\n   */\n  'x-bypass-permission'?: string;\n\n  /**\n   * RBAC bypass flag (set by gateway)\n   */\n  'x-rbac-bypass'?: 'true' | 'false';\n\n  /**\n   * Bypass source (set by gateway)\n   */\n  'x-bypass-source'?: string;\n\n  /**\n   * Bypass timestamp (set by gateway)\n   */\n  'x-bypass-timestamp'?: string;\n}\n"]}
+{"version":3,"sources":["../src/types/layer.ts"],"names":["DEFAULT_GATEWAY_ROUTING","wspace","layer","internalGateway","host","port","graphqlPath","crossLayerGateway","global","DEFAULT_LAYER_STREAMS","name","subjects","description","buildInternalGatewayUrl","routing","protocol","DEFAULT_LAYER_RESOURCES","eventQueueUrl","valkeyUrl","temporalAddress","temporalNamespace","rbacGatewayUrl","DEFAULT_CIRCUIT_BREAKER_CONFIG","failureThreshold","resetTimeout","failureWindow","DEFAULT_GATEWAY_RETRY_CONFIG","maxAttempts","initialDelay","maxDelay","backoffMultiplier"],"mappings":";;;AAyJO,IAAMA,uBAAAA,GAAsE;EACjFC,MAAAA,EAAQ;IACNC,KAAAA,EAAO,QAAA;IACPC,eAAAA,EAAiB;MACfC,IAAAA,EAAM,oBAAA;MACNC,IAAAA,EAAM,IAAA;MACNC,WAAAA,EAAa;AACf,KAAA;IACAC,iBAAAA,EAAmB;MACjBH,IAAAA,EAAM,uBAAA;MACNC,IAAAA,EAAM,GAAA;MACNC,WAAAA,EAAa;AACf;AACF,GAAA;EACAE,MAAAA,EAAQ;IACNN,KAAAA,EAAO,QAAA;IACPC,eAAAA,EAAiB;MACfC,IAAAA,EAAM,oBAAA;MACNC,IAAAA,EAAM,IAAA;MACNC,WAAAA,EAAa;AACf,KAAA;IACAC,iBAAAA,EAAmB;MACjBH,IAAAA,EAAM,uBAAA;MACNC,IAAAA,EAAM,IAAA;MACNC,WAAAA,EAAa;AACf;AACF;AACF;AAKO,IAAMG,qBAAAA,GAGT;EACFR,MAAAA,EAAQ;AACN,IAAA;MACES,IAAAA,EAAM,eAAA;MACNC,QAAAA,EAAU;AAAC,QAAA;;MACXC,WAAAA,EAAa;AACf,KAAA;AACA,IAAA;MACEF,IAAAA,EAAM,qBAAA;MACNC,QAAAA,EAAU;AAAC,QAAA;;MACXC,WAAAA,EAAa;AACf;;EAEFJ,MAAAA,EAAQ;AACN,IAAA;MACEE,IAAAA,EAAM,eAAA;MACNC,QAAAA,EAAU;AAAC,QAAA;;MACXC,WAAAA,EAAa;AACf,KAAA;AACA,IAAA;MACEF,IAAAA,EAAM,qBAAA;MACNC,QAAAA,EAAU;AAAC,QAAA;;MACXC,WAAAA,EAAa;AACf;;AAEJ;AAMA,SAASC,wBAAwBX,KAAAA,EAAmB;AAClD,EAAA,MAAMY,OAAAA,GAAUd,wBAAwBE,KAAAA,CAAAA;AACxC,EAAA,MAAM,EAAEE,IAAAA,EAAMC,IAAAA,EAAMC,WAAAA,KAAgBQ,OAAAA,CAAQX,eAAAA;AAE5C,EAAA,MAAMY,QAAAA,GAAW,MAAA;AACjB,EAAA,OAAO,GAAGA,QAAAA,CAAAA,GAAAA,EAAcX,IAAAA,CAAAA,CAAAA,EAAQC,IAAAA,GAAOC,WAAAA,CAAAA,CAAAA;AACzC;AANSO,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AAcF,IAAMG,uBAAAA,GAAmE;;;;;EAK9Ef,MAAAA,EAAQ;IACNgB,aAAAA,EAAe,mCAAA;IACfC,SAAAA,EAAW,6BAAA;IACXC,eAAAA,EAAiB,sBAAA;IACjBC,iBAAAA,EAAmB,gBAAA;AACnBC,IAAAA,cAAAA,EAAgBR,wBAAwB,QAAA;AAC1C,GAAA;EACAL,MAAAA,EAAQ;IACNS,aAAAA,EAAe,mCAAA;IACfC,SAAAA,EAAW,6BAAA;IACXC,eAAAA,EAAiB,sBAAA;IACjBC,iBAAAA,EAAmB,gBAAA;AACnBC,IAAAA,cAAAA,EAAgBR,wBAAwB,QAAA;AAC1C;AACF;AA4BO,IAAMS,8BAAAA,GAAuD;EAClEC,gBAAAA,EAAkB,CAAA;EAClBC,YAAAA,EAAc,GAAA;EACdC,aAAAA,EAAe;AACjB;AAkCO,IAAMC,4BAAAA,GAAmD;EAC9DC,WAAAA,EAAa,CAAA;EACbC,YAAAA,EAAc,GAAA;EACdC,QAAAA,EAAU,GAAA;EACVC,iBAAAA,EAAmB;AACrB","file":"chunk-YFOHAHZE.js","sourcesContent":["/**\n * Layer Type Definitions for Burdenoff Backend SDK\n *\n * This module defines types for the layer-aware architecture,\n * supporting wspace (workspace) and global (tenant) service layers.\n *\n * @module types/layer\n * @category Configuration\n */\n\n/**\n * Service layer types\n * - wspace: Workspace layer services (product-specific operations)\n * - global: Global/tenant layer services (cross-product services)\n */\nexport type ServiceLayer = 'wspace' | 'global';\n\n/**\n * Layer configuration for a service\n */\nexport interface LayerConfig {\n  /**\n   * Layer type this service belongs to\n   * @example 'wspace' or 'global'\n   */\n  layer: ServiceLayer;\n\n  /**\n   * Service name (e.g., 'wspace-tags-svc', 'global-auth-svc')\n   */\n  serviceName: string;\n\n  /**\n   * Service identity for bypass headers\n   * Used for M2M authentication\n   * @default serviceName\n   */\n  serviceIdentity?: string;\n}\n\n/**\n * Gateway configuration per layer\n */\nexport interface LayerGatewayConfig {\n  /**\n   * Internal gateway URL (same layer int-gateway)\n   * - wspace services use: wspace-int-gateway\n   * - global services use: global-int-gateway\n   */\n  internalGatewayUrl: string;\n\n  /**\n   * Cross-layer gateway URL (cross layer public-gateway)\n   * - wspace services use: global-public-gateway\n   * - global services use: wspace-public-gateway\n   */\n  crossLayerGatewayUrl: string;\n}\n\n/**\n * Resource URLs per layer\n */\nexport interface LayerResourceUrls {\n  /**\n   * Event queue (Redis Streams) URL.\n   *\n   * Single fleet-shared Redis instance in every environment:\n   *   - ACA (prod/alpha): Azure Managed Redis — `REDIS_URL` injected from\n   *     KeyVault overrides this default.\n   *   - Local dev: self-hosted `shared-valkey` reachable via\n   *     docker-compose; the default below points at the same container\n   *     name used by `~/products/dev`'s compose graph.\n   *\n   * `LayerManager.resolveResourceConfig()` always prefers `REDIS_URL`\n   * from the environment, so the layer-scoped default is only the\n   * local-dev fallback.\n   */\n  eventQueueUrl: string;\n\n  /**\n   * Valkey/Redis URL for the layer\n   */\n  valkeyUrl: string;\n\n  /**\n   * Temporal server address for the layer\n   */\n  temporalAddress: string;\n\n  /**\n   * Temporal namespace for the layer\n   */\n  temporalNamespace: string;\n\n  /**\n   * RBAC gateway URL (for permission checks)\n   */\n  rbacGatewayUrl: string;\n}\n\n/**\n * Complete layer configuration including gateways and resources\n */\nexport interface LayerFullConfig extends LayerConfig {\n  /**\n   * Gateway configuration\n   */\n  gateways: LayerGatewayConfig;\n\n  /**\n   * Resource URLs\n   */\n  resources: LayerResourceUrls;\n}\n\n/**\n * Gateway routing rules by layer\n * Defines which gateway to use for same-layer vs cross-layer communication\n */\nexport interface GatewayRoutingConfig {\n  /**\n   * Layer this config applies to\n   */\n  layer: ServiceLayer;\n\n  /**\n   * Internal gateway for same-layer M2M calls\n   */\n  internalGateway: {\n    /** Gateway host (without protocol) */\n    host: string;\n    /** Gateway port */\n    port: number;\n    /** GraphQL endpoint path */\n    graphqlPath: string;\n  };\n\n  /**\n   * Public gateway for cross-layer calls\n   */\n  crossLayerGateway: {\n    /** Gateway host (without protocol) */\n    host: string;\n    /** Gateway port */\n    port: number;\n    /** GraphQL endpoint path */\n    graphqlPath: string;\n  };\n}\n\n/**\n * Default gateway routing configuration\n */\nexport const DEFAULT_GATEWAY_ROUTING: Record<ServiceLayer, GatewayRoutingConfig> = {\n  wspace: {\n    layer: 'wspace',\n    internalGateway: {\n      host: 'wspace-int-gateway',\n      port: 4001,\n      graphqlPath: '/workspaces/graphql',\n    },\n    crossLayerGateway: {\n      host: 'global-public-gateway',\n      port: 4000,\n      graphqlPath: '/global/graphql',\n    },\n  },\n  global: {\n    layer: 'global',\n    internalGateway: {\n      host: 'global-int-gateway',\n      port: 4002,\n      graphqlPath: '/global/graphql',\n    },\n    crossLayerGateway: {\n      host: 'wspace-public-gateway',\n      port: 4003,\n      graphqlPath: '/workspaces/graphql',\n    },\n  },\n};\n\n/**\n * Default stream configurations per layer\n */\nexport const DEFAULT_LAYER_STREAMS: Record<\n  ServiceLayer,\n  Array<{ name: string; subjects: string[]; description?: string }>\n> = {\n  wspace: [\n    {\n      name: 'WSPACE_EVENTS',\n      subjects: ['wspace.>'],\n      description: 'Workspace layer events stream',\n    },\n    {\n      name: 'WSPACE_GRAPH_EVENTS',\n      subjects: ['graph.>'],\n      description: 'Workspace layer graph events stream (captures all graph entity events)',\n    },\n  ],\n  global: [\n    {\n      name: 'GLOBAL_EVENTS',\n      subjects: ['global.>'],\n      description: 'Global layer events stream',\n    },\n    {\n      name: 'GLOBAL_GRAPH_EVENTS',\n      subjects: ['graph.>'],\n      description: 'Global layer graph events stream (captures all graph entity events)',\n    },\n  ],\n};\n\n/**\n * Build internal gateway URL for a layer\n * Uses HTTP for internal K8s communication (mTLS via Istio service mesh)\n */\nfunction buildInternalGatewayUrl(layer: ServiceLayer): string {\n  const routing = DEFAULT_GATEWAY_ROUTING[layer];\n  const { host, port, graphqlPath } = routing.internalGateway;\n  // Internal K8s services use plain HTTP with mTLS handled by Istio\n  const protocol = 'http';\n  return `${protocol}://${host}:${port}${graphqlPath}`;\n}\n\n/**\n * Default resource URLs per layer\n *\n * Note: Internal K8s service communication uses plain HTTP with mTLS via Istio.\n * External traffic uses HTTPS via ingress gateway.\n */\nexport const DEFAULT_LAYER_RESOURCES: Record<ServiceLayer, LayerResourceUrls> = {\n  // The event queue is a single fleet-shared Redis (Azure Managed Redis in\n  // ACA, fed via REDIS_URL; self-hosted shared-valkey in local dev). The\n  // layer-scoped default URL below is only the local-dev compose hostname —\n  // production always overrides via REDIS_URL.\n  wspace: {\n    eventQueueUrl: 'redis://wspace-shared-valkey:6379',\n    valkeyUrl: 'valkey://wspace-valkey:6379',\n    temporalAddress: 'wspace-temporal:7233',\n    temporalNamespace: 'wspace-default',\n    rbacGatewayUrl: buildInternalGatewayUrl('wspace'),\n  },\n  global: {\n    eventQueueUrl: 'redis://global-shared-valkey:6379',\n    valkeyUrl: 'valkey://global-valkey:6379',\n    temporalAddress: 'global-temporal:7233',\n    temporalNamespace: 'global-default',\n    rbacGatewayUrl: buildInternalGatewayUrl('global'),\n  },\n};\n\n/**\n * Circuit breaker configuration for gateway client\n */\nexport interface CircuitBreakerConfig {\n  /**\n   * Number of failures before opening circuit\n   * @default 5\n   */\n  failureThreshold: number;\n\n  /**\n   * Time in milliseconds to wait before attempting to close circuit\n   * @default 30000 (30 seconds)\n   */\n  resetTimeout: number;\n\n  /**\n   * Time window in milliseconds for counting failures\n   * @default 60000 (60 seconds)\n   */\n  failureWindow: number;\n}\n\n/**\n * Default circuit breaker configuration\n */\nexport const DEFAULT_CIRCUIT_BREAKER_CONFIG: CircuitBreakerConfig = {\n  failureThreshold: 5,\n  resetTimeout: 30000,\n  failureWindow: 60000,\n};\n\n/**\n * Retry configuration for gateway client\n */\nexport interface GatewayRetryConfig {\n  /**\n   * Maximum number of retry attempts\n   * @default 3\n   */\n  maxAttempts: number;\n\n  /**\n   * Initial delay in milliseconds before first retry\n   * @default 1000 (1 second)\n   */\n  initialDelay: number;\n\n  /**\n   * Maximum delay in milliseconds between retries\n   * @default 10000 (10 seconds)\n   */\n  maxDelay: number;\n\n  /**\n   * Backoff multiplier for exponential backoff\n   * @default 2\n   */\n  backoffMultiplier: number;\n}\n\n/**\n * Default retry configuration\n */\nexport const DEFAULT_GATEWAY_RETRY_CONFIG: GatewayRetryConfig = {\n  maxAttempts: 3,\n  initialDelay: 1000,\n  maxDelay: 10000,\n  backoffMultiplier: 2,\n};\n\n/**\n * Headers automatically added by gateway client for M2M calls\n */\nexport interface GatewayRequestHeaders {\n  /**\n   * Actor ID making the request\n   */\n  'x-actor-id'?: string;\n\n  /**\n   * Actor type\n   */\n  'x-actor-type'?: 'user' | 'app' | 'service' | 'super_admin';\n\n  /**\n   * Workspace ID for the request context\n   */\n  'x-workspace-id'?: string;\n\n  /**\n   * Service identity for bypass validation\n   */\n  'x-service-identity'?: string;\n\n  /**\n   * Call type indicator\n   */\n  'x-call-type'?: 'internal' | 'cross-layer';\n\n  /**\n   * Permission bypass flag\n   */\n  'x-bypass-permission'?: string;\n\n  /**\n   * RBAC bypass flag (set by gateway)\n   */\n  'x-rbac-bypass'?: 'true' | 'false';\n\n  /**\n   * Bypass source (set by gateway)\n   */\n  'x-bypass-source'?: string;\n\n  /**\n   * Bypass timestamp (set by gateway)\n   */\n  'x-bypass-timestamp'?: string;\n\n  /**\n   * Cloudflare Access service-token client id, re-presented on cross-layer\n   * outbound calls so the peer layer's CF-Access-gated public gateway admits\n   * the request. Normally attached automatically from request context.\n   */\n  'cf-access-client-id'?: string;\n\n  /**\n   * Cloudflare Access service-token client secret (paired with the client id).\n   */\n  'cf-access-client-secret'?: string;\n}\n"]}

package/dist/{chunk-TIINMQSD.js → chunk-Z2423JIB.js}

@@ -1,6 +1,6 @@
 import { shouldSyncRelationship, shouldSyncEntity, parseRelationship, getCollectionForEntity, extractMinimalFields, extractEntityTitle, createRelationshipEvent, createEntityEvent, addGraphExtension, GraphRegistry } from './chunk-5CESUKWC.js';
 import { getGraphEventEmitter, GraphEventEmitterImpl } from './chunk-OHEPNJ2X.js';
-import { ValidationError } from './chunk-O6RHB2YP.js';
+import { ValidationError } from './chunk-EZ4PKRUK.js';
 import { logger } from './chunk-CBZNP6RF.js';
 import { __export, __name } from './chunk-XE4OXN2W.js';
 
@@ -1873,5 +1873,5 @@ var GraphModule = class {
 };
 
 export { AUDIT_FIELDS, GraphEventsPublisher, GraphExportService, GraphModule, SOFT_DELETE_FIELDS, STANDARD_FIELDS, TENANT_FIELDS, createGraphEventsHelper, createGraphExportService, createPrismaGraphIntegration, createRelationshipFromEntity, defineEntity, defineGraphConfig, defineModuleGraph, defineRelationship, getGraphEventsPublisher, getGraphStats, graph_exports, initializeGraph, isGraphInitialized };
-//# sourceMappingURL=chunk-TIINMQSD.js.map
-//# sourceMappingURL=chunk-TIINMQSD.js.map
+//# sourceMappingURL=chunk-Z2423JIB.js.map
+//# sourceMappingURL=chunk-Z2423JIB.js.map