@burdenoff/be-sdk 2026.611.1 → 2026.622.1

package/dist/index.js

@@ -2,22 +2,22 @@ export { prisma_exports as Prisma } from './chunk-GCBR3TFZ.js';
 export { RESOURCE_CAP_DEFAULTS, ResourceCapExceededError, ResourceCapsModule, getResourceCaps } from './chunk-VDDOGIWY.js';
 import './chunk-GTEMQXCA.js';
 export { sharing_exports as Sharing } from './chunk-XD5ZK727.js';
-export { TemporalClient, TemporalClientFactory, TemporalModule, TemporalWorker, TemporalWorkerFactory, TemporalWorkerManager } from './chunk-5SD7DU3L.js';
-import { ActivityModule, UsageModule, TrackerModule } from './chunk-PPIDJP2W.js';
-export { ActivityModule, TrackerModule, UsageModule } from './chunk-PPIDJP2W.js';
-import { RBACModule } from './chunk-BNJFEOGH.js';
-export { RBACModule, createRBACDirective, createRBACDirectiveForLayer, createRBACDirectiveFromEnv } from './chunk-BNJFEOGH.js';
+export { TemporalClient, TemporalClientFactory, TemporalModule, TemporalWorker, TemporalWorkerFactory, TemporalWorkerManager } from './chunk-IC7YDBGE.js';
+import { ActivityModule, UsageModule, TrackerModule } from './chunk-TYXGWVRL.js';
+export { ActivityModule, TrackerModule, UsageModule } from './chunk-TYXGWVRL.js';
+import { RBACModule } from './chunk-6NB7P6SR.js';
+export { RBACModule, createRBACDirective, createRBACDirectiveForLayer, createRBACDirectiveFromEnv } from './chunk-6NB7P6SR.js';
 export { instrumentation_exports as Instrumentation } from './chunk-ACYGOENW.js';
 import './chunk-REF7PANB.js';
 export { middleware_exports as Middleware } from './chunk-2HANKZZM.js';
-import { TenantNotificationsModule, NotificationsModule } from './chunk-RMDKB5O7.js';
-export { tenant_notifications_exports as Notifications, NotificationsModule } from './chunk-RMDKB5O7.js';
+import { TenantNotificationsModule, NotificationsModule } from './chunk-IUL5TEKE.js';
+export { tenant_notifications_exports as Notifications, NotificationsModule } from './chunk-IUL5TEKE.js';
 export { observability_exports as Observability } from './chunk-5LXDPGDH.js';
 export { platform_exports as Platform } from './chunk-PHKK7725.js';
-export { export_exports as Export } from './chunk-GMFHIFS5.js';
-export { feature_flags_exports as FeatureFlags } from './chunk-VWCN5PMD.js';
-import { GraphModule } from './chunk-TIINMQSD.js';
-export { graph_exports as Graph, GraphModule } from './chunk-TIINMQSD.js';
+export { export_exports as Export } from './chunk-WD2TUTAS.js';
+export { feature_flags_exports as FeatureFlags } from './chunk-YEA4BZOL.js';
+import { GraphModule } from './chunk-Z2423JIB.js';
+export { graph_exports as Graph, GraphModule } from './chunk-Z2423JIB.js';
 import './chunk-5CESUKWC.js';
 import { EventsModule } from './chunk-H3AXO5SY.js';
 export { event_queue_exports as EventQueue, EventsModule } from './chunk-H3AXO5SY.js';
@@ -27,34 +27,49 @@ export { graphql_exports as GraphQL } from './chunk-X4NELQLV.js';
 import './chunk-QLVKMWFA.js';
 import './chunk-MHNA7IS7.js';
 export { i18n_exports as I18n, createTranslator, getLanguage, getLocale, hasI18n, t } from './chunk-ULFFX3YE.js';
-export { init_exports as Init } from './chunk-ZRRLY7SM.js';
-export { gateway_exports as Gateway } from './chunk-BJVXHIUV.js';
-import './chunk-4NFZOFRS.js';
-export { layer_exports as Layer } from './chunk-GSEPF2B6.js';
-import { AuthModule } from './chunk-KKCC3Z4I.js';
-export { AuthModule } from './chunk-KKCC3Z4I.js';
+export { init_exports as Init } from './chunk-Y7GCABRS.js';
+import { GatewayClient, GatewayError, GatewayErrorType } from './chunk-3H4TRD6E.js';
+export { gateway_exports as Gateway } from './chunk-3H4TRD6E.js';
+import './chunk-L2P4CJUR.js';
+export { layer_exports as Layer } from './chunk-UIMPJNWC.js';
+import './chunk-VFCMR5GX.js';
+import { ContextManager } from './chunk-DXX6C6X6.js';
+export { ContextManager } from './chunk-DXX6C6X6.js';
+import { AuthModule } from './chunk-SS4XWRYR.js';
+export { AuthModule } from './chunk-SS4XWRYR.js';
 export { utils_exports as Utils } from './chunk-B7I4TABG.js';
-export { cache_exports as Cache } from './chunk-7NYCLQFJ.js';
+export { cache_exports as Cache } from './chunk-UYE4IEPT.js';
 export { captcha_exports as Captcha, isCaptchaEnabled, verifyCaptcha, verifyCaptchaIfEnabled } from './chunk-YMZEUTD2.js';
 export { createInternalClient, createInternalClientForTenant, createInternalClientForWorkspaces } from './chunk-VI4VSNTI.js';
 export { crypto_exports as Crypto } from './chunk-SBS4S2PJ.js';
-import { DatabaseModule } from './chunk-UFQQSQG6.js';
-export { DatabaseModule } from './chunk-UFQQSQG6.js';
-import { APIError, NetworkError, TimeoutError, ValidationError } from './chunk-O6RHB2YP.js';
-export { DEFAULT_CIRCUIT_BREAKER_CONFIG, DEFAULT_GATEWAY_RETRY_CONFIG, DEFAULT_GATEWAY_ROUTING, DEFAULT_LAYER_RESOURCES, DEFAULT_LAYER_STREAMS } from './chunk-HP6JTFNR.js';
+import { DatabaseModule } from './chunk-4OQRBSHM.js';
+export { DatabaseModule } from './chunk-4OQRBSHM.js';
+import { APIError, NetworkError, TimeoutError, ValidationError } from './chunk-EZ4PKRUK.js';
+export { DEFAULT_CIRCUIT_BREAKER_CONFIG, DEFAULT_GATEWAY_RETRY_CONFIG, DEFAULT_GATEWAY_ROUTING, DEFAULT_LAYER_RESOURCES, DEFAULT_LAYER_STREAMS } from './chunk-YFOHAHZE.js';
 import { logger } from './chunk-CBZNP6RF.js';
 export { logger_exports as Logger } from './chunk-CBZNP6RF.js';
 export { dataloader_exports as DataLoader } from './chunk-NUB5GQTU.js';
 import { __name } from './chunk-XE4OXN2W.js';
 import { GraphQLClient } from 'graphql-request';
-import { AsyncLocalStorage } from 'async_hooks';
 
+function isServiceLayer(value) {
+  return value === "wspace" || value === "global";
+}
+__name(isServiceLayer, "isServiceLayer");
 var BurdenoffGraphQLClient = class {
   static {
     __name(this, "BurdenoffGraphQLClient");
   }
   workspacesClient;
-  tenantClient;
+  /**
+  * Cross-layer (tenant) calls go through the unified GatewayClient, which
+  * targets the peer layer's PUBLIC gateway and mints a short-lived `service`
+  * actor JWT (via signServiceJwt) so the gateway admits the M2M call and the
+  * subgraph sees a trusted service context. This is the same mechanism used by
+  * `GatewayClient.crossLayerQuery` everywhere else — kept consistent here so
+  * tenant SDK calls (notifications, tenant lookups) authenticate identically.
+  */
+  tenantGateway;
   config;
   defaultContext;
   constructor(config, defaultContext = {}) {
@@ -64,8 +79,15 @@ var BurdenoffGraphQLClient = class {
       headers: this.getHeaders(defaultContext)
     });
     if (config.tenantApiUrl) {
-      this.tenantClient = new GraphQLClient(config.tenantApiUrl, {
-        headers: this.getHeaders(defaultContext)
+      this.tenantGateway = new GatewayClient({
+        layer: config.serviceLayer ?? (isServiceLayer(process.env["SERVICE_LAYER"]) ? process.env["SERVICE_LAYER"] : "wspace"),
+        serviceName: config.serviceName ?? process.env["SERVICE_NAME"] ?? "burdenoff-be-sdk",
+        crossLayerGatewayUrl: config.tenantApiUrl,
+        timeout: config.timeout,
+        // Honor the SDK's retry config (same field shape) so callers that lower
+        // maxAttempts for non-idempotent tenant mutations (e.g. notification
+        // sends) are respected instead of falling back to the gateway default.
+        retry: config.retry
       });
     }
   }
@@ -103,9 +125,6 @@ var BurdenoffGraphQLClient = class {
       ...context
     };
     this.workspacesClient.setHeaders(this.getHeaders(this.defaultContext));
-    if (this.tenantClient) {
-      this.tenantClient.setHeaders(this.getHeaders(this.defaultContext));
-    }
   }
   /**
   * Execute GraphQL query/mutation against workspaces API
@@ -114,15 +133,79 @@ var BurdenoffGraphQLClient = class {
     return this.executeWithRetry(() => this.executeQuery(this.workspacesClient, query, variables, context), "workspaces");
   }
   /**
-  * Execute GraphQL query/mutation against tenant API
+  * Execute GraphQL query/mutation against the tenant (cross-layer) API.
+  *
+  * Routed through GatewayClient.crossLayerQuery: targets the peer layer's
+  * PUBLIC gateway and mints a short-lived `service` actor JWT. Only routing
+  * context (workspace / product) is forwarded — the end-user identity is not,
+  * because cross-layer tenant operations are service-to-service M2M. Retry and
+  * circuit-breaking are handled inside GatewayClient.
   */
   async tenantQuery(query, variables, context) {
-    if (!this.tenantClient) {
+    if (!this.tenantGateway) {
       throw new APIError("Tenant API URL not configured", {
         operation: "tenantQuery"
       });
     }
-    return this.executeWithRetry(() => this.executeQuery(this.tenantClient, query, variables, context), "tenant");
+    const mergedContext = {
+      ...this.defaultContext,
+      ...context
+    };
+    const headers = {};
+    if (mergedContext.workspaceId) {
+      headers["x-workspace-id"] = mergedContext.workspaceId;
+    }
+    if (mergedContext.productId) {
+      headers["x-product-id"] = mergedContext.productId;
+    }
+    try {
+      const response = await this.tenantGateway.crossLayerQuery({
+        query,
+        variables,
+        headers
+      });
+      if (response.data == null) {
+        throw new APIError("Tenant query returned no data", {
+          api: "tenant"
+        });
+      }
+      return response.data;
+    } catch (error) {
+      throw this.mapTenantError(error);
+    }
+  }
+  /**
+  * Map a GatewayClient failure back to the SDK's APIError contract so existing
+  * tenant callers (which inspect `error.message` / extensions, e.g. "Forbidden")
+  * keep working unchanged.
+  */
+  mapTenantError(error) {
+    if (error instanceof APIError) {
+      return error;
+    }
+    if (error instanceof GatewayError) {
+      const first = error.graphqlErrors?.[0];
+      if (first) {
+        return new APIError(first.message, {
+          graphqlErrors: error.graphqlErrors,
+          extensions: first.extensions
+        });
+      }
+      if (error.type === GatewayErrorType.NETWORK_ERROR) {
+        return new NetworkError(error.message, {
+          gatewayErrorType: error.type
+        });
+      }
+      if (error.type === GatewayErrorType.TIMEOUT_ERROR) {
+        return new TimeoutError(error.message, {
+          gatewayErrorType: error.type
+        });
+      }
+      return new APIError(error.message, {
+        gatewayErrorType: error.type
+      });
+    }
+    return this.handleError(error);
   }
   /**
   * Execute GraphQL request
@@ -134,8 +217,7 @@ var BurdenoffGraphQLClient = class {
         ...context
       };
       if (context) {
-        const headers = this.getHeaders(mergedContext);
-        client.setHeaders(headers);
+        client.setHeaders(this.getHeaders(mergedContext));
       }
       const response = await client.request(query, variables);
       return response;
@@ -235,141 +317,6 @@ var BurdenoffGraphQLClient = class {
     };
   }
 };
-var asyncLocalStorage = new AsyncLocalStorage();
-var ContextManager = class {
-  static {
-    __name(this, "ContextManager");
-  }
-  /**
-  * Get current context from async local storage
-  */
-  static getContext() {
-    return asyncLocalStorage.getStore();
-  }
-  /**
-  * Set context for current async scope
-  * Merges with existing context if present
-  */
-  static setContext(context) {
-    const currentContext = this.getContext() || {};
-    asyncLocalStorage.enterWith({
-      ...currentContext,
-      ...context
-    });
-  }
-  /**
-  * Run function with specific context
-  * Context is isolated to this execution and its children
-  */
-  static async withContext(context, fn) {
-    return asyncLocalStorage.run(context, fn);
-  }
-  /**
-  * Run synchronous function with specific context
-  */
-  static withContextSync(context, fn) {
-    return asyncLocalStorage.run(context, fn);
-  }
-  /**
-  * Clear current context
-  */
-  static clearContext() {
-    asyncLocalStorage.disable();
-  }
-  /**
-  * Get actor ID from context
-  */
-  static getActorId() {
-    return this.getContext()?.actorId;
-  }
-  /**
-  * Get legacy user ID from context.
-  */
-  static getUser() {
-    const context = this.getContext();
-    const userId = context?.["userId"];
-    return typeof userId === "string" ? userId : context?.actorId;
-  }
-  /**
-  * Get workspace ID from context
-  */
-  static getWorkspace() {
-    return this.getContext()?.workspaceId;
-  }
-  /**
-  * Get tenant ID from context
-  */
-  static getTenant() {
-    return this.getContext()?.tenantId;
-  }
-  /**
-  * Get legacy organization ID from context.
-  */
-  static getOrganization() {
-    const organizationId = this.getContext()?.["organizationId"];
-    return typeof organizationId === "string" ? organizationId : void 0;
-  }
-  /**
-  * Get project ID from context
-  */
-  static getProject() {
-    return this.getContext()?.projectId;
-  }
-  /**
-  * Get app ID from context
-  */
-  static getApp() {
-    return this.getContext()?.appId;
-  }
-  /**
-  * Get JWT token from context
-  */
-  static getToken() {
-    return this.getContext()?.token;
-  }
-  /**
-  * Get product ID from context
-  */
-  static getProduct() {
-    return this.getContext()?.productId;
-  }
-  /**
-  * Update specific context fields
-  */
-  static updateContext(updates) {
-    const current = this.getContext();
-    if (current) {
-      this.setContext({
-        ...current,
-        ...updates
-      });
-    } else {
-      this.setContext(updates);
-    }
-  }
-  /**
-  * Check if context exists
-  */
-  static hasContext() {
-    return this.getContext() !== void 0;
-  }
-  /**
-  * Get custom field from context
-  */
-  static getCustomField(key) {
-    return this.getContext()?.[key];
-  }
-  /**
-  * Set custom field in context
-  */
-  static setCustomField(key, value) {
-    const current = this.getContext() || {};
-    this.setContext({
-      ...current,
-      [key]: value
-    });
-  }
-};
 
 // src/search/index.ts
 var SearchModule = class {
@@ -2036,6 +1983,14 @@ var BootstrapModule = class {
     if (appId) {
       context.appId = appId;
     }
+    const cfAccessClientId = getHeader("cf-access-client-id");
+    if (cfAccessClientId) {
+      context.cfAccessClientId = cfAccessClientId;
+    }
+    const cfAccessClientSecret = getHeader("cf-access-client-secret");
+    if (cfAccessClientSecret) {
+      context.cfAccessClientSecret = cfAccessClientSecret;
+    }
     return context;
   }
   /**
@@ -2626,6 +2581,6 @@ function createSDK(config, context) {
 }
 __name(createSDK, "createSDK");
 
-export { BootstrapModule, BurdenoffGraphQLClient, BurdenoffSDK, ContextManager, PaymentsModule, SearchModule, TenantBackendClient, TranslationModule, createBootstrap, createSDK, createTenantBackendClient, index_default as default };
+export { BootstrapModule, BurdenoffGraphQLClient, BurdenoffSDK, PaymentsModule, SearchModule, TenantBackendClient, TranslationModule, createBootstrap, createSDK, createTenantBackendClient, index_default as default };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map