@burdenoff/be-sdk 2026.723.1 → 2026.725.2

package/dist/auth/index.d.ts

@@ -1,6 +1,6 @@
 import { B as BurdenoffGraphQLClient } from '../graphql-Dxxpbzr3.js';
 import { S as SDKContext } from '../index-B8viwwDM.js';
-import { G as GraphQLContext } from '../types-DMZAHZNR.js';
+import { G as GraphQLContext } from '../types-BuP_sFzk.js';
 import 'graphql-request';
 import '../layer-GNAVXBMf.js';
 import 'graphql';
@@ -8,7 +8,7 @@ import 'graphql-yoga';
 import '../client-CCXpAZ2r.js';
 import '@prisma/adapter-pg';
 import 'pg';
-import '../workspace-extension-TquhDEKU.js';
+import '../workspace-extension-DlxYz3P4.js';
 import '../types-C8TbSdEj.js';
 
 interface CookieOptions {

package/dist/{chunk-MXLCLLCI.js → chunk-KESVEZB2.js}

@@ -21,7 +21,7 @@ function withWorkspaceContextSync(context, fn) {
   return workspaceContextStore.run(context, fn);
 }
 __name(withWorkspaceContextSync, "withWorkspaceContextSync");
-var defaultConfig = {
+var defaultWorkspaceExtensionConfig = {
   enabled: true,
   enableReadIsolation: true,
   enableDeleteIsolation: true,
@@ -30,6 +30,7 @@ var defaultConfig = {
   populateCreatedBy: true,
   populateUpdatedBy: true,
   populateTenantId: false,
+  populateOnBehalfOf: true,
   excludeModels: [],
   excludeModelsFromReadIsolation: [],
   strictMode: true,
@@ -58,9 +59,9 @@ function injectCreateFields(data, wsCtx, config) {
   if (config.populateUpdatedBy && wsCtx.actorId && !hasField(injected, "updatedBy")) {
     injected["updatedBy"] = wsCtx.actorId;
   }
-  if (wsCtx.onBehalfOf && !hasField(injected, "onBehalfOf")) {
+  if (config.populateOnBehalfOf && wsCtx.onBehalfOf && !hasField(injected, "onBehalfOf")) {
     injected["onBehalfOf"] = wsCtx.onBehalfOf;
-  } else if (wsCtx.actorId && !hasField(injected, "onBehalfOf")) {
+  } else if (config.populateOnBehalfOf && wsCtx.actorId && !hasField(injected, "onBehalfOf")) {
     injected["onBehalfOf"] = wsCtx.actorId;
   }
   if (config.populateContextJson && !hasField(injected, "context")) {
@@ -166,9 +167,27 @@ async function maybeSetRlsGuc(rawPrisma, wsCtx) {
   }
 }
 __name(maybeSetRlsGuc, "maybeSetRlsGuc");
+function modelToClientProperty(model) {
+  return model.length > 0 ? model.charAt(0).toLowerCase() + model.slice(1) : model;
+}
+__name(modelToClientProperty, "modelToClientProperty");
+async function runOperationWithRlsGuc(rootClient, wsCtx, model, operation, args) {
+  const safeWs = (wsCtx.workspaceId ?? "").replace(/[^a-zA-Z0-9\-_]/g, "");
+  const clientProperty = modelToClientProperty(model);
+  return rootClient.$transaction(async (tx) => {
+    await tx.$executeRawUnsafe(`SET LOCAL app.workspace_id = '${safeWs}'`);
+    const delegate = tx[clientProperty];
+    const method = delegate?.[operation];
+    if (typeof method !== "function") {
+      throw new Error(`[WorkspaceExtension] Unable to resolve ${model}.${operation} (client property "${clientProperty}") on the interactive-transaction client for RLS GUC tagging.`);
+    }
+    return method(args);
+  });
+}
+__name(runOperationWithRlsGuc, "runOperationWithRlsGuc");
 function addWorkspaceExtension(baseClient, config) {
   const fullConfig = {
-    ...defaultConfig,
+    ...defaultWorkspaceExtensionConfig,
     ...config
   };
   if (!fullConfig.enabled) {
@@ -176,6 +195,7 @@ function addWorkspaceExtension(baseClient, config) {
     return baseClient;
   }
   const rawPrisma = baseClient;
+  const rawPrismaForTransactions = baseClient;
   const prismaClient = baseClient;
   logger.info("[WorkspaceExtension] Workspace extension enabled", {
     populateContextJson: fullConfig.populateContextJson,
@@ -210,9 +230,6 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
-          if (fullConfig.enableRlsGucTagging) {
-            await maybeSetRlsGuc(rawPrisma, wsCtx);
-          }
           const injectedData = injectCreateFields(args.data, wsCtx, fullConfig);
           if (fullConfig.debug) {
             const injectedKeys = Object.keys(injectedData).filter((k) => !(k in args.data));
@@ -223,10 +240,14 @@ function addWorkspaceExtension(baseClient, config) {
               });
             }
           }
-          return query({
+          const finalArgs = {
             ...stripSkipFlag(args),
             data: injectedData
-          });
+          };
+          if (fullConfig.enableRlsGucTagging) {
+            return runOperationWithRlsGuc(rawPrismaForTransactions, wsCtx, model, "create", finalArgs);
+          }
+          return query(finalArgs);
         },
         async createMany({ model, args, query }) {
           if (fullConfig.excludeModels.includes(model) || args._skipWorkspaceInjection) {
@@ -240,17 +261,18 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
-          if (fullConfig.enableRlsGucTagging) {
-            await maybeSetRlsGuc(rawPrisma, wsCtx);
-          }
           const dataArray = Array.isArray(args.data) ? args.data : [
             args.data
           ];
           const injectedData = dataArray.map((item) => injectCreateFields(item, wsCtx, fullConfig));
-          return query({
+          const finalArgs = {
             ...stripSkipFlag(args),
             data: Array.isArray(args.data) ? injectedData : injectedData[0]
-          });
+          };
+          if (fullConfig.enableRlsGucTagging) {
+            return runOperationWithRlsGuc(rawPrismaForTransactions, wsCtx, model, "createMany", finalArgs);
+          }
+          return query(finalArgs);
         },
         async createManyAndReturn({ model, args, query }) {
           if (fullConfig.excludeModels.includes(model) || args._skipWorkspaceInjection) {
@@ -264,17 +286,18 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
-          if (fullConfig.enableRlsGucTagging) {
-            await maybeSetRlsGuc(rawPrisma, wsCtx);
-          }
           const dataArray = Array.isArray(args.data) ? args.data : [
             args.data
           ];
           const injectedData = dataArray.map((item) => injectCreateFields(item, wsCtx, fullConfig));
-          return query({
+          const finalArgs = {
             ...stripSkipFlag(args),
             data: Array.isArray(args.data) ? injectedData : injectedData[0]
-          });
+          };
+          if (fullConfig.enableRlsGucTagging) {
+            return runOperationWithRlsGuc(rawPrismaForTransactions, wsCtx, model, "createManyAndReturn", finalArgs);
+          }
+          return query(finalArgs);
         },
         // ================================================================
         // UPDATE OPERATIONS - inject updatedBy into data + workspaceId into where
@@ -291,9 +314,6 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
-          if (fullConfig.enableRlsGucTagging) {
-            await maybeSetRlsGuc(rawPrisma, wsCtx);
-          }
           const injectedData = injectUpdateFields(args.data, wsCtx, fullConfig);
           let injectedWhere = args.where;
           if (fullConfig.enableUpdateWhereIsolation && !isExcludedFromReadIsolation(model, fullConfig)) {
@@ -306,11 +326,15 @@ function addWorkspaceExtension(baseClient, config) {
               logger.debug(`[WorkspaceExtension] ${model}.update - injected data: ${injectedDataKeys.join(", ")}${whereChanged ? ", where: workspaceId" : ""}`);
             }
           }
-          return query({
+          const finalArgs = {
             ...stripSkipFlag(args),
             data: injectedData,
             where: injectedWhere
-          });
+          };
+          if (fullConfig.enableRlsGucTagging) {
+            return runOperationWithRlsGuc(rawPrismaForTransactions, wsCtx, model, "update", finalArgs);
+          }
+          return query(finalArgs);
         },
         async updateMany({ model, args, query }) {
           if (fullConfig.excludeModels.includes(model) || args._skipWorkspaceInjection) {
@@ -324,19 +348,20 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
-          if (fullConfig.enableRlsGucTagging) {
-            await maybeSetRlsGuc(rawPrisma, wsCtx);
-          }
           const injectedData = injectUpdateFields(args.data, wsCtx, fullConfig);
           let injectedWhere = args.where;
           if (fullConfig.enableUpdateWhereIsolation && !isExcludedFromReadIsolation(model, fullConfig)) {
             injectedWhere = injectWhereClause(args.where, wsCtx);
           }
-          return query({
+          const finalArgs = {
             ...stripSkipFlag(args),
             data: injectedData,
             where: injectedWhere
-          });
+          };
+          if (fullConfig.enableRlsGucTagging) {
+            return runOperationWithRlsGuc(rawPrismaForTransactions, wsCtx, model, "updateMany", finalArgs);
+          }
+          return query(finalArgs);
         },
         async upsert({ model, args, query }) {
           if (fullConfig.excludeModels.includes(model) || args._skipWorkspaceInjection) {
@@ -350,21 +375,22 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
-          if (fullConfig.enableRlsGucTagging) {
-            await maybeSetRlsGuc(rawPrisma, wsCtx);
-          }
           const injectedCreate = injectCreateFields(args.create, wsCtx, fullConfig);
           const injectedUpdate = injectUpdateFields(args.update, wsCtx, fullConfig);
           let injectedWhere = args.where;
           if (fullConfig.enableUpdateWhereIsolation && !isExcludedFromReadIsolation(model, fullConfig)) {
             injectedWhere = injectWhereClause(args.where, wsCtx);
           }
-          return query({
+          const finalArgs = {
             ...stripSkipFlag(args),
             create: injectedCreate,
             update: injectedUpdate,
             where: injectedWhere
-          });
+          };
+          if (fullConfig.enableRlsGucTagging) {
+            return runOperationWithRlsGuc(rawPrismaForTransactions, wsCtx, model, "upsert", finalArgs);
+          }
+          return query(finalArgs);
         },
         // ================================================================
         // READ OPERATIONS - inject workspaceId into where clause
@@ -381,19 +407,20 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
-          if (fullConfig.enableRlsGucTagging) {
-            await maybeSetRlsGuc(rawPrisma, wsCtx);
-          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.findMany - injected workspaceId into where`, {
               workspaceId: wsCtx.workspaceId
             });
           }
-          return query({
+          const finalArgs = {
             ...stripSkipFlag(args),
             where: injectedWhere
-          });
+          };
+          if (fullConfig.enableRlsGucTagging) {
+            return runOperationWithRlsGuc(rawPrismaForTransactions, wsCtx, model, "findMany", finalArgs);
+          }
+          return query(finalArgs);
         },
         async findFirst({ model, args, query }) {
           if (!fullConfig.enableReadIsolation || isExcludedFromReadIsolation(model, fullConfig) || args._skipWorkspaceInjection) {
@@ -407,19 +434,20 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
-          if (fullConfig.enableRlsGucTagging) {
-            await maybeSetRlsGuc(rawPrisma, wsCtx);
-          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.findFirst - injected workspaceId into where`, {
               workspaceId: wsCtx.workspaceId
             });
           }
-          return query({
+          const finalArgs = {
             ...stripSkipFlag(args),
             where: injectedWhere
-          });
+          };
+          if (fullConfig.enableRlsGucTagging) {
+            return runOperationWithRlsGuc(rawPrismaForTransactions, wsCtx, model, "findFirst", finalArgs);
+          }
+          return query(finalArgs);
         },
         async findFirstOrThrow({ model, args, query }) {
           if (!fullConfig.enableReadIsolation || isExcludedFromReadIsolation(model, fullConfig) || args._skipWorkspaceInjection) {
@@ -433,19 +461,20 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
-          if (fullConfig.enableRlsGucTagging) {
-            await maybeSetRlsGuc(rawPrisma, wsCtx);
-          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.findFirstOrThrow - injected workspaceId into where`, {
               workspaceId: wsCtx.workspaceId
             });
           }
-          return query({
+          const finalArgs = {
             ...stripSkipFlag(args),
             where: injectedWhere
-          });
+          };
+          if (fullConfig.enableRlsGucTagging) {
+            return runOperationWithRlsGuc(rawPrismaForTransactions, wsCtx, model, "findFirstOrThrow", finalArgs);
+          }
+          return query(finalArgs);
         },
         async findUnique({ model, args, query }) {
           if (!fullConfig.enableReadIsolation || isExcludedFromReadIsolation(model, fullConfig) || args._skipWorkspaceInjection) {
@@ -459,19 +488,20 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
-          if (fullConfig.enableRlsGucTagging) {
-            await maybeSetRlsGuc(rawPrisma, wsCtx);
-          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.findUnique - injected workspaceId into where`, {
               workspaceId: wsCtx.workspaceId
             });
           }
-          return query({
+          const finalArgs = {
             ...stripSkipFlag(args),
             where: injectedWhere
-          });
+          };
+          if (fullConfig.enableRlsGucTagging) {
+            return runOperationWithRlsGuc(rawPrismaForTransactions, wsCtx, model, "findUnique", finalArgs);
+          }
+          return query(finalArgs);
         },
         async findUniqueOrThrow({ model, args, query }) {
           if (!fullConfig.enableReadIsolation || isExcludedFromReadIsolation(model, fullConfig) || args._skipWorkspaceInjection) {
@@ -485,19 +515,20 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
-          if (fullConfig.enableRlsGucTagging) {
-            await maybeSetRlsGuc(rawPrisma, wsCtx);
-          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.findUniqueOrThrow - injected workspaceId into where`, {
               workspaceId: wsCtx.workspaceId
             });
           }
-          return query({
+          const finalArgs = {
             ...stripSkipFlag(args),
             where: injectedWhere
-          });
+          };
+          if (fullConfig.enableRlsGucTagging) {
+            return runOperationWithRlsGuc(rawPrismaForTransactions, wsCtx, model, "findUniqueOrThrow", finalArgs);
+          }
+          return query(finalArgs);
         },
         async count({ model, args, query }) {
           if (!fullConfig.enableReadIsolation || isExcludedFromReadIsolation(model, fullConfig) || args._skipWorkspaceInjection) {
@@ -511,19 +542,20 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
-          if (fullConfig.enableRlsGucTagging) {
-            await maybeSetRlsGuc(rawPrisma, wsCtx);
-          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.count - injected workspaceId into where`, {
               workspaceId: wsCtx.workspaceId
             });
           }
-          return query({
+          const finalArgs = {
             ...stripSkipFlag(args),
             where: injectedWhere
-          });
+          };
+          if (fullConfig.enableRlsGucTagging) {
+            return runOperationWithRlsGuc(rawPrismaForTransactions, wsCtx, model, "count", finalArgs);
+          }
+          return query(finalArgs);
         },
         async aggregate({ model, args, query }) {
           if (!fullConfig.enableReadIsolation || isExcludedFromReadIsolation(model, fullConfig) || args._skipWorkspaceInjection) {
@@ -537,19 +569,20 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
-          if (fullConfig.enableRlsGucTagging) {
-            await maybeSetRlsGuc(rawPrisma, wsCtx);
-          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.aggregate - injected workspaceId into where`, {
               workspaceId: wsCtx.workspaceId
             });
           }
-          return query({
+          const finalArgs = {
             ...stripSkipFlag(args),
             where: injectedWhere
-          });
+          };
+          if (fullConfig.enableRlsGucTagging) {
+            return runOperationWithRlsGuc(rawPrismaForTransactions, wsCtx, model, "aggregate", finalArgs);
+          }
+          return query(finalArgs);
         },
         async groupBy({ model, args, query }) {
           if (!fullConfig.enableReadIsolation || isExcludedFromReadIsolation(model, fullConfig) || args._skipWorkspaceInjection) {
@@ -563,19 +596,20 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
-          if (fullConfig.enableRlsGucTagging) {
-            await maybeSetRlsGuc(rawPrisma, wsCtx);
-          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.groupBy - injected workspaceId into where`, {
               workspaceId: wsCtx.workspaceId
             });
           }
-          return query({
+          const finalArgs = {
             ...stripSkipFlag(args),
             where: injectedWhere
-          });
+          };
+          if (fullConfig.enableRlsGucTagging) {
+            return runOperationWithRlsGuc(rawPrismaForTransactions, wsCtx, model, "groupBy", finalArgs);
+          }
+          return query(finalArgs);
         },
         // ================================================================
         // DELETE OPERATIONS - inject workspaceId into where clause
@@ -592,19 +626,20 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
-          if (fullConfig.enableRlsGucTagging) {
-            await maybeSetRlsGuc(rawPrisma, wsCtx);
-          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.delete - injected workspaceId into where`, {
               workspaceId: wsCtx.workspaceId
             });
           }
-          return query({
+          const finalArgs = {
             ...stripSkipFlag(args),
             where: injectedWhere
-          });
+          };
+          if (fullConfig.enableRlsGucTagging) {
+            return runOperationWithRlsGuc(rawPrismaForTransactions, wsCtx, model, "delete", finalArgs);
+          }
+          return query(finalArgs);
         },
         async deleteMany({ model, args, query }) {
           if (!fullConfig.enableDeleteIsolation || isExcludedFromReadIsolation(model, fullConfig) || args._skipWorkspaceInjection) {
@@ -618,19 +653,20 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
-          if (fullConfig.enableRlsGucTagging) {
-            await maybeSetRlsGuc(rawPrisma, wsCtx);
-          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.deleteMany - injected workspaceId into where`, {
               workspaceId: wsCtx.workspaceId
             });
           }
-          return query({
+          const finalArgs = {
             ...stripSkipFlag(args),
             where: injectedWhere
-          });
+          };
+          if (fullConfig.enableRlsGucTagging) {
+            return runOperationWithRlsGuc(rawPrismaForTransactions, wsCtx, model, "deleteMany", finalArgs);
+          }
+          return query(finalArgs);
         }
       }
     }
@@ -638,6 +674,6 @@ function addWorkspaceExtension(baseClient, config) {
 }
 __name(addWorkspaceExtension, "addWorkspaceExtension");
 
-export { addWorkspaceExtension, getWorkspaceContext, injectWhereWorkspaceId, maybeSetRlsGuc, maybeTagConnection, setWorkspaceContext, withWorkspaceContext, withWorkspaceContextSync };
-//# sourceMappingURL=chunk-MXLCLLCI.js.map
-//# sourceMappingURL=chunk-MXLCLLCI.js.map
+export { addWorkspaceExtension, defaultWorkspaceExtensionConfig, getWorkspaceContext, injectCreateFields, injectWhereWorkspaceId, maybeSetRlsGuc, maybeTagConnection, runOperationWithRlsGuc, setWorkspaceContext, withWorkspaceContext, withWorkspaceContextSync };
+//# sourceMappingURL=chunk-KESVEZB2.js.map
+//# sourceMappingURL=chunk-KESVEZB2.js.map