@xkova/sdk 0.1.0-alpha.7 → 0.1.0-alpha.9

package/dist/workforce-bff.js

@@ -0,0 +1,462 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { XKOVAClient } from './client.js';
+import { XKOVAApiError } from './errors.js';
+import { isAllowedProtocol } from './url.js';
+import { WorkforceWalletsResource } from './resources/workforce-wallets.js';
+// These helpers operate only on a customer's cookie/reference and CSRF proof.
+// Reusing their cryptography does not reuse member identity or session authority.
+export { serializeXKOVAMemberSessionCookie as serializeXKOVAWorkforceSessionCookie, serializeXKOVAMemberFlowCookie as serializeXKOVAWorkforceFlowCookie, serializeClearedXKOVAMemberCookie as serializeClearedXKOVAWorkforceCookie, readXKOVAMemberCookie as readXKOVAWorkforceCookie, readXKOVAMemberCallbackFlow as readXKOVAWorkforceCallbackFlow, xkovaMemberFlowCookieName as xkovaWorkforceFlowCookieName, createXKOVAMemberCsrfToken as createXKOVAWorkforceCsrfToken, verifyXKOVAMemberCsrfToken as verifyXKOVAWorkforceCsrfToken, assertXKOVAMemberRequestOrigin as assertXKOVAWorkforceRequestOrigin, } from './member-bff.js';
+export class XKOVAWorkforceBffError extends Error {
+    code;
+    constructor(code) {
+        super('The workforce sign-in or session cannot safely continue. Start sign-in again.');
+        this.code = code;
+        this.name = 'XKOVAWorkforceBffError';
+    }
+}
+/** Confidential workforce protocol. It neither enrolls a subject nor creates local staff authority. */
+export class XKOVAWorkforceBffClient {
+    options;
+    client;
+    fingerprint;
+    constructor(options) {
+        this.options = options;
+        if (!/^xkova_wf_[A-Za-z0-9_-]{43}$/.test(options.workforceKey)) {
+            throw new TypeError('Invalid workforce application selector');
+        }
+        this.client = XKOVAClient.forTenant(options);
+        const origin = new URL(options.baseUrl).origin;
+        this.fingerprint = digest(JSON.stringify([origin, options.apiKey, options.workforceKey]));
+    }
+    async beginAuthorization(input) {
+        const origin = new URL(input.browserOrigin);
+        const callback = exactCallback(input.redirectUri);
+        if (origin.origin !== input.browserOrigin ||
+            !isAllowedProtocol(origin) ||
+            callback.origin !== origin.origin) {
+            throw new TypeError('Workforce callback must belong to the exact application origin');
+        }
+        const state = random(), codeVerifier = random();
+        const transaction = {
+            clientFingerprint: this.fingerprint,
+            status: 'pending',
+            redirectUri: callback.href,
+            codeVerifier,
+            codeChallenge: digest(codeVerifier),
+            exchangeAttemptId: random(),
+            sessionReference: random(),
+            expiresAt: Date.now() + 300_000,
+        };
+        const key = digest(state);
+        await input.transactionStore.put(key, transaction);
+        const result = object(await this.postJson('/workforce-auth/transactions', {
+            browser_origin: origin.origin,
+            redirect_uri: callback.href,
+            code_challenge: transaction.codeChallenge,
+            code_challenge_method: 'S256',
+        }, transaction.exchangeAttemptId));
+        const expiresAt = timestamp(result, 'expires_at');
+        if (expiresAt <= Date.now() || expiresAt > transaction.expiresAt + 5_000)
+            throw new Error('Invalid workforce transaction lifetime');
+        const issuer = text(result, 'issuer');
+        secureUrl(issuer);
+        const authorizationEndpoint = secureUrl(text(result, 'authorization_endpoint')).href;
+        const audience = text(result, 'audience'), nonce = text(result, 'nonce');
+        opaque(nonce);
+        const maxAuthAgeSeconds = result.max_auth_age_seconds;
+        if (!Number.isSafeInteger(maxAuthAgeSeconds) || Number(maxAuthAgeSeconds) < 1)
+            throw new Error('Invalid workforce authentication policy');
+        const requiredAcrValues = strings(result.required_acr_values);
+        const bound = {
+            ...transaction,
+            transactionId: text(result, 'transaction_id'),
+            nonce,
+            issuer,
+            audience,
+            expiresAt,
+        };
+        await input.transactionStore.replace(key, bound);
+        return {
+            state,
+            nonce,
+            redirectUri: callback.href,
+            codeChallenge: transaction.codeChallenge,
+            codeChallengeMethod: 'S256',
+            issuer,
+            audience,
+            authorizationEndpoint,
+            maxAuthAgeSeconds: Number(maxAuthAgeSeconds),
+            requiredAcrValues,
+            expiresAt: new Date(expiresAt).toISOString(),
+        };
+    }
+    async completeAuthorizationCallback(input) {
+        const callback = secureUrl(input.callbackUrl), states = callback.searchParams.getAll('state');
+        opaque(input.expectedState);
+        if (states.length !== 1 ||
+            !equal(states[0], input.expectedState) ||
+            callback.searchParams.has('error')) {
+            throw new XKOVAWorkforceBffError('binding_mismatch');
+        }
+        const codes = callback.searchParams.getAll('code');
+        if (codes.length !== 1 || !codes[0] || codes[0].length > 8192)
+            throw new XKOVAWorkforceBffError('binding_mismatch');
+        const code = codes[0], codeHash = digest(code), key = digest(input.expectedState);
+        return input.transactionStore.runExclusive(key, async () => {
+            const initial = await input.transactionStore.get(key);
+            if (!initial ||
+                initial.expiresAt <= Date.now() ||
+                initial.clientFingerprint !== this.fingerprint ||
+                callback.origin + callback.pathname !== initial.redirectUri) {
+                throw new XKOVAWorkforceBffError('transaction_unavailable');
+            }
+            if (initial.providerExchangeStarted &&
+                initial.providerExchangeStarted.codeHash !== codeHash) {
+                throw new XKOVAWorkforceBffError('binding_mismatch');
+            }
+            const reference = initial.sessionReference;
+            return input.sessionStore.runExclusive(reference, async () => {
+                let transaction = initial;
+                if (transaction.stagedProofToken && !transaction.providerExchangeStarted) {
+                    throw new XKOVAWorkforceBffError('transaction_unavailable');
+                }
+                const existing = await input.sessionStore.get(reference);
+                if (existing) {
+                    this.assertSession(existing);
+                    if (existing.authorizationCodeHash !== codeHash || existing.logoutPending) {
+                        throw new XKOVAWorkforceBffError('session_unavailable');
+                    }
+                    await input.transactionStore.replace(key, { ...transaction, status: 'completed' });
+                    return { reference, session: existing };
+                }
+                if (transaction.status === 'completed' ||
+                    !transaction.transactionId ||
+                    !transaction.nonce ||
+                    !transaction.issuer ||
+                    !transaction.audience)
+                    throw new XKOVAWorkforceBffError('session_unavailable');
+                if (!transaction.stagedProofToken) {
+                    if (transaction.providerExchangeStarted)
+                        throw new XKOVAWorkforceBffError('provider_exchange_outcome_unknown');
+                    // Freeze application data before consuming a code. A later retry cannot replace it.
+                    transaction = {
+                        ...transaction,
+                        providerExchangeStarted: {
+                            codeHash,
+                            applicationData: JSON.parse(JSON.stringify({ value: input.applicationData })).value,
+                        },
+                    };
+                    await input.transactionStore.replace(key, transaction);
+                    const proof = await input.exchangeProviderCode({
+                        code,
+                        codeVerifier: transaction.codeVerifier,
+                        redirectUri: transaction.redirectUri,
+                        expectedNonce: transaction.nonce,
+                        issuer: transaction.issuer,
+                        audience: transaction.audience,
+                    });
+                    if (typeof proof.proofToken !== 'string' ||
+                        !proof.proofToken ||
+                        proof.proofToken.length > 65536) {
+                        throw new Error('Invalid workforce provider proof result');
+                    }
+                    transaction = { ...transaction, stagedProofToken: proof.proofToken };
+                    await input.transactionStore.replace(key, transaction);
+                }
+                const material = parseMaterial(await this.postJson('/workforce-auth/exchange', {
+                    transaction_id: transaction.transactionId,
+                    nonce: transaction.nonce,
+                    proof_token: transaction.stagedProofToken,
+                    exchange_attempt_id: transaction.exchangeAttemptId,
+                }, transaction.exchangeAttemptId));
+                const stored = {
+                    clientFingerprint: this.fingerprint,
+                    authorizationCodeHash: codeHash,
+                    material,
+                    applicationExpiresAt: timestamp(material.session, 'absolute_expires_at'),
+                    applicationData: transaction.providerExchangeStarted.applicationData,
+                };
+                await input.sessionStore.put(reference, stored);
+                await input.transactionStore.replace(key, { ...transaction, status: 'completed' });
+                return { reference, session: stored };
+            });
+        });
+    }
+    async getSession(sessionToken) {
+        credential(sessionToken, 'xwfs');
+        return parseSession(await this.getJson('/workforce-auth/session', sessionToken));
+    }
+    async resolveSession(input) {
+        opaque(input.reference);
+        return input.sessionStore.runExclusive(input.reference, async () => {
+            let stored = await input.sessionStore.get(input.reference);
+            if (!stored || stored.logoutPending)
+                return null;
+            this.assertSession(stored);
+            if (stored.applicationExpiresAt <= Date.now())
+                return null;
+            try {
+                if (timestamp(stored.material.session, 'expires_at') <= Date.now() + 30_000) {
+                    const material = parseMaterial(await this.postJson('/workforce-auth/refresh', {
+                        refresh_token: stored.material.refresh_token,
+                        refresh_attempt_token: stored.material.refresh_attempt_token,
+                    }));
+                    assertSameHuman(stored.material.session, material.session);
+                    stored = { ...stored, material };
+                    await input.sessionStore.replace(input.reference, stored);
+                }
+                const session = await this.getSession(stored.material.session_token);
+                assertSameHuman(stored.material.session, session);
+                stored = { ...stored, material: { ...stored.material, session } };
+                await input.sessionStore.replace(input.reference, stored);
+                return stored;
+            }
+            catch (error) {
+                if (error instanceof XKOVAApiError && (error.status === 401 || error.status === 403)) {
+                    await input.sessionStore.replace(input.reference, { ...stored, logoutPending: true });
+                    return null;
+                }
+                throw error;
+            }
+        });
+    }
+    /** Request-scoped resources only. Check the browser's Origin/CSRF before invoking writes. */
+    async resolveResources(input) {
+        const session = await this.resolveSession(input);
+        if (!session)
+            return null;
+        if (input.actionGrant) {
+            opaque(input.actionGrant.grant_token);
+            if (timestamp(input.actionGrant, 'expires_at') <= Date.now())
+                throw new XKOVAWorkforceBffError('session_unavailable');
+        }
+        const bound = XKOVAClient.forWorkforceSession(this.options, {
+            workforceKey: this.options.workforceKey,
+            sessionToken: session.material.session_token,
+            browserOrigin: input.browserOrigin,
+            ...(input.actionGrant && { humanAuthorization: input.actionGrant.grant_token }),
+        });
+        return {
+            session,
+            resources: {
+                treasury: bound.treasury,
+                tokenization: bound.tokenization,
+                wallets: new WorkforceWalletsResource(bound),
+            },
+        };
+    }
+    /** Review the locator returned by human_authorization_required. Never send it to a third-party host. */
+    async inspectAction(input) {
+        opaque(input.authorizationToken);
+        const raw = object(await this.getJson(`/workforce-auth/actions/${encodeURIComponent(input.authorizationToken)}`, input.sessionToken, input.browserOrigin));
+        text(raw, 'operation');
+        text(raw, 'proof_method');
+        object(raw.review);
+        validateReview(raw);
+        return raw;
+    }
+    /** Starts a real provider ceremony after the user reviews the exact request. No action is executed. */
+    async beginActionProof(input) {
+        opaque(input.authorizationToken);
+        const raw = object(await this.postJson(`/workforce-auth/actions/${encodeURIComponent(input.authorizationToken)}/begin`, undefined, undefined, input));
+        if (text(raw, 'nonce') !== input.authorizationToken)
+            throw new XKOVAWorkforceBffError('binding_mismatch');
+        secureUrl(text(raw, 'issuer'));
+        secureUrl(text(raw, 'authorization_endpoint'));
+        text(raw, 'audience');
+        const maxAge = raw.max_auth_age_seconds;
+        if (!Number.isSafeInteger(maxAge) || Number(maxAge) < 1 || Number(maxAge) > 300)
+            throw new Error('Invalid workforce action policy');
+        strings(raw.required_acr_values);
+        strings(raw.required_amr_values);
+        object(raw.review);
+        validateReview(raw);
+        return raw;
+    }
+    /** Submit the real, freshly verified provider token. A lost response is never automatically retried. */
+    async completeActionProof(input) {
+        opaque(input.authorizationToken);
+        if (input.nonce !== input.authorizationToken)
+            throw new XKOVAWorkforceBffError('binding_mismatch');
+        if (!input.proofToken || input.proofToken.length > 16384)
+            throw new TypeError('Invalid workforce action proof');
+        const raw = object(await this.postJson(`/workforce-auth/actions/${encodeURIComponent(input.authorizationToken)}/complete`, { nonce: input.nonce, proof_token: input.proofToken }, undefined, input));
+        opaque(text(raw, 'grant_token'));
+        if (timestamp(raw, 'expires_at') <= Date.now())
+            throw new XKOVAWorkforceBffError('session_unavailable');
+        return raw;
+    }
+    async logoutSession(input) {
+        opaque(input.reference);
+        await input.sessionStore.runExclusive(input.reference, async () => {
+            const stored = await input.sessionStore.get(input.reference);
+            if (!stored)
+                return;
+            this.assertSession(stored);
+            if (!stored.logoutPending)
+                await input.sessionStore.replace(input.reference, { ...stored, logoutPending: true });
+            await this.postJson('/workforce-auth/sign-out', {
+                session_token: stored.material.session_token,
+            });
+            await input.sessionStore.delete(input.reference);
+        });
+    }
+    assertSession(session) {
+        if (session.clientFingerprint !== this.fingerprint)
+            throw new XKOVAWorkforceBffError('binding_mismatch');
+    }
+    postJson(path, body, idempotencyKey, context) {
+        const client = context
+            ? XKOVAClient.forWorkforceSession(this.options, {
+                ...context,
+                workforceKey: this.options.workforceKey,
+            })
+            : this.client;
+        return client.requestJson({
+            method: 'POST',
+            path,
+            ...(body !== undefined && { body }),
+            headers: { 'X-XKOVA-Workforce-Key': this.options.workforceKey },
+            ...(idempotencyKey !== undefined && { idempotencyKey }),
+        });
+    }
+    getJson(path, sessionToken, browserOrigin) {
+        const client = browserOrigin
+            ? XKOVAClient.forWorkforceSession(this.options, {
+                sessionToken,
+                browserOrigin,
+                workforceKey: this.options.workforceKey,
+            })
+            : this.client;
+        return client.requestJson({
+            method: 'GET',
+            path,
+            headers: {
+                'X-XKOVA-Workforce-Key': this.options.workforceKey,
+                'X-Workforce-Session': sessionToken,
+            },
+        });
+    }
+}
+/** Advisory browser UI data only; provider identity, credentials and grants stay confidential. */
+export function projectXKOVAWorkforceSession(value) {
+    return {
+        signedIn: true,
+        staffId: value.material.session.staff_id,
+        roles: [...value.material.session.roles],
+        expiresAt: value.material.session.expires_at,
+    };
+}
+function parseMaterial(value) {
+    const raw = object(value);
+    const sessionToken = text(raw, 'session_token'), refreshToken = text(raw, 'refresh_token'), attempt = text(raw, 'refresh_attempt_token');
+    credential(sessionToken, 'xwfs');
+    credential(refreshToken, 'xwfr');
+    credential(attempt, 'xwfa');
+    return {
+        session_token: sessionToken,
+        refresh_token: refreshToken,
+        refresh_attempt_token: attempt,
+        session: parseSession(raw.session),
+    };
+}
+function parseSession(value) {
+    const raw = object(value), grants = object(raw.resource_grants);
+    for (const name of ['session_id', 'application_id', 'person_id', 'tenant_id', 'workspace_id']) {
+        if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(text(raw, name))) {
+            throw new Error('Invalid workforce session identity');
+        }
+    }
+    if (!/^stf_[0-9A-Za-z]{22}$/.test(text(raw, 'staff_id')))
+        throw new Error('Invalid workforce staff identity');
+    const expires = timestamp(raw, 'expires_at'), absolute = timestamp(raw, 'absolute_expires_at');
+    if (expires > absolute || typeof raw.action_authorization_enabled !== 'boolean')
+        throw new Error('Invalid workforce session policy');
+    text(raw, 'provider_namespace');
+    text(raw, 'provider_subject');
+    strings(raw.roles);
+    strings(raw.scopes);
+    strings(grants.treasury_wallet_ids);
+    strings(grants.customer_token_ids);
+    if (!strings(grants.treasury_wallet_ids).every((id) => /^vlt_[0-9A-Za-z]{22}$/.test(id)) ||
+        !strings(grants.customer_token_ids).every((id) => /^ctk_[0-9A-Za-z]{22}$/.test(id))) {
+        throw new Error('Invalid workforce resource identity');
+    }
+    return raw;
+}
+function assertSameHuman(before, after) {
+    for (const name of [
+        'session_id',
+        'application_id',
+        'staff_id',
+        'person_id',
+        'tenant_id',
+        'workspace_id',
+        'provider_namespace',
+        'provider_subject',
+    ]) {
+        if (before[name] !== after[name])
+            throw new XKOVAWorkforceBffError('binding_mismatch');
+    }
+}
+function random() {
+    return randomBytes(32).toString('base64url');
+}
+function digest(value) {
+    return createHash('sha256').update(value).digest('base64url');
+}
+function opaque(value) {
+    if (!/^[A-Za-z0-9_-]{43}$/.test(value))
+        throw new TypeError('Invalid opaque workforce reference');
+}
+function credential(value, prefix) {
+    if (!new RegExp(`^${prefix}_[A-Za-z0-9_-]{43}$`).test(value))
+        throw new TypeError('Invalid workforce credential');
+}
+function equal(a, b) {
+    const left = Buffer.from(a), right = Buffer.from(b);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+function secureUrl(value) {
+    const url = new URL(value);
+    if (!isAllowedProtocol(url) || url.username || url.password || url.hash)
+        throw new TypeError('Invalid workforce URL');
+    return url;
+}
+function exactCallback(value) {
+    const url = secureUrl(value);
+    if (url.search)
+        throw new TypeError('Workforce callback cannot contain a query');
+    return url;
+}
+function object(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Invalid workforce API response');
+    return value;
+}
+function text(value, key) {
+    const field = value[key];
+    if (typeof field !== 'string' || !field || field.length > 65536)
+        throw new Error('Invalid workforce API response field');
+    return field;
+}
+function strings(value) {
+    if (!Array.isArray(value) ||
+        value.length > 1000 ||
+        !value.every((item) => typeof item === 'string' && item.length > 0 && item.length <= 512)) {
+        throw new Error('Invalid workforce API response list');
+    }
+    return value;
+}
+function timestamp(value, key) {
+    const result = Date.parse(text(value, key));
+    if (!Number.isFinite(result))
+        throw new Error('Invalid workforce API expiry');
+    return result;
+}
+function validateReview(raw) {
+    if (!/^[a-f0-9]{64}$/i.test(text(raw, 'review_digest')) ||
+        timestamp(raw, 'expires_at') <= Date.now()) {
+        throw new XKOVAWorkforceBffError('session_unavailable');
+    }
+}

package/llms.txt

@@ -9,6 +9,7 @@ Use this package on a Node.js 22+ server. Read the installed declarations before
 - `dist/generated/types.d.ts`: exact request bodies, responses, parameters, and operation IDs. Import types through @xkova/sdk/types.
 - `dist/member-bff.d.ts`: authorization, session persistence, refresh, logout, action reviews, and human authorization.
 - `dist/member-resources.d.ts`: typed resources bound to the exact authenticated member.
+- `dist/workforce-bff.d.ts`: confidential workforce sessions, durable callback recovery, exact action reviews and fresh provider proof. Use @xkova/sdk/workforce-bff, separately from member login and Console operators.
 - [Quickstart](https://docs.xkova.com/getting-started.html): sandbox access and first authenticated call.
 - [Customer OpenAPI](https://github.com/XKOVA/typescript-sdk/blob/main/schema/customer-api.json): machine-readable contract for the public SDK source. For an installed release, use its generated declarations.
 - [SDK guide](https://docs.xkova.com/sdk-overview.html): client and resource examples.
@@ -22,6 +23,7 @@ Use this package on a Node.js 22+ server. Read the installed declarations before
 1. Server business integration: create XKOVAClient.forTenant({ baseUrl, apiKey }). Use https://sandbox-api.xkova.com for sandbox and https://api.xkova.com for production. The API key binds the workspace and mode.
 2. Member application: use XKOVAMemberBffClient from @xkova/sdk/member-bff in your BFF. Resolve confidential sessions to request-scoped resources with resolveResources(). The browser sends only its application cookie and CSRF proof to your BFF.
 3. Browser companion: optionally install @xkova/browser. It calls your same-origin routes; it does not create those routes or install a session store.
+4. Customer staff application: use XKOVAWorkforceBffClient from @xkova/sdk/workforce-bff, an explicitly registered dedicated principal and immutable admitted provider subjects. Resolve each authenticated person per request. API-key attribution, email, groups and member credentials cannot create staff authority.
 
 ## Find a capability
 
@@ -40,6 +42,7 @@ Each namespace below is a property of XKOVAClient. Read its declaration under di
 | Transaction history | transactions |
 | Fee schedules and platform fees | feeSchedules |
 | Customer tokens, deployment, minting, supply, access | tokenization |
+| Tenant treasury vaults, proposals, owner signatures, quorum and transfer status | treasury |
 | Real-world assets, cap tables, distributions, corporate actions, provenance | rwa |
 | Gateway registration and conformance | integrationGateways |
 | Branding and sending-domain configuration | branding |
@@ -48,6 +51,7 @@ Each namespace below is a property of XKOVAClient. Read its declaration under di
 | Webhook subscriptions and delivery operations | webhooks |
 | Token deployment/mint polling and off-ramp initiation | workflows |
 | Session exchange, durable review recovery, fresh human authorization | @xkova/sdk/member-bff |
+| Institution workforce login, scoped sessions and exact action proofs | @xkova/sdk/workforce-bff |
 | Verify webhook signatures over raw body bytes | @xkova/sdk/webhook |
 | Offline RWA transparency proofs | @xkova/sdk/rwa-verify |
 | Customer contract ABIs | @xkova/sdk/abi |
@@ -60,6 +64,7 @@ API availability does not grant permission. Product entitlement, selected API-ke
 - Use exported package entry points and typed resource methods. Do not import dist files as runtime subpaths, fabricate request fields, or suppress type errors with any.
 - Production writes require the bearer key plus an active asymmetric requestSigner credential. Its async callback signs through your key provider. The SDK supplies RFC 9421 signatures and RFC 9530 digests. Production reads use bearer authentication.
 - Generate one idempotency key before a logical mutation and persist it. Reuse it only with the identical request. The SDK does not automatically retry writes. A timeout or disconnect can leave the outcome unknown; reconcile the existing resource before starting another operation.
+- Treasury methods preserve API roles, governance holds, independent owner signatures and Safe quorum. An API key is not an authenticated staff session or a wallet signer. Use isHeldApproval before reading an entity from a governed mutation; approval does not itself produce a signature or prove settlement.
 - Use decimal strings for monetary values according to the request type. Preserve asset and chain identity throughout a flow. Do not perform monetary calculations with JavaScript floating-point numbers.
 - Read pagination and response types. Use paginateCursor or collectCursor where applicable; bound collection sizes and polling. Propagate AbortSignal and request deadlines.
 - Handle XKOVAApiError with its code, status, correlationId, and retryAfter. Handle XKOVAUploadError for the object-storage stage. Do not expose transport headers, provider proofs, or signed URLs in user errors or logs.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xkova/sdk",
-  "version": "0.1.0-alpha.7",
+  "version": "0.1.0-alpha.9",
   "description": "TypeScript SDK for the XKOVA API.",
   "homepage": "https://docs.xkova.com",
   "repository": {
@@ -31,6 +31,10 @@
       "types": "./dist/member-bff.d.ts",
       "default": "./dist/member-bff.js"
     },
+    "./workforce-bff": {
+      "types": "./dist/workforce-bff.d.ts",
+      "default": "./dist/workforce-bff.js"
+    },
     "./webhook": {
       "types": "./dist/webhook.d.ts",
       "default": "./dist/webhook.js"