@forestadmin/agent-bff 1.2.0 → 1.4.0

package/README.md

@@ -3,9 +3,10 @@
 Standalone REST BFF (Backend-For-Frontend) that lets a trusted third-party UI call a Forest Admin
 agent from a browser without learning MCP or JSON:API.
 
-This package is the Slice 0 scaffold: a bootable Koa 3 server with a `/health` endpoint, a version
-header, and env-driven config validation. Auth, data endpoints, and OpenAPI generation land in later
-slices.
+It is a bootable Koa 3 server with a `/health` endpoint, a version header, env-driven config
+validation, OAuth (Mode 1) + API-key (Mode 2) auth, and a hardened request edge (timezone, CORS,
+auth-mode precedence, structured error contract). The data-endpoint proxy and OpenAPI generation
+land in later slices.
 
 ## Usage
 
@@ -34,14 +35,61 @@ yarn start:dev         # node --env-file=.env dist/cli.js
 | `FOREST_SERVER_URL`  | yes      | Forest SaaS API base URL.                                            |
 | `FOREST_APP_URL`     | yes      | Forest front base URL (OAuth front-channel, later slices).          |
 | `AGENT_URL`          | yes      | The customer agent base URL the BFF calls via agent-client.          |
+| `BFF_TOKEN_ENCRYPTION_KEY`| for OAuth | Base64-encoded 32-byte AES-256 key encrypting stored refresh tokens. Until it is set, the `/oauth/*` token-issuance routes are disabled and `/health` reports `degraded`; already-issued `bff_access` tokens still authenticate on `/agent/*` whenever `FOREST_AUTH_SECRET` is present. |
 | `HTTP_PORT`          | no       | Server port, integer 0–65535. Defaults to `3450`. `0` binds an OS-assigned ephemeral port. |
+| `BFF_ALLOWED_ORIGINS`| no       | Comma-separated CORS allow-list of exact origins (scheme + host + port). No wildcard. Empty ⇒ no cross-origin browser access. |
+| `BFF_DEFAULT_TIMEZONE`| no      | Fallback IANA timezone used when a request carries neither an `X-Forest-Timezone` header nor a body `timezone`. |
 
 ### Config validation
 
-- A malformed value (a non-http(s) `*_URL`, a `HTTP_PORT` that is not a decimal integer in 0–65535)
-  fails fast at boot: the process exits with a clear error and never echoes the offending value.
+- A malformed value (a non-http(s) `*_URL`, a `HTTP_PORT` that is not a decimal integer in 0–65535,
+  a non-IANA `BFF_DEFAULT_TIMEZONE`) fails fast at boot: the process exits with a clear error and
+  never echoes the offending value.
 - A required var that is absent (or empty / whitespace-only) does not crash the server. It boots and
   reports the gap through `/health` (503 `degraded`).
+- Malformed `BFF_ALLOWED_ORIGINS` entries (including a literal `*`) are dropped and logged once at
+  boot (`Warn`); they never enter the allow-list, so a wildcard origin can never be served.
+
+## Request edge (`/agent/*`)
+
+Every agent call flows through a request edge that enforces three cross-cutting concerns before the
+(Slice-3) proxy runs. Errors use a structured, type-first contract — `{ error: { type, status,
+message, details? } }` — so consumers branch on `error.type`, never on message text.
+
+### Auth-mode precedence
+
+| Presented credentials                          | Result                          |
+| ---------------------------------------------- | ------------------------------- |
+| `Authorization: Bearer <bff_access>`           | Mode 1 (OAuth session)          |
+| `X-Forest-Bff-Key`                             | Mode 2 (API key)                |
+| both                                           | `400 ambiguous_credentials`     |
+| neither                                        | `401 unauthorized`              |
+
+A Mode 1 `bff_access` that is malformed or wrong-typed → `401 unauthorized`; one that is validly
+signed but expired → `401 session_expired` (the client should refresh). Refresh-token reuse remains
+a `POST /oauth/token` concern (`session_invalidated`, OAuth/RFC shape).
+
+### CORS
+
+Two layers, both driven by exact-origin matching (case-insensitive scheme/host, default ports
+normalized away, no trailing slash, no wildcard, no subdomain matching):
+
+- **Layer 1 (transport)** — the only layer that sets `Access-Control-Allow-Origin`. An origin in
+  `BFF_ALLOWED_ORIGINS` is echoed back exactly; anything else gets no CORS headers (the browser
+  blocks). Applies to `POST /oauth/token` too. Preflight `OPTIONS` from an allow-listed origin gets
+  the allowed methods + headers; credentials are never enabled.
+- **Layer 2 (per-key authorization, Mode 2 only)** — when the resolved key has a non-empty
+  `allowedOrigins`, the request `Origin` must also be in that list (a missing `Origin` is rejected),
+  else `403 origin_not_allowed`. An empty per-key list is a no-op.
+
+**Local development:** browsers still enforce CORS against `localhost`, so add your dev origin(s) to
+`BFF_ALLOWED_ORIGINS` (e.g. `BFF_ALLOWED_ORIGINS=http://localhost:4200`) — there is no dev bypass.
+
+### Timezone
+
+The BFF always forwards an explicit `timezone` to the agent, resolved in order: (1) `X-Forest-Timezone`
+header, (2) body `timezone` field, (3) `BFF_DEFAULT_TIMEZONE`. None → `400 missing_timezone`; a
+non-IANA value → `400 invalid_timezone`.
 
 ## Sessions & token rotation
 

package/dist/agent/agent-stub.d.ts

@@ -0,0 +1,3 @@
+import type { Middleware } from 'koa';
+export default function createAgentStubMiddleware(): Middleware;
+//# sourceMappingURL=agent-stub.d.ts.map

package/dist/agent/agent-stub.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = createAgentStubMiddleware;
+const build_agent_query_1 = require("./build-agent-query");
+function createAgentStubMiddleware() {
+    return async function agentStubMiddleware(ctx) {
+        const query = (0, build_agent_query_1.buildAgentQuery)({ timezone: ctx.state.timezone });
+        ctx.state.agentQuery = query;
+        ctx.status = 501;
+        ctx.body = {
+            error: {
+                type: 'not_implemented',
+                status: 501,
+                message: 'Agent proxy is not implemented yet',
+            },
+        };
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWdlbnQtc3R1Yi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9hZ2VudC9hZ2VudC1zdHViLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBSUEsNENBY0M7QUFoQkQsMkRBQXNEO0FBRXRELFNBQXdCLHlCQUF5QjtJQUMvQyxPQUFPLEtBQUssVUFBVSxtQkFBbUIsQ0FBQyxHQUFHO1FBQzNDLE1BQU0sS0FBSyxHQUFHLElBQUEsbUNBQWUsRUFBQyxFQUFFLFFBQVEsRUFBRSxHQUFHLENBQUMsS0FBSyxDQUFDLFFBQWtCLEVBQUUsQ0FBQyxDQUFDO1FBQzFFLEdBQUcsQ0FBQyxLQUFLLENBQUMsVUFBVSxHQUFHLEtBQUssQ0FBQztRQUU3QixHQUFHLENBQUMsTUFBTSxHQUFHLEdBQUcsQ0FBQztRQUNqQixHQUFHLENBQUMsSUFBSSxHQUFHO1lBQ1QsS0FBSyxFQUFFO2dCQUNMLElBQUksRUFBRSxpQkFBaUI7Z0JBQ3ZCLE1BQU0sRUFBRSxHQUFHO2dCQUNYLE9BQU8sRUFBRSxvQ0FBb0M7YUFDOUM7U0FDRixDQUFDO0lBQ0osQ0FBQyxDQUFDO0FBQ0osQ0FBQyJ9

package/dist/agent/build-agent-query.d.ts

@@ -0,0 +1,8 @@
+export interface AgentQuery {
+    timezone: string;
+}
+export interface BuildAgentQueryParams {
+    timezone: string;
+}
+export declare function buildAgentQuery({ timezone }: BuildAgentQueryParams): AgentQuery;
+//# sourceMappingURL=build-agent-query.d.ts.map

package/dist/agent/build-agent-query.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAgentQuery = buildAgentQuery;
+function buildAgentQuery({ timezone }) {
+    return { timezone };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVpbGQtYWdlbnQtcXVlcnkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYWdlbnQvYnVpbGQtYWdlbnQtcXVlcnkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFRQSwwQ0FFQztBQUZELFNBQWdCLGVBQWUsQ0FBQyxFQUFFLFFBQVEsRUFBeUI7SUFDakUsT0FBTyxFQUFFLFFBQVEsRUFBRSxDQUFDO0FBQ3RCLENBQUMifQ==

package/dist/api-key/agent-token.d.ts

@@ -0,0 +1,8 @@
+import type { ResolvedApiKeyIdentity } from './api-key-client';
+export declare const AGENT_TOKEN_EXPIRES_IN = "5m";
+export interface IssueAgentTokenParams {
+    identity: ResolvedApiKeyIdentity;
+    authSecret: string;
+}
+export declare function issueAgentToken({ identity, authSecret }: IssueAgentTokenParams): string;
+//# sourceMappingURL=agent-token.d.ts.map

package/dist/api-key/agent-token.js

@@ -0,0 +1,34 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_TOKEN_EXPIRES_IN = void 0;
+exports.issueAgentToken = issueAgentToken;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+exports.AGENT_TOKEN_EXPIRES_IN = '5m';
+function tagsToRecord(tags) {
+    return tags.reduce((memo, { key, value }) => ({ ...memo, [key]: value }), {});
+}
+function issueAgentToken({ identity, authSecret }) {
+    const { user, renderingId } = identity;
+    const firstName = user.firstName ?? '';
+    const lastName = user.lastName ?? '';
+    const tags = tagsToRecord(user.tags);
+    // snake_case aliases: Ruby/Python agents splat JWT claims into Caller (snake_case kwargs).
+    return jsonwebtoken_1.default.sign({
+        id: user.id,
+        email: user.email,
+        firstName,
+        lastName,
+        team: user.team,
+        renderingId,
+        tags,
+        permissionLevel: user.permissionLevel,
+        first_name: firstName,
+        last_name: lastName,
+        rendering_id: renderingId,
+        permission_level: user.permissionLevel,
+    }, authSecret, { algorithm: 'HS256', expiresIn: exports.AGENT_TOKEN_EXPIRES_IN });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWdlbnQtdG9rZW4uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYXBpLWtleS9hZ2VudC10b2tlbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFlQSwwQ0F5QkM7QUF0Q0QsZ0VBQXdDO0FBRTNCLFFBQUEsc0JBQXNCLEdBQUcsSUFBSSxDQUFDO0FBTzNDLFNBQVMsWUFBWSxDQUFDLElBQXNDO0lBQzFELE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLEdBQUcsSUFBSSxFQUFFLENBQUMsR0FBRyxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQztBQUNoRixDQUFDO0FBRUQsU0FBZ0IsZUFBZSxDQUFDLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBeUI7SUFDN0UsTUFBTSxFQUFFLElBQUksRUFBRSxXQUFXLEVBQUUsR0FBRyxRQUFRLENBQUM7SUFDdkMsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLFNBQVMsSUFBSSxFQUFFLENBQUM7SUFDdkMsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLFFBQVEsSUFBSSxFQUFFLENBQUM7SUFDckMsTUFBTSxJQUFJLEdBQUcsWUFBWSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUVyQywyRkFBMkY7SUFDM0YsT0FBTyxzQkFBWSxDQUFDLElBQUksQ0FDdEI7UUFDRSxFQUFFLEVBQUUsSUFBSSxDQUFDLEVBQUU7UUFDWCxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUs7UUFDakIsU0FBUztRQUNULFFBQVE7UUFDUixJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUk7UUFDZixXQUFXO1FBQ1gsSUFBSTtRQUNKLGVBQWUsRUFBRSxJQUFJLENBQUMsZUFBZTtRQUNyQyxVQUFVLEVBQUUsU0FBUztRQUNyQixTQUFTLEVBQUUsUUFBUTtRQUNuQixZQUFZLEVBQUUsV0FBVztRQUN6QixnQkFBZ0IsRUFBRSxJQUFJLENBQUMsZUFBZTtLQUN2QyxFQUNELFVBQVUsRUFDVixFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsU0FBUyxFQUFFLDhCQUFzQixFQUFFLENBQzFELENBQUM7QUFDSixDQUFDIn0=

package/dist/api-key/api-key-authenticator.d.ts

@@ -0,0 +1,17 @@
+import type ApiKeyClient from './api-key-client';
+import type { ResolvedApiKeyIdentity } from './api-key-client';
+import type { ResolveCache } from './resolve-cache';
+export interface ApiKeyAuthenticatorOptions {
+    client: ApiKeyClient;
+    cache: ResolveCache;
+    authSecret: string;
+}
+export interface AuthenticatedApiKey {
+    agentToken: string;
+    identity: ResolvedApiKeyIdentity;
+}
+export interface ApiKeyAuthenticator {
+    authenticate(rawKey: string): Promise<AuthenticatedApiKey>;
+}
+export default function createApiKeyAuthenticator({ client, cache, authSecret, }: ApiKeyAuthenticatorOptions): ApiKeyAuthenticator;
+//# sourceMappingURL=api-key-authenticator.d.ts.map

package/dist/api-key/api-key-authenticator.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = createApiKeyAuthenticator;
+const agent_token_1 = require("./agent-token");
+const api_key_1 = require("./api-key");
+const api_key_client_1 = require("./api-key-client");
+const api_key_error_1 = require("./api-key-error");
+const UNAVAILABLE_RETRY_AFTER_SECONDS = 5;
+const NEGATIVE_CACHE_STATUSES = new Set([401, 403]);
+function mapResolveError(error) {
+    if (error.unreachable)
+        return (0, api_key_error_1.keyResolutionUnavailable)(UNAVAILABLE_RETRY_AFTER_SECONDS);
+    switch (error.status) {
+        case 401:
+            return (0, api_key_error_1.invalidApiKey)();
+        case 403:
+            return (0, api_key_error_1.forestIdentityNotAllowed)();
+        case 400:
+            return (0, api_key_error_1.invalidRequest)();
+        case 429:
+            return (0, api_key_error_1.keyResolutionUnavailable)(error.retryAfter ?? UNAVAILABLE_RETRY_AFTER_SECONDS);
+        default:
+            return (0, api_key_error_1.keyResolutionUnavailable)(UNAVAILABLE_RETRY_AFTER_SECONDS);
+    }
+}
+function createApiKeyAuthenticator({ client, cache, authSecret, }) {
+    function mint(identity) {
+        return { agentToken: (0, agent_token_1.issueAgentToken)({ identity, authSecret }), identity };
+    }
+    return {
+        async authenticate(rawKey) {
+            const parsed = (0, api_key_1.parseApiKey)(rawKey);
+            if (!parsed)
+                throw (0, api_key_error_1.invalidApiKey)();
+            const hash = (0, api_key_1.hashApiKey)(parsed.keyId, parsed.secret);
+            const cachedIdentity = cache.getPositive(hash);
+            if (cachedIdentity)
+                return mint(cachedIdentity);
+            const cachedError = cache.getNegative(hash);
+            if (cachedError)
+                throw cachedError;
+            let identity;
+            try {
+                identity = await client.resolveApiKey(parsed);
+            }
+            catch (error) {
+                if (error instanceof api_key_client_1.ApiKeyResolveError) {
+                    const mapped = mapResolveError(error);
+                    if (NEGATIVE_CACHE_STATUSES.has(mapped.status))
+                        cache.setNegative(hash, mapped);
+                    throw mapped;
+                }
+                throw error;
+            }
+            const authenticated = mint(identity);
+            cache.setPositive(hash, identity);
+            return authenticated;
+        },
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLWtleS1hdXRoZW50aWNhdG9yLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FwaS1rZXkvYXBpLWtleS1hdXRoZW50aWNhdG9yLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBa0RBLDRDQTRDQztBQXpGRCwrQ0FBZ0Q7QUFDaEQsdUNBQW9EO0FBQ3BELHFEQUFzRDtBQUN0RCxtREFLeUI7QUFFekIsTUFBTSwrQkFBK0IsR0FBRyxDQUFDLENBQUM7QUFDMUMsTUFBTSx1QkFBdUIsR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO0FBaUJwRCxTQUFTLGVBQWUsQ0FBQyxLQUF5QjtJQUNoRCxJQUFJLEtBQUssQ0FBQyxXQUFXO1FBQUUsT0FBTyxJQUFBLHdDQUF3QixFQUFDLCtCQUErQixDQUFDLENBQUM7SUFFeEYsUUFBUSxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDckIsS0FBSyxHQUFHO1lBQ04sT0FBTyxJQUFBLDZCQUFhLEdBQUUsQ0FBQztRQUN6QixLQUFLLEdBQUc7WUFDTixPQUFPLElBQUEsd0NBQXdCLEdBQUUsQ0FBQztRQUNwQyxLQUFLLEdBQUc7WUFDTixPQUFPLElBQUEsOEJBQWMsR0FBRSxDQUFDO1FBQzFCLEtBQUssR0FBRztZQUNOLE9BQU8sSUFBQSx3Q0FBd0IsRUFBQyxLQUFLLENBQUMsVUFBVSxJQUFJLCtCQUErQixDQUFDLENBQUM7UUFDdkY7WUFDRSxPQUFPLElBQUEsd0NBQXdCLEVBQUMsK0JBQStCLENBQUMsQ0FBQztJQUNyRSxDQUFDO0FBQ0gsQ0FBQztBQUVELFNBQXdCLHlCQUF5QixDQUFDLEVBQ2hELE1BQU0sRUFDTixLQUFLLEVBQ0wsVUFBVSxHQUNpQjtJQUMzQixTQUFTLElBQUksQ0FBQyxRQUFnQztRQUM1QyxPQUFPLEVBQUUsVUFBVSxFQUFFLElBQUEsNkJBQWUsRUFBQyxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsQ0FBQyxFQUFFLFFBQVEsRUFBRSxDQUFDO0lBQzdFLENBQUM7SUFFRCxPQUFPO1FBQ0wsS0FBSyxDQUFDLFlBQVksQ0FBQyxNQUFNO1lBQ3ZCLE1BQU0sTUFBTSxHQUFHLElBQUEscUJBQVcsRUFBQyxNQUFNLENBQUMsQ0FBQztZQUVuQyxJQUFJLENBQUMsTUFBTTtnQkFBRSxNQUFNLElBQUEsNkJBQWEsR0FBRSxDQUFDO1lBRW5DLE1BQU0sSUFBSSxHQUFHLElBQUEsb0JBQVUsRUFBQyxNQUFNLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUVyRCxNQUFNLGNBQWMsR0FBRyxLQUFLLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQy9DLElBQUksY0FBYztnQkFBRSxPQUFPLElBQUksQ0FBQyxjQUFjLENBQUMsQ0FBQztZQUVoRCxNQUFNLFdBQVcsR0FBRyxLQUFLLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQzVDLElBQUksV0FBVztnQkFBRSxNQUFNLFdBQVcsQ0FBQztZQUVuQyxJQUFJLFFBQWdDLENBQUM7WUFFckMsSUFBSSxDQUFDO2dCQUNILFFBQVEsR0FBRyxNQUFNLE1BQU0sQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDaEQsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2YsSUFBSSxLQUFLLFlBQVksbUNBQWtCLEVBQUUsQ0FBQztvQkFDeEMsTUFBTSxNQUFNLEdBQUcsZUFBZSxDQUFDLEtBQUssQ0FBQyxDQUFDO29CQUN0QyxJQUFJLHVCQUF1QixDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDO3dCQUFFLEtBQUssQ0FBQyxXQUFXLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDO29CQUVoRixNQUFNLE1BQU0sQ0FBQztnQkFDZixDQUFDO2dCQUVELE1BQU0sS0FBSyxDQUFDO1lBQ2QsQ0FBQztZQUVELE1BQU0sYUFBYSxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUNyQyxLQUFLLENBQUMsV0FBVyxDQUFDLElBQUksRUFBRSxRQUFRLENBQUMsQ0FBQztZQUVsQyxPQUFPLGFBQWEsQ0FBQztRQUN2QixDQUFDO0tBQ0YsQ0FBQztBQUNKLENBQUMifQ==

package/dist/api-key/api-key-client.d.ts

@@ -0,0 +1,37 @@
+export { ApiKeyResolveError } from './api-key-resolve-error';
+export type { ApiKeyResolveErrorParams } from './api-key-resolve-error';
+export interface ApiKeyIdentityUser {
+    id: number;
+    email: string;
+    firstName: string | null;
+    lastName: string | null;
+    team: string;
+    tags: {
+        key: string;
+        value: string;
+    }[];
+    permissionLevel: string;
+}
+export interface ResolvedApiKeyIdentity {
+    user: ApiKeyIdentityUser;
+    renderingId: number;
+    allowedOrigins: string[];
+}
+export interface ApiKeyClientOptions {
+    forestServerUrl: string;
+    envSecret: string;
+}
+export default class ApiKeyClient {
+    private readonly forestServerUrl;
+    private readonly envSecret;
+    constructor({ forestServerUrl, envSecret }: ApiKeyClientOptions);
+    resolveApiKey(parsedKey: {
+        keyId: string;
+        secret: string;
+    }): Promise<ResolvedApiKeyIdentity>;
+    private static isResolvedIdentity;
+    private static isIdentityUser;
+    private static parseRetryAfter;
+    private url;
+}
+//# sourceMappingURL=api-key-client.d.ts.map

package/dist/api-key/api-key-client.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeyResolveError = void 0;
+const api_key_resolve_error_1 = require("./api-key-resolve-error");
+var api_key_resolve_error_2 = require("./api-key-resolve-error");
+Object.defineProperty(exports, "ApiKeyResolveError", { enumerable: true, get: function () { return api_key_resolve_error_2.ApiKeyResolveError; } });
+const DEFAULT_HEADERS = { 'Content-Type': 'application/json' };
+const REQUEST_TIMEOUT_MS = 10000;
+const RESOLVE_PATH = '/liana/v1/bff-api-keys/resolve';
+class ApiKeyClient {
+    constructor({ forestServerUrl, envSecret }) {
+        this.forestServerUrl = forestServerUrl;
+        this.envSecret = envSecret;
+    }
+    async resolveApiKey(parsedKey) {
+        let response;
+        try {
+            response = await fetch(this.url(RESOLVE_PATH), {
+                method: 'POST',
+                headers: { ...DEFAULT_HEADERS, 'forest-secret-key': this.envSecret },
+                body: JSON.stringify({ keyId: parsedKey.keyId, secret: parsedKey.secret }),
+                signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+            });
+        }
+        catch {
+            throw new api_key_resolve_error_1.ApiKeyResolveError({ unreachable: true });
+        }
+        if (!response.ok) {
+            const body = (await response.json().catch(() => ({})));
+            const firstError = body.errors?.[0];
+            throw new api_key_resolve_error_1.ApiKeyResolveError({
+                status: response.status,
+                code: firstError?.meta?.code,
+                name: firstError?.name,
+                retryAfter: ApiKeyClient.parseRetryAfter(response.headers.get('retry-after')),
+            });
+        }
+        let body;
+        try {
+            body = await response.json();
+        }
+        catch {
+            throw new api_key_resolve_error_1.ApiKeyResolveError({ unreachable: true });
+        }
+        // A well-formed HTTP 200 with an incomplete body is an unusable resolution, not a caller
+        // error: surface it as unavailable rather than letting a later `user` deref throw a 500.
+        if (!ApiKeyClient.isResolvedIdentity(body)) {
+            throw new api_key_resolve_error_1.ApiKeyResolveError({ unreachable: true });
+        }
+        return body;
+    }
+    static isResolvedIdentity(body) {
+        if (typeof body !== 'object' || body === null)
+            return false;
+        const candidate = body;
+        return (typeof candidate.renderingId === 'number' &&
+            Array.isArray(candidate.allowedOrigins) &&
+            ApiKeyClient.isIdentityUser(candidate.user));
+    }
+    // Every field the agent-token mint reads must be present, so a partial body fails here
+    // (mapped to unavailable) instead of minting a token with undefined claims later.
+    static isIdentityUser(user) {
+        if (typeof user !== 'object' || user === null)
+            return false;
+        const candidate = user;
+        return (typeof candidate.id === 'number' &&
+            typeof candidate.email === 'string' &&
+            typeof candidate.team === 'string' &&
+            typeof candidate.permissionLevel === 'string' &&
+            Array.isArray(candidate.tags));
+    }
+    // Retry-After may be an HTTP-date rather than delay-seconds; keep only a positive integer so a
+    // date/negative/zero value falls back to the caller's default instead of a useless backoff hint.
+    static parseRetryAfter(header) {
+        if (header === null)
+            return undefined;
+        const seconds = Number(header);
+        return Number.isInteger(seconds) && seconds > 0 ? seconds : undefined;
+    }
+    url(path) {
+        return new URL(path, this.forestServerUrl).toString();
+    }
+}
+exports.default = ApiKeyClient;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLWtleS1jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYXBpLWtleS9hcGkta2V5LWNsaWVudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxtRUFBNkQ7QUFFN0QsaUVBQTZEO0FBQXBELDJIQUFBLGtCQUFrQixPQUFBO0FBd0IzQixNQUFNLGVBQWUsR0FBRyxFQUFFLGNBQWMsRUFBRSxrQkFBa0IsRUFBVyxDQUFDO0FBQ3hFLE1BQU0sa0JBQWtCLEdBQUcsS0FBTSxDQUFDO0FBQ2xDLE1BQU0sWUFBWSxHQUFHLGdDQUFnQyxDQUFDO0FBTXRELE1BQXFCLFlBQVk7SUFJL0IsWUFBWSxFQUFFLGVBQWUsRUFBRSxTQUFTLEVBQXVCO1FBQzdELElBQUksQ0FBQyxlQUFlLEdBQUcsZUFBZSxDQUFDO1FBQ3ZDLElBQUksQ0FBQyxTQUFTLEdBQUcsU0FBUyxDQUFDO0lBQzdCLENBQUM7SUFFRCxLQUFLLENBQUMsYUFBYSxDQUFDLFNBR25CO1FBQ0MsSUFBSSxRQUFrQixDQUFDO1FBRXZCLElBQUksQ0FBQztZQUNILFFBQVEsR0FBRyxNQUFNLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLFlBQVksQ0FBQyxFQUFFO2dCQUM3QyxNQUFNLEVBQUUsTUFBTTtnQkFDZCxPQUFPLEVBQUUsRUFBRSxHQUFHLGVBQWUsRUFBRSxtQkFBbUIsRUFBRSxJQUFJLENBQUMsU0FBUyxFQUFFO2dCQUNwRSxJQUFJLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLEtBQUssRUFBRSxTQUFTLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxTQUFTLENBQUMsTUFBTSxFQUFFLENBQUM7Z0JBQzFFLE1BQU0sRUFBRSxXQUFXLENBQUMsT0FBTyxDQUFDLGtCQUFrQixDQUFDO2FBQ2hELENBQUMsQ0FBQztRQUNMLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxNQUFNLElBQUksMENBQWtCLENBQUMsRUFBRSxXQUFXLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUN0RCxDQUFDO1FBRUQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUNqQixNQUFNLElBQUksR0FBRyxDQUFDLE1BQU0sUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQWtCLENBQUM7WUFDeEUsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBRXBDLE1BQU0sSUFBSSwwQ0FBa0IsQ0FBQztnQkFDM0IsTUFBTSxFQUFFLFFBQVEsQ0FBQyxNQUFNO2dCQUN2QixJQUFJLEVBQUUsVUFBVSxFQUFFLElBQUksRUFBRSxJQUFJO2dCQUM1QixJQUFJLEVBQUUsVUFBVSxFQUFFLElBQUk7Z0JBQ3RCLFVBQVUsRUFBRSxZQUFZLENBQUMsZUFBZSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQyxDQUFDO2FBQzlFLENBQUMsQ0FBQztRQUNMLENBQUM7UUFFRCxJQUFJLElBQWEsQ0FBQztRQUVsQixJQUFJLENBQUM7WUFDSCxJQUFJLEdBQUcsTUFBTSxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDL0IsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE1BQU0sSUFBSSwwQ0FBa0IsQ0FBQyxFQUFFLFdBQVcsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ3RELENBQUM7UUFFRCx5RkFBeUY7UUFDekYseUZBQXlGO1FBQ3pGLElBQUksQ0FBQyxZQUFZLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUMzQyxNQUFNLElBQUksMENBQWtCLENBQUMsRUFBRSxXQUFXLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUN0RCxDQUFDO1FBRUQsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRU8sTUFBTSxDQUFDLGtCQUFrQixDQUFDLElBQWE7UUFDN0MsSUFBSSxPQUFPLElBQUksS0FBSyxRQUFRLElBQUksSUFBSSxLQUFLLElBQUk7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUU1RCxNQUFNLFNBQVMsR0FBRyxJQUEyRSxDQUFDO1FBRTlGLE9BQU8sQ0FDTCxPQUFPLFNBQVMsQ0FBQyxXQUFXLEtBQUssUUFBUTtZQUN6QyxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxjQUFjLENBQUM7WUFDdkMsWUFBWSxDQUFDLGNBQWMsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLENBQzVDLENBQUM7SUFDSixDQUFDO0lBRUQsdUZBQXVGO0lBQ3ZGLGtGQUFrRjtJQUMxRSxNQUFNLENBQUMsY0FBYyxDQUFDLElBQWE7UUFDekMsSUFBSSxPQUFPLElBQUksS0FBSyxRQUFRLElBQUksSUFBSSxLQUFLLElBQUk7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUU1RCxNQUFNLFNBQVMsR0FBRyxJQUErQixDQUFDO1FBRWxELE9BQU8sQ0FDTCxPQUFPLFNBQVMsQ0FBQyxFQUFFLEtBQUssUUFBUTtZQUNoQyxPQUFPLFNBQVMsQ0FBQyxLQUFLLEtBQUssUUFBUTtZQUNuQyxPQUFPLFNBQVMsQ0FBQyxJQUFJLEtBQUssUUFBUTtZQUNsQyxPQUFPLFNBQVMsQ0FBQyxlQUFlLEtBQUssUUFBUTtZQUM3QyxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FDOUIsQ0FBQztJQUNKLENBQUM7SUFFRCwrRkFBK0Y7SUFDL0YsaUdBQWlHO0lBQ3pGLE1BQU0sQ0FBQyxlQUFlLENBQUMsTUFBcUI7UUFDbEQsSUFBSSxNQUFNLEtBQUssSUFBSTtZQUFFLE9BQU8sU0FBUyxDQUFDO1FBRXRDLE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUUvQixPQUFPLE1BQU0sQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLElBQUksT0FBTyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDeEUsQ0FBQztJQUVPLEdBQUcsQ0FBQyxJQUFZO1FBQ3RCLE9BQU8sSUFBSSxHQUFHLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxlQUFlLENBQUMsQ0FBQyxRQUFRLEVBQUUsQ0FBQztJQUN4RCxDQUFDO0NBQ0Y7QUFoR0QsK0JBZ0dDIn0=

package/dist/api-key/api-key-error.d.ts

@@ -0,0 +1,20 @@
+export type ApiKeyErrorType = 'invalid_api_key' | 'forest_identity_not_allowed' | 'invalid_request' | 'key_resolution_unavailable';
+export declare class ApiKeyError extends Error {
+    readonly status: number;
+    readonly type: ApiKeyErrorType;
+    readonly retryAfter?: number;
+    constructor(status: number, type: ApiKeyErrorType, message: string, retryAfter?: number);
+}
+export interface ApiKeyErrorBody {
+    error: {
+        type: ApiKeyErrorType;
+        status: number;
+        message: string;
+    };
+}
+export declare function toErrorBody(error: ApiKeyError): ApiKeyErrorBody;
+export declare function invalidApiKey(message?: string): ApiKeyError;
+export declare function forestIdentityNotAllowed(message?: string): ApiKeyError;
+export declare function invalidRequest(message?: string): ApiKeyError;
+export declare function keyResolutionUnavailable(retryAfter: number, message?: string): ApiKeyError;
+//# sourceMappingURL=api-key-error.d.ts.map

package/dist/api-key/api-key-error.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeyError = void 0;
+exports.toErrorBody = toErrorBody;
+exports.invalidApiKey = invalidApiKey;
+exports.forestIdentityNotAllowed = forestIdentityNotAllowed;
+exports.invalidRequest = invalidRequest;
+exports.keyResolutionUnavailable = keyResolutionUnavailable;
+class ApiKeyError extends Error {
+    constructor(status, type, message, retryAfter) {
+        super(message);
+        this.name = 'ApiKeyError';
+        this.status = status;
+        this.type = type;
+        this.retryAfter = retryAfter;
+    }
+}
+exports.ApiKeyError = ApiKeyError;
+function toErrorBody(error) {
+    return { error: { type: error.type, status: error.status, message: error.message } };
+}
+function invalidApiKey(message = 'Invalid API key') {
+    return new ApiKeyError(401, 'invalid_api_key', message);
+}
+function forestIdentityNotAllowed(message = 'Forest identity not allowed') {
+    return new ApiKeyError(403, 'forest_identity_not_allowed', message);
+}
+function invalidRequest(message = 'Invalid request') {
+    return new ApiKeyError(400, 'invalid_request', message);
+}
+function keyResolutionUnavailable(retryAfter, message = 'Key resolution unavailable') {
+    return new ApiKeyError(503, 'key_resolution_unavailable', message, retryAfter);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLWtleS1lcnJvci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9hcGkta2V5L2FwaS1rZXktZXJyb3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBNEJBLGtDQUVDO0FBRUQsc0NBRUM7QUFFRCw0REFFQztBQUVELHdDQUVDO0FBRUQsNERBS0M7QUEzQ0QsTUFBYSxXQUFZLFNBQVEsS0FBSztJQUtwQyxZQUFZLE1BQWMsRUFBRSxJQUFxQixFQUFFLE9BQWUsRUFBRSxVQUFtQjtRQUNyRixLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDZixJQUFJLENBQUMsSUFBSSxHQUFHLGFBQWEsQ0FBQztRQUMxQixJQUFJLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQztRQUNyQixJQUFJLENBQUMsSUFBSSxHQUFHLElBQUksQ0FBQztRQUNqQixJQUFJLENBQUMsVUFBVSxHQUFHLFVBQVUsQ0FBQztJQUMvQixDQUFDO0NBQ0Y7QUFaRCxrQ0FZQztBQVVELFNBQWdCLFdBQVcsQ0FBQyxLQUFrQjtJQUM1QyxPQUFPLEVBQUUsS0FBSyxFQUFFLEVBQUUsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsT0FBTyxFQUFFLEtBQUssQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO0FBQ3ZGLENBQUM7QUFFRCxTQUFnQixhQUFhLENBQUMsT0FBTyxHQUFHLGlCQUFpQjtJQUN2RCxPQUFPLElBQUksV0FBVyxDQUFDLEdBQUcsRUFBRSxpQkFBaUIsRUFBRSxPQUFPLENBQUMsQ0FBQztBQUMxRCxDQUFDO0FBRUQsU0FBZ0Isd0JBQXdCLENBQUMsT0FBTyxHQUFHLDZCQUE2QjtJQUM5RSxPQUFPLElBQUksV0FBVyxDQUFDLEdBQUcsRUFBRSw2QkFBNkIsRUFBRSxPQUFPLENBQUMsQ0FBQztBQUN0RSxDQUFDO0FBRUQsU0FBZ0IsY0FBYyxDQUFDLE9BQU8sR0FBRyxpQkFBaUI7SUFDeEQsT0FBTyxJQUFJLFdBQVcsQ0FBQyxHQUFHLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxDQUFDLENBQUM7QUFDMUQsQ0FBQztBQUVELFNBQWdCLHdCQUF3QixDQUN0QyxVQUFrQixFQUNsQixPQUFPLEdBQUcsNEJBQTRCO0lBRXRDLE9BQU8sSUFBSSxXQUFXLENBQUMsR0FBRyxFQUFFLDRCQUE0QixFQUFFLE9BQU8sRUFBRSxVQUFVLENBQUMsQ0FBQztBQUNqRixDQUFDIn0=

package/dist/api-key/api-key-middleware.d.ts

@@ -0,0 +1,10 @@
+import type { ApiKeyAuthenticator } from './api-key-authenticator';
+import type { Logger } from '../ports/logger-port';
+import type { Middleware } from 'koa';
+export declare const BFF_KEY_HEADER = "X-Forest-Bff-Key";
+export interface ApiKeyMiddlewareOptions {
+    authenticator: ApiKeyAuthenticator;
+    logger: Logger;
+}
+export default function createApiKeyMiddleware({ authenticator, logger, }: ApiKeyMiddlewareOptions): Middleware;
+//# sourceMappingURL=api-key-middleware.d.ts.map

package/dist/api-key/api-key-middleware.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BFF_KEY_HEADER = void 0;
+exports.default = createApiKeyMiddleware;
+const api_key_1 = require("./api-key");
+const api_key_error_1 = require("./api-key-error");
+exports.BFF_KEY_HEADER = 'X-Forest-Bff-Key';
+// On authentication failure this middleware rethrows `ApiKeyError` rather than
+// writing the response itself; it must be mounted behind an error middleware
+// that serializes the structured body (see `createErrorMiddleware`).
+function createApiKeyMiddleware({ authenticator, logger, }) {
+    return async function apiKeyMiddleware(ctx, next) {
+        const rawKey = ctx.get(exports.BFF_KEY_HEADER);
+        if (!rawKey) {
+            await next();
+            return;
+        }
+        let authenticated;
+        try {
+            authenticated = await authenticator.authenticate(rawKey);
+        }
+        catch (error) {
+            if (error instanceof api_key_error_1.ApiKeyError) {
+                logger('Warn', 'BFF API key rejected', {
+                    keyHash: (0, api_key_1.fingerprintApiKey)(rawKey),
+                    type: error.type,
+                });
+            }
+            else {
+                logger('Error', 'BFF API key middleware failure', {
+                    keyHash: (0, api_key_1.fingerprintApiKey)(rawKey),
+                    cause: error instanceof Error ? `${error.name}: ${error.message}` : String(error),
+                });
+            }
+            throw error;
+        }
+        ctx.state.agentToken = authenticated.agentToken;
+        ctx.state.apiKeyIdentity = authenticated.identity;
+        ctx.set('Cache-Control', 'no-store');
+        logger('Info', 'Resolved BFF API key', {
+            keyHash: (0, api_key_1.fingerprintApiKey)(rawKey),
+            renderingId: authenticated.identity.renderingId,
+        });
+        await next();
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLWtleS1taWRkbGV3YXJlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FwaS1rZXkvYXBpLWtleS1taWRkbGV3YXJlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQWlCQSx5Q0EyQ0M7QUF4REQsdUNBQThDO0FBQzlDLG1EQUE4QztBQUVqQyxRQUFBLGNBQWMsR0FBRyxrQkFBa0IsQ0FBQztBQU9qRCwrRUFBK0U7QUFDL0UsNkVBQTZFO0FBQzdFLHFFQUFxRTtBQUNyRSxTQUF3QixzQkFBc0IsQ0FBQyxFQUM3QyxhQUFhLEVBQ2IsTUFBTSxHQUNrQjtJQUN4QixPQUFPLEtBQUssVUFBVSxnQkFBZ0IsQ0FBQyxHQUFHLEVBQUUsSUFBSTtRQUM5QyxNQUFNLE1BQU0sR0FBRyxHQUFHLENBQUMsR0FBRyxDQUFDLHNCQUFjLENBQUMsQ0FBQztRQUV2QyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDWixNQUFNLElBQUksRUFBRSxDQUFDO1lBRWIsT0FBTztRQUNULENBQUM7UUFFRCxJQUFJLGFBQWtDLENBQUM7UUFFdkMsSUFBSSxDQUFDO1lBQ0gsYUFBYSxHQUFHLE1BQU0sYUFBYSxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMzRCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLElBQUksS0FBSyxZQUFZLDJCQUFXLEVBQUUsQ0FBQztnQkFDakMsTUFBTSxDQUFDLE1BQU0sRUFBRSxzQkFBc0IsRUFBRTtvQkFDckMsT0FBTyxFQUFFLElBQUEsMkJBQWlCLEVBQUMsTUFBTSxDQUFDO29CQUNsQyxJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUk7aUJBQ2pCLENBQUMsQ0FBQztZQUNMLENBQUM7aUJBQU0sQ0FBQztnQkFDTixNQUFNLENBQUMsT0FBTyxFQUFFLGdDQUFnQyxFQUFFO29CQUNoRCxPQUFPLEVBQUUsSUFBQSwyQkFBaUIsRUFBQyxNQUFNLENBQUM7b0JBQ2xDLEtBQUssRUFBRSxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxHQUFHLEtBQUssQ0FBQyxJQUFJLEtBQUssS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO2lCQUNsRixDQUFDLENBQUM7WUFDTCxDQUFDO1lBRUQsTUFBTSxLQUFLLENBQUM7UUFDZCxDQUFDO1FBRUQsR0FBRyxDQUFDLEtBQUssQ0FBQyxVQUFVLEdBQUcsYUFBYSxDQUFDLFVBQVUsQ0FBQztRQUNoRCxHQUFHLENBQUMsS0FBSyxDQUFDLGNBQWMsR0FBRyxhQUFhLENBQUMsUUFBUSxDQUFDO1FBQ2xELEdBQUcsQ0FBQyxHQUFHLENBQUMsZUFBZSxFQUFFLFVBQVUsQ0FBQyxDQUFDO1FBQ3JDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsc0JBQXNCLEVBQUU7WUFDckMsT0FBTyxFQUFFLElBQUEsMkJBQWlCLEVBQUMsTUFBTSxDQUFDO1lBQ2xDLFdBQVcsRUFBRSxhQUFhLENBQUMsUUFBUSxDQUFDLFdBQVc7U0FDaEQsQ0FBQyxDQUFDO1FBRUgsTUFBTSxJQUFJLEVBQUUsQ0FBQztJQUNmLENBQUMsQ0FBQztBQUNKLENBQUMifQ==

package/dist/api-key/api-key-resolve-error.d.ts

@@ -0,0 +1,16 @@
+export interface ApiKeyResolveErrorParams {
+    status?: number;
+    code?: string;
+    name?: string;
+    retryAfter?: number;
+    unreachable?: boolean;
+}
+export declare class ApiKeyResolveError extends Error {
+    readonly status?: number;
+    readonly code?: string;
+    readonly saasName?: string;
+    readonly retryAfter?: number;
+    readonly unreachable: boolean;
+    constructor(params: ApiKeyResolveErrorParams);
+}
+//# sourceMappingURL=api-key-resolve-error.d.ts.map

package/dist/api-key/api-key-resolve-error.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeyResolveError = void 0;
+class ApiKeyResolveError extends Error {
+    constructor(params) {
+        super(`BFF API key resolve failed${params.status ? ` (${params.status})` : ''}`);
+        this.name = 'ApiKeyResolveError';
+        this.status = params.status;
+        this.code = params.code;
+        this.saasName = params.name;
+        this.retryAfter = params.retryAfter;
+        this.unreachable = params.unreachable ?? false;
+    }
+}
+exports.ApiKeyResolveError = ApiKeyResolveError;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLWtleS1yZXNvbHZlLWVycm9yLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FwaS1rZXkvYXBpLWtleS1yZXNvbHZlLWVycm9yLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQVFBLE1BQWEsa0JBQW1CLFNBQVEsS0FBSztJQU8zQyxZQUFZLE1BQWdDO1FBQzFDLEtBQUssQ0FBQyw2QkFBNkIsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsS0FBSyxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDakYsSUFBSSxDQUFDLElBQUksR0FBRyxvQkFBb0IsQ0FBQztRQUNqQyxJQUFJLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7UUFDNUIsSUFBSSxDQUFDLElBQUksR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDO1FBQ3hCLElBQUksQ0FBQyxRQUFRLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQztRQUM1QixJQUFJLENBQUMsVUFBVSxHQUFHLE1BQU0sQ0FBQyxVQUFVLENBQUM7UUFDcEMsSUFBSSxDQUFDLFdBQVcsR0FBRyxNQUFNLENBQUMsV0FBVyxJQUFJLEtBQUssQ0FBQztJQUNqRCxDQUFDO0NBQ0Y7QUFoQkQsZ0RBZ0JDIn0=

package/dist/api-key/api-key.d.ts

@@ -0,0 +1,8 @@
+export interface ParsedApiKey {
+    keyId: string;
+    secret: string;
+}
+export declare function parseApiKey(raw: string): ParsedApiKey | null;
+export declare function hashApiKey(keyId: string, secret: string): string;
+export declare function fingerprintApiKey(raw: string): string;
+//# sourceMappingURL=api-key.d.ts.map

package/dist/api-key/api-key.js

@@ -0,0 +1,23 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseApiKey = parseApiKey;
+exports.hashApiKey = hashApiKey;
+exports.fingerprintApiKey = fingerprintApiKey;
+const crypto_1 = __importDefault(require("crypto"));
+const API_KEY_PATTERN = /^fbff_([0-9a-f]{16})_([0-9a-f]{64})$/;
+function parseApiKey(raw) {
+    const match = API_KEY_PATTERN.exec(raw);
+    if (!match)
+        return null;
+    return { keyId: match[1], secret: match[2] };
+}
+function hashApiKey(keyId, secret) {
+    return crypto_1.default.createHash('sha256').update(`${keyId}:${secret}`).digest('hex');
+}
+function fingerprintApiKey(raw) {
+    return crypto_1.default.createHash('sha256').update(raw).digest('hex').slice(0, 12);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLWtleS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9hcGkta2V5L2FwaS1rZXkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFTQSxrQ0FNQztBQUVELGdDQUVDO0FBRUQsOENBRUM7QUF2QkQsb0RBQTRCO0FBRTVCLE1BQU0sZUFBZSxHQUFHLHNDQUFzQyxDQUFDO0FBTy9ELFNBQWdCLFdBQVcsQ0FBQyxHQUFXO0lBQ3JDLE1BQU0sS0FBSyxHQUFHLGVBQWUsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7SUFFeEMsSUFBSSxDQUFDLEtBQUs7UUFBRSxPQUFPLElBQUksQ0FBQztJQUV4QixPQUFPLEVBQUUsS0FBSyxFQUFFLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7QUFDL0MsQ0FBQztBQUVELFNBQWdCLFVBQVUsQ0FBQyxLQUFhLEVBQUUsTUFBYztJQUN0RCxPQUFPLGdCQUFNLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxHQUFHLEtBQUssSUFBSSxNQUFNLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUNoRixDQUFDO0FBRUQsU0FBZ0IsaUJBQWlCLENBQUMsR0FBVztJQUMzQyxPQUFPLGdCQUFNLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQztBQUM1RSxDQUFDIn0=

package/dist/api-key/resolve-cache.d.ts

@@ -0,0 +1,17 @@
+import type { ResolvedApiKeyIdentity } from './api-key-client';
+import type { ApiKeyError } from './api-key-error';
+export interface ResolveCache {
+    getPositive(hash: string): ResolvedApiKeyIdentity | undefined;
+    getNegative(hash: string): ApiKeyError | undefined;
+    setPositive(hash: string, identity: ResolvedApiKeyIdentity): void;
+    setNegative(hash: string, error: ApiKeyError): void;
+    size(): number;
+}
+export interface ResolveCacheOptions {
+    now: () => number;
+    positiveTtlSeconds?: number;
+    negativeTtlSeconds?: number;
+    maxEntries?: number;
+}
+export default function createResolveCache({ now, positiveTtlSeconds, negativeTtlSeconds, maxEntries, }: ResolveCacheOptions): ResolveCache;
+//# sourceMappingURL=resolve-cache.d.ts.map