@forestadmin/agent-bff 1.25.4 → 1.26.0

package/dist/build-bff.js

@@ -0,0 +1,372 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveOAuthConfig = resolveOAuthConfig;
+exports.resolveUnfoldSource = resolveUnfoldSource;
+exports.default = buildBff;
+const bodyparser_1 = require("@koa/bodyparser");
+const koa_1 = __importDefault(require("koa"));
+const action_routes_middleware_1 = __importDefault(require("./action/action-routes-middleware"));
+const console_logger_1 = __importDefault(require("./adapters/console-logger"));
+const agent_stub_1 = __importDefault(require("./agent/agent-stub"));
+const agent_transport_1 = require("./agent/agent-transport");
+const ai_proxy_client_1 = __importDefault(require("./ai/ai-proxy-client"));
+const ai_routes_middleware_1 = __importStar(require("./ai/ai-routes-middleware"));
+const api_key_authenticator_1 = __importDefault(require("./api-key/api-key-authenticator"));
+const api_key_client_1 = __importDefault(require("./api-key/api-key-client"));
+const api_key_middleware_1 = __importDefault(require("./api-key/api-key-middleware"));
+const resolve_cache_1 = __importDefault(require("./api-key/resolve-cache"));
+const auth_mode_middleware_1 = __importDefault(require("./auth/auth-mode-middleware"));
+const missing_config_warning_1 = __importDefault(require("./config/missing-config-warning"));
+const context_routes_middleware_1 = __importDefault(require("./context/context-routes-middleware"));
+const cors_middleware_1 = __importDefault(require("./cors/cors-middleware"));
+const per_key_origin_1 = __importDefault(require("./cors/per-key-origin"));
+const data_routes_middleware_1 = __importDefault(require("./data/data-routes-middleware"));
+const docs_routes_1 = __importDefault(require("./docs/docs-routes"));
+const bff_http_error_1 = require("./http/bff-http-error");
+const body_limit_1 = __importStar(require("./http/body-limit"));
+const error_middleware_1 = __importDefault(require("./http/error-middleware"));
+const health_route_1 = __importDefault(require("./http/health-route"));
+const version_header_middleware_1 = __importDefault(require("./http/version-header-middleware"));
+const environment_id_1 = __importStar(require("./oauth/environment-id"));
+const forest_server_client_1 = __importDefault(require("./oauth/forest-server-client"));
+const oauth_routes_1 = __importDefault(require("./oauth/oauth-routes"));
+const session_store_1 = __importDefault(require("./oauth/session-store"));
+const token_cipher_1 = __importDefault(require("./oauth/token-cipher"));
+const openapi_routes_1 = __importStar(require("./openapi/openapi-routes"));
+const permissions_cache_1 = __importDefault(require("./permissions/permissions-cache"));
+const permissions_client_1 = __importDefault(require("./permissions/permissions-client"));
+const permissions_routes_middleware_1 = __importDefault(require("./permissions/permissions-routes-middleware"));
+const agent_path_1 = __importDefault(require("./rate-limit/agent-path"));
+const rate_limit_middleware_1 = __importDefault(require("./rate-limit/rate-limit-middleware"));
+const create_read_model_1 = __importDefault(require("./read-model/create-read-model"));
+const timezone_middleware_1 = __importDefault(require("./timezone/timezone-middleware"));
+const version_1 = __importDefault(require("./version"));
+const SESSION_TTL_SECONDS = 24 * 60 * 60;
+const BODY_METHODS = new Set(['POST', 'PUT', 'PATCH']);
+const JSON_BODY_TYPES = ['application/json', 'application/*+json'];
+function hasBody(ctx) {
+    return (ctx.request.length ?? 0) > 0 || ctx.get('transfer-encoding') !== '';
+}
+function createJsonOnlyGuard() {
+    return async function jsonOnlyGuard(ctx, next) {
+        if (BODY_METHODS.has(ctx.method) && hasBody(ctx) && !ctx.is(JSON_BODY_TYPES)) {
+            throw (0, bff_http_error_1.unsupportedMediaType)();
+        }
+        await next();
+    };
+}
+function agentScoped(middleware) {
+    return async function scoped(ctx, next) {
+        if (!(0, agent_path_1.default)(ctx.path)) {
+            await next();
+            return;
+        }
+        await middleware(ctx, next);
+    };
+}
+function createBodyParser(hasAiQueryRoute) {
+    const extendTypes = { json: JSON_BODY_TYPES };
+    const parseBody = (0, bodyparser_1.bodyParser)({ jsonLimit: body_limit_1.default, extendTypes });
+    if (!hasAiQueryRoute)
+        return parseBody;
+    const parseAiBody = (0, bodyparser_1.bodyParser)({
+        jsonLimit: body_limit_1.AI_BODY_LIMIT,
+        enableTypes: ['json'],
+        extendTypes,
+    });
+    return async function selectedBodyParser(ctx, next) {
+        if (ctx.path === ai_routes_middleware_1.AI_QUERY_ROUTE) {
+            await parseAiBody(ctx, next);
+            return;
+        }
+        await parseBody(ctx, next);
+    };
+}
+function createApiKeyUnavailableGuard(logger) {
+    return async function apiKeyUnavailableGuard(ctx, next) {
+        if (ctx.state.authMode === 'api-key') {
+            logger('Error', 'API key auth requested but the resolver is not configured');
+            throw (0, bff_http_error_1.unauthorized)('Credentials could not be validated');
+        }
+        await next();
+    };
+}
+function resolveOAuthConfig(config) {
+    const { forestServerUrl, forestEnvSecret, forestAppUrl, forestAuthSecret, tokenEncryptionKey } = config;
+    if (forestServerUrl &&
+        forestEnvSecret &&
+        forestAppUrl &&
+        forestAuthSecret &&
+        tokenEncryptionKey) {
+        return { forestServerUrl, forestEnvSecret, forestAppUrl, forestAuthSecret, tokenEncryptionKey };
+    }
+    return undefined;
+}
+function buildOAuthMiddlewares(config, logger) {
+    const oauthConfig = resolveOAuthConfig(config);
+    if (!oauthConfig) {
+        logger('Warn', 'OAuth routes disabled: required configuration is missing');
+        return { middlewares: [] };
+    }
+    const { forestServerUrl, forestEnvSecret, forestAppUrl, forestAuthSecret, tokenEncryptionKey } = oauthConfig;
+    const serverClient = new forest_server_client_1.default({ forestServerUrl, envSecret: forestEnvSecret });
+    const resolveEnvironmentId = (0, environment_id_1.default)(serverClient);
+    const sessionStore = (0, session_store_1.default)({
+        cipher: (0, token_cipher_1.default)(tokenEncryptionKey),
+        now: () => Date.now(),
+        sessionTtlSeconds: SESSION_TTL_SECONDS,
+    });
+    const oauthRoutes = (0, oauth_routes_1.default)({
+        serverClient,
+        sessionStore,
+        forestAppUrl,
+        authSecret: forestAuthSecret,
+        resolveEnvironmentId,
+        logger,
+    });
+    return {
+        middlewares: [oauthRoutes],
+        resolveEnvironmentId,
+        session: { store: sessionStore, serverClient, forestServerUrl },
+    };
+}
+function resolveApiKeyConfig(config) {
+    const { forestServerUrl, forestEnvSecret, forestAuthSecret } = config;
+    if (forestServerUrl && forestEnvSecret && forestAuthSecret) {
+        return { forestServerUrl, forestEnvSecret, forestAuthSecret };
+    }
+    return undefined;
+}
+function buildApiKeyMiddleware(config, logger) {
+    const apiKeyConfig = resolveApiKeyConfig(config);
+    if (!apiKeyConfig) {
+        logger('Warn', 'API key auth disabled: required configuration is missing');
+        return undefined;
+    }
+    const client = new api_key_client_1.default({
+        forestServerUrl: apiKeyConfig.forestServerUrl,
+        envSecret: apiKeyConfig.forestEnvSecret,
+    });
+    const cache = (0, resolve_cache_1.default)({ now: () => Date.now() });
+    const authenticator = (0, api_key_authenticator_1.default)({
+        client,
+        cache,
+        authSecret: apiKeyConfig.forestAuthSecret,
+    });
+    return (0, api_key_middleware_1.default)({ authenticator, logger });
+}
+/**
+ * The read-model store the data routes, the action routes, the permissions endpoint and the OpenAPI
+ * unfolding all share — one cache, one schema fetch. Needs no agent: the permissions endpoint and the
+ * schema itself come from the SaaS.
+ */
+function resolveReadModelBundle(config, logger, metrics) {
+    const apiKeyConfig = resolveApiKeyConfig(config);
+    if (!apiKeyConfig)
+        return undefined;
+    const { store } = (0, create_read_model_1.default)({
+        forestServerUrl: apiKeyConfig.forestServerUrl,
+        envSecret: apiKeyConfig.forestEnvSecret,
+        logger,
+        metrics,
+    });
+    return { store, apiKeyConfig };
+}
+/**
+ * When unfolding is possible, in ONE place: the document needs the AGENT_URL the store does not,
+ * because a collection's field set comes from the agent capabilities. The server passes the bundle it
+ * already built for the data routes; the CLI goes through `resolveUnfoldSource`. Silent on purpose —
+ * the two report a missing configuration differently.
+ */
+function toUnfoldSource(bundle, config, logger) {
+    if (!bundle || !config.agentUrl)
+        return undefined;
+    return {
+        store: bundle.store,
+        transport: (0, agent_transport_1.createHttpTransport)({
+            agentUrl: config.agentUrl,
+            timeoutMs: config.agentTimeoutMs,
+        }),
+        logger,
+    };
+}
+/**
+ * Metrics are dropped rather than logged: without an explicit sink `createReadModel` builds a console
+ * one, which reports gauges at `Info`, and `createConsoleLogger` sends `Info` to `console.info` — the
+ * stdout the document is written to. The server keeps its metrics; the export has no sink for them
+ * anyway.
+ */
+const UNMEASURED = { increment: () => undefined, gauge: () => undefined };
+function resolveUnfoldSource(config, logger) {
+    return toUnfoldSource(resolveReadModelBundle(config, logger, UNMEASURED), config, logger);
+}
+// The data middleware falls through to the action middleware on a non-data path.
+function buildAgentRouteMiddlewares(bundle, config, logger) {
+    if (!bundle) {
+        logger('Warn', 'Data, action and permissions endpoints disabled: FOREST_SERVER_URL, FOREST_ENV_SECRET or FOREST_AUTH_SECRET is missing');
+        return [(0, agent_stub_1.default)()];
+    }
+    const { store, apiKeyConfig } = bundle;
+    const { agentUrl, agentTimeoutMs: timeoutMs } = config;
+    const permissionsMiddleware = (0, permissions_routes_middleware_1.default)({
+        store,
+        client: new permissions_client_1.default({
+            forestServerUrl: apiKeyConfig.forestServerUrl,
+            envSecret: apiKeyConfig.forestEnvSecret,
+        }),
+        cache: new permissions_cache_1.default(),
+        logger,
+    });
+    if (!agentUrl) {
+        logger('Warn', 'Data and action endpoints disabled: AGENT_URL is missing');
+        return [permissionsMiddleware, (0, agent_stub_1.default)()];
+    }
+    const transport = (0, agent_transport_1.createHttpTransport)({ agentUrl, timeoutMs });
+    return [
+        permissionsMiddleware,
+        (0, data_routes_middleware_1.default)({ store, transport, logger }),
+        (0, action_routes_middleware_1.default)({ store, transport, logger }),
+    ];
+}
+function buildAiMiddlewares(config, oauth, logger) {
+    const { session, resolveEnvironmentId } = oauth;
+    if (!session) {
+        logger('Warn', 'AI query route disabled: the deployment carries no OAuth session');
+        return [];
+    }
+    const client = new ai_proxy_client_1.default({
+        forestServerUrl: session.forestServerUrl,
+        timeoutMs: config.aiTimeoutMs,
+    });
+    return [
+        (0, ai_routes_middleware_1.default)({
+            client,
+            sessionStore: session.store,
+            serverClient: session.serverClient,
+            resolveEnvironmentId,
+            logger,
+        }),
+    ];
+}
+function buildAgentMiddlewares(config, logger, oauth, aiMiddlewares) {
+    const { forestAuthSecret, defaultTimezone } = config;
+    if (!forestAuthSecret) {
+        logger('Warn', 'Agent edge disabled: FOREST_AUTH_SECRET is missing');
+        return [];
+    }
+    const apiKeyStep = buildApiKeyMiddleware(config, logger) ?? createApiKeyUnavailableGuard(logger);
+    // One store for the whole edge. The document only unfolds when the agent is reachable too: with no
+    // AGENT_URL every data path answers 501, so concrete paths would advertise a dead surface.
+    const bundle = resolveReadModelBundle(config, logger);
+    const source = toUnfoldSource(bundle, config, logger);
+    const chain = [
+        (0, auth_mode_middleware_1.default)({ authSecret: forestAuthSecret }),
+        apiKeyStep,
+        (0, rate_limit_middleware_1.default)({
+            maxRequests: config.rateLimitMaxRequests,
+            windowMs: config.rateLimitWindowMs,
+        }),
+        (0, per_key_origin_1.default)({ logger, serverAllowedOrigins: config.allowedOrigins }),
+        (0, openapi_routes_1.default)({
+            version: version_1.default,
+            enabled: config.openapiEnabled,
+            source,
+            hasAiQueryRoute: aiMiddlewares.length > 0,
+            publicUrl: config.publicUrl,
+        }),
+        ...(bundle
+            ? [
+                (0, context_routes_middleware_1.default)({
+                    store: bundle.store,
+                    resolveEnvironmentId: oauth.resolveEnvironmentId
+                        ? (0, environment_id_1.tolerateEnvironmentIdFailure)(oauth.resolveEnvironmentId, logger)
+                        : undefined,
+                }),
+            ]
+            : []),
+        ...aiMiddlewares,
+        (0, timezone_middleware_1.default)({ defaultTimezone }),
+        ...buildAgentRouteMiddlewares(bundle, config, logger),
+    ];
+    return chain.map(agentScoped);
+}
+/**
+ * Assemble the whole BFF — `/health`, the version header, and every middleware in the one order both
+ * deployment modes must share — and hand back the request handler. `runCli` puts it behind a
+ * listener; an embedding host mounts it at the root of its own server. The handler is terminal — it
+ * answers 404 itself instead of yielding to a host `next()` — and every path it serves is absolute,
+ * so a prefix mount would move `/health` and `/agent/...` off the paths the frontend calls.
+ */
+async function buildBff({ config, logger = (0, console_logger_1.default)(), }) {
+    if (config.invalidAllowedOrigins.length > 0) {
+        logger('Warn', 'Ignoring malformed BFF_ALLOWED_ORIGINS entries', {
+            entries: config.invalidAllowedOrigins,
+        });
+    }
+    (0, missing_config_warning_1.default)(config, logger);
+    const oauth = buildOAuthMiddlewares(config, logger);
+    const aiMiddlewares = buildAiMiddlewares(config, oauth, logger);
+    const agentMiddlewares = buildAgentMiddlewares(config, logger, oauth, aiMiddlewares);
+    const hasAgentEdge = agentMiddlewares.length > 0;
+    const agentErrorMiddleware = hasAgentEdge ? [agentScoped((0, error_middleware_1.default)({ logger }))] : [];
+    const agentJsonOnlyGuard = hasAgentEdge ? [agentScoped(createJsonOnlyGuard())] : [];
+    const middlewares = [
+        (0, version_header_middleware_1.default)(version_1.default),
+        (0, health_route_1.default)({ config, version: version_1.default }),
+        (0, cors_middleware_1.default)({ allowedOrigins: config.allowedOrigins, logger }),
+        ...agentErrorMiddleware,
+        ...agentJsonOnlyGuard,
+        createBodyParser(aiMiddlewares.length > 0),
+        ...oauth.middlewares,
+        // Outside the agent-scoped chain on purpose: the viewer is a public page, the document it fetches
+        // is not. Gated on the edge being mounted too, like the error middleware above: with no agent
+        // chain there is no document to fetch, and the page would only ever reach a bare Koa 404.
+        (0, docs_routes_1.default)({
+            enabled: config.openapiEnabled && agentMiddlewares.length > 0,
+            documentPath: openapi_routes_1.OPENAPI_PATH,
+            logger,
+        }),
+        ...agentMiddlewares,
+    ];
+    const app = new koa_1.default();
+    for (const middleware of middlewares)
+        app.use(middleware);
+    return { callback: app.callback() };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVpbGQtYmZmLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL2J1aWxkLWJmZi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQXdJQSxnREFlQztBQXNKRCxrREFFQztBQWtJRCwyQkEwQ0M7QUFqZEQsZ0RBQTZDO0FBQzdDLDhDQUFzQjtBQUV0QixpR0FBNkU7QUFDN0UsK0VBQTREO0FBQzVELG9FQUEyRDtBQUMzRCw2REFBOEQ7QUFDOUQsMkVBQWlEO0FBQ2pELGtGQUFxRjtBQUNyRiw0RkFBd0U7QUFDeEUsOEVBQW9EO0FBQ3BELHNGQUFrRTtBQUNsRSw0RUFBeUQ7QUFDekQsdUZBQW1FO0FBQ25FLDZGQUFnRTtBQUNoRSxvR0FBZ0Y7QUFDaEYsNkVBQTBEO0FBQzFELDJFQUFpRTtBQUNqRSwyRkFBdUU7QUFDdkUscUVBQWtEO0FBQ2xELDBEQUEyRTtBQUMzRSxnRUFBOEQ7QUFDOUQsK0VBQTREO0FBQzVELHVFQUFvRDtBQUNwRCxpR0FBNkU7QUFDN0UseUVBQW1HO0FBQ25HLHdGQUE4RDtBQUM5RCx3RUFBcUQ7QUFDckQsMEVBQStEO0FBQy9ELHdFQUFxRDtBQUNyRCwyRUFBNkU7QUFDN0Usd0ZBQStEO0FBQy9ELDBGQUFpRTtBQUNqRSxnSEFBNEY7QUFDNUYseUVBQWtEO0FBQ2xELCtGQUEyRTtBQUMzRSx1RkFBNkQ7QUFDN0QseUZBQXNFO0FBQ3RFLHdEQUFnQztBQWNoQyxNQUFNLG1CQUFtQixHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxDQUFDO0FBRXpDLE1BQU0sWUFBWSxHQUFHLElBQUksR0FBRyxDQUFDLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0FBRXZELE1BQU0sZUFBZSxHQUFHLENBQUMsa0JBQWtCLEVBQUUsb0JBQW9CLENBQUMsQ0FBQztBQUVuRSxTQUFTLE9BQU8sQ0FBQyxHQUE4QjtJQUM3QyxPQUFPLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxNQUFNLElBQUksQ0FBQyxDQUFDLEdBQUcsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxHQUFHLENBQUMsbUJBQW1CLENBQUMsS0FBSyxFQUFFLENBQUM7QUFDOUUsQ0FBQztBQUVELFNBQVMsbUJBQW1CO0lBQzFCLE9BQU8sS0FBSyxVQUFVLGFBQWEsQ0FBQyxHQUFHLEVBQUUsSUFBSTtRQUMzQyxJQUFJLFlBQVksQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxJQUFJLE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsZUFBZSxDQUFDLEVBQUUsQ0FBQztZQUM3RSxNQUFNLElBQUEscUNBQW9CLEdBQUUsQ0FBQztRQUMvQixDQUFDO1FBRUQsTUFBTSxJQUFJLEVBQUUsQ0FBQztJQUNmLENBQUMsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLFdBQVcsQ0FBQyxVQUFzQjtJQUN6QyxPQUFPLEtBQUssVUFBVSxNQUFNLENBQUMsR0FBRyxFQUFFLElBQUk7UUFDcEMsSUFBSSxDQUFDLElBQUEsb0JBQVcsRUFBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUMzQixNQUFNLElBQUksRUFBRSxDQUFDO1lBRWIsT0FBTztRQUNULENBQUM7UUFFRCxNQUFNLFVBQVUsQ0FBQyxHQUFHLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDOUIsQ0FBQyxDQUFDO0FBQ0osQ0FBQztBQUVELFNBQVMsZ0JBQWdCLENBQUMsZUFBd0I7SUFDaEQsTUFBTSxXQUFXLEdBQUcsRUFBRSxJQUFJLEVBQUUsZUFBZSxFQUFFLENBQUM7SUFDOUMsTUFBTSxTQUFTLEdBQUcsSUFBQSx1QkFBVSxFQUFDLEVBQUUsU0FBUyxFQUFFLG9CQUFVLEVBQUUsV0FBVyxFQUFFLENBQUMsQ0FBQztJQUVyRSxJQUFJLENBQUMsZUFBZTtRQUFFLE9BQU8sU0FBUyxDQUFDO0lBRXZDLE1BQU0sV0FBVyxHQUFHLElBQUEsdUJBQVUsRUFBQztRQUM3QixTQUFTLEVBQUUsMEJBQWE7UUFDeEIsV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDO1FBQ3JCLFdBQVc7S0FDWixDQUFDLENBQUM7SUFFSCxPQUFPLEtBQUssVUFBVSxrQkFBa0IsQ0FBQyxHQUFHLEVBQUUsSUFBSTtRQUNoRCxJQUFJLEdBQUcsQ0FBQyxJQUFJLEtBQUsscUNBQWMsRUFBRSxDQUFDO1lBQ2hDLE1BQU0sV0FBVyxDQUFDLEdBQUcsRUFBRSxJQUFJLENBQUMsQ0FBQztZQUU3QixPQUFPO1FBQ1QsQ0FBQztRQUVELE1BQU0sU0FBUyxDQUFDLEdBQUcsRUFBRSxJQUFJLENBQUMsQ0FBQztJQUM3QixDQUFDLENBQUM7QUFDSixDQUFDO0FBRUQsU0FBUyw0QkFBNEIsQ0FBQyxNQUFjO0lBQ2xELE9BQU8sS0FBSyxVQUFVLHNCQUFzQixDQUFDLEdBQUcsRUFBRSxJQUFJO1FBQ3BELElBQUksR0FBRyxDQUFDLEtBQUssQ0FBQyxRQUFRLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDckMsTUFBTSxDQUFDLE9BQU8sRUFBRSwyREFBMkQsQ0FBQyxDQUFDO1lBQzdFLE1BQU0sSUFBQSw2QkFBWSxFQUFDLG9DQUFvQyxDQUFDLENBQUM7UUFDM0QsQ0FBQztRQUVELE1BQU0sSUFBSSxFQUFFLENBQUM7SUFDZixDQUFDLENBQUM7QUFDSixDQUFDO0FBVUQsU0FBZ0Isa0JBQWtCLENBQUMsTUFBaUI7SUFDbEQsTUFBTSxFQUFFLGVBQWUsRUFBRSxlQUFlLEVBQUUsWUFBWSxFQUFFLGdCQUFnQixFQUFFLGtCQUFrQixFQUFFLEdBQzVGLE1BQU0sQ0FBQztJQUVULElBQ0UsZUFBZTtRQUNmLGVBQWU7UUFDZixZQUFZO1FBQ1osZ0JBQWdCO1FBQ2hCLGtCQUFrQixFQUNsQixDQUFDO1FBQ0QsT0FBTyxFQUFFLGVBQWUsRUFBRSxlQUFlLEVBQUUsWUFBWSxFQUFFLGdCQUFnQixFQUFFLGtCQUFrQixFQUFFLENBQUM7SUFDbEcsQ0FBQztJQUVELE9BQU8sU0FBUyxDQUFDO0FBQ25CLENBQUM7QUFjRCxTQUFTLHFCQUFxQixDQUFDLE1BQWlCLEVBQUUsTUFBYztJQUM5RCxNQUFNLFdBQVcsR0FBRyxrQkFBa0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUUvQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDakIsTUFBTSxDQUFDLE1BQU0sRUFBRSwwREFBMEQsQ0FBQyxDQUFDO1FBRTNFLE9BQU8sRUFBRSxXQUFXLEVBQUUsRUFBRSxFQUFFLENBQUM7SUFDN0IsQ0FBQztJQUVELE1BQU0sRUFBRSxlQUFlLEVBQUUsZUFBZSxFQUFFLFlBQVksRUFBRSxnQkFBZ0IsRUFBRSxrQkFBa0IsRUFBRSxHQUM1RixXQUFXLENBQUM7SUFFZCxNQUFNLFlBQVksR0FBRyxJQUFJLDhCQUFrQixDQUFDLEVBQUUsZUFBZSxFQUFFLFNBQVMsRUFBRSxlQUFlLEVBQUUsQ0FBQyxDQUFDO0lBQzdGLE1BQU0sb0JBQW9CLEdBQUcsSUFBQSx3QkFBMkIsRUFBQyxZQUFZLENBQUMsQ0FBQztJQUV2RSxNQUFNLFlBQVksR0FBRyxJQUFBLHVCQUEwQixFQUFDO1FBQzlDLE1BQU0sRUFBRSxJQUFBLHNCQUFpQixFQUFDLGtCQUFrQixDQUFDO1FBQzdDLEdBQUcsRUFBRSxHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO1FBQ3JCLGlCQUFpQixFQUFFLG1CQUFtQjtLQUN2QyxDQUFDLENBQUM7SUFFSCxNQUFNLFdBQVcsR0FBRyxJQUFBLHNCQUFpQixFQUFDO1FBQ3BDLFlBQVk7UUFDWixZQUFZO1FBQ1osWUFBWTtRQUNaLFVBQVUsRUFBRSxnQkFBZ0I7UUFDNUIsb0JBQW9CO1FBQ3BCLE1BQU07S0FDUCxDQUFDLENBQUM7SUFFSCxPQUFPO1FBQ0wsV0FBVyxFQUFFLENBQUMsV0FBVyxDQUFDO1FBQzFCLG9CQUFvQjtRQUNwQixPQUFPLEVBQUUsRUFBRSxLQUFLLEVBQUUsWUFBWSxFQUFFLFlBQVksRUFBRSxlQUFlLEVBQUU7S0FDaEUsQ0FBQztBQUNKLENBQUM7QUFRRCxTQUFTLG1CQUFtQixDQUFDLE1BQWlCO0lBQzVDLE1BQU0sRUFBRSxlQUFlLEVBQUUsZUFBZSxFQUFFLGdCQUFnQixFQUFFLEdBQUcsTUFBTSxDQUFDO0lBRXRFLElBQUksZUFBZSxJQUFJLGVBQWUsSUFBSSxnQkFBZ0IsRUFBRSxDQUFDO1FBQzNELE9BQU8sRUFBRSxlQUFlLEVBQUUsZUFBZSxFQUFFLGdCQUFnQixFQUFFLENBQUM7SUFDaEUsQ0FBQztJQUVELE9BQU8sU0FBUyxDQUFDO0FBQ25CLENBQUM7QUFFRCxTQUFTLHFCQUFxQixDQUFDLE1BQWlCLEVBQUUsTUFBYztJQUM5RCxNQUFNLFlBQVksR0FBRyxtQkFBbUIsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUVqRCxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDbEIsTUFBTSxDQUFDLE1BQU0sRUFBRSwwREFBMEQsQ0FBQyxDQUFDO1FBRTNFLE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7SUFFRCxNQUFNLE1BQU0sR0FBRyxJQUFJLHdCQUFZLENBQUM7UUFDOUIsZUFBZSxFQUFFLFlBQVksQ0FBQyxlQUFlO1FBQzdDLFNBQVMsRUFBRSxZQUFZLENBQUMsZUFBZTtLQUN4QyxDQUFDLENBQUM7SUFDSCxNQUFNLEtBQUssR0FBRyxJQUFBLHVCQUFrQixFQUFDLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDNUQsTUFBTSxhQUFhLEdBQUcsSUFBQSwrQkFBeUIsRUFBQztRQUM5QyxNQUFNO1FBQ04sS0FBSztRQUNMLFVBQVUsRUFBRSxZQUFZLENBQUMsZ0JBQWdCO0tBQzFDLENBQUMsQ0FBQztJQUVILE9BQU8sSUFBQSw0QkFBc0IsRUFBQyxFQUFFLGFBQWEsRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO0FBQzNELENBQUM7QUFPRDs7OztHQUlHO0FBQ0gsU0FBUyxzQkFBc0IsQ0FDN0IsTUFBaUIsRUFDakIsTUFBYyxFQUNkLE9BQWlCO0lBRWpCLE1BQU0sWUFBWSxHQUFHLG1CQUFtQixDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBRWpELElBQUksQ0FBQyxZQUFZO1FBQUUsT0FBTyxTQUFTLENBQUM7SUFFcEMsTUFBTSxFQUFFLEtBQUssRUFBRSxHQUFHLElBQUEsMkJBQWUsRUFBQztRQUNoQyxlQUFlLEVBQUUsWUFBWSxDQUFDLGVBQWU7UUFDN0MsU0FBUyxFQUFFLFlBQVksQ0FBQyxlQUFlO1FBQ3ZDLE1BQU07UUFDTixPQUFPO0tBQ1IsQ0FBQyxDQUFDO0lBRUgsT0FBTyxFQUFFLEtBQUssRUFBRSxZQUFZLEVBQUUsQ0FBQztBQUNqQyxDQUFDO0FBRUQ7Ozs7O0dBS0c7QUFDSCxTQUFTLGNBQWMsQ0FDckIsTUFBbUMsRUFDbkMsTUFBaUIsRUFDakIsTUFBYztJQUVkLElBQUksQ0FBQyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUTtRQUFFLE9BQU8sU0FBUyxDQUFDO0lBRWxELE9BQU87UUFDTCxLQUFLLEVBQUUsTUFBTSxDQUFDLEtBQUs7UUFDbkIsU0FBUyxFQUFFLElBQUEscUNBQW1CLEVBQUM7WUFDN0IsUUFBUSxFQUFFLE1BQU0sQ0FBQyxRQUFRO1lBQ3pCLFNBQVMsRUFBRSxNQUFNLENBQUMsY0FBYztTQUNqQyxDQUFDO1FBQ0YsTUFBTTtLQUNQLENBQUM7QUFDSixDQUFDO0FBRUQ7Ozs7O0dBS0c7QUFDSCxNQUFNLFVBQVUsR0FBWSxFQUFFLFNBQVMsRUFBRSxHQUFHLEVBQUUsQ0FBQyxTQUFTLEVBQUUsS0FBSyxFQUFFLEdBQUcsRUFBRSxDQUFDLFNBQVMsRUFBRSxDQUFDO0FBRW5GLFNBQWdCLG1CQUFtQixDQUFDLE1BQWlCLEVBQUUsTUFBYztJQUNuRSxPQUFPLGNBQWMsQ0FBQyxzQkFBc0IsQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLFVBQVUsQ0FBQyxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsQ0FBQztBQUM1RixDQUFDO0FBRUQsaUZBQWlGO0FBQ2pGLFNBQVMsMEJBQTBCLENBQ2pDLE1BQW1DLEVBQ25DLE1BQWlCLEVBQ2pCLE1BQWM7SUFFZCxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDWixNQUFNLENBQ0osTUFBTSxFQUNOLHdIQUF3SCxDQUN6SCxDQUFDO1FBRUYsT0FBTyxDQUFDLElBQUEsb0JBQXlCLEdBQUUsQ0FBQyxDQUFDO0lBQ3ZDLENBQUM7SUFFRCxNQUFNLEVBQUUsS0FBSyxFQUFFLFlBQVksRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUN2QyxNQUFNLEVBQUUsUUFBUSxFQUFFLGNBQWMsRUFBRSxTQUFTLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFFdkQsTUFBTSxxQkFBcUIsR0FBRyxJQUFBLHVDQUFpQyxFQUFDO1FBQzlELEtBQUs7UUFDTCxNQUFNLEVBQUUsSUFBSSw0QkFBaUIsQ0FBQztZQUM1QixlQUFlLEVBQUUsWUFBWSxDQUFDLGVBQWU7WUFDN0MsU0FBUyxFQUFFLFlBQVksQ0FBQyxlQUFlO1NBQ3hDLENBQUM7UUFDRixLQUFLLEVBQUUsSUFBSSwyQkFBZ0IsRUFBRTtRQUM3QixNQUFNO0tBQ1AsQ0FBQyxDQUFDO0lBRUgsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO1FBQ2QsTUFBTSxDQUFDLE1BQU0sRUFBRSwwREFBMEQsQ0FBQyxDQUFDO1FBRTNFLE9BQU8sQ0FBQyxxQkFBcUIsRUFBRSxJQUFBLG9CQUF5QixHQUFFLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBRUQsTUFBTSxTQUFTLEdBQUcsSUFBQSxxQ0FBbUIsRUFBQyxFQUFFLFFBQVEsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBRS9ELE9BQU87UUFDTCxxQkFBcUI7UUFDckIsSUFBQSxnQ0FBMEIsRUFBQyxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFLENBQUM7UUFDeEQsSUFBQSxrQ0FBNEIsRUFBQyxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFLENBQUM7S0FDM0QsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLGtCQUFrQixDQUFDLE1BQWlCLEVBQUUsS0FBZ0IsRUFBRSxNQUFjO0lBQzdFLE1BQU0sRUFBRSxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsR0FBRyxLQUFLLENBQUM7SUFFaEQsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ2IsTUFBTSxDQUFDLE1BQU0sRUFBRSxrRUFBa0UsQ0FBQyxDQUFDO1FBRW5GLE9BQU8sRUFBRSxDQUFDO0lBQ1osQ0FBQztJQUVELE1BQU0sTUFBTSxHQUFHLElBQUkseUJBQWEsQ0FBQztRQUMvQixlQUFlLEVBQUUsT0FBTyxDQUFDLGVBQWU7UUFDeEMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxXQUFXO0tBQzlCLENBQUMsQ0FBQztJQUVILE9BQU87UUFDTCxJQUFBLDhCQUF3QixFQUFDO1lBQ3ZCLE1BQU07WUFDTixZQUFZLEVBQUUsT0FBTyxDQUFDLEtBQUs7WUFDM0IsWUFBWSxFQUFFLE9BQU8sQ0FBQyxZQUFZO1lBQ2xDLG9CQUFvQjtZQUNwQixNQUFNO1NBQ1AsQ0FBQztLQUNILENBQUM7QUFDSixDQUFDO0FBRUQsU0FBUyxxQkFBcUIsQ0FDNUIsTUFBaUIsRUFDakIsTUFBYyxFQUNkLEtBQWdCLEVBQ2hCLGFBQTJCO0lBRTNCLE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxlQUFlLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFFckQsSUFBSSxDQUFDLGdCQUFnQixFQUFFLENBQUM7UUFDdEIsTUFBTSxDQUFDLE1BQU0sRUFBRSxvREFBb0QsQ0FBQyxDQUFDO1FBRXJFLE9BQU8sRUFBRSxDQUFDO0lBQ1osQ0FBQztJQUVELE1BQU0sVUFBVSxHQUFHLHFCQUFxQixDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsSUFBSSw0QkFBNEIsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNqRyxtR0FBbUc7SUFDbkcsMkZBQTJGO0lBQzNGLE1BQU0sTUFBTSxHQUFHLHNCQUFzQixDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsQ0FBQztJQUN0RCxNQUFNLE1BQU0sR0FBRyxjQUFjLENBQUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsQ0FBQztJQUV0RCxNQUFNLEtBQUssR0FBaUI7UUFDMUIsSUFBQSw4QkFBd0IsRUFBQyxFQUFFLFVBQVUsRUFBRSxnQkFBZ0IsRUFBRSxDQUFDO1FBQzFELFVBQVU7UUFDVixJQUFBLCtCQUF5QixFQUFDO1lBQ3hCLFdBQVcsRUFBRSxNQUFNLENBQUMsb0JBQW9CO1lBQ3hDLFFBQVEsRUFBRSxNQUFNLENBQUMsaUJBQWlCO1NBQ25DLENBQUM7UUFDRixJQUFBLHdCQUE0QixFQUFDLEVBQUUsTUFBTSxFQUFFLG9CQUFvQixFQUFFLE1BQU0sQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUNyRixJQUFBLHdCQUFtQixFQUFDO1lBQ2xCLE9BQU8sRUFBUCxpQkFBTztZQUNQLE9BQU8sRUFBRSxNQUFNLENBQUMsY0FBYztZQUM5QixNQUFNO1lBQ04sZUFBZSxFQUFFLGFBQWEsQ0FBQyxNQUFNLEdBQUcsQ0FBQztZQUN6QyxTQUFTLEVBQUUsTUFBTSxDQUFDLFNBQVM7U0FDNUIsQ0FBQztRQUNGLEdBQUcsQ0FBQyxNQUFNO1lBQ1IsQ0FBQyxDQUFDO2dCQUNFLElBQUEsbUNBQTZCLEVBQUM7b0JBQzVCLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSztvQkFDbkIsb0JBQW9CLEVBQUUsS0FBSyxDQUFDLG9CQUFvQjt3QkFDOUMsQ0FBQyxDQUFDLElBQUEsNkNBQTRCLEVBQUMsS0FBSyxDQUFDLG9CQUFvQixFQUFFLE1BQU0sQ0FBQzt3QkFDbEUsQ0FBQyxDQUFDLFNBQVM7aUJBQ2QsQ0FBQzthQUNIO1lBQ0gsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNQLEdBQUcsYUFBYTtRQUNoQixJQUFBLDZCQUF3QixFQUFDLEVBQUUsZUFBZSxFQUFFLENBQUM7UUFDN0MsR0FBRywwQkFBMEIsQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQztLQUN0RCxDQUFDO0lBRUYsT0FBTyxLQUFLLENBQUMsR0FBRyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0FBQ2hDLENBQUM7QUFFRDs7Ozs7O0dBTUc7QUFDWSxLQUFLLFVBQVUsUUFBUSxDQUFDLEVBQ3JDLE1BQU0sRUFDTixNQUFNLEdBQUcsSUFBQSx3QkFBbUIsR0FBRSxHQUNkO0lBQ2hCLElBQUksTUFBTSxDQUFDLHFCQUFxQixDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUM1QyxNQUFNLENBQUMsTUFBTSxFQUFFLGdEQUFnRCxFQUFFO1lBQy9ELE9BQU8sRUFBRSxNQUFNLENBQUMscUJBQXFCO1NBQ3RDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxJQUFBLGdDQUFpQixFQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsQ0FBQztJQUVsQyxNQUFNLEtBQUssR0FBRyxxQkFBcUIsQ0FBQyxNQUFNLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDcEQsTUFBTSxhQUFhLEdBQUcsa0JBQWtCLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQztJQUNoRSxNQUFNLGdCQUFnQixHQUFHLHFCQUFxQixDQUFDLE1BQU0sRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLGFBQWEsQ0FBQyxDQUFDO0lBQ3JGLE1BQU0sWUFBWSxHQUFHLGdCQUFnQixDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUM7SUFDakQsTUFBTSxvQkFBb0IsR0FBRyxZQUFZLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLElBQUEsMEJBQXFCLEVBQUMsRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ2xHLE1BQU0sa0JBQWtCLEdBQUcsWUFBWSxDQUFDLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxtQkFBbUIsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBRXBGLE1BQU0sV0FBVyxHQUFHO1FBQ2xCLElBQUEsbUNBQTZCLEVBQUMsaUJBQU8sQ0FBQztRQUN0QyxJQUFBLHNCQUFpQixFQUFDLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBUCxpQkFBTyxFQUFFLENBQUM7UUFDdEMsSUFBQSx5QkFBb0IsRUFBQyxFQUFFLGNBQWMsRUFBRSxNQUFNLENBQUMsY0FBYyxFQUFFLE1BQU0sRUFBRSxDQUFDO1FBQ3ZFLEdBQUcsb0JBQW9CO1FBQ3ZCLEdBQUcsa0JBQWtCO1FBQ3JCLGdCQUFnQixDQUFDLGFBQWEsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDO1FBQzFDLEdBQUcsS0FBSyxDQUFDLFdBQVc7UUFDcEIsa0dBQWtHO1FBQ2xHLDhGQUE4RjtRQUM5RiwwRkFBMEY7UUFDMUYsSUFBQSxxQkFBZ0IsRUFBQztZQUNmLE9BQU8sRUFBRSxNQUFNLENBQUMsY0FBYyxJQUFJLGdCQUFnQixDQUFDLE1BQU0sR0FBRyxDQUFDO1lBQzdELFlBQVksRUFBRSw2QkFBWTtZQUMxQixNQUFNO1NBQ1AsQ0FBQztRQUNGLEdBQUcsZ0JBQWdCO0tBQ3BCLENBQUM7SUFFRixNQUFNLEdBQUcsR0FBRyxJQUFJLGFBQUcsRUFBRSxDQUFDO0lBQ3RCLEtBQUssTUFBTSxVQUFVLElBQUksV0FBVztRQUFFLEdBQUcsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUM7SUFFMUQsT0FBTyxFQUFFLFFBQVEsRUFBRSxHQUFHLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQztBQUN0QyxDQUFDIn0=

package/dist/cli-core.d.ts

@@ -1,17 +1,5 @@
-import type { BFFConfig } from './config/env-config';
-import type { UnfoldSource } from './openapi/unfolded-document';
 import type { Logger } from './ports/logger-port';
 import BFFHttpServer from './http/bff-http-server';
-interface ResolvedOAuthConfig {
-    forestServerUrl: string;
-    forestEnvSecret: string;
-    forestAppUrl: string;
-    forestAuthSecret: string;
-    tokenEncryptionKey: string;
-}
-export declare function resolveOAuthConfig(config: BFFConfig): ResolvedOAuthConfig | undefined;
-export declare function resolveUnfoldSource(config: BFFConfig, logger: Logger): UnfoldSource | undefined;
 export default function runCli(env: NodeJS.ProcessEnv, logger?: Logger): Promise<BFFHttpServer>;
 export declare function reportFatalError(err: unknown): void;
-export {};
 //# sourceMappingURL=cli-core.d.ts.map